net: switch importing msghdr from userland to {compat_,}import_iovec()
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
408eccce 75#include <linux/ptp_classify.h>
1da177e4
LT
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
1da177e4
LT
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
3ec3b2fb 86#include <linux/audit.h>
d86b5e0e 87#include <linux/wireless.h>
1b8d7ae4 88#include <linux/nsproxy.h>
1fd7317d 89#include <linux/magic.h>
5a0e3ad6 90#include <linux/slab.h>
600e1779 91#include <linux/xattr.h>
1da177e4
LT
92
93#include <asm/uaccess.h>
94#include <asm/unistd.h>
95
96#include <net/compat.h>
87de87d5 97#include <net/wext.h>
f8451725 98#include <net/cls_cgroup.h>
1da177e4
LT
99
100#include <net/sock.h>
101#include <linux/netfilter.h>
102
6b96018b
AB
103#include <linux/if_tun.h>
104#include <linux/ipv6_route.h>
105#include <linux/route.h>
6b96018b
AB
106#include <linux/sockios.h>
107#include <linux/atalk.h>
076bb0c8 108#include <net/busy_poll.h>
f24b9be5 109#include <linux/errqueue.h>
06021292 110
e0d1095a 111#ifdef CONFIG_NET_RX_BUSY_POLL
64b0dc51
ET
112unsigned int sysctl_net_busy_read __read_mostly;
113unsigned int sysctl_net_busy_poll __read_mostly;
06021292 114#endif
6b96018b 115
8ae5e030
AV
116static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
117static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
89bddce5 118static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
119
120static int sock_close(struct inode *inode, struct file *file);
121static unsigned int sock_poll(struct file *file,
122 struct poll_table_struct *wait);
89bddce5 123static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
124#ifdef CONFIG_COMPAT
125static long compat_sock_ioctl(struct file *file,
89bddce5 126 unsigned int cmd, unsigned long arg);
89bbfc95 127#endif
1da177e4 128static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
129static ssize_t sock_sendpage(struct file *file, struct page *page,
130 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 131static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 132 struct pipe_inode_info *pipe, size_t len,
9c55e01c 133 unsigned int flags);
1da177e4 134
1da177e4
LT
135/*
136 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
137 * in the operation structures but are done directly via the socketcall() multiplexor.
138 */
139
da7071d7 140static const struct file_operations socket_file_ops = {
1da177e4
LT
141 .owner = THIS_MODULE,
142 .llseek = no_llseek,
8ae5e030
AV
143 .read = new_sync_read,
144 .write = new_sync_write,
145 .read_iter = sock_read_iter,
146 .write_iter = sock_write_iter,
1da177e4
LT
147 .poll = sock_poll,
148 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
149#ifdef CONFIG_COMPAT
150 .compat_ioctl = compat_sock_ioctl,
151#endif
1da177e4 152 .mmap = sock_mmap,
1da177e4
LT
153 .release = sock_close,
154 .fasync = sock_fasync,
5274f052
JA
155 .sendpage = sock_sendpage,
156 .splice_write = generic_splice_sendpage,
9c55e01c 157 .splice_read = sock_splice_read,
1da177e4
LT
158};
159
160/*
161 * The protocol list. Each protocol is registered in here.
162 */
163
1da177e4 164static DEFINE_SPINLOCK(net_family_lock);
190683a9 165static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 166
1da177e4
LT
167/*
168 * Statistics counters of the socket lists
169 */
170
c6d409cf 171static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
172
173/*
89bddce5
SH
174 * Support routines.
175 * Move socket addresses back and forth across the kernel/user
176 * divide and look after the messy bits.
1da177e4
LT
177 */
178
1da177e4
LT
179/**
180 * move_addr_to_kernel - copy a socket address into kernel space
181 * @uaddr: Address in user space
182 * @kaddr: Address in kernel space
183 * @ulen: Length in user space
184 *
185 * The address is copied into kernel space. If the provided address is
186 * too long an error code of -EINVAL is returned. If the copy gives
187 * invalid addresses -EFAULT is returned. On a success 0 is returned.
188 */
189
43db362d 190int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 191{
230b1839 192 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 193 return -EINVAL;
89bddce5 194 if (ulen == 0)
1da177e4 195 return 0;
89bddce5 196 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 197 return -EFAULT;
3ec3b2fb 198 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
199}
200
201/**
202 * move_addr_to_user - copy an address to user space
203 * @kaddr: kernel space address
204 * @klen: length of address in kernel
205 * @uaddr: user space address
206 * @ulen: pointer to user length field
207 *
208 * The value pointed to by ulen on entry is the buffer length available.
209 * This is overwritten with the buffer space used. -EINVAL is returned
210 * if an overlong buffer is specified or a negative buffer size. -EFAULT
211 * is returned if either the buffer or the length field are not
212 * accessible.
213 * After copying the data up to the limit the user specifies, the true
214 * length of the data is written over the length limit the user
215 * specified. Zero is returned for a success.
216 */
89bddce5 217
43db362d 218static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 219 void __user *uaddr, int __user *ulen)
1da177e4
LT
220{
221 int err;
222 int len;
223
68c6beb3 224 BUG_ON(klen > sizeof(struct sockaddr_storage));
89bddce5
SH
225 err = get_user(len, ulen);
226 if (err)
1da177e4 227 return err;
89bddce5
SH
228 if (len > klen)
229 len = klen;
68c6beb3 230 if (len < 0)
1da177e4 231 return -EINVAL;
89bddce5 232 if (len) {
d6fe3945
SG
233 if (audit_sockaddr(klen, kaddr))
234 return -ENOMEM;
89bddce5 235 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
236 return -EFAULT;
237 }
238 /*
89bddce5
SH
239 * "fromlen shall refer to the value before truncation.."
240 * 1003.1g
1da177e4
LT
241 */
242 return __put_user(klen, ulen);
243}
244
e18b890b 245static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
246
247static struct inode *sock_alloc_inode(struct super_block *sb)
248{
249 struct socket_alloc *ei;
eaefd110 250 struct socket_wq *wq;
89bddce5 251
e94b1766 252 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
253 if (!ei)
254 return NULL;
eaefd110
ED
255 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
256 if (!wq) {
43815482
ED
257 kmem_cache_free(sock_inode_cachep, ei);
258 return NULL;
259 }
eaefd110
ED
260 init_waitqueue_head(&wq->wait);
261 wq->fasync_list = NULL;
262 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 263
1da177e4
LT
264 ei->socket.state = SS_UNCONNECTED;
265 ei->socket.flags = 0;
266 ei->socket.ops = NULL;
267 ei->socket.sk = NULL;
268 ei->socket.file = NULL;
1da177e4
LT
269
270 return &ei->vfs_inode;
271}
272
273static void sock_destroy_inode(struct inode *inode)
274{
43815482 275 struct socket_alloc *ei;
eaefd110 276 struct socket_wq *wq;
43815482
ED
277
278 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 279 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 280 kfree_rcu(wq, rcu);
43815482 281 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
282}
283
51cc5068 284static void init_once(void *foo)
1da177e4 285{
89bddce5 286 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 287
a35afb83 288 inode_init_once(&ei->vfs_inode);
1da177e4 289}
89bddce5 290
1da177e4
LT
291static int init_inodecache(void)
292{
293 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
294 sizeof(struct socket_alloc),
295 0,
296 (SLAB_HWCACHE_ALIGN |
297 SLAB_RECLAIM_ACCOUNT |
298 SLAB_MEM_SPREAD),
20c2df83 299 init_once);
1da177e4
LT
300 if (sock_inode_cachep == NULL)
301 return -ENOMEM;
302 return 0;
303}
304
b87221de 305static const struct super_operations sockfs_ops = {
c6d409cf
ED
306 .alloc_inode = sock_alloc_inode,
307 .destroy_inode = sock_destroy_inode,
308 .statfs = simple_statfs,
1da177e4
LT
309};
310
c23fbb6b
ED
311/*
312 * sockfs_dname() is called from d_path().
313 */
314static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
315{
316 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
317 dentry->d_inode->i_ino);
318}
319
3ba13d17 320static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 321 .d_dname = sockfs_dname,
1da177e4
LT
322};
323
c74a1cbb
AV
324static struct dentry *sockfs_mount(struct file_system_type *fs_type,
325 int flags, const char *dev_name, void *data)
326{
327 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
328 &sockfs_dentry_operations, SOCKFS_MAGIC);
329}
330
331static struct vfsmount *sock_mnt __read_mostly;
332
333static struct file_system_type sock_fs_type = {
334 .name = "sockfs",
335 .mount = sockfs_mount,
336 .kill_sb = kill_anon_super,
337};
338
1da177e4
LT
339/*
340 * Obtains the first available file descriptor and sets it up for use.
341 *
39d8c1b6
DM
342 * These functions create file structures and maps them to fd space
343 * of the current process. On success it returns file descriptor
1da177e4
LT
344 * and file struct implicitly stored in sock->file.
345 * Note that another thread may close file descriptor before we return
346 * from this function. We use the fact that now we do not refer
347 * to socket after mapping. If one day we will need it, this
348 * function will increment ref. count on file by 1.
349 *
350 * In any case returned fd MAY BE not valid!
351 * This race condition is unavoidable
352 * with shared fd spaces, we cannot solve it inside kernel,
353 * but we take care of internal coherence yet.
354 */
355
aab174f0 356struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 357{
7cbe66b6 358 struct qstr name = { .name = "" };
2c48b9c4 359 struct path path;
7cbe66b6 360 struct file *file;
1da177e4 361
600e1779
MY
362 if (dname) {
363 name.name = dname;
364 name.len = strlen(name.name);
365 } else if (sock->sk) {
366 name.name = sock->sk->sk_prot_creator->name;
367 name.len = strlen(name.name);
368 }
4b936885 369 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
370 if (unlikely(!path.dentry))
371 return ERR_PTR(-ENOMEM);
2c48b9c4 372 path.mnt = mntget(sock_mnt);
39d8c1b6 373
2c48b9c4 374 d_instantiate(path.dentry, SOCK_INODE(sock));
39d8c1b6 375
2c48b9c4 376 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 377 &socket_file_ops);
39b65252 378 if (unlikely(IS_ERR(file))) {
cc3808f8 379 /* drop dentry, keep inode */
7de9c6ee 380 ihold(path.dentry->d_inode);
2c48b9c4 381 path_put(&path);
39b65252 382 return file;
cc3808f8
AV
383 }
384
385 sock->file = file;
77d27200 386 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 387 file->private_data = sock;
28407630 388 return file;
39d8c1b6 389}
56b31d1c 390EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 391
56b31d1c 392static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
393{
394 struct file *newfile;
28407630
AV
395 int fd = get_unused_fd_flags(flags);
396 if (unlikely(fd < 0))
397 return fd;
39d8c1b6 398
aab174f0 399 newfile = sock_alloc_file(sock, flags, NULL);
28407630 400 if (likely(!IS_ERR(newfile))) {
39d8c1b6 401 fd_install(fd, newfile);
28407630
AV
402 return fd;
403 }
7cbe66b6 404
28407630
AV
405 put_unused_fd(fd);
406 return PTR_ERR(newfile);
1da177e4
LT
407}
408
406a3c63 409struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 410{
6cb153ca
BL
411 if (file->f_op == &socket_file_ops)
412 return file->private_data; /* set in sock_map_fd */
413
23bb80d2
ED
414 *err = -ENOTSOCK;
415 return NULL;
6cb153ca 416}
406a3c63 417EXPORT_SYMBOL(sock_from_file);
6cb153ca 418
1da177e4 419/**
c6d409cf 420 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
421 * @fd: file handle
422 * @err: pointer to an error code return
423 *
424 * The file handle passed in is locked and the socket it is bound
425 * too is returned. If an error occurs the err pointer is overwritten
426 * with a negative errno code and NULL is returned. The function checks
427 * for both invalid handles and passing a handle which is not a socket.
428 *
429 * On a success the socket object pointer is returned.
430 */
431
432struct socket *sockfd_lookup(int fd, int *err)
433{
434 struct file *file;
1da177e4
LT
435 struct socket *sock;
436
89bddce5
SH
437 file = fget(fd);
438 if (!file) {
1da177e4
LT
439 *err = -EBADF;
440 return NULL;
441 }
89bddce5 442
6cb153ca
BL
443 sock = sock_from_file(file, err);
444 if (!sock)
1da177e4 445 fput(file);
6cb153ca
BL
446 return sock;
447}
c6d409cf 448EXPORT_SYMBOL(sockfd_lookup);
1da177e4 449
6cb153ca
BL
450static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
451{
00e188ef 452 struct fd f = fdget(fd);
6cb153ca
BL
453 struct socket *sock;
454
3672558c 455 *err = -EBADF;
00e188ef
AV
456 if (f.file) {
457 sock = sock_from_file(f.file, err);
458 if (likely(sock)) {
459 *fput_needed = f.flags;
6cb153ca 460 return sock;
00e188ef
AV
461 }
462 fdput(f);
1da177e4 463 }
6cb153ca 464 return NULL;
1da177e4
LT
465}
466
600e1779
MY
467#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
468#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
469#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
470static ssize_t sockfs_getxattr(struct dentry *dentry,
471 const char *name, void *value, size_t size)
472{
473 const char *proto_name;
474 size_t proto_size;
475 int error;
476
477 error = -ENODATA;
478 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
479 proto_name = dentry->d_name.name;
480 proto_size = strlen(proto_name);
481
482 if (value) {
483 error = -ERANGE;
484 if (proto_size + 1 > size)
485 goto out;
486
487 strncpy(value, proto_name, proto_size + 1);
488 }
489 error = proto_size + 1;
490 }
491
492out:
493 return error;
494}
495
496static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
497 size_t size)
498{
499 ssize_t len;
500 ssize_t used = 0;
501
502 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
503 if (len < 0)
504 return len;
505 used += len;
506 if (buffer) {
507 if (size < used)
508 return -ERANGE;
509 buffer += len;
510 }
511
512 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
513 used += len;
514 if (buffer) {
515 if (size < used)
516 return -ERANGE;
517 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
518 buffer += len;
519 }
520
521 return used;
522}
523
524static const struct inode_operations sockfs_inode_ops = {
525 .getxattr = sockfs_getxattr,
526 .listxattr = sockfs_listxattr,
527};
528
1da177e4
LT
529/**
530 * sock_alloc - allocate a socket
89bddce5 531 *
1da177e4
LT
532 * Allocate a new inode and socket object. The two are bound together
533 * and initialised. The socket is then returned. If we are out of inodes
534 * NULL is returned.
535 */
536
537static struct socket *sock_alloc(void)
538{
89bddce5
SH
539 struct inode *inode;
540 struct socket *sock;
1da177e4 541
a209dfc7 542 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
543 if (!inode)
544 return NULL;
545
546 sock = SOCKET_I(inode);
547
29a020d3 548 kmemcheck_annotate_bitfield(sock, type);
85fe4025 549 inode->i_ino = get_next_ino();
89bddce5 550 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
551 inode->i_uid = current_fsuid();
552 inode->i_gid = current_fsgid();
600e1779 553 inode->i_op = &sockfs_inode_ops;
1da177e4 554
19e8d69c 555 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
556 return sock;
557}
558
1da177e4
LT
559/**
560 * sock_release - close a socket
561 * @sock: socket to close
562 *
563 * The socket is released from the protocol stack if it has a release
564 * callback, and the inode is then released if the socket is bound to
89bddce5 565 * an inode not a file.
1da177e4 566 */
89bddce5 567
1da177e4
LT
568void sock_release(struct socket *sock)
569{
570 if (sock->ops) {
571 struct module *owner = sock->ops->owner;
572
573 sock->ops->release(sock);
574 sock->ops = NULL;
575 module_put(owner);
576 }
577
eaefd110 578 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
3410f22e 579 pr_err("%s: fasync list not empty!\n", __func__);
1da177e4 580
b09e786b
MP
581 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
582 return;
583
19e8d69c 584 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
585 if (!sock->file) {
586 iput(SOCK_INODE(sock));
587 return;
588 }
89bddce5 589 sock->file = NULL;
1da177e4 590}
c6d409cf 591EXPORT_SYMBOL(sock_release);
1da177e4 592
67cc0d40 593void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags)
20d49473 594{
140c55d4
ED
595 u8 flags = *tx_flags;
596
b9f40e21 597 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
140c55d4
ED
598 flags |= SKBTX_HW_TSTAMP;
599
b9f40e21 600 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
140c55d4
ED
601 flags |= SKBTX_SW_TSTAMP;
602
e7fd2885 603 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)
140c55d4
ED
604 flags |= SKBTX_SCHED_TSTAMP;
605
e1c8a607 606 if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)
140c55d4 607 flags |= SKBTX_ACK_TSTAMP;
e7fd2885 608
140c55d4 609 *tx_flags = flags;
20d49473 610}
67cc0d40 611EXPORT_SYMBOL(__sock_tx_timestamp);
20d49473 612
1b784140
YX
613static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg,
614 size_t size)
1da177e4 615{
1b784140 616 return sock->ops->sendmsg(sock, msg, size);
1da177e4
LT
617}
618
1b784140 619int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
620{
621 int err = security_socket_sendmsg(sock, msg, size);
622
1b784140 623 return err ?: sock_sendmsg_nosec(sock, msg, size);
0cf00c6f 624}
c6d409cf 625EXPORT_SYMBOL(sock_sendmsg);
1da177e4
LT
626
627int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
628 struct kvec *vec, size_t num, size_t size)
629{
630 mm_segment_t oldfs = get_fs();
631 int result;
632
633 set_fs(KERNEL_DS);
634 /*
635 * the following is safe, since for compiler definitions of kvec and
636 * iovec are identical, yielding the same in-core layout and alignment
637 */
c0371da6 638 iov_iter_init(&msg->msg_iter, WRITE, (struct iovec *)vec, num, size);
1da177e4
LT
639 result = sock_sendmsg(sock, msg, size);
640 set_fs(oldfs);
641 return result;
642}
c6d409cf 643EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 644
92f37fd2
ED
645/*
646 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
647 */
648void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
649 struct sk_buff *skb)
650{
20d49473 651 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
f24b9be5 652 struct scm_timestamping tss;
20d49473
PO
653 int empty = 1;
654 struct skb_shared_hwtstamps *shhwtstamps =
655 skb_hwtstamps(skb);
656
657 /* Race occurred between timestamp enabling and packet
658 receiving. Fill in the current time for now. */
659 if (need_software_tstamp && skb->tstamp.tv64 == 0)
660 __net_timestamp(skb);
661
662 if (need_software_tstamp) {
663 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
664 struct timeval tv;
665 skb_get_timestamp(skb, &tv);
666 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
667 sizeof(tv), &tv);
668 } else {
f24b9be5
WB
669 struct timespec ts;
670 skb_get_timestampns(skb, &ts);
20d49473 671 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
f24b9be5 672 sizeof(ts), &ts);
20d49473
PO
673 }
674 }
675
f24b9be5 676 memset(&tss, 0, sizeof(tss));
c199105d 677 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
f24b9be5 678 ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
20d49473 679 empty = 0;
4d276eb6 680 if (shhwtstamps &&
b9f40e21 681 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
f24b9be5 682 ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
4d276eb6 683 empty = 0;
20d49473
PO
684 if (!empty)
685 put_cmsg(msg, SOL_SOCKET,
f24b9be5 686 SCM_TIMESTAMPING, sizeof(tss), &tss);
92f37fd2 687}
7c81fd8b
ACM
688EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
689
6e3e939f
JB
690void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
691 struct sk_buff *skb)
692{
693 int ack;
694
695 if (!sock_flag(sk, SOCK_WIFI_STATUS))
696 return;
697 if (!skb->wifi_acked_valid)
698 return;
699
700 ack = skb->wifi_acked;
701
702 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
703}
704EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
705
11165f14 706static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
707 struct sk_buff *skb)
3b885787 708{
744d5a3e 709 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
3b885787 710 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
744d5a3e 711 sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
3b885787
NH
712}
713
767dd033 714void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
715 struct sk_buff *skb)
716{
717 sock_recv_timestamp(msg, sk, skb);
718 sock_recv_drops(msg, sk, skb);
719}
767dd033 720EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 721
1b784140
YX
722static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
723 size_t size, int flags)
1da177e4 724{
1b784140 725 return sock->ops->recvmsg(sock, msg, size, flags);
1da177e4
LT
726}
727
1b784140
YX
728int sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
729 int flags)
a2e27255
ACM
730{
731 int err = security_socket_recvmsg(sock, msg, size, flags);
732
1b784140 733 return err ?: sock_recvmsg_nosec(sock, msg, size, flags);
1da177e4 734}
c6d409cf 735EXPORT_SYMBOL(sock_recvmsg);
1da177e4 736
c1249c0a
ML
737/**
738 * kernel_recvmsg - Receive a message from a socket (kernel space)
739 * @sock: The socket to receive the message from
740 * @msg: Received message
741 * @vec: Input s/g array for message data
742 * @num: Size of input s/g array
743 * @size: Number of bytes to read
744 * @flags: Message flags (MSG_DONTWAIT, etc...)
745 *
746 * On return the msg structure contains the scatter/gather array passed in the
747 * vec argument. The array is modified so that it consists of the unfilled
748 * portion of the original array.
749 *
750 * The returned value is the total number of bytes received, or an error.
751 */
89bddce5
SH
752int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
753 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
754{
755 mm_segment_t oldfs = get_fs();
756 int result;
757
758 set_fs(KERNEL_DS);
759 /*
760 * the following is safe, since for compiler definitions of kvec and
761 * iovec are identical, yielding the same in-core layout and alignment
762 */
c0371da6 763 iov_iter_init(&msg->msg_iter, READ, (struct iovec *)vec, num, size);
1da177e4
LT
764 result = sock_recvmsg(sock, msg, size, flags);
765 set_fs(oldfs);
766 return result;
767}
c6d409cf 768EXPORT_SYMBOL(kernel_recvmsg);
1da177e4 769
ce1d4d3e
CH
770static ssize_t sock_sendpage(struct file *file, struct page *page,
771 int offset, size_t size, loff_t *ppos, int more)
1da177e4 772{
1da177e4
LT
773 struct socket *sock;
774 int flags;
775
ce1d4d3e
CH
776 sock = file->private_data;
777
35f9c09f
ED
778 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
779 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
780 flags |= more;
ce1d4d3e 781
e6949583 782 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 783}
1da177e4 784
9c55e01c 785static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 786 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
787 unsigned int flags)
788{
789 struct socket *sock = file->private_data;
790
997b37da
RDC
791 if (unlikely(!sock->ops->splice_read))
792 return -EINVAL;
793
9c55e01c
JA
794 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
795}
796
8ae5e030 797static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
ce1d4d3e 798{
6d652330
AV
799 struct file *file = iocb->ki_filp;
800 struct socket *sock = file->private_data;
0345f931 801 struct msghdr msg = {.msg_iter = *to,
802 .msg_iocb = iocb};
8ae5e030 803 ssize_t res;
ce1d4d3e 804
8ae5e030
AV
805 if (file->f_flags & O_NONBLOCK)
806 msg.msg_flags = MSG_DONTWAIT;
807
808 if (iocb->ki_pos != 0)
1da177e4 809 return -ESPIPE;
027445c3 810
66ee59af 811 if (!iov_iter_count(to)) /* Match SYS5 behaviour */
1da177e4
LT
812 return 0;
813
237dae88 814 res = sock_recvmsg(sock, &msg, iov_iter_count(to), msg.msg_flags);
8ae5e030
AV
815 *to = msg.msg_iter;
816 return res;
1da177e4
LT
817}
818
8ae5e030 819static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
ce1d4d3e 820{
6d652330
AV
821 struct file *file = iocb->ki_filp;
822 struct socket *sock = file->private_data;
0345f931 823 struct msghdr msg = {.msg_iter = *from,
824 .msg_iocb = iocb};
8ae5e030 825 ssize_t res;
1da177e4 826
8ae5e030 827 if (iocb->ki_pos != 0)
ce1d4d3e 828 return -ESPIPE;
027445c3 829
8ae5e030
AV
830 if (file->f_flags & O_NONBLOCK)
831 msg.msg_flags = MSG_DONTWAIT;
832
6d652330
AV
833 if (sock->type == SOCK_SEQPACKET)
834 msg.msg_flags |= MSG_EOR;
835
237dae88 836 res = sock_sendmsg(sock, &msg, iov_iter_count(from));
8ae5e030
AV
837 *from = msg.msg_iter;
838 return res;
1da177e4
LT
839}
840
1da177e4
LT
841/*
842 * Atomic setting of ioctl hooks to avoid race
843 * with module unload.
844 */
845
4a3e2f71 846static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 847static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 848
881d966b 849void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 850{
4a3e2f71 851 mutex_lock(&br_ioctl_mutex);
1da177e4 852 br_ioctl_hook = hook;
4a3e2f71 853 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
854}
855EXPORT_SYMBOL(brioctl_set);
856
4a3e2f71 857static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 858static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 859
881d966b 860void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 861{
4a3e2f71 862 mutex_lock(&vlan_ioctl_mutex);
1da177e4 863 vlan_ioctl_hook = hook;
4a3e2f71 864 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
865}
866EXPORT_SYMBOL(vlan_ioctl_set);
867
4a3e2f71 868static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 869static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 870
89bddce5 871void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 872{
4a3e2f71 873 mutex_lock(&dlci_ioctl_mutex);
1da177e4 874 dlci_ioctl_hook = hook;
4a3e2f71 875 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
876}
877EXPORT_SYMBOL(dlci_ioctl_set);
878
6b96018b
AB
879static long sock_do_ioctl(struct net *net, struct socket *sock,
880 unsigned int cmd, unsigned long arg)
881{
882 int err;
883 void __user *argp = (void __user *)arg;
884
885 err = sock->ops->ioctl(sock, cmd, arg);
886
887 /*
888 * If this ioctl is unknown try to hand it down
889 * to the NIC driver.
890 */
891 if (err == -ENOIOCTLCMD)
892 err = dev_ioctl(net, cmd, argp);
893
894 return err;
895}
896
1da177e4
LT
897/*
898 * With an ioctl, arg may well be a user mode pointer, but we don't know
899 * what to do with it - that's up to the protocol still.
900 */
901
902static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
903{
904 struct socket *sock;
881d966b 905 struct sock *sk;
1da177e4
LT
906 void __user *argp = (void __user *)arg;
907 int pid, err;
881d966b 908 struct net *net;
1da177e4 909
b69aee04 910 sock = file->private_data;
881d966b 911 sk = sock->sk;
3b1e0a65 912 net = sock_net(sk);
1da177e4 913 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 914 err = dev_ioctl(net, cmd, argp);
1da177e4 915 } else
3d23e349 916#ifdef CONFIG_WEXT_CORE
1da177e4 917 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 918 err = dev_ioctl(net, cmd, argp);
1da177e4 919 } else
3d23e349 920#endif
89bddce5 921 switch (cmd) {
1da177e4
LT
922 case FIOSETOWN:
923 case SIOCSPGRP:
924 err = -EFAULT;
925 if (get_user(pid, (int __user *)argp))
926 break;
e0b93edd
JL
927 f_setown(sock->file, pid, 1);
928 err = 0;
1da177e4
LT
929 break;
930 case FIOGETOWN:
931 case SIOCGPGRP:
609d7fa9 932 err = put_user(f_getown(sock->file),
89bddce5 933 (int __user *)argp);
1da177e4
LT
934 break;
935 case SIOCGIFBR:
936 case SIOCSIFBR:
937 case SIOCBRADDBR:
938 case SIOCBRDELBR:
939 err = -ENOPKG;
940 if (!br_ioctl_hook)
941 request_module("bridge");
942
4a3e2f71 943 mutex_lock(&br_ioctl_mutex);
89bddce5 944 if (br_ioctl_hook)
881d966b 945 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 946 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
947 break;
948 case SIOCGIFVLAN:
949 case SIOCSIFVLAN:
950 err = -ENOPKG;
951 if (!vlan_ioctl_hook)
952 request_module("8021q");
953
4a3e2f71 954 mutex_lock(&vlan_ioctl_mutex);
1da177e4 955 if (vlan_ioctl_hook)
881d966b 956 err = vlan_ioctl_hook(net, argp);
4a3e2f71 957 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 958 break;
1da177e4
LT
959 case SIOCADDDLCI:
960 case SIOCDELDLCI:
961 err = -ENOPKG;
962 if (!dlci_ioctl_hook)
963 request_module("dlci");
964
7512cbf6
PE
965 mutex_lock(&dlci_ioctl_mutex);
966 if (dlci_ioctl_hook)
1da177e4 967 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 968 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
969 break;
970 default:
6b96018b 971 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 972 break;
89bddce5 973 }
1da177e4
LT
974 return err;
975}
976
977int sock_create_lite(int family, int type, int protocol, struct socket **res)
978{
979 int err;
980 struct socket *sock = NULL;
89bddce5 981
1da177e4
LT
982 err = security_socket_create(family, type, protocol, 1);
983 if (err)
984 goto out;
985
986 sock = sock_alloc();
987 if (!sock) {
988 err = -ENOMEM;
989 goto out;
990 }
991
1da177e4 992 sock->type = type;
7420ed23
VY
993 err = security_socket_post_create(sock, family, type, protocol, 1);
994 if (err)
995 goto out_release;
996
1da177e4
LT
997out:
998 *res = sock;
999 return err;
7420ed23
VY
1000out_release:
1001 sock_release(sock);
1002 sock = NULL;
1003 goto out;
1da177e4 1004}
c6d409cf 1005EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1006
1007/* No kernel lock held - perfect */
89bddce5 1008static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4 1009{
cbf55001 1010 unsigned int busy_flag = 0;
1da177e4
LT
1011 struct socket *sock;
1012
1013 /*
89bddce5 1014 * We can't return errors to poll, so it's either yes or no.
1da177e4 1015 */
b69aee04 1016 sock = file->private_data;
2d48d67f 1017
cbf55001 1018 if (sk_can_busy_loop(sock->sk)) {
2d48d67f 1019 /* this socket can poll_ll so tell the system call */
cbf55001 1020 busy_flag = POLL_BUSY_LOOP;
2d48d67f
ET
1021
1022 /* once, only if requested by syscall */
cbf55001
ET
1023 if (wait && (wait->_key & POLL_BUSY_LOOP))
1024 sk_busy_loop(sock->sk, 1);
2d48d67f
ET
1025 }
1026
cbf55001 1027 return busy_flag | sock->ops->poll(file, sock, wait);
1da177e4
LT
1028}
1029
89bddce5 1030static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1031{
b69aee04 1032 struct socket *sock = file->private_data;
1da177e4
LT
1033
1034 return sock->ops->mmap(file, sock, vma);
1035}
1036
20380731 1037static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1038{
1da177e4
LT
1039 sock_release(SOCKET_I(inode));
1040 return 0;
1041}
1042
1043/*
1044 * Update the socket async list
1045 *
1046 * Fasync_list locking strategy.
1047 *
1048 * 1. fasync_list is modified only under process context socket lock
1049 * i.e. under semaphore.
1050 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1051 * or under socket lock
1da177e4
LT
1052 */
1053
1054static int sock_fasync(int fd, struct file *filp, int on)
1055{
989a2979
ED
1056 struct socket *sock = filp->private_data;
1057 struct sock *sk = sock->sk;
eaefd110 1058 struct socket_wq *wq;
1da177e4 1059
989a2979 1060 if (sk == NULL)
1da177e4 1061 return -EINVAL;
1da177e4
LT
1062
1063 lock_sock(sk);
eaefd110
ED
1064 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1065 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1066
eaefd110 1067 if (!wq->fasync_list)
989a2979
ED
1068 sock_reset_flag(sk, SOCK_FASYNC);
1069 else
bcdce719 1070 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1071
989a2979 1072 release_sock(sk);
1da177e4
LT
1073 return 0;
1074}
1075
43815482 1076/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1077
1078int sock_wake_async(struct socket *sock, int how, int band)
1079{
43815482
ED
1080 struct socket_wq *wq;
1081
1082 if (!sock)
1083 return -1;
1084 rcu_read_lock();
1085 wq = rcu_dereference(sock->wq);
1086 if (!wq || !wq->fasync_list) {
1087 rcu_read_unlock();
1da177e4 1088 return -1;
43815482 1089 }
89bddce5 1090 switch (how) {
8d8ad9d7 1091 case SOCK_WAKE_WAITD:
1da177e4
LT
1092 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1093 break;
1094 goto call_kill;
8d8ad9d7 1095 case SOCK_WAKE_SPACE:
1da177e4
LT
1096 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1097 break;
1098 /* fall through */
8d8ad9d7 1099 case SOCK_WAKE_IO:
89bddce5 1100call_kill:
43815482 1101 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1102 break;
8d8ad9d7 1103 case SOCK_WAKE_URG:
43815482 1104 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1105 }
43815482 1106 rcu_read_unlock();
1da177e4
LT
1107 return 0;
1108}
c6d409cf 1109EXPORT_SYMBOL(sock_wake_async);
1da177e4 1110
721db93a 1111int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1112 struct socket **res, int kern)
1da177e4
LT
1113{
1114 int err;
1115 struct socket *sock;
55737fda 1116 const struct net_proto_family *pf;
1da177e4
LT
1117
1118 /*
89bddce5 1119 * Check protocol is in range
1da177e4
LT
1120 */
1121 if (family < 0 || family >= NPROTO)
1122 return -EAFNOSUPPORT;
1123 if (type < 0 || type >= SOCK_MAX)
1124 return -EINVAL;
1125
1126 /* Compatibility.
1127
1128 This uglymoron is moved from INET layer to here to avoid
1129 deadlock in module load.
1130 */
1131 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1132 static int warned;
1da177e4
LT
1133 if (!warned) {
1134 warned = 1;
3410f22e
YY
1135 pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1136 current->comm);
1da177e4
LT
1137 }
1138 family = PF_PACKET;
1139 }
1140
1141 err = security_socket_create(family, type, protocol, kern);
1142 if (err)
1143 return err;
89bddce5 1144
55737fda
SH
1145 /*
1146 * Allocate the socket and allow the family to set things up. if
1147 * the protocol is 0, the family is instructed to select an appropriate
1148 * default.
1149 */
1150 sock = sock_alloc();
1151 if (!sock) {
e87cc472 1152 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1153 return -ENFILE; /* Not exactly a match, but its the
1154 closest posix thing */
1155 }
1156
1157 sock->type = type;
1158
95a5afca 1159#ifdef CONFIG_MODULES
89bddce5
SH
1160 /* Attempt to load a protocol module if the find failed.
1161 *
1162 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1163 * requested real, full-featured networking support upon configuration.
1164 * Otherwise module support will break!
1165 */
190683a9 1166 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1167 request_module("net-pf-%d", family);
1da177e4
LT
1168#endif
1169
55737fda
SH
1170 rcu_read_lock();
1171 pf = rcu_dereference(net_families[family]);
1172 err = -EAFNOSUPPORT;
1173 if (!pf)
1174 goto out_release;
1da177e4
LT
1175
1176 /*
1177 * We will call the ->create function, that possibly is in a loadable
1178 * module, so we have to bump that loadable module refcnt first.
1179 */
55737fda 1180 if (!try_module_get(pf->owner))
1da177e4
LT
1181 goto out_release;
1182
55737fda
SH
1183 /* Now protected by module ref count */
1184 rcu_read_unlock();
1185
3f378b68 1186 err = pf->create(net, sock, protocol, kern);
55737fda 1187 if (err < 0)
1da177e4 1188 goto out_module_put;
a79af59e 1189
1da177e4
LT
1190 /*
1191 * Now to bump the refcnt of the [loadable] module that owns this
1192 * socket at sock_release time we decrement its refcnt.
1193 */
55737fda
SH
1194 if (!try_module_get(sock->ops->owner))
1195 goto out_module_busy;
1196
1da177e4
LT
1197 /*
1198 * Now that we're done with the ->create function, the [loadable]
1199 * module can have its refcnt decremented
1200 */
55737fda 1201 module_put(pf->owner);
7420ed23
VY
1202 err = security_socket_post_create(sock, family, type, protocol, kern);
1203 if (err)
3b185525 1204 goto out_sock_release;
55737fda 1205 *res = sock;
1da177e4 1206
55737fda
SH
1207 return 0;
1208
1209out_module_busy:
1210 err = -EAFNOSUPPORT;
1da177e4 1211out_module_put:
55737fda
SH
1212 sock->ops = NULL;
1213 module_put(pf->owner);
1214out_sock_release:
1da177e4 1215 sock_release(sock);
55737fda
SH
1216 return err;
1217
1218out_release:
1219 rcu_read_unlock();
1220 goto out_sock_release;
1da177e4 1221}
721db93a 1222EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1223
1224int sock_create(int family, int type, int protocol, struct socket **res)
1225{
1b8d7ae4 1226 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1227}
c6d409cf 1228EXPORT_SYMBOL(sock_create);
1da177e4
LT
1229
1230int sock_create_kern(int family, int type, int protocol, struct socket **res)
1231{
1b8d7ae4 1232 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1233}
c6d409cf 1234EXPORT_SYMBOL(sock_create_kern);
1da177e4 1235
3e0fa65f 1236SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1237{
1238 int retval;
1239 struct socket *sock;
a677a039
UD
1240 int flags;
1241
e38b36f3
UD
1242 /* Check the SOCK_* constants for consistency. */
1243 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1244 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1245 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1246 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1247
a677a039 1248 flags = type & ~SOCK_TYPE_MASK;
77d27200 1249 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1250 return -EINVAL;
1251 type &= SOCK_TYPE_MASK;
1da177e4 1252
aaca0bdc
UD
1253 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1254 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1255
1da177e4
LT
1256 retval = sock_create(family, type, protocol, &sock);
1257 if (retval < 0)
1258 goto out;
1259
77d27200 1260 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1261 if (retval < 0)
1262 goto out_release;
1263
1264out:
1265 /* It may be already another descriptor 8) Not kernel problem. */
1266 return retval;
1267
1268out_release:
1269 sock_release(sock);
1270 return retval;
1271}
1272
1273/*
1274 * Create a pair of connected sockets.
1275 */
1276
3e0fa65f
HC
1277SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1278 int __user *, usockvec)
1da177e4
LT
1279{
1280 struct socket *sock1, *sock2;
1281 int fd1, fd2, err;
db349509 1282 struct file *newfile1, *newfile2;
a677a039
UD
1283 int flags;
1284
1285 flags = type & ~SOCK_TYPE_MASK;
77d27200 1286 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1287 return -EINVAL;
1288 type &= SOCK_TYPE_MASK;
1da177e4 1289
aaca0bdc
UD
1290 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1291 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1292
1da177e4
LT
1293 /*
1294 * Obtain the first socket and check if the underlying protocol
1295 * supports the socketpair call.
1296 */
1297
1298 err = sock_create(family, type, protocol, &sock1);
1299 if (err < 0)
1300 goto out;
1301
1302 err = sock_create(family, type, protocol, &sock2);
1303 if (err < 0)
1304 goto out_release_1;
1305
1306 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1307 if (err < 0)
1da177e4
LT
1308 goto out_release_both;
1309
28407630 1310 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1311 if (unlikely(fd1 < 0)) {
1312 err = fd1;
db349509 1313 goto out_release_both;
bf3c23d1 1314 }
d73aa286 1315
28407630 1316 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1317 if (unlikely(fd2 < 0)) {
1318 err = fd2;
d73aa286 1319 goto out_put_unused_1;
28407630
AV
1320 }
1321
aab174f0 1322 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1323 if (unlikely(IS_ERR(newfile1))) {
1324 err = PTR_ERR(newfile1);
d73aa286 1325 goto out_put_unused_both;
28407630
AV
1326 }
1327
aab174f0 1328 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1329 if (IS_ERR(newfile2)) {
1330 err = PTR_ERR(newfile2);
d73aa286 1331 goto out_fput_1;
db349509
AV
1332 }
1333
d73aa286
YD
1334 err = put_user(fd1, &usockvec[0]);
1335 if (err)
1336 goto out_fput_both;
1337
1338 err = put_user(fd2, &usockvec[1]);
1339 if (err)
1340 goto out_fput_both;
1341
157cf649 1342 audit_fd_pair(fd1, fd2);
d73aa286 1343
db349509
AV
1344 fd_install(fd1, newfile1);
1345 fd_install(fd2, newfile2);
1da177e4
LT
1346 /* fd1 and fd2 may be already another descriptors.
1347 * Not kernel problem.
1348 */
1349
d73aa286 1350 return 0;
1da177e4 1351
d73aa286
YD
1352out_fput_both:
1353 fput(newfile2);
1354 fput(newfile1);
1355 put_unused_fd(fd2);
1356 put_unused_fd(fd1);
1357 goto out;
1358
1359out_fput_1:
1360 fput(newfile1);
1361 put_unused_fd(fd2);
1362 put_unused_fd(fd1);
1363 sock_release(sock2);
1364 goto out;
1da177e4 1365
d73aa286
YD
1366out_put_unused_both:
1367 put_unused_fd(fd2);
1368out_put_unused_1:
1369 put_unused_fd(fd1);
1da177e4 1370out_release_both:
89bddce5 1371 sock_release(sock2);
1da177e4 1372out_release_1:
89bddce5 1373 sock_release(sock1);
1da177e4
LT
1374out:
1375 return err;
1376}
1377
1da177e4
LT
1378/*
1379 * Bind a name to a socket. Nothing much to do here since it's
1380 * the protocol's responsibility to handle the local address.
1381 *
1382 * We move the socket address to kernel space before we call
1383 * the protocol layer (having also checked the address is ok).
1384 */
1385
20f37034 1386SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1387{
1388 struct socket *sock;
230b1839 1389 struct sockaddr_storage address;
6cb153ca 1390 int err, fput_needed;
1da177e4 1391
89bddce5 1392 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1393 if (sock) {
43db362d 1394 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1395 if (err >= 0) {
1396 err = security_socket_bind(sock,
230b1839 1397 (struct sockaddr *)&address,
89bddce5 1398 addrlen);
6cb153ca
BL
1399 if (!err)
1400 err = sock->ops->bind(sock,
89bddce5 1401 (struct sockaddr *)
230b1839 1402 &address, addrlen);
1da177e4 1403 }
6cb153ca 1404 fput_light(sock->file, fput_needed);
89bddce5 1405 }
1da177e4
LT
1406 return err;
1407}
1408
1da177e4
LT
1409/*
1410 * Perform a listen. Basically, we allow the protocol to do anything
1411 * necessary for a listen, and if that works, we mark the socket as
1412 * ready for listening.
1413 */
1414
3e0fa65f 1415SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1416{
1417 struct socket *sock;
6cb153ca 1418 int err, fput_needed;
b8e1f9b5 1419 int somaxconn;
89bddce5
SH
1420
1421 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1422 if (sock) {
8efa6e93 1423 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1424 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1425 backlog = somaxconn;
1da177e4
LT
1426
1427 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1428 if (!err)
1429 err = sock->ops->listen(sock, backlog);
1da177e4 1430
6cb153ca 1431 fput_light(sock->file, fput_needed);
1da177e4
LT
1432 }
1433 return err;
1434}
1435
1da177e4
LT
1436/*
1437 * For accept, we attempt to create a new socket, set up the link
1438 * with the client, wake up the client, then return the new
1439 * connected fd. We collect the address of the connector in kernel
1440 * space and move it to user at the very end. This is unclean because
1441 * we open the socket then return an error.
1442 *
1443 * 1003.1g adds the ability to recvmsg() to query connection pending
1444 * status to recvmsg. We need to add that support in a way thats
1445 * clean when we restucture accept also.
1446 */
1447
20f37034
HC
1448SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1449 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1450{
1451 struct socket *sock, *newsock;
39d8c1b6 1452 struct file *newfile;
6cb153ca 1453 int err, len, newfd, fput_needed;
230b1839 1454 struct sockaddr_storage address;
1da177e4 1455
77d27200 1456 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1457 return -EINVAL;
1458
1459 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1460 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1461
6cb153ca 1462 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1463 if (!sock)
1464 goto out;
1465
1466 err = -ENFILE;
c6d409cf
ED
1467 newsock = sock_alloc();
1468 if (!newsock)
1da177e4
LT
1469 goto out_put;
1470
1471 newsock->type = sock->type;
1472 newsock->ops = sock->ops;
1473
1da177e4
LT
1474 /*
1475 * We don't need try_module_get here, as the listening socket (sock)
1476 * has the protocol module (sock->ops->owner) held.
1477 */
1478 __module_get(newsock->ops->owner);
1479
28407630 1480 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1481 if (unlikely(newfd < 0)) {
1482 err = newfd;
9a1875e6
DM
1483 sock_release(newsock);
1484 goto out_put;
39d8c1b6 1485 }
aab174f0 1486 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1487 if (unlikely(IS_ERR(newfile))) {
1488 err = PTR_ERR(newfile);
1489 put_unused_fd(newfd);
1490 sock_release(newsock);
1491 goto out_put;
1492 }
39d8c1b6 1493
a79af59e
FF
1494 err = security_socket_accept(sock, newsock);
1495 if (err)
39d8c1b6 1496 goto out_fd;
a79af59e 1497
1da177e4
LT
1498 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1499 if (err < 0)
39d8c1b6 1500 goto out_fd;
1da177e4
LT
1501
1502 if (upeer_sockaddr) {
230b1839 1503 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1504 &len, 2) < 0) {
1da177e4 1505 err = -ECONNABORTED;
39d8c1b6 1506 goto out_fd;
1da177e4 1507 }
43db362d 1508 err = move_addr_to_user(&address,
230b1839 1509 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1510 if (err < 0)
39d8c1b6 1511 goto out_fd;
1da177e4
LT
1512 }
1513
1514 /* File flags are not inherited via accept() unlike another OSes. */
1515
39d8c1b6
DM
1516 fd_install(newfd, newfile);
1517 err = newfd;
1da177e4 1518
1da177e4 1519out_put:
6cb153ca 1520 fput_light(sock->file, fput_needed);
1da177e4
LT
1521out:
1522 return err;
39d8c1b6 1523out_fd:
9606a216 1524 fput(newfile);
39d8c1b6 1525 put_unused_fd(newfd);
1da177e4
LT
1526 goto out_put;
1527}
1528
20f37034
HC
1529SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1530 int __user *, upeer_addrlen)
aaca0bdc 1531{
de11defe 1532 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1533}
1534
1da177e4
LT
1535/*
1536 * Attempt to connect to a socket with the server address. The address
1537 * is in user space so we verify it is OK and move it to kernel space.
1538 *
1539 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1540 * break bindings
1541 *
1542 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1543 * other SEQPACKET protocols that take time to connect() as it doesn't
1544 * include the -EINPROGRESS status for such sockets.
1545 */
1546
20f37034
HC
1547SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1548 int, addrlen)
1da177e4
LT
1549{
1550 struct socket *sock;
230b1839 1551 struct sockaddr_storage address;
6cb153ca 1552 int err, fput_needed;
1da177e4 1553
6cb153ca 1554 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1555 if (!sock)
1556 goto out;
43db362d 1557 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1558 if (err < 0)
1559 goto out_put;
1560
89bddce5 1561 err =
230b1839 1562 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1563 if (err)
1564 goto out_put;
1565
230b1839 1566 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1567 sock->file->f_flags);
1568out_put:
6cb153ca 1569 fput_light(sock->file, fput_needed);
1da177e4
LT
1570out:
1571 return err;
1572}
1573
1574/*
1575 * Get the local address ('name') of a socket object. Move the obtained
1576 * name to user space.
1577 */
1578
20f37034
HC
1579SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1580 int __user *, usockaddr_len)
1da177e4
LT
1581{
1582 struct socket *sock;
230b1839 1583 struct sockaddr_storage address;
6cb153ca 1584 int len, err, fput_needed;
89bddce5 1585
6cb153ca 1586 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1587 if (!sock)
1588 goto out;
1589
1590 err = security_socket_getsockname(sock);
1591 if (err)
1592 goto out_put;
1593
230b1839 1594 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1595 if (err)
1596 goto out_put;
43db362d 1597 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1598
1599out_put:
6cb153ca 1600 fput_light(sock->file, fput_needed);
1da177e4
LT
1601out:
1602 return err;
1603}
1604
1605/*
1606 * Get the remote address ('name') of a socket object. Move the obtained
1607 * name to user space.
1608 */
1609
20f37034
HC
1610SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1611 int __user *, usockaddr_len)
1da177e4
LT
1612{
1613 struct socket *sock;
230b1839 1614 struct sockaddr_storage address;
6cb153ca 1615 int len, err, fput_needed;
1da177e4 1616
89bddce5
SH
1617 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1618 if (sock != NULL) {
1da177e4
LT
1619 err = security_socket_getpeername(sock);
1620 if (err) {
6cb153ca 1621 fput_light(sock->file, fput_needed);
1da177e4
LT
1622 return err;
1623 }
1624
89bddce5 1625 err =
230b1839 1626 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1627 1);
1da177e4 1628 if (!err)
43db362d 1629 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1630 usockaddr_len);
6cb153ca 1631 fput_light(sock->file, fput_needed);
1da177e4
LT
1632 }
1633 return err;
1634}
1635
1636/*
1637 * Send a datagram to a given address. We move the address into kernel
1638 * space and check the user space data area is readable before invoking
1639 * the protocol.
1640 */
1641
3e0fa65f 1642SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1643 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1644 int, addr_len)
1da177e4
LT
1645{
1646 struct socket *sock;
230b1839 1647 struct sockaddr_storage address;
1da177e4
LT
1648 int err;
1649 struct msghdr msg;
1650 struct iovec iov;
6cb153ca 1651 int fput_needed;
6cb153ca 1652
602bd0e9
AV
1653 err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1654 if (unlikely(err))
1655 return err;
de0fa95c
PE
1656 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1657 if (!sock)
4387ff75 1658 goto out;
6cb153ca 1659
89bddce5 1660 msg.msg_name = NULL;
89bddce5
SH
1661 msg.msg_control = NULL;
1662 msg.msg_controllen = 0;
1663 msg.msg_namelen = 0;
6cb153ca 1664 if (addr) {
43db362d 1665 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1666 if (err < 0)
1667 goto out_put;
230b1839 1668 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1669 msg.msg_namelen = addr_len;
1da177e4
LT
1670 }
1671 if (sock->file->f_flags & O_NONBLOCK)
1672 flags |= MSG_DONTWAIT;
1673 msg.msg_flags = flags;
602bd0e9 1674 err = sock_sendmsg(sock, &msg, iov_iter_count(&msg.msg_iter));
1da177e4 1675
89bddce5 1676out_put:
de0fa95c 1677 fput_light(sock->file, fput_needed);
4387ff75 1678out:
1da177e4
LT
1679 return err;
1680}
1681
1682/*
89bddce5 1683 * Send a datagram down a socket.
1da177e4
LT
1684 */
1685
3e0fa65f 1686SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1687 unsigned int, flags)
1da177e4
LT
1688{
1689 return sys_sendto(fd, buff, len, flags, NULL, 0);
1690}
1691
1692/*
89bddce5 1693 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1694 * sender. We verify the buffers are writable and if needed move the
1695 * sender address from kernel to user space.
1696 */
1697
3e0fa65f 1698SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1699 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1700 int __user *, addr_len)
1da177e4
LT
1701{
1702 struct socket *sock;
1703 struct iovec iov;
1704 struct msghdr msg;
230b1839 1705 struct sockaddr_storage address;
89bddce5 1706 int err, err2;
6cb153ca
BL
1707 int fput_needed;
1708
602bd0e9
AV
1709 err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1710 if (unlikely(err))
1711 return err;
de0fa95c 1712 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1713 if (!sock)
de0fa95c 1714 goto out;
1da177e4 1715
89bddce5
SH
1716 msg.msg_control = NULL;
1717 msg.msg_controllen = 0;
f3d33426
HFS
1718 /* Save some cycles and don't copy the address if not needed */
1719 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1720 /* We assume all kernel code knows the size of sockaddr_storage */
1721 msg.msg_namelen = 0;
1da177e4
LT
1722 if (sock->file->f_flags & O_NONBLOCK)
1723 flags |= MSG_DONTWAIT;
602bd0e9 1724 err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
1da177e4 1725
89bddce5 1726 if (err >= 0 && addr != NULL) {
43db362d 1727 err2 = move_addr_to_user(&address,
230b1839 1728 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1729 if (err2 < 0)
1730 err = err2;
1da177e4 1731 }
de0fa95c
PE
1732
1733 fput_light(sock->file, fput_needed);
4387ff75 1734out:
1da177e4
LT
1735 return err;
1736}
1737
1738/*
89bddce5 1739 * Receive a datagram from a socket.
1da177e4
LT
1740 */
1741
b7c0ddf5
JG
1742SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1743 unsigned int, flags)
1da177e4
LT
1744{
1745 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1746}
1747
1748/*
1749 * Set a socket option. Because we don't know the option lengths we have
1750 * to pass the user mode parameter for the protocols to sort out.
1751 */
1752
20f37034
HC
1753SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1754 char __user *, optval, int, optlen)
1da177e4 1755{
6cb153ca 1756 int err, fput_needed;
1da177e4
LT
1757 struct socket *sock;
1758
1759 if (optlen < 0)
1760 return -EINVAL;
89bddce5
SH
1761
1762 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1763 if (sock != NULL) {
1764 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1765 if (err)
1766 goto out_put;
1da177e4
LT
1767
1768 if (level == SOL_SOCKET)
89bddce5
SH
1769 err =
1770 sock_setsockopt(sock, level, optname, optval,
1771 optlen);
1da177e4 1772 else
89bddce5
SH
1773 err =
1774 sock->ops->setsockopt(sock, level, optname, optval,
1775 optlen);
6cb153ca
BL
1776out_put:
1777 fput_light(sock->file, fput_needed);
1da177e4
LT
1778 }
1779 return err;
1780}
1781
1782/*
1783 * Get a socket option. Because we don't know the option lengths we have
1784 * to pass a user mode parameter for the protocols to sort out.
1785 */
1786
20f37034
HC
1787SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1788 char __user *, optval, int __user *, optlen)
1da177e4 1789{
6cb153ca 1790 int err, fput_needed;
1da177e4
LT
1791 struct socket *sock;
1792
89bddce5
SH
1793 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1794 if (sock != NULL) {
6cb153ca
BL
1795 err = security_socket_getsockopt(sock, level, optname);
1796 if (err)
1797 goto out_put;
1da177e4
LT
1798
1799 if (level == SOL_SOCKET)
89bddce5
SH
1800 err =
1801 sock_getsockopt(sock, level, optname, optval,
1802 optlen);
1da177e4 1803 else
89bddce5
SH
1804 err =
1805 sock->ops->getsockopt(sock, level, optname, optval,
1806 optlen);
6cb153ca
BL
1807out_put:
1808 fput_light(sock->file, fput_needed);
1da177e4
LT
1809 }
1810 return err;
1811}
1812
1da177e4
LT
1813/*
1814 * Shutdown a socket.
1815 */
1816
754fe8d2 1817SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1818{
6cb153ca 1819 int err, fput_needed;
1da177e4
LT
1820 struct socket *sock;
1821
89bddce5
SH
1822 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1823 if (sock != NULL) {
1da177e4 1824 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1825 if (!err)
1826 err = sock->ops->shutdown(sock, how);
1827 fput_light(sock->file, fput_needed);
1da177e4
LT
1828 }
1829 return err;
1830}
1831
89bddce5 1832/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1833 * fields which are the same type (int / unsigned) on our platforms.
1834 */
1835#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1836#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1837#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1838
c71d8ebe
TH
1839struct used_address {
1840 struct sockaddr_storage name;
1841 unsigned int name_len;
1842};
1843
da184284
AV
1844static int copy_msghdr_from_user(struct msghdr *kmsg,
1845 struct user_msghdr __user *umsg,
1846 struct sockaddr __user **save_addr,
1847 struct iovec **iov)
1661bf36 1848{
08adb7da
AV
1849 struct sockaddr __user *uaddr;
1850 struct iovec __user *uiov;
c0371da6 1851 size_t nr_segs;
08adb7da
AV
1852 ssize_t err;
1853
1854 if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1855 __get_user(uaddr, &umsg->msg_name) ||
1856 __get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1857 __get_user(uiov, &umsg->msg_iov) ||
c0371da6 1858 __get_user(nr_segs, &umsg->msg_iovlen) ||
08adb7da
AV
1859 __get_user(kmsg->msg_control, &umsg->msg_control) ||
1860 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1861 __get_user(kmsg->msg_flags, &umsg->msg_flags))
1661bf36 1862 return -EFAULT;
dbb490b9 1863
08adb7da 1864 if (!uaddr)
6a2a2b3a
AS
1865 kmsg->msg_namelen = 0;
1866
dbb490b9
ML
1867 if (kmsg->msg_namelen < 0)
1868 return -EINVAL;
1869
1661bf36 1870 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
db31c55a 1871 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
08adb7da
AV
1872
1873 if (save_addr)
1874 *save_addr = uaddr;
1875
1876 if (uaddr && kmsg->msg_namelen) {
1877 if (!save_addr) {
1878 err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1879 kmsg->msg_name);
1880 if (err < 0)
1881 return err;
1882 }
1883 } else {
1884 kmsg->msg_name = NULL;
1885 kmsg->msg_namelen = 0;
1886 }
1887
c0371da6 1888 if (nr_segs > UIO_MAXIOV)
08adb7da
AV
1889 return -EMSGSIZE;
1890
0345f931 1891 kmsg->msg_iocb = NULL;
1892
da184284
AV
1893 return import_iovec(save_addr ? READ : WRITE, uiov, nr_segs,
1894 UIO_FASTIOV, iov, &kmsg->msg_iter);
1661bf36
DC
1895}
1896
666547ff 1897static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 1898 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1899 struct used_address *used_address)
1da177e4 1900{
89bddce5
SH
1901 struct compat_msghdr __user *msg_compat =
1902 (struct compat_msghdr __user *)msg;
230b1839 1903 struct sockaddr_storage address;
1da177e4 1904 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1905 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1906 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1907 /* 20 is size of ipv6_pktinfo */
1da177e4 1908 unsigned char *ctl_buf = ctl;
08adb7da
AV
1909 int ctl_len, total_len;
1910 ssize_t err;
89bddce5 1911
08adb7da 1912 msg_sys->msg_name = &address;
1da177e4 1913
08449320 1914 if (MSG_CMSG_COMPAT & flags)
08adb7da 1915 err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
08449320 1916 else
08adb7da 1917 err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
89bddce5 1918 if (err < 0)
da184284
AV
1919 return err;
1920 total_len = iov_iter_count(&msg_sys->msg_iter);
1da177e4
LT
1921
1922 err = -ENOBUFS;
1923
228e548e 1924 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 1925 goto out_freeiov;
228e548e 1926 ctl_len = msg_sys->msg_controllen;
1da177e4 1927 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 1928 err =
228e548e 1929 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 1930 sizeof(ctl));
1da177e4
LT
1931 if (err)
1932 goto out_freeiov;
228e548e
AB
1933 ctl_buf = msg_sys->msg_control;
1934 ctl_len = msg_sys->msg_controllen;
1da177e4 1935 } else if (ctl_len) {
89bddce5 1936 if (ctl_len > sizeof(ctl)) {
1da177e4 1937 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 1938 if (ctl_buf == NULL)
1da177e4
LT
1939 goto out_freeiov;
1940 }
1941 err = -EFAULT;
1942 /*
228e548e 1943 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
1944 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1945 * checking falls down on this.
1946 */
fb8621bb 1947 if (copy_from_user(ctl_buf,
228e548e 1948 (void __user __force *)msg_sys->msg_control,
89bddce5 1949 ctl_len))
1da177e4 1950 goto out_freectl;
228e548e 1951 msg_sys->msg_control = ctl_buf;
1da177e4 1952 }
228e548e 1953 msg_sys->msg_flags = flags;
1da177e4
LT
1954
1955 if (sock->file->f_flags & O_NONBLOCK)
228e548e 1956 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
1957 /*
1958 * If this is sendmmsg() and current destination address is same as
1959 * previously succeeded address, omit asking LSM's decision.
1960 * used_address->name_len is initialized to UINT_MAX so that the first
1961 * destination address never matches.
1962 */
bc909d9d
MD
1963 if (used_address && msg_sys->msg_name &&
1964 used_address->name_len == msg_sys->msg_namelen &&
1965 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
1966 used_address->name_len)) {
1967 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
1968 goto out_freectl;
1969 }
1970 err = sock_sendmsg(sock, msg_sys, total_len);
1971 /*
1972 * If this is sendmmsg() and sending to current destination address was
1973 * successful, remember it.
1974 */
1975 if (used_address && err >= 0) {
1976 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
1977 if (msg_sys->msg_name)
1978 memcpy(&used_address->name, msg_sys->msg_name,
1979 used_address->name_len);
c71d8ebe 1980 }
1da177e4
LT
1981
1982out_freectl:
89bddce5 1983 if (ctl_buf != ctl)
1da177e4
LT
1984 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1985out_freeiov:
da184284 1986 kfree(iov);
228e548e
AB
1987 return err;
1988}
1989
1990/*
1991 * BSD sendmsg interface
1992 */
1993
666547ff 1994long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
228e548e
AB
1995{
1996 int fput_needed, err;
1997 struct msghdr msg_sys;
1be374a0
AL
1998 struct socket *sock;
1999
1be374a0 2000 sock = sockfd_lookup_light(fd, &err, &fput_needed);
228e548e
AB
2001 if (!sock)
2002 goto out;
2003
a7526eb5 2004 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2005
6cb153ca 2006 fput_light(sock->file, fput_needed);
89bddce5 2007out:
1da177e4
LT
2008 return err;
2009}
2010
666547ff 2011SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
a7526eb5
AL
2012{
2013 if (flags & MSG_CMSG_COMPAT)
2014 return -EINVAL;
2015 return __sys_sendmsg(fd, msg, flags);
2016}
2017
228e548e
AB
2018/*
2019 * Linux sendmmsg interface
2020 */
2021
2022int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2023 unsigned int flags)
2024{
2025 int fput_needed, err, datagrams;
2026 struct socket *sock;
2027 struct mmsghdr __user *entry;
2028 struct compat_mmsghdr __user *compat_entry;
2029 struct msghdr msg_sys;
c71d8ebe 2030 struct used_address used_address;
228e548e 2031
98382f41
AB
2032 if (vlen > UIO_MAXIOV)
2033 vlen = UIO_MAXIOV;
228e548e
AB
2034
2035 datagrams = 0;
2036
2037 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2038 if (!sock)
2039 return err;
2040
c71d8ebe 2041 used_address.name_len = UINT_MAX;
228e548e
AB
2042 entry = mmsg;
2043 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2044 err = 0;
228e548e
AB
2045
2046 while (datagrams < vlen) {
228e548e 2047 if (MSG_CMSG_COMPAT & flags) {
666547ff 2048 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5 2049 &msg_sys, flags, &used_address);
228e548e
AB
2050 if (err < 0)
2051 break;
2052 err = __put_user(err, &compat_entry->msg_len);
2053 ++compat_entry;
2054 } else {
a7526eb5 2055 err = ___sys_sendmsg(sock,
666547ff 2056 (struct user_msghdr __user *)entry,
a7526eb5 2057 &msg_sys, flags, &used_address);
228e548e
AB
2058 if (err < 0)
2059 break;
2060 err = put_user(err, &entry->msg_len);
2061 ++entry;
2062 }
2063
2064 if (err)
2065 break;
2066 ++datagrams;
2067 }
2068
228e548e
AB
2069 fput_light(sock->file, fput_needed);
2070
728ffb86
AB
2071 /* We only return an error if no datagrams were able to be sent */
2072 if (datagrams != 0)
228e548e
AB
2073 return datagrams;
2074
228e548e
AB
2075 return err;
2076}
2077
2078SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2079 unsigned int, vlen, unsigned int, flags)
2080{
1be374a0
AL
2081 if (flags & MSG_CMSG_COMPAT)
2082 return -EINVAL;
228e548e
AB
2083 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2084}
2085
666547ff 2086static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
95c96174 2087 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2088{
89bddce5
SH
2089 struct compat_msghdr __user *msg_compat =
2090 (struct compat_msghdr __user *)msg;
1da177e4 2091 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2092 struct iovec *iov = iovstack;
1da177e4 2093 unsigned long cmsg_ptr;
08adb7da
AV
2094 int total_len, len;
2095 ssize_t err;
1da177e4
LT
2096
2097 /* kernel mode address */
230b1839 2098 struct sockaddr_storage addr;
1da177e4
LT
2099
2100 /* user mode address pointers */
2101 struct sockaddr __user *uaddr;
08adb7da 2102 int __user *uaddr_len = COMPAT_NAMELEN(msg);
89bddce5 2103
08adb7da 2104 msg_sys->msg_name = &addr;
1da177e4 2105
f3d33426 2106 if (MSG_CMSG_COMPAT & flags)
08adb7da 2107 err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
f3d33426 2108 else
08adb7da 2109 err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
1da177e4 2110 if (err < 0)
da184284
AV
2111 return err;
2112 total_len = iov_iter_count(&msg_sys->msg_iter);
1da177e4 2113
a2e27255
ACM
2114 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2115 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2116
f3d33426
HFS
2117 /* We assume all kernel code knows the size of sockaddr_storage */
2118 msg_sys->msg_namelen = 0;
2119
1da177e4
LT
2120 if (sock->file->f_flags & O_NONBLOCK)
2121 flags |= MSG_DONTWAIT;
a2e27255
ACM
2122 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2123 total_len, flags);
1da177e4
LT
2124 if (err < 0)
2125 goto out_freeiov;
2126 len = err;
2127
2128 if (uaddr != NULL) {
43db362d 2129 err = move_addr_to_user(&addr,
a2e27255 2130 msg_sys->msg_namelen, uaddr,
89bddce5 2131 uaddr_len);
1da177e4
LT
2132 if (err < 0)
2133 goto out_freeiov;
2134 }
a2e27255 2135 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2136 COMPAT_FLAGS(msg));
1da177e4
LT
2137 if (err)
2138 goto out_freeiov;
2139 if (MSG_CMSG_COMPAT & flags)
a2e27255 2140 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2141 &msg_compat->msg_controllen);
2142 else
a2e27255 2143 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2144 &msg->msg_controllen);
2145 if (err)
2146 goto out_freeiov;
2147 err = len;
2148
2149out_freeiov:
da184284 2150 kfree(iov);
a2e27255
ACM
2151 return err;
2152}
2153
2154/*
2155 * BSD recvmsg interface
2156 */
2157
666547ff 2158long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
a2e27255
ACM
2159{
2160 int fput_needed, err;
2161 struct msghdr msg_sys;
1be374a0
AL
2162 struct socket *sock;
2163
1be374a0 2164 sock = sockfd_lookup_light(fd, &err, &fput_needed);
a2e27255
ACM
2165 if (!sock)
2166 goto out;
2167
a7526eb5 2168 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
a2e27255 2169
6cb153ca 2170 fput_light(sock->file, fput_needed);
1da177e4
LT
2171out:
2172 return err;
2173}
2174
666547ff 2175SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
a7526eb5
AL
2176 unsigned int, flags)
2177{
2178 if (flags & MSG_CMSG_COMPAT)
2179 return -EINVAL;
2180 return __sys_recvmsg(fd, msg, flags);
2181}
2182
a2e27255
ACM
2183/*
2184 * Linux recvmmsg interface
2185 */
2186
2187int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2188 unsigned int flags, struct timespec *timeout)
2189{
2190 int fput_needed, err, datagrams;
2191 struct socket *sock;
2192 struct mmsghdr __user *entry;
d7256d0e 2193 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2194 struct msghdr msg_sys;
2195 struct timespec end_time;
2196
2197 if (timeout &&
2198 poll_select_set_timeout(&end_time, timeout->tv_sec,
2199 timeout->tv_nsec))
2200 return -EINVAL;
2201
2202 datagrams = 0;
2203
2204 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2205 if (!sock)
2206 return err;
2207
2208 err = sock_error(sock->sk);
2209 if (err)
2210 goto out_put;
2211
2212 entry = mmsg;
d7256d0e 2213 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2214
2215 while (datagrams < vlen) {
2216 /*
2217 * No need to ask LSM for more than the first datagram.
2218 */
d7256d0e 2219 if (MSG_CMSG_COMPAT & flags) {
666547ff 2220 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
a7526eb5
AL
2221 &msg_sys, flags & ~MSG_WAITFORONE,
2222 datagrams);
d7256d0e
JMG
2223 if (err < 0)
2224 break;
2225 err = __put_user(err, &compat_entry->msg_len);
2226 ++compat_entry;
2227 } else {
a7526eb5 2228 err = ___sys_recvmsg(sock,
666547ff 2229 (struct user_msghdr __user *)entry,
a7526eb5
AL
2230 &msg_sys, flags & ~MSG_WAITFORONE,
2231 datagrams);
d7256d0e
JMG
2232 if (err < 0)
2233 break;
2234 err = put_user(err, &entry->msg_len);
2235 ++entry;
2236 }
2237
a2e27255
ACM
2238 if (err)
2239 break;
a2e27255
ACM
2240 ++datagrams;
2241
71c5c159
BB
2242 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2243 if (flags & MSG_WAITFORONE)
2244 flags |= MSG_DONTWAIT;
2245
a2e27255
ACM
2246 if (timeout) {
2247 ktime_get_ts(timeout);
2248 *timeout = timespec_sub(end_time, *timeout);
2249 if (timeout->tv_sec < 0) {
2250 timeout->tv_sec = timeout->tv_nsec = 0;
2251 break;
2252 }
2253
2254 /* Timeout, return less than vlen datagrams */
2255 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2256 break;
2257 }
2258
2259 /* Out of band data, return right away */
2260 if (msg_sys.msg_flags & MSG_OOB)
2261 break;
2262 }
2263
2264out_put:
2265 fput_light(sock->file, fput_needed);
1da177e4 2266
a2e27255
ACM
2267 if (err == 0)
2268 return datagrams;
2269
2270 if (datagrams != 0) {
2271 /*
2272 * We may return less entries than requested (vlen) if the
2273 * sock is non block and there aren't enough datagrams...
2274 */
2275 if (err != -EAGAIN) {
2276 /*
2277 * ... or if recvmsg returns an error after we
2278 * received some datagrams, where we record the
2279 * error to return on the next call or if the
2280 * app asks about it using getsockopt(SO_ERROR).
2281 */
2282 sock->sk->sk_err = -err;
2283 }
2284
2285 return datagrams;
2286 }
2287
2288 return err;
2289}
2290
2291SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2292 unsigned int, vlen, unsigned int, flags,
2293 struct timespec __user *, timeout)
2294{
2295 int datagrams;
2296 struct timespec timeout_sys;
2297
1be374a0
AL
2298 if (flags & MSG_CMSG_COMPAT)
2299 return -EINVAL;
2300
a2e27255
ACM
2301 if (!timeout)
2302 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2303
2304 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2305 return -EFAULT;
2306
2307 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2308
2309 if (datagrams > 0 &&
2310 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2311 datagrams = -EFAULT;
2312
2313 return datagrams;
2314}
2315
2316#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2317/* Argument list sizes for sys_socketcall */
2318#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2319static const unsigned char nargs[21] = {
c6d409cf
ED
2320 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2321 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2322 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2323 AL(4), AL(5), AL(4)
89bddce5
SH
2324};
2325
1da177e4
LT
2326#undef AL
2327
2328/*
89bddce5 2329 * System call vectors.
1da177e4
LT
2330 *
2331 * Argument checking cleaned up. Saved 20% in size.
2332 * This function doesn't need to set the kernel lock because
89bddce5 2333 * it is set by the callees.
1da177e4
LT
2334 */
2335
3e0fa65f 2336SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2337{
2950fa9d 2338 unsigned long a[AUDITSC_ARGS];
89bddce5 2339 unsigned long a0, a1;
1da177e4 2340 int err;
47379052 2341 unsigned int len;
1da177e4 2342
228e548e 2343 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2344 return -EINVAL;
2345
47379052
AV
2346 len = nargs[call];
2347 if (len > sizeof(a))
2348 return -EINVAL;
2349
1da177e4 2350 /* copy_from_user should be SMP safe. */
47379052 2351 if (copy_from_user(a, args, len))
1da177e4 2352 return -EFAULT;
3ec3b2fb 2353
2950fa9d
CG
2354 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2355 if (err)
2356 return err;
3ec3b2fb 2357
89bddce5
SH
2358 a0 = a[0];
2359 a1 = a[1];
2360
2361 switch (call) {
2362 case SYS_SOCKET:
2363 err = sys_socket(a0, a1, a[2]);
2364 break;
2365 case SYS_BIND:
2366 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2367 break;
2368 case SYS_CONNECT:
2369 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2370 break;
2371 case SYS_LISTEN:
2372 err = sys_listen(a0, a1);
2373 break;
2374 case SYS_ACCEPT:
de11defe
UD
2375 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2376 (int __user *)a[2], 0);
89bddce5
SH
2377 break;
2378 case SYS_GETSOCKNAME:
2379 err =
2380 sys_getsockname(a0, (struct sockaddr __user *)a1,
2381 (int __user *)a[2]);
2382 break;
2383 case SYS_GETPEERNAME:
2384 err =
2385 sys_getpeername(a0, (struct sockaddr __user *)a1,
2386 (int __user *)a[2]);
2387 break;
2388 case SYS_SOCKETPAIR:
2389 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2390 break;
2391 case SYS_SEND:
2392 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2393 break;
2394 case SYS_SENDTO:
2395 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2396 (struct sockaddr __user *)a[4], a[5]);
2397 break;
2398 case SYS_RECV:
2399 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2400 break;
2401 case SYS_RECVFROM:
2402 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2403 (struct sockaddr __user *)a[4],
2404 (int __user *)a[5]);
2405 break;
2406 case SYS_SHUTDOWN:
2407 err = sys_shutdown(a0, a1);
2408 break;
2409 case SYS_SETSOCKOPT:
2410 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2411 break;
2412 case SYS_GETSOCKOPT:
2413 err =
2414 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2415 (int __user *)a[4]);
2416 break;
2417 case SYS_SENDMSG:
666547ff 2418 err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2419 break;
228e548e
AB
2420 case SYS_SENDMMSG:
2421 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2422 break;
89bddce5 2423 case SYS_RECVMSG:
666547ff 2424 err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
89bddce5 2425 break;
a2e27255
ACM
2426 case SYS_RECVMMSG:
2427 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2428 (struct timespec __user *)a[4]);
2429 break;
de11defe
UD
2430 case SYS_ACCEPT4:
2431 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2432 (int __user *)a[2], a[3]);
aaca0bdc 2433 break;
89bddce5
SH
2434 default:
2435 err = -EINVAL;
2436 break;
1da177e4
LT
2437 }
2438 return err;
2439}
2440
89bddce5 2441#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2442
55737fda
SH
2443/**
2444 * sock_register - add a socket protocol handler
2445 * @ops: description of protocol
2446 *
1da177e4
LT
2447 * This function is called by a protocol handler that wants to
2448 * advertise its address family, and have it linked into the
e793c0f7 2449 * socket interface. The value ops->family corresponds to the
55737fda 2450 * socket system call protocol family.
1da177e4 2451 */
f0fd27d4 2452int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2453{
2454 int err;
2455
2456 if (ops->family >= NPROTO) {
3410f22e 2457 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
1da177e4
LT
2458 return -ENOBUFS;
2459 }
55737fda
SH
2460
2461 spin_lock(&net_family_lock);
190683a9
ED
2462 if (rcu_dereference_protected(net_families[ops->family],
2463 lockdep_is_held(&net_family_lock)))
55737fda
SH
2464 err = -EEXIST;
2465 else {
cf778b00 2466 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2467 err = 0;
2468 }
55737fda
SH
2469 spin_unlock(&net_family_lock);
2470
3410f22e 2471 pr_info("NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2472 return err;
2473}
c6d409cf 2474EXPORT_SYMBOL(sock_register);
1da177e4 2475
55737fda
SH
2476/**
2477 * sock_unregister - remove a protocol handler
2478 * @family: protocol family to remove
2479 *
1da177e4
LT
2480 * This function is called by a protocol handler that wants to
2481 * remove its address family, and have it unlinked from the
55737fda
SH
2482 * new socket creation.
2483 *
2484 * If protocol handler is a module, then it can use module reference
2485 * counts to protect against new references. If protocol handler is not
2486 * a module then it needs to provide its own protection in
2487 * the ops->create routine.
1da177e4 2488 */
f0fd27d4 2489void sock_unregister(int family)
1da177e4 2490{
f0fd27d4 2491 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2492
55737fda 2493 spin_lock(&net_family_lock);
a9b3cd7f 2494 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2495 spin_unlock(&net_family_lock);
2496
2497 synchronize_rcu();
2498
3410f22e 2499 pr_info("NET: Unregistered protocol family %d\n", family);
1da177e4 2500}
c6d409cf 2501EXPORT_SYMBOL(sock_unregister);
1da177e4 2502
77d76ea3 2503static int __init sock_init(void)
1da177e4 2504{
b3e19d92 2505 int err;
2ca794e5
EB
2506 /*
2507 * Initialize the network sysctl infrastructure.
2508 */
2509 err = net_sysctl_init();
2510 if (err)
2511 goto out;
b3e19d92 2512
1da177e4 2513 /*
89bddce5 2514 * Initialize skbuff SLAB cache
1da177e4
LT
2515 */
2516 skb_init();
1da177e4
LT
2517
2518 /*
89bddce5 2519 * Initialize the protocols module.
1da177e4
LT
2520 */
2521
2522 init_inodecache();
b3e19d92
NP
2523
2524 err = register_filesystem(&sock_fs_type);
2525 if (err)
2526 goto out_fs;
1da177e4 2527 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2528 if (IS_ERR(sock_mnt)) {
2529 err = PTR_ERR(sock_mnt);
2530 goto out_mount;
2531 }
77d76ea3
AK
2532
2533 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2534 */
2535
2536#ifdef CONFIG_NETFILTER
6d11cfdb
PNA
2537 err = netfilter_init();
2538 if (err)
2539 goto out;
1da177e4 2540#endif
cbeb321a 2541
408eccce 2542 ptp_classifier_init();
c1f19b51 2543
b3e19d92
NP
2544out:
2545 return err;
2546
2547out_mount:
2548 unregister_filesystem(&sock_fs_type);
2549out_fs:
2550 goto out;
1da177e4
LT
2551}
2552
77d76ea3
AK
2553core_initcall(sock_init); /* early initcall */
2554
1da177e4
LT
2555#ifdef CONFIG_PROC_FS
2556void socket_seq_show(struct seq_file *seq)
2557{
2558 int cpu;
2559 int counter = 0;
2560
6f912042 2561 for_each_possible_cpu(cpu)
89bddce5 2562 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2563
2564 /* It can be negative, by the way. 8) */
2565 if (counter < 0)
2566 counter = 0;
2567
2568 seq_printf(seq, "sockets: used %d\n", counter);
2569}
89bddce5 2570#endif /* CONFIG_PROC_FS */
1da177e4 2571
89bbfc95 2572#ifdef CONFIG_COMPAT
6b96018b 2573static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2574 unsigned int cmd, void __user *up)
7a229387 2575{
7a229387
AB
2576 mm_segment_t old_fs = get_fs();
2577 struct timeval ktv;
2578 int err;
2579
2580 set_fs(KERNEL_DS);
6b96018b 2581 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2582 set_fs(old_fs);
644595f8 2583 if (!err)
ed6fe9d6 2584 err = compat_put_timeval(&ktv, up);
644595f8 2585
7a229387
AB
2586 return err;
2587}
2588
6b96018b 2589static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2590 unsigned int cmd, void __user *up)
7a229387 2591{
7a229387
AB
2592 mm_segment_t old_fs = get_fs();
2593 struct timespec kts;
2594 int err;
2595
2596 set_fs(KERNEL_DS);
6b96018b 2597 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2598 set_fs(old_fs);
644595f8 2599 if (!err)
ed6fe9d6 2600 err = compat_put_timespec(&kts, up);
644595f8 2601
7a229387
AB
2602 return err;
2603}
2604
6b96018b 2605static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2606{
2607 struct ifreq __user *uifr;
2608 int err;
2609
2610 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2611 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2612 return -EFAULT;
2613
6b96018b 2614 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2615 if (err)
2616 return err;
2617
6b96018b 2618 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2619 return -EFAULT;
2620
2621 return 0;
2622}
2623
6b96018b 2624static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2625{
6b96018b 2626 struct compat_ifconf ifc32;
7a229387
AB
2627 struct ifconf ifc;
2628 struct ifconf __user *uifc;
6b96018b 2629 struct compat_ifreq __user *ifr32;
7a229387
AB
2630 struct ifreq __user *ifr;
2631 unsigned int i, j;
2632 int err;
2633
6b96018b 2634 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2635 return -EFAULT;
2636
43da5f2e 2637 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2638 if (ifc32.ifcbuf == 0) {
2639 ifc32.ifc_len = 0;
2640 ifc.ifc_len = 0;
2641 ifc.ifc_req = NULL;
2642 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2643 } else {
c6d409cf
ED
2644 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2645 sizeof(struct ifreq);
7a229387
AB
2646 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2647 ifc.ifc_len = len;
2648 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2649 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2650 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2651 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2652 return -EFAULT;
2653 ifr++;
2654 ifr32++;
2655 }
2656 }
2657 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2658 return -EFAULT;
2659
6b96018b 2660 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2661 if (err)
2662 return err;
2663
2664 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2665 return -EFAULT;
2666
2667 ifr = ifc.ifc_req;
2668 ifr32 = compat_ptr(ifc32.ifcbuf);
2669 for (i = 0, j = 0;
c6d409cf
ED
2670 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2671 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2672 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2673 return -EFAULT;
2674 ifr32++;
2675 ifr++;
2676 }
2677
2678 if (ifc32.ifcbuf == 0) {
2679 /* Translate from 64-bit structure multiple to
2680 * a 32-bit one.
2681 */
2682 i = ifc.ifc_len;
6b96018b 2683 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2684 ifc32.ifc_len = i;
2685 } else {
2686 ifc32.ifc_len = i;
2687 }
6b96018b 2688 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2689 return -EFAULT;
2690
2691 return 0;
2692}
2693
6b96018b 2694static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2695{
3a7da39d
BH
2696 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2697 bool convert_in = false, convert_out = false;
2698 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2699 struct ethtool_rxnfc __user *rxnfc;
7a229387 2700 struct ifreq __user *ifr;
3a7da39d
BH
2701 u32 rule_cnt = 0, actual_rule_cnt;
2702 u32 ethcmd;
7a229387 2703 u32 data;
3a7da39d 2704 int ret;
7a229387 2705
3a7da39d
BH
2706 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2707 return -EFAULT;
7a229387 2708
3a7da39d
BH
2709 compat_rxnfc = compat_ptr(data);
2710
2711 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2712 return -EFAULT;
2713
3a7da39d
BH
2714 /* Most ethtool structures are defined without padding.
2715 * Unfortunately struct ethtool_rxnfc is an exception.
2716 */
2717 switch (ethcmd) {
2718 default:
2719 break;
2720 case ETHTOOL_GRXCLSRLALL:
2721 /* Buffer size is variable */
2722 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2723 return -EFAULT;
2724 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2725 return -ENOMEM;
2726 buf_size += rule_cnt * sizeof(u32);
2727 /* fall through */
2728 case ETHTOOL_GRXRINGS:
2729 case ETHTOOL_GRXCLSRLCNT:
2730 case ETHTOOL_GRXCLSRULE:
55664f32 2731 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2732 convert_out = true;
2733 /* fall through */
2734 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2735 buf_size += sizeof(struct ethtool_rxnfc);
2736 convert_in = true;
2737 break;
2738 }
2739
2740 ifr = compat_alloc_user_space(buf_size);
954b1244 2741 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2742
2743 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2744 return -EFAULT;
2745
3a7da39d
BH
2746 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2747 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2748 return -EFAULT;
2749
3a7da39d 2750 if (convert_in) {
127fe533 2751 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2752 * fs.ring_cookie and at the end of fs, but nowhere else.
2753 */
127fe533
AD
2754 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2755 sizeof(compat_rxnfc->fs.m_ext) !=
2756 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2757 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2758 BUILD_BUG_ON(
2759 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2760 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2761 offsetof(struct ethtool_rxnfc, fs.location) -
2762 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2763
2764 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2765 (void __user *)(&rxnfc->fs.m_ext + 1) -
2766 (void __user *)rxnfc) ||
3a7da39d
BH
2767 copy_in_user(&rxnfc->fs.ring_cookie,
2768 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2769 (void __user *)(&rxnfc->fs.location + 1) -
2770 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2771 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2772 sizeof(rxnfc->rule_cnt)))
2773 return -EFAULT;
2774 }
2775
2776 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2777 if (ret)
2778 return ret;
2779
2780 if (convert_out) {
2781 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2782 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2783 (const void __user *)rxnfc) ||
3a7da39d
BH
2784 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2785 &rxnfc->fs.ring_cookie,
954b1244
SH
2786 (const void __user *)(&rxnfc->fs.location + 1) -
2787 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2788 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2789 sizeof(rxnfc->rule_cnt)))
2790 return -EFAULT;
2791
2792 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2793 /* As an optimisation, we only copy the actual
2794 * number of rules that the underlying
2795 * function returned. Since Mallory might
2796 * change the rule count in user memory, we
2797 * check that it is less than the rule count
2798 * originally given (as the user buffer size),
2799 * which has been range-checked.
2800 */
2801 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2802 return -EFAULT;
2803 if (actual_rule_cnt < rule_cnt)
2804 rule_cnt = actual_rule_cnt;
2805 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2806 &rxnfc->rule_locs[0],
2807 rule_cnt * sizeof(u32)))
2808 return -EFAULT;
2809 }
2810 }
2811
2812 return 0;
7a229387
AB
2813}
2814
7a50a240
AB
2815static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2816{
2817 void __user *uptr;
2818 compat_uptr_t uptr32;
2819 struct ifreq __user *uifr;
2820
c6d409cf 2821 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2822 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2823 return -EFAULT;
2824
2825 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2826 return -EFAULT;
2827
2828 uptr = compat_ptr(uptr32);
2829
2830 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2831 return -EFAULT;
2832
2833 return dev_ioctl(net, SIOCWANDEV, uifr);
2834}
2835
6b96018b
AB
2836static int bond_ioctl(struct net *net, unsigned int cmd,
2837 struct compat_ifreq __user *ifr32)
7a229387
AB
2838{
2839 struct ifreq kifr;
7a229387
AB
2840 mm_segment_t old_fs;
2841 int err;
7a229387
AB
2842
2843 switch (cmd) {
2844 case SIOCBONDENSLAVE:
2845 case SIOCBONDRELEASE:
2846 case SIOCBONDSETHWADDR:
2847 case SIOCBONDCHANGEACTIVE:
6b96018b 2848 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2849 return -EFAULT;
2850
2851 old_fs = get_fs();
c6d409cf 2852 set_fs(KERNEL_DS);
c3f52ae6 2853 err = dev_ioctl(net, cmd,
2854 (struct ifreq __user __force *) &kifr);
c6d409cf 2855 set_fs(old_fs);
7a229387
AB
2856
2857 return err;
7a229387 2858 default:
07d106d0 2859 return -ENOIOCTLCMD;
ccbd6a5a 2860 }
7a229387
AB
2861}
2862
590d4693
BH
2863/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2864static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
6b96018b 2865 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2866{
2867 struct ifreq __user *u_ifreq64;
7a229387
AB
2868 char tmp_buf[IFNAMSIZ];
2869 void __user *data64;
2870 u32 data32;
2871
2872 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2873 IFNAMSIZ))
2874 return -EFAULT;
417c3522 2875 if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
7a229387
AB
2876 return -EFAULT;
2877 data64 = compat_ptr(data32);
2878
2879 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2880
7a229387
AB
2881 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2882 IFNAMSIZ))
2883 return -EFAULT;
417c3522 2884 if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
7a229387
AB
2885 return -EFAULT;
2886
6b96018b 2887 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
2888}
2889
6b96018b
AB
2890static int dev_ifsioc(struct net *net, struct socket *sock,
2891 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 2892{
a2116ed2 2893 struct ifreq __user *uifr;
7a229387
AB
2894 int err;
2895
a2116ed2
AB
2896 uifr = compat_alloc_user_space(sizeof(*uifr));
2897 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2898 return -EFAULT;
2899
2900 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2901
7a229387
AB
2902 if (!err) {
2903 switch (cmd) {
2904 case SIOCGIFFLAGS:
2905 case SIOCGIFMETRIC:
2906 case SIOCGIFMTU:
2907 case SIOCGIFMEM:
2908 case SIOCGIFHWADDR:
2909 case SIOCGIFINDEX:
2910 case SIOCGIFADDR:
2911 case SIOCGIFBRDADDR:
2912 case SIOCGIFDSTADDR:
2913 case SIOCGIFNETMASK:
fab2532b 2914 case SIOCGIFPFLAGS:
7a229387 2915 case SIOCGIFTXQLEN:
fab2532b
AB
2916 case SIOCGMIIPHY:
2917 case SIOCGMIIREG:
a2116ed2 2918 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
2919 err = -EFAULT;
2920 break;
2921 }
2922 }
2923 return err;
2924}
2925
a2116ed2
AB
2926static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2927 struct compat_ifreq __user *uifr32)
2928{
2929 struct ifreq ifr;
2930 struct compat_ifmap __user *uifmap32;
2931 mm_segment_t old_fs;
2932 int err;
2933
2934 uifmap32 = &uifr32->ifr_ifru.ifru_map;
2935 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3ddc5b46
MD
2936 err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2937 err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2938 err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2939 err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2940 err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2941 err |= get_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2942 if (err)
2943 return -EFAULT;
2944
2945 old_fs = get_fs();
c6d409cf 2946 set_fs(KERNEL_DS);
c3f52ae6 2947 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 2948 set_fs(old_fs);
a2116ed2
AB
2949
2950 if (cmd == SIOCGIFMAP && !err) {
2951 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3ddc5b46
MD
2952 err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2953 err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2954 err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2955 err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2956 err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2957 err |= put_user(ifr.ifr_map.port, &uifmap32->port);
a2116ed2
AB
2958 if (err)
2959 err = -EFAULT;
2960 }
2961 return err;
2962}
2963
7a229387 2964struct rtentry32 {
c6d409cf 2965 u32 rt_pad1;
7a229387
AB
2966 struct sockaddr rt_dst; /* target address */
2967 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
2968 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
2969 unsigned short rt_flags;
2970 short rt_pad2;
2971 u32 rt_pad3;
2972 unsigned char rt_tos;
2973 unsigned char rt_class;
2974 short rt_pad4;
2975 short rt_metric; /* +1 for binary compatibility! */
7a229387 2976 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
2977 u32 rt_mtu; /* per route MTU/Window */
2978 u32 rt_window; /* Window clamping */
7a229387
AB
2979 unsigned short rt_irtt; /* Initial RTT */
2980};
2981
2982struct in6_rtmsg32 {
2983 struct in6_addr rtmsg_dst;
2984 struct in6_addr rtmsg_src;
2985 struct in6_addr rtmsg_gateway;
2986 u32 rtmsg_type;
2987 u16 rtmsg_dst_len;
2988 u16 rtmsg_src_len;
2989 u32 rtmsg_metric;
2990 u32 rtmsg_info;
2991 u32 rtmsg_flags;
2992 s32 rtmsg_ifindex;
2993};
2994
6b96018b
AB
2995static int routing_ioctl(struct net *net, struct socket *sock,
2996 unsigned int cmd, void __user *argp)
7a229387
AB
2997{
2998 int ret;
2999 void *r = NULL;
3000 struct in6_rtmsg r6;
3001 struct rtentry r4;
3002 char devname[16];
3003 u32 rtdev;
3004 mm_segment_t old_fs = get_fs();
3005
6b96018b
AB
3006 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3007 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3008 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3009 3 * sizeof(struct in6_addr));
3ddc5b46
MD
3010 ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3011 ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3012 ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3013 ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3014 ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3015 ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3016 ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3017
3018 r = (void *) &r6;
3019 } else { /* ipv4 */
6b96018b 3020 struct rtentry32 __user *ur4 = argp;
c6d409cf 3021 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3022 3 * sizeof(struct sockaddr));
3ddc5b46
MD
3023 ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3024 ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3025 ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3026 ret |= get_user(r4.rt_window, &(ur4->rt_window));
3027 ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3028 ret |= get_user(rtdev, &(ur4->rt_dev));
7a229387 3029 if (rtdev) {
c6d409cf 3030 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3031 r4.rt_dev = (char __user __force *)devname;
3032 devname[15] = 0;
7a229387
AB
3033 } else
3034 r4.rt_dev = NULL;
3035
3036 r = (void *) &r4;
3037 }
3038
3039 if (ret) {
3040 ret = -EFAULT;
3041 goto out;
3042 }
3043
c6d409cf 3044 set_fs(KERNEL_DS);
6b96018b 3045 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3046 set_fs(old_fs);
7a229387
AB
3047
3048out:
7a229387
AB
3049 return ret;
3050}
3051
3052/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3053 * for some operations; this forces use of the newer bridge-utils that
25985edc 3054 * use compatible ioctls
7a229387 3055 */
6b96018b 3056static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3057{
6b96018b 3058 compat_ulong_t tmp;
7a229387 3059
6b96018b 3060 if (get_user(tmp, argp))
7a229387
AB
3061 return -EFAULT;
3062 if (tmp == BRCTL_GET_VERSION)
3063 return BRCTL_VERSION + 1;
3064 return -EINVAL;
3065}
3066
6b96018b
AB
3067static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3068 unsigned int cmd, unsigned long arg)
3069{
3070 void __user *argp = compat_ptr(arg);
3071 struct sock *sk = sock->sk;
3072 struct net *net = sock_net(sk);
7a229387 3073
6b96018b 3074 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
590d4693 3075 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3076
3077 switch (cmd) {
3078 case SIOCSIFBR:
3079 case SIOCGIFBR:
3080 return old_bridge_ioctl(argp);
3081 case SIOCGIFNAME:
3082 return dev_ifname32(net, argp);
3083 case SIOCGIFCONF:
3084 return dev_ifconf(net, argp);
3085 case SIOCETHTOOL:
3086 return ethtool_ioctl(net, argp);
7a50a240
AB
3087 case SIOCWANDEV:
3088 return compat_siocwandev(net, argp);
a2116ed2
AB
3089 case SIOCGIFMAP:
3090 case SIOCSIFMAP:
3091 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3092 case SIOCBONDENSLAVE:
3093 case SIOCBONDRELEASE:
3094 case SIOCBONDSETHWADDR:
6b96018b
AB
3095 case SIOCBONDCHANGEACTIVE:
3096 return bond_ioctl(net, cmd, argp);
3097 case SIOCADDRT:
3098 case SIOCDELRT:
3099 return routing_ioctl(net, sock, cmd, argp);
3100 case SIOCGSTAMP:
3101 return do_siocgstamp(net, sock, cmd, argp);
3102 case SIOCGSTAMPNS:
3103 return do_siocgstampns(net, sock, cmd, argp);
590d4693
BH
3104 case SIOCBONDSLAVEINFOQUERY:
3105 case SIOCBONDINFOQUERY:
a2116ed2 3106 case SIOCSHWTSTAMP:
fd468c74 3107 case SIOCGHWTSTAMP:
590d4693 3108 return compat_ifr_data_ioctl(net, cmd, argp);
6b96018b
AB
3109
3110 case FIOSETOWN:
3111 case SIOCSPGRP:
3112 case FIOGETOWN:
3113 case SIOCGPGRP:
3114 case SIOCBRADDBR:
3115 case SIOCBRDELBR:
3116 case SIOCGIFVLAN:
3117 case SIOCSIFVLAN:
3118 case SIOCADDDLCI:
3119 case SIOCDELDLCI:
3120 return sock_ioctl(file, cmd, arg);
3121
3122 case SIOCGIFFLAGS:
3123 case SIOCSIFFLAGS:
3124 case SIOCGIFMETRIC:
3125 case SIOCSIFMETRIC:
3126 case SIOCGIFMTU:
3127 case SIOCSIFMTU:
3128 case SIOCGIFMEM:
3129 case SIOCSIFMEM:
3130 case SIOCGIFHWADDR:
3131 case SIOCSIFHWADDR:
3132 case SIOCADDMULTI:
3133 case SIOCDELMULTI:
3134 case SIOCGIFINDEX:
6b96018b
AB
3135 case SIOCGIFADDR:
3136 case SIOCSIFADDR:
3137 case SIOCSIFHWBROADCAST:
6b96018b 3138 case SIOCDIFADDR:
6b96018b
AB
3139 case SIOCGIFBRDADDR:
3140 case SIOCSIFBRDADDR:
3141 case SIOCGIFDSTADDR:
3142 case SIOCSIFDSTADDR:
3143 case SIOCGIFNETMASK:
3144 case SIOCSIFNETMASK:
3145 case SIOCSIFPFLAGS:
3146 case SIOCGIFPFLAGS:
3147 case SIOCGIFTXQLEN:
3148 case SIOCSIFTXQLEN:
3149 case SIOCBRADDIF:
3150 case SIOCBRDELIF:
9177efd3
AB
3151 case SIOCSIFNAME:
3152 case SIOCGMIIPHY:
3153 case SIOCGMIIREG:
3154 case SIOCSMIIREG:
6b96018b 3155 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3156
6b96018b
AB
3157 case SIOCSARP:
3158 case SIOCGARP:
3159 case SIOCDARP:
6b96018b 3160 case SIOCATMARK:
9177efd3
AB
3161 return sock_do_ioctl(net, sock, cmd, arg);
3162 }
3163
6b96018b
AB
3164 return -ENOIOCTLCMD;
3165}
7a229387 3166
95c96174 3167static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3168 unsigned long arg)
89bbfc95
SP
3169{
3170 struct socket *sock = file->private_data;
3171 int ret = -ENOIOCTLCMD;
87de87d5
DM
3172 struct sock *sk;
3173 struct net *net;
3174
3175 sk = sock->sk;
3176 net = sock_net(sk);
89bbfc95
SP
3177
3178 if (sock->ops->compat_ioctl)
3179 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3180
87de87d5
DM
3181 if (ret == -ENOIOCTLCMD &&
3182 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3183 ret = compat_wext_handle_ioctl(net, cmd, arg);
3184
6b96018b
AB
3185 if (ret == -ENOIOCTLCMD)
3186 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3187
89bbfc95
SP
3188 return ret;
3189}
3190#endif
3191
ac5a488e
SS
3192int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3193{
3194 return sock->ops->bind(sock, addr, addrlen);
3195}
c6d409cf 3196EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3197
3198int kernel_listen(struct socket *sock, int backlog)
3199{
3200 return sock->ops->listen(sock, backlog);
3201}
c6d409cf 3202EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3203
3204int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3205{
3206 struct sock *sk = sock->sk;
3207 int err;
3208
3209 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3210 newsock);
3211 if (err < 0)
3212 goto done;
3213
3214 err = sock->ops->accept(sock, *newsock, flags);
3215 if (err < 0) {
3216 sock_release(*newsock);
fa8705b0 3217 *newsock = NULL;
ac5a488e
SS
3218 goto done;
3219 }
3220
3221 (*newsock)->ops = sock->ops;
1b08534e 3222 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3223
3224done:
3225 return err;
3226}
c6d409cf 3227EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3228
3229int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3230 int flags)
ac5a488e
SS
3231{
3232 return sock->ops->connect(sock, addr, addrlen, flags);
3233}
c6d409cf 3234EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3235
3236int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3237 int *addrlen)
3238{
3239 return sock->ops->getname(sock, addr, addrlen, 0);
3240}
c6d409cf 3241EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3242
3243int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3244 int *addrlen)
3245{
3246 return sock->ops->getname(sock, addr, addrlen, 1);
3247}
c6d409cf 3248EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3249
3250int kernel_getsockopt(struct socket *sock, int level, int optname,
3251 char *optval, int *optlen)
3252{
3253 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3254 char __user *uoptval;
3255 int __user *uoptlen;
ac5a488e
SS
3256 int err;
3257
fb8621bb
NK
3258 uoptval = (char __user __force *) optval;
3259 uoptlen = (int __user __force *) optlen;
3260
ac5a488e
SS
3261 set_fs(KERNEL_DS);
3262 if (level == SOL_SOCKET)
fb8621bb 3263 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3264 else
fb8621bb
NK
3265 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3266 uoptlen);
ac5a488e
SS
3267 set_fs(oldfs);
3268 return err;
3269}
c6d409cf 3270EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3271
3272int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3273 char *optval, unsigned int optlen)
ac5a488e
SS
3274{
3275 mm_segment_t oldfs = get_fs();
fb8621bb 3276 char __user *uoptval;
ac5a488e
SS
3277 int err;
3278
fb8621bb
NK
3279 uoptval = (char __user __force *) optval;
3280
ac5a488e
SS
3281 set_fs(KERNEL_DS);
3282 if (level == SOL_SOCKET)
fb8621bb 3283 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3284 else
fb8621bb 3285 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3286 optlen);
3287 set_fs(oldfs);
3288 return err;
3289}
c6d409cf 3290EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3291
3292int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3293 size_t size, int flags)
3294{
3295 if (sock->ops->sendpage)
3296 return sock->ops->sendpage(sock, page, offset, size, flags);
3297
3298 return sock_no_sendpage(sock, page, offset, size, flags);
3299}
c6d409cf 3300EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3301
3302int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3303{
3304 mm_segment_t oldfs = get_fs();
3305 int err;
3306
3307 set_fs(KERNEL_DS);
3308 err = sock->ops->ioctl(sock, cmd, arg);
3309 set_fs(oldfs);
3310
3311 return err;
3312}
c6d409cf 3313EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3314
91cf45f0
TM
3315int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3316{
3317 return sock->ops->shutdown(sock, how);
3318}
91cf45f0 3319EXPORT_SYMBOL(kernel_sock_shutdown);