ipv4: fix redirect handling for TCP packets
[linux-2.6-block.git] / net / socket.c
CommitLineData
1da177e4
LT
1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
02c30a84 7 * Ross Biro
1da177e4
LT
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
89bddce5 45 * Tigran Aivazian : Made listen(2) backlog sanity checks
1da177e4
LT
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
89bddce5 56 * paradigm.
1da177e4
LT
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
1da177e4 61#include <linux/mm.h>
1da177e4
LT
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
aaca0bdc 66#include <linux/thread_info.h>
55737fda 67#include <linux/rcupdate.h>
1da177e4
LT
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
4a3e2f71 71#include <linux/mutex.h>
1da177e4 72#include <linux/if_bridge.h>
20380731
ACM
73#include <linux/if_frad.h>
74#include <linux/if_vlan.h>
1da177e4
LT
75#include <linux/init.h>
76#include <linux/poll.h>
77#include <linux/cache.h>
78#include <linux/module.h>
79#include <linux/highmem.h>
1da177e4
LT
80#include <linux/mount.h>
81#include <linux/security.h>
82#include <linux/syscalls.h>
83#include <linux/compat.h>
84#include <linux/kmod.h>
3ec3b2fb 85#include <linux/audit.h>
d86b5e0e 86#include <linux/wireless.h>
1b8d7ae4 87#include <linux/nsproxy.h>
1fd7317d 88#include <linux/magic.h>
5a0e3ad6 89#include <linux/slab.h>
600e1779 90#include <linux/xattr.h>
1da177e4
LT
91
92#include <asm/uaccess.h>
93#include <asm/unistd.h>
94
95#include <net/compat.h>
87de87d5 96#include <net/wext.h>
f8451725 97#include <net/cls_cgroup.h>
1da177e4
LT
98
99#include <net/sock.h>
100#include <linux/netfilter.h>
101
6b96018b
AB
102#include <linux/if_tun.h>
103#include <linux/ipv6_route.h>
104#include <linux/route.h>
6b96018b
AB
105#include <linux/sockios.h>
106#include <linux/atalk.h>
107
1da177e4 108static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
027445c3
BP
109static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
110 unsigned long nr_segs, loff_t pos);
111static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
112 unsigned long nr_segs, loff_t pos);
89bddce5 113static int sock_mmap(struct file *file, struct vm_area_struct *vma);
1da177e4
LT
114
115static int sock_close(struct inode *inode, struct file *file);
116static unsigned int sock_poll(struct file *file,
117 struct poll_table_struct *wait);
89bddce5 118static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
89bbfc95
SP
119#ifdef CONFIG_COMPAT
120static long compat_sock_ioctl(struct file *file,
89bddce5 121 unsigned int cmd, unsigned long arg);
89bbfc95 122#endif
1da177e4 123static int sock_fasync(int fd, struct file *filp, int on);
1da177e4
LT
124static ssize_t sock_sendpage(struct file *file, struct page *page,
125 int offset, size_t size, loff_t *ppos, int more);
9c55e01c 126static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 127 struct pipe_inode_info *pipe, size_t len,
9c55e01c 128 unsigned int flags);
1da177e4 129
1da177e4
LT
130/*
131 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
132 * in the operation structures but are done directly via the socketcall() multiplexor.
133 */
134
da7071d7 135static const struct file_operations socket_file_ops = {
1da177e4
LT
136 .owner = THIS_MODULE,
137 .llseek = no_llseek,
138 .aio_read = sock_aio_read,
139 .aio_write = sock_aio_write,
140 .poll = sock_poll,
141 .unlocked_ioctl = sock_ioctl,
89bbfc95
SP
142#ifdef CONFIG_COMPAT
143 .compat_ioctl = compat_sock_ioctl,
144#endif
1da177e4
LT
145 .mmap = sock_mmap,
146 .open = sock_no_open, /* special open code to disallow open via /proc */
147 .release = sock_close,
148 .fasync = sock_fasync,
5274f052
JA
149 .sendpage = sock_sendpage,
150 .splice_write = generic_splice_sendpage,
9c55e01c 151 .splice_read = sock_splice_read,
1da177e4
LT
152};
153
154/*
155 * The protocol list. Each protocol is registered in here.
156 */
157
1da177e4 158static DEFINE_SPINLOCK(net_family_lock);
190683a9 159static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
1da177e4 160
1da177e4
LT
161/*
162 * Statistics counters of the socket lists
163 */
164
c6d409cf 165static DEFINE_PER_CPU(int, sockets_in_use);
1da177e4
LT
166
167/*
89bddce5
SH
168 * Support routines.
169 * Move socket addresses back and forth across the kernel/user
170 * divide and look after the messy bits.
1da177e4
LT
171 */
172
1da177e4
LT
173/**
174 * move_addr_to_kernel - copy a socket address into kernel space
175 * @uaddr: Address in user space
176 * @kaddr: Address in kernel space
177 * @ulen: Length in user space
178 *
179 * The address is copied into kernel space. If the provided address is
180 * too long an error code of -EINVAL is returned. If the copy gives
181 * invalid addresses -EFAULT is returned. On a success 0 is returned.
182 */
183
43db362d 184int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
1da177e4 185{
230b1839 186 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
1da177e4 187 return -EINVAL;
89bddce5 188 if (ulen == 0)
1da177e4 189 return 0;
89bddce5 190 if (copy_from_user(kaddr, uaddr, ulen))
1da177e4 191 return -EFAULT;
3ec3b2fb 192 return audit_sockaddr(ulen, kaddr);
1da177e4
LT
193}
194
195/**
196 * move_addr_to_user - copy an address to user space
197 * @kaddr: kernel space address
198 * @klen: length of address in kernel
199 * @uaddr: user space address
200 * @ulen: pointer to user length field
201 *
202 * The value pointed to by ulen on entry is the buffer length available.
203 * This is overwritten with the buffer space used. -EINVAL is returned
204 * if an overlong buffer is specified or a negative buffer size. -EFAULT
205 * is returned if either the buffer or the length field are not
206 * accessible.
207 * After copying the data up to the limit the user specifies, the true
208 * length of the data is written over the length limit the user
209 * specified. Zero is returned for a success.
210 */
89bddce5 211
43db362d 212static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
11165f14 213 void __user *uaddr, int __user *ulen)
1da177e4
LT
214{
215 int err;
216 int len;
217
89bddce5
SH
218 err = get_user(len, ulen);
219 if (err)
1da177e4 220 return err;
89bddce5
SH
221 if (len > klen)
222 len = klen;
230b1839 223 if (len < 0 || len > sizeof(struct sockaddr_storage))
1da177e4 224 return -EINVAL;
89bddce5 225 if (len) {
d6fe3945
SG
226 if (audit_sockaddr(klen, kaddr))
227 return -ENOMEM;
89bddce5 228 if (copy_to_user(uaddr, kaddr, len))
1da177e4
LT
229 return -EFAULT;
230 }
231 /*
89bddce5
SH
232 * "fromlen shall refer to the value before truncation.."
233 * 1003.1g
1da177e4
LT
234 */
235 return __put_user(klen, ulen);
236}
237
e18b890b 238static struct kmem_cache *sock_inode_cachep __read_mostly;
1da177e4
LT
239
240static struct inode *sock_alloc_inode(struct super_block *sb)
241{
242 struct socket_alloc *ei;
eaefd110 243 struct socket_wq *wq;
89bddce5 244
e94b1766 245 ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
1da177e4
LT
246 if (!ei)
247 return NULL;
eaefd110
ED
248 wq = kmalloc(sizeof(*wq), GFP_KERNEL);
249 if (!wq) {
43815482
ED
250 kmem_cache_free(sock_inode_cachep, ei);
251 return NULL;
252 }
eaefd110
ED
253 init_waitqueue_head(&wq->wait);
254 wq->fasync_list = NULL;
255 RCU_INIT_POINTER(ei->socket.wq, wq);
89bddce5 256
1da177e4
LT
257 ei->socket.state = SS_UNCONNECTED;
258 ei->socket.flags = 0;
259 ei->socket.ops = NULL;
260 ei->socket.sk = NULL;
261 ei->socket.file = NULL;
1da177e4
LT
262
263 return &ei->vfs_inode;
264}
265
266static void sock_destroy_inode(struct inode *inode)
267{
43815482 268 struct socket_alloc *ei;
eaefd110 269 struct socket_wq *wq;
43815482
ED
270
271 ei = container_of(inode, struct socket_alloc, vfs_inode);
eaefd110 272 wq = rcu_dereference_protected(ei->socket.wq, 1);
61845220 273 kfree_rcu(wq, rcu);
43815482 274 kmem_cache_free(sock_inode_cachep, ei);
1da177e4
LT
275}
276
51cc5068 277static void init_once(void *foo)
1da177e4 278{
89bddce5 279 struct socket_alloc *ei = (struct socket_alloc *)foo;
1da177e4 280
a35afb83 281 inode_init_once(&ei->vfs_inode);
1da177e4 282}
89bddce5 283
1da177e4
LT
284static int init_inodecache(void)
285{
286 sock_inode_cachep = kmem_cache_create("sock_inode_cache",
89bddce5
SH
287 sizeof(struct socket_alloc),
288 0,
289 (SLAB_HWCACHE_ALIGN |
290 SLAB_RECLAIM_ACCOUNT |
291 SLAB_MEM_SPREAD),
20c2df83 292 init_once);
1da177e4
LT
293 if (sock_inode_cachep == NULL)
294 return -ENOMEM;
295 return 0;
296}
297
b87221de 298static const struct super_operations sockfs_ops = {
c6d409cf
ED
299 .alloc_inode = sock_alloc_inode,
300 .destroy_inode = sock_destroy_inode,
301 .statfs = simple_statfs,
1da177e4
LT
302};
303
c23fbb6b
ED
304/*
305 * sockfs_dname() is called from d_path().
306 */
307static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
308{
309 return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
310 dentry->d_inode->i_ino);
311}
312
3ba13d17 313static const struct dentry_operations sockfs_dentry_operations = {
c23fbb6b 314 .d_dname = sockfs_dname,
1da177e4
LT
315};
316
c74a1cbb
AV
317static struct dentry *sockfs_mount(struct file_system_type *fs_type,
318 int flags, const char *dev_name, void *data)
319{
320 return mount_pseudo(fs_type, "socket:", &sockfs_ops,
321 &sockfs_dentry_operations, SOCKFS_MAGIC);
322}
323
324static struct vfsmount *sock_mnt __read_mostly;
325
326static struct file_system_type sock_fs_type = {
327 .name = "sockfs",
328 .mount = sockfs_mount,
329 .kill_sb = kill_anon_super,
330};
331
1da177e4
LT
332/*
333 * Obtains the first available file descriptor and sets it up for use.
334 *
39d8c1b6
DM
335 * These functions create file structures and maps them to fd space
336 * of the current process. On success it returns file descriptor
1da177e4
LT
337 * and file struct implicitly stored in sock->file.
338 * Note that another thread may close file descriptor before we return
339 * from this function. We use the fact that now we do not refer
340 * to socket after mapping. If one day we will need it, this
341 * function will increment ref. count on file by 1.
342 *
343 * In any case returned fd MAY BE not valid!
344 * This race condition is unavoidable
345 * with shared fd spaces, we cannot solve it inside kernel,
346 * but we take care of internal coherence yet.
347 */
348
aab174f0 349struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
1da177e4 350{
7cbe66b6 351 struct qstr name = { .name = "" };
2c48b9c4 352 struct path path;
7cbe66b6 353 struct file *file;
1da177e4 354
600e1779
MY
355 if (dname) {
356 name.name = dname;
357 name.len = strlen(name.name);
358 } else if (sock->sk) {
359 name.name = sock->sk->sk_prot_creator->name;
360 name.len = strlen(name.name);
361 }
4b936885 362 path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
28407630
AV
363 if (unlikely(!path.dentry))
364 return ERR_PTR(-ENOMEM);
2c48b9c4 365 path.mnt = mntget(sock_mnt);
39d8c1b6 366
2c48b9c4 367 d_instantiate(path.dentry, SOCK_INODE(sock));
cc3808f8 368 SOCK_INODE(sock)->i_fop = &socket_file_ops;
39d8c1b6 369
2c48b9c4 370 file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
ce8d2cdf 371 &socket_file_ops);
39b65252 372 if (unlikely(IS_ERR(file))) {
cc3808f8 373 /* drop dentry, keep inode */
7de9c6ee 374 ihold(path.dentry->d_inode);
2c48b9c4 375 path_put(&path);
39b65252 376 return file;
cc3808f8
AV
377 }
378
379 sock->file = file;
77d27200 380 file->f_flags = O_RDWR | (flags & O_NONBLOCK);
39d8c1b6 381 file->private_data = sock;
28407630 382 return file;
39d8c1b6 383}
56b31d1c 384EXPORT_SYMBOL(sock_alloc_file);
39d8c1b6 385
56b31d1c 386static int sock_map_fd(struct socket *sock, int flags)
39d8c1b6
DM
387{
388 struct file *newfile;
28407630
AV
389 int fd = get_unused_fd_flags(flags);
390 if (unlikely(fd < 0))
391 return fd;
39d8c1b6 392
aab174f0 393 newfile = sock_alloc_file(sock, flags, NULL);
28407630 394 if (likely(!IS_ERR(newfile))) {
39d8c1b6 395 fd_install(fd, newfile);
28407630
AV
396 return fd;
397 }
7cbe66b6 398
28407630
AV
399 put_unused_fd(fd);
400 return PTR_ERR(newfile);
1da177e4
LT
401}
402
406a3c63 403struct socket *sock_from_file(struct file *file, int *err)
6cb153ca 404{
6cb153ca
BL
405 if (file->f_op == &socket_file_ops)
406 return file->private_data; /* set in sock_map_fd */
407
23bb80d2
ED
408 *err = -ENOTSOCK;
409 return NULL;
6cb153ca 410}
406a3c63 411EXPORT_SYMBOL(sock_from_file);
6cb153ca 412
1da177e4 413/**
c6d409cf 414 * sockfd_lookup - Go from a file number to its socket slot
1da177e4
LT
415 * @fd: file handle
416 * @err: pointer to an error code return
417 *
418 * The file handle passed in is locked and the socket it is bound
419 * too is returned. If an error occurs the err pointer is overwritten
420 * with a negative errno code and NULL is returned. The function checks
421 * for both invalid handles and passing a handle which is not a socket.
422 *
423 * On a success the socket object pointer is returned.
424 */
425
426struct socket *sockfd_lookup(int fd, int *err)
427{
428 struct file *file;
1da177e4
LT
429 struct socket *sock;
430
89bddce5
SH
431 file = fget(fd);
432 if (!file) {
1da177e4
LT
433 *err = -EBADF;
434 return NULL;
435 }
89bddce5 436
6cb153ca
BL
437 sock = sock_from_file(file, err);
438 if (!sock)
1da177e4 439 fput(file);
6cb153ca
BL
440 return sock;
441}
c6d409cf 442EXPORT_SYMBOL(sockfd_lookup);
1da177e4 443
6cb153ca
BL
444static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
445{
446 struct file *file;
447 struct socket *sock;
448
3672558c 449 *err = -EBADF;
6cb153ca
BL
450 file = fget_light(fd, fput_needed);
451 if (file) {
452 sock = sock_from_file(file, err);
453 if (sock)
454 return sock;
455 fput_light(file, *fput_needed);
1da177e4 456 }
6cb153ca 457 return NULL;
1da177e4
LT
458}
459
600e1779
MY
460#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
461#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
462#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
463static ssize_t sockfs_getxattr(struct dentry *dentry,
464 const char *name, void *value, size_t size)
465{
466 const char *proto_name;
467 size_t proto_size;
468 int error;
469
470 error = -ENODATA;
471 if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
472 proto_name = dentry->d_name.name;
473 proto_size = strlen(proto_name);
474
475 if (value) {
476 error = -ERANGE;
477 if (proto_size + 1 > size)
478 goto out;
479
480 strncpy(value, proto_name, proto_size + 1);
481 }
482 error = proto_size + 1;
483 }
484
485out:
486 return error;
487}
488
489static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
490 size_t size)
491{
492 ssize_t len;
493 ssize_t used = 0;
494
495 len = security_inode_listsecurity(dentry->d_inode, buffer, size);
496 if (len < 0)
497 return len;
498 used += len;
499 if (buffer) {
500 if (size < used)
501 return -ERANGE;
502 buffer += len;
503 }
504
505 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
506 used += len;
507 if (buffer) {
508 if (size < used)
509 return -ERANGE;
510 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
511 buffer += len;
512 }
513
514 return used;
515}
516
517static const struct inode_operations sockfs_inode_ops = {
518 .getxattr = sockfs_getxattr,
519 .listxattr = sockfs_listxattr,
520};
521
1da177e4
LT
522/**
523 * sock_alloc - allocate a socket
89bddce5 524 *
1da177e4
LT
525 * Allocate a new inode and socket object. The two are bound together
526 * and initialised. The socket is then returned. If we are out of inodes
527 * NULL is returned.
528 */
529
530static struct socket *sock_alloc(void)
531{
89bddce5
SH
532 struct inode *inode;
533 struct socket *sock;
1da177e4 534
a209dfc7 535 inode = new_inode_pseudo(sock_mnt->mnt_sb);
1da177e4
LT
536 if (!inode)
537 return NULL;
538
539 sock = SOCKET_I(inode);
540
29a020d3 541 kmemcheck_annotate_bitfield(sock, type);
85fe4025 542 inode->i_ino = get_next_ino();
89bddce5 543 inode->i_mode = S_IFSOCK | S_IRWXUGO;
8192b0c4
DH
544 inode->i_uid = current_fsuid();
545 inode->i_gid = current_fsgid();
600e1779 546 inode->i_op = &sockfs_inode_ops;
1da177e4 547
19e8d69c 548 this_cpu_add(sockets_in_use, 1);
1da177e4
LT
549 return sock;
550}
551
552/*
553 * In theory you can't get an open on this inode, but /proc provides
554 * a back door. Remember to keep it shut otherwise you'll let the
555 * creepy crawlies in.
556 */
89bddce5 557
1da177e4
LT
558static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
559{
560 return -ENXIO;
561}
562
4b6f5d20 563const struct file_operations bad_sock_fops = {
1da177e4
LT
564 .owner = THIS_MODULE,
565 .open = sock_no_open,
6038f373 566 .llseek = noop_llseek,
1da177e4
LT
567};
568
569/**
570 * sock_release - close a socket
571 * @sock: socket to close
572 *
573 * The socket is released from the protocol stack if it has a release
574 * callback, and the inode is then released if the socket is bound to
89bddce5 575 * an inode not a file.
1da177e4 576 */
89bddce5 577
1da177e4
LT
578void sock_release(struct socket *sock)
579{
580 if (sock->ops) {
581 struct module *owner = sock->ops->owner;
582
583 sock->ops->release(sock);
584 sock->ops = NULL;
585 module_put(owner);
586 }
587
eaefd110 588 if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
1da177e4
LT
589 printk(KERN_ERR "sock_release: fasync list not empty!\n");
590
b09e786b
MP
591 if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
592 return;
593
19e8d69c 594 this_cpu_sub(sockets_in_use, 1);
1da177e4
LT
595 if (!sock->file) {
596 iput(SOCK_INODE(sock));
597 return;
598 }
89bddce5 599 sock->file = NULL;
1da177e4 600}
c6d409cf 601EXPORT_SYMBOL(sock_release);
1da177e4 602
bf84a010 603void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
20d49473 604{
2244d07b 605 *tx_flags = 0;
20d49473 606 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
2244d07b 607 *tx_flags |= SKBTX_HW_TSTAMP;
20d49473 608 if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
2244d07b 609 *tx_flags |= SKBTX_SW_TSTAMP;
6e3e939f
JB
610 if (sock_flag(sk, SOCK_WIFI_STATUS))
611 *tx_flags |= SKBTX_WIFI_STATUS;
20d49473
PO
612}
613EXPORT_SYMBOL(sock_tx_timestamp);
614
228e548e
AB
615static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
616 struct msghdr *msg, size_t size)
1da177e4
LT
617{
618 struct sock_iocb *si = kiocb_to_siocb(iocb);
1da177e4
LT
619
620 si->sock = sock;
621 si->scm = NULL;
622 si->msg = msg;
623 si->size = size;
624
1da177e4
LT
625 return sock->ops->sendmsg(iocb, sock, msg, size);
626}
627
228e548e
AB
628static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
629 struct msghdr *msg, size_t size)
630{
631 int err = security_socket_sendmsg(sock, msg, size);
632
633 return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
634}
635
1da177e4
LT
636int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
637{
638 struct kiocb iocb;
639 struct sock_iocb siocb;
640 int ret;
641
642 init_sync_kiocb(&iocb, NULL);
643 iocb.private = &siocb;
644 ret = __sock_sendmsg(&iocb, sock, msg, size);
645 if (-EIOCBQUEUED == ret)
646 ret = wait_on_sync_kiocb(&iocb);
647 return ret;
648}
c6d409cf 649EXPORT_SYMBOL(sock_sendmsg);
1da177e4 650
894dc24c 651static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
228e548e
AB
652{
653 struct kiocb iocb;
654 struct sock_iocb siocb;
655 int ret;
656
657 init_sync_kiocb(&iocb, NULL);
658 iocb.private = &siocb;
659 ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
660 if (-EIOCBQUEUED == ret)
661 ret = wait_on_sync_kiocb(&iocb);
662 return ret;
663}
664
1da177e4
LT
665int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
666 struct kvec *vec, size_t num, size_t size)
667{
668 mm_segment_t oldfs = get_fs();
669 int result;
670
671 set_fs(KERNEL_DS);
672 /*
673 * the following is safe, since for compiler definitions of kvec and
674 * iovec are identical, yielding the same in-core layout and alignment
675 */
89bddce5 676 msg->msg_iov = (struct iovec *)vec;
1da177e4
LT
677 msg->msg_iovlen = num;
678 result = sock_sendmsg(sock, msg, size);
679 set_fs(oldfs);
680 return result;
681}
c6d409cf 682EXPORT_SYMBOL(kernel_sendmsg);
1da177e4 683
92f37fd2
ED
684/*
685 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
686 */
687void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
688 struct sk_buff *skb)
689{
20d49473
PO
690 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
691 struct timespec ts[3];
692 int empty = 1;
693 struct skb_shared_hwtstamps *shhwtstamps =
694 skb_hwtstamps(skb);
695
696 /* Race occurred between timestamp enabling and packet
697 receiving. Fill in the current time for now. */
698 if (need_software_tstamp && skb->tstamp.tv64 == 0)
699 __net_timestamp(skb);
700
701 if (need_software_tstamp) {
702 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
703 struct timeval tv;
704 skb_get_timestamp(skb, &tv);
705 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
706 sizeof(tv), &tv);
707 } else {
842509b8 708 skb_get_timestampns(skb, &ts[0]);
20d49473 709 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
842509b8 710 sizeof(ts[0]), &ts[0]);
20d49473
PO
711 }
712 }
713
714
715 memset(ts, 0, sizeof(ts));
6e94d1ef
DB
716 if (sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE) &&
717 ktime_to_timespec_cond(skb->tstamp, ts + 0))
20d49473 718 empty = 0;
20d49473
PO
719 if (shhwtstamps) {
720 if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
6e94d1ef 721 ktime_to_timespec_cond(shhwtstamps->syststamp, ts + 1))
20d49473
PO
722 empty = 0;
723 if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
6e94d1ef 724 ktime_to_timespec_cond(shhwtstamps->hwtstamp, ts + 2))
20d49473 725 empty = 0;
92f37fd2 726 }
20d49473
PO
727 if (!empty)
728 put_cmsg(msg, SOL_SOCKET,
729 SCM_TIMESTAMPING, sizeof(ts), &ts);
92f37fd2 730}
7c81fd8b
ACM
731EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
732
6e3e939f
JB
733void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
734 struct sk_buff *skb)
735{
736 int ack;
737
738 if (!sock_flag(sk, SOCK_WIFI_STATUS))
739 return;
740 if (!skb->wifi_acked_valid)
741 return;
742
743 ack = skb->wifi_acked;
744
745 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
746}
747EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
748
11165f14 749static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
750 struct sk_buff *skb)
3b885787
NH
751{
752 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
753 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
754 sizeof(__u32), &skb->dropcount);
755}
756
767dd033 757void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
3b885787
NH
758 struct sk_buff *skb)
759{
760 sock_recv_timestamp(msg, sk, skb);
761 sock_recv_drops(msg, sk, skb);
762}
767dd033 763EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
3b885787 764
a2e27255
ACM
765static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
766 struct msghdr *msg, size_t size, int flags)
1da177e4 767{
1da177e4
LT
768 struct sock_iocb *si = kiocb_to_siocb(iocb);
769
770 si->sock = sock;
771 si->scm = NULL;
772 si->msg = msg;
773 si->size = size;
774 si->flags = flags;
775
1da177e4
LT
776 return sock->ops->recvmsg(iocb, sock, msg, size, flags);
777}
778
a2e27255
ACM
779static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
780 struct msghdr *msg, size_t size, int flags)
781{
782 int err = security_socket_recvmsg(sock, msg, size, flags);
783
784 return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
785}
786
89bddce5 787int sock_recvmsg(struct socket *sock, struct msghdr *msg,
1da177e4
LT
788 size_t size, int flags)
789{
790 struct kiocb iocb;
791 struct sock_iocb siocb;
792 int ret;
793
89bddce5 794 init_sync_kiocb(&iocb, NULL);
1da177e4
LT
795 iocb.private = &siocb;
796 ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
797 if (-EIOCBQUEUED == ret)
798 ret = wait_on_sync_kiocb(&iocb);
799 return ret;
800}
c6d409cf 801EXPORT_SYMBOL(sock_recvmsg);
1da177e4 802
a2e27255
ACM
803static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
804 size_t size, int flags)
805{
806 struct kiocb iocb;
807 struct sock_iocb siocb;
808 int ret;
809
810 init_sync_kiocb(&iocb, NULL);
811 iocb.private = &siocb;
812 ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
813 if (-EIOCBQUEUED == ret)
814 ret = wait_on_sync_kiocb(&iocb);
815 return ret;
816}
817
c1249c0a
ML
818/**
819 * kernel_recvmsg - Receive a message from a socket (kernel space)
820 * @sock: The socket to receive the message from
821 * @msg: Received message
822 * @vec: Input s/g array for message data
823 * @num: Size of input s/g array
824 * @size: Number of bytes to read
825 * @flags: Message flags (MSG_DONTWAIT, etc...)
826 *
827 * On return the msg structure contains the scatter/gather array passed in the
828 * vec argument. The array is modified so that it consists of the unfilled
829 * portion of the original array.
830 *
831 * The returned value is the total number of bytes received, or an error.
832 */
89bddce5
SH
833int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
834 struct kvec *vec, size_t num, size_t size, int flags)
1da177e4
LT
835{
836 mm_segment_t oldfs = get_fs();
837 int result;
838
839 set_fs(KERNEL_DS);
840 /*
841 * the following is safe, since for compiler definitions of kvec and
842 * iovec are identical, yielding the same in-core layout and alignment
843 */
89bddce5 844 msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
1da177e4
LT
845 result = sock_recvmsg(sock, msg, size, flags);
846 set_fs(oldfs);
847 return result;
848}
c6d409cf 849EXPORT_SYMBOL(kernel_recvmsg);
1da177e4
LT
850
851static void sock_aio_dtor(struct kiocb *iocb)
852{
853 kfree(iocb->private);
854}
855
ce1d4d3e
CH
856static ssize_t sock_sendpage(struct file *file, struct page *page,
857 int offset, size_t size, loff_t *ppos, int more)
1da177e4 858{
1da177e4
LT
859 struct socket *sock;
860 int flags;
861
ce1d4d3e
CH
862 sock = file->private_data;
863
35f9c09f
ED
864 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
865 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
866 flags |= more;
ce1d4d3e 867
e6949583 868 return kernel_sendpage(sock, page, offset, size, flags);
ce1d4d3e 869}
1da177e4 870
9c55e01c 871static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
c6d409cf 872 struct pipe_inode_info *pipe, size_t len,
9c55e01c
JA
873 unsigned int flags)
874{
875 struct socket *sock = file->private_data;
876
997b37da
RDC
877 if (unlikely(!sock->ops->splice_read))
878 return -EINVAL;
879
9c55e01c
JA
880 return sock->ops->splice_read(sock, ppos, pipe, len, flags);
881}
882
ce1d4d3e 883static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
89bddce5 884 struct sock_iocb *siocb)
ce1d4d3e
CH
885{
886 if (!is_sync_kiocb(iocb)) {
887 siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
888 if (!siocb)
889 return NULL;
1da177e4
LT
890 iocb->ki_dtor = sock_aio_dtor;
891 }
1da177e4 892
ce1d4d3e 893 siocb->kiocb = iocb;
ce1d4d3e
CH
894 iocb->private = siocb;
895 return siocb;
1da177e4
LT
896}
897
ce1d4d3e 898static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
899 struct file *file, const struct iovec *iov,
900 unsigned long nr_segs)
ce1d4d3e
CH
901{
902 struct socket *sock = file->private_data;
903 size_t size = 0;
904 int i;
1da177e4 905
89bddce5
SH
906 for (i = 0; i < nr_segs; i++)
907 size += iov[i].iov_len;
1da177e4 908
ce1d4d3e
CH
909 msg->msg_name = NULL;
910 msg->msg_namelen = 0;
911 msg->msg_control = NULL;
912 msg->msg_controllen = 0;
89bddce5 913 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
914 msg->msg_iovlen = nr_segs;
915 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
916
917 return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
918}
919
027445c3
BP
920static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
921 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
922{
923 struct sock_iocb siocb, *x;
924
1da177e4
LT
925 if (pos != 0)
926 return -ESPIPE;
027445c3
BP
927
928 if (iocb->ki_left == 0) /* Match SYS5 behaviour */
1da177e4
LT
929 return 0;
930
027445c3
BP
931
932 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
933 if (!x)
934 return -ENOMEM;
027445c3 935 return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
936}
937
ce1d4d3e 938static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
027445c3
BP
939 struct file *file, const struct iovec *iov,
940 unsigned long nr_segs)
1da177e4 941{
ce1d4d3e
CH
942 struct socket *sock = file->private_data;
943 size_t size = 0;
944 int i;
1da177e4 945
89bddce5
SH
946 for (i = 0; i < nr_segs; i++)
947 size += iov[i].iov_len;
1da177e4 948
ce1d4d3e
CH
949 msg->msg_name = NULL;
950 msg->msg_namelen = 0;
951 msg->msg_control = NULL;
952 msg->msg_controllen = 0;
89bddce5 953 msg->msg_iov = (struct iovec *)iov;
ce1d4d3e
CH
954 msg->msg_iovlen = nr_segs;
955 msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
956 if (sock->type == SOCK_SEQPACKET)
957 msg->msg_flags |= MSG_EOR;
1da177e4 958
ce1d4d3e 959 return __sock_sendmsg(iocb, sock, msg, size);
1da177e4
LT
960}
961
027445c3
BP
962static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
963 unsigned long nr_segs, loff_t pos)
ce1d4d3e
CH
964{
965 struct sock_iocb siocb, *x;
1da177e4 966
ce1d4d3e
CH
967 if (pos != 0)
968 return -ESPIPE;
027445c3 969
027445c3 970 x = alloc_sock_iocb(iocb, &siocb);
ce1d4d3e
CH
971 if (!x)
972 return -ENOMEM;
1da177e4 973
027445c3 974 return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
1da177e4
LT
975}
976
1da177e4
LT
977/*
978 * Atomic setting of ioctl hooks to avoid race
979 * with module unload.
980 */
981
4a3e2f71 982static DEFINE_MUTEX(br_ioctl_mutex);
c6d409cf 983static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1da177e4 984
881d966b 985void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1da177e4 986{
4a3e2f71 987 mutex_lock(&br_ioctl_mutex);
1da177e4 988 br_ioctl_hook = hook;
4a3e2f71 989 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
990}
991EXPORT_SYMBOL(brioctl_set);
992
4a3e2f71 993static DEFINE_MUTEX(vlan_ioctl_mutex);
881d966b 994static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1da177e4 995
881d966b 996void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1da177e4 997{
4a3e2f71 998 mutex_lock(&vlan_ioctl_mutex);
1da177e4 999 vlan_ioctl_hook = hook;
4a3e2f71 1000 mutex_unlock(&vlan_ioctl_mutex);
1da177e4
LT
1001}
1002EXPORT_SYMBOL(vlan_ioctl_set);
1003
4a3e2f71 1004static DEFINE_MUTEX(dlci_ioctl_mutex);
89bddce5 1005static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1da177e4 1006
89bddce5 1007void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1da177e4 1008{
4a3e2f71 1009 mutex_lock(&dlci_ioctl_mutex);
1da177e4 1010 dlci_ioctl_hook = hook;
4a3e2f71 1011 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1012}
1013EXPORT_SYMBOL(dlci_ioctl_set);
1014
6b96018b
AB
1015static long sock_do_ioctl(struct net *net, struct socket *sock,
1016 unsigned int cmd, unsigned long arg)
1017{
1018 int err;
1019 void __user *argp = (void __user *)arg;
1020
1021 err = sock->ops->ioctl(sock, cmd, arg);
1022
1023 /*
1024 * If this ioctl is unknown try to hand it down
1025 * to the NIC driver.
1026 */
1027 if (err == -ENOIOCTLCMD)
1028 err = dev_ioctl(net, cmd, argp);
1029
1030 return err;
1031}
1032
1da177e4
LT
1033/*
1034 * With an ioctl, arg may well be a user mode pointer, but we don't know
1035 * what to do with it - that's up to the protocol still.
1036 */
1037
1038static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1039{
1040 struct socket *sock;
881d966b 1041 struct sock *sk;
1da177e4
LT
1042 void __user *argp = (void __user *)arg;
1043 int pid, err;
881d966b 1044 struct net *net;
1da177e4 1045
b69aee04 1046 sock = file->private_data;
881d966b 1047 sk = sock->sk;
3b1e0a65 1048 net = sock_net(sk);
1da177e4 1049 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
881d966b 1050 err = dev_ioctl(net, cmd, argp);
1da177e4 1051 } else
3d23e349 1052#ifdef CONFIG_WEXT_CORE
1da177e4 1053 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
881d966b 1054 err = dev_ioctl(net, cmd, argp);
1da177e4 1055 } else
3d23e349 1056#endif
89bddce5 1057 switch (cmd) {
1da177e4
LT
1058 case FIOSETOWN:
1059 case SIOCSPGRP:
1060 err = -EFAULT;
1061 if (get_user(pid, (int __user *)argp))
1062 break;
1063 err = f_setown(sock->file, pid, 1);
1064 break;
1065 case FIOGETOWN:
1066 case SIOCGPGRP:
609d7fa9 1067 err = put_user(f_getown(sock->file),
89bddce5 1068 (int __user *)argp);
1da177e4
LT
1069 break;
1070 case SIOCGIFBR:
1071 case SIOCSIFBR:
1072 case SIOCBRADDBR:
1073 case SIOCBRDELBR:
1074 err = -ENOPKG;
1075 if (!br_ioctl_hook)
1076 request_module("bridge");
1077
4a3e2f71 1078 mutex_lock(&br_ioctl_mutex);
89bddce5 1079 if (br_ioctl_hook)
881d966b 1080 err = br_ioctl_hook(net, cmd, argp);
4a3e2f71 1081 mutex_unlock(&br_ioctl_mutex);
1da177e4
LT
1082 break;
1083 case SIOCGIFVLAN:
1084 case SIOCSIFVLAN:
1085 err = -ENOPKG;
1086 if (!vlan_ioctl_hook)
1087 request_module("8021q");
1088
4a3e2f71 1089 mutex_lock(&vlan_ioctl_mutex);
1da177e4 1090 if (vlan_ioctl_hook)
881d966b 1091 err = vlan_ioctl_hook(net, argp);
4a3e2f71 1092 mutex_unlock(&vlan_ioctl_mutex);
1da177e4 1093 break;
1da177e4
LT
1094 case SIOCADDDLCI:
1095 case SIOCDELDLCI:
1096 err = -ENOPKG;
1097 if (!dlci_ioctl_hook)
1098 request_module("dlci");
1099
7512cbf6
PE
1100 mutex_lock(&dlci_ioctl_mutex);
1101 if (dlci_ioctl_hook)
1da177e4 1102 err = dlci_ioctl_hook(cmd, argp);
7512cbf6 1103 mutex_unlock(&dlci_ioctl_mutex);
1da177e4
LT
1104 break;
1105 default:
6b96018b 1106 err = sock_do_ioctl(net, sock, cmd, arg);
1da177e4 1107 break;
89bddce5 1108 }
1da177e4
LT
1109 return err;
1110}
1111
1112int sock_create_lite(int family, int type, int protocol, struct socket **res)
1113{
1114 int err;
1115 struct socket *sock = NULL;
89bddce5 1116
1da177e4
LT
1117 err = security_socket_create(family, type, protocol, 1);
1118 if (err)
1119 goto out;
1120
1121 sock = sock_alloc();
1122 if (!sock) {
1123 err = -ENOMEM;
1124 goto out;
1125 }
1126
1da177e4 1127 sock->type = type;
7420ed23
VY
1128 err = security_socket_post_create(sock, family, type, protocol, 1);
1129 if (err)
1130 goto out_release;
1131
1da177e4
LT
1132out:
1133 *res = sock;
1134 return err;
7420ed23
VY
1135out_release:
1136 sock_release(sock);
1137 sock = NULL;
1138 goto out;
1da177e4 1139}
c6d409cf 1140EXPORT_SYMBOL(sock_create_lite);
1da177e4
LT
1141
1142/* No kernel lock held - perfect */
89bddce5 1143static unsigned int sock_poll(struct file *file, poll_table *wait)
1da177e4
LT
1144{
1145 struct socket *sock;
1146
1147 /*
89bddce5 1148 * We can't return errors to poll, so it's either yes or no.
1da177e4 1149 */
b69aee04 1150 sock = file->private_data;
1da177e4
LT
1151 return sock->ops->poll(file, sock, wait);
1152}
1153
89bddce5 1154static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1da177e4 1155{
b69aee04 1156 struct socket *sock = file->private_data;
1da177e4
LT
1157
1158 return sock->ops->mmap(file, sock, vma);
1159}
1160
20380731 1161static int sock_close(struct inode *inode, struct file *filp)
1da177e4 1162{
1da177e4
LT
1163 sock_release(SOCKET_I(inode));
1164 return 0;
1165}
1166
1167/*
1168 * Update the socket async list
1169 *
1170 * Fasync_list locking strategy.
1171 *
1172 * 1. fasync_list is modified only under process context socket lock
1173 * i.e. under semaphore.
1174 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
989a2979 1175 * or under socket lock
1da177e4
LT
1176 */
1177
1178static int sock_fasync(int fd, struct file *filp, int on)
1179{
989a2979
ED
1180 struct socket *sock = filp->private_data;
1181 struct sock *sk = sock->sk;
eaefd110 1182 struct socket_wq *wq;
1da177e4 1183
989a2979 1184 if (sk == NULL)
1da177e4 1185 return -EINVAL;
1da177e4
LT
1186
1187 lock_sock(sk);
eaefd110
ED
1188 wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1189 fasync_helper(fd, filp, on, &wq->fasync_list);
1da177e4 1190
eaefd110 1191 if (!wq->fasync_list)
989a2979
ED
1192 sock_reset_flag(sk, SOCK_FASYNC);
1193 else
bcdce719 1194 sock_set_flag(sk, SOCK_FASYNC);
1da177e4 1195
989a2979 1196 release_sock(sk);
1da177e4
LT
1197 return 0;
1198}
1199
43815482 1200/* This function may be called only under socket lock or callback_lock or rcu_lock */
1da177e4
LT
1201
1202int sock_wake_async(struct socket *sock, int how, int band)
1203{
43815482
ED
1204 struct socket_wq *wq;
1205
1206 if (!sock)
1207 return -1;
1208 rcu_read_lock();
1209 wq = rcu_dereference(sock->wq);
1210 if (!wq || !wq->fasync_list) {
1211 rcu_read_unlock();
1da177e4 1212 return -1;
43815482 1213 }
89bddce5 1214 switch (how) {
8d8ad9d7 1215 case SOCK_WAKE_WAITD:
1da177e4
LT
1216 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1217 break;
1218 goto call_kill;
8d8ad9d7 1219 case SOCK_WAKE_SPACE:
1da177e4
LT
1220 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1221 break;
1222 /* fall through */
8d8ad9d7 1223 case SOCK_WAKE_IO:
89bddce5 1224call_kill:
43815482 1225 kill_fasync(&wq->fasync_list, SIGIO, band);
1da177e4 1226 break;
8d8ad9d7 1227 case SOCK_WAKE_URG:
43815482 1228 kill_fasync(&wq->fasync_list, SIGURG, band);
1da177e4 1229 }
43815482 1230 rcu_read_unlock();
1da177e4
LT
1231 return 0;
1232}
c6d409cf 1233EXPORT_SYMBOL(sock_wake_async);
1da177e4 1234
721db93a 1235int __sock_create(struct net *net, int family, int type, int protocol,
89bddce5 1236 struct socket **res, int kern)
1da177e4
LT
1237{
1238 int err;
1239 struct socket *sock;
55737fda 1240 const struct net_proto_family *pf;
1da177e4
LT
1241
1242 /*
89bddce5 1243 * Check protocol is in range
1da177e4
LT
1244 */
1245 if (family < 0 || family >= NPROTO)
1246 return -EAFNOSUPPORT;
1247 if (type < 0 || type >= SOCK_MAX)
1248 return -EINVAL;
1249
1250 /* Compatibility.
1251
1252 This uglymoron is moved from INET layer to here to avoid
1253 deadlock in module load.
1254 */
1255 if (family == PF_INET && type == SOCK_PACKET) {
89bddce5 1256 static int warned;
1da177e4
LT
1257 if (!warned) {
1258 warned = 1;
89bddce5
SH
1259 printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1260 current->comm);
1da177e4
LT
1261 }
1262 family = PF_PACKET;
1263 }
1264
1265 err = security_socket_create(family, type, protocol, kern);
1266 if (err)
1267 return err;
89bddce5 1268
55737fda
SH
1269 /*
1270 * Allocate the socket and allow the family to set things up. if
1271 * the protocol is 0, the family is instructed to select an appropriate
1272 * default.
1273 */
1274 sock = sock_alloc();
1275 if (!sock) {
e87cc472 1276 net_warn_ratelimited("socket: no more sockets\n");
55737fda
SH
1277 return -ENFILE; /* Not exactly a match, but its the
1278 closest posix thing */
1279 }
1280
1281 sock->type = type;
1282
95a5afca 1283#ifdef CONFIG_MODULES
89bddce5
SH
1284 /* Attempt to load a protocol module if the find failed.
1285 *
1286 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1da177e4
LT
1287 * requested real, full-featured networking support upon configuration.
1288 * Otherwise module support will break!
1289 */
190683a9 1290 if (rcu_access_pointer(net_families[family]) == NULL)
89bddce5 1291 request_module("net-pf-%d", family);
1da177e4
LT
1292#endif
1293
55737fda
SH
1294 rcu_read_lock();
1295 pf = rcu_dereference(net_families[family]);
1296 err = -EAFNOSUPPORT;
1297 if (!pf)
1298 goto out_release;
1da177e4
LT
1299
1300 /*
1301 * We will call the ->create function, that possibly is in a loadable
1302 * module, so we have to bump that loadable module refcnt first.
1303 */
55737fda 1304 if (!try_module_get(pf->owner))
1da177e4
LT
1305 goto out_release;
1306
55737fda
SH
1307 /* Now protected by module ref count */
1308 rcu_read_unlock();
1309
3f378b68 1310 err = pf->create(net, sock, protocol, kern);
55737fda 1311 if (err < 0)
1da177e4 1312 goto out_module_put;
a79af59e 1313
1da177e4
LT
1314 /*
1315 * Now to bump the refcnt of the [loadable] module that owns this
1316 * socket at sock_release time we decrement its refcnt.
1317 */
55737fda
SH
1318 if (!try_module_get(sock->ops->owner))
1319 goto out_module_busy;
1320
1da177e4
LT
1321 /*
1322 * Now that we're done with the ->create function, the [loadable]
1323 * module can have its refcnt decremented
1324 */
55737fda 1325 module_put(pf->owner);
7420ed23
VY
1326 err = security_socket_post_create(sock, family, type, protocol, kern);
1327 if (err)
3b185525 1328 goto out_sock_release;
55737fda 1329 *res = sock;
1da177e4 1330
55737fda
SH
1331 return 0;
1332
1333out_module_busy:
1334 err = -EAFNOSUPPORT;
1da177e4 1335out_module_put:
55737fda
SH
1336 sock->ops = NULL;
1337 module_put(pf->owner);
1338out_sock_release:
1da177e4 1339 sock_release(sock);
55737fda
SH
1340 return err;
1341
1342out_release:
1343 rcu_read_unlock();
1344 goto out_sock_release;
1da177e4 1345}
721db93a 1346EXPORT_SYMBOL(__sock_create);
1da177e4
LT
1347
1348int sock_create(int family, int type, int protocol, struct socket **res)
1349{
1b8d7ae4 1350 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1da177e4 1351}
c6d409cf 1352EXPORT_SYMBOL(sock_create);
1da177e4
LT
1353
1354int sock_create_kern(int family, int type, int protocol, struct socket **res)
1355{
1b8d7ae4 1356 return __sock_create(&init_net, family, type, protocol, res, 1);
1da177e4 1357}
c6d409cf 1358EXPORT_SYMBOL(sock_create_kern);
1da177e4 1359
3e0fa65f 1360SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1da177e4
LT
1361{
1362 int retval;
1363 struct socket *sock;
a677a039
UD
1364 int flags;
1365
e38b36f3
UD
1366 /* Check the SOCK_* constants for consistency. */
1367 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1368 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1369 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1370 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1371
a677a039 1372 flags = type & ~SOCK_TYPE_MASK;
77d27200 1373 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1374 return -EINVAL;
1375 type &= SOCK_TYPE_MASK;
1da177e4 1376
aaca0bdc
UD
1377 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1378 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1379
1da177e4
LT
1380 retval = sock_create(family, type, protocol, &sock);
1381 if (retval < 0)
1382 goto out;
1383
77d27200 1384 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1da177e4
LT
1385 if (retval < 0)
1386 goto out_release;
1387
1388out:
1389 /* It may be already another descriptor 8) Not kernel problem. */
1390 return retval;
1391
1392out_release:
1393 sock_release(sock);
1394 return retval;
1395}
1396
1397/*
1398 * Create a pair of connected sockets.
1399 */
1400
3e0fa65f
HC
1401SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1402 int __user *, usockvec)
1da177e4
LT
1403{
1404 struct socket *sock1, *sock2;
1405 int fd1, fd2, err;
db349509 1406 struct file *newfile1, *newfile2;
a677a039
UD
1407 int flags;
1408
1409 flags = type & ~SOCK_TYPE_MASK;
77d27200 1410 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
a677a039
UD
1411 return -EINVAL;
1412 type &= SOCK_TYPE_MASK;
1da177e4 1413
aaca0bdc
UD
1414 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1415 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1416
1da177e4
LT
1417 /*
1418 * Obtain the first socket and check if the underlying protocol
1419 * supports the socketpair call.
1420 */
1421
1422 err = sock_create(family, type, protocol, &sock1);
1423 if (err < 0)
1424 goto out;
1425
1426 err = sock_create(family, type, protocol, &sock2);
1427 if (err < 0)
1428 goto out_release_1;
1429
1430 err = sock1->ops->socketpair(sock1, sock2);
89bddce5 1431 if (err < 0)
1da177e4
LT
1432 goto out_release_both;
1433
28407630 1434 fd1 = get_unused_fd_flags(flags);
bf3c23d1
DM
1435 if (unlikely(fd1 < 0)) {
1436 err = fd1;
db349509 1437 goto out_release_both;
bf3c23d1 1438 }
28407630 1439 fd2 = get_unused_fd_flags(flags);
198de4d7
AV
1440 if (unlikely(fd2 < 0)) {
1441 err = fd2;
28407630
AV
1442 put_unused_fd(fd1);
1443 goto out_release_both;
1444 }
1445
aab174f0 1446 newfile1 = sock_alloc_file(sock1, flags, NULL);
28407630
AV
1447 if (unlikely(IS_ERR(newfile1))) {
1448 err = PTR_ERR(newfile1);
1449 put_unused_fd(fd1);
1450 put_unused_fd(fd2);
1451 goto out_release_both;
1452 }
1453
aab174f0 1454 newfile2 = sock_alloc_file(sock2, flags, NULL);
28407630
AV
1455 if (IS_ERR(newfile2)) {
1456 err = PTR_ERR(newfile2);
198de4d7
AV
1457 fput(newfile1);
1458 put_unused_fd(fd1);
28407630 1459 put_unused_fd(fd2);
198de4d7
AV
1460 sock_release(sock2);
1461 goto out;
db349509
AV
1462 }
1463
157cf649 1464 audit_fd_pair(fd1, fd2);
db349509
AV
1465 fd_install(fd1, newfile1);
1466 fd_install(fd2, newfile2);
1da177e4
LT
1467 /* fd1 and fd2 may be already another descriptors.
1468 * Not kernel problem.
1469 */
1470
89bddce5 1471 err = put_user(fd1, &usockvec[0]);
1da177e4
LT
1472 if (!err)
1473 err = put_user(fd2, &usockvec[1]);
1474 if (!err)
1475 return 0;
1476
1477 sys_close(fd2);
1478 sys_close(fd1);
1479 return err;
1480
1da177e4 1481out_release_both:
89bddce5 1482 sock_release(sock2);
1da177e4 1483out_release_1:
89bddce5 1484 sock_release(sock1);
1da177e4
LT
1485out:
1486 return err;
1487}
1488
1da177e4
LT
1489/*
1490 * Bind a name to a socket. Nothing much to do here since it's
1491 * the protocol's responsibility to handle the local address.
1492 *
1493 * We move the socket address to kernel space before we call
1494 * the protocol layer (having also checked the address is ok).
1495 */
1496
20f37034 1497SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1da177e4
LT
1498{
1499 struct socket *sock;
230b1839 1500 struct sockaddr_storage address;
6cb153ca 1501 int err, fput_needed;
1da177e4 1502
89bddce5 1503 sock = sockfd_lookup_light(fd, &err, &fput_needed);
e71a4783 1504 if (sock) {
43db362d 1505 err = move_addr_to_kernel(umyaddr, addrlen, &address);
89bddce5
SH
1506 if (err >= 0) {
1507 err = security_socket_bind(sock,
230b1839 1508 (struct sockaddr *)&address,
89bddce5 1509 addrlen);
6cb153ca
BL
1510 if (!err)
1511 err = sock->ops->bind(sock,
89bddce5 1512 (struct sockaddr *)
230b1839 1513 &address, addrlen);
1da177e4 1514 }
6cb153ca 1515 fput_light(sock->file, fput_needed);
89bddce5 1516 }
1da177e4
LT
1517 return err;
1518}
1519
1da177e4
LT
1520/*
1521 * Perform a listen. Basically, we allow the protocol to do anything
1522 * necessary for a listen, and if that works, we mark the socket as
1523 * ready for listening.
1524 */
1525
3e0fa65f 1526SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1da177e4
LT
1527{
1528 struct socket *sock;
6cb153ca 1529 int err, fput_needed;
b8e1f9b5 1530 int somaxconn;
89bddce5
SH
1531
1532 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1533 if (sock) {
8efa6e93 1534 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
95c96174 1535 if ((unsigned int)backlog > somaxconn)
b8e1f9b5 1536 backlog = somaxconn;
1da177e4
LT
1537
1538 err = security_socket_listen(sock, backlog);
6cb153ca
BL
1539 if (!err)
1540 err = sock->ops->listen(sock, backlog);
1da177e4 1541
6cb153ca 1542 fput_light(sock->file, fput_needed);
1da177e4
LT
1543 }
1544 return err;
1545}
1546
1da177e4
LT
1547/*
1548 * For accept, we attempt to create a new socket, set up the link
1549 * with the client, wake up the client, then return the new
1550 * connected fd. We collect the address of the connector in kernel
1551 * space and move it to user at the very end. This is unclean because
1552 * we open the socket then return an error.
1553 *
1554 * 1003.1g adds the ability to recvmsg() to query connection pending
1555 * status to recvmsg. We need to add that support in a way thats
1556 * clean when we restucture accept also.
1557 */
1558
20f37034
HC
1559SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1560 int __user *, upeer_addrlen, int, flags)
1da177e4
LT
1561{
1562 struct socket *sock, *newsock;
39d8c1b6 1563 struct file *newfile;
6cb153ca 1564 int err, len, newfd, fput_needed;
230b1839 1565 struct sockaddr_storage address;
1da177e4 1566
77d27200 1567 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
aaca0bdc
UD
1568 return -EINVAL;
1569
1570 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1571 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1572
6cb153ca 1573 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1574 if (!sock)
1575 goto out;
1576
1577 err = -ENFILE;
c6d409cf
ED
1578 newsock = sock_alloc();
1579 if (!newsock)
1da177e4
LT
1580 goto out_put;
1581
1582 newsock->type = sock->type;
1583 newsock->ops = sock->ops;
1584
1da177e4
LT
1585 /*
1586 * We don't need try_module_get here, as the listening socket (sock)
1587 * has the protocol module (sock->ops->owner) held.
1588 */
1589 __module_get(newsock->ops->owner);
1590
28407630 1591 newfd = get_unused_fd_flags(flags);
39d8c1b6
DM
1592 if (unlikely(newfd < 0)) {
1593 err = newfd;
9a1875e6
DM
1594 sock_release(newsock);
1595 goto out_put;
39d8c1b6 1596 }
aab174f0 1597 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
28407630
AV
1598 if (unlikely(IS_ERR(newfile))) {
1599 err = PTR_ERR(newfile);
1600 put_unused_fd(newfd);
1601 sock_release(newsock);
1602 goto out_put;
1603 }
39d8c1b6 1604
a79af59e
FF
1605 err = security_socket_accept(sock, newsock);
1606 if (err)
39d8c1b6 1607 goto out_fd;
a79af59e 1608
1da177e4
LT
1609 err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1610 if (err < 0)
39d8c1b6 1611 goto out_fd;
1da177e4
LT
1612
1613 if (upeer_sockaddr) {
230b1839 1614 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
89bddce5 1615 &len, 2) < 0) {
1da177e4 1616 err = -ECONNABORTED;
39d8c1b6 1617 goto out_fd;
1da177e4 1618 }
43db362d 1619 err = move_addr_to_user(&address,
230b1839 1620 len, upeer_sockaddr, upeer_addrlen);
1da177e4 1621 if (err < 0)
39d8c1b6 1622 goto out_fd;
1da177e4
LT
1623 }
1624
1625 /* File flags are not inherited via accept() unlike another OSes. */
1626
39d8c1b6
DM
1627 fd_install(newfd, newfile);
1628 err = newfd;
1da177e4 1629
1da177e4 1630out_put:
6cb153ca 1631 fput_light(sock->file, fput_needed);
1da177e4
LT
1632out:
1633 return err;
39d8c1b6 1634out_fd:
9606a216 1635 fput(newfile);
39d8c1b6 1636 put_unused_fd(newfd);
1da177e4
LT
1637 goto out_put;
1638}
1639
20f37034
HC
1640SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1641 int __user *, upeer_addrlen)
aaca0bdc 1642{
de11defe 1643 return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
aaca0bdc
UD
1644}
1645
1da177e4
LT
1646/*
1647 * Attempt to connect to a socket with the server address. The address
1648 * is in user space so we verify it is OK and move it to kernel space.
1649 *
1650 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1651 * break bindings
1652 *
1653 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1654 * other SEQPACKET protocols that take time to connect() as it doesn't
1655 * include the -EINPROGRESS status for such sockets.
1656 */
1657
20f37034
HC
1658SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1659 int, addrlen)
1da177e4
LT
1660{
1661 struct socket *sock;
230b1839 1662 struct sockaddr_storage address;
6cb153ca 1663 int err, fput_needed;
1da177e4 1664
6cb153ca 1665 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1666 if (!sock)
1667 goto out;
43db362d 1668 err = move_addr_to_kernel(uservaddr, addrlen, &address);
1da177e4
LT
1669 if (err < 0)
1670 goto out_put;
1671
89bddce5 1672 err =
230b1839 1673 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1da177e4
LT
1674 if (err)
1675 goto out_put;
1676
230b1839 1677 err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1da177e4
LT
1678 sock->file->f_flags);
1679out_put:
6cb153ca 1680 fput_light(sock->file, fput_needed);
1da177e4
LT
1681out:
1682 return err;
1683}
1684
1685/*
1686 * Get the local address ('name') of a socket object. Move the obtained
1687 * name to user space.
1688 */
1689
20f37034
HC
1690SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1691 int __user *, usockaddr_len)
1da177e4
LT
1692{
1693 struct socket *sock;
230b1839 1694 struct sockaddr_storage address;
6cb153ca 1695 int len, err, fput_needed;
89bddce5 1696
6cb153ca 1697 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4
LT
1698 if (!sock)
1699 goto out;
1700
1701 err = security_socket_getsockname(sock);
1702 if (err)
1703 goto out_put;
1704
230b1839 1705 err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1da177e4
LT
1706 if (err)
1707 goto out_put;
43db362d 1708 err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1da177e4
LT
1709
1710out_put:
6cb153ca 1711 fput_light(sock->file, fput_needed);
1da177e4
LT
1712out:
1713 return err;
1714}
1715
1716/*
1717 * Get the remote address ('name') of a socket object. Move the obtained
1718 * name to user space.
1719 */
1720
20f37034
HC
1721SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1722 int __user *, usockaddr_len)
1da177e4
LT
1723{
1724 struct socket *sock;
230b1839 1725 struct sockaddr_storage address;
6cb153ca 1726 int len, err, fput_needed;
1da177e4 1727
89bddce5
SH
1728 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1729 if (sock != NULL) {
1da177e4
LT
1730 err = security_socket_getpeername(sock);
1731 if (err) {
6cb153ca 1732 fput_light(sock->file, fput_needed);
1da177e4
LT
1733 return err;
1734 }
1735
89bddce5 1736 err =
230b1839 1737 sock->ops->getname(sock, (struct sockaddr *)&address, &len,
89bddce5 1738 1);
1da177e4 1739 if (!err)
43db362d 1740 err = move_addr_to_user(&address, len, usockaddr,
89bddce5 1741 usockaddr_len);
6cb153ca 1742 fput_light(sock->file, fput_needed);
1da177e4
LT
1743 }
1744 return err;
1745}
1746
1747/*
1748 * Send a datagram to a given address. We move the address into kernel
1749 * space and check the user space data area is readable before invoking
1750 * the protocol.
1751 */
1752
3e0fa65f 1753SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
95c96174 1754 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1755 int, addr_len)
1da177e4
LT
1756{
1757 struct socket *sock;
230b1839 1758 struct sockaddr_storage address;
1da177e4
LT
1759 int err;
1760 struct msghdr msg;
1761 struct iovec iov;
6cb153ca 1762 int fput_needed;
6cb153ca 1763
253eacc0
LT
1764 if (len > INT_MAX)
1765 len = INT_MAX;
de0fa95c
PE
1766 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1767 if (!sock)
4387ff75 1768 goto out;
6cb153ca 1769
89bddce5
SH
1770 iov.iov_base = buff;
1771 iov.iov_len = len;
1772 msg.msg_name = NULL;
1773 msg.msg_iov = &iov;
1774 msg.msg_iovlen = 1;
1775 msg.msg_control = NULL;
1776 msg.msg_controllen = 0;
1777 msg.msg_namelen = 0;
6cb153ca 1778 if (addr) {
43db362d 1779 err = move_addr_to_kernel(addr, addr_len, &address);
1da177e4
LT
1780 if (err < 0)
1781 goto out_put;
230b1839 1782 msg.msg_name = (struct sockaddr *)&address;
89bddce5 1783 msg.msg_namelen = addr_len;
1da177e4
LT
1784 }
1785 if (sock->file->f_flags & O_NONBLOCK)
1786 flags |= MSG_DONTWAIT;
1787 msg.msg_flags = flags;
1788 err = sock_sendmsg(sock, &msg, len);
1789
89bddce5 1790out_put:
de0fa95c 1791 fput_light(sock->file, fput_needed);
4387ff75 1792out:
1da177e4
LT
1793 return err;
1794}
1795
1796/*
89bddce5 1797 * Send a datagram down a socket.
1da177e4
LT
1798 */
1799
3e0fa65f 1800SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
95c96174 1801 unsigned int, flags)
1da177e4
LT
1802{
1803 return sys_sendto(fd, buff, len, flags, NULL, 0);
1804}
1805
1806/*
89bddce5 1807 * Receive a frame from the socket and optionally record the address of the
1da177e4
LT
1808 * sender. We verify the buffers are writable and if needed move the
1809 * sender address from kernel to user space.
1810 */
1811
3e0fa65f 1812SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
95c96174 1813 unsigned int, flags, struct sockaddr __user *, addr,
3e0fa65f 1814 int __user *, addr_len)
1da177e4
LT
1815{
1816 struct socket *sock;
1817 struct iovec iov;
1818 struct msghdr msg;
230b1839 1819 struct sockaddr_storage address;
89bddce5 1820 int err, err2;
6cb153ca
BL
1821 int fput_needed;
1822
253eacc0
LT
1823 if (size > INT_MAX)
1824 size = INT_MAX;
de0fa95c 1825 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1da177e4 1826 if (!sock)
de0fa95c 1827 goto out;
1da177e4 1828
89bddce5
SH
1829 msg.msg_control = NULL;
1830 msg.msg_controllen = 0;
1831 msg.msg_iovlen = 1;
1832 msg.msg_iov = &iov;
1833 iov.iov_len = size;
1834 iov.iov_base = ubuf;
230b1839
YH
1835 msg.msg_name = (struct sockaddr *)&address;
1836 msg.msg_namelen = sizeof(address);
1da177e4
LT
1837 if (sock->file->f_flags & O_NONBLOCK)
1838 flags |= MSG_DONTWAIT;
89bddce5 1839 err = sock_recvmsg(sock, &msg, size, flags);
1da177e4 1840
89bddce5 1841 if (err >= 0 && addr != NULL) {
43db362d 1842 err2 = move_addr_to_user(&address,
230b1839 1843 msg.msg_namelen, addr, addr_len);
89bddce5
SH
1844 if (err2 < 0)
1845 err = err2;
1da177e4 1846 }
de0fa95c
PE
1847
1848 fput_light(sock->file, fput_needed);
4387ff75 1849out:
1da177e4
LT
1850 return err;
1851}
1852
1853/*
89bddce5 1854 * Receive a datagram from a socket.
1da177e4
LT
1855 */
1856
89bddce5 1857asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
95c96174 1858 unsigned int flags)
1da177e4
LT
1859{
1860 return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1861}
1862
1863/*
1864 * Set a socket option. Because we don't know the option lengths we have
1865 * to pass the user mode parameter for the protocols to sort out.
1866 */
1867
20f37034
HC
1868SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1869 char __user *, optval, int, optlen)
1da177e4 1870{
6cb153ca 1871 int err, fput_needed;
1da177e4
LT
1872 struct socket *sock;
1873
1874 if (optlen < 0)
1875 return -EINVAL;
89bddce5
SH
1876
1877 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1878 if (sock != NULL) {
1879 err = security_socket_setsockopt(sock, level, optname);
6cb153ca
BL
1880 if (err)
1881 goto out_put;
1da177e4
LT
1882
1883 if (level == SOL_SOCKET)
89bddce5
SH
1884 err =
1885 sock_setsockopt(sock, level, optname, optval,
1886 optlen);
1da177e4 1887 else
89bddce5
SH
1888 err =
1889 sock->ops->setsockopt(sock, level, optname, optval,
1890 optlen);
6cb153ca
BL
1891out_put:
1892 fput_light(sock->file, fput_needed);
1da177e4
LT
1893 }
1894 return err;
1895}
1896
1897/*
1898 * Get a socket option. Because we don't know the option lengths we have
1899 * to pass a user mode parameter for the protocols to sort out.
1900 */
1901
20f37034
HC
1902SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1903 char __user *, optval, int __user *, optlen)
1da177e4 1904{
6cb153ca 1905 int err, fput_needed;
1da177e4
LT
1906 struct socket *sock;
1907
89bddce5
SH
1908 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1909 if (sock != NULL) {
6cb153ca
BL
1910 err = security_socket_getsockopt(sock, level, optname);
1911 if (err)
1912 goto out_put;
1da177e4
LT
1913
1914 if (level == SOL_SOCKET)
89bddce5
SH
1915 err =
1916 sock_getsockopt(sock, level, optname, optval,
1917 optlen);
1da177e4 1918 else
89bddce5
SH
1919 err =
1920 sock->ops->getsockopt(sock, level, optname, optval,
1921 optlen);
6cb153ca
BL
1922out_put:
1923 fput_light(sock->file, fput_needed);
1da177e4
LT
1924 }
1925 return err;
1926}
1927
1da177e4
LT
1928/*
1929 * Shutdown a socket.
1930 */
1931
754fe8d2 1932SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1da177e4 1933{
6cb153ca 1934 int err, fput_needed;
1da177e4
LT
1935 struct socket *sock;
1936
89bddce5
SH
1937 sock = sockfd_lookup_light(fd, &err, &fput_needed);
1938 if (sock != NULL) {
1da177e4 1939 err = security_socket_shutdown(sock, how);
6cb153ca
BL
1940 if (!err)
1941 err = sock->ops->shutdown(sock, how);
1942 fput_light(sock->file, fput_needed);
1da177e4
LT
1943 }
1944 return err;
1945}
1946
89bddce5 1947/* A couple of helpful macros for getting the address of the 32/64 bit
1da177e4
LT
1948 * fields which are the same type (int / unsigned) on our platforms.
1949 */
1950#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1951#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1952#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1953
c71d8ebe
TH
1954struct used_address {
1955 struct sockaddr_storage name;
1956 unsigned int name_len;
1957};
1958
228e548e 1959static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 1960 struct msghdr *msg_sys, unsigned int flags,
c71d8ebe 1961 struct used_address *used_address)
1da177e4 1962{
89bddce5
SH
1963 struct compat_msghdr __user *msg_compat =
1964 (struct compat_msghdr __user *)msg;
230b1839 1965 struct sockaddr_storage address;
1da177e4 1966 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
b9d717a7 1967 unsigned char ctl[sizeof(struct cmsghdr) + 20]
89bddce5
SH
1968 __attribute__ ((aligned(sizeof(__kernel_size_t))));
1969 /* 20 is size of ipv6_pktinfo */
1da177e4 1970 unsigned char *ctl_buf = ctl;
a74e9106 1971 int err, ctl_len, total_len;
89bddce5 1972
1da177e4
LT
1973 err = -EFAULT;
1974 if (MSG_CMSG_COMPAT & flags) {
228e548e 1975 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 1976 return -EFAULT;
228e548e 1977 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
1da177e4
LT
1978 return -EFAULT;
1979
228e548e 1980 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
1981 err = -EMSGSIZE;
1982 if (msg_sys->msg_iovlen > UIO_MAXIOV)
1983 goto out;
1984 err = -ENOMEM;
1985 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
1986 GFP_KERNEL);
1da177e4 1987 if (!iov)
228e548e 1988 goto out;
1da177e4
LT
1989 }
1990
1991 /* This will also move the address data into kernel space */
1992 if (MSG_CMSG_COMPAT & flags) {
43db362d 1993 err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
1da177e4 1994 } else
43db362d 1995 err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
89bddce5 1996 if (err < 0)
1da177e4
LT
1997 goto out_freeiov;
1998 total_len = err;
1999
2000 err = -ENOBUFS;
2001
228e548e 2002 if (msg_sys->msg_controllen > INT_MAX)
1da177e4 2003 goto out_freeiov;
228e548e 2004 ctl_len = msg_sys->msg_controllen;
1da177e4 2005 if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
89bddce5 2006 err =
228e548e 2007 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
89bddce5 2008 sizeof(ctl));
1da177e4
LT
2009 if (err)
2010 goto out_freeiov;
228e548e
AB
2011 ctl_buf = msg_sys->msg_control;
2012 ctl_len = msg_sys->msg_controllen;
1da177e4 2013 } else if (ctl_len) {
89bddce5 2014 if (ctl_len > sizeof(ctl)) {
1da177e4 2015 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
89bddce5 2016 if (ctl_buf == NULL)
1da177e4
LT
2017 goto out_freeiov;
2018 }
2019 err = -EFAULT;
2020 /*
228e548e 2021 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1da177e4
LT
2022 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2023 * checking falls down on this.
2024 */
fb8621bb 2025 if (copy_from_user(ctl_buf,
228e548e 2026 (void __user __force *)msg_sys->msg_control,
89bddce5 2027 ctl_len))
1da177e4 2028 goto out_freectl;
228e548e 2029 msg_sys->msg_control = ctl_buf;
1da177e4 2030 }
228e548e 2031 msg_sys->msg_flags = flags;
1da177e4
LT
2032
2033 if (sock->file->f_flags & O_NONBLOCK)
228e548e 2034 msg_sys->msg_flags |= MSG_DONTWAIT;
c71d8ebe
TH
2035 /*
2036 * If this is sendmmsg() and current destination address is same as
2037 * previously succeeded address, omit asking LSM's decision.
2038 * used_address->name_len is initialized to UINT_MAX so that the first
2039 * destination address never matches.
2040 */
bc909d9d
MD
2041 if (used_address && msg_sys->msg_name &&
2042 used_address->name_len == msg_sys->msg_namelen &&
2043 !memcmp(&used_address->name, msg_sys->msg_name,
c71d8ebe
TH
2044 used_address->name_len)) {
2045 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2046 goto out_freectl;
2047 }
2048 err = sock_sendmsg(sock, msg_sys, total_len);
2049 /*
2050 * If this is sendmmsg() and sending to current destination address was
2051 * successful, remember it.
2052 */
2053 if (used_address && err >= 0) {
2054 used_address->name_len = msg_sys->msg_namelen;
bc909d9d
MD
2055 if (msg_sys->msg_name)
2056 memcpy(&used_address->name, msg_sys->msg_name,
2057 used_address->name_len);
c71d8ebe 2058 }
1da177e4
LT
2059
2060out_freectl:
89bddce5 2061 if (ctl_buf != ctl)
1da177e4
LT
2062 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2063out_freeiov:
2064 if (iov != iovstack)
a74e9106 2065 kfree(iov);
228e548e
AB
2066out:
2067 return err;
2068}
2069
2070/*
2071 * BSD sendmsg interface
2072 */
2073
95c96174 2074SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
228e548e
AB
2075{
2076 int fput_needed, err;
2077 struct msghdr msg_sys;
2078 struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2079
2080 if (!sock)
2081 goto out;
2082
c71d8ebe 2083 err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
228e548e 2084
6cb153ca 2085 fput_light(sock->file, fput_needed);
89bddce5 2086out:
1da177e4
LT
2087 return err;
2088}
2089
228e548e
AB
2090/*
2091 * Linux sendmmsg interface
2092 */
2093
2094int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2095 unsigned int flags)
2096{
2097 int fput_needed, err, datagrams;
2098 struct socket *sock;
2099 struct mmsghdr __user *entry;
2100 struct compat_mmsghdr __user *compat_entry;
2101 struct msghdr msg_sys;
c71d8ebe 2102 struct used_address used_address;
228e548e 2103
98382f41
AB
2104 if (vlen > UIO_MAXIOV)
2105 vlen = UIO_MAXIOV;
228e548e
AB
2106
2107 datagrams = 0;
2108
2109 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2110 if (!sock)
2111 return err;
2112
c71d8ebe 2113 used_address.name_len = UINT_MAX;
228e548e
AB
2114 entry = mmsg;
2115 compat_entry = (struct compat_mmsghdr __user *)mmsg;
728ffb86 2116 err = 0;
228e548e
AB
2117
2118 while (datagrams < vlen) {
228e548e
AB
2119 if (MSG_CMSG_COMPAT & flags) {
2120 err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
c71d8ebe 2121 &msg_sys, flags, &used_address);
228e548e
AB
2122 if (err < 0)
2123 break;
2124 err = __put_user(err, &compat_entry->msg_len);
2125 ++compat_entry;
2126 } else {
2127 err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
c71d8ebe 2128 &msg_sys, flags, &used_address);
228e548e
AB
2129 if (err < 0)
2130 break;
2131 err = put_user(err, &entry->msg_len);
2132 ++entry;
2133 }
2134
2135 if (err)
2136 break;
2137 ++datagrams;
2138 }
2139
228e548e
AB
2140 fput_light(sock->file, fput_needed);
2141
728ffb86
AB
2142 /* We only return an error if no datagrams were able to be sent */
2143 if (datagrams != 0)
228e548e
AB
2144 return datagrams;
2145
228e548e
AB
2146 return err;
2147}
2148
2149SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2150 unsigned int, vlen, unsigned int, flags)
2151{
2152 return __sys_sendmmsg(fd, mmsg, vlen, flags);
2153}
2154
a2e27255 2155static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
95c96174 2156 struct msghdr *msg_sys, unsigned int flags, int nosec)
1da177e4 2157{
89bddce5
SH
2158 struct compat_msghdr __user *msg_compat =
2159 (struct compat_msghdr __user *)msg;
1da177e4 2160 struct iovec iovstack[UIO_FASTIOV];
89bddce5 2161 struct iovec *iov = iovstack;
1da177e4 2162 unsigned long cmsg_ptr;
a74e9106 2163 int err, total_len, len;
1da177e4
LT
2164
2165 /* kernel mode address */
230b1839 2166 struct sockaddr_storage addr;
1da177e4
LT
2167
2168 /* user mode address pointers */
2169 struct sockaddr __user *uaddr;
2170 int __user *uaddr_len;
89bddce5 2171
1da177e4 2172 if (MSG_CMSG_COMPAT & flags) {
a2e27255 2173 if (get_compat_msghdr(msg_sys, msg_compat))
1da177e4 2174 return -EFAULT;
c6d409cf 2175 } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
89bddce5 2176 return -EFAULT;
1da177e4 2177
a2e27255 2178 if (msg_sys->msg_iovlen > UIO_FASTIOV) {
a74e9106
ED
2179 err = -EMSGSIZE;
2180 if (msg_sys->msg_iovlen > UIO_MAXIOV)
2181 goto out;
2182 err = -ENOMEM;
2183 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2184 GFP_KERNEL);
1da177e4 2185 if (!iov)
a2e27255 2186 goto out;
1da177e4
LT
2187 }
2188
2189 /*
89bddce5
SH
2190 * Save the user-mode address (verify_iovec will change the
2191 * kernel msghdr to use the kernel address space)
1da177e4 2192 */
89bddce5 2193
a2e27255 2194 uaddr = (__force void __user *)msg_sys->msg_name;
1da177e4
LT
2195 uaddr_len = COMPAT_NAMELEN(msg);
2196 if (MSG_CMSG_COMPAT & flags) {
43db362d 2197 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4 2198 } else
43db362d 2199 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
1da177e4
LT
2200 if (err < 0)
2201 goto out_freeiov;
89bddce5 2202 total_len = err;
1da177e4 2203
a2e27255
ACM
2204 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2205 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
89bddce5 2206
1da177e4
LT
2207 if (sock->file->f_flags & O_NONBLOCK)
2208 flags |= MSG_DONTWAIT;
a2e27255
ACM
2209 err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2210 total_len, flags);
1da177e4
LT
2211 if (err < 0)
2212 goto out_freeiov;
2213 len = err;
2214
2215 if (uaddr != NULL) {
43db362d 2216 err = move_addr_to_user(&addr,
a2e27255 2217 msg_sys->msg_namelen, uaddr,
89bddce5 2218 uaddr_len);
1da177e4
LT
2219 if (err < 0)
2220 goto out_freeiov;
2221 }
a2e27255 2222 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
37f7f421 2223 COMPAT_FLAGS(msg));
1da177e4
LT
2224 if (err)
2225 goto out_freeiov;
2226 if (MSG_CMSG_COMPAT & flags)
a2e27255 2227 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2228 &msg_compat->msg_controllen);
2229 else
a2e27255 2230 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
1da177e4
LT
2231 &msg->msg_controllen);
2232 if (err)
2233 goto out_freeiov;
2234 err = len;
2235
2236out_freeiov:
2237 if (iov != iovstack)
a74e9106 2238 kfree(iov);
a2e27255
ACM
2239out:
2240 return err;
2241}
2242
2243/*
2244 * BSD recvmsg interface
2245 */
2246
2247SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2248 unsigned int, flags)
2249{
2250 int fput_needed, err;
2251 struct msghdr msg_sys;
2252 struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2253
2254 if (!sock)
2255 goto out;
2256
2257 err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2258
6cb153ca 2259 fput_light(sock->file, fput_needed);
1da177e4
LT
2260out:
2261 return err;
2262}
2263
a2e27255
ACM
2264/*
2265 * Linux recvmmsg interface
2266 */
2267
2268int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2269 unsigned int flags, struct timespec *timeout)
2270{
2271 int fput_needed, err, datagrams;
2272 struct socket *sock;
2273 struct mmsghdr __user *entry;
d7256d0e 2274 struct compat_mmsghdr __user *compat_entry;
a2e27255
ACM
2275 struct msghdr msg_sys;
2276 struct timespec end_time;
2277
2278 if (timeout &&
2279 poll_select_set_timeout(&end_time, timeout->tv_sec,
2280 timeout->tv_nsec))
2281 return -EINVAL;
2282
2283 datagrams = 0;
2284
2285 sock = sockfd_lookup_light(fd, &err, &fput_needed);
2286 if (!sock)
2287 return err;
2288
2289 err = sock_error(sock->sk);
2290 if (err)
2291 goto out_put;
2292
2293 entry = mmsg;
d7256d0e 2294 compat_entry = (struct compat_mmsghdr __user *)mmsg;
a2e27255
ACM
2295
2296 while (datagrams < vlen) {
2297 /*
2298 * No need to ask LSM for more than the first datagram.
2299 */
d7256d0e
JMG
2300 if (MSG_CMSG_COMPAT & flags) {
2301 err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
b9eb8b87
AB
2302 &msg_sys, flags & ~MSG_WAITFORONE,
2303 datagrams);
d7256d0e
JMG
2304 if (err < 0)
2305 break;
2306 err = __put_user(err, &compat_entry->msg_len);
2307 ++compat_entry;
2308 } else {
2309 err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
b9eb8b87
AB
2310 &msg_sys, flags & ~MSG_WAITFORONE,
2311 datagrams);
d7256d0e
JMG
2312 if (err < 0)
2313 break;
2314 err = put_user(err, &entry->msg_len);
2315 ++entry;
2316 }
2317
a2e27255
ACM
2318 if (err)
2319 break;
a2e27255
ACM
2320 ++datagrams;
2321
71c5c159
BB
2322 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2323 if (flags & MSG_WAITFORONE)
2324 flags |= MSG_DONTWAIT;
2325
a2e27255
ACM
2326 if (timeout) {
2327 ktime_get_ts(timeout);
2328 *timeout = timespec_sub(end_time, *timeout);
2329 if (timeout->tv_sec < 0) {
2330 timeout->tv_sec = timeout->tv_nsec = 0;
2331 break;
2332 }
2333
2334 /* Timeout, return less than vlen datagrams */
2335 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2336 break;
2337 }
2338
2339 /* Out of band data, return right away */
2340 if (msg_sys.msg_flags & MSG_OOB)
2341 break;
2342 }
2343
2344out_put:
2345 fput_light(sock->file, fput_needed);
1da177e4 2346
a2e27255
ACM
2347 if (err == 0)
2348 return datagrams;
2349
2350 if (datagrams != 0) {
2351 /*
2352 * We may return less entries than requested (vlen) if the
2353 * sock is non block and there aren't enough datagrams...
2354 */
2355 if (err != -EAGAIN) {
2356 /*
2357 * ... or if recvmsg returns an error after we
2358 * received some datagrams, where we record the
2359 * error to return on the next call or if the
2360 * app asks about it using getsockopt(SO_ERROR).
2361 */
2362 sock->sk->sk_err = -err;
2363 }
2364
2365 return datagrams;
2366 }
2367
2368 return err;
2369}
2370
2371SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2372 unsigned int, vlen, unsigned int, flags,
2373 struct timespec __user *, timeout)
2374{
2375 int datagrams;
2376 struct timespec timeout_sys;
2377
2378 if (!timeout)
2379 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2380
2381 if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2382 return -EFAULT;
2383
2384 datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2385
2386 if (datagrams > 0 &&
2387 copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2388 datagrams = -EFAULT;
2389
2390 return datagrams;
2391}
2392
2393#ifdef __ARCH_WANT_SYS_SOCKETCALL
1da177e4
LT
2394/* Argument list sizes for sys_socketcall */
2395#define AL(x) ((x) * sizeof(unsigned long))
228e548e 2396static const unsigned char nargs[21] = {
c6d409cf
ED
2397 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2398 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2399 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
228e548e 2400 AL(4), AL(5), AL(4)
89bddce5
SH
2401};
2402
1da177e4
LT
2403#undef AL
2404
2405/*
89bddce5 2406 * System call vectors.
1da177e4
LT
2407 *
2408 * Argument checking cleaned up. Saved 20% in size.
2409 * This function doesn't need to set the kernel lock because
89bddce5 2410 * it is set by the callees.
1da177e4
LT
2411 */
2412
3e0fa65f 2413SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
1da177e4 2414{
2950fa9d 2415 unsigned long a[AUDITSC_ARGS];
89bddce5 2416 unsigned long a0, a1;
1da177e4 2417 int err;
47379052 2418 unsigned int len;
1da177e4 2419
228e548e 2420 if (call < 1 || call > SYS_SENDMMSG)
1da177e4
LT
2421 return -EINVAL;
2422
47379052
AV
2423 len = nargs[call];
2424 if (len > sizeof(a))
2425 return -EINVAL;
2426
1da177e4 2427 /* copy_from_user should be SMP safe. */
47379052 2428 if (copy_from_user(a, args, len))
1da177e4 2429 return -EFAULT;
3ec3b2fb 2430
2950fa9d
CG
2431 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2432 if (err)
2433 return err;
3ec3b2fb 2434
89bddce5
SH
2435 a0 = a[0];
2436 a1 = a[1];
2437
2438 switch (call) {
2439 case SYS_SOCKET:
2440 err = sys_socket(a0, a1, a[2]);
2441 break;
2442 case SYS_BIND:
2443 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2444 break;
2445 case SYS_CONNECT:
2446 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2447 break;
2448 case SYS_LISTEN:
2449 err = sys_listen(a0, a1);
2450 break;
2451 case SYS_ACCEPT:
de11defe
UD
2452 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2453 (int __user *)a[2], 0);
89bddce5
SH
2454 break;
2455 case SYS_GETSOCKNAME:
2456 err =
2457 sys_getsockname(a0, (struct sockaddr __user *)a1,
2458 (int __user *)a[2]);
2459 break;
2460 case SYS_GETPEERNAME:
2461 err =
2462 sys_getpeername(a0, (struct sockaddr __user *)a1,
2463 (int __user *)a[2]);
2464 break;
2465 case SYS_SOCKETPAIR:
2466 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2467 break;
2468 case SYS_SEND:
2469 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2470 break;
2471 case SYS_SENDTO:
2472 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2473 (struct sockaddr __user *)a[4], a[5]);
2474 break;
2475 case SYS_RECV:
2476 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2477 break;
2478 case SYS_RECVFROM:
2479 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2480 (struct sockaddr __user *)a[4],
2481 (int __user *)a[5]);
2482 break;
2483 case SYS_SHUTDOWN:
2484 err = sys_shutdown(a0, a1);
2485 break;
2486 case SYS_SETSOCKOPT:
2487 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2488 break;
2489 case SYS_GETSOCKOPT:
2490 err =
2491 sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2492 (int __user *)a[4]);
2493 break;
2494 case SYS_SENDMSG:
2495 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2496 break;
228e548e
AB
2497 case SYS_SENDMMSG:
2498 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2499 break;
89bddce5
SH
2500 case SYS_RECVMSG:
2501 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2502 break;
a2e27255
ACM
2503 case SYS_RECVMMSG:
2504 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2505 (struct timespec __user *)a[4]);
2506 break;
de11defe
UD
2507 case SYS_ACCEPT4:
2508 err = sys_accept4(a0, (struct sockaddr __user *)a1,
2509 (int __user *)a[2], a[3]);
aaca0bdc 2510 break;
89bddce5
SH
2511 default:
2512 err = -EINVAL;
2513 break;
1da177e4
LT
2514 }
2515 return err;
2516}
2517
89bddce5 2518#endif /* __ARCH_WANT_SYS_SOCKETCALL */
1da177e4 2519
55737fda
SH
2520/**
2521 * sock_register - add a socket protocol handler
2522 * @ops: description of protocol
2523 *
1da177e4
LT
2524 * This function is called by a protocol handler that wants to
2525 * advertise its address family, and have it linked into the
55737fda
SH
2526 * socket interface. The value ops->family coresponds to the
2527 * socket system call protocol family.
1da177e4 2528 */
f0fd27d4 2529int sock_register(const struct net_proto_family *ops)
1da177e4
LT
2530{
2531 int err;
2532
2533 if (ops->family >= NPROTO) {
89bddce5
SH
2534 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2535 NPROTO);
1da177e4
LT
2536 return -ENOBUFS;
2537 }
55737fda
SH
2538
2539 spin_lock(&net_family_lock);
190683a9
ED
2540 if (rcu_dereference_protected(net_families[ops->family],
2541 lockdep_is_held(&net_family_lock)))
55737fda
SH
2542 err = -EEXIST;
2543 else {
cf778b00 2544 rcu_assign_pointer(net_families[ops->family], ops);
1da177e4
LT
2545 err = 0;
2546 }
55737fda
SH
2547 spin_unlock(&net_family_lock);
2548
89bddce5 2549 printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
1da177e4
LT
2550 return err;
2551}
c6d409cf 2552EXPORT_SYMBOL(sock_register);
1da177e4 2553
55737fda
SH
2554/**
2555 * sock_unregister - remove a protocol handler
2556 * @family: protocol family to remove
2557 *
1da177e4
LT
2558 * This function is called by a protocol handler that wants to
2559 * remove its address family, and have it unlinked from the
55737fda
SH
2560 * new socket creation.
2561 *
2562 * If protocol handler is a module, then it can use module reference
2563 * counts to protect against new references. If protocol handler is not
2564 * a module then it needs to provide its own protection in
2565 * the ops->create routine.
1da177e4 2566 */
f0fd27d4 2567void sock_unregister(int family)
1da177e4 2568{
f0fd27d4 2569 BUG_ON(family < 0 || family >= NPROTO);
1da177e4 2570
55737fda 2571 spin_lock(&net_family_lock);
a9b3cd7f 2572 RCU_INIT_POINTER(net_families[family], NULL);
55737fda
SH
2573 spin_unlock(&net_family_lock);
2574
2575 synchronize_rcu();
2576
89bddce5 2577 printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
1da177e4 2578}
c6d409cf 2579EXPORT_SYMBOL(sock_unregister);
1da177e4 2580
77d76ea3 2581static int __init sock_init(void)
1da177e4 2582{
b3e19d92 2583 int err;
2ca794e5
EB
2584 /*
2585 * Initialize the network sysctl infrastructure.
2586 */
2587 err = net_sysctl_init();
2588 if (err)
2589 goto out;
b3e19d92 2590
1da177e4 2591 /*
89bddce5 2592 * Initialize skbuff SLAB cache
1da177e4
LT
2593 */
2594 skb_init();
1da177e4
LT
2595
2596 /*
89bddce5 2597 * Initialize the protocols module.
1da177e4
LT
2598 */
2599
2600 init_inodecache();
b3e19d92
NP
2601
2602 err = register_filesystem(&sock_fs_type);
2603 if (err)
2604 goto out_fs;
1da177e4 2605 sock_mnt = kern_mount(&sock_fs_type);
b3e19d92
NP
2606 if (IS_ERR(sock_mnt)) {
2607 err = PTR_ERR(sock_mnt);
2608 goto out_mount;
2609 }
77d76ea3
AK
2610
2611 /* The real protocol initialization is performed in later initcalls.
1da177e4
LT
2612 */
2613
2614#ifdef CONFIG_NETFILTER
2615 netfilter_init();
2616#endif
cbeb321a 2617
c1f19b51
RC
2618#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2619 skb_timestamping_init();
2620#endif
2621
b3e19d92
NP
2622out:
2623 return err;
2624
2625out_mount:
2626 unregister_filesystem(&sock_fs_type);
2627out_fs:
2628 goto out;
1da177e4
LT
2629}
2630
77d76ea3
AK
2631core_initcall(sock_init); /* early initcall */
2632
1da177e4
LT
2633#ifdef CONFIG_PROC_FS
2634void socket_seq_show(struct seq_file *seq)
2635{
2636 int cpu;
2637 int counter = 0;
2638
6f912042 2639 for_each_possible_cpu(cpu)
89bddce5 2640 counter += per_cpu(sockets_in_use, cpu);
1da177e4
LT
2641
2642 /* It can be negative, by the way. 8) */
2643 if (counter < 0)
2644 counter = 0;
2645
2646 seq_printf(seq, "sockets: used %d\n", counter);
2647}
89bddce5 2648#endif /* CONFIG_PROC_FS */
1da177e4 2649
89bbfc95 2650#ifdef CONFIG_COMPAT
6b96018b 2651static int do_siocgstamp(struct net *net, struct socket *sock,
644595f8 2652 unsigned int cmd, void __user *up)
7a229387 2653{
7a229387
AB
2654 mm_segment_t old_fs = get_fs();
2655 struct timeval ktv;
2656 int err;
2657
2658 set_fs(KERNEL_DS);
6b96018b 2659 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
7a229387 2660 set_fs(old_fs);
644595f8 2661 if (!err)
ed6fe9d6 2662 err = compat_put_timeval(&ktv, up);
644595f8 2663
7a229387
AB
2664 return err;
2665}
2666
6b96018b 2667static int do_siocgstampns(struct net *net, struct socket *sock,
644595f8 2668 unsigned int cmd, void __user *up)
7a229387 2669{
7a229387
AB
2670 mm_segment_t old_fs = get_fs();
2671 struct timespec kts;
2672 int err;
2673
2674 set_fs(KERNEL_DS);
6b96018b 2675 err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
7a229387 2676 set_fs(old_fs);
644595f8 2677 if (!err)
ed6fe9d6 2678 err = compat_put_timespec(&kts, up);
644595f8 2679
7a229387
AB
2680 return err;
2681}
2682
6b96018b 2683static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
7a229387
AB
2684{
2685 struct ifreq __user *uifr;
2686 int err;
2687
2688 uifr = compat_alloc_user_space(sizeof(struct ifreq));
6b96018b 2689 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2690 return -EFAULT;
2691
6b96018b 2692 err = dev_ioctl(net, SIOCGIFNAME, uifr);
7a229387
AB
2693 if (err)
2694 return err;
2695
6b96018b 2696 if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
7a229387
AB
2697 return -EFAULT;
2698
2699 return 0;
2700}
2701
6b96018b 2702static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
7a229387 2703{
6b96018b 2704 struct compat_ifconf ifc32;
7a229387
AB
2705 struct ifconf ifc;
2706 struct ifconf __user *uifc;
6b96018b 2707 struct compat_ifreq __user *ifr32;
7a229387
AB
2708 struct ifreq __user *ifr;
2709 unsigned int i, j;
2710 int err;
2711
6b96018b 2712 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2713 return -EFAULT;
2714
43da5f2e 2715 memset(&ifc, 0, sizeof(ifc));
7a229387
AB
2716 if (ifc32.ifcbuf == 0) {
2717 ifc32.ifc_len = 0;
2718 ifc.ifc_len = 0;
2719 ifc.ifc_req = NULL;
2720 uifc = compat_alloc_user_space(sizeof(struct ifconf));
2721 } else {
c6d409cf
ED
2722 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2723 sizeof(struct ifreq);
7a229387
AB
2724 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2725 ifc.ifc_len = len;
2726 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2727 ifr32 = compat_ptr(ifc32.ifcbuf);
c6d409cf 2728 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
6b96018b 2729 if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2730 return -EFAULT;
2731 ifr++;
2732 ifr32++;
2733 }
2734 }
2735 if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2736 return -EFAULT;
2737
6b96018b 2738 err = dev_ioctl(net, SIOCGIFCONF, uifc);
7a229387
AB
2739 if (err)
2740 return err;
2741
2742 if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2743 return -EFAULT;
2744
2745 ifr = ifc.ifc_req;
2746 ifr32 = compat_ptr(ifc32.ifcbuf);
2747 for (i = 0, j = 0;
c6d409cf
ED
2748 i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2749 i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2750 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
7a229387
AB
2751 return -EFAULT;
2752 ifr32++;
2753 ifr++;
2754 }
2755
2756 if (ifc32.ifcbuf == 0) {
2757 /* Translate from 64-bit structure multiple to
2758 * a 32-bit one.
2759 */
2760 i = ifc.ifc_len;
6b96018b 2761 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
7a229387
AB
2762 ifc32.ifc_len = i;
2763 } else {
2764 ifc32.ifc_len = i;
2765 }
6b96018b 2766 if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
7a229387
AB
2767 return -EFAULT;
2768
2769 return 0;
2770}
2771
6b96018b 2772static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
7a229387 2773{
3a7da39d
BH
2774 struct compat_ethtool_rxnfc __user *compat_rxnfc;
2775 bool convert_in = false, convert_out = false;
2776 size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2777 struct ethtool_rxnfc __user *rxnfc;
7a229387 2778 struct ifreq __user *ifr;
3a7da39d
BH
2779 u32 rule_cnt = 0, actual_rule_cnt;
2780 u32 ethcmd;
7a229387 2781 u32 data;
3a7da39d 2782 int ret;
7a229387 2783
3a7da39d
BH
2784 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2785 return -EFAULT;
7a229387 2786
3a7da39d
BH
2787 compat_rxnfc = compat_ptr(data);
2788
2789 if (get_user(ethcmd, &compat_rxnfc->cmd))
7a229387
AB
2790 return -EFAULT;
2791
3a7da39d
BH
2792 /* Most ethtool structures are defined without padding.
2793 * Unfortunately struct ethtool_rxnfc is an exception.
2794 */
2795 switch (ethcmd) {
2796 default:
2797 break;
2798 case ETHTOOL_GRXCLSRLALL:
2799 /* Buffer size is variable */
2800 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2801 return -EFAULT;
2802 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2803 return -ENOMEM;
2804 buf_size += rule_cnt * sizeof(u32);
2805 /* fall through */
2806 case ETHTOOL_GRXRINGS:
2807 case ETHTOOL_GRXCLSRLCNT:
2808 case ETHTOOL_GRXCLSRULE:
55664f32 2809 case ETHTOOL_SRXCLSRLINS:
3a7da39d
BH
2810 convert_out = true;
2811 /* fall through */
2812 case ETHTOOL_SRXCLSRLDEL:
3a7da39d
BH
2813 buf_size += sizeof(struct ethtool_rxnfc);
2814 convert_in = true;
2815 break;
2816 }
2817
2818 ifr = compat_alloc_user_space(buf_size);
954b1244 2819 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
3a7da39d
BH
2820
2821 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
7a229387
AB
2822 return -EFAULT;
2823
3a7da39d
BH
2824 if (put_user(convert_in ? rxnfc : compat_ptr(data),
2825 &ifr->ifr_ifru.ifru_data))
7a229387
AB
2826 return -EFAULT;
2827
3a7da39d 2828 if (convert_in) {
127fe533 2829 /* We expect there to be holes between fs.m_ext and
3a7da39d
BH
2830 * fs.ring_cookie and at the end of fs, but nowhere else.
2831 */
127fe533
AD
2832 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2833 sizeof(compat_rxnfc->fs.m_ext) !=
2834 offsetof(struct ethtool_rxnfc, fs.m_ext) +
2835 sizeof(rxnfc->fs.m_ext));
3a7da39d
BH
2836 BUILD_BUG_ON(
2837 offsetof(struct compat_ethtool_rxnfc, fs.location) -
2838 offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2839 offsetof(struct ethtool_rxnfc, fs.location) -
2840 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2841
2842 if (copy_in_user(rxnfc, compat_rxnfc,
954b1244
SH
2843 (void __user *)(&rxnfc->fs.m_ext + 1) -
2844 (void __user *)rxnfc) ||
3a7da39d
BH
2845 copy_in_user(&rxnfc->fs.ring_cookie,
2846 &compat_rxnfc->fs.ring_cookie,
954b1244
SH
2847 (void __user *)(&rxnfc->fs.location + 1) -
2848 (void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2849 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2850 sizeof(rxnfc->rule_cnt)))
2851 return -EFAULT;
2852 }
2853
2854 ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2855 if (ret)
2856 return ret;
2857
2858 if (convert_out) {
2859 if (copy_in_user(compat_rxnfc, rxnfc,
954b1244
SH
2860 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2861 (const void __user *)rxnfc) ||
3a7da39d
BH
2862 copy_in_user(&compat_rxnfc->fs.ring_cookie,
2863 &rxnfc->fs.ring_cookie,
954b1244
SH
2864 (const void __user *)(&rxnfc->fs.location + 1) -
2865 (const void __user *)&rxnfc->fs.ring_cookie) ||
3a7da39d
BH
2866 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2867 sizeof(rxnfc->rule_cnt)))
2868 return -EFAULT;
2869
2870 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2871 /* As an optimisation, we only copy the actual
2872 * number of rules that the underlying
2873 * function returned. Since Mallory might
2874 * change the rule count in user memory, we
2875 * check that it is less than the rule count
2876 * originally given (as the user buffer size),
2877 * which has been range-checked.
2878 */
2879 if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2880 return -EFAULT;
2881 if (actual_rule_cnt < rule_cnt)
2882 rule_cnt = actual_rule_cnt;
2883 if (copy_in_user(&compat_rxnfc->rule_locs[0],
2884 &rxnfc->rule_locs[0],
2885 rule_cnt * sizeof(u32)))
2886 return -EFAULT;
2887 }
2888 }
2889
2890 return 0;
7a229387
AB
2891}
2892
7a50a240
AB
2893static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2894{
2895 void __user *uptr;
2896 compat_uptr_t uptr32;
2897 struct ifreq __user *uifr;
2898
c6d409cf 2899 uifr = compat_alloc_user_space(sizeof(*uifr));
7a50a240
AB
2900 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2901 return -EFAULT;
2902
2903 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2904 return -EFAULT;
2905
2906 uptr = compat_ptr(uptr32);
2907
2908 if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2909 return -EFAULT;
2910
2911 return dev_ioctl(net, SIOCWANDEV, uifr);
2912}
2913
6b96018b
AB
2914static int bond_ioctl(struct net *net, unsigned int cmd,
2915 struct compat_ifreq __user *ifr32)
7a229387
AB
2916{
2917 struct ifreq kifr;
2918 struct ifreq __user *uifr;
7a229387
AB
2919 mm_segment_t old_fs;
2920 int err;
2921 u32 data;
2922 void __user *datap;
2923
2924 switch (cmd) {
2925 case SIOCBONDENSLAVE:
2926 case SIOCBONDRELEASE:
2927 case SIOCBONDSETHWADDR:
2928 case SIOCBONDCHANGEACTIVE:
6b96018b 2929 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
7a229387
AB
2930 return -EFAULT;
2931
2932 old_fs = get_fs();
c6d409cf 2933 set_fs(KERNEL_DS);
c3f52ae6 2934 err = dev_ioctl(net, cmd,
2935 (struct ifreq __user __force *) &kifr);
c6d409cf 2936 set_fs(old_fs);
7a229387
AB
2937
2938 return err;
2939 case SIOCBONDSLAVEINFOQUERY:
2940 case SIOCBONDINFOQUERY:
2941 uifr = compat_alloc_user_space(sizeof(*uifr));
2942 if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2943 return -EFAULT;
2944
2945 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2946 return -EFAULT;
2947
2948 datap = compat_ptr(data);
2949 if (put_user(datap, &uifr->ifr_ifru.ifru_data))
2950 return -EFAULT;
2951
6b96018b 2952 return dev_ioctl(net, cmd, uifr);
7a229387 2953 default:
07d106d0 2954 return -ENOIOCTLCMD;
ccbd6a5a 2955 }
7a229387
AB
2956}
2957
6b96018b
AB
2958static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
2959 struct compat_ifreq __user *u_ifreq32)
7a229387
AB
2960{
2961 struct ifreq __user *u_ifreq64;
7a229387
AB
2962 char tmp_buf[IFNAMSIZ];
2963 void __user *data64;
2964 u32 data32;
2965
2966 if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2967 IFNAMSIZ))
2968 return -EFAULT;
2969 if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2970 return -EFAULT;
2971 data64 = compat_ptr(data32);
2972
2973 u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2974
2975 /* Don't check these user accesses, just let that get trapped
2976 * in the ioctl handler instead.
2977 */
2978 if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2979 IFNAMSIZ))
2980 return -EFAULT;
2981 if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2982 return -EFAULT;
2983
6b96018b 2984 return dev_ioctl(net, cmd, u_ifreq64);
7a229387
AB
2985}
2986
6b96018b
AB
2987static int dev_ifsioc(struct net *net, struct socket *sock,
2988 unsigned int cmd, struct compat_ifreq __user *uifr32)
7a229387 2989{
a2116ed2 2990 struct ifreq __user *uifr;
7a229387
AB
2991 int err;
2992
a2116ed2
AB
2993 uifr = compat_alloc_user_space(sizeof(*uifr));
2994 if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2995 return -EFAULT;
2996
2997 err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2998
7a229387
AB
2999 if (!err) {
3000 switch (cmd) {
3001 case SIOCGIFFLAGS:
3002 case SIOCGIFMETRIC:
3003 case SIOCGIFMTU:
3004 case SIOCGIFMEM:
3005 case SIOCGIFHWADDR:
3006 case SIOCGIFINDEX:
3007 case SIOCGIFADDR:
3008 case SIOCGIFBRDADDR:
3009 case SIOCGIFDSTADDR:
3010 case SIOCGIFNETMASK:
fab2532b 3011 case SIOCGIFPFLAGS:
7a229387 3012 case SIOCGIFTXQLEN:
fab2532b
AB
3013 case SIOCGMIIPHY:
3014 case SIOCGMIIREG:
a2116ed2 3015 if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
7a229387
AB
3016 err = -EFAULT;
3017 break;
3018 }
3019 }
3020 return err;
3021}
3022
a2116ed2
AB
3023static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3024 struct compat_ifreq __user *uifr32)
3025{
3026 struct ifreq ifr;
3027 struct compat_ifmap __user *uifmap32;
3028 mm_segment_t old_fs;
3029 int err;
3030
3031 uifmap32 = &uifr32->ifr_ifru.ifru_map;
3032 err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3033 err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3034 err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3035 err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3036 err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
3037 err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
3038 err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
3039 if (err)
3040 return -EFAULT;
3041
3042 old_fs = get_fs();
c6d409cf 3043 set_fs(KERNEL_DS);
c3f52ae6 3044 err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
c6d409cf 3045 set_fs(old_fs);
a2116ed2
AB
3046
3047 if (cmd == SIOCGIFMAP && !err) {
3048 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3049 err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3050 err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3051 err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3052 err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
3053 err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
3054 err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
3055 if (err)
3056 err = -EFAULT;
3057 }
3058 return err;
3059}
3060
3061static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
3062{
3063 void __user *uptr;
3064 compat_uptr_t uptr32;
3065 struct ifreq __user *uifr;
3066
c6d409cf 3067 uifr = compat_alloc_user_space(sizeof(*uifr));
a2116ed2
AB
3068 if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
3069 return -EFAULT;
3070
3071 if (get_user(uptr32, &uifr32->ifr_data))
3072 return -EFAULT;
3073
3074 uptr = compat_ptr(uptr32);
3075
3076 if (put_user(uptr, &uifr->ifr_data))
3077 return -EFAULT;
3078
3079 return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
3080}
3081
7a229387 3082struct rtentry32 {
c6d409cf 3083 u32 rt_pad1;
7a229387
AB
3084 struct sockaddr rt_dst; /* target address */
3085 struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3086 struct sockaddr rt_genmask; /* target network mask (IP) */
c6d409cf
ED
3087 unsigned short rt_flags;
3088 short rt_pad2;
3089 u32 rt_pad3;
3090 unsigned char rt_tos;
3091 unsigned char rt_class;
3092 short rt_pad4;
3093 short rt_metric; /* +1 for binary compatibility! */
7a229387 3094 /* char * */ u32 rt_dev; /* forcing the device at add */
c6d409cf
ED
3095 u32 rt_mtu; /* per route MTU/Window */
3096 u32 rt_window; /* Window clamping */
7a229387
AB
3097 unsigned short rt_irtt; /* Initial RTT */
3098};
3099
3100struct in6_rtmsg32 {
3101 struct in6_addr rtmsg_dst;
3102 struct in6_addr rtmsg_src;
3103 struct in6_addr rtmsg_gateway;
3104 u32 rtmsg_type;
3105 u16 rtmsg_dst_len;
3106 u16 rtmsg_src_len;
3107 u32 rtmsg_metric;
3108 u32 rtmsg_info;
3109 u32 rtmsg_flags;
3110 s32 rtmsg_ifindex;
3111};
3112
6b96018b
AB
3113static int routing_ioctl(struct net *net, struct socket *sock,
3114 unsigned int cmd, void __user *argp)
7a229387
AB
3115{
3116 int ret;
3117 void *r = NULL;
3118 struct in6_rtmsg r6;
3119 struct rtentry r4;
3120 char devname[16];
3121 u32 rtdev;
3122 mm_segment_t old_fs = get_fs();
3123
6b96018b
AB
3124 if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3125 struct in6_rtmsg32 __user *ur6 = argp;
c6d409cf 3126 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
7a229387 3127 3 * sizeof(struct in6_addr));
c6d409cf
ED
3128 ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3129 ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3130 ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3131 ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3132 ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3133 ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3134 ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
7a229387
AB
3135
3136 r = (void *) &r6;
3137 } else { /* ipv4 */
6b96018b 3138 struct rtentry32 __user *ur4 = argp;
c6d409cf 3139 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
7a229387 3140 3 * sizeof(struct sockaddr));
c6d409cf
ED
3141 ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
3142 ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
3143 ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
3144 ret |= __get_user(r4.rt_window, &(ur4->rt_window));
3145 ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
3146 ret |= __get_user(rtdev, &(ur4->rt_dev));
7a229387 3147 if (rtdev) {
c6d409cf 3148 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
c3f52ae6 3149 r4.rt_dev = (char __user __force *)devname;
3150 devname[15] = 0;
7a229387
AB
3151 } else
3152 r4.rt_dev = NULL;
3153
3154 r = (void *) &r4;
3155 }
3156
3157 if (ret) {
3158 ret = -EFAULT;
3159 goto out;
3160 }
3161
c6d409cf 3162 set_fs(KERNEL_DS);
6b96018b 3163 ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
c6d409cf 3164 set_fs(old_fs);
7a229387
AB
3165
3166out:
7a229387
AB
3167 return ret;
3168}
3169
3170/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3171 * for some operations; this forces use of the newer bridge-utils that
25985edc 3172 * use compatible ioctls
7a229387 3173 */
6b96018b 3174static int old_bridge_ioctl(compat_ulong_t __user *argp)
7a229387 3175{
6b96018b 3176 compat_ulong_t tmp;
7a229387 3177
6b96018b 3178 if (get_user(tmp, argp))
7a229387
AB
3179 return -EFAULT;
3180 if (tmp == BRCTL_GET_VERSION)
3181 return BRCTL_VERSION + 1;
3182 return -EINVAL;
3183}
3184
6b96018b
AB
3185static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3186 unsigned int cmd, unsigned long arg)
3187{
3188 void __user *argp = compat_ptr(arg);
3189 struct sock *sk = sock->sk;
3190 struct net *net = sock_net(sk);
7a229387 3191
6b96018b
AB
3192 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3193 return siocdevprivate_ioctl(net, cmd, argp);
3194
3195 switch (cmd) {
3196 case SIOCSIFBR:
3197 case SIOCGIFBR:
3198 return old_bridge_ioctl(argp);
3199 case SIOCGIFNAME:
3200 return dev_ifname32(net, argp);
3201 case SIOCGIFCONF:
3202 return dev_ifconf(net, argp);
3203 case SIOCETHTOOL:
3204 return ethtool_ioctl(net, argp);
7a50a240
AB
3205 case SIOCWANDEV:
3206 return compat_siocwandev(net, argp);
a2116ed2
AB
3207 case SIOCGIFMAP:
3208 case SIOCSIFMAP:
3209 return compat_sioc_ifmap(net, cmd, argp);
6b96018b
AB
3210 case SIOCBONDENSLAVE:
3211 case SIOCBONDRELEASE:
3212 case SIOCBONDSETHWADDR:
3213 case SIOCBONDSLAVEINFOQUERY:
3214 case SIOCBONDINFOQUERY:
3215 case SIOCBONDCHANGEACTIVE:
3216 return bond_ioctl(net, cmd, argp);
3217 case SIOCADDRT:
3218 case SIOCDELRT:
3219 return routing_ioctl(net, sock, cmd, argp);
3220 case SIOCGSTAMP:
3221 return do_siocgstamp(net, sock, cmd, argp);
3222 case SIOCGSTAMPNS:
3223 return do_siocgstampns(net, sock, cmd, argp);
a2116ed2
AB
3224 case SIOCSHWTSTAMP:
3225 return compat_siocshwtstamp(net, argp);
6b96018b
AB
3226
3227 case FIOSETOWN:
3228 case SIOCSPGRP:
3229 case FIOGETOWN:
3230 case SIOCGPGRP:
3231 case SIOCBRADDBR:
3232 case SIOCBRDELBR:
3233 case SIOCGIFVLAN:
3234 case SIOCSIFVLAN:
3235 case SIOCADDDLCI:
3236 case SIOCDELDLCI:
3237 return sock_ioctl(file, cmd, arg);
3238
3239 case SIOCGIFFLAGS:
3240 case SIOCSIFFLAGS:
3241 case SIOCGIFMETRIC:
3242 case SIOCSIFMETRIC:
3243 case SIOCGIFMTU:
3244 case SIOCSIFMTU:
3245 case SIOCGIFMEM:
3246 case SIOCSIFMEM:
3247 case SIOCGIFHWADDR:
3248 case SIOCSIFHWADDR:
3249 case SIOCADDMULTI:
3250 case SIOCDELMULTI:
3251 case SIOCGIFINDEX:
6b96018b
AB
3252 case SIOCGIFADDR:
3253 case SIOCSIFADDR:
3254 case SIOCSIFHWBROADCAST:
6b96018b 3255 case SIOCDIFADDR:
6b96018b
AB
3256 case SIOCGIFBRDADDR:
3257 case SIOCSIFBRDADDR:
3258 case SIOCGIFDSTADDR:
3259 case SIOCSIFDSTADDR:
3260 case SIOCGIFNETMASK:
3261 case SIOCSIFNETMASK:
3262 case SIOCSIFPFLAGS:
3263 case SIOCGIFPFLAGS:
3264 case SIOCGIFTXQLEN:
3265 case SIOCSIFTXQLEN:
3266 case SIOCBRADDIF:
3267 case SIOCBRDELIF:
9177efd3
AB
3268 case SIOCSIFNAME:
3269 case SIOCGMIIPHY:
3270 case SIOCGMIIREG:
3271 case SIOCSMIIREG:
6b96018b 3272 return dev_ifsioc(net, sock, cmd, argp);
9177efd3 3273
6b96018b
AB
3274 case SIOCSARP:
3275 case SIOCGARP:
3276 case SIOCDARP:
6b96018b 3277 case SIOCATMARK:
9177efd3
AB
3278 return sock_do_ioctl(net, sock, cmd, arg);
3279 }
3280
6b96018b
AB
3281 return -ENOIOCTLCMD;
3282}
7a229387 3283
95c96174 3284static long compat_sock_ioctl(struct file *file, unsigned int cmd,
89bddce5 3285 unsigned long arg)
89bbfc95
SP
3286{
3287 struct socket *sock = file->private_data;
3288 int ret = -ENOIOCTLCMD;
87de87d5
DM
3289 struct sock *sk;
3290 struct net *net;
3291
3292 sk = sock->sk;
3293 net = sock_net(sk);
89bbfc95
SP
3294
3295 if (sock->ops->compat_ioctl)
3296 ret = sock->ops->compat_ioctl(sock, cmd, arg);
3297
87de87d5
DM
3298 if (ret == -ENOIOCTLCMD &&
3299 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3300 ret = compat_wext_handle_ioctl(net, cmd, arg);
3301
6b96018b
AB
3302 if (ret == -ENOIOCTLCMD)
3303 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3304
89bbfc95
SP
3305 return ret;
3306}
3307#endif
3308
ac5a488e
SS
3309int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3310{
3311 return sock->ops->bind(sock, addr, addrlen);
3312}
c6d409cf 3313EXPORT_SYMBOL(kernel_bind);
ac5a488e
SS
3314
3315int kernel_listen(struct socket *sock, int backlog)
3316{
3317 return sock->ops->listen(sock, backlog);
3318}
c6d409cf 3319EXPORT_SYMBOL(kernel_listen);
ac5a488e
SS
3320
3321int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3322{
3323 struct sock *sk = sock->sk;
3324 int err;
3325
3326 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3327 newsock);
3328 if (err < 0)
3329 goto done;
3330
3331 err = sock->ops->accept(sock, *newsock, flags);
3332 if (err < 0) {
3333 sock_release(*newsock);
fa8705b0 3334 *newsock = NULL;
ac5a488e
SS
3335 goto done;
3336 }
3337
3338 (*newsock)->ops = sock->ops;
1b08534e 3339 __module_get((*newsock)->ops->owner);
ac5a488e
SS
3340
3341done:
3342 return err;
3343}
c6d409cf 3344EXPORT_SYMBOL(kernel_accept);
ac5a488e
SS
3345
3346int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
4768fbcb 3347 int flags)
ac5a488e
SS
3348{
3349 return sock->ops->connect(sock, addr, addrlen, flags);
3350}
c6d409cf 3351EXPORT_SYMBOL(kernel_connect);
ac5a488e
SS
3352
3353int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3354 int *addrlen)
3355{
3356 return sock->ops->getname(sock, addr, addrlen, 0);
3357}
c6d409cf 3358EXPORT_SYMBOL(kernel_getsockname);
ac5a488e
SS
3359
3360int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3361 int *addrlen)
3362{
3363 return sock->ops->getname(sock, addr, addrlen, 1);
3364}
c6d409cf 3365EXPORT_SYMBOL(kernel_getpeername);
ac5a488e
SS
3366
3367int kernel_getsockopt(struct socket *sock, int level, int optname,
3368 char *optval, int *optlen)
3369{
3370 mm_segment_t oldfs = get_fs();
fb8621bb
NK
3371 char __user *uoptval;
3372 int __user *uoptlen;
ac5a488e
SS
3373 int err;
3374
fb8621bb
NK
3375 uoptval = (char __user __force *) optval;
3376 uoptlen = (int __user __force *) optlen;
3377
ac5a488e
SS
3378 set_fs(KERNEL_DS);
3379 if (level == SOL_SOCKET)
fb8621bb 3380 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
ac5a488e 3381 else
fb8621bb
NK
3382 err = sock->ops->getsockopt(sock, level, optname, uoptval,
3383 uoptlen);
ac5a488e
SS
3384 set_fs(oldfs);
3385 return err;
3386}
c6d409cf 3387EXPORT_SYMBOL(kernel_getsockopt);
ac5a488e
SS
3388
3389int kernel_setsockopt(struct socket *sock, int level, int optname,
b7058842 3390 char *optval, unsigned int optlen)
ac5a488e
SS
3391{
3392 mm_segment_t oldfs = get_fs();
fb8621bb 3393 char __user *uoptval;
ac5a488e
SS
3394 int err;
3395
fb8621bb
NK
3396 uoptval = (char __user __force *) optval;
3397
ac5a488e
SS
3398 set_fs(KERNEL_DS);
3399 if (level == SOL_SOCKET)
fb8621bb 3400 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
ac5a488e 3401 else
fb8621bb 3402 err = sock->ops->setsockopt(sock, level, optname, uoptval,
ac5a488e
SS
3403 optlen);
3404 set_fs(oldfs);
3405 return err;
3406}
c6d409cf 3407EXPORT_SYMBOL(kernel_setsockopt);
ac5a488e
SS
3408
3409int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3410 size_t size, int flags)
3411{
3412 if (sock->ops->sendpage)
3413 return sock->ops->sendpage(sock, page, offset, size, flags);
3414
3415 return sock_no_sendpage(sock, page, offset, size, flags);
3416}
c6d409cf 3417EXPORT_SYMBOL(kernel_sendpage);
ac5a488e
SS
3418
3419int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3420{
3421 mm_segment_t oldfs = get_fs();
3422 int err;
3423
3424 set_fs(KERNEL_DS);
3425 err = sock->ops->ioctl(sock, cmd, arg);
3426 set_fs(oldfs);
3427
3428 return err;
3429}
c6d409cf 3430EXPORT_SYMBOL(kernel_sock_ioctl);
ac5a488e 3431
91cf45f0
TM
3432int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3433{
3434 return sock->ops->shutdown(sock, how);
3435}
91cf45f0 3436EXPORT_SYMBOL(kernel_sock_shutdown);