socket.c 84.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6
/*
 * NET		An implementation of the SOCKET network access protocol.
 *
 * Version:	@(#)socket.c	1.1.93	18/02/95
 *
 * Authors:	Orest Zborowski, <obz@Kodak.COM>
7
 *		Ross Biro
L
Linus Torvalds 已提交
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
 *
 * Fixes:
 *		Anonymous	:	NOTSOCK/BADF cleanup. Error fix in
 *					shutdown()
 *		Alan Cox	:	verify_area() fixes
 *		Alan Cox	:	Removed DDI
 *		Jonathan Kamens	:	SOCK_DGRAM reconnect bug
 *		Alan Cox	:	Moved a load of checks to the very
 *					top level.
 *		Alan Cox	:	Move address structures to/from user
 *					mode above the protocol layers.
 *		Rob Janssen	:	Allow 0 length sends.
 *		Alan Cox	:	Asynchronous I/O support (cribbed from the
 *					tty drivers).
 *		Niibe Yutaka	:	Asynchronous I/O for writes (4.4BSD style)
 *		Jeff Uphoff	:	Made max number of sockets command-line
 *					configurable.
 *		Matti Aarnio	:	Made the number of sockets dynamic,
 *					to be allocated when needed, and mr.
 *					Uphoff's max is used as max to be
 *					allowed to allocate.
 *		Linus		:	Argh. removed all the socket allocation
 *					altogether: it's in the inode now.
 *		Alan Cox	:	Made sock_alloc()/sock_release() public
 *					for NetROM and future kernel nfsd type
 *					stuff.
 *		Alan Cox	:	sendmsg/recvmsg basics.
 *		Tom Dyas	:	Export net symbols.
 *		Marcin Dalecki	:	Fixed problems with CONFIG_NET="n".
 *		Alan Cox	:	Added thread locking to sys_* calls
 *					for sockets. May have errors at the
 *					moment.
 *		Kevin Buhr	:	Fixed the dumb errors in the above.
 *		Andi Kleen	:	Some small cleanups, optimizations,
 *					and fixed a copy_from_user() bug.
 *		Tigran Aivazian	:	sys_send(args) calls sys_sendto(args, NULL, 0)
45
 *		Tigran Aivazian	:	Made listen(2) backlog sanity checks
L
Linus Torvalds 已提交
46 47 48 49 50 51 52 53 54 55
 *					protocol-independent
 *
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
 *
 *
 *	This module is effectively the top level interface to the BSD socket
56
 *	paradigm.
L
Linus Torvalds 已提交
57 58 59 60 61 62 63 64 65
 *
 *	Based upon Swansea University Computer Society NET3.039
 */

#include <linux/mm.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/net.h>
#include <linux/interrupt.h>
U
Ulrich Drepper 已提交
66
#include <linux/thread_info.h>
67
#include <linux/rcupdate.h>
L
Linus Torvalds 已提交
68 69 70
#include <linux/netdevice.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
A
Arjan van de Ven 已提交
71
#include <linux/mutex.h>
L
Linus Torvalds 已提交
72
#include <linux/if_bridge.h>
73 74
#include <linux/if_frad.h>
#include <linux/if_vlan.h>
75
#include <linux/ptp_classify.h>
L
Linus Torvalds 已提交
76 77 78 79 80 81 82 83 84 85
#include <linux/init.h>
#include <linux/poll.h>
#include <linux/cache.h>
#include <linux/module.h>
#include <linux/highmem.h>
#include <linux/mount.h>
#include <linux/security.h>
#include <linux/syscalls.h>
#include <linux/compat.h>
#include <linux/kmod.h>
86
#include <linux/audit.h>
87
#include <linux/wireless.h>
88
#include <linux/nsproxy.h>
N
Nick Black 已提交
89
#include <linux/magic.h>
90
#include <linux/slab.h>
91
#include <linux/xattr.h>
L
Linus Torvalds 已提交
92

93
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
94 95 96
#include <asm/unistd.h>

#include <net/compat.h>
97
#include <net/wext.h>
98
#include <net/cls_cgroup.h>
L
Linus Torvalds 已提交
99 100 101 102

#include <net/sock.h>
#include <linux/netfilter.h>

103 104 105 106 107
#include <linux/if_tun.h>
#include <linux/ipv6_route.h>
#include <linux/route.h>
#include <linux/sockios.h>
#include <linux/atalk.h>
108
#include <net/busy_poll.h>
109
#include <linux/errqueue.h>
E
Eliezer Tamir 已提交
110

111
#ifdef CONFIG_NET_RX_BUSY_POLL
112 113
unsigned int sysctl_net_busy_read __read_mostly;
unsigned int sysctl_net_busy_poll __read_mostly;
E
Eliezer Tamir 已提交
114
#endif
115

116 117
static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
118
static int sock_mmap(struct file *file, struct vm_area_struct *vma);
L
Linus Torvalds 已提交
119 120 121 122

static int sock_close(struct inode *inode, struct file *file);
static unsigned int sock_poll(struct file *file,
			      struct poll_table_struct *wait);
123
static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
124 125
#ifdef CONFIG_COMPAT
static long compat_sock_ioctl(struct file *file,
126
			      unsigned int cmd, unsigned long arg);
127
#endif
L
Linus Torvalds 已提交
128 129 130
static int sock_fasync(int fd, struct file *filp, int on);
static ssize_t sock_sendpage(struct file *file, struct page *page,
			     int offset, size_t size, loff_t *ppos, int more);
J
Jens Axboe 已提交
131
static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
132
				struct pipe_inode_info *pipe, size_t len,
J
Jens Axboe 已提交
133
				unsigned int flags);
L
Linus Torvalds 已提交
134 135 136 137 138 139

/*
 *	Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
 *	in the operation structures but are done directly via the socketcall() multiplexor.
 */

140
static const struct file_operations socket_file_ops = {
L
Linus Torvalds 已提交
141 142
	.owner =	THIS_MODULE,
	.llseek =	no_llseek,
143 144
	.read_iter =	sock_read_iter,
	.write_iter =	sock_write_iter,
L
Linus Torvalds 已提交
145 146
	.poll =		sock_poll,
	.unlocked_ioctl = sock_ioctl,
147 148 149
#ifdef CONFIG_COMPAT
	.compat_ioctl = compat_sock_ioctl,
#endif
L
Linus Torvalds 已提交
150 151 152
	.mmap =		sock_mmap,
	.release =	sock_close,
	.fasync =	sock_fasync,
153 154
	.sendpage =	sock_sendpage,
	.splice_write = generic_splice_sendpage,
J
Jens Axboe 已提交
155
	.splice_read =	sock_splice_read,
L
Linus Torvalds 已提交
156 157 158 159 160 161 162
};

/*
 *	The protocol list. Each protocol is registered in here.
 */

static DEFINE_SPINLOCK(net_family_lock);
E
Eric Dumazet 已提交
163
static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
L
Linus Torvalds 已提交
164 165 166 167 168

/*
 *	Statistics counters of the socket lists
 */

169
static DEFINE_PER_CPU(int, sockets_in_use);
L
Linus Torvalds 已提交
170 171

/*
172 173 174
 * Support routines.
 * Move socket addresses back and forth across the kernel/user
 * divide and look after the messy bits.
L
Linus Torvalds 已提交
175 176 177 178 179 180 181 182 183 184 185 186 187
 */

/**
 *	move_addr_to_kernel	-	copy a socket address into kernel space
 *	@uaddr: Address in user space
 *	@kaddr: Address in kernel space
 *	@ulen: Length in user space
 *
 *	The address is copied into kernel space. If the provided address is
 *	too long an error code of -EINVAL is returned. If the copy gives
 *	invalid addresses -EFAULT is returned. On a success 0 is returned.
 */

188
int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
L
Linus Torvalds 已提交
189
{
190
	if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
L
Linus Torvalds 已提交
191
		return -EINVAL;
192
	if (ulen == 0)
L
Linus Torvalds 已提交
193
		return 0;
194
	if (copy_from_user(kaddr, uaddr, ulen))
L
Linus Torvalds 已提交
195
		return -EFAULT;
196
	return audit_sockaddr(ulen, kaddr);
L
Linus Torvalds 已提交
197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214
}

/**
 *	move_addr_to_user	-	copy an address to user space
 *	@kaddr: kernel space address
 *	@klen: length of address in kernel
 *	@uaddr: user space address
 *	@ulen: pointer to user length field
 *
 *	The value pointed to by ulen on entry is the buffer length available.
 *	This is overwritten with the buffer space used. -EINVAL is returned
 *	if an overlong buffer is specified or a negative buffer size. -EFAULT
 *	is returned if either the buffer or the length field are not
 *	accessible.
 *	After copying the data up to the limit the user specifies, the true
 *	length of the data is written over the length limit the user
 *	specified. Zero is returned for a success.
 */
215

216
static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
S
stephen hemminger 已提交
217
			     void __user *uaddr, int __user *ulen)
L
Linus Torvalds 已提交
218 219 220 221
{
	int err;
	int len;

222
	BUG_ON(klen > sizeof(struct sockaddr_storage));
223 224
	err = get_user(len, ulen);
	if (err)
L
Linus Torvalds 已提交
225
		return err;
226 227
	if (len > klen)
		len = klen;
228
	if (len < 0)
L
Linus Torvalds 已提交
229
		return -EINVAL;
230
	if (len) {
S
Steve Grubb 已提交
231 232
		if (audit_sockaddr(klen, kaddr))
			return -ENOMEM;
233
		if (copy_to_user(uaddr, kaddr, len))
L
Linus Torvalds 已提交
234 235 236
			return -EFAULT;
	}
	/*
237 238
	 *      "fromlen shall refer to the value before truncation.."
	 *                      1003.1g
L
Linus Torvalds 已提交
239 240 241 242
	 */
	return __put_user(klen, ulen);
}

243
static struct kmem_cache *sock_inode_cachep __read_mostly;
L
Linus Torvalds 已提交
244 245 246 247

static struct inode *sock_alloc_inode(struct super_block *sb)
{
	struct socket_alloc *ei;
248
	struct socket_wq *wq;
249

250
	ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
L
Linus Torvalds 已提交
251 252
	if (!ei)
		return NULL;
253 254
	wq = kmalloc(sizeof(*wq), GFP_KERNEL);
	if (!wq) {
255 256 257
		kmem_cache_free(sock_inode_cachep, ei);
		return NULL;
	}
258 259
	init_waitqueue_head(&wq->wait);
	wq->fasync_list = NULL;
260
	wq->flags = 0;
261
	RCU_INIT_POINTER(ei->socket.wq, wq);
262

L
Linus Torvalds 已提交
263 264 265 266 267 268 269 270 271 272 273
	ei->socket.state = SS_UNCONNECTED;
	ei->socket.flags = 0;
	ei->socket.ops = NULL;
	ei->socket.sk = NULL;
	ei->socket.file = NULL;

	return &ei->vfs_inode;
}

static void sock_destroy_inode(struct inode *inode)
{
274
	struct socket_alloc *ei;
275
	struct socket_wq *wq;
276 277

	ei = container_of(inode, struct socket_alloc, vfs_inode);
278
	wq = rcu_dereference_protected(ei->socket.wq, 1);
279
	kfree_rcu(wq, rcu);
280
	kmem_cache_free(sock_inode_cachep, ei);
L
Linus Torvalds 已提交
281 282
}

283
static void init_once(void *foo)
L
Linus Torvalds 已提交
284
{
285
	struct socket_alloc *ei = (struct socket_alloc *)foo;
L
Linus Torvalds 已提交
286

C
Christoph Lameter 已提交
287
	inode_init_once(&ei->vfs_inode);
L
Linus Torvalds 已提交
288
}
289

290
static void init_inodecache(void)
L
Linus Torvalds 已提交
291 292
{
	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
293 294 295 296
					      sizeof(struct socket_alloc),
					      0,
					      (SLAB_HWCACHE_ALIGN |
					       SLAB_RECLAIM_ACCOUNT |
297
					       SLAB_MEM_SPREAD | SLAB_ACCOUNT),
298
					      init_once);
299
	BUG_ON(sock_inode_cachep == NULL);
L
Linus Torvalds 已提交
300 301
}

302
static const struct super_operations sockfs_ops = {
303 304 305
	.alloc_inode	= sock_alloc_inode,
	.destroy_inode	= sock_destroy_inode,
	.statfs		= simple_statfs,
L
Linus Torvalds 已提交
306 307
};

308 309 310 311 312 313
/*
 * sockfs_dname() is called from d_path().
 */
static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
{
	return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
D
David Howells 已提交
314
				d_inode(dentry)->i_ino);
315 316
}

A
Al Viro 已提交
317
static const struct dentry_operations sockfs_dentry_operations = {
318
	.d_dname  = sockfs_dname,
L
Linus Torvalds 已提交
319 320
};

321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341
static int sockfs_xattr_get(const struct xattr_handler *handler,
			    struct dentry *dentry, struct inode *inode,
			    const char *suffix, void *value, size_t size)
{
	if (value) {
		if (dentry->d_name.len + 1 > size)
			return -ERANGE;
		memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
	}
	return dentry->d_name.len + 1;
}

#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)

static const struct xattr_handler sockfs_xattr_handler = {
	.name = XATTR_NAME_SOCKPROTONAME,
	.get = sockfs_xattr_get,
};

342 343 344 345 346 347 348 349 350 351 352 353 354 355
static int sockfs_security_xattr_set(const struct xattr_handler *handler,
				     struct dentry *dentry, struct inode *inode,
				     const char *suffix, const void *value,
				     size_t size, int flags)
{
	/* Handled by LSM. */
	return -EAGAIN;
}

static const struct xattr_handler sockfs_security_xattr_handler = {
	.prefix = XATTR_SECURITY_PREFIX,
	.set = sockfs_security_xattr_set,
};

356 357
static const struct xattr_handler *sockfs_xattr_handlers[] = {
	&sockfs_xattr_handler,
358
	&sockfs_security_xattr_handler,
359 360 361
	NULL
};

362 363 364
static struct dentry *sockfs_mount(struct file_system_type *fs_type,
			 int flags, const char *dev_name, void *data)
{
365 366 367
	return mount_pseudo_xattr(fs_type, "socket:", &sockfs_ops,
				  sockfs_xattr_handlers,
				  &sockfs_dentry_operations, SOCKFS_MAGIC);
368 369 370 371 372 373 374 375 376 377
}

static struct vfsmount *sock_mnt __read_mostly;

static struct file_system_type sock_fs_type = {
	.name =		"sockfs",
	.mount =	sockfs_mount,
	.kill_sb =	kill_anon_super,
};

L
Linus Torvalds 已提交
378 379 380
/*
 *	Obtains the first available file descriptor and sets it up for use.
 *
381 382
 *	These functions create file structures and maps them to fd space
 *	of the current process. On success it returns file descriptor
L
Linus Torvalds 已提交
383 384 385 386 387 388 389 390 391 392 393 394
 *	and file struct implicitly stored in sock->file.
 *	Note that another thread may close file descriptor before we return
 *	from this function. We use the fact that now we do not refer
 *	to socket after mapping. If one day we will need it, this
 *	function will increment ref. count on file by 1.
 *
 *	In any case returned fd MAY BE not valid!
 *	This race condition is unavoidable
 *	with shared fd spaces, we cannot solve it inside kernel,
 *	but we take care of internal coherence yet.
 */

395
struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
L
Linus Torvalds 已提交
396
{
397
	struct qstr name = { .name = "" };
398
	struct path path;
399
	struct file *file;
L
Linus Torvalds 已提交
400

401 402 403 404 405 406 407
	if (dname) {
		name.name = dname;
		name.len = strlen(name.name);
	} else if (sock->sk) {
		name.name = sock->sk->sk_prot_creator->name;
		name.len = strlen(name.name);
	}
408
	path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
409 410
	if (unlikely(!path.dentry))
		return ERR_PTR(-ENOMEM);
411
	path.mnt = mntget(sock_mnt);
412

413
	d_instantiate(path.dentry, SOCK_INODE(sock));
414

415
	file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
416
		  &socket_file_ops);
417
	if (IS_ERR(file)) {
A
Al Viro 已提交
418
		/* drop dentry, keep inode */
D
David Howells 已提交
419
		ihold(d_inode(path.dentry));
420
		path_put(&path);
421
		return file;
A
Al Viro 已提交
422 423 424
	}

	sock->file = file;
425
	file->f_flags = O_RDWR | (flags & O_NONBLOCK);
426
	file->private_data = sock;
427
	return file;
428
}
429
EXPORT_SYMBOL(sock_alloc_file);
430

431
static int sock_map_fd(struct socket *sock, int flags)
432 433
{
	struct file *newfile;
434 435 436
	int fd = get_unused_fd_flags(flags);
	if (unlikely(fd < 0))
		return fd;
437

438
	newfile = sock_alloc_file(sock, flags, NULL);
439
	if (likely(!IS_ERR(newfile))) {
440
		fd_install(fd, newfile);
441 442
		return fd;
	}
443

444 445
	put_unused_fd(fd);
	return PTR_ERR(newfile);
L
Linus Torvalds 已提交
446 447
}

448
struct socket *sock_from_file(struct file *file, int *err)
449 450 451 452
{
	if (file->f_op == &socket_file_ops)
		return file->private_data;	/* set in sock_map_fd */

E
Eric Dumazet 已提交
453 454
	*err = -ENOTSOCK;
	return NULL;
455
}
456
EXPORT_SYMBOL(sock_from_file);
457

L
Linus Torvalds 已提交
458
/**
459
 *	sockfd_lookup - Go from a file number to its socket slot
L
Linus Torvalds 已提交
460 461 462 463
 *	@fd: file handle
 *	@err: pointer to an error code return
 *
 *	The file handle passed in is locked and the socket it is bound
464
 *	to is returned. If an error occurs the err pointer is overwritten
L
Linus Torvalds 已提交
465 466 467 468 469 470 471 472 473 474 475
 *	with a negative errno code and NULL is returned. The function checks
 *	for both invalid handles and passing a handle which is not a socket.
 *
 *	On a success the socket object pointer is returned.
 */

struct socket *sockfd_lookup(int fd, int *err)
{
	struct file *file;
	struct socket *sock;

476 477
	file = fget(fd);
	if (!file) {
L
Linus Torvalds 已提交
478 479 480
		*err = -EBADF;
		return NULL;
	}
481

482 483
	sock = sock_from_file(file, err);
	if (!sock)
L
Linus Torvalds 已提交
484
		fput(file);
485 486
	return sock;
}
487
EXPORT_SYMBOL(sockfd_lookup);
L
Linus Torvalds 已提交
488

489 490
static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
{
491
	struct fd f = fdget(fd);
492 493
	struct socket *sock;

494
	*err = -EBADF;
495 496 497 498
	if (f.file) {
		sock = sock_from_file(f.file, err);
		if (likely(sock)) {
			*fput_needed = f.flags;
499
			return sock;
500 501
		}
		fdput(f);
L
Linus Torvalds 已提交
502
	}
503
	return NULL;
L
Linus Torvalds 已提交
504 505
}

506 507 508 509 510 511
static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
				size_t size)
{
	ssize_t len;
	ssize_t used = 0;

D
David Howells 已提交
512
	len = security_inode_listsecurity(d_inode(dentry), buffer, size);
513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533
	if (len < 0)
		return len;
	used += len;
	if (buffer) {
		if (size < used)
			return -ERANGE;
		buffer += len;
	}

	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
	used += len;
	if (buffer) {
		if (size < used)
			return -ERANGE;
		memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
		buffer += len;
	}

	return used;
}

534
static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
535 536 537
{
	int err = simple_setattr(dentry, iattr);

538
	if (!err && (iattr->ia_valid & ATTR_UID)) {
539 540 541 542 543 544 545 546
		struct socket *sock = SOCKET_I(d_inode(dentry));

		sock->sk->sk_uid = iattr->ia_uid;
	}

	return err;
}

547 548
static const struct inode_operations sockfs_inode_ops = {
	.listxattr = sockfs_listxattr,
549
	.setattr = sockfs_setattr,
550 551
};

L
Linus Torvalds 已提交
552 553
/**
 *	sock_alloc	-	allocate a socket
554
 *
L
Linus Torvalds 已提交
555 556 557 558 559
 *	Allocate a new inode and socket object. The two are bound together
 *	and initialised. The socket is then returned. If we are out of inodes
 *	NULL is returned.
 */

T
Tom Herbert 已提交
560
struct socket *sock_alloc(void)
L
Linus Torvalds 已提交
561
{
562 563
	struct inode *inode;
	struct socket *sock;
L
Linus Torvalds 已提交
564

565
	inode = new_inode_pseudo(sock_mnt->mnt_sb);
L
Linus Torvalds 已提交
566 567 568 569 570
	if (!inode)
		return NULL;

	sock = SOCKET_I(inode);

571
	inode->i_ino = get_next_ino();
572
	inode->i_mode = S_IFSOCK | S_IRWXUGO;
573 574
	inode->i_uid = current_fsuid();
	inode->i_gid = current_fsgid();
575
	inode->i_op = &sockfs_inode_ops;
L
Linus Torvalds 已提交
576

577
	this_cpu_add(sockets_in_use, 1);
L
Linus Torvalds 已提交
578 579
	return sock;
}
T
Tom Herbert 已提交
580
EXPORT_SYMBOL(sock_alloc);
L
Linus Torvalds 已提交
581 582 583 584 585 586 587

/**
 *	sock_release	-	close a socket
 *	@sock: socket to close
 *
 *	The socket is released from the protocol stack if it has a release
 *	callback, and the inode is then released if the socket is bound to
588
 *	an inode not a file.
L
Linus Torvalds 已提交
589
 */
590

L
Linus Torvalds 已提交
591 592 593 594 595 596 597 598 599 600
void sock_release(struct socket *sock)
{
	if (sock->ops) {
		struct module *owner = sock->ops->owner;

		sock->ops->release(sock);
		sock->ops = NULL;
		module_put(owner);
	}

601
	if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
602
		pr_err("%s: fasync list not empty!\n", __func__);
L
Linus Torvalds 已提交
603

604
	this_cpu_sub(sockets_in_use, 1);
L
Linus Torvalds 已提交
605 606 607 608
	if (!sock->file) {
		iput(SOCK_INODE(sock));
		return;
	}
609
	sock->file = NULL;
L
Linus Torvalds 已提交
610
}
611
EXPORT_SYMBOL(sock_release);
L
Linus Torvalds 已提交
612

613
void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
614
{
615 616
	u8 flags = *tx_flags;

617
	if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
618 619
		flags |= SKBTX_HW_TSTAMP;

620
	if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
621 622
		flags |= SKBTX_SW_TSTAMP;

623
	if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
624 625 626
		flags |= SKBTX_SCHED_TSTAMP;

	*tx_flags = flags;
627
}
628
EXPORT_SYMBOL(__sock_tx_timestamp);
629

630
static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
L
Linus Torvalds 已提交
631
{
A
Al Viro 已提交
632
	int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
633 634
	BUG_ON(ret == -EIOCBQUEUED);
	return ret;
L
Linus Torvalds 已提交
635 636
}

637
int sock_sendmsg(struct socket *sock, struct msghdr *msg)
638
{
639
	int err = security_socket_sendmsg(sock, msg,
A
Al Viro 已提交
640
					  msg_data_left(msg));
641

642
	return err ?: sock_sendmsg_nosec(sock, msg);
643
}
644
EXPORT_SYMBOL(sock_sendmsg);
L
Linus Torvalds 已提交
645 646 647 648

int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
		   struct kvec *vec, size_t num, size_t size)
{
649
	iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
650
	return sock_sendmsg(sock, msg);
L
Linus Torvalds 已提交
651
}
652
EXPORT_SYMBOL(kernel_sendmsg);
L
Linus Torvalds 已提交
653

654 655 656 657 658 659
int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
			  struct kvec *vec, size_t num, size_t size)
{
	struct socket *sock = sk->sk_socket;

	if (!sock->ops->sendmsg_locked)
J
John Fastabend 已提交
660
		return sock_no_sendmsg_locked(sk, msg, size);
661 662 663 664 665 666 667

	iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);

	return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg));
}
EXPORT_SYMBOL(kernel_sendmsg_locked);

668 669 670 671 672 673 674 675 676 677
static bool skb_is_err_queue(const struct sk_buff *skb)
{
	/* pkt_type of skbs enqueued on the error queue are set to
	 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
	 * in recvmsg, since skbs received on a local socket will never
	 * have a pkt_type of PACKET_OUTGOING.
	 */
	return skb->pkt_type == PACKET_OUTGOING;
}

678 679 680 681 682 683 684 685 686 687 688 689 690
/* On transmit, software and hardware timestamps are returned independently.
 * As the two skb clones share the hardware timestamp, which may be updated
 * before the software timestamp is received, a hardware TX timestamp may be
 * returned only if there is no software TX timestamp. Ignore false software
 * timestamps, which may be made in the __sock_recv_timestamp() call when the
 * option SO_TIMESTAMP(NS) is enabled on the socket, even when the skb has a
 * hardware timestamp.
 */
static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp)
{
	return skb->tstamp && !false_tstamp && skb_is_err_queue(skb);
}

691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711
static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb)
{
	struct scm_ts_pktinfo ts_pktinfo;
	struct net_device *orig_dev;

	if (!skb_mac_header_was_set(skb))
		return;

	memset(&ts_pktinfo, 0, sizeof(ts_pktinfo));

	rcu_read_lock();
	orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
	if (orig_dev)
		ts_pktinfo.if_index = orig_dev->ifindex;
	rcu_read_unlock();

	ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb);
	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
		 sizeof(ts_pktinfo), &ts_pktinfo);
}

712 713 714 715 716 717
/*
 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
 */
void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
	struct sk_buff *skb)
{
718
	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
719
	struct scm_timestamping tss;
720
	int empty = 1, false_tstamp = 0;
721 722 723 724 725
	struct skb_shared_hwtstamps *shhwtstamps =
		skb_hwtstamps(skb);

	/* Race occurred between timestamp enabling and packet
	   receiving.  Fill in the current time for now. */
726
	if (need_software_tstamp && skb->tstamp == 0) {
727
		__net_timestamp(skb);
728 729
		false_tstamp = 1;
	}
730 731 732 733 734 735 736 737

	if (need_software_tstamp) {
		if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
			struct timeval tv;
			skb_get_timestamp(skb, &tv);
			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
				 sizeof(tv), &tv);
		} else {
738 739
			struct timespec ts;
			skb_get_timestampns(skb, &ts);
740
			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
741
				 sizeof(ts), &ts);
742 743 744
		}
	}

745
	memset(&tss, 0, sizeof(tss));
746
	if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
747
	    ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
748
		empty = 0;
749
	if (shhwtstamps &&
750
	    (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
751
	    !skb_is_swtx_tstamp(skb, false_tstamp) &&
752
	    ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2)) {
753
		empty = 0;
754 755 756 757
		if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) &&
		    !skb_is_err_queue(skb))
			put_ts_pktinfo(msg, skb);
	}
758
	if (!empty) {
759
		put_cmsg(msg, SOL_SOCKET,
760
			 SCM_TIMESTAMPING, sizeof(tss), &tss);
761

762
		if (skb_is_err_queue(skb) && skb->len &&
763
		    SKB_EXT_ERR(skb)->opt_stats)
764 765 766
			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
				 skb->len, skb->data);
	}
767
}
768 769
EXPORT_SYMBOL_GPL(__sock_recv_timestamp);

770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785
void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
	struct sk_buff *skb)
{
	int ack;

	if (!sock_flag(sk, SOCK_WIFI_STATUS))
		return;
	if (!skb->wifi_acked_valid)
		return;

	ack = skb->wifi_acked;

	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
}
EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);

S
stephen hemminger 已提交
786 787
static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
				   struct sk_buff *skb)
788
{
789
	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
790
		put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
791
			sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
792 793
}

794
void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
795 796 797 798 799
	struct sk_buff *skb)
{
	sock_recv_timestamp(msg, sk, skb);
	sock_recv_drops(msg, sk, skb);
}
800
EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
801

802
static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
803
				     int flags)
L
Linus Torvalds 已提交
804
{
805
	return sock->ops->recvmsg(sock, msg, msg_data_left(msg), flags);
L
Linus Torvalds 已提交
806 807
}

808
int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
809
{
810
	int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
811

812
	return err ?: sock_recvmsg_nosec(sock, msg, flags);
L
Linus Torvalds 已提交
813
}
814
EXPORT_SYMBOL(sock_recvmsg);
L
Linus Torvalds 已提交
815

816 817 818 819 820 821 822 823 824 825 826 827 828 829 830
/**
 * kernel_recvmsg - Receive a message from a socket (kernel space)
 * @sock:       The socket to receive the message from
 * @msg:        Received message
 * @vec:        Input s/g array for message data
 * @num:        Size of input s/g array
 * @size:       Number of bytes to read
 * @flags:      Message flags (MSG_DONTWAIT, etc...)
 *
 * On return the msg structure contains the scatter/gather array passed in the
 * vec argument. The array is modified so that it consists of the unfilled
 * portion of the original array.
 *
 * The returned value is the total number of bytes received, or an error.
 */
831 832
int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
		   struct kvec *vec, size_t num, size_t size, int flags)
L
Linus Torvalds 已提交
833 834 835 836
{
	mm_segment_t oldfs = get_fs();
	int result;

837
	iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
L
Linus Torvalds 已提交
838
	set_fs(KERNEL_DS);
839
	result = sock_recvmsg(sock, msg, flags);
L
Linus Torvalds 已提交
840 841 842
	set_fs(oldfs);
	return result;
}
843
EXPORT_SYMBOL(kernel_recvmsg);
L
Linus Torvalds 已提交
844

845 846
static ssize_t sock_sendpage(struct file *file, struct page *page,
			     int offset, size_t size, loff_t *ppos, int more)
L
Linus Torvalds 已提交
847 848 849 850
{
	struct socket *sock;
	int flags;

851 852
	sock = file->private_data;

853 854 855
	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
	flags |= more;
856

857
	return kernel_sendpage(sock, page, offset, size, flags);
858
}
L
Linus Torvalds 已提交
859

J
Jens Axboe 已提交
860
static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
861
				struct pipe_inode_info *pipe, size_t len,
J
Jens Axboe 已提交
862 863 864 865
				unsigned int flags)
{
	struct socket *sock = file->private_data;

866 867 868
	if (unlikely(!sock->ops->splice_read))
		return -EINVAL;

J
Jens Axboe 已提交
869 870 871
	return sock->ops->splice_read(sock, ppos, pipe, len, flags);
}

872
static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
873
{
874 875
	struct file *file = iocb->ki_filp;
	struct socket *sock = file->private_data;
876 877
	struct msghdr msg = {.msg_iter = *to,
			     .msg_iocb = iocb};
878
	ssize_t res;
879

880 881 882 883
	if (file->f_flags & O_NONBLOCK)
		msg.msg_flags = MSG_DONTWAIT;

	if (iocb->ki_pos != 0)
L
Linus Torvalds 已提交
884
		return -ESPIPE;
885

C
Christoph Hellwig 已提交
886
	if (!iov_iter_count(to))	/* Match SYS5 behaviour */
L
Linus Torvalds 已提交
887 888
		return 0;

889
	res = sock_recvmsg(sock, &msg, msg.msg_flags);
890 891
	*to = msg.msg_iter;
	return res;
L
Linus Torvalds 已提交
892 893
}

894
static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
895
{
896 897
	struct file *file = iocb->ki_filp;
	struct socket *sock = file->private_data;
898 899
	struct msghdr msg = {.msg_iter = *from,
			     .msg_iocb = iocb};
900
	ssize_t res;
L
Linus Torvalds 已提交
901

902
	if (iocb->ki_pos != 0)
903
		return -ESPIPE;
904

905 906 907
	if (file->f_flags & O_NONBLOCK)
		msg.msg_flags = MSG_DONTWAIT;

908 909 910
	if (sock->type == SOCK_SEQPACKET)
		msg.msg_flags |= MSG_EOR;

911
	res = sock_sendmsg(sock, &msg);
912 913
	*from = msg.msg_iter;
	return res;
L
Linus Torvalds 已提交
914 915 916 917 918 919 920
}

/*
 * Atomic setting of ioctl hooks to avoid race
 * with module unload.
 */

A
Arjan van de Ven 已提交
921
static DEFINE_MUTEX(br_ioctl_mutex);
922
static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
L
Linus Torvalds 已提交
923

924
void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
L
Linus Torvalds 已提交
925
{
A
Arjan van de Ven 已提交
926
	mutex_lock(&br_ioctl_mutex);
L
Linus Torvalds 已提交
927
	br_ioctl_hook = hook;
A
Arjan van de Ven 已提交
928
	mutex_unlock(&br_ioctl_mutex);
L
Linus Torvalds 已提交
929 930 931
}
EXPORT_SYMBOL(brioctl_set);

A
Arjan van de Ven 已提交
932
static DEFINE_MUTEX(vlan_ioctl_mutex);
933
static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
L
Linus Torvalds 已提交
934

935
void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
L
Linus Torvalds 已提交
936
{
A
Arjan van de Ven 已提交
937
	mutex_lock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
938
	vlan_ioctl_hook = hook;
A
Arjan van de Ven 已提交
939
	mutex_unlock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
940 941 942
}
EXPORT_SYMBOL(vlan_ioctl_set);

A
Arjan van de Ven 已提交
943
static DEFINE_MUTEX(dlci_ioctl_mutex);
944
static int (*dlci_ioctl_hook) (unsigned int, void __user *);
L
Linus Torvalds 已提交
945

946
void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
L
Linus Torvalds 已提交
947
{
A
Arjan van de Ven 已提交
948
	mutex_lock(&dlci_ioctl_mutex);
L
Linus Torvalds 已提交
949
	dlci_ioctl_hook = hook;
A
Arjan van de Ven 已提交
950
	mutex_unlock(&dlci_ioctl_mutex);
L
Linus Torvalds 已提交
951 952 953
}
EXPORT_SYMBOL(dlci_ioctl_set);

954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971
static long sock_do_ioctl(struct net *net, struct socket *sock,
				 unsigned int cmd, unsigned long arg)
{
	int err;
	void __user *argp = (void __user *)arg;

	err = sock->ops->ioctl(sock, cmd, arg);

	/*
	 * If this ioctl is unknown try to hand it down
	 * to the NIC driver.
	 */
	if (err == -ENOIOCTLCMD)
		err = dev_ioctl(net, cmd, argp);

	return err;
}

L
Linus Torvalds 已提交
972 973 974 975 976
/*
 *	With an ioctl, arg may well be a user mode pointer, but we don't know
 *	what to do with it - that's up to the protocol still.
 */

977 978 979 980 981
static struct ns_common *get_net_ns(struct ns_common *ns)
{
	return &get_net(container_of(ns, struct net, ns))->ns;
}

L
Linus Torvalds 已提交
982 983 984
static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
{
	struct socket *sock;
985
	struct sock *sk;
L
Linus Torvalds 已提交
986 987
	void __user *argp = (void __user *)arg;
	int pid, err;
988
	struct net *net;
L
Linus Torvalds 已提交
989

990
	sock = file->private_data;
991
	sk = sock->sk;
992
	net = sock_net(sk);
L
Linus Torvalds 已提交
993
	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
994
		err = dev_ioctl(net, cmd, argp);
L
Linus Torvalds 已提交
995
	} else
J
Johannes Berg 已提交
996
#ifdef CONFIG_WEXT_CORE
L
Linus Torvalds 已提交
997
	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
998
		err = dev_ioctl(net, cmd, argp);
L
Linus Torvalds 已提交
999
	} else
J
Johannes Berg 已提交
1000
#endif
1001
		switch (cmd) {
L
Linus Torvalds 已提交
1002 1003 1004 1005 1006
		case FIOSETOWN:
		case SIOCSPGRP:
			err = -EFAULT;
			if (get_user(pid, (int __user *)argp))
				break;
1007
			err = f_setown(sock->file, pid, 1);
L
Linus Torvalds 已提交
1008 1009 1010
			break;
		case FIOGETOWN:
		case SIOCGPGRP:
1011
			err = put_user(f_getown(sock->file),
1012
				       (int __user *)argp);
L
Linus Torvalds 已提交
1013 1014 1015 1016 1017 1018 1019 1020 1021
			break;
		case SIOCGIFBR:
		case SIOCSIFBR:
		case SIOCBRADDBR:
		case SIOCBRDELBR:
			err = -ENOPKG;
			if (!br_ioctl_hook)
				request_module("bridge");

A
Arjan van de Ven 已提交
1022
			mutex_lock(&br_ioctl_mutex);
1023
			if (br_ioctl_hook)
1024
				err = br_ioctl_hook(net, cmd, argp);
A
Arjan van de Ven 已提交
1025
			mutex_unlock(&br_ioctl_mutex);
L
Linus Torvalds 已提交
1026 1027 1028 1029 1030 1031 1032
			break;
		case SIOCGIFVLAN:
		case SIOCSIFVLAN:
			err = -ENOPKG;
			if (!vlan_ioctl_hook)
				request_module("8021q");

A
Arjan van de Ven 已提交
1033
			mutex_lock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
1034
			if (vlan_ioctl_hook)
1035
				err = vlan_ioctl_hook(net, argp);
A
Arjan van de Ven 已提交
1036
			mutex_unlock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
1037 1038 1039 1040 1041 1042 1043
			break;
		case SIOCADDDLCI:
		case SIOCDELDLCI:
			err = -ENOPKG;
			if (!dlci_ioctl_hook)
				request_module("dlci");

1044 1045
			mutex_lock(&dlci_ioctl_mutex);
			if (dlci_ioctl_hook)
L
Linus Torvalds 已提交
1046
				err = dlci_ioctl_hook(cmd, argp);
1047
			mutex_unlock(&dlci_ioctl_mutex);
L
Linus Torvalds 已提交
1048
			break;
1049 1050 1051 1052 1053 1054 1055
		case SIOCGSKNS:
			err = -EPERM;
			if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
				break;

			err = open_related_ns(&net->ns, get_net_ns);
			break;
L
Linus Torvalds 已提交
1056
		default:
1057
			err = sock_do_ioctl(net, sock, cmd, arg);
L
Linus Torvalds 已提交
1058
			break;
1059
		}
L
Linus Torvalds 已提交
1060 1061 1062 1063 1064 1065 1066
	return err;
}

int sock_create_lite(int family, int type, int protocol, struct socket **res)
{
	int err;
	struct socket *sock = NULL;
1067

L
Linus Torvalds 已提交
1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078
	err = security_socket_create(family, type, protocol, 1);
	if (err)
		goto out;

	sock = sock_alloc();
	if (!sock) {
		err = -ENOMEM;
		goto out;
	}

	sock->type = type;
V
Venkat Yekkirala 已提交
1079 1080 1081 1082
	err = security_socket_post_create(sock, family, type, protocol, 1);
	if (err)
		goto out_release;

L
Linus Torvalds 已提交
1083 1084 1085
out:
	*res = sock;
	return err;
V
Venkat Yekkirala 已提交
1086 1087 1088 1089
out_release:
	sock_release(sock);
	sock = NULL;
	goto out;
L
Linus Torvalds 已提交
1090
}
1091
EXPORT_SYMBOL(sock_create_lite);
L
Linus Torvalds 已提交
1092 1093

/* No kernel lock held - perfect */
1094
static unsigned int sock_poll(struct file *file, poll_table *wait)
L
Linus Torvalds 已提交
1095
{
1096
	unsigned int busy_flag = 0;
L
Linus Torvalds 已提交
1097 1098 1099
	struct socket *sock;

	/*
1100
	 *      We can't return errors to poll, so it's either yes or no.
L
Linus Torvalds 已提交
1101
	 */
1102
	sock = file->private_data;
1103

1104
	if (sk_can_busy_loop(sock->sk)) {
1105
		/* this socket can poll_ll so tell the system call */
1106
		busy_flag = POLL_BUSY_LOOP;
1107 1108

		/* once, only if requested by syscall */
1109 1110
		if (wait && (wait->_key & POLL_BUSY_LOOP))
			sk_busy_loop(sock->sk, 1);
1111 1112
	}

1113
	return busy_flag | sock->ops->poll(file, sock, wait);
L
Linus Torvalds 已提交
1114 1115
}

1116
static int sock_mmap(struct file *file, struct vm_area_struct *vma)
L
Linus Torvalds 已提交
1117
{
1118
	struct socket *sock = file->private_data;
L
Linus Torvalds 已提交
1119 1120 1121 1122

	return sock->ops->mmap(file, sock, vma);
}

1123
static int sock_close(struct inode *inode, struct file *filp)
L
Linus Torvalds 已提交
1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136
{
	sock_release(SOCKET_I(inode));
	return 0;
}

/*
 *	Update the socket async list
 *
 *	Fasync_list locking strategy.
 *
 *	1. fasync_list is modified only under process context socket lock
 *	   i.e. under semaphore.
 *	2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1137
 *	   or under socket lock
L
Linus Torvalds 已提交
1138 1139 1140 1141
 */

static int sock_fasync(int fd, struct file *filp, int on)
{
1142 1143
	struct socket *sock = filp->private_data;
	struct sock *sk = sock->sk;
1144
	struct socket_wq *wq;
L
Linus Torvalds 已提交
1145

1146
	if (sk == NULL)
L
Linus Torvalds 已提交
1147 1148 1149
		return -EINVAL;

	lock_sock(sk);
1150
	wq = rcu_dereference_protected(sock->wq, lockdep_sock_is_held(sk));
1151
	fasync_helper(fd, filp, on, &wq->fasync_list);
L
Linus Torvalds 已提交
1152

1153
	if (!wq->fasync_list)
1154 1155
		sock_reset_flag(sk, SOCK_FASYNC);
	else
E
Eric Dumazet 已提交
1156
		sock_set_flag(sk, SOCK_FASYNC);
L
Linus Torvalds 已提交
1157

1158
	release_sock(sk);
L
Linus Torvalds 已提交
1159 1160 1161
	return 0;
}

1162
/* This function may be called only under rcu_lock */
L
Linus Torvalds 已提交
1163

1164
int sock_wake_async(struct socket_wq *wq, int how, int band)
L
Linus Torvalds 已提交
1165
{
1166
	if (!wq || !wq->fasync_list)
L
Linus Torvalds 已提交
1167
		return -1;
1168

1169
	switch (how) {
1170
	case SOCK_WAKE_WAITD:
1171
		if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
L
Linus Torvalds 已提交
1172 1173
			break;
		goto call_kill;
1174
	case SOCK_WAKE_SPACE:
1175
		if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
L
Linus Torvalds 已提交
1176 1177
			break;
		/* fall through */
1178
	case SOCK_WAKE_IO:
1179
call_kill:
1180
		kill_fasync(&wq->fasync_list, SIGIO, band);
L
Linus Torvalds 已提交
1181
		break;
1182
	case SOCK_WAKE_URG:
1183
		kill_fasync(&wq->fasync_list, SIGURG, band);
L
Linus Torvalds 已提交
1184
	}
1185

L
Linus Torvalds 已提交
1186 1187
	return 0;
}
1188
EXPORT_SYMBOL(sock_wake_async);
L
Linus Torvalds 已提交
1189

P
Pavel Emelyanov 已提交
1190
int __sock_create(struct net *net, int family, int type, int protocol,
1191
			 struct socket **res, int kern)
L
Linus Torvalds 已提交
1192 1193 1194
{
	int err;
	struct socket *sock;
1195
	const struct net_proto_family *pf;
L
Linus Torvalds 已提交
1196 1197

	/*
1198
	 *      Check protocol is in range
L
Linus Torvalds 已提交
1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
	 */
	if (family < 0 || family >= NPROTO)
		return -EAFNOSUPPORT;
	if (type < 0 || type >= SOCK_MAX)
		return -EINVAL;

	/* Compatibility.

	   This uglymoron is moved from INET layer to here to avoid
	   deadlock in module load.
	 */
	if (family == PF_INET && type == SOCK_PACKET) {
1211 1212
		pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
			     current->comm);
L
Linus Torvalds 已提交
1213 1214 1215 1216 1217 1218
		family = PF_PACKET;
	}

	err = security_socket_create(family, type, protocol, kern);
	if (err)
		return err;
1219

1220 1221 1222 1223 1224 1225 1226
	/*
	 *	Allocate the socket and allow the family to set things up. if
	 *	the protocol is 0, the family is instructed to select an appropriate
	 *	default.
	 */
	sock = sock_alloc();
	if (!sock) {
1227
		net_warn_ratelimited("socket: no more sockets\n");
1228 1229 1230 1231 1232 1233
		return -ENFILE;	/* Not exactly a match, but its the
				   closest posix thing */
	}

	sock->type = type;

1234
#ifdef CONFIG_MODULES
1235 1236 1237
	/* Attempt to load a protocol module if the find failed.
	 *
	 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
L
Linus Torvalds 已提交
1238 1239 1240
	 * requested real, full-featured networking support upon configuration.
	 * Otherwise module support will break!
	 */
E
Eric Dumazet 已提交
1241
	if (rcu_access_pointer(net_families[family]) == NULL)
1242
		request_module("net-pf-%d", family);
L
Linus Torvalds 已提交
1243 1244
#endif

1245 1246 1247 1248 1249
	rcu_read_lock();
	pf = rcu_dereference(net_families[family]);
	err = -EAFNOSUPPORT;
	if (!pf)
		goto out_release;
L
Linus Torvalds 已提交
1250 1251 1252 1253 1254

	/*
	 * We will call the ->create function, that possibly is in a loadable
	 * module, so we have to bump that loadable module refcnt first.
	 */
1255
	if (!try_module_get(pf->owner))
L
Linus Torvalds 已提交
1256 1257
		goto out_release;

1258 1259 1260
	/* Now protected by module ref count */
	rcu_read_unlock();

1261
	err = pf->create(net, sock, protocol, kern);
1262
	if (err < 0)
L
Linus Torvalds 已提交
1263
		goto out_module_put;
1264

L
Linus Torvalds 已提交
1265 1266 1267 1268
	/*
	 * Now to bump the refcnt of the [loadable] module that owns this
	 * socket at sock_release time we decrement its refcnt.
	 */
1269 1270 1271
	if (!try_module_get(sock->ops->owner))
		goto out_module_busy;

L
Linus Torvalds 已提交
1272 1273 1274 1275
	/*
	 * Now that we're done with the ->create function, the [loadable]
	 * module can have its refcnt decremented
	 */
1276
	module_put(pf->owner);
V
Venkat Yekkirala 已提交
1277 1278
	err = security_socket_post_create(sock, family, type, protocol, kern);
	if (err)
1279
		goto out_sock_release;
1280
	*res = sock;
L
Linus Torvalds 已提交
1281

1282 1283 1284 1285
	return 0;

out_module_busy:
	err = -EAFNOSUPPORT;
L
Linus Torvalds 已提交
1286
out_module_put:
1287 1288 1289
	sock->ops = NULL;
	module_put(pf->owner);
out_sock_release:
L
Linus Torvalds 已提交
1290
	sock_release(sock);
1291 1292 1293 1294 1295
	return err;

out_release:
	rcu_read_unlock();
	goto out_sock_release;
L
Linus Torvalds 已提交
1296
}
P
Pavel Emelyanov 已提交
1297
EXPORT_SYMBOL(__sock_create);
L
Linus Torvalds 已提交
1298 1299 1300

int sock_create(int family, int type, int protocol, struct socket **res)
{
1301
	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
L
Linus Torvalds 已提交
1302
}
1303
EXPORT_SYMBOL(sock_create);
L
Linus Torvalds 已提交
1304

1305
int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
L
Linus Torvalds 已提交
1306
{
1307
	return __sock_create(net, family, type, protocol, res, 1);
L
Linus Torvalds 已提交
1308
}
1309
EXPORT_SYMBOL(sock_create_kern);
L
Linus Torvalds 已提交
1310

1311
SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
L
Linus Torvalds 已提交
1312 1313 1314
{
	int retval;
	struct socket *sock;
1315 1316
	int flags;

1317 1318 1319 1320 1321 1322
	/* Check the SOCK_* constants for consistency.  */
	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);

1323
	flags = type & ~SOCK_TYPE_MASK;
1324
	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1325 1326
		return -EINVAL;
	type &= SOCK_TYPE_MASK;
L
Linus Torvalds 已提交
1327

U
Ulrich Drepper 已提交
1328 1329 1330
	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

L
Linus Torvalds 已提交
1331 1332 1333 1334
	retval = sock_create(family, type, protocol, &sock);
	if (retval < 0)
		goto out;

1335
	retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
L
Linus Torvalds 已提交
1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351
	if (retval < 0)
		goto out_release;

out:
	/* It may be already another descriptor 8) Not kernel problem. */
	return retval;

out_release:
	sock_release(sock);
	return retval;
}

/*
 *	Create a pair of connected sockets.
 */

1352 1353
SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
		int __user *, usockvec)
L
Linus Torvalds 已提交
1354 1355 1356
{
	struct socket *sock1, *sock2;
	int fd1, fd2, err;
A
Al Viro 已提交
1357
	struct file *newfile1, *newfile2;
1358 1359 1360
	int flags;

	flags = type & ~SOCK_TYPE_MASK;
1361
	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1362 1363
		return -EINVAL;
	type &= SOCK_TYPE_MASK;
L
Linus Torvalds 已提交
1364

U
Ulrich Drepper 已提交
1365 1366 1367
	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

L
Linus Torvalds 已提交
1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381
	/*
	 * Obtain the first socket and check if the underlying protocol
	 * supports the socketpair call.
	 */

	err = sock_create(family, type, protocol, &sock1);
	if (err < 0)
		goto out;

	err = sock_create(family, type, protocol, &sock2);
	if (err < 0)
		goto out_release_1;

	err = sock1->ops->socketpair(sock1, sock2);
1382
	if (err < 0)
L
Linus Torvalds 已提交
1383 1384
		goto out_release_both;

1385
	fd1 = get_unused_fd_flags(flags);
1386 1387
	if (unlikely(fd1 < 0)) {
		err = fd1;
A
Al Viro 已提交
1388
		goto out_release_both;
1389
	}
1390

1391
	fd2 = get_unused_fd_flags(flags);
1392 1393
	if (unlikely(fd2 < 0)) {
		err = fd2;
1394
		goto out_put_unused_1;
1395 1396
	}

1397
	newfile1 = sock_alloc_file(sock1, flags, NULL);
1398
	if (IS_ERR(newfile1)) {
1399
		err = PTR_ERR(newfile1);
1400
		goto out_put_unused_both;
1401 1402
	}

1403
	newfile2 = sock_alloc_file(sock2, flags, NULL);
1404 1405
	if (IS_ERR(newfile2)) {
		err = PTR_ERR(newfile2);
1406
		goto out_fput_1;
A
Al Viro 已提交
1407 1408
	}

1409 1410 1411 1412 1413 1414 1415 1416
	err = put_user(fd1, &usockvec[0]);
	if (err)
		goto out_fput_both;

	err = put_user(fd2, &usockvec[1]);
	if (err)
		goto out_fput_both;

A
Al Viro 已提交
1417
	audit_fd_pair(fd1, fd2);
1418

A
Al Viro 已提交
1419 1420
	fd_install(fd1, newfile1);
	fd_install(fd2, newfile2);
L
Linus Torvalds 已提交
1421 1422 1423 1424
	/* fd1 and fd2 may be already another descriptors.
	 * Not kernel problem.
	 */

1425
	return 0;
L
Linus Torvalds 已提交
1426

1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439
out_fput_both:
	fput(newfile2);
	fput(newfile1);
	put_unused_fd(fd2);
	put_unused_fd(fd1);
	goto out;

out_fput_1:
	fput(newfile1);
	put_unused_fd(fd2);
	put_unused_fd(fd1);
	sock_release(sock2);
	goto out;
L
Linus Torvalds 已提交
1440

1441 1442 1443 1444
out_put_unused_both:
	put_unused_fd(fd2);
out_put_unused_1:
	put_unused_fd(fd1);
L
Linus Torvalds 已提交
1445
out_release_both:
1446
	sock_release(sock2);
L
Linus Torvalds 已提交
1447
out_release_1:
1448
	sock_release(sock1);
L
Linus Torvalds 已提交
1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460
out:
	return err;
}

/*
 *	Bind a name to a socket. Nothing much to do here since it's
 *	the protocol's responsibility to handle the local address.
 *
 *	We move the socket address to kernel space before we call
 *	the protocol layer (having also checked the address is ok).
 */

1461
SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
L
Linus Torvalds 已提交
1462 1463
{
	struct socket *sock;
1464
	struct sockaddr_storage address;
1465
	int err, fput_needed;
L
Linus Torvalds 已提交
1466

1467
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1468
	if (sock) {
1469
		err = move_addr_to_kernel(umyaddr, addrlen, &address);
1470 1471
		if (err >= 0) {
			err = security_socket_bind(sock,
1472
						   (struct sockaddr *)&address,
1473
						   addrlen);
1474 1475
			if (!err)
				err = sock->ops->bind(sock,
1476
						      (struct sockaddr *)
1477
						      &address, addrlen);
L
Linus Torvalds 已提交
1478
		}
1479
		fput_light(sock->file, fput_needed);
1480
	}
L
Linus Torvalds 已提交
1481 1482 1483 1484 1485 1486 1487 1488 1489
	return err;
}

/*
 *	Perform a listen. Basically, we allow the protocol to do anything
 *	necessary for a listen, and if that works, we mark the socket as
 *	ready for listening.
 */

1490
SYSCALL_DEFINE2(listen, int, fd, int, backlog)
L
Linus Torvalds 已提交
1491 1492
{
	struct socket *sock;
1493
	int err, fput_needed;
1494
	int somaxconn;
1495 1496 1497

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock) {
1498
		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1499
		if ((unsigned int)backlog > somaxconn)
1500
			backlog = somaxconn;
L
Linus Torvalds 已提交
1501 1502

		err = security_socket_listen(sock, backlog);
1503 1504
		if (!err)
			err = sock->ops->listen(sock, backlog);
L
Linus Torvalds 已提交
1505

1506
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522
	}
	return err;
}

/*
 *	For accept, we attempt to create a new socket, set up the link
 *	with the client, wake up the client, then return the new
 *	connected fd. We collect the address of the connector in kernel
 *	space and move it to user at the very end. This is unclean because
 *	we open the socket then return an error.
 *
 *	1003.1g adds the ability to recvmsg() to query connection pending
 *	status to recvmsg. We need to add that support in a way thats
 *	clean when we restucture accept also.
 */

1523 1524
SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
		int __user *, upeer_addrlen, int, flags)
L
Linus Torvalds 已提交
1525 1526
{
	struct socket *sock, *newsock;
1527
	struct file *newfile;
1528
	int err, len, newfd, fput_needed;
1529
	struct sockaddr_storage address;
L
Linus Torvalds 已提交
1530

1531
	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
U
Ulrich Drepper 已提交
1532 1533 1534 1535 1536
		return -EINVAL;

	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

1537
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1538 1539 1540 1541
	if (!sock)
		goto out;

	err = -ENFILE;
1542 1543
	newsock = sock_alloc();
	if (!newsock)
L
Linus Torvalds 已提交
1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554
		goto out_put;

	newsock->type = sock->type;
	newsock->ops = sock->ops;

	/*
	 * We don't need try_module_get here, as the listening socket (sock)
	 * has the protocol module (sock->ops->owner) held.
	 */
	__module_get(newsock->ops->owner);

1555
	newfd = get_unused_fd_flags(flags);
1556 1557
	if (unlikely(newfd < 0)) {
		err = newfd;
1558 1559
		sock_release(newsock);
		goto out_put;
1560
	}
1561
	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1562
	if (IS_ERR(newfile)) {
1563 1564 1565 1566 1567
		err = PTR_ERR(newfile);
		put_unused_fd(newfd);
		sock_release(newsock);
		goto out_put;
	}
1568

1569 1570
	err = security_socket_accept(sock, newsock);
	if (err)
1571
		goto out_fd;
1572

1573
	err = sock->ops->accept(sock, newsock, sock->file->f_flags, false);
L
Linus Torvalds 已提交
1574
	if (err < 0)
1575
		goto out_fd;
L
Linus Torvalds 已提交
1576 1577

	if (upeer_sockaddr) {
1578
		if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1579
					  &len, 2) < 0) {
L
Linus Torvalds 已提交
1580
			err = -ECONNABORTED;
1581
			goto out_fd;
L
Linus Torvalds 已提交
1582
		}
1583
		err = move_addr_to_user(&address,
1584
					len, upeer_sockaddr, upeer_addrlen);
L
Linus Torvalds 已提交
1585
		if (err < 0)
1586
			goto out_fd;
L
Linus Torvalds 已提交
1587 1588 1589 1590
	}

	/* File flags are not inherited via accept() unlike another OSes. */

1591 1592
	fd_install(newfd, newfile);
	err = newfd;
L
Linus Torvalds 已提交
1593 1594

out_put:
1595
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1596 1597
out:
	return err;
1598
out_fd:
1599
	fput(newfile);
1600
	put_unused_fd(newfd);
L
Linus Torvalds 已提交
1601 1602 1603
	goto out_put;
}

1604 1605
SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
		int __user *, upeer_addrlen)
U
Ulrich Drepper 已提交
1606
{
U
Ulrich Drepper 已提交
1607
	return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
U
Ulrich Drepper 已提交
1608 1609
}

L
Linus Torvalds 已提交
1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621
/*
 *	Attempt to connect to a socket with the server address.  The address
 *	is in user space so we verify it is OK and move it to kernel space.
 *
 *	For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
 *	break bindings
 *
 *	NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
 *	other SEQPACKET protocols that take time to connect() as it doesn't
 *	include the -EINPROGRESS status for such sockets.
 */

1622 1623
SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
		int, addrlen)
L
Linus Torvalds 已提交
1624 1625
{
	struct socket *sock;
1626
	struct sockaddr_storage address;
1627
	int err, fput_needed;
L
Linus Torvalds 已提交
1628

1629
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1630 1631
	if (!sock)
		goto out;
1632
	err = move_addr_to_kernel(uservaddr, addrlen, &address);
L
Linus Torvalds 已提交
1633 1634 1635
	if (err < 0)
		goto out_put;

1636
	err =
1637
	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
L
Linus Torvalds 已提交
1638 1639 1640
	if (err)
		goto out_put;

1641
	err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
L
Linus Torvalds 已提交
1642 1643
				 sock->file->f_flags);
out_put:
1644
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1645 1646 1647 1648 1649 1650 1651 1652 1653
out:
	return err;
}

/*
 *	Get the local address ('name') of a socket object. Move the obtained
 *	name to user space.
 */

1654 1655
SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
		int __user *, usockaddr_len)
L
Linus Torvalds 已提交
1656 1657
{
	struct socket *sock;
1658
	struct sockaddr_storage address;
1659
	int len, err, fput_needed;
1660

1661
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1662 1663 1664 1665 1666 1667 1668
	if (!sock)
		goto out;

	err = security_socket_getsockname(sock);
	if (err)
		goto out_put;

1669
	err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
L
Linus Torvalds 已提交
1670 1671
	if (err)
		goto out_put;
1672
	err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
L
Linus Torvalds 已提交
1673 1674

out_put:
1675
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1676 1677 1678 1679 1680 1681 1682 1683 1684
out:
	return err;
}

/*
 *	Get the remote address ('name') of a socket object. Move the obtained
 *	name to user space.
 */

1685 1686
SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
		int __user *, usockaddr_len)
L
Linus Torvalds 已提交
1687 1688
{
	struct socket *sock;
1689
	struct sockaddr_storage address;
1690
	int len, err, fput_needed;
L
Linus Torvalds 已提交
1691

1692 1693
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
L
Linus Torvalds 已提交
1694 1695
		err = security_socket_getpeername(sock);
		if (err) {
1696
			fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1697 1698 1699
			return err;
		}

1700
		err =
1701
		    sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1702
				       1);
L
Linus Torvalds 已提交
1703
		if (!err)
1704
			err = move_addr_to_user(&address, len, usockaddr,
1705
						usockaddr_len);
1706
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1707 1708 1709 1710 1711 1712 1713 1714 1715 1716
	}
	return err;
}

/*
 *	Send a datagram to a given address. We move the address into kernel
 *	space and check the user space data area is readable before invoking
 *	the protocol.
 */

1717
SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1718
		unsigned int, flags, struct sockaddr __user *, addr,
1719
		int, addr_len)
L
Linus Torvalds 已提交
1720 1721
{
	struct socket *sock;
1722
	struct sockaddr_storage address;
L
Linus Torvalds 已提交
1723 1724 1725
	int err;
	struct msghdr msg;
	struct iovec iov;
1726 1727
	int fput_needed;

1728 1729 1730
	err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
	if (unlikely(err))
		return err;
1731 1732
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (!sock)
1733
		goto out;
1734

1735 1736 1737 1738
	msg.msg_name = NULL;
	msg.msg_control = NULL;
	msg.msg_controllen = 0;
	msg.msg_namelen = 0;
1739
	if (addr) {
1740
		err = move_addr_to_kernel(addr, addr_len, &address);
L
Linus Torvalds 已提交
1741 1742
		if (err < 0)
			goto out_put;
1743
		msg.msg_name = (struct sockaddr *)&address;
1744
		msg.msg_namelen = addr_len;
L
Linus Torvalds 已提交
1745 1746 1747 1748
	}
	if (sock->file->f_flags & O_NONBLOCK)
		flags |= MSG_DONTWAIT;
	msg.msg_flags = flags;
1749
	err = sock_sendmsg(sock, &msg);
L
Linus Torvalds 已提交
1750

1751
out_put:
1752
	fput_light(sock->file, fput_needed);
1753
out:
L
Linus Torvalds 已提交
1754 1755 1756 1757
	return err;
}

/*
1758
 *	Send a datagram down a socket.
L
Linus Torvalds 已提交
1759 1760
 */

1761
SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1762
		unsigned int, flags)
L
Linus Torvalds 已提交
1763 1764 1765 1766 1767
{
	return sys_sendto(fd, buff, len, flags, NULL, 0);
}

/*
1768
 *	Receive a frame from the socket and optionally record the address of the
L
Linus Torvalds 已提交
1769 1770 1771 1772
 *	sender. We verify the buffers are writable and if needed move the
 *	sender address from kernel to user space.
 */

1773
SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1774
		unsigned int, flags, struct sockaddr __user *, addr,
1775
		int __user *, addr_len)
L
Linus Torvalds 已提交
1776 1777 1778 1779
{
	struct socket *sock;
	struct iovec iov;
	struct msghdr msg;
1780
	struct sockaddr_storage address;
1781
	int err, err2;
1782 1783
	int fput_needed;

1784 1785 1786
	err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
	if (unlikely(err))
		return err;
1787
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1788
	if (!sock)
1789
		goto out;
L
Linus Torvalds 已提交
1790

1791 1792
	msg.msg_control = NULL;
	msg.msg_controllen = 0;
1793 1794 1795 1796
	/* Save some cycles and don't copy the address if not needed */
	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
	/* We assume all kernel code knows the size of sockaddr_storage */
	msg.msg_namelen = 0;
1797
	msg.msg_iocb = NULL;
1798
	msg.msg_flags = 0;
L
Linus Torvalds 已提交
1799 1800
	if (sock->file->f_flags & O_NONBLOCK)
		flags |= MSG_DONTWAIT;
1801
	err = sock_recvmsg(sock, &msg, flags);
L
Linus Torvalds 已提交
1802

1803
	if (err >= 0 && addr != NULL) {
1804
		err2 = move_addr_to_user(&address,
1805
					 msg.msg_namelen, addr, addr_len);
1806 1807
		if (err2 < 0)
			err = err2;
L
Linus Torvalds 已提交
1808
	}
1809 1810

	fput_light(sock->file, fput_needed);
1811
out:
L
Linus Torvalds 已提交
1812 1813 1814 1815
	return err;
}

/*
1816
 *	Receive a datagram from a socket.
L
Linus Torvalds 已提交
1817 1818
 */

1819 1820
SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
		unsigned int, flags)
L
Linus Torvalds 已提交
1821 1822 1823 1824 1825 1826 1827 1828 1829
{
	return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
}

/*
 *	Set a socket option. Because we don't know the option lengths we have
 *	to pass the user mode parameter for the protocols to sort out.
 */

1830 1831
SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
		char __user *, optval, int, optlen)
L
Linus Torvalds 已提交
1832
{
1833
	int err, fput_needed;
L
Linus Torvalds 已提交
1834 1835 1836 1837
	struct socket *sock;

	if (optlen < 0)
		return -EINVAL;
1838 1839 1840 1841

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
		err = security_socket_setsockopt(sock, level, optname);
1842 1843
		if (err)
			goto out_put;
L
Linus Torvalds 已提交
1844 1845

		if (level == SOL_SOCKET)
1846 1847 1848
			err =
			    sock_setsockopt(sock, level, optname, optval,
					    optlen);
L
Linus Torvalds 已提交
1849
		else
1850 1851 1852
			err =
			    sock->ops->setsockopt(sock, level, optname, optval,
						  optlen);
1853 1854
out_put:
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1855 1856 1857 1858 1859 1860 1861 1862 1863
	}
	return err;
}

/*
 *	Get a socket option. Because we don't know the option lengths we have
 *	to pass a user mode parameter for the protocols to sort out.
 */

1864 1865
SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
		char __user *, optval, int __user *, optlen)
L
Linus Torvalds 已提交
1866
{
1867
	int err, fput_needed;
L
Linus Torvalds 已提交
1868 1869
	struct socket *sock;

1870 1871
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
1872 1873 1874
		err = security_socket_getsockopt(sock, level, optname);
		if (err)
			goto out_put;
L
Linus Torvalds 已提交
1875 1876

		if (level == SOL_SOCKET)
1877 1878 1879
			err =
			    sock_getsockopt(sock, level, optname, optval,
					    optlen);
L
Linus Torvalds 已提交
1880
		else
1881 1882 1883
			err =
			    sock->ops->getsockopt(sock, level, optname, optval,
						  optlen);
1884 1885
out_put:
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1886 1887 1888 1889 1890 1891 1892 1893
	}
	return err;
}

/*
 *	Shutdown a socket.
 */

1894
SYSCALL_DEFINE2(shutdown, int, fd, int, how)
L
Linus Torvalds 已提交
1895
{
1896
	int err, fput_needed;
L
Linus Torvalds 已提交
1897 1898
	struct socket *sock;

1899 1900
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
L
Linus Torvalds 已提交
1901
		err = security_socket_shutdown(sock, how);
1902 1903 1904
		if (!err)
			err = sock->ops->shutdown(sock, how);
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1905 1906 1907 1908
	}
	return err;
}

1909
/* A couple of helpful macros for getting the address of the 32/64 bit
L
Linus Torvalds 已提交
1910 1911 1912 1913 1914 1915
 * fields which are the same type (int / unsigned) on our platforms.
 */
#define COMPAT_MSG(msg, member)	((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
#define COMPAT_NAMELEN(msg)	COMPAT_MSG(msg, msg_namelen)
#define COMPAT_FLAGS(msg)	COMPAT_MSG(msg, msg_flags)

1916 1917 1918 1919 1920
struct used_address {
	struct sockaddr_storage name;
	unsigned int name_len;
};

1921 1922 1923 1924
static int copy_msghdr_from_user(struct msghdr *kmsg,
				 struct user_msghdr __user *umsg,
				 struct sockaddr __user **save_addr,
				 struct iovec **iov)
1925
{
1926
	struct user_msghdr msg;
1927 1928
	ssize_t err;

1929
	if (copy_from_user(&msg, umsg, sizeof(*umsg)))
1930
		return -EFAULT;
1931

1932
	kmsg->msg_control = (void __force *)msg.msg_control;
1933 1934 1935 1936 1937
	kmsg->msg_controllen = msg.msg_controllen;
	kmsg->msg_flags = msg.msg_flags;

	kmsg->msg_namelen = msg.msg_namelen;
	if (!msg.msg_name)
1938 1939
		kmsg->msg_namelen = 0;

1940 1941 1942
	if (kmsg->msg_namelen < 0)
		return -EINVAL;

1943
	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
1944
		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
1945 1946

	if (save_addr)
1947
		*save_addr = msg.msg_name;
1948

1949
	if (msg.msg_name && kmsg->msg_namelen) {
1950
		if (!save_addr) {
1951 1952
			err = move_addr_to_kernel(msg.msg_name,
						  kmsg->msg_namelen,
1953 1954 1955 1956 1957 1958 1959 1960 1961
						  kmsg->msg_name);
			if (err < 0)
				return err;
		}
	} else {
		kmsg->msg_name = NULL;
		kmsg->msg_namelen = 0;
	}

1962
	if (msg.msg_iovlen > UIO_MAXIOV)
1963 1964
		return -EMSGSIZE;

1965 1966
	kmsg->msg_iocb = NULL;

1967 1968
	return import_iovec(save_addr ? READ : WRITE,
			    msg.msg_iov, msg.msg_iovlen,
1969
			    UIO_FASTIOV, iov, &kmsg->msg_iter);
1970 1971
}

1972
static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
1973
			 struct msghdr *msg_sys, unsigned int flags,
1974 1975
			 struct used_address *used_address,
			 unsigned int allowed_msghdr_flags)
L
Linus Torvalds 已提交
1976
{
1977 1978
	struct compat_msghdr __user *msg_compat =
	    (struct compat_msghdr __user *)msg;
1979
	struct sockaddr_storage address;
L
Linus Torvalds 已提交
1980
	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1981
	unsigned char ctl[sizeof(struct cmsghdr) + 20]
1982
				__aligned(sizeof(__kernel_size_t));
1983
	/* 20 is size of ipv6_pktinfo */
L
Linus Torvalds 已提交
1984
	unsigned char *ctl_buf = ctl;
1985
	int ctl_len;
1986
	ssize_t err;
1987

1988
	msg_sys->msg_name = &address;
L
Linus Torvalds 已提交
1989

1990
	if (MSG_CMSG_COMPAT & flags)
1991
		err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
1992
	else
1993
		err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
1994
	if (err < 0)
1995
		return err;
L
Linus Torvalds 已提交
1996 1997 1998

	err = -ENOBUFS;

1999
	if (msg_sys->msg_controllen > INT_MAX)
L
Linus Torvalds 已提交
2000
		goto out_freeiov;
2001
	flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
2002
	ctl_len = msg_sys->msg_controllen;
L
Linus Torvalds 已提交
2003
	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
2004
		err =
2005
		    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
2006
						     sizeof(ctl));
L
Linus Torvalds 已提交
2007 2008
		if (err)
			goto out_freeiov;
2009 2010
		ctl_buf = msg_sys->msg_control;
		ctl_len = msg_sys->msg_controllen;
L
Linus Torvalds 已提交
2011
	} else if (ctl_len) {
2012 2013
		BUILD_BUG_ON(sizeof(struct cmsghdr) !=
			     CMSG_ALIGN(sizeof(struct cmsghdr)));
2014
		if (ctl_len > sizeof(ctl)) {
L
Linus Torvalds 已提交
2015
			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
2016
			if (ctl_buf == NULL)
L
Linus Torvalds 已提交
2017 2018 2019 2020
				goto out_freeiov;
		}
		err = -EFAULT;
		/*
2021
		 * Careful! Before this, msg_sys->msg_control contains a user pointer.
L
Linus Torvalds 已提交
2022 2023 2024
		 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
		 * checking falls down on this.
		 */
2025
		if (copy_from_user(ctl_buf,
2026
				   (void __user __force *)msg_sys->msg_control,
2027
				   ctl_len))
L
Linus Torvalds 已提交
2028
			goto out_freectl;
2029
		msg_sys->msg_control = ctl_buf;
L
Linus Torvalds 已提交
2030
	}
2031
	msg_sys->msg_flags = flags;
L
Linus Torvalds 已提交
2032 2033

	if (sock->file->f_flags & O_NONBLOCK)
2034
		msg_sys->msg_flags |= MSG_DONTWAIT;
2035 2036 2037 2038 2039 2040
	/*
	 * If this is sendmmsg() and current destination address is same as
	 * previously succeeded address, omit asking LSM's decision.
	 * used_address->name_len is initialized to UINT_MAX so that the first
	 * destination address never matches.
	 */
2041 2042 2043
	if (used_address && msg_sys->msg_name &&
	    used_address->name_len == msg_sys->msg_namelen &&
	    !memcmp(&used_address->name, msg_sys->msg_name,
2044
		    used_address->name_len)) {
2045
		err = sock_sendmsg_nosec(sock, msg_sys);
2046 2047
		goto out_freectl;
	}
2048
	err = sock_sendmsg(sock, msg_sys);
2049 2050 2051 2052 2053 2054
	/*
	 * If this is sendmmsg() and sending to current destination address was
	 * successful, remember it.
	 */
	if (used_address && err >= 0) {
		used_address->name_len = msg_sys->msg_namelen;
2055 2056 2057
		if (msg_sys->msg_name)
			memcpy(&used_address->name, msg_sys->msg_name,
			       used_address->name_len);
2058
	}
L
Linus Torvalds 已提交
2059 2060

out_freectl:
2061
	if (ctl_buf != ctl)
L
Linus Torvalds 已提交
2062 2063
		sock_kfree_s(sock->sk, ctl_buf, ctl_len);
out_freeiov:
2064
	kfree(iov);
2065 2066 2067 2068 2069 2070 2071
	return err;
}

/*
 *	BSD sendmsg interface
 */

2072
long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2073 2074 2075
{
	int fput_needed, err;
	struct msghdr msg_sys;
2076 2077 2078
	struct socket *sock;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2079 2080 2081
	if (!sock)
		goto out;

2082
	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
2083

2084
	fput_light(sock->file, fput_needed);
2085
out:
L
Linus Torvalds 已提交
2086 2087 2088
	return err;
}

2089
SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2090 2091 2092 2093 2094 2095
{
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;
	return __sys_sendmsg(fd, msg, flags);
}

2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107
/*
 *	Linux sendmmsg interface
 */

int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
		   unsigned int flags)
{
	int fput_needed, err, datagrams;
	struct socket *sock;
	struct mmsghdr __user *entry;
	struct compat_mmsghdr __user *compat_entry;
	struct msghdr msg_sys;
2108
	struct used_address used_address;
T
Tom Herbert 已提交
2109
	unsigned int oflags = flags;
2110

2111 2112
	if (vlen > UIO_MAXIOV)
		vlen = UIO_MAXIOV;
2113 2114 2115 2116 2117 2118 2119

	datagrams = 0;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (!sock)
		return err;

2120
	used_address.name_len = UINT_MAX;
2121 2122
	entry = mmsg;
	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2123
	err = 0;
T
Tom Herbert 已提交
2124
	flags |= MSG_BATCH;
2125 2126

	while (datagrams < vlen) {
T
Tom Herbert 已提交
2127 2128 2129
		if (datagrams == vlen - 1)
			flags = oflags;

2130
		if (MSG_CMSG_COMPAT & flags) {
2131
			err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2132
					     &msg_sys, flags, &used_address, MSG_EOR);
2133 2134 2135 2136 2137
			if (err < 0)
				break;
			err = __put_user(err, &compat_entry->msg_len);
			++compat_entry;
		} else {
2138
			err = ___sys_sendmsg(sock,
2139
					     (struct user_msghdr __user *)entry,
2140
					     &msg_sys, flags, &used_address, MSG_EOR);
2141 2142 2143 2144 2145 2146 2147 2148 2149
			if (err < 0)
				break;
			err = put_user(err, &entry->msg_len);
			++entry;
		}

		if (err)
			break;
		++datagrams;
2150 2151
		if (msg_data_left(&msg_sys))
			break;
2152
		cond_resched();
2153 2154 2155 2156
	}

	fput_light(sock->file, fput_needed);

2157 2158
	/* We only return an error if no datagrams were able to be sent */
	if (datagrams != 0)
2159 2160 2161 2162 2163 2164 2165 2166
		return datagrams;

	return err;
}

SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
		unsigned int, vlen, unsigned int, flags)
{
2167 2168
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;
2169 2170 2171
	return __sys_sendmmsg(fd, mmsg, vlen, flags);
}

2172
static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
2173
			 struct msghdr *msg_sys, unsigned int flags, int nosec)
L
Linus Torvalds 已提交
2174
{
2175 2176
	struct compat_msghdr __user *msg_compat =
	    (struct compat_msghdr __user *)msg;
L
Linus Torvalds 已提交
2177
	struct iovec iovstack[UIO_FASTIOV];
2178
	struct iovec *iov = iovstack;
L
Linus Torvalds 已提交
2179
	unsigned long cmsg_ptr;
2180
	int len;
2181
	ssize_t err;
L
Linus Torvalds 已提交
2182 2183

	/* kernel mode address */
2184
	struct sockaddr_storage addr;
L
Linus Torvalds 已提交
2185 2186 2187

	/* user mode address pointers */
	struct sockaddr __user *uaddr;
2188
	int __user *uaddr_len = COMPAT_NAMELEN(msg);
2189

2190
	msg_sys->msg_name = &addr;
L
Linus Torvalds 已提交
2191

2192
	if (MSG_CMSG_COMPAT & flags)
2193
		err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
2194
	else
2195
		err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
L
Linus Torvalds 已提交
2196
	if (err < 0)
2197
		return err;
L
Linus Torvalds 已提交
2198

2199 2200
	cmsg_ptr = (unsigned long)msg_sys->msg_control;
	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2201

2202 2203 2204
	/* We assume all kernel code knows the size of sockaddr_storage */
	msg_sys->msg_namelen = 0;

L
Linus Torvalds 已提交
2205 2206
	if (sock->file->f_flags & O_NONBLOCK)
		flags |= MSG_DONTWAIT;
2207
	err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys, flags);
L
Linus Torvalds 已提交
2208 2209 2210 2211 2212
	if (err < 0)
		goto out_freeiov;
	len = err;

	if (uaddr != NULL) {
2213
		err = move_addr_to_user(&addr,
2214
					msg_sys->msg_namelen, uaddr,
2215
					uaddr_len);
L
Linus Torvalds 已提交
2216 2217 2218
		if (err < 0)
			goto out_freeiov;
	}
2219
	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2220
			 COMPAT_FLAGS(msg));
L
Linus Torvalds 已提交
2221 2222 2223
	if (err)
		goto out_freeiov;
	if (MSG_CMSG_COMPAT & flags)
2224
		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
L
Linus Torvalds 已提交
2225 2226
				 &msg_compat->msg_controllen);
	else
2227
		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
L
Linus Torvalds 已提交
2228 2229 2230 2231 2232 2233
				 &msg->msg_controllen);
	if (err)
		goto out_freeiov;
	err = len;

out_freeiov:
2234
	kfree(iov);
2235 2236 2237 2238 2239 2240 2241
	return err;
}

/*
 *	BSD recvmsg interface
 */

2242
long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2243 2244 2245
{
	int fput_needed, err;
	struct msghdr msg_sys;
2246 2247 2248
	struct socket *sock;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2249 2250 2251
	if (!sock)
		goto out;

2252
	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2253

2254
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
2255 2256 2257 2258
out:
	return err;
}

2259
SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2260 2261 2262 2263 2264 2265 2266
		unsigned int, flags)
{
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;
	return __sys_recvmsg(fd, msg, flags);
}

2267 2268 2269 2270 2271 2272 2273 2274 2275 2276
/*
 *     Linux recvmmsg interface
 */

int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
		   unsigned int flags, struct timespec *timeout)
{
	int fput_needed, err, datagrams;
	struct socket *sock;
	struct mmsghdr __user *entry;
2277
	struct compat_mmsghdr __user *compat_entry;
2278
	struct msghdr msg_sys;
2279 2280
	struct timespec64 end_time;
	struct timespec64 timeout64;
2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293

	if (timeout &&
	    poll_select_set_timeout(&end_time, timeout->tv_sec,
				    timeout->tv_nsec))
		return -EINVAL;

	datagrams = 0;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (!sock)
		return err;

	err = sock_error(sock->sk);
2294 2295
	if (err) {
		datagrams = err;
2296
		goto out_put;
2297
	}
2298 2299

	entry = mmsg;
2300
	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2301 2302 2303 2304 2305

	while (datagrams < vlen) {
		/*
		 * No need to ask LSM for more than the first datagram.
		 */
2306
		if (MSG_CMSG_COMPAT & flags) {
2307
			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2308 2309
					     &msg_sys, flags & ~MSG_WAITFORONE,
					     datagrams);
2310 2311 2312 2313 2314
			if (err < 0)
				break;
			err = __put_user(err, &compat_entry->msg_len);
			++compat_entry;
		} else {
2315
			err = ___sys_recvmsg(sock,
2316
					     (struct user_msghdr __user *)entry,
2317 2318
					     &msg_sys, flags & ~MSG_WAITFORONE,
					     datagrams);
2319 2320 2321 2322 2323 2324
			if (err < 0)
				break;
			err = put_user(err, &entry->msg_len);
			++entry;
		}

2325 2326 2327 2328
		if (err)
			break;
		++datagrams;

2329 2330 2331 2332
		/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
		if (flags & MSG_WAITFORONE)
			flags |= MSG_DONTWAIT;

2333
		if (timeout) {
2334 2335 2336
			ktime_get_ts64(&timeout64);
			*timeout = timespec64_to_timespec(
					timespec64_sub(end_time, timeout64));
2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349
			if (timeout->tv_sec < 0) {
				timeout->tv_sec = timeout->tv_nsec = 0;
				break;
			}

			/* Timeout, return less than vlen datagrams */
			if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
				break;
		}

		/* Out of band data, return right away */
		if (msg_sys.msg_flags & MSG_OOB)
			break;
2350
		cond_resched();
2351 2352 2353
	}

	if (err == 0)
2354 2355 2356 2357 2358 2359
		goto out_put;

	if (datagrams == 0) {
		datagrams = err;
		goto out_put;
	}
2360

2361 2362 2363 2364 2365
	/*
	 * We may return less entries than requested (vlen) if the
	 * sock is non block and there aren't enough datagrams...
	 */
	if (err != -EAGAIN) {
2366
		/*
2367 2368 2369 2370
		 * ... or  if recvmsg returns an error after we
		 * received some datagrams, where we record the
		 * error to return on the next call or if the
		 * app asks about it using getsockopt(SO_ERROR).
2371
		 */
2372
		sock->sk->sk_err = -err;
2373
	}
2374 2375
out_put:
	fput_light(sock->file, fput_needed);
2376

2377
	return datagrams;
2378 2379 2380 2381 2382 2383 2384 2385 2386
}

SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
		unsigned int, vlen, unsigned int, flags,
		struct timespec __user *, timeout)
{
	int datagrams;
	struct timespec timeout_sys;

2387 2388 2389
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;

2390 2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405
	if (!timeout)
		return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);

	if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
		return -EFAULT;

	datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);

	if (datagrams > 0 &&
	    copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
		datagrams = -EFAULT;

	return datagrams;
}

#ifdef __ARCH_WANT_SYS_SOCKETCALL
L
Linus Torvalds 已提交
2406 2407
/* Argument list sizes for sys_socketcall */
#define AL(x) ((x) * sizeof(unsigned long))
2408
static const unsigned char nargs[21] = {
2409 2410 2411
	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2412
	AL(4), AL(5), AL(4)
2413 2414
};

L
Linus Torvalds 已提交
2415 2416 2417
#undef AL

/*
2418
 *	System call vectors.
L
Linus Torvalds 已提交
2419 2420 2421
 *
 *	Argument checking cleaned up. Saved 20% in size.
 *  This function doesn't need to set the kernel lock because
2422
 *  it is set by the callees.
L
Linus Torvalds 已提交
2423 2424
 */

2425
SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
L
Linus Torvalds 已提交
2426
{
2427
	unsigned long a[AUDITSC_ARGS];
2428
	unsigned long a0, a1;
L
Linus Torvalds 已提交
2429
	int err;
2430
	unsigned int len;
L
Linus Torvalds 已提交
2431

2432
	if (call < 1 || call > SYS_SENDMMSG)
L
Linus Torvalds 已提交
2433 2434
		return -EINVAL;

2435 2436 2437 2438
	len = nargs[call];
	if (len > sizeof(a))
		return -EINVAL;

L
Linus Torvalds 已提交
2439
	/* copy_from_user should be SMP safe. */
2440
	if (copy_from_user(a, args, len))
L
Linus Torvalds 已提交
2441
		return -EFAULT;
2442

2443 2444 2445
	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
	if (err)
		return err;
2446

2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463
	a0 = a[0];
	a1 = a[1];

	switch (call) {
	case SYS_SOCKET:
		err = sys_socket(a0, a1, a[2]);
		break;
	case SYS_BIND:
		err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
		break;
	case SYS_CONNECT:
		err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
		break;
	case SYS_LISTEN:
		err = sys_listen(a0, a1);
		break;
	case SYS_ACCEPT:
U
Ulrich Drepper 已提交
2464 2465
		err = sys_accept4(a0, (struct sockaddr __user *)a1,
				  (int __user *)a[2], 0);
2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506
		break;
	case SYS_GETSOCKNAME:
		err =
		    sys_getsockname(a0, (struct sockaddr __user *)a1,
				    (int __user *)a[2]);
		break;
	case SYS_GETPEERNAME:
		err =
		    sys_getpeername(a0, (struct sockaddr __user *)a1,
				    (int __user *)a[2]);
		break;
	case SYS_SOCKETPAIR:
		err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
		break;
	case SYS_SEND:
		err = sys_send(a0, (void __user *)a1, a[2], a[3]);
		break;
	case SYS_SENDTO:
		err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
				 (struct sockaddr __user *)a[4], a[5]);
		break;
	case SYS_RECV:
		err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
		break;
	case SYS_RECVFROM:
		err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
				   (struct sockaddr __user *)a[4],
				   (int __user *)a[5]);
		break;
	case SYS_SHUTDOWN:
		err = sys_shutdown(a0, a1);
		break;
	case SYS_SETSOCKOPT:
		err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
		break;
	case SYS_GETSOCKOPT:
		err =
		    sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
				   (int __user *)a[4]);
		break;
	case SYS_SENDMSG:
2507
		err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2508
		break;
2509 2510 2511
	case SYS_SENDMMSG:
		err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
		break;
2512
	case SYS_RECVMSG:
2513
		err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2514
		break;
2515 2516 2517 2518
	case SYS_RECVMMSG:
		err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
				   (struct timespec __user *)a[4]);
		break;
U
Ulrich Drepper 已提交
2519 2520 2521
	case SYS_ACCEPT4:
		err = sys_accept4(a0, (struct sockaddr __user *)a1,
				  (int __user *)a[2], a[3]);
U
Ulrich Drepper 已提交
2522
		break;
2523 2524 2525
	default:
		err = -EINVAL;
		break;
L
Linus Torvalds 已提交
2526 2527 2528 2529
	}
	return err;
}

2530
#endif				/* __ARCH_WANT_SYS_SOCKETCALL */
L
Linus Torvalds 已提交
2531

2532 2533 2534 2535
/**
 *	sock_register - add a socket protocol handler
 *	@ops: description of protocol
 *
L
Linus Torvalds 已提交
2536 2537
 *	This function is called by a protocol handler that wants to
 *	advertise its address family, and have it linked into the
2538
 *	socket interface. The value ops->family corresponds to the
2539
 *	socket system call protocol family.
L
Linus Torvalds 已提交
2540
 */
2541
int sock_register(const struct net_proto_family *ops)
L
Linus Torvalds 已提交
2542 2543 2544 2545
{
	int err;

	if (ops->family >= NPROTO) {
2546
		pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
L
Linus Torvalds 已提交
2547 2548
		return -ENOBUFS;
	}
2549 2550

	spin_lock(&net_family_lock);
E
Eric Dumazet 已提交
2551 2552
	if (rcu_dereference_protected(net_families[ops->family],
				      lockdep_is_held(&net_family_lock)))
2553 2554
		err = -EEXIST;
	else {
2555
		rcu_assign_pointer(net_families[ops->family], ops);
L
Linus Torvalds 已提交
2556 2557
		err = 0;
	}
2558 2559
	spin_unlock(&net_family_lock);

2560
	pr_info("NET: Registered protocol family %d\n", ops->family);
L
Linus Torvalds 已提交
2561 2562
	return err;
}
2563
EXPORT_SYMBOL(sock_register);
L
Linus Torvalds 已提交
2564

2565 2566 2567 2568
/**
 *	sock_unregister - remove a protocol handler
 *	@family: protocol family to remove
 *
L
Linus Torvalds 已提交
2569 2570
 *	This function is called by a protocol handler that wants to
 *	remove its address family, and have it unlinked from the
2571 2572 2573 2574 2575 2576
 *	new socket creation.
 *
 *	If protocol handler is a module, then it can use module reference
 *	counts to protect against new references. If protocol handler is not
 *	a module then it needs to provide its own protection in
 *	the ops->create routine.
L
Linus Torvalds 已提交
2577
 */
2578
void sock_unregister(int family)
L
Linus Torvalds 已提交
2579
{
2580
	BUG_ON(family < 0 || family >= NPROTO);
L
Linus Torvalds 已提交
2581

2582
	spin_lock(&net_family_lock);
2583
	RCU_INIT_POINTER(net_families[family], NULL);
2584 2585 2586 2587
	spin_unlock(&net_family_lock);

	synchronize_rcu();

2588
	pr_info("NET: Unregistered protocol family %d\n", family);
L
Linus Torvalds 已提交
2589
}
2590
EXPORT_SYMBOL(sock_unregister);
L
Linus Torvalds 已提交
2591

2592
static int __init sock_init(void)
L
Linus Torvalds 已提交
2593
{
N
Nick Piggin 已提交
2594
	int err;
2595 2596 2597 2598 2599 2600
	/*
	 *      Initialize the network sysctl infrastructure.
	 */
	err = net_sysctl_init();
	if (err)
		goto out;
N
Nick Piggin 已提交
2601

L
Linus Torvalds 已提交
2602
	/*
2603
	 *      Initialize skbuff SLAB cache
L
Linus Torvalds 已提交
2604 2605 2606 2607
	 */
	skb_init();

	/*
2608
	 *      Initialize the protocols module.
L
Linus Torvalds 已提交
2609 2610 2611
	 */

	init_inodecache();
N
Nick Piggin 已提交
2612 2613 2614 2615

	err = register_filesystem(&sock_fs_type);
	if (err)
		goto out_fs;
L
Linus Torvalds 已提交
2616
	sock_mnt = kern_mount(&sock_fs_type);
N
Nick Piggin 已提交
2617 2618 2619 2620
	if (IS_ERR(sock_mnt)) {
		err = PTR_ERR(sock_mnt);
		goto out_mount;
	}
2621 2622

	/* The real protocol initialization is performed in later initcalls.
L
Linus Torvalds 已提交
2623 2624 2625
	 */

#ifdef CONFIG_NETFILTER
2626 2627 2628
	err = netfilter_init();
	if (err)
		goto out;
L
Linus Torvalds 已提交
2629
#endif
2630

2631
	ptp_classifier_init();
2632

N
Nick Piggin 已提交
2633 2634 2635 2636 2637 2638 2639
out:
	return err;

out_mount:
	unregister_filesystem(&sock_fs_type);
out_fs:
	goto out;
L
Linus Torvalds 已提交
2640 2641
}

2642 2643
core_initcall(sock_init);	/* early initcall */

L
Linus Torvalds 已提交
2644 2645 2646 2647 2648 2649
#ifdef CONFIG_PROC_FS
void socket_seq_show(struct seq_file *seq)
{
	int cpu;
	int counter = 0;

2650
	for_each_possible_cpu(cpu)
2651
	    counter += per_cpu(sockets_in_use, cpu);
L
Linus Torvalds 已提交
2652 2653 2654 2655 2656 2657 2658

	/* It can be negative, by the way. 8) */
	if (counter < 0)
		counter = 0;

	seq_printf(seq, "sockets: used %d\n", counter);
}
2659
#endif				/* CONFIG_PROC_FS */
L
Linus Torvalds 已提交
2660

2661
#ifdef CONFIG_COMPAT
2662
static int do_siocgstamp(struct net *net, struct socket *sock,
2663
			 unsigned int cmd, void __user *up)
2664 2665 2666 2667 2668 2669
{
	mm_segment_t old_fs = get_fs();
	struct timeval ktv;
	int err;

	set_fs(KERNEL_DS);
2670
	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2671
	set_fs(old_fs);
2672
	if (!err)
2673
		err = compat_put_timeval(&ktv, up);
2674

2675 2676 2677
	return err;
}

2678
static int do_siocgstampns(struct net *net, struct socket *sock,
2679
			   unsigned int cmd, void __user *up)
2680 2681 2682 2683 2684 2685
{
	mm_segment_t old_fs = get_fs();
	struct timespec kts;
	int err;

	set_fs(KERNEL_DS);
2686
	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2687
	set_fs(old_fs);
2688
	if (!err)
2689
		err = compat_put_timespec(&kts, up);
2690

2691 2692 2693
	return err;
}

2694
static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2695 2696 2697 2698 2699
{
	struct ifreq __user *uifr;
	int err;

	uifr = compat_alloc_user_space(sizeof(struct ifreq));
2700
	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2701 2702
		return -EFAULT;

2703
	err = dev_ioctl(net, SIOCGIFNAME, uifr);
2704 2705 2706
	if (err)
		return err;

2707
	if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2708 2709 2710 2711 2712
		return -EFAULT;

	return 0;
}

2713
static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2714
{
2715
	struct compat_ifconf ifc32;
2716 2717
	struct ifconf ifc;
	struct ifconf __user *uifc;
2718
	struct compat_ifreq __user *ifr32;
2719 2720 2721 2722
	struct ifreq __user *ifr;
	unsigned int i, j;
	int err;

2723
	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2724 2725
		return -EFAULT;

2726
	memset(&ifc, 0, sizeof(ifc));
2727 2728 2729 2730 2731 2732
	if (ifc32.ifcbuf == 0) {
		ifc32.ifc_len = 0;
		ifc.ifc_len = 0;
		ifc.ifc_req = NULL;
		uifc = compat_alloc_user_space(sizeof(struct ifconf));
	} else {
2733 2734
		size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
			sizeof(struct ifreq);
2735 2736 2737 2738
		uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
		ifc.ifc_len = len;
		ifr = ifc.ifc_req = (void __user *)(uifc + 1);
		ifr32 = compat_ptr(ifc32.ifcbuf);
2739
		for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2740
			if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2741 2742 2743 2744 2745 2746 2747 2748
				return -EFAULT;
			ifr++;
			ifr32++;
		}
	}
	if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
		return -EFAULT;

2749
	err = dev_ioctl(net, SIOCGIFCONF, uifc);
2750 2751 2752 2753 2754 2755 2756 2757 2758
	if (err)
		return err;

	if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
		return -EFAULT;

	ifr = ifc.ifc_req;
	ifr32 = compat_ptr(ifc32.ifcbuf);
	for (i = 0, j = 0;
2759 2760 2761
	     i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
	     i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
		if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2762 2763 2764 2765 2766 2767 2768 2769 2770 2771
			return -EFAULT;
		ifr32++;
		ifr++;
	}

	if (ifc32.ifcbuf == 0) {
		/* Translate from 64-bit structure multiple to
		 * a 32-bit one.
		 */
		i = ifc.ifc_len;
2772
		i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2773 2774 2775 2776
		ifc32.ifc_len = i;
	} else {
		ifc32.ifc_len = i;
	}
2777
	if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2778 2779 2780 2781 2782
		return -EFAULT;

	return 0;
}

2783
static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2784
{
2785 2786 2787 2788
	struct compat_ethtool_rxnfc __user *compat_rxnfc;
	bool convert_in = false, convert_out = false;
	size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
	struct ethtool_rxnfc __user *rxnfc;
2789
	struct ifreq __user *ifr;
2790 2791
	u32 rule_cnt = 0, actual_rule_cnt;
	u32 ethcmd;
2792
	u32 data;
2793
	int ret;
2794

2795 2796
	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
		return -EFAULT;
2797

2798 2799 2800
	compat_rxnfc = compat_ptr(data);

	if (get_user(ethcmd, &compat_rxnfc->cmd))
2801 2802
		return -EFAULT;

2803 2804 2805 2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819
	/* Most ethtool structures are defined without padding.
	 * Unfortunately struct ethtool_rxnfc is an exception.
	 */
	switch (ethcmd) {
	default:
		break;
	case ETHTOOL_GRXCLSRLALL:
		/* Buffer size is variable */
		if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
			return -EFAULT;
		if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
			return -ENOMEM;
		buf_size += rule_cnt * sizeof(u32);
		/* fall through */
	case ETHTOOL_GRXRINGS:
	case ETHTOOL_GRXCLSRLCNT:
	case ETHTOOL_GRXCLSRULE:
2820
	case ETHTOOL_SRXCLSRLINS:
2821 2822 2823 2824 2825 2826 2827 2828 2829
		convert_out = true;
		/* fall through */
	case ETHTOOL_SRXCLSRLDEL:
		buf_size += sizeof(struct ethtool_rxnfc);
		convert_in = true;
		break;
	}

	ifr = compat_alloc_user_space(buf_size);
S
Stephen Hemminger 已提交
2830
	rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
2831 2832

	if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2833 2834
		return -EFAULT;

2835 2836
	if (put_user(convert_in ? rxnfc : compat_ptr(data),
		     &ifr->ifr_ifru.ifru_data))
2837 2838
		return -EFAULT;

2839
	if (convert_in) {
2840
		/* We expect there to be holes between fs.m_ext and
2841 2842
		 * fs.ring_cookie and at the end of fs, but nowhere else.
		 */
2843 2844 2845 2846
		BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
			     sizeof(compat_rxnfc->fs.m_ext) !=
			     offsetof(struct ethtool_rxnfc, fs.m_ext) +
			     sizeof(rxnfc->fs.m_ext));
2847 2848 2849 2850 2851 2852 2853
		BUILD_BUG_ON(
			offsetof(struct compat_ethtool_rxnfc, fs.location) -
			offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
			offsetof(struct ethtool_rxnfc, fs.location) -
			offsetof(struct ethtool_rxnfc, fs.ring_cookie));

		if (copy_in_user(rxnfc, compat_rxnfc,
S
Stephen Hemminger 已提交
2854 2855
				 (void __user *)(&rxnfc->fs.m_ext + 1) -
				 (void __user *)rxnfc) ||
2856 2857
		    copy_in_user(&rxnfc->fs.ring_cookie,
				 &compat_rxnfc->fs.ring_cookie,
S
Stephen Hemminger 已提交
2858 2859
				 (void __user *)(&rxnfc->fs.location + 1) -
				 (void __user *)&rxnfc->fs.ring_cookie) ||
2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870
		    copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
				 sizeof(rxnfc->rule_cnt)))
			return -EFAULT;
	}

	ret = dev_ioctl(net, SIOCETHTOOL, ifr);
	if (ret)
		return ret;

	if (convert_out) {
		if (copy_in_user(compat_rxnfc, rxnfc,
S
Stephen Hemminger 已提交
2871 2872
				 (const void __user *)(&rxnfc->fs.m_ext + 1) -
				 (const void __user *)rxnfc) ||
2873 2874
		    copy_in_user(&compat_rxnfc->fs.ring_cookie,
				 &rxnfc->fs.ring_cookie,
S
Stephen Hemminger 已提交
2875 2876
				 (const void __user *)(&rxnfc->fs.location + 1) -
				 (const void __user *)&rxnfc->fs.ring_cookie) ||
2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901
		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
				 sizeof(rxnfc->rule_cnt)))
			return -EFAULT;

		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
			/* As an optimisation, we only copy the actual
			 * number of rules that the underlying
			 * function returned.  Since Mallory might
			 * change the rule count in user memory, we
			 * check that it is less than the rule count
			 * originally given (as the user buffer size),
			 * which has been range-checked.
			 */
			if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
				return -EFAULT;
			if (actual_rule_cnt < rule_cnt)
				rule_cnt = actual_rule_cnt;
			if (copy_in_user(&compat_rxnfc->rule_locs[0],
					 &rxnfc->rule_locs[0],
					 rule_cnt * sizeof(u32)))
				return -EFAULT;
		}
	}

	return 0;
2902 2903
}

2904 2905 2906 2907 2908 2909
static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
{
	void __user *uptr;
	compat_uptr_t uptr32;
	struct ifreq __user *uifr;

2910
	uifr = compat_alloc_user_space(sizeof(*uifr));
2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924
	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
		return -EFAULT;

	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
		return -EFAULT;

	uptr = compat_ptr(uptr32);

	if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
		return -EFAULT;

	return dev_ioctl(net, SIOCWANDEV, uifr);
}

2925 2926
static int bond_ioctl(struct net *net, unsigned int cmd,
			 struct compat_ifreq __user *ifr32)
2927 2928 2929 2930 2931 2932 2933 2934 2935 2936
{
	struct ifreq kifr;
	mm_segment_t old_fs;
	int err;

	switch (cmd) {
	case SIOCBONDENSLAVE:
	case SIOCBONDRELEASE:
	case SIOCBONDSETHWADDR:
	case SIOCBONDCHANGEACTIVE:
2937
		if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2938 2939 2940
			return -EFAULT;

		old_fs = get_fs();
2941
		set_fs(KERNEL_DS);
2942 2943
		err = dev_ioctl(net, cmd,
				(struct ifreq __user __force *) &kifr);
2944
		set_fs(old_fs);
2945 2946 2947

		return err;
	default:
2948
		return -ENOIOCTLCMD;
2949
	}
2950 2951
}

2952 2953
/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
2954
				 struct compat_ifreq __user *u_ifreq32)
2955 2956 2957 2958 2959 2960 2961 2962 2963
{
	struct ifreq __user *u_ifreq64;
	char tmp_buf[IFNAMSIZ];
	void __user *data64;
	u32 data32;

	if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
			   IFNAMSIZ))
		return -EFAULT;
2964
	if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2965 2966 2967 2968 2969 2970 2971 2972
		return -EFAULT;
	data64 = compat_ptr(data32);

	u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));

	if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
			 IFNAMSIZ))
		return -EFAULT;
2973
	if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2974 2975
		return -EFAULT;

2976
	return dev_ioctl(net, cmd, u_ifreq64);
2977 2978
}

2979 2980
static int dev_ifsioc(struct net *net, struct socket *sock,
			 unsigned int cmd, struct compat_ifreq __user *uifr32)
2981
{
2982
	struct ifreq __user *uifr;
2983 2984
	int err;

2985 2986 2987 2988 2989 2990
	uifr = compat_alloc_user_space(sizeof(*uifr));
	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
		return -EFAULT;

	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);

2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002
	if (!err) {
		switch (cmd) {
		case SIOCGIFFLAGS:
		case SIOCGIFMETRIC:
		case SIOCGIFMTU:
		case SIOCGIFMEM:
		case SIOCGIFHWADDR:
		case SIOCGIFINDEX:
		case SIOCGIFADDR:
		case SIOCGIFBRDADDR:
		case SIOCGIFDSTADDR:
		case SIOCGIFNETMASK:
3003
		case SIOCGIFPFLAGS:
3004
		case SIOCGIFTXQLEN:
3005 3006
		case SIOCGMIIPHY:
		case SIOCGMIIREG:
3007
			if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
3008 3009 3010 3011 3012 3013 3014
				err = -EFAULT;
			break;
		}
	}
	return err;
}

3015 3016 3017 3018 3019 3020 3021 3022 3023 3024
static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
			struct compat_ifreq __user *uifr32)
{
	struct ifreq ifr;
	struct compat_ifmap __user *uifmap32;
	mm_segment_t old_fs;
	int err;

	uifmap32 = &uifr32->ifr_ifru.ifru_map;
	err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3025 3026 3027 3028 3029 3030
	err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
	err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
	err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
	err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
	err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
	err |= get_user(ifr.ifr_map.port, &uifmap32->port);
3031 3032 3033 3034
	if (err)
		return -EFAULT;

	old_fs = get_fs();
3035
	set_fs(KERNEL_DS);
3036
	err = dev_ioctl(net, cmd, (void  __user __force *)&ifr);
3037
	set_fs(old_fs);
3038 3039 3040

	if (cmd == SIOCGIFMAP && !err) {
		err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3041 3042 3043 3044 3045 3046
		err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
		err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
		err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
		err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
		err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
		err |= put_user(ifr.ifr_map.port, &uifmap32->port);
3047 3048 3049 3050 3051 3052
		if (err)
			err = -EFAULT;
	}
	return err;
}

3053
struct rtentry32 {
3054
	u32		rt_pad1;
3055 3056 3057
	struct sockaddr rt_dst;         /* target address               */
	struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
	struct sockaddr rt_genmask;     /* target network mask (IP)     */
3058 3059 3060 3061 3062 3063 3064
	unsigned short	rt_flags;
	short		rt_pad2;
	u32		rt_pad3;
	unsigned char	rt_tos;
	unsigned char	rt_class;
	short		rt_pad4;
	short		rt_metric;      /* +1 for binary compatibility! */
3065
	/* char * */ u32 rt_dev;        /* forcing the device at add    */
3066 3067
	u32		rt_mtu;         /* per route MTU/Window         */
	u32		rt_window;      /* Window clamping              */
3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083
	unsigned short  rt_irtt;        /* Initial RTT                  */
};

struct in6_rtmsg32 {
	struct in6_addr		rtmsg_dst;
	struct in6_addr		rtmsg_src;
	struct in6_addr		rtmsg_gateway;
	u32			rtmsg_type;
	u16			rtmsg_dst_len;
	u16			rtmsg_src_len;
	u32			rtmsg_metric;
	u32			rtmsg_info;
	u32			rtmsg_flags;
	s32			rtmsg_ifindex;
};

3084 3085
static int routing_ioctl(struct net *net, struct socket *sock,
			 unsigned int cmd, void __user *argp)
3086 3087 3088 3089 3090 3091 3092 3093 3094
{
	int ret;
	void *r = NULL;
	struct in6_rtmsg r6;
	struct rtentry r4;
	char devname[16];
	u32 rtdev;
	mm_segment_t old_fs = get_fs();

3095 3096
	if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
		struct in6_rtmsg32 __user *ur6 = argp;
3097
		ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3098
			3 * sizeof(struct in6_addr));
3099 3100 3101 3102 3103 3104 3105
		ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
		ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
		ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
		ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
		ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
		ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
		ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3106 3107 3108

		r = (void *) &r6;
	} else { /* ipv4 */
3109
		struct rtentry32 __user *ur4 = argp;
3110
		ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3111
					3 * sizeof(struct sockaddr));
3112 3113 3114 3115 3116 3117
		ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
		ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
		ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
		ret |= get_user(r4.rt_window, &(ur4->rt_window));
		ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
		ret |= get_user(rtdev, &(ur4->rt_dev));
3118
		if (rtdev) {
3119
			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3120 3121
			r4.rt_dev = (char __user __force *)devname;
			devname[15] = 0;
3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132
		} else
			r4.rt_dev = NULL;

		r = (void *) &r4;
	}

	if (ret) {
		ret = -EFAULT;
		goto out;
	}

3133
	set_fs(KERNEL_DS);
3134
	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3135
	set_fs(old_fs);
3136 3137 3138 3139 3140 3141 3142

out:
	return ret;
}

/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
 * for some operations; this forces use of the newer bridge-utils that
L
Lucas De Marchi 已提交
3143
 * use compatible ioctls
3144
 */
3145
static int old_bridge_ioctl(compat_ulong_t __user *argp)
3146
{
3147
	compat_ulong_t tmp;
3148

3149
	if (get_user(tmp, argp))
3150 3151 3152 3153 3154 3155
		return -EFAULT;
	if (tmp == BRCTL_GET_VERSION)
		return BRCTL_VERSION + 1;
	return -EINVAL;
}

3156 3157 3158 3159 3160 3161
static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
			 unsigned int cmd, unsigned long arg)
{
	void __user *argp = compat_ptr(arg);
	struct sock *sk = sock->sk;
	struct net *net = sock_net(sk);
3162

3163
	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3164
		return compat_ifr_data_ioctl(net, cmd, argp);
3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175

	switch (cmd) {
	case SIOCSIFBR:
	case SIOCGIFBR:
		return old_bridge_ioctl(argp);
	case SIOCGIFNAME:
		return dev_ifname32(net, argp);
	case SIOCGIFCONF:
		return dev_ifconf(net, argp);
	case SIOCETHTOOL:
		return ethtool_ioctl(net, argp);
3176 3177
	case SIOCWANDEV:
		return compat_siocwandev(net, argp);
3178 3179 3180
	case SIOCGIFMAP:
	case SIOCSIFMAP:
		return compat_sioc_ifmap(net, cmd, argp);
3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192
	case SIOCBONDENSLAVE:
	case SIOCBONDRELEASE:
	case SIOCBONDSETHWADDR:
	case SIOCBONDCHANGEACTIVE:
		return bond_ioctl(net, cmd, argp);
	case SIOCADDRT:
	case SIOCDELRT:
		return routing_ioctl(net, sock, cmd, argp);
	case SIOCGSTAMP:
		return do_siocgstamp(net, sock, cmd, argp);
	case SIOCGSTAMPNS:
		return do_siocgstampns(net, sock, cmd, argp);
3193 3194
	case SIOCBONDSLAVEINFOQUERY:
	case SIOCBONDINFOQUERY:
3195
	case SIOCSHWTSTAMP:
3196
	case SIOCGHWTSTAMP:
3197
		return compat_ifr_data_ioctl(net, cmd, argp);
3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208

	case FIOSETOWN:
	case SIOCSPGRP:
	case FIOGETOWN:
	case SIOCGPGRP:
	case SIOCBRADDBR:
	case SIOCBRDELBR:
	case SIOCGIFVLAN:
	case SIOCSIFVLAN:
	case SIOCADDDLCI:
	case SIOCDELDLCI:
3209
	case SIOCGSKNS:
3210 3211 3212 3213 3214 3215 3216 3217 3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240
		return sock_ioctl(file, cmd, arg);

	case SIOCGIFFLAGS:
	case SIOCSIFFLAGS:
	case SIOCGIFMETRIC:
	case SIOCSIFMETRIC:
	case SIOCGIFMTU:
	case SIOCSIFMTU:
	case SIOCGIFMEM:
	case SIOCSIFMEM:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
	case SIOCADDMULTI:
	case SIOCDELMULTI:
	case SIOCGIFINDEX:
	case SIOCGIFADDR:
	case SIOCSIFADDR:
	case SIOCSIFHWBROADCAST:
	case SIOCDIFADDR:
	case SIOCGIFBRDADDR:
	case SIOCSIFBRDADDR:
	case SIOCGIFDSTADDR:
	case SIOCSIFDSTADDR:
	case SIOCGIFNETMASK:
	case SIOCSIFNETMASK:
	case SIOCSIFPFLAGS:
	case SIOCGIFPFLAGS:
	case SIOCGIFTXQLEN:
	case SIOCSIFTXQLEN:
	case SIOCBRADDIF:
	case SIOCBRDELIF:
3241 3242 3243 3244
	case SIOCSIFNAME:
	case SIOCGMIIPHY:
	case SIOCGMIIREG:
	case SIOCSMIIREG:
3245
		return dev_ifsioc(net, sock, cmd, argp);
3246

3247 3248 3249 3250
	case SIOCSARP:
	case SIOCGARP:
	case SIOCDARP:
	case SIOCATMARK:
3251 3252 3253
		return sock_do_ioctl(net, sock, cmd, arg);
	}

3254 3255
	return -ENOIOCTLCMD;
}
3256

3257
static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3258
			      unsigned long arg)
3259 3260 3261
{
	struct socket *sock = file->private_data;
	int ret = -ENOIOCTLCMD;
3262 3263 3264 3265 3266
	struct sock *sk;
	struct net *net;

	sk = sock->sk;
	net = sock_net(sk);
3267 3268 3269 3270

	if (sock->ops->compat_ioctl)
		ret = sock->ops->compat_ioctl(sock, cmd, arg);

3271 3272 3273 3274
	if (ret == -ENOIOCTLCMD &&
	    (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
		ret = compat_wext_handle_ioctl(net, cmd, arg);

3275 3276 3277
	if (ret == -ENOIOCTLCMD)
		ret = compat_sock_ioctl_trans(file, sock, cmd, arg);

3278 3279 3280 3281
	return ret;
}
#endif

3282 3283 3284 3285
int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
{
	return sock->ops->bind(sock, addr, addrlen);
}
3286
EXPORT_SYMBOL(kernel_bind);
3287 3288 3289 3290 3291

int kernel_listen(struct socket *sock, int backlog)
{
	return sock->ops->listen(sock, backlog);
}
3292
EXPORT_SYMBOL(kernel_listen);
3293 3294 3295 3296 3297 3298 3299 3300 3301 3302 3303

int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
{
	struct sock *sk = sock->sk;
	int err;

	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
			       newsock);
	if (err < 0)
		goto done;

3304
	err = sock->ops->accept(sock, *newsock, flags, true);
3305 3306
	if (err < 0) {
		sock_release(*newsock);
3307
		*newsock = NULL;
3308 3309 3310 3311
		goto done;
	}

	(*newsock)->ops = sock->ops;
3312
	__module_get((*newsock)->ops->owner);
3313 3314 3315 3316

done:
	return err;
}
3317
EXPORT_SYMBOL(kernel_accept);
3318 3319

int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3320
		   int flags)
3321 3322 3323
{
	return sock->ops->connect(sock, addr, addrlen, flags);
}
3324
EXPORT_SYMBOL(kernel_connect);
3325 3326 3327 3328 3329 3330

int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
			 int *addrlen)
{
	return sock->ops->getname(sock, addr, addrlen, 0);
}
3331
EXPORT_SYMBOL(kernel_getsockname);
3332 3333 3334 3335 3336 3337

int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
			 int *addrlen)
{
	return sock->ops->getname(sock, addr, addrlen, 1);
}
3338
EXPORT_SYMBOL(kernel_getpeername);
3339 3340 3341 3342 3343

int kernel_getsockopt(struct socket *sock, int level, int optname,
			char *optval, int *optlen)
{
	mm_segment_t oldfs = get_fs();
3344 3345
	char __user *uoptval;
	int __user *uoptlen;
3346 3347
	int err;

3348 3349 3350
	uoptval = (char __user __force *) optval;
	uoptlen = (int __user __force *) optlen;

3351 3352
	set_fs(KERNEL_DS);
	if (level == SOL_SOCKET)
3353
		err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3354
	else
3355 3356
		err = sock->ops->getsockopt(sock, level, optname, uoptval,
					    uoptlen);
3357 3358 3359
	set_fs(oldfs);
	return err;
}
3360
EXPORT_SYMBOL(kernel_getsockopt);
3361 3362

int kernel_setsockopt(struct socket *sock, int level, int optname,
3363
			char *optval, unsigned int optlen)
3364 3365
{
	mm_segment_t oldfs = get_fs();
3366
	char __user *uoptval;
3367 3368
	int err;

3369 3370
	uoptval = (char __user __force *) optval;

3371 3372
	set_fs(KERNEL_DS);
	if (level == SOL_SOCKET)
3373
		err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3374
	else
3375
		err = sock->ops->setsockopt(sock, level, optname, uoptval,
3376 3377 3378 3379
					    optlen);
	set_fs(oldfs);
	return err;
}
3380
EXPORT_SYMBOL(kernel_setsockopt);
3381 3382 3383 3384 3385 3386 3387 3388 3389

int kernel_sendpage(struct socket *sock, struct page *page, int offset,
		    size_t size, int flags)
{
	if (sock->ops->sendpage)
		return sock->ops->sendpage(sock, page, offset, size, flags);

	return sock_no_sendpage(sock, page, offset, size, flags);
}
3390
EXPORT_SYMBOL(kernel_sendpage);
3391

3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404
int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset,
			   size_t size, int flags)
{
	struct socket *sock = sk->sk_socket;

	if (sock->ops->sendpage_locked)
		return sock->ops->sendpage_locked(sk, page, offset, size,
						  flags);

	return sock_no_sendpage_locked(sk, page, offset, size, flags);
}
EXPORT_SYMBOL(kernel_sendpage_locked);

3405 3406 3407 3408 3409 3410 3411 3412 3413 3414 3415
int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
{
	mm_segment_t oldfs = get_fs();
	int err;

	set_fs(KERNEL_DS);
	err = sock->ops->ioctl(sock, cmd, arg);
	set_fs(oldfs);

	return err;
}
3416
EXPORT_SYMBOL(kernel_sock_ioctl);
3417

3418 3419 3420 3421 3422
int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
{
	return sock->ops->shutdown(sock, how);
}
EXPORT_SYMBOL(kernel_sock_shutdown);
3423 3424 3425 3426

/* This routine returns the IP overhead imposed by a socket i.e.
 * the length of the underlying IP header, depending on whether
 * this is an IPv4 or IPv6 socket and the length from IP options turned
3427
 * on at the socket. Assumes that the caller has a lock on the socket.
3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446
 */
u32 kernel_sock_ip_overhead(struct sock *sk)
{
	struct inet_sock *inet;
	struct ip_options_rcu *opt;
	u32 overhead = 0;
#if IS_ENABLED(CONFIG_IPV6)
	struct ipv6_pinfo *np;
	struct ipv6_txoptions *optv6 = NULL;
#endif /* IS_ENABLED(CONFIG_IPV6) */

	if (!sk)
		return overhead;

	switch (sk->sk_family) {
	case AF_INET:
		inet = inet_sk(sk);
		overhead += sizeof(struct iphdr);
		opt = rcu_dereference_protected(inet->inet_opt,
3447
						sock_owned_by_user(sk));
3448 3449 3450 3451 3452 3453 3454 3455 3456
		if (opt)
			overhead += opt->opt.optlen;
		return overhead;
#if IS_ENABLED(CONFIG_IPV6)
	case AF_INET6:
		np = inet6_sk(sk);
		overhead += sizeof(struct ipv6hdr);
		if (np)
			optv6 = rcu_dereference_protected(np->opt,
3457
							  sock_owned_by_user(sk));
3458 3459 3460 3461 3462 3463 3464 3465 3466
		if (optv6)
			overhead += (optv6->opt_flen + optv6->opt_nflen);
		return overhead;
#endif /* IS_ENABLED(CONFIG_IPV6) */
	default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
		return overhead;
	}
}
EXPORT_SYMBOL(kernel_sock_ip_overhead);