socket.c 84.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6
/*
 * NET		An implementation of the SOCKET network access protocol.
 *
 * Version:	@(#)socket.c	1.1.93	18/02/95
 *
 * Authors:	Orest Zborowski, <obz@Kodak.COM>
7
 *		Ross Biro
L
Linus Torvalds 已提交
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
 *
 * Fixes:
 *		Anonymous	:	NOTSOCK/BADF cleanup. Error fix in
 *					shutdown()
 *		Alan Cox	:	verify_area() fixes
 *		Alan Cox	:	Removed DDI
 *		Jonathan Kamens	:	SOCK_DGRAM reconnect bug
 *		Alan Cox	:	Moved a load of checks to the very
 *					top level.
 *		Alan Cox	:	Move address structures to/from user
 *					mode above the protocol layers.
 *		Rob Janssen	:	Allow 0 length sends.
 *		Alan Cox	:	Asynchronous I/O support (cribbed from the
 *					tty drivers).
 *		Niibe Yutaka	:	Asynchronous I/O for writes (4.4BSD style)
 *		Jeff Uphoff	:	Made max number of sockets command-line
 *					configurable.
 *		Matti Aarnio	:	Made the number of sockets dynamic,
 *					to be allocated when needed, and mr.
 *					Uphoff's max is used as max to be
 *					allowed to allocate.
 *		Linus		:	Argh. removed all the socket allocation
 *					altogether: it's in the inode now.
 *		Alan Cox	:	Made sock_alloc()/sock_release() public
 *					for NetROM and future kernel nfsd type
 *					stuff.
 *		Alan Cox	:	sendmsg/recvmsg basics.
 *		Tom Dyas	:	Export net symbols.
 *		Marcin Dalecki	:	Fixed problems with CONFIG_NET="n".
 *		Alan Cox	:	Added thread locking to sys_* calls
 *					for sockets. May have errors at the
 *					moment.
 *		Kevin Buhr	:	Fixed the dumb errors in the above.
 *		Andi Kleen	:	Some small cleanups, optimizations,
 *					and fixed a copy_from_user() bug.
 *		Tigran Aivazian	:	sys_send(args) calls sys_sendto(args, NULL, 0)
45
 *		Tigran Aivazian	:	Made listen(2) backlog sanity checks
L
Linus Torvalds 已提交
46 47 48 49 50 51 52 53 54 55
 *					protocol-independent
 *
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
 *
 *
 *	This module is effectively the top level interface to the BSD socket
56
 *	paradigm.
L
Linus Torvalds 已提交
57 58 59 60 61 62 63 64 65
 *
 *	Based upon Swansea University Computer Society NET3.039
 */

#include <linux/mm.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/net.h>
#include <linux/interrupt.h>
U
Ulrich Drepper 已提交
66
#include <linux/thread_info.h>
67
#include <linux/rcupdate.h>
L
Linus Torvalds 已提交
68 69 70
#include <linux/netdevice.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
A
Arjan van de Ven 已提交
71
#include <linux/mutex.h>
L
Linus Torvalds 已提交
72
#include <linux/if_bridge.h>
73 74
#include <linux/if_frad.h>
#include <linux/if_vlan.h>
L
Linus Torvalds 已提交
75 76 77 78 79 80 81 82 83 84
#include <linux/init.h>
#include <linux/poll.h>
#include <linux/cache.h>
#include <linux/module.h>
#include <linux/highmem.h>
#include <linux/mount.h>
#include <linux/security.h>
#include <linux/syscalls.h>
#include <linux/compat.h>
#include <linux/kmod.h>
85
#include <linux/audit.h>
86
#include <linux/wireless.h>
87
#include <linux/nsproxy.h>
N
Nick Black 已提交
88
#include <linux/magic.h>
89
#include <linux/slab.h>
90
#include <linux/xattr.h>
L
Linus Torvalds 已提交
91 92 93 94 95

#include <asm/uaccess.h>
#include <asm/unistd.h>

#include <net/compat.h>
96
#include <net/wext.h>
97
#include <net/cls_cgroup.h>
L
Linus Torvalds 已提交
98 99 100 101

#include <net/sock.h>
#include <linux/netfilter.h>

102 103 104 105 106
#include <linux/if_tun.h>
#include <linux/ipv6_route.h>
#include <linux/route.h>
#include <linux/sockios.h>
#include <linux/atalk.h>
107
#include <net/busy_poll.h>
E
Eliezer Tamir 已提交
108

109
#ifdef CONFIG_NET_RX_BUSY_POLL
110 111
unsigned int sysctl_net_busy_read __read_mostly;
unsigned int sysctl_net_busy_poll __read_mostly;
E
Eliezer Tamir 已提交
112
#endif
113

L
Linus Torvalds 已提交
114
static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
115 116 117 118
static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
			 unsigned long nr_segs, loff_t pos);
static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
			  unsigned long nr_segs, loff_t pos);
119
static int sock_mmap(struct file *file, struct vm_area_struct *vma);
L
Linus Torvalds 已提交
120 121 122 123

static int sock_close(struct inode *inode, struct file *file);
static unsigned int sock_poll(struct file *file,
			      struct poll_table_struct *wait);
124
static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
125 126
#ifdef CONFIG_COMPAT
static long compat_sock_ioctl(struct file *file,
127
			      unsigned int cmd, unsigned long arg);
128
#endif
L
Linus Torvalds 已提交
129 130 131
static int sock_fasync(int fd, struct file *filp, int on);
static ssize_t sock_sendpage(struct file *file, struct page *page,
			     int offset, size_t size, loff_t *ppos, int more);
J
Jens Axboe 已提交
132
static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
133
				struct pipe_inode_info *pipe, size_t len,
J
Jens Axboe 已提交
134
				unsigned int flags);
L
Linus Torvalds 已提交
135 136 137 138 139 140

/*
 *	Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
 *	in the operation structures but are done directly via the socketcall() multiplexor.
 */

141
static const struct file_operations socket_file_ops = {
L
Linus Torvalds 已提交
142 143 144 145 146 147
	.owner =	THIS_MODULE,
	.llseek =	no_llseek,
	.aio_read =	sock_aio_read,
	.aio_write =	sock_aio_write,
	.poll =		sock_poll,
	.unlocked_ioctl = sock_ioctl,
148 149 150
#ifdef CONFIG_COMPAT
	.compat_ioctl = compat_sock_ioctl,
#endif
L
Linus Torvalds 已提交
151 152 153 154
	.mmap =		sock_mmap,
	.open =		sock_no_open,	/* special open code to disallow open via /proc */
	.release =	sock_close,
	.fasync =	sock_fasync,
155 156
	.sendpage =	sock_sendpage,
	.splice_write = generic_splice_sendpage,
J
Jens Axboe 已提交
157
	.splice_read =	sock_splice_read,
L
Linus Torvalds 已提交
158 159 160 161 162 163 164
};

/*
 *	The protocol list. Each protocol is registered in here.
 */

static DEFINE_SPINLOCK(net_family_lock);
E
Eric Dumazet 已提交
165
static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
L
Linus Torvalds 已提交
166 167 168 169 170

/*
 *	Statistics counters of the socket lists
 */

171
static DEFINE_PER_CPU(int, sockets_in_use);
L
Linus Torvalds 已提交
172 173

/*
174 175 176
 * Support routines.
 * Move socket addresses back and forth across the kernel/user
 * divide and look after the messy bits.
L
Linus Torvalds 已提交
177 178 179 180 181 182 183 184 185 186 187 188 189
 */

/**
 *	move_addr_to_kernel	-	copy a socket address into kernel space
 *	@uaddr: Address in user space
 *	@kaddr: Address in kernel space
 *	@ulen: Length in user space
 *
 *	The address is copied into kernel space. If the provided address is
 *	too long an error code of -EINVAL is returned. If the copy gives
 *	invalid addresses -EFAULT is returned. On a success 0 is returned.
 */

190
int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
L
Linus Torvalds 已提交
191
{
192
	if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
L
Linus Torvalds 已提交
193
		return -EINVAL;
194
	if (ulen == 0)
L
Linus Torvalds 已提交
195
		return 0;
196
	if (copy_from_user(kaddr, uaddr, ulen))
L
Linus Torvalds 已提交
197
		return -EFAULT;
198
	return audit_sockaddr(ulen, kaddr);
L
Linus Torvalds 已提交
199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216
}

/**
 *	move_addr_to_user	-	copy an address to user space
 *	@kaddr: kernel space address
 *	@klen: length of address in kernel
 *	@uaddr: user space address
 *	@ulen: pointer to user length field
 *
 *	The value pointed to by ulen on entry is the buffer length available.
 *	This is overwritten with the buffer space used. -EINVAL is returned
 *	if an overlong buffer is specified or a negative buffer size. -EFAULT
 *	is returned if either the buffer or the length field are not
 *	accessible.
 *	After copying the data up to the limit the user specifies, the true
 *	length of the data is written over the length limit the user
 *	specified. Zero is returned for a success.
 */
217

218
static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
S
stephen hemminger 已提交
219
			     void __user *uaddr, int __user *ulen)
L
Linus Torvalds 已提交
220 221 222 223
{
	int err;
	int len;

224 225
	err = get_user(len, ulen);
	if (err)
L
Linus Torvalds 已提交
226
		return err;
227 228
	if (len > klen)
		len = klen;
229
	if (len < 0 || len > sizeof(struct sockaddr_storage))
L
Linus Torvalds 已提交
230
		return -EINVAL;
231
	if (len) {
S
Steve Grubb 已提交
232 233
		if (audit_sockaddr(klen, kaddr))
			return -ENOMEM;
234
		if (copy_to_user(uaddr, kaddr, len))
L
Linus Torvalds 已提交
235 236 237
			return -EFAULT;
	}
	/*
238 239
	 *      "fromlen shall refer to the value before truncation.."
	 *                      1003.1g
L
Linus Torvalds 已提交
240 241 242 243
	 */
	return __put_user(klen, ulen);
}

244
static struct kmem_cache *sock_inode_cachep __read_mostly;
L
Linus Torvalds 已提交
245 246 247 248

static struct inode *sock_alloc_inode(struct super_block *sb)
{
	struct socket_alloc *ei;
249
	struct socket_wq *wq;
250

251
	ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
L
Linus Torvalds 已提交
252 253
	if (!ei)
		return NULL;
254 255
	wq = kmalloc(sizeof(*wq), GFP_KERNEL);
	if (!wq) {
256 257 258
		kmem_cache_free(sock_inode_cachep, ei);
		return NULL;
	}
259 260 261
	init_waitqueue_head(&wq->wait);
	wq->fasync_list = NULL;
	RCU_INIT_POINTER(ei->socket.wq, wq);
262

L
Linus Torvalds 已提交
263 264 265 266 267 268 269 270 271 272 273
	ei->socket.state = SS_UNCONNECTED;
	ei->socket.flags = 0;
	ei->socket.ops = NULL;
	ei->socket.sk = NULL;
	ei->socket.file = NULL;

	return &ei->vfs_inode;
}

static void sock_destroy_inode(struct inode *inode)
{
274
	struct socket_alloc *ei;
275
	struct socket_wq *wq;
276 277

	ei = container_of(inode, struct socket_alloc, vfs_inode);
278
	wq = rcu_dereference_protected(ei->socket.wq, 1);
279
	kfree_rcu(wq, rcu);
280
	kmem_cache_free(sock_inode_cachep, ei);
L
Linus Torvalds 已提交
281 282
}

283
static void init_once(void *foo)
L
Linus Torvalds 已提交
284
{
285
	struct socket_alloc *ei = (struct socket_alloc *)foo;
L
Linus Torvalds 已提交
286

C
Christoph Lameter 已提交
287
	inode_init_once(&ei->vfs_inode);
L
Linus Torvalds 已提交
288
}
289

L
Linus Torvalds 已提交
290 291 292
static int init_inodecache(void)
{
	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
293 294 295 296 297
					      sizeof(struct socket_alloc),
					      0,
					      (SLAB_HWCACHE_ALIGN |
					       SLAB_RECLAIM_ACCOUNT |
					       SLAB_MEM_SPREAD),
298
					      init_once);
L
Linus Torvalds 已提交
299 300 301 302 303
	if (sock_inode_cachep == NULL)
		return -ENOMEM;
	return 0;
}

304
static const struct super_operations sockfs_ops = {
305 306 307
	.alloc_inode	= sock_alloc_inode,
	.destroy_inode	= sock_destroy_inode,
	.statfs		= simple_statfs,
L
Linus Torvalds 已提交
308 309
};

310 311 312 313 314 315 316 317 318
/*
 * sockfs_dname() is called from d_path().
 */
static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
{
	return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
				dentry->d_inode->i_ino);
}

A
Al Viro 已提交
319
static const struct dentry_operations sockfs_dentry_operations = {
320
	.d_dname  = sockfs_dname,
L
Linus Torvalds 已提交
321 322
};

323 324 325 326 327 328 329 330 331 332 333 334 335 336 337
static struct dentry *sockfs_mount(struct file_system_type *fs_type,
			 int flags, const char *dev_name, void *data)
{
	return mount_pseudo(fs_type, "socket:", &sockfs_ops,
		&sockfs_dentry_operations, SOCKFS_MAGIC);
}

static struct vfsmount *sock_mnt __read_mostly;

static struct file_system_type sock_fs_type = {
	.name =		"sockfs",
	.mount =	sockfs_mount,
	.kill_sb =	kill_anon_super,
};

L
Linus Torvalds 已提交
338 339 340
/*
 *	Obtains the first available file descriptor and sets it up for use.
 *
341 342
 *	These functions create file structures and maps them to fd space
 *	of the current process. On success it returns file descriptor
L
Linus Torvalds 已提交
343 344 345 346 347 348 349 350 351 352 353 354
 *	and file struct implicitly stored in sock->file.
 *	Note that another thread may close file descriptor before we return
 *	from this function. We use the fact that now we do not refer
 *	to socket after mapping. If one day we will need it, this
 *	function will increment ref. count on file by 1.
 *
 *	In any case returned fd MAY BE not valid!
 *	This race condition is unavoidable
 *	with shared fd spaces, we cannot solve it inside kernel,
 *	but we take care of internal coherence yet.
 */

355
struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
L
Linus Torvalds 已提交
356
{
357
	struct qstr name = { .name = "" };
358
	struct path path;
359
	struct file *file;
L
Linus Torvalds 已提交
360

361 362 363 364 365 366 367
	if (dname) {
		name.name = dname;
		name.len = strlen(name.name);
	} else if (sock->sk) {
		name.name = sock->sk->sk_prot_creator->name;
		name.len = strlen(name.name);
	}
368
	path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
369 370
	if (unlikely(!path.dentry))
		return ERR_PTR(-ENOMEM);
371
	path.mnt = mntget(sock_mnt);
372

373
	d_instantiate(path.dentry, SOCK_INODE(sock));
A
Al Viro 已提交
374
	SOCK_INODE(sock)->i_fop = &socket_file_ops;
375

376
	file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
377
		  &socket_file_ops);
378
	if (unlikely(IS_ERR(file))) {
A
Al Viro 已提交
379
		/* drop dentry, keep inode */
A
Al Viro 已提交
380
		ihold(path.dentry->d_inode);
381
		path_put(&path);
382
		return file;
A
Al Viro 已提交
383 384 385
	}

	sock->file = file;
386
	file->f_flags = O_RDWR | (flags & O_NONBLOCK);
387
	file->private_data = sock;
388
	return file;
389
}
390
EXPORT_SYMBOL(sock_alloc_file);
391

392
static int sock_map_fd(struct socket *sock, int flags)
393 394
{
	struct file *newfile;
395 396 397
	int fd = get_unused_fd_flags(flags);
	if (unlikely(fd < 0))
		return fd;
398

399
	newfile = sock_alloc_file(sock, flags, NULL);
400
	if (likely(!IS_ERR(newfile))) {
401
		fd_install(fd, newfile);
402 403
		return fd;
	}
404

405 406
	put_unused_fd(fd);
	return PTR_ERR(newfile);
L
Linus Torvalds 已提交
407 408
}

409
struct socket *sock_from_file(struct file *file, int *err)
410 411 412 413
{
	if (file->f_op == &socket_file_ops)
		return file->private_data;	/* set in sock_map_fd */

E
Eric Dumazet 已提交
414 415
	*err = -ENOTSOCK;
	return NULL;
416
}
417
EXPORT_SYMBOL(sock_from_file);
418

L
Linus Torvalds 已提交
419
/**
420
 *	sockfd_lookup - Go from a file number to its socket slot
L
Linus Torvalds 已提交
421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436
 *	@fd: file handle
 *	@err: pointer to an error code return
 *
 *	The file handle passed in is locked and the socket it is bound
 *	too is returned. If an error occurs the err pointer is overwritten
 *	with a negative errno code and NULL is returned. The function checks
 *	for both invalid handles and passing a handle which is not a socket.
 *
 *	On a success the socket object pointer is returned.
 */

struct socket *sockfd_lookup(int fd, int *err)
{
	struct file *file;
	struct socket *sock;

437 438
	file = fget(fd);
	if (!file) {
L
Linus Torvalds 已提交
439 440 441
		*err = -EBADF;
		return NULL;
	}
442

443 444
	sock = sock_from_file(file, err);
	if (!sock)
L
Linus Torvalds 已提交
445
		fput(file);
446 447
	return sock;
}
448
EXPORT_SYMBOL(sockfd_lookup);
L
Linus Torvalds 已提交
449

450 451 452 453 454
static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
{
	struct file *file;
	struct socket *sock;

455
	*err = -EBADF;
456 457 458 459 460 461
	file = fget_light(fd, fput_needed);
	if (file) {
		sock = sock_from_file(file, err);
		if (sock)
			return sock;
		fput_light(file, *fput_needed);
L
Linus Torvalds 已提交
462
	}
463
	return NULL;
L
Linus Torvalds 已提交
464 465
}

466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527
#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
static ssize_t sockfs_getxattr(struct dentry *dentry,
			       const char *name, void *value, size_t size)
{
	const char *proto_name;
	size_t proto_size;
	int error;

	error = -ENODATA;
	if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
		proto_name = dentry->d_name.name;
		proto_size = strlen(proto_name);

		if (value) {
			error = -ERANGE;
			if (proto_size + 1 > size)
				goto out;

			strncpy(value, proto_name, proto_size + 1);
		}
		error = proto_size + 1;
	}

out:
	return error;
}

static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
				size_t size)
{
	ssize_t len;
	ssize_t used = 0;

	len = security_inode_listsecurity(dentry->d_inode, buffer, size);
	if (len < 0)
		return len;
	used += len;
	if (buffer) {
		if (size < used)
			return -ERANGE;
		buffer += len;
	}

	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
	used += len;
	if (buffer) {
		if (size < used)
			return -ERANGE;
		memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
		buffer += len;
	}

	return used;
}

static const struct inode_operations sockfs_inode_ops = {
	.getxattr = sockfs_getxattr,
	.listxattr = sockfs_listxattr,
};

L
Linus Torvalds 已提交
528 529
/**
 *	sock_alloc	-	allocate a socket
530
 *
L
Linus Torvalds 已提交
531 532 533 534 535 536 537
 *	Allocate a new inode and socket object. The two are bound together
 *	and initialised. The socket is then returned. If we are out of inodes
 *	NULL is returned.
 */

static struct socket *sock_alloc(void)
{
538 539
	struct inode *inode;
	struct socket *sock;
L
Linus Torvalds 已提交
540

541
	inode = new_inode_pseudo(sock_mnt->mnt_sb);
L
Linus Torvalds 已提交
542 543 544 545 546
	if (!inode)
		return NULL;

	sock = SOCKET_I(inode);

547
	kmemcheck_annotate_bitfield(sock, type);
548
	inode->i_ino = get_next_ino();
549
	inode->i_mode = S_IFSOCK | S_IRWXUGO;
550 551
	inode->i_uid = current_fsuid();
	inode->i_gid = current_fsgid();
552
	inode->i_op = &sockfs_inode_ops;
L
Linus Torvalds 已提交
553

554
	this_cpu_add(sockets_in_use, 1);
L
Linus Torvalds 已提交
555 556 557 558 559 560 561 562
	return sock;
}

/*
 *	In theory you can't get an open on this inode, but /proc provides
 *	a back door. Remember to keep it shut otherwise you'll let the
 *	creepy crawlies in.
 */
563

L
Linus Torvalds 已提交
564 565 566 567 568
static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
{
	return -ENXIO;
}

569
const struct file_operations bad_sock_fops = {
L
Linus Torvalds 已提交
570 571
	.owner = THIS_MODULE,
	.open = sock_no_open,
572
	.llseek = noop_llseek,
L
Linus Torvalds 已提交
573 574 575 576 577 578 579 580
};

/**
 *	sock_release	-	close a socket
 *	@sock: socket to close
 *
 *	The socket is released from the protocol stack if it has a release
 *	callback, and the inode is then released if the socket is bound to
581
 *	an inode not a file.
L
Linus Torvalds 已提交
582
 */
583

L
Linus Torvalds 已提交
584 585 586 587 588 589 590 591 592 593
void sock_release(struct socket *sock)
{
	if (sock->ops) {
		struct module *owner = sock->ops->owner;

		sock->ops->release(sock);
		sock->ops = NULL;
		module_put(owner);
	}

594
	if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
L
Linus Torvalds 已提交
595 596
		printk(KERN_ERR "sock_release: fasync list not empty!\n");

597 598 599
	if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
		return;

600
	this_cpu_sub(sockets_in_use, 1);
L
Linus Torvalds 已提交
601 602 603 604
	if (!sock->file) {
		iput(SOCK_INODE(sock));
		return;
	}
605
	sock->file = NULL;
L
Linus Torvalds 已提交
606
}
607
EXPORT_SYMBOL(sock_release);
L
Linus Torvalds 已提交
608

609
void sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
610
{
611
	*tx_flags = 0;
612
	if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
613
		*tx_flags |= SKBTX_HW_TSTAMP;
614
	if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
615
		*tx_flags |= SKBTX_SW_TSTAMP;
616 617
	if (sock_flag(sk, SOCK_WIFI_STATUS))
		*tx_flags |= SKBTX_WIFI_STATUS;
618 619 620
}
EXPORT_SYMBOL(sock_tx_timestamp);

621 622
static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
				       struct msghdr *msg, size_t size)
L
Linus Torvalds 已提交
623 624 625 626 627 628 629 630 631 632 633
{
	struct sock_iocb *si = kiocb_to_siocb(iocb);

	si->sock = sock;
	si->scm = NULL;
	si->msg = msg;
	si->size = size;

	return sock->ops->sendmsg(iocb, sock, msg, size);
}

634 635 636 637 638 639 640 641
static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
				 struct msghdr *msg, size_t size)
{
	int err = security_socket_sendmsg(sock, msg, size);

	return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
}

L
Linus Torvalds 已提交
642 643 644 645 646 647 648 649 650 651 652 653 654
int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
{
	struct kiocb iocb;
	struct sock_iocb siocb;
	int ret;

	init_sync_kiocb(&iocb, NULL);
	iocb.private = &siocb;
	ret = __sock_sendmsg(&iocb, sock, msg, size);
	if (-EIOCBQUEUED == ret)
		ret = wait_on_sync_kiocb(&iocb);
	return ret;
}
655
EXPORT_SYMBOL(sock_sendmsg);
L
Linus Torvalds 已提交
656

657
static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
658 659 660 661 662 663 664 665 666 667 668 669 670
{
	struct kiocb iocb;
	struct sock_iocb siocb;
	int ret;

	init_sync_kiocb(&iocb, NULL);
	iocb.private = &siocb;
	ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
	if (-EIOCBQUEUED == ret)
		ret = wait_on_sync_kiocb(&iocb);
	return ret;
}

L
Linus Torvalds 已提交
671 672 673 674 675 676 677 678 679 680 681
int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
		   struct kvec *vec, size_t num, size_t size)
{
	mm_segment_t oldfs = get_fs();
	int result;

	set_fs(KERNEL_DS);
	/*
	 * the following is safe, since for compiler definitions of kvec and
	 * iovec are identical, yielding the same in-core layout and alignment
	 */
682
	msg->msg_iov = (struct iovec *)vec;
L
Linus Torvalds 已提交
683 684 685 686 687
	msg->msg_iovlen = num;
	result = sock_sendmsg(sock, msg, size);
	set_fs(oldfs);
	return result;
}
688
EXPORT_SYMBOL(kernel_sendmsg);
L
Linus Torvalds 已提交
689

690 691 692 693 694 695
/*
 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
 */
void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
	struct sk_buff *skb)
{
696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713
	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
	struct timespec ts[3];
	int empty = 1;
	struct skb_shared_hwtstamps *shhwtstamps =
		skb_hwtstamps(skb);

	/* Race occurred between timestamp enabling and packet
	   receiving.  Fill in the current time for now. */
	if (need_software_tstamp && skb->tstamp.tv64 == 0)
		__net_timestamp(skb);

	if (need_software_tstamp) {
		if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
			struct timeval tv;
			skb_get_timestamp(skb, &tv);
			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
				 sizeof(tv), &tv);
		} else {
714
			skb_get_timestampns(skb, &ts[0]);
715
			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
716
				 sizeof(ts[0]), &ts[0]);
717 718 719 720 721
		}
	}


	memset(ts, 0, sizeof(ts));
722 723
	if (sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE) &&
	    ktime_to_timespec_cond(skb->tstamp, ts + 0))
724 725 726
		empty = 0;
	if (shhwtstamps) {
		if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
727
		    ktime_to_timespec_cond(shhwtstamps->syststamp, ts + 1))
728 729
			empty = 0;
		if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
730
		    ktime_to_timespec_cond(shhwtstamps->hwtstamp, ts + 2))
731
			empty = 0;
732
	}
733 734 735
	if (!empty)
		put_cmsg(msg, SOL_SOCKET,
			 SCM_TIMESTAMPING, sizeof(ts), &ts);
736
}
737 738
EXPORT_SYMBOL_GPL(__sock_recv_timestamp);

739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754
void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
	struct sk_buff *skb)
{
	int ack;

	if (!sock_flag(sk, SOCK_WIFI_STATUS))
		return;
	if (!skb->wifi_acked_valid)
		return;

	ack = skb->wifi_acked;

	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
}
EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);

S
stephen hemminger 已提交
755 756
static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
				   struct sk_buff *skb)
757 758 759 760 761 762
{
	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
		put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
			sizeof(__u32), &skb->dropcount);
}

763
void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
764 765 766 767 768
	struct sk_buff *skb)
{
	sock_recv_timestamp(msg, sk, skb);
	sock_recv_drops(msg, sk, skb);
}
769
EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
770

771 772
static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
				       struct msghdr *msg, size_t size, int flags)
L
Linus Torvalds 已提交
773 774 775 776 777 778 779 780 781 782 783 784
{
	struct sock_iocb *si = kiocb_to_siocb(iocb);

	si->sock = sock;
	si->scm = NULL;
	si->msg = msg;
	si->size = size;
	si->flags = flags;

	return sock->ops->recvmsg(iocb, sock, msg, size, flags);
}

785 786 787 788 789 790 791 792
static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
				 struct msghdr *msg, size_t size, int flags)
{
	int err = security_socket_recvmsg(sock, msg, size, flags);

	return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
}

793
int sock_recvmsg(struct socket *sock, struct msghdr *msg,
L
Linus Torvalds 已提交
794 795 796 797 798 799
		 size_t size, int flags)
{
	struct kiocb iocb;
	struct sock_iocb siocb;
	int ret;

800
	init_sync_kiocb(&iocb, NULL);
L
Linus Torvalds 已提交
801 802 803 804 805 806
	iocb.private = &siocb;
	ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
	if (-EIOCBQUEUED == ret)
		ret = wait_on_sync_kiocb(&iocb);
	return ret;
}
807
EXPORT_SYMBOL(sock_recvmsg);
L
Linus Torvalds 已提交
808

809 810 811 812 813 814 815 816 817 818 819 820 821 822 823
static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
			      size_t size, int flags)
{
	struct kiocb iocb;
	struct sock_iocb siocb;
	int ret;

	init_sync_kiocb(&iocb, NULL);
	iocb.private = &siocb;
	ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
	if (-EIOCBQUEUED == ret)
		ret = wait_on_sync_kiocb(&iocb);
	return ret;
}

824 825 826 827 828 829 830 831 832 833 834 835 836 837 838
/**
 * kernel_recvmsg - Receive a message from a socket (kernel space)
 * @sock:       The socket to receive the message from
 * @msg:        Received message
 * @vec:        Input s/g array for message data
 * @num:        Size of input s/g array
 * @size:       Number of bytes to read
 * @flags:      Message flags (MSG_DONTWAIT, etc...)
 *
 * On return the msg structure contains the scatter/gather array passed in the
 * vec argument. The array is modified so that it consists of the unfilled
 * portion of the original array.
 *
 * The returned value is the total number of bytes received, or an error.
 */
839 840
int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
		   struct kvec *vec, size_t num, size_t size, int flags)
L
Linus Torvalds 已提交
841 842 843 844 845 846 847 848 849
{
	mm_segment_t oldfs = get_fs();
	int result;

	set_fs(KERNEL_DS);
	/*
	 * the following is safe, since for compiler definitions of kvec and
	 * iovec are identical, yielding the same in-core layout and alignment
	 */
850
	msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
L
Linus Torvalds 已提交
851 852 853 854
	result = sock_recvmsg(sock, msg, size, flags);
	set_fs(oldfs);
	return result;
}
855
EXPORT_SYMBOL(kernel_recvmsg);
L
Linus Torvalds 已提交
856

857 858
static ssize_t sock_sendpage(struct file *file, struct page *page,
			     int offset, size_t size, loff_t *ppos, int more)
L
Linus Torvalds 已提交
859 860 861 862
{
	struct socket *sock;
	int flags;

863 864
	sock = file->private_data;

865 866 867
	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
	flags |= more;
868

869
	return kernel_sendpage(sock, page, offset, size, flags);
870
}
L
Linus Torvalds 已提交
871

J
Jens Axboe 已提交
872
static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
873
				struct pipe_inode_info *pipe, size_t len,
J
Jens Axboe 已提交
874 875 876 877
				unsigned int flags)
{
	struct socket *sock = file->private_data;

878 879 880
	if (unlikely(!sock->ops->splice_read))
		return -EINVAL;

J
Jens Axboe 已提交
881 882 883
	return sock->ops->splice_read(sock, ppos, pipe, len, flags);
}

884
static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
885
					 struct sock_iocb *siocb)
886
{
K
Kent Overstreet 已提交
887 888
	if (!is_sync_kiocb(iocb))
		BUG();
L
Linus Torvalds 已提交
889

890 891 892
	siocb->kiocb = iocb;
	iocb->private = siocb;
	return siocb;
L
Linus Torvalds 已提交
893 894
}

895
static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
896 897
		struct file *file, const struct iovec *iov,
		unsigned long nr_segs)
898 899 900 901
{
	struct socket *sock = file->private_data;
	size_t size = 0;
	int i;
L
Linus Torvalds 已提交
902

903 904
	for (i = 0; i < nr_segs; i++)
		size += iov[i].iov_len;
L
Linus Torvalds 已提交
905

906 907 908 909
	msg->msg_name = NULL;
	msg->msg_namelen = 0;
	msg->msg_control = NULL;
	msg->msg_controllen = 0;
910
	msg->msg_iov = (struct iovec *)iov;
911 912 913 914 915 916
	msg->msg_iovlen = nr_segs;
	msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;

	return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
}

917 918
static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
				unsigned long nr_segs, loff_t pos)
919 920 921
{
	struct sock_iocb siocb, *x;

L
Linus Torvalds 已提交
922 923
	if (pos != 0)
		return -ESPIPE;
924

K
Kent Overstreet 已提交
925
	if (iocb->ki_nbytes == 0)	/* Match SYS5 behaviour */
L
Linus Torvalds 已提交
926 927
		return 0;

928 929

	x = alloc_sock_iocb(iocb, &siocb);
930 931
	if (!x)
		return -ENOMEM;
932
	return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
L
Linus Torvalds 已提交
933 934
}

935
static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
936 937
			struct file *file, const struct iovec *iov,
			unsigned long nr_segs)
L
Linus Torvalds 已提交
938
{
939 940 941
	struct socket *sock = file->private_data;
	size_t size = 0;
	int i;
L
Linus Torvalds 已提交
942

943 944
	for (i = 0; i < nr_segs; i++)
		size += iov[i].iov_len;
L
Linus Torvalds 已提交
945

946 947 948 949
	msg->msg_name = NULL;
	msg->msg_namelen = 0;
	msg->msg_control = NULL;
	msg->msg_controllen = 0;
950
	msg->msg_iov = (struct iovec *)iov;
951 952 953 954
	msg->msg_iovlen = nr_segs;
	msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
	if (sock->type == SOCK_SEQPACKET)
		msg->msg_flags |= MSG_EOR;
L
Linus Torvalds 已提交
955

956
	return __sock_sendmsg(iocb, sock, msg, size);
L
Linus Torvalds 已提交
957 958
}

959 960
static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
			  unsigned long nr_segs, loff_t pos)
961 962
{
	struct sock_iocb siocb, *x;
L
Linus Torvalds 已提交
963

964 965
	if (pos != 0)
		return -ESPIPE;
966 967

	x = alloc_sock_iocb(iocb, &siocb);
968 969
	if (!x)
		return -ENOMEM;
L
Linus Torvalds 已提交
970

971
	return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
L
Linus Torvalds 已提交
972 973 974 975 976 977 978
}

/*
 * Atomic setting of ioctl hooks to avoid race
 * with module unload.
 */

A
Arjan van de Ven 已提交
979
static DEFINE_MUTEX(br_ioctl_mutex);
980
static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
L
Linus Torvalds 已提交
981

982
void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
L
Linus Torvalds 已提交
983
{
A
Arjan van de Ven 已提交
984
	mutex_lock(&br_ioctl_mutex);
L
Linus Torvalds 已提交
985
	br_ioctl_hook = hook;
A
Arjan van de Ven 已提交
986
	mutex_unlock(&br_ioctl_mutex);
L
Linus Torvalds 已提交
987 988 989
}
EXPORT_SYMBOL(brioctl_set);

A
Arjan van de Ven 已提交
990
static DEFINE_MUTEX(vlan_ioctl_mutex);
991
static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
L
Linus Torvalds 已提交
992

993
void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
L
Linus Torvalds 已提交
994
{
A
Arjan van de Ven 已提交
995
	mutex_lock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
996
	vlan_ioctl_hook = hook;
A
Arjan van de Ven 已提交
997
	mutex_unlock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
998 999 1000
}
EXPORT_SYMBOL(vlan_ioctl_set);

A
Arjan van de Ven 已提交
1001
static DEFINE_MUTEX(dlci_ioctl_mutex);
1002
static int (*dlci_ioctl_hook) (unsigned int, void __user *);
L
Linus Torvalds 已提交
1003

1004
void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
L
Linus Torvalds 已提交
1005
{
A
Arjan van de Ven 已提交
1006
	mutex_lock(&dlci_ioctl_mutex);
L
Linus Torvalds 已提交
1007
	dlci_ioctl_hook = hook;
A
Arjan van de Ven 已提交
1008
	mutex_unlock(&dlci_ioctl_mutex);
L
Linus Torvalds 已提交
1009 1010 1011
}
EXPORT_SYMBOL(dlci_ioctl_set);

1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029
static long sock_do_ioctl(struct net *net, struct socket *sock,
				 unsigned int cmd, unsigned long arg)
{
	int err;
	void __user *argp = (void __user *)arg;

	err = sock->ops->ioctl(sock, cmd, arg);

	/*
	 * If this ioctl is unknown try to hand it down
	 * to the NIC driver.
	 */
	if (err == -ENOIOCTLCMD)
		err = dev_ioctl(net, cmd, argp);

	return err;
}

L
Linus Torvalds 已提交
1030 1031 1032 1033 1034 1035 1036 1037
/*
 *	With an ioctl, arg may well be a user mode pointer, but we don't know
 *	what to do with it - that's up to the protocol still.
 */

static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
{
	struct socket *sock;
1038
	struct sock *sk;
L
Linus Torvalds 已提交
1039 1040
	void __user *argp = (void __user *)arg;
	int pid, err;
1041
	struct net *net;
L
Linus Torvalds 已提交
1042

1043
	sock = file->private_data;
1044
	sk = sock->sk;
1045
	net = sock_net(sk);
L
Linus Torvalds 已提交
1046
	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
1047
		err = dev_ioctl(net, cmd, argp);
L
Linus Torvalds 已提交
1048
	} else
J
Johannes Berg 已提交
1049
#ifdef CONFIG_WEXT_CORE
L
Linus Torvalds 已提交
1050
	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
1051
		err = dev_ioctl(net, cmd, argp);
L
Linus Torvalds 已提交
1052
	} else
J
Johannes Berg 已提交
1053
#endif
1054
		switch (cmd) {
L
Linus Torvalds 已提交
1055 1056 1057 1058 1059 1060 1061 1062 1063
		case FIOSETOWN:
		case SIOCSPGRP:
			err = -EFAULT;
			if (get_user(pid, (int __user *)argp))
				break;
			err = f_setown(sock->file, pid, 1);
			break;
		case FIOGETOWN:
		case SIOCGPGRP:
1064
			err = put_user(f_getown(sock->file),
1065
				       (int __user *)argp);
L
Linus Torvalds 已提交
1066 1067 1068 1069 1070 1071 1072 1073 1074
			break;
		case SIOCGIFBR:
		case SIOCSIFBR:
		case SIOCBRADDBR:
		case SIOCBRDELBR:
			err = -ENOPKG;
			if (!br_ioctl_hook)
				request_module("bridge");

A
Arjan van de Ven 已提交
1075
			mutex_lock(&br_ioctl_mutex);
1076
			if (br_ioctl_hook)
1077
				err = br_ioctl_hook(net, cmd, argp);
A
Arjan van de Ven 已提交
1078
			mutex_unlock(&br_ioctl_mutex);
L
Linus Torvalds 已提交
1079 1080 1081 1082 1083 1084 1085
			break;
		case SIOCGIFVLAN:
		case SIOCSIFVLAN:
			err = -ENOPKG;
			if (!vlan_ioctl_hook)
				request_module("8021q");

A
Arjan van de Ven 已提交
1086
			mutex_lock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
1087
			if (vlan_ioctl_hook)
1088
				err = vlan_ioctl_hook(net, argp);
A
Arjan van de Ven 已提交
1089
			mutex_unlock(&vlan_ioctl_mutex);
L
Linus Torvalds 已提交
1090 1091 1092 1093 1094 1095 1096
			break;
		case SIOCADDDLCI:
		case SIOCDELDLCI:
			err = -ENOPKG;
			if (!dlci_ioctl_hook)
				request_module("dlci");

1097 1098
			mutex_lock(&dlci_ioctl_mutex);
			if (dlci_ioctl_hook)
L
Linus Torvalds 已提交
1099
				err = dlci_ioctl_hook(cmd, argp);
1100
			mutex_unlock(&dlci_ioctl_mutex);
L
Linus Torvalds 已提交
1101 1102
			break;
		default:
1103
			err = sock_do_ioctl(net, sock, cmd, arg);
L
Linus Torvalds 已提交
1104
			break;
1105
		}
L
Linus Torvalds 已提交
1106 1107 1108 1109 1110 1111 1112
	return err;
}

int sock_create_lite(int family, int type, int protocol, struct socket **res)
{
	int err;
	struct socket *sock = NULL;
1113

L
Linus Torvalds 已提交
1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124
	err = security_socket_create(family, type, protocol, 1);
	if (err)
		goto out;

	sock = sock_alloc();
	if (!sock) {
		err = -ENOMEM;
		goto out;
	}

	sock->type = type;
V
Venkat Yekkirala 已提交
1125 1126 1127 1128
	err = security_socket_post_create(sock, family, type, protocol, 1);
	if (err)
		goto out_release;

L
Linus Torvalds 已提交
1129 1130 1131
out:
	*res = sock;
	return err;
V
Venkat Yekkirala 已提交
1132 1133 1134 1135
out_release:
	sock_release(sock);
	sock = NULL;
	goto out;
L
Linus Torvalds 已提交
1136
}
1137
EXPORT_SYMBOL(sock_create_lite);
L
Linus Torvalds 已提交
1138 1139

/* No kernel lock held - perfect */
1140
static unsigned int sock_poll(struct file *file, poll_table *wait)
L
Linus Torvalds 已提交
1141
{
1142
	unsigned int busy_flag = 0;
L
Linus Torvalds 已提交
1143 1144 1145
	struct socket *sock;

	/*
1146
	 *      We can't return errors to poll, so it's either yes or no.
L
Linus Torvalds 已提交
1147
	 */
1148
	sock = file->private_data;
1149

1150
	if (sk_can_busy_loop(sock->sk)) {
1151
		/* this socket can poll_ll so tell the system call */
1152
		busy_flag = POLL_BUSY_LOOP;
1153 1154

		/* once, only if requested by syscall */
1155 1156
		if (wait && (wait->_key & POLL_BUSY_LOOP))
			sk_busy_loop(sock->sk, 1);
1157 1158
	}

1159
	return busy_flag | sock->ops->poll(file, sock, wait);
L
Linus Torvalds 已提交
1160 1161
}

1162
static int sock_mmap(struct file *file, struct vm_area_struct *vma)
L
Linus Torvalds 已提交
1163
{
1164
	struct socket *sock = file->private_data;
L
Linus Torvalds 已提交
1165 1166 1167 1168

	return sock->ops->mmap(file, sock, vma);
}

1169
static int sock_close(struct inode *inode, struct file *filp)
L
Linus Torvalds 已提交
1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182
{
	sock_release(SOCKET_I(inode));
	return 0;
}

/*
 *	Update the socket async list
 *
 *	Fasync_list locking strategy.
 *
 *	1. fasync_list is modified only under process context socket lock
 *	   i.e. under semaphore.
 *	2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1183
 *	   or under socket lock
L
Linus Torvalds 已提交
1184 1185 1186 1187
 */

static int sock_fasync(int fd, struct file *filp, int on)
{
1188 1189
	struct socket *sock = filp->private_data;
	struct sock *sk = sock->sk;
1190
	struct socket_wq *wq;
L
Linus Torvalds 已提交
1191

1192
	if (sk == NULL)
L
Linus Torvalds 已提交
1193 1194 1195
		return -EINVAL;

	lock_sock(sk);
1196 1197
	wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
	fasync_helper(fd, filp, on, &wq->fasync_list);
L
Linus Torvalds 已提交
1198

1199
	if (!wq->fasync_list)
1200 1201
		sock_reset_flag(sk, SOCK_FASYNC);
	else
E
Eric Dumazet 已提交
1202
		sock_set_flag(sk, SOCK_FASYNC);
L
Linus Torvalds 已提交
1203

1204
	release_sock(sk);
L
Linus Torvalds 已提交
1205 1206 1207
	return 0;
}

1208
/* This function may be called only under socket lock or callback_lock or rcu_lock */
L
Linus Torvalds 已提交
1209 1210 1211

int sock_wake_async(struct socket *sock, int how, int band)
{
1212 1213 1214 1215 1216 1217 1218 1219
	struct socket_wq *wq;

	if (!sock)
		return -1;
	rcu_read_lock();
	wq = rcu_dereference(sock->wq);
	if (!wq || !wq->fasync_list) {
		rcu_read_unlock();
L
Linus Torvalds 已提交
1220
		return -1;
1221
	}
1222
	switch (how) {
1223
	case SOCK_WAKE_WAITD:
L
Linus Torvalds 已提交
1224 1225 1226
		if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
			break;
		goto call_kill;
1227
	case SOCK_WAKE_SPACE:
L
Linus Torvalds 已提交
1228 1229 1230
		if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
			break;
		/* fall through */
1231
	case SOCK_WAKE_IO:
1232
call_kill:
1233
		kill_fasync(&wq->fasync_list, SIGIO, band);
L
Linus Torvalds 已提交
1234
		break;
1235
	case SOCK_WAKE_URG:
1236
		kill_fasync(&wq->fasync_list, SIGURG, band);
L
Linus Torvalds 已提交
1237
	}
1238
	rcu_read_unlock();
L
Linus Torvalds 已提交
1239 1240
	return 0;
}
1241
EXPORT_SYMBOL(sock_wake_async);
L
Linus Torvalds 已提交
1242

P
Pavel Emelyanov 已提交
1243
int __sock_create(struct net *net, int family, int type, int protocol,
1244
			 struct socket **res, int kern)
L
Linus Torvalds 已提交
1245 1246 1247
{
	int err;
	struct socket *sock;
1248
	const struct net_proto_family *pf;
L
Linus Torvalds 已提交
1249 1250

	/*
1251
	 *      Check protocol is in range
L
Linus Torvalds 已提交
1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263
	 */
	if (family < 0 || family >= NPROTO)
		return -EAFNOSUPPORT;
	if (type < 0 || type >= SOCK_MAX)
		return -EINVAL;

	/* Compatibility.

	   This uglymoron is moved from INET layer to here to avoid
	   deadlock in module load.
	 */
	if (family == PF_INET && type == SOCK_PACKET) {
1264
		static int warned;
L
Linus Torvalds 已提交
1265 1266
		if (!warned) {
			warned = 1;
1267 1268
			printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
			       current->comm);
L
Linus Torvalds 已提交
1269 1270 1271 1272 1273 1274 1275
		}
		family = PF_PACKET;
	}

	err = security_socket_create(family, type, protocol, kern);
	if (err)
		return err;
1276

1277 1278 1279 1280 1281 1282 1283
	/*
	 *	Allocate the socket and allow the family to set things up. if
	 *	the protocol is 0, the family is instructed to select an appropriate
	 *	default.
	 */
	sock = sock_alloc();
	if (!sock) {
1284
		net_warn_ratelimited("socket: no more sockets\n");
1285 1286 1287 1288 1289 1290
		return -ENFILE;	/* Not exactly a match, but its the
				   closest posix thing */
	}

	sock->type = type;

1291
#ifdef CONFIG_MODULES
1292 1293 1294
	/* Attempt to load a protocol module if the find failed.
	 *
	 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
L
Linus Torvalds 已提交
1295 1296 1297
	 * requested real, full-featured networking support upon configuration.
	 * Otherwise module support will break!
	 */
E
Eric Dumazet 已提交
1298
	if (rcu_access_pointer(net_families[family]) == NULL)
1299
		request_module("net-pf-%d", family);
L
Linus Torvalds 已提交
1300 1301
#endif

1302 1303 1304 1305 1306
	rcu_read_lock();
	pf = rcu_dereference(net_families[family]);
	err = -EAFNOSUPPORT;
	if (!pf)
		goto out_release;
L
Linus Torvalds 已提交
1307 1308 1309 1310 1311

	/*
	 * We will call the ->create function, that possibly is in a loadable
	 * module, so we have to bump that loadable module refcnt first.
	 */
1312
	if (!try_module_get(pf->owner))
L
Linus Torvalds 已提交
1313 1314
		goto out_release;

1315 1316 1317
	/* Now protected by module ref count */
	rcu_read_unlock();

1318
	err = pf->create(net, sock, protocol, kern);
1319
	if (err < 0)
L
Linus Torvalds 已提交
1320
		goto out_module_put;
1321

L
Linus Torvalds 已提交
1322 1323 1324 1325
	/*
	 * Now to bump the refcnt of the [loadable] module that owns this
	 * socket at sock_release time we decrement its refcnt.
	 */
1326 1327 1328
	if (!try_module_get(sock->ops->owner))
		goto out_module_busy;

L
Linus Torvalds 已提交
1329 1330 1331 1332
	/*
	 * Now that we're done with the ->create function, the [loadable]
	 * module can have its refcnt decremented
	 */
1333
	module_put(pf->owner);
V
Venkat Yekkirala 已提交
1334 1335
	err = security_socket_post_create(sock, family, type, protocol, kern);
	if (err)
1336
		goto out_sock_release;
1337
	*res = sock;
L
Linus Torvalds 已提交
1338

1339 1340 1341 1342
	return 0;

out_module_busy:
	err = -EAFNOSUPPORT;
L
Linus Torvalds 已提交
1343
out_module_put:
1344 1345 1346
	sock->ops = NULL;
	module_put(pf->owner);
out_sock_release:
L
Linus Torvalds 已提交
1347
	sock_release(sock);
1348 1349 1350 1351 1352
	return err;

out_release:
	rcu_read_unlock();
	goto out_sock_release;
L
Linus Torvalds 已提交
1353
}
P
Pavel Emelyanov 已提交
1354
EXPORT_SYMBOL(__sock_create);
L
Linus Torvalds 已提交
1355 1356 1357

int sock_create(int family, int type, int protocol, struct socket **res)
{
1358
	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
L
Linus Torvalds 已提交
1359
}
1360
EXPORT_SYMBOL(sock_create);
L
Linus Torvalds 已提交
1361 1362 1363

int sock_create_kern(int family, int type, int protocol, struct socket **res)
{
1364
	return __sock_create(&init_net, family, type, protocol, res, 1);
L
Linus Torvalds 已提交
1365
}
1366
EXPORT_SYMBOL(sock_create_kern);
L
Linus Torvalds 已提交
1367

1368
SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
L
Linus Torvalds 已提交
1369 1370 1371
{
	int retval;
	struct socket *sock;
1372 1373
	int flags;

1374 1375 1376 1377 1378 1379
	/* Check the SOCK_* constants for consistency.  */
	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);

1380
	flags = type & ~SOCK_TYPE_MASK;
1381
	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1382 1383
		return -EINVAL;
	type &= SOCK_TYPE_MASK;
L
Linus Torvalds 已提交
1384

U
Ulrich Drepper 已提交
1385 1386 1387
	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

L
Linus Torvalds 已提交
1388 1389 1390 1391
	retval = sock_create(family, type, protocol, &sock);
	if (retval < 0)
		goto out;

1392
	retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
L
Linus Torvalds 已提交
1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408
	if (retval < 0)
		goto out_release;

out:
	/* It may be already another descriptor 8) Not kernel problem. */
	return retval;

out_release:
	sock_release(sock);
	return retval;
}

/*
 *	Create a pair of connected sockets.
 */

1409 1410
SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
		int __user *, usockvec)
L
Linus Torvalds 已提交
1411 1412 1413
{
	struct socket *sock1, *sock2;
	int fd1, fd2, err;
A
Al Viro 已提交
1414
	struct file *newfile1, *newfile2;
1415 1416 1417
	int flags;

	flags = type & ~SOCK_TYPE_MASK;
1418
	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1419 1420
		return -EINVAL;
	type &= SOCK_TYPE_MASK;
L
Linus Torvalds 已提交
1421

U
Ulrich Drepper 已提交
1422 1423 1424
	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

L
Linus Torvalds 已提交
1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438
	/*
	 * Obtain the first socket and check if the underlying protocol
	 * supports the socketpair call.
	 */

	err = sock_create(family, type, protocol, &sock1);
	if (err < 0)
		goto out;

	err = sock_create(family, type, protocol, &sock2);
	if (err < 0)
		goto out_release_1;

	err = sock1->ops->socketpair(sock1, sock2);
1439
	if (err < 0)
L
Linus Torvalds 已提交
1440 1441
		goto out_release_both;

1442
	fd1 = get_unused_fd_flags(flags);
1443 1444
	if (unlikely(fd1 < 0)) {
		err = fd1;
A
Al Viro 已提交
1445
		goto out_release_both;
1446
	}
1447
	fd2 = get_unused_fd_flags(flags);
1448 1449
	if (unlikely(fd2 < 0)) {
		err = fd2;
1450 1451 1452 1453
		put_unused_fd(fd1);
		goto out_release_both;
	}

1454
	newfile1 = sock_alloc_file(sock1, flags, NULL);
1455 1456 1457 1458 1459 1460 1461
	if (unlikely(IS_ERR(newfile1))) {
		err = PTR_ERR(newfile1);
		put_unused_fd(fd1);
		put_unused_fd(fd2);
		goto out_release_both;
	}

1462
	newfile2 = sock_alloc_file(sock2, flags, NULL);
1463 1464
	if (IS_ERR(newfile2)) {
		err = PTR_ERR(newfile2);
1465 1466
		fput(newfile1);
		put_unused_fd(fd1);
1467
		put_unused_fd(fd2);
1468 1469
		sock_release(sock2);
		goto out;
A
Al Viro 已提交
1470 1471
	}

A
Al Viro 已提交
1472
	audit_fd_pair(fd1, fd2);
A
Al Viro 已提交
1473 1474
	fd_install(fd1, newfile1);
	fd_install(fd2, newfile2);
L
Linus Torvalds 已提交
1475 1476 1477 1478
	/* fd1 and fd2 may be already another descriptors.
	 * Not kernel problem.
	 */

1479
	err = put_user(fd1, &usockvec[0]);
L
Linus Torvalds 已提交
1480 1481 1482 1483 1484 1485 1486 1487 1488 1489
	if (!err)
		err = put_user(fd2, &usockvec[1]);
	if (!err)
		return 0;

	sys_close(fd2);
	sys_close(fd1);
	return err;

out_release_both:
1490
	sock_release(sock2);
L
Linus Torvalds 已提交
1491
out_release_1:
1492
	sock_release(sock1);
L
Linus Torvalds 已提交
1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504
out:
	return err;
}

/*
 *	Bind a name to a socket. Nothing much to do here since it's
 *	the protocol's responsibility to handle the local address.
 *
 *	We move the socket address to kernel space before we call
 *	the protocol layer (having also checked the address is ok).
 */

1505
SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
L
Linus Torvalds 已提交
1506 1507
{
	struct socket *sock;
1508
	struct sockaddr_storage address;
1509
	int err, fput_needed;
L
Linus Torvalds 已提交
1510

1511
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1512
	if (sock) {
1513
		err = move_addr_to_kernel(umyaddr, addrlen, &address);
1514 1515
		if (err >= 0) {
			err = security_socket_bind(sock,
1516
						   (struct sockaddr *)&address,
1517
						   addrlen);
1518 1519
			if (!err)
				err = sock->ops->bind(sock,
1520
						      (struct sockaddr *)
1521
						      &address, addrlen);
L
Linus Torvalds 已提交
1522
		}
1523
		fput_light(sock->file, fput_needed);
1524
	}
L
Linus Torvalds 已提交
1525 1526 1527 1528 1529 1530 1531 1532 1533
	return err;
}

/*
 *	Perform a listen. Basically, we allow the protocol to do anything
 *	necessary for a listen, and if that works, we mark the socket as
 *	ready for listening.
 */

1534
SYSCALL_DEFINE2(listen, int, fd, int, backlog)
L
Linus Torvalds 已提交
1535 1536
{
	struct socket *sock;
1537
	int err, fput_needed;
1538
	int somaxconn;
1539 1540 1541

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock) {
1542
		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1543
		if ((unsigned int)backlog > somaxconn)
1544
			backlog = somaxconn;
L
Linus Torvalds 已提交
1545 1546

		err = security_socket_listen(sock, backlog);
1547 1548
		if (!err)
			err = sock->ops->listen(sock, backlog);
L
Linus Torvalds 已提交
1549

1550
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566
	}
	return err;
}

/*
 *	For accept, we attempt to create a new socket, set up the link
 *	with the client, wake up the client, then return the new
 *	connected fd. We collect the address of the connector in kernel
 *	space and move it to user at the very end. This is unclean because
 *	we open the socket then return an error.
 *
 *	1003.1g adds the ability to recvmsg() to query connection pending
 *	status to recvmsg. We need to add that support in a way thats
 *	clean when we restucture accept also.
 */

1567 1568
SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
		int __user *, upeer_addrlen, int, flags)
L
Linus Torvalds 已提交
1569 1570
{
	struct socket *sock, *newsock;
1571
	struct file *newfile;
1572
	int err, len, newfd, fput_needed;
1573
	struct sockaddr_storage address;
L
Linus Torvalds 已提交
1574

1575
	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
U
Ulrich Drepper 已提交
1576 1577 1578 1579 1580
		return -EINVAL;

	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

1581
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1582 1583 1584 1585
	if (!sock)
		goto out;

	err = -ENFILE;
1586 1587
	newsock = sock_alloc();
	if (!newsock)
L
Linus Torvalds 已提交
1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598
		goto out_put;

	newsock->type = sock->type;
	newsock->ops = sock->ops;

	/*
	 * We don't need try_module_get here, as the listening socket (sock)
	 * has the protocol module (sock->ops->owner) held.
	 */
	__module_get(newsock->ops->owner);

1599
	newfd = get_unused_fd_flags(flags);
1600 1601
	if (unlikely(newfd < 0)) {
		err = newfd;
1602 1603
		sock_release(newsock);
		goto out_put;
1604
	}
1605
	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1606 1607 1608 1609 1610 1611
	if (unlikely(IS_ERR(newfile))) {
		err = PTR_ERR(newfile);
		put_unused_fd(newfd);
		sock_release(newsock);
		goto out_put;
	}
1612

1613 1614
	err = security_socket_accept(sock, newsock);
	if (err)
1615
		goto out_fd;
1616

L
Linus Torvalds 已提交
1617 1618
	err = sock->ops->accept(sock, newsock, sock->file->f_flags);
	if (err < 0)
1619
		goto out_fd;
L
Linus Torvalds 已提交
1620 1621

	if (upeer_sockaddr) {
1622
		if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1623
					  &len, 2) < 0) {
L
Linus Torvalds 已提交
1624
			err = -ECONNABORTED;
1625
			goto out_fd;
L
Linus Torvalds 已提交
1626
		}
1627
		err = move_addr_to_user(&address,
1628
					len, upeer_sockaddr, upeer_addrlen);
L
Linus Torvalds 已提交
1629
		if (err < 0)
1630
			goto out_fd;
L
Linus Torvalds 已提交
1631 1632 1633 1634
	}

	/* File flags are not inherited via accept() unlike another OSes. */

1635 1636
	fd_install(newfd, newfile);
	err = newfd;
L
Linus Torvalds 已提交
1637 1638

out_put:
1639
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1640 1641
out:
	return err;
1642
out_fd:
1643
	fput(newfile);
1644
	put_unused_fd(newfd);
L
Linus Torvalds 已提交
1645 1646 1647
	goto out_put;
}

1648 1649
SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
		int __user *, upeer_addrlen)
U
Ulrich Drepper 已提交
1650
{
U
Ulrich Drepper 已提交
1651
	return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
U
Ulrich Drepper 已提交
1652 1653
}

L
Linus Torvalds 已提交
1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665
/*
 *	Attempt to connect to a socket with the server address.  The address
 *	is in user space so we verify it is OK and move it to kernel space.
 *
 *	For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
 *	break bindings
 *
 *	NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
 *	other SEQPACKET protocols that take time to connect() as it doesn't
 *	include the -EINPROGRESS status for such sockets.
 */

1666 1667
SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
		int, addrlen)
L
Linus Torvalds 已提交
1668 1669
{
	struct socket *sock;
1670
	struct sockaddr_storage address;
1671
	int err, fput_needed;
L
Linus Torvalds 已提交
1672

1673
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1674 1675
	if (!sock)
		goto out;
1676
	err = move_addr_to_kernel(uservaddr, addrlen, &address);
L
Linus Torvalds 已提交
1677 1678 1679
	if (err < 0)
		goto out_put;

1680
	err =
1681
	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
L
Linus Torvalds 已提交
1682 1683 1684
	if (err)
		goto out_put;

1685
	err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
L
Linus Torvalds 已提交
1686 1687
				 sock->file->f_flags);
out_put:
1688
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1689 1690 1691 1692 1693 1694 1695 1696 1697
out:
	return err;
}

/*
 *	Get the local address ('name') of a socket object. Move the obtained
 *	name to user space.
 */

1698 1699
SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
		int __user *, usockaddr_len)
L
Linus Torvalds 已提交
1700 1701
{
	struct socket *sock;
1702
	struct sockaddr_storage address;
1703
	int len, err, fput_needed;
1704

1705
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1706 1707 1708 1709 1710 1711 1712
	if (!sock)
		goto out;

	err = security_socket_getsockname(sock);
	if (err)
		goto out_put;

1713
	err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
L
Linus Torvalds 已提交
1714 1715
	if (err)
		goto out_put;
1716
	err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
L
Linus Torvalds 已提交
1717 1718

out_put:
1719
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1720 1721 1722 1723 1724 1725 1726 1727 1728
out:
	return err;
}

/*
 *	Get the remote address ('name') of a socket object. Move the obtained
 *	name to user space.
 */

1729 1730
SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
		int __user *, usockaddr_len)
L
Linus Torvalds 已提交
1731 1732
{
	struct socket *sock;
1733
	struct sockaddr_storage address;
1734
	int len, err, fput_needed;
L
Linus Torvalds 已提交
1735

1736 1737
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
L
Linus Torvalds 已提交
1738 1739
		err = security_socket_getpeername(sock);
		if (err) {
1740
			fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1741 1742 1743
			return err;
		}

1744
		err =
1745
		    sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1746
				       1);
L
Linus Torvalds 已提交
1747
		if (!err)
1748
			err = move_addr_to_user(&address, len, usockaddr,
1749
						usockaddr_len);
1750
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1751 1752 1753 1754 1755 1756 1757 1758 1759 1760
	}
	return err;
}

/*
 *	Send a datagram to a given address. We move the address into kernel
 *	space and check the user space data area is readable before invoking
 *	the protocol.
 */

1761
SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1762
		unsigned int, flags, struct sockaddr __user *, addr,
1763
		int, addr_len)
L
Linus Torvalds 已提交
1764 1765
{
	struct socket *sock;
1766
	struct sockaddr_storage address;
L
Linus Torvalds 已提交
1767 1768 1769
	int err;
	struct msghdr msg;
	struct iovec iov;
1770 1771
	int fput_needed;

1772 1773
	if (len > INT_MAX)
		len = INT_MAX;
1774 1775
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (!sock)
1776
		goto out;
1777

1778 1779 1780 1781 1782 1783 1784 1785
	iov.iov_base = buff;
	iov.iov_len = len;
	msg.msg_name = NULL;
	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;
	msg.msg_control = NULL;
	msg.msg_controllen = 0;
	msg.msg_namelen = 0;
1786
	if (addr) {
1787
		err = move_addr_to_kernel(addr, addr_len, &address);
L
Linus Torvalds 已提交
1788 1789
		if (err < 0)
			goto out_put;
1790
		msg.msg_name = (struct sockaddr *)&address;
1791
		msg.msg_namelen = addr_len;
L
Linus Torvalds 已提交
1792 1793 1794 1795 1796 1797
	}
	if (sock->file->f_flags & O_NONBLOCK)
		flags |= MSG_DONTWAIT;
	msg.msg_flags = flags;
	err = sock_sendmsg(sock, &msg, len);

1798
out_put:
1799
	fput_light(sock->file, fput_needed);
1800
out:
L
Linus Torvalds 已提交
1801 1802 1803 1804
	return err;
}

/*
1805
 *	Send a datagram down a socket.
L
Linus Torvalds 已提交
1806 1807
 */

1808
SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1809
		unsigned int, flags)
L
Linus Torvalds 已提交
1810 1811 1812 1813 1814
{
	return sys_sendto(fd, buff, len, flags, NULL, 0);
}

/*
1815
 *	Receive a frame from the socket and optionally record the address of the
L
Linus Torvalds 已提交
1816 1817 1818 1819
 *	sender. We verify the buffers are writable and if needed move the
 *	sender address from kernel to user space.
 */

1820
SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1821
		unsigned int, flags, struct sockaddr __user *, addr,
1822
		int __user *, addr_len)
L
Linus Torvalds 已提交
1823 1824 1825 1826
{
	struct socket *sock;
	struct iovec iov;
	struct msghdr msg;
1827
	struct sockaddr_storage address;
1828
	int err, err2;
1829 1830
	int fput_needed;

1831 1832
	if (size > INT_MAX)
		size = INT_MAX;
1833
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
L
Linus Torvalds 已提交
1834
	if (!sock)
1835
		goto out;
L
Linus Torvalds 已提交
1836

1837 1838 1839 1840 1841 1842
	msg.msg_control = NULL;
	msg.msg_controllen = 0;
	msg.msg_iovlen = 1;
	msg.msg_iov = &iov;
	iov.iov_len = size;
	iov.iov_base = ubuf;
1843 1844
	msg.msg_name = (struct sockaddr *)&address;
	msg.msg_namelen = sizeof(address);
L
Linus Torvalds 已提交
1845 1846
	if (sock->file->f_flags & O_NONBLOCK)
		flags |= MSG_DONTWAIT;
1847
	err = sock_recvmsg(sock, &msg, size, flags);
L
Linus Torvalds 已提交
1848

1849
	if (err >= 0 && addr != NULL) {
1850
		err2 = move_addr_to_user(&address,
1851
					 msg.msg_namelen, addr, addr_len);
1852 1853
		if (err2 < 0)
			err = err2;
L
Linus Torvalds 已提交
1854
	}
1855 1856

	fput_light(sock->file, fput_needed);
1857
out:
L
Linus Torvalds 已提交
1858 1859 1860 1861
	return err;
}

/*
1862
 *	Receive a datagram from a socket.
L
Linus Torvalds 已提交
1863 1864
 */

1865
asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
1866
			 unsigned int flags)
L
Linus Torvalds 已提交
1867 1868 1869 1870 1871 1872 1873 1874 1875
{
	return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
}

/*
 *	Set a socket option. Because we don't know the option lengths we have
 *	to pass the user mode parameter for the protocols to sort out.
 */

1876 1877
SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
		char __user *, optval, int, optlen)
L
Linus Torvalds 已提交
1878
{
1879
	int err, fput_needed;
L
Linus Torvalds 已提交
1880 1881 1882 1883
	struct socket *sock;

	if (optlen < 0)
		return -EINVAL;
1884 1885 1886 1887

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
		err = security_socket_setsockopt(sock, level, optname);
1888 1889
		if (err)
			goto out_put;
L
Linus Torvalds 已提交
1890 1891

		if (level == SOL_SOCKET)
1892 1893 1894
			err =
			    sock_setsockopt(sock, level, optname, optval,
					    optlen);
L
Linus Torvalds 已提交
1895
		else
1896 1897 1898
			err =
			    sock->ops->setsockopt(sock, level, optname, optval,
						  optlen);
1899 1900
out_put:
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1901 1902 1903 1904 1905 1906 1907 1908 1909
	}
	return err;
}

/*
 *	Get a socket option. Because we don't know the option lengths we have
 *	to pass a user mode parameter for the protocols to sort out.
 */

1910 1911
SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
		char __user *, optval, int __user *, optlen)
L
Linus Torvalds 已提交
1912
{
1913
	int err, fput_needed;
L
Linus Torvalds 已提交
1914 1915
	struct socket *sock;

1916 1917
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
1918 1919 1920
		err = security_socket_getsockopt(sock, level, optname);
		if (err)
			goto out_put;
L
Linus Torvalds 已提交
1921 1922

		if (level == SOL_SOCKET)
1923 1924 1925
			err =
			    sock_getsockopt(sock, level, optname, optval,
					    optlen);
L
Linus Torvalds 已提交
1926
		else
1927 1928 1929
			err =
			    sock->ops->getsockopt(sock, level, optname, optval,
						  optlen);
1930 1931
out_put:
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1932 1933 1934 1935 1936 1937 1938 1939
	}
	return err;
}

/*
 *	Shutdown a socket.
 */

1940
SYSCALL_DEFINE2(shutdown, int, fd, int, how)
L
Linus Torvalds 已提交
1941
{
1942
	int err, fput_needed;
L
Linus Torvalds 已提交
1943 1944
	struct socket *sock;

1945 1946
	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (sock != NULL) {
L
Linus Torvalds 已提交
1947
		err = security_socket_shutdown(sock, how);
1948 1949 1950
		if (!err)
			err = sock->ops->shutdown(sock, how);
		fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
1951 1952 1953 1954
	}
	return err;
}

1955
/* A couple of helpful macros for getting the address of the 32/64 bit
L
Linus Torvalds 已提交
1956 1957 1958 1959 1960 1961
 * fields which are the same type (int / unsigned) on our platforms.
 */
#define COMPAT_MSG(msg, member)	((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
#define COMPAT_NAMELEN(msg)	COMPAT_MSG(msg, msg_namelen)
#define COMPAT_FLAGS(msg)	COMPAT_MSG(msg, msg_flags)

1962 1963 1964 1965 1966
struct used_address {
	struct sockaddr_storage name;
	unsigned int name_len;
};

1967 1968 1969 1970 1971 1972 1973 1974 1975 1976
static int copy_msghdr_from_user(struct msghdr *kmsg,
				 struct msghdr __user *umsg)
{
	if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
		return -EFAULT;
	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
		return -EINVAL;
	return 0;
}

1977
static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
1978
			 struct msghdr *msg_sys, unsigned int flags,
1979
			 struct used_address *used_address)
L
Linus Torvalds 已提交
1980
{
1981 1982
	struct compat_msghdr __user *msg_compat =
	    (struct compat_msghdr __user *)msg;
1983
	struct sockaddr_storage address;
L
Linus Torvalds 已提交
1984
	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1985
	unsigned char ctl[sizeof(struct cmsghdr) + 20]
1986 1987
	    __attribute__ ((aligned(sizeof(__kernel_size_t))));
	/* 20 is size of ipv6_pktinfo */
L
Linus Torvalds 已提交
1988
	unsigned char *ctl_buf = ctl;
E
Eric Dumazet 已提交
1989
	int err, ctl_len, total_len;
1990

L
Linus Torvalds 已提交
1991 1992
	err = -EFAULT;
	if (MSG_CMSG_COMPAT & flags) {
1993
		if (get_compat_msghdr(msg_sys, msg_compat))
L
Linus Torvalds 已提交
1994
			return -EFAULT;
1995 1996 1997 1998 1999
	} else {
		err = copy_msghdr_from_user(msg_sys, msg);
		if (err)
			return err;
	}
L
Linus Torvalds 已提交
2000

2001
	if (msg_sys->msg_iovlen > UIO_FASTIOV) {
E
Eric Dumazet 已提交
2002 2003 2004 2005 2006 2007
		err = -EMSGSIZE;
		if (msg_sys->msg_iovlen > UIO_MAXIOV)
			goto out;
		err = -ENOMEM;
		iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
			      GFP_KERNEL);
L
Linus Torvalds 已提交
2008
		if (!iov)
2009
			goto out;
L
Linus Torvalds 已提交
2010 2011 2012 2013
	}

	/* This will also move the address data into kernel space */
	if (MSG_CMSG_COMPAT & flags) {
2014
		err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
L
Linus Torvalds 已提交
2015
	} else
2016
		err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
2017
	if (err < 0)
L
Linus Torvalds 已提交
2018 2019 2020 2021 2022
		goto out_freeiov;
	total_len = err;

	err = -ENOBUFS;

2023
	if (msg_sys->msg_controllen > INT_MAX)
L
Linus Torvalds 已提交
2024
		goto out_freeiov;
2025
	ctl_len = msg_sys->msg_controllen;
L
Linus Torvalds 已提交
2026
	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
2027
		err =
2028
		    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
2029
						     sizeof(ctl));
L
Linus Torvalds 已提交
2030 2031
		if (err)
			goto out_freeiov;
2032 2033
		ctl_buf = msg_sys->msg_control;
		ctl_len = msg_sys->msg_controllen;
L
Linus Torvalds 已提交
2034
	} else if (ctl_len) {
2035
		if (ctl_len > sizeof(ctl)) {
L
Linus Torvalds 已提交
2036
			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
2037
			if (ctl_buf == NULL)
L
Linus Torvalds 已提交
2038 2039 2040 2041
				goto out_freeiov;
		}
		err = -EFAULT;
		/*
2042
		 * Careful! Before this, msg_sys->msg_control contains a user pointer.
L
Linus Torvalds 已提交
2043 2044 2045
		 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
		 * checking falls down on this.
		 */
2046
		if (copy_from_user(ctl_buf,
2047
				   (void __user __force *)msg_sys->msg_control,
2048
				   ctl_len))
L
Linus Torvalds 已提交
2049
			goto out_freectl;
2050
		msg_sys->msg_control = ctl_buf;
L
Linus Torvalds 已提交
2051
	}
2052
	msg_sys->msg_flags = flags;
L
Linus Torvalds 已提交
2053 2054

	if (sock->file->f_flags & O_NONBLOCK)
2055
		msg_sys->msg_flags |= MSG_DONTWAIT;
2056 2057 2058 2059 2060 2061
	/*
	 * If this is sendmmsg() and current destination address is same as
	 * previously succeeded address, omit asking LSM's decision.
	 * used_address->name_len is initialized to UINT_MAX so that the first
	 * destination address never matches.
	 */
2062 2063 2064
	if (used_address && msg_sys->msg_name &&
	    used_address->name_len == msg_sys->msg_namelen &&
	    !memcmp(&used_address->name, msg_sys->msg_name,
2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075
		    used_address->name_len)) {
		err = sock_sendmsg_nosec(sock, msg_sys, total_len);
		goto out_freectl;
	}
	err = sock_sendmsg(sock, msg_sys, total_len);
	/*
	 * If this is sendmmsg() and sending to current destination address was
	 * successful, remember it.
	 */
	if (used_address && err >= 0) {
		used_address->name_len = msg_sys->msg_namelen;
2076 2077 2078
		if (msg_sys->msg_name)
			memcpy(&used_address->name, msg_sys->msg_name,
			       used_address->name_len);
2079
	}
L
Linus Torvalds 已提交
2080 2081

out_freectl:
2082
	if (ctl_buf != ctl)
L
Linus Torvalds 已提交
2083 2084 2085
		sock_kfree_s(sock->sk, ctl_buf, ctl_len);
out_freeiov:
	if (iov != iovstack)
E
Eric Dumazet 已提交
2086
		kfree(iov);
2087 2088 2089 2090 2091 2092 2093 2094
out:
	return err;
}

/*
 *	BSD sendmsg interface
 */

2095
long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
2096 2097 2098
{
	int fput_needed, err;
	struct msghdr msg_sys;
2099 2100 2101
	struct socket *sock;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2102 2103 2104
	if (!sock)
		goto out;

2105
	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
2106

2107
	fput_light(sock->file, fput_needed);
2108
out:
L
Linus Torvalds 已提交
2109 2110 2111
	return err;
}

2112 2113 2114 2115 2116 2117 2118
SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
{
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;
	return __sys_sendmsg(fd, msg, flags);
}

2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130
/*
 *	Linux sendmmsg interface
 */

int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
		   unsigned int flags)
{
	int fput_needed, err, datagrams;
	struct socket *sock;
	struct mmsghdr __user *entry;
	struct compat_mmsghdr __user *compat_entry;
	struct msghdr msg_sys;
2131
	struct used_address used_address;
2132

2133 2134
	if (vlen > UIO_MAXIOV)
		vlen = UIO_MAXIOV;
2135 2136 2137 2138 2139 2140 2141

	datagrams = 0;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (!sock)
		return err;

2142
	used_address.name_len = UINT_MAX;
2143 2144
	entry = mmsg;
	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2145
	err = 0;
2146 2147 2148

	while (datagrams < vlen) {
		if (MSG_CMSG_COMPAT & flags) {
2149 2150
			err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
					     &msg_sys, flags, &used_address);
2151 2152 2153 2154 2155
			if (err < 0)
				break;
			err = __put_user(err, &compat_entry->msg_len);
			++compat_entry;
		} else {
2156 2157 2158
			err = ___sys_sendmsg(sock,
					     (struct msghdr __user *)entry,
					     &msg_sys, flags, &used_address);
2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171
			if (err < 0)
				break;
			err = put_user(err, &entry->msg_len);
			++entry;
		}

		if (err)
			break;
		++datagrams;
	}

	fput_light(sock->file, fput_needed);

2172 2173
	/* We only return an error if no datagrams were able to be sent */
	if (datagrams != 0)
2174 2175 2176 2177 2178 2179 2180 2181
		return datagrams;

	return err;
}

SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
		unsigned int, vlen, unsigned int, flags)
{
2182 2183
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;
2184 2185 2186
	return __sys_sendmmsg(fd, mmsg, vlen, flags);
}

2187
static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
2188
			 struct msghdr *msg_sys, unsigned int flags, int nosec)
L
Linus Torvalds 已提交
2189
{
2190 2191
	struct compat_msghdr __user *msg_compat =
	    (struct compat_msghdr __user *)msg;
L
Linus Torvalds 已提交
2192
	struct iovec iovstack[UIO_FASTIOV];
2193
	struct iovec *iov = iovstack;
L
Linus Torvalds 已提交
2194
	unsigned long cmsg_ptr;
E
Eric Dumazet 已提交
2195
	int err, total_len, len;
L
Linus Torvalds 已提交
2196 2197

	/* kernel mode address */
2198
	struct sockaddr_storage addr;
L
Linus Torvalds 已提交
2199 2200 2201 2202

	/* user mode address pointers */
	struct sockaddr __user *uaddr;
	int __user *uaddr_len;
2203

L
Linus Torvalds 已提交
2204
	if (MSG_CMSG_COMPAT & flags) {
2205
		if (get_compat_msghdr(msg_sys, msg_compat))
L
Linus Torvalds 已提交
2206
			return -EFAULT;
2207 2208 2209 2210 2211
	} else {
		err = copy_msghdr_from_user(msg_sys, msg);
		if (err)
			return err;
	}
L
Linus Torvalds 已提交
2212

2213
	if (msg_sys->msg_iovlen > UIO_FASTIOV) {
E
Eric Dumazet 已提交
2214 2215 2216 2217 2218 2219
		err = -EMSGSIZE;
		if (msg_sys->msg_iovlen > UIO_MAXIOV)
			goto out;
		err = -ENOMEM;
		iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
			      GFP_KERNEL);
L
Linus Torvalds 已提交
2220
		if (!iov)
2221
			goto out;
L
Linus Torvalds 已提交
2222 2223 2224
	}

	/*
2225 2226
	 *      Save the user-mode address (verify_iovec will change the
	 *      kernel msghdr to use the kernel address space)
L
Linus Torvalds 已提交
2227
	 */
2228

2229
	uaddr = (__force void __user *)msg_sys->msg_name;
L
Linus Torvalds 已提交
2230 2231
	uaddr_len = COMPAT_NAMELEN(msg);
	if (MSG_CMSG_COMPAT & flags) {
2232
		err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
L
Linus Torvalds 已提交
2233
	} else
2234
		err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
L
Linus Torvalds 已提交
2235 2236
	if (err < 0)
		goto out_freeiov;
2237
	total_len = err;
L
Linus Torvalds 已提交
2238

2239 2240
	cmsg_ptr = (unsigned long)msg_sys->msg_control;
	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2241

L
Linus Torvalds 已提交
2242 2243
	if (sock->file->f_flags & O_NONBLOCK)
		flags |= MSG_DONTWAIT;
2244 2245
	err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
							  total_len, flags);
L
Linus Torvalds 已提交
2246 2247 2248 2249 2250
	if (err < 0)
		goto out_freeiov;
	len = err;

	if (uaddr != NULL) {
2251
		err = move_addr_to_user(&addr,
2252
					msg_sys->msg_namelen, uaddr,
2253
					uaddr_len);
L
Linus Torvalds 已提交
2254 2255 2256
		if (err < 0)
			goto out_freeiov;
	}
2257
	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2258
			 COMPAT_FLAGS(msg));
L
Linus Torvalds 已提交
2259 2260 2261
	if (err)
		goto out_freeiov;
	if (MSG_CMSG_COMPAT & flags)
2262
		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
L
Linus Torvalds 已提交
2263 2264
				 &msg_compat->msg_controllen);
	else
2265
		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
L
Linus Torvalds 已提交
2266 2267 2268 2269 2270 2271 2272
				 &msg->msg_controllen);
	if (err)
		goto out_freeiov;
	err = len;

out_freeiov:
	if (iov != iovstack)
E
Eric Dumazet 已提交
2273
		kfree(iov);
2274 2275 2276 2277 2278 2279 2280 2281
out:
	return err;
}

/*
 *	BSD recvmsg interface
 */

2282
long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
2283 2284 2285
{
	int fput_needed, err;
	struct msghdr msg_sys;
2286 2287 2288
	struct socket *sock;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2289 2290 2291
	if (!sock)
		goto out;

2292
	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2293

2294
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
2295 2296 2297 2298
out:
	return err;
}

2299 2300 2301 2302 2303 2304 2305 2306
SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
		unsigned int, flags)
{
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;
	return __sys_recvmsg(fd, msg, flags);
}

2307 2308 2309 2310 2311 2312 2313 2314 2315 2316
/*
 *     Linux recvmmsg interface
 */

int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
		   unsigned int flags, struct timespec *timeout)
{
	int fput_needed, err, datagrams;
	struct socket *sock;
	struct mmsghdr __user *entry;
2317
	struct compat_mmsghdr __user *compat_entry;
2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336
	struct msghdr msg_sys;
	struct timespec end_time;

	if (timeout &&
	    poll_select_set_timeout(&end_time, timeout->tv_sec,
				    timeout->tv_nsec))
		return -EINVAL;

	datagrams = 0;

	sock = sockfd_lookup_light(fd, &err, &fput_needed);
	if (!sock)
		return err;

	err = sock_error(sock->sk);
	if (err)
		goto out_put;

	entry = mmsg;
2337
	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2338 2339 2340 2341 2342

	while (datagrams < vlen) {
		/*
		 * No need to ask LSM for more than the first datagram.
		 */
2343
		if (MSG_CMSG_COMPAT & flags) {
2344 2345 2346
			err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
					     &msg_sys, flags & ~MSG_WAITFORONE,
					     datagrams);
2347 2348 2349 2350 2351
			if (err < 0)
				break;
			err = __put_user(err, &compat_entry->msg_len);
			++compat_entry;
		} else {
2352 2353 2354 2355
			err = ___sys_recvmsg(sock,
					     (struct msghdr __user *)entry,
					     &msg_sys, flags & ~MSG_WAITFORONE,
					     datagrams);
2356 2357 2358 2359 2360 2361
			if (err < 0)
				break;
			err = put_user(err, &entry->msg_len);
			++entry;
		}

2362 2363 2364 2365
		if (err)
			break;
		++datagrams;

2366 2367 2368 2369
		/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
		if (flags & MSG_WAITFORONE)
			flags |= MSG_DONTWAIT;

2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389
		if (timeout) {
			ktime_get_ts(timeout);
			*timeout = timespec_sub(end_time, *timeout);
			if (timeout->tv_sec < 0) {
				timeout->tv_sec = timeout->tv_nsec = 0;
				break;
			}

			/* Timeout, return less than vlen datagrams */
			if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
				break;
		}

		/* Out of band data, return right away */
		if (msg_sys.msg_flags & MSG_OOB)
			break;
	}

out_put:
	fput_light(sock->file, fput_needed);
L
Linus Torvalds 已提交
2390

2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421
	if (err == 0)
		return datagrams;

	if (datagrams != 0) {
		/*
		 * We may return less entries than requested (vlen) if the
		 * sock is non block and there aren't enough datagrams...
		 */
		if (err != -EAGAIN) {
			/*
			 * ... or  if recvmsg returns an error after we
			 * received some datagrams, where we record the
			 * error to return on the next call or if the
			 * app asks about it using getsockopt(SO_ERROR).
			 */
			sock->sk->sk_err = -err;
		}

		return datagrams;
	}

	return err;
}

SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
		unsigned int, vlen, unsigned int, flags,
		struct timespec __user *, timeout)
{
	int datagrams;
	struct timespec timeout_sys;

2422 2423 2424
	if (flags & MSG_CMSG_COMPAT)
		return -EINVAL;

2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440
	if (!timeout)
		return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);

	if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
		return -EFAULT;

	datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);

	if (datagrams > 0 &&
	    copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
		datagrams = -EFAULT;

	return datagrams;
}

#ifdef __ARCH_WANT_SYS_SOCKETCALL
L
Linus Torvalds 已提交
2441 2442
/* Argument list sizes for sys_socketcall */
#define AL(x) ((x) * sizeof(unsigned long))
2443
static const unsigned char nargs[21] = {
2444 2445 2446
	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2447
	AL(4), AL(5), AL(4)
2448 2449
};

L
Linus Torvalds 已提交
2450 2451 2452
#undef AL

/*
2453
 *	System call vectors.
L
Linus Torvalds 已提交
2454 2455 2456
 *
 *	Argument checking cleaned up. Saved 20% in size.
 *  This function doesn't need to set the kernel lock because
2457
 *  it is set by the callees.
L
Linus Torvalds 已提交
2458 2459
 */

2460
SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
L
Linus Torvalds 已提交
2461
{
2462
	unsigned long a[AUDITSC_ARGS];
2463
	unsigned long a0, a1;
L
Linus Torvalds 已提交
2464
	int err;
2465
	unsigned int len;
L
Linus Torvalds 已提交
2466

2467
	if (call < 1 || call > SYS_SENDMMSG)
L
Linus Torvalds 已提交
2468 2469
		return -EINVAL;

2470 2471 2472 2473
	len = nargs[call];
	if (len > sizeof(a))
		return -EINVAL;

L
Linus Torvalds 已提交
2474
	/* copy_from_user should be SMP safe. */
2475
	if (copy_from_user(a, args, len))
L
Linus Torvalds 已提交
2476
		return -EFAULT;
2477

2478 2479 2480
	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
	if (err)
		return err;
2481

2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498
	a0 = a[0];
	a1 = a[1];

	switch (call) {
	case SYS_SOCKET:
		err = sys_socket(a0, a1, a[2]);
		break;
	case SYS_BIND:
		err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
		break;
	case SYS_CONNECT:
		err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
		break;
	case SYS_LISTEN:
		err = sys_listen(a0, a1);
		break;
	case SYS_ACCEPT:
U
Ulrich Drepper 已提交
2499 2500
		err = sys_accept4(a0, (struct sockaddr __user *)a1,
				  (int __user *)a[2], 0);
2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543
		break;
	case SYS_GETSOCKNAME:
		err =
		    sys_getsockname(a0, (struct sockaddr __user *)a1,
				    (int __user *)a[2]);
		break;
	case SYS_GETPEERNAME:
		err =
		    sys_getpeername(a0, (struct sockaddr __user *)a1,
				    (int __user *)a[2]);
		break;
	case SYS_SOCKETPAIR:
		err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
		break;
	case SYS_SEND:
		err = sys_send(a0, (void __user *)a1, a[2], a[3]);
		break;
	case SYS_SENDTO:
		err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
				 (struct sockaddr __user *)a[4], a[5]);
		break;
	case SYS_RECV:
		err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
		break;
	case SYS_RECVFROM:
		err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
				   (struct sockaddr __user *)a[4],
				   (int __user *)a[5]);
		break;
	case SYS_SHUTDOWN:
		err = sys_shutdown(a0, a1);
		break;
	case SYS_SETSOCKOPT:
		err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
		break;
	case SYS_GETSOCKOPT:
		err =
		    sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
				   (int __user *)a[4]);
		break;
	case SYS_SENDMSG:
		err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
		break;
2544 2545 2546
	case SYS_SENDMMSG:
		err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
		break;
2547 2548 2549
	case SYS_RECVMSG:
		err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
		break;
2550 2551 2552 2553
	case SYS_RECVMMSG:
		err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
				   (struct timespec __user *)a[4]);
		break;
U
Ulrich Drepper 已提交
2554 2555 2556
	case SYS_ACCEPT4:
		err = sys_accept4(a0, (struct sockaddr __user *)a1,
				  (int __user *)a[2], a[3]);
U
Ulrich Drepper 已提交
2557
		break;
2558 2559 2560
	default:
		err = -EINVAL;
		break;
L
Linus Torvalds 已提交
2561 2562 2563 2564
	}
	return err;
}

2565
#endif				/* __ARCH_WANT_SYS_SOCKETCALL */
L
Linus Torvalds 已提交
2566

2567 2568 2569 2570
/**
 *	sock_register - add a socket protocol handler
 *	@ops: description of protocol
 *
L
Linus Torvalds 已提交
2571 2572
 *	This function is called by a protocol handler that wants to
 *	advertise its address family, and have it linked into the
2573 2574
 *	socket interface. The value ops->family coresponds to the
 *	socket system call protocol family.
L
Linus Torvalds 已提交
2575
 */
2576
int sock_register(const struct net_proto_family *ops)
L
Linus Torvalds 已提交
2577 2578 2579 2580
{
	int err;

	if (ops->family >= NPROTO) {
2581 2582
		printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
		       NPROTO);
L
Linus Torvalds 已提交
2583 2584
		return -ENOBUFS;
	}
2585 2586

	spin_lock(&net_family_lock);
E
Eric Dumazet 已提交
2587 2588
	if (rcu_dereference_protected(net_families[ops->family],
				      lockdep_is_held(&net_family_lock)))
2589 2590
		err = -EEXIST;
	else {
2591
		rcu_assign_pointer(net_families[ops->family], ops);
L
Linus Torvalds 已提交
2592 2593
		err = 0;
	}
2594 2595
	spin_unlock(&net_family_lock);

2596
	printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
L
Linus Torvalds 已提交
2597 2598
	return err;
}
2599
EXPORT_SYMBOL(sock_register);
L
Linus Torvalds 已提交
2600

2601 2602 2603 2604
/**
 *	sock_unregister - remove a protocol handler
 *	@family: protocol family to remove
 *
L
Linus Torvalds 已提交
2605 2606
 *	This function is called by a protocol handler that wants to
 *	remove its address family, and have it unlinked from the
2607 2608 2609 2610 2611 2612
 *	new socket creation.
 *
 *	If protocol handler is a module, then it can use module reference
 *	counts to protect against new references. If protocol handler is not
 *	a module then it needs to provide its own protection in
 *	the ops->create routine.
L
Linus Torvalds 已提交
2613
 */
2614
void sock_unregister(int family)
L
Linus Torvalds 已提交
2615
{
2616
	BUG_ON(family < 0 || family >= NPROTO);
L
Linus Torvalds 已提交
2617

2618
	spin_lock(&net_family_lock);
2619
	RCU_INIT_POINTER(net_families[family], NULL);
2620 2621 2622 2623
	spin_unlock(&net_family_lock);

	synchronize_rcu();

2624
	printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
L
Linus Torvalds 已提交
2625
}
2626
EXPORT_SYMBOL(sock_unregister);
L
Linus Torvalds 已提交
2627

2628
static int __init sock_init(void)
L
Linus Torvalds 已提交
2629
{
N
Nick Piggin 已提交
2630
	int err;
2631 2632 2633 2634 2635 2636
	/*
	 *      Initialize the network sysctl infrastructure.
	 */
	err = net_sysctl_init();
	if (err)
		goto out;
N
Nick Piggin 已提交
2637

L
Linus Torvalds 已提交
2638
	/*
2639
	 *      Initialize skbuff SLAB cache
L
Linus Torvalds 已提交
2640 2641 2642 2643
	 */
	skb_init();

	/*
2644
	 *      Initialize the protocols module.
L
Linus Torvalds 已提交
2645 2646 2647
	 */

	init_inodecache();
N
Nick Piggin 已提交
2648 2649 2650 2651

	err = register_filesystem(&sock_fs_type);
	if (err)
		goto out_fs;
L
Linus Torvalds 已提交
2652
	sock_mnt = kern_mount(&sock_fs_type);
N
Nick Piggin 已提交
2653 2654 2655 2656
	if (IS_ERR(sock_mnt)) {
		err = PTR_ERR(sock_mnt);
		goto out_mount;
	}
2657 2658

	/* The real protocol initialization is performed in later initcalls.
L
Linus Torvalds 已提交
2659 2660 2661
	 */

#ifdef CONFIG_NETFILTER
2662 2663 2664
	err = netfilter_init();
	if (err)
		goto out;
L
Linus Torvalds 已提交
2665
#endif
2666

2667 2668 2669 2670
#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
	skb_timestamping_init();
#endif

N
Nick Piggin 已提交
2671 2672 2673 2674 2675 2676 2677
out:
	return err;

out_mount:
	unregister_filesystem(&sock_fs_type);
out_fs:
	goto out;
L
Linus Torvalds 已提交
2678 2679
}

2680 2681
core_initcall(sock_init);	/* early initcall */

L
Linus Torvalds 已提交
2682 2683 2684 2685 2686 2687
#ifdef CONFIG_PROC_FS
void socket_seq_show(struct seq_file *seq)
{
	int cpu;
	int counter = 0;

2688
	for_each_possible_cpu(cpu)
2689
	    counter += per_cpu(sockets_in_use, cpu);
L
Linus Torvalds 已提交
2690 2691 2692 2693 2694 2695 2696

	/* It can be negative, by the way. 8) */
	if (counter < 0)
		counter = 0;

	seq_printf(seq, "sockets: used %d\n", counter);
}
2697
#endif				/* CONFIG_PROC_FS */
L
Linus Torvalds 已提交
2698

2699
#ifdef CONFIG_COMPAT
2700
static int do_siocgstamp(struct net *net, struct socket *sock,
2701
			 unsigned int cmd, void __user *up)
2702 2703 2704 2705 2706 2707
{
	mm_segment_t old_fs = get_fs();
	struct timeval ktv;
	int err;

	set_fs(KERNEL_DS);
2708
	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2709
	set_fs(old_fs);
2710
	if (!err)
2711
		err = compat_put_timeval(&ktv, up);
2712

2713 2714 2715
	return err;
}

2716
static int do_siocgstampns(struct net *net, struct socket *sock,
2717
			   unsigned int cmd, void __user *up)
2718 2719 2720 2721 2722 2723
{
	mm_segment_t old_fs = get_fs();
	struct timespec kts;
	int err;

	set_fs(KERNEL_DS);
2724
	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2725
	set_fs(old_fs);
2726
	if (!err)
2727
		err = compat_put_timespec(&kts, up);
2728

2729 2730 2731
	return err;
}

2732
static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2733 2734 2735 2736 2737
{
	struct ifreq __user *uifr;
	int err;

	uifr = compat_alloc_user_space(sizeof(struct ifreq));
2738
	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2739 2740
		return -EFAULT;

2741
	err = dev_ioctl(net, SIOCGIFNAME, uifr);
2742 2743 2744
	if (err)
		return err;

2745
	if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2746 2747 2748 2749 2750
		return -EFAULT;

	return 0;
}

2751
static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2752
{
2753
	struct compat_ifconf ifc32;
2754 2755
	struct ifconf ifc;
	struct ifconf __user *uifc;
2756
	struct compat_ifreq __user *ifr32;
2757 2758 2759 2760
	struct ifreq __user *ifr;
	unsigned int i, j;
	int err;

2761
	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2762 2763
		return -EFAULT;

2764
	memset(&ifc, 0, sizeof(ifc));
2765 2766 2767 2768 2769 2770
	if (ifc32.ifcbuf == 0) {
		ifc32.ifc_len = 0;
		ifc.ifc_len = 0;
		ifc.ifc_req = NULL;
		uifc = compat_alloc_user_space(sizeof(struct ifconf));
	} else {
2771 2772
		size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
			sizeof(struct ifreq);
2773 2774 2775 2776
		uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
		ifc.ifc_len = len;
		ifr = ifc.ifc_req = (void __user *)(uifc + 1);
		ifr32 = compat_ptr(ifc32.ifcbuf);
2777
		for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2778
			if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2779 2780 2781 2782 2783 2784 2785 2786
				return -EFAULT;
			ifr++;
			ifr32++;
		}
	}
	if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
		return -EFAULT;

2787
	err = dev_ioctl(net, SIOCGIFCONF, uifc);
2788 2789 2790 2791 2792 2793 2794 2795 2796
	if (err)
		return err;

	if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
		return -EFAULT;

	ifr = ifc.ifc_req;
	ifr32 = compat_ptr(ifc32.ifcbuf);
	for (i = 0, j = 0;
2797 2798 2799
	     i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
	     i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
		if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2800 2801 2802 2803 2804 2805 2806 2807 2808 2809
			return -EFAULT;
		ifr32++;
		ifr++;
	}

	if (ifc32.ifcbuf == 0) {
		/* Translate from 64-bit structure multiple to
		 * a 32-bit one.
		 */
		i = ifc.ifc_len;
2810
		i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2811 2812 2813 2814
		ifc32.ifc_len = i;
	} else {
		ifc32.ifc_len = i;
	}
2815
	if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2816 2817 2818 2819 2820
		return -EFAULT;

	return 0;
}

2821
static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2822
{
2823 2824 2825 2826
	struct compat_ethtool_rxnfc __user *compat_rxnfc;
	bool convert_in = false, convert_out = false;
	size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
	struct ethtool_rxnfc __user *rxnfc;
2827
	struct ifreq __user *ifr;
2828 2829
	u32 rule_cnt = 0, actual_rule_cnt;
	u32 ethcmd;
2830
	u32 data;
2831
	int ret;
2832

2833 2834
	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
		return -EFAULT;
2835

2836 2837 2838
	compat_rxnfc = compat_ptr(data);

	if (get_user(ethcmd, &compat_rxnfc->cmd))
2839 2840
		return -EFAULT;

2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857
	/* Most ethtool structures are defined without padding.
	 * Unfortunately struct ethtool_rxnfc is an exception.
	 */
	switch (ethcmd) {
	default:
		break;
	case ETHTOOL_GRXCLSRLALL:
		/* Buffer size is variable */
		if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
			return -EFAULT;
		if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
			return -ENOMEM;
		buf_size += rule_cnt * sizeof(u32);
		/* fall through */
	case ETHTOOL_GRXRINGS:
	case ETHTOOL_GRXCLSRLCNT:
	case ETHTOOL_GRXCLSRULE:
2858
	case ETHTOOL_SRXCLSRLINS:
2859 2860 2861 2862 2863 2864 2865 2866 2867
		convert_out = true;
		/* fall through */
	case ETHTOOL_SRXCLSRLDEL:
		buf_size += sizeof(struct ethtool_rxnfc);
		convert_in = true;
		break;
	}

	ifr = compat_alloc_user_space(buf_size);
S
Stephen Hemminger 已提交
2868
	rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
2869 2870

	if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2871 2872
		return -EFAULT;

2873 2874
	if (put_user(convert_in ? rxnfc : compat_ptr(data),
		     &ifr->ifr_ifru.ifru_data))
2875 2876
		return -EFAULT;

2877
	if (convert_in) {
2878
		/* We expect there to be holes between fs.m_ext and
2879 2880
		 * fs.ring_cookie and at the end of fs, but nowhere else.
		 */
2881 2882 2883 2884
		BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
			     sizeof(compat_rxnfc->fs.m_ext) !=
			     offsetof(struct ethtool_rxnfc, fs.m_ext) +
			     sizeof(rxnfc->fs.m_ext));
2885 2886 2887 2888 2889 2890 2891
		BUILD_BUG_ON(
			offsetof(struct compat_ethtool_rxnfc, fs.location) -
			offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
			offsetof(struct ethtool_rxnfc, fs.location) -
			offsetof(struct ethtool_rxnfc, fs.ring_cookie));

		if (copy_in_user(rxnfc, compat_rxnfc,
S
Stephen Hemminger 已提交
2892 2893
				 (void __user *)(&rxnfc->fs.m_ext + 1) -
				 (void __user *)rxnfc) ||
2894 2895
		    copy_in_user(&rxnfc->fs.ring_cookie,
				 &compat_rxnfc->fs.ring_cookie,
S
Stephen Hemminger 已提交
2896 2897
				 (void __user *)(&rxnfc->fs.location + 1) -
				 (void __user *)&rxnfc->fs.ring_cookie) ||
2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908
		    copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
				 sizeof(rxnfc->rule_cnt)))
			return -EFAULT;
	}

	ret = dev_ioctl(net, SIOCETHTOOL, ifr);
	if (ret)
		return ret;

	if (convert_out) {
		if (copy_in_user(compat_rxnfc, rxnfc,
S
Stephen Hemminger 已提交
2909 2910
				 (const void __user *)(&rxnfc->fs.m_ext + 1) -
				 (const void __user *)rxnfc) ||
2911 2912
		    copy_in_user(&compat_rxnfc->fs.ring_cookie,
				 &rxnfc->fs.ring_cookie,
S
Stephen Hemminger 已提交
2913 2914
				 (const void __user *)(&rxnfc->fs.location + 1) -
				 (const void __user *)&rxnfc->fs.ring_cookie) ||
2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939
		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
				 sizeof(rxnfc->rule_cnt)))
			return -EFAULT;

		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
			/* As an optimisation, we only copy the actual
			 * number of rules that the underlying
			 * function returned.  Since Mallory might
			 * change the rule count in user memory, we
			 * check that it is less than the rule count
			 * originally given (as the user buffer size),
			 * which has been range-checked.
			 */
			if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
				return -EFAULT;
			if (actual_rule_cnt < rule_cnt)
				rule_cnt = actual_rule_cnt;
			if (copy_in_user(&compat_rxnfc->rule_locs[0],
					 &rxnfc->rule_locs[0],
					 rule_cnt * sizeof(u32)))
				return -EFAULT;
		}
	}

	return 0;
2940 2941
}

2942 2943 2944 2945 2946 2947
static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
{
	void __user *uptr;
	compat_uptr_t uptr32;
	struct ifreq __user *uifr;

2948
	uifr = compat_alloc_user_space(sizeof(*uifr));
2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962
	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
		return -EFAULT;

	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
		return -EFAULT;

	uptr = compat_ptr(uptr32);

	if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
		return -EFAULT;

	return dev_ioctl(net, SIOCWANDEV, uifr);
}

2963 2964
static int bond_ioctl(struct net *net, unsigned int cmd,
			 struct compat_ifreq __user *ifr32)
2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977
{
	struct ifreq kifr;
	struct ifreq __user *uifr;
	mm_segment_t old_fs;
	int err;
	u32 data;
	void __user *datap;

	switch (cmd) {
	case SIOCBONDENSLAVE:
	case SIOCBONDRELEASE:
	case SIOCBONDSETHWADDR:
	case SIOCBONDCHANGEACTIVE:
2978
		if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2979 2980 2981
			return -EFAULT;

		old_fs = get_fs();
2982
		set_fs(KERNEL_DS);
2983 2984
		err = dev_ioctl(net, cmd,
				(struct ifreq __user __force *) &kifr);
2985
		set_fs(old_fs);
2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000

		return err;
	case SIOCBONDSLAVEINFOQUERY:
	case SIOCBONDINFOQUERY:
		uifr = compat_alloc_user_space(sizeof(*uifr));
		if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
			return -EFAULT;

		if (get_user(data, &ifr32->ifr_ifru.ifru_data))
			return -EFAULT;

		datap = compat_ptr(data);
		if (put_user(datap, &uifr->ifr_ifru.ifru_data))
			return -EFAULT;

3001
		return dev_ioctl(net, cmd, uifr);
3002
	default:
3003
		return -ENOIOCTLCMD;
3004
	}
3005 3006
}

3007 3008
static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
				 struct compat_ifreq __user *u_ifreq32)
3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032
{
	struct ifreq __user *u_ifreq64;
	char tmp_buf[IFNAMSIZ];
	void __user *data64;
	u32 data32;

	if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
			   IFNAMSIZ))
		return -EFAULT;
	if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
		return -EFAULT;
	data64 = compat_ptr(data32);

	u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));

	/* Don't check these user accesses, just let that get trapped
	 * in the ioctl handler instead.
	 */
	if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
			 IFNAMSIZ))
		return -EFAULT;
	if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
		return -EFAULT;

3033
	return dev_ioctl(net, cmd, u_ifreq64);
3034 3035
}

3036 3037
static int dev_ifsioc(struct net *net, struct socket *sock,
			 unsigned int cmd, struct compat_ifreq __user *uifr32)
3038
{
3039
	struct ifreq __user *uifr;
3040 3041
	int err;

3042 3043 3044 3045 3046 3047
	uifr = compat_alloc_user_space(sizeof(*uifr));
	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
		return -EFAULT;

	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);

3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059
	if (!err) {
		switch (cmd) {
		case SIOCGIFFLAGS:
		case SIOCGIFMETRIC:
		case SIOCGIFMTU:
		case SIOCGIFMEM:
		case SIOCGIFHWADDR:
		case SIOCGIFINDEX:
		case SIOCGIFADDR:
		case SIOCGIFBRDADDR:
		case SIOCGIFDSTADDR:
		case SIOCGIFNETMASK:
3060
		case SIOCGIFPFLAGS:
3061
		case SIOCGIFTXQLEN:
3062 3063
		case SIOCGMIIPHY:
		case SIOCGMIIREG:
3064
			if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
3065 3066 3067 3068 3069 3070 3071
				err = -EFAULT;
			break;
		}
	}
	return err;
}

3072 3073 3074 3075 3076 3077 3078 3079 3080 3081
static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
			struct compat_ifreq __user *uifr32)
{
	struct ifreq ifr;
	struct compat_ifmap __user *uifmap32;
	mm_segment_t old_fs;
	int err;

	uifmap32 = &uifr32->ifr_ifru.ifru_map;
	err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3082 3083 3084 3085 3086 3087
	err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
	err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
	err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
	err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
	err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
	err |= get_user(ifr.ifr_map.port, &uifmap32->port);
3088 3089 3090 3091
	if (err)
		return -EFAULT;

	old_fs = get_fs();
3092
	set_fs(KERNEL_DS);
3093
	err = dev_ioctl(net, cmd, (void  __user __force *)&ifr);
3094
	set_fs(old_fs);
3095 3096 3097

	if (cmd == SIOCGIFMAP && !err) {
		err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3098 3099 3100 3101 3102 3103
		err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
		err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
		err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
		err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
		err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
		err |= put_user(ifr.ifr_map.port, &uifmap32->port);
3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115
		if (err)
			err = -EFAULT;
	}
	return err;
}

static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
{
	void __user *uptr;
	compat_uptr_t uptr32;
	struct ifreq __user *uifr;

3116
	uifr = compat_alloc_user_space(sizeof(*uifr));
3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130
	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
		return -EFAULT;

	if (get_user(uptr32, &uifr32->ifr_data))
		return -EFAULT;

	uptr = compat_ptr(uptr32);

	if (put_user(uptr, &uifr->ifr_data))
		return -EFAULT;

	return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
}

3131
struct rtentry32 {
3132
	u32		rt_pad1;
3133 3134 3135
	struct sockaddr rt_dst;         /* target address               */
	struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
	struct sockaddr rt_genmask;     /* target network mask (IP)     */
3136 3137 3138 3139 3140 3141 3142
	unsigned short	rt_flags;
	short		rt_pad2;
	u32		rt_pad3;
	unsigned char	rt_tos;
	unsigned char	rt_class;
	short		rt_pad4;
	short		rt_metric;      /* +1 for binary compatibility! */
3143
	/* char * */ u32 rt_dev;        /* forcing the device at add    */
3144 3145
	u32		rt_mtu;         /* per route MTU/Window         */
	u32		rt_window;      /* Window clamping              */
3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161
	unsigned short  rt_irtt;        /* Initial RTT                  */
};

struct in6_rtmsg32 {
	struct in6_addr		rtmsg_dst;
	struct in6_addr		rtmsg_src;
	struct in6_addr		rtmsg_gateway;
	u32			rtmsg_type;
	u16			rtmsg_dst_len;
	u16			rtmsg_src_len;
	u32			rtmsg_metric;
	u32			rtmsg_info;
	u32			rtmsg_flags;
	s32			rtmsg_ifindex;
};

3162 3163
static int routing_ioctl(struct net *net, struct socket *sock,
			 unsigned int cmd, void __user *argp)
3164 3165 3166 3167 3168 3169 3170 3171 3172
{
	int ret;
	void *r = NULL;
	struct in6_rtmsg r6;
	struct rtentry r4;
	char devname[16];
	u32 rtdev;
	mm_segment_t old_fs = get_fs();

3173 3174
	if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
		struct in6_rtmsg32 __user *ur6 = argp;
3175
		ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3176
			3 * sizeof(struct in6_addr));
3177 3178 3179 3180 3181 3182 3183
		ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
		ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
		ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
		ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
		ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
		ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
		ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3184 3185 3186

		r = (void *) &r6;
	} else { /* ipv4 */
3187
		struct rtentry32 __user *ur4 = argp;
3188
		ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3189
					3 * sizeof(struct sockaddr));
3190 3191 3192 3193 3194 3195
		ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
		ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
		ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
		ret |= get_user(r4.rt_window, &(ur4->rt_window));
		ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
		ret |= get_user(rtdev, &(ur4->rt_dev));
3196
		if (rtdev) {
3197
			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3198 3199
			r4.rt_dev = (char __user __force *)devname;
			devname[15] = 0;
3200 3201 3202 3203 3204 3205 3206 3207 3208 3209 3210
		} else
			r4.rt_dev = NULL;

		r = (void *) &r4;
	}

	if (ret) {
		ret = -EFAULT;
		goto out;
	}

3211
	set_fs(KERNEL_DS);
3212
	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3213
	set_fs(old_fs);
3214 3215 3216 3217 3218 3219 3220

out:
	return ret;
}

/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
 * for some operations; this forces use of the newer bridge-utils that
L
Lucas De Marchi 已提交
3221
 * use compatible ioctls
3222
 */
3223
static int old_bridge_ioctl(compat_ulong_t __user *argp)
3224
{
3225
	compat_ulong_t tmp;
3226

3227
	if (get_user(tmp, argp))
3228 3229 3230 3231 3232 3233
		return -EFAULT;
	if (tmp == BRCTL_GET_VERSION)
		return BRCTL_VERSION + 1;
	return -EINVAL;
}

3234 3235 3236 3237 3238 3239
static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
			 unsigned int cmd, unsigned long arg)
{
	void __user *argp = compat_ptr(arg);
	struct sock *sk = sock->sk;
	struct net *net = sock_net(sk);
3240

3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253
	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
		return siocdevprivate_ioctl(net, cmd, argp);

	switch (cmd) {
	case SIOCSIFBR:
	case SIOCGIFBR:
		return old_bridge_ioctl(argp);
	case SIOCGIFNAME:
		return dev_ifname32(net, argp);
	case SIOCGIFCONF:
		return dev_ifconf(net, argp);
	case SIOCETHTOOL:
		return ethtool_ioctl(net, argp);
3254 3255
	case SIOCWANDEV:
		return compat_siocwandev(net, argp);
3256 3257 3258
	case SIOCGIFMAP:
	case SIOCSIFMAP:
		return compat_sioc_ifmap(net, cmd, argp);
3259 3260 3261 3262 3263 3264 3265 3266 3267 3268 3269 3270 3271 3272
	case SIOCBONDENSLAVE:
	case SIOCBONDRELEASE:
	case SIOCBONDSETHWADDR:
	case SIOCBONDSLAVEINFOQUERY:
	case SIOCBONDINFOQUERY:
	case SIOCBONDCHANGEACTIVE:
		return bond_ioctl(net, cmd, argp);
	case SIOCADDRT:
	case SIOCDELRT:
		return routing_ioctl(net, sock, cmd, argp);
	case SIOCGSTAMP:
		return do_siocgstamp(net, sock, cmd, argp);
	case SIOCGSTAMPNS:
		return do_siocgstampns(net, sock, cmd, argp);
3273 3274
	case SIOCSHWTSTAMP:
		return compat_siocshwtstamp(net, argp);
3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296 3297 3298 3299 3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316

	case FIOSETOWN:
	case SIOCSPGRP:
	case FIOGETOWN:
	case SIOCGPGRP:
	case SIOCBRADDBR:
	case SIOCBRDELBR:
	case SIOCGIFVLAN:
	case SIOCSIFVLAN:
	case SIOCADDDLCI:
	case SIOCDELDLCI:
		return sock_ioctl(file, cmd, arg);

	case SIOCGIFFLAGS:
	case SIOCSIFFLAGS:
	case SIOCGIFMETRIC:
	case SIOCSIFMETRIC:
	case SIOCGIFMTU:
	case SIOCSIFMTU:
	case SIOCGIFMEM:
	case SIOCSIFMEM:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
	case SIOCADDMULTI:
	case SIOCDELMULTI:
	case SIOCGIFINDEX:
	case SIOCGIFADDR:
	case SIOCSIFADDR:
	case SIOCSIFHWBROADCAST:
	case SIOCDIFADDR:
	case SIOCGIFBRDADDR:
	case SIOCSIFBRDADDR:
	case SIOCGIFDSTADDR:
	case SIOCSIFDSTADDR:
	case SIOCGIFNETMASK:
	case SIOCSIFNETMASK:
	case SIOCSIFPFLAGS:
	case SIOCGIFPFLAGS:
	case SIOCGIFTXQLEN:
	case SIOCSIFTXQLEN:
	case SIOCBRADDIF:
	case SIOCBRDELIF:
3317 3318 3319 3320
	case SIOCSIFNAME:
	case SIOCGMIIPHY:
	case SIOCGMIIREG:
	case SIOCSMIIREG:
3321
		return dev_ifsioc(net, sock, cmd, argp);
3322

3323 3324 3325 3326
	case SIOCSARP:
	case SIOCGARP:
	case SIOCDARP:
	case SIOCATMARK:
3327 3328 3329
		return sock_do_ioctl(net, sock, cmd, arg);
	}

3330 3331
	return -ENOIOCTLCMD;
}
3332

3333
static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3334
			      unsigned long arg)
3335 3336 3337
{
	struct socket *sock = file->private_data;
	int ret = -ENOIOCTLCMD;
3338 3339 3340 3341 3342
	struct sock *sk;
	struct net *net;

	sk = sock->sk;
	net = sock_net(sk);
3343 3344 3345 3346

	if (sock->ops->compat_ioctl)
		ret = sock->ops->compat_ioctl(sock, cmd, arg);

3347 3348 3349 3350
	if (ret == -ENOIOCTLCMD &&
	    (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
		ret = compat_wext_handle_ioctl(net, cmd, arg);

3351 3352 3353
	if (ret == -ENOIOCTLCMD)
		ret = compat_sock_ioctl_trans(file, sock, cmd, arg);

3354 3355 3356 3357
	return ret;
}
#endif

3358 3359 3360 3361
int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
{
	return sock->ops->bind(sock, addr, addrlen);
}
3362
EXPORT_SYMBOL(kernel_bind);
3363 3364 3365 3366 3367

int kernel_listen(struct socket *sock, int backlog)
{
	return sock->ops->listen(sock, backlog);
}
3368
EXPORT_SYMBOL(kernel_listen);
3369 3370 3371 3372 3373 3374 3375 3376 3377 3378 3379 3380 3381 3382

int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
{
	struct sock *sk = sock->sk;
	int err;

	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
			       newsock);
	if (err < 0)
		goto done;

	err = sock->ops->accept(sock, *newsock, flags);
	if (err < 0) {
		sock_release(*newsock);
3383
		*newsock = NULL;
3384 3385 3386 3387
		goto done;
	}

	(*newsock)->ops = sock->ops;
3388
	__module_get((*newsock)->ops->owner);
3389 3390 3391 3392

done:
	return err;
}
3393
EXPORT_SYMBOL(kernel_accept);
3394 3395

int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3396
		   int flags)
3397 3398 3399
{
	return sock->ops->connect(sock, addr, addrlen, flags);
}
3400
EXPORT_SYMBOL(kernel_connect);
3401 3402 3403 3404 3405 3406

int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
			 int *addrlen)
{
	return sock->ops->getname(sock, addr, addrlen, 0);
}
3407
EXPORT_SYMBOL(kernel_getsockname);
3408 3409 3410 3411 3412 3413

int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
			 int *addrlen)
{
	return sock->ops->getname(sock, addr, addrlen, 1);
}
3414
EXPORT_SYMBOL(kernel_getpeername);
3415 3416 3417 3418 3419

int kernel_getsockopt(struct socket *sock, int level, int optname,
			char *optval, int *optlen)
{
	mm_segment_t oldfs = get_fs();
3420 3421
	char __user *uoptval;
	int __user *uoptlen;
3422 3423
	int err;

3424 3425 3426
	uoptval = (char __user __force *) optval;
	uoptlen = (int __user __force *) optlen;

3427 3428
	set_fs(KERNEL_DS);
	if (level == SOL_SOCKET)
3429
		err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3430
	else
3431 3432
		err = sock->ops->getsockopt(sock, level, optname, uoptval,
					    uoptlen);
3433 3434 3435
	set_fs(oldfs);
	return err;
}
3436
EXPORT_SYMBOL(kernel_getsockopt);
3437 3438

int kernel_setsockopt(struct socket *sock, int level, int optname,
3439
			char *optval, unsigned int optlen)
3440 3441
{
	mm_segment_t oldfs = get_fs();
3442
	char __user *uoptval;
3443 3444
	int err;

3445 3446
	uoptval = (char __user __force *) optval;

3447 3448
	set_fs(KERNEL_DS);
	if (level == SOL_SOCKET)
3449
		err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3450
	else
3451
		err = sock->ops->setsockopt(sock, level, optname, uoptval,
3452 3453 3454 3455
					    optlen);
	set_fs(oldfs);
	return err;
}
3456
EXPORT_SYMBOL(kernel_setsockopt);
3457 3458 3459 3460 3461 3462 3463 3464 3465

int kernel_sendpage(struct socket *sock, struct page *page, int offset,
		    size_t size, int flags)
{
	if (sock->ops->sendpage)
		return sock->ops->sendpage(sock, page, offset, size, flags);

	return sock_no_sendpage(sock, page, offset, size, flags);
}
3466
EXPORT_SYMBOL(kernel_sendpage);
3467 3468 3469 3470 3471 3472 3473 3474 3475 3476 3477 3478

int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
{
	mm_segment_t oldfs = get_fs();
	int err;

	set_fs(KERNEL_DS);
	err = sock->ops->ioctl(sock, cmd, arg);
	set_fs(oldfs);

	return err;
}
3479
EXPORT_SYMBOL(kernel_sock_ioctl);
3480

3481 3482 3483 3484 3485
int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
{
	return sock->ops->shutdown(sock, how);
}
EXPORT_SYMBOL(kernel_sock_shutdown);