sock.c 88.1 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
L
Linus Torvalds 已提交
2 3 4 5 6 7 8 9
/*
 * INET		An implementation of the TCP/IP protocol suite for the LINUX
 *		operating system.  INET is implemented using the  BSD Socket
 *		interface as the means of communication with the user level.
 *
 *		Generic socket support routines. Memory allocators, socket lock/release
 *		handler for protocols to use and generic option handler.
 *
10
 * Authors:	Ross Biro
L
Linus Torvalds 已提交
11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
 *		Florian La Roche, <flla@stud.uni-sb.de>
 *		Alan Cox, <A.Cox@swansea.ac.uk>
 *
 * Fixes:
 *		Alan Cox	: 	Numerous verify_area() problems
 *		Alan Cox	:	Connecting on a connecting socket
 *					now returns an error for tcp.
 *		Alan Cox	:	sock->protocol is set correctly.
 *					and is not sometimes left as 0.
 *		Alan Cox	:	connect handles icmp errors on a
 *					connect properly. Unfortunately there
 *					is a restart syscall nasty there. I
 *					can't match BSD without hacking the C
 *					library. Ideas urgently sought!
 *		Alan Cox	:	Disallow bind() to addresses that are
 *					not ours - especially broadcast ones!!
 *		Alan Cox	:	Socket 1024 _IS_ ok for users. (fencepost)
 *		Alan Cox	:	sock_wfree/sock_rfree don't destroy sockets,
 *					instead they leave that for the DESTROY timer.
 *		Alan Cox	:	Clean up error flag in accept
 *		Alan Cox	:	TCP ack handling is buggy, the DESTROY timer
 *					was buggy. Put a remove_sock() in the handler
 *					for memory when we hit 0. Also altered the timer
35
 *					code. The ACK stuff can wait and needs major
L
Linus Torvalds 已提交
36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85
 *					TCP layer surgery.
 *		Alan Cox	:	Fixed TCP ack bug, removed remove sock
 *					and fixed timer/inet_bh race.
 *		Alan Cox	:	Added zapped flag for TCP
 *		Alan Cox	:	Move kfree_skb into skbuff.c and tidied up surplus code
 *		Alan Cox	:	for new sk_buff allocations wmalloc/rmalloc now call alloc_skb
 *		Alan Cox	:	kfree_s calls now are kfree_skbmem so we can track skb resources
 *		Alan Cox	:	Supports socket option broadcast now as does udp. Packet and raw need fixing.
 *		Alan Cox	:	Added RCVBUF,SNDBUF size setting. It suddenly occurred to me how easy it was so...
 *		Rick Sladkey	:	Relaxed UDP rules for matching packets.
 *		C.E.Hawkins	:	IFF_PROMISC/SIOCGHWADDR support
 *	Pauline Middelink	:	identd support
 *		Alan Cox	:	Fixed connect() taking signals I think.
 *		Alan Cox	:	SO_LINGER supported
 *		Alan Cox	:	Error reporting fixes
 *		Anonymous	:	inet_create tidied up (sk->reuse setting)
 *		Alan Cox	:	inet sockets don't set sk->type!
 *		Alan Cox	:	Split socket option code
 *		Alan Cox	:	Callbacks
 *		Alan Cox	:	Nagle flag for Charles & Johannes stuff
 *		Alex		:	Removed restriction on inet fioctl
 *		Alan Cox	:	Splitting INET from NET core
 *		Alan Cox	:	Fixed bogus SO_TYPE handling in getsockopt()
 *		Adam Caldwell	:	Missing return in SO_DONTROUTE/SO_DEBUG code
 *		Alan Cox	:	Split IP from generic code
 *		Alan Cox	:	New kfree_skbmem()
 *		Alan Cox	:	Make SO_DEBUG superuser only.
 *		Alan Cox	:	Allow anyone to clear SO_DEBUG
 *					(compatibility fix)
 *		Alan Cox	:	Added optimistic memory grabbing for AF_UNIX throughput.
 *		Alan Cox	:	Allocator for a socket is settable.
 *		Alan Cox	:	SO_ERROR includes soft errors.
 *		Alan Cox	:	Allow NULL arguments on some SO_ opts
 *		Alan Cox	: 	Generic socket allocation to make hooks
 *					easier (suggested by Craig Metz).
 *		Michael Pall	:	SO_ERROR returns positive errno again
 *              Steve Whitehouse:       Added default destructor to free
 *                                      protocol private data.
 *              Steve Whitehouse:       Added various other default routines
 *                                      common to several socket families.
 *              Chris Evans     :       Call suser() check last on F_SETOWN
 *		Jay Schulist	:	Added SO_ATTACH_FILTER and SO_DETACH_FILTER.
 *		Andi Kleen	:	Add sock_kmalloc()/sock_kfree_s()
 *		Andi Kleen	:	Fix write_space callback
 *		Chris Evans	:	Security fixes - signedness again
 *		Arnaldo C. Melo :       cleanups, use skb_queue_purge
 *
 * To Fix:
 */

J
Joe Perches 已提交
86 87
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

88
#include <asm/unaligned.h>
89
#include <linux/capability.h>
L
Linus Torvalds 已提交
90
#include <linux/errno.h>
91
#include <linux/errqueue.h>
L
Linus Torvalds 已提交
92 93 94 95 96 97 98 99
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/sched.h>
100
#include <linux/sched/mm.h>
L
Linus Torvalds 已提交
101 102 103 104 105 106 107 108 109 110
#include <linux/timer.h>
#include <linux/string.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/interrupt.h>
#include <linux/poll.h>
#include <linux/tcp.h>
#include <linux/init.h>
A
Al Viro 已提交
111
#include <linux/highmem.h>
112
#include <linux/user_namespace.h>
113
#include <linux/static_key.h>
114
#include <linux/memcontrol.h>
115
#include <linux/prefetch.h>
116
#include <linux/compat.h>
L
Linus Torvalds 已提交
117

118
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
119 120 121 122

#include <linux/netdevice.h>
#include <net/protocol.h>
#include <linux/skbuff.h>
123
#include <net/net_namespace.h>
124
#include <net/request_sock.h>
L
Linus Torvalds 已提交
125
#include <net/sock.h>
126
#include <linux/net_tstamp.h>
L
Linus Torvalds 已提交
127 128
#include <net/xfrm.h>
#include <linux/ipsec.h>
129
#include <net/cls_cgroup.h>
130
#include <net/netprio_cgroup.h>
131
#include <linux/sock_diag.h>
L
Linus Torvalds 已提交
132 133

#include <linux/filter.h>
134
#include <net/sock_reuseport.h>
135
#include <net/bpf_sk_storage.h>
L
Linus Torvalds 已提交
136

137 138
#include <trace/events/sock.h>

L
Linus Torvalds 已提交
139
#include <net/tcp.h>
140
#include <net/busy_poll.h>
E
Eliezer Tamir 已提交
141

142
static DEFINE_MUTEX(proto_list_mutex);
G
Glauber Costa 已提交
143 144
static LIST_HEAD(proto_list);

145 146
static void sock_inuse_add(struct net *net, int val);

147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167
/**
 * sk_ns_capable - General socket capability test
 * @sk: Socket to use a capability on or through
 * @user_ns: The user namespace of the capability to use
 * @cap: The capability to use
 *
 * Test to see if the opener of the socket had when the socket was
 * created and the current process has the capability @cap in the user
 * namespace @user_ns.
 */
bool sk_ns_capable(const struct sock *sk,
		   struct user_namespace *user_ns, int cap)
{
	return file_ns_capable(sk->sk_socket->file, user_ns, cap) &&
		ns_capable(user_ns, cap);
}
EXPORT_SYMBOL(sk_ns_capable);

/**
 * sk_capable - Socket global capability test
 * @sk: Socket to use a capability on or through
168
 * @cap: The global capability to use
169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184
 *
 * Test to see if the opener of the socket had when the socket was
 * created and the current process has the capability @cap in all user
 * namespaces.
 */
bool sk_capable(const struct sock *sk, int cap)
{
	return sk_ns_capable(sk, &init_user_ns, cap);
}
EXPORT_SYMBOL(sk_capable);

/**
 * sk_net_capable - Network namespace socket capability test
 * @sk: Socket to use a capability on or through
 * @cap: The capability to use
 *
185
 * Test to see if the opener of the socket had when the socket was created
186 187 188 189 190 191 192 193 194
 * and the current process has the capability @cap over the network namespace
 * the socket is a member of.
 */
bool sk_net_capable(const struct sock *sk, int cap)
{
	return sk_ns_capable(sk, sock_net(sk)->user_ns, cap);
}
EXPORT_SYMBOL(sk_net_capable);

195 196
/*
 * Each address family might have different locking rules, so we have
197 198
 * one slock key per address family and separate keys for internal and
 * userspace sockets.
199
 */
I
Ingo Molnar 已提交
200
static struct lock_class_key af_family_keys[AF_MAX];
201
static struct lock_class_key af_family_kern_keys[AF_MAX];
I
Ingo Molnar 已提交
202
static struct lock_class_key af_family_slock_keys[AF_MAX];
203
static struct lock_class_key af_family_kern_slock_keys[AF_MAX];
I
Ingo Molnar 已提交
204 205 206 207 208 209

/*
 * Make lock validator output more readable. (we pre-construct these
 * strings build-time, so that runtime initialization of socket
 * locks is fast):
 */
210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225

#define _sock_locks(x)						  \
  x "AF_UNSPEC",	x "AF_UNIX"     ,	x "AF_INET"     , \
  x "AF_AX25"  ,	x "AF_IPX"      ,	x "AF_APPLETALK", \
  x "AF_NETROM",	x "AF_BRIDGE"   ,	x "AF_ATMPVC"   , \
  x "AF_X25"   ,	x "AF_INET6"    ,	x "AF_ROSE"     , \
  x "AF_DECnet",	x "AF_NETBEUI"  ,	x "AF_SECURITY" , \
  x "AF_KEY"   ,	x "AF_NETLINK"  ,	x "AF_PACKET"   , \
  x "AF_ASH"   ,	x "AF_ECONET"   ,	x "AF_ATMSVC"   , \
  x "AF_RDS"   ,	x "AF_SNA"      ,	x "AF_IRDA"     , \
  x "AF_PPPOX" ,	x "AF_WANPIPE"  ,	x "AF_LLC"      , \
  x "27"       ,	x "28"          ,	x "AF_CAN"      , \
  x "AF_TIPC"  ,	x "AF_BLUETOOTH",	x "IUCV"        , \
  x "AF_RXRPC" ,	x "AF_ISDN"     ,	x "AF_PHONET"   , \
  x "AF_IEEE802154",	x "AF_CAIF"	,	x "AF_ALG"      , \
  x "AF_NFC"   ,	x "AF_VSOCK"    ,	x "AF_KCM"      , \
B
Björn Töpel 已提交
226 227
  x "AF_QIPCRTR",	x "AF_SMC"	,	x "AF_XDP"	, \
  x "AF_MAX"
228

229
static const char *const af_family_key_strings[AF_MAX+1] = {
230
	_sock_locks("sk_lock-")
I
Ingo Molnar 已提交
231
};
232
static const char *const af_family_slock_key_strings[AF_MAX+1] = {
233
	_sock_locks("slock-")
I
Ingo Molnar 已提交
234
};
235
static const char *const af_family_clock_key_strings[AF_MAX+1] = {
236 237 238 239 240 241 242 243 244 245 246
	_sock_locks("clock-")
};

static const char *const af_family_kern_key_strings[AF_MAX+1] = {
	_sock_locks("k-sk_lock-")
};
static const char *const af_family_kern_slock_key_strings[AF_MAX+1] = {
	_sock_locks("k-slock-")
};
static const char *const af_family_kern_clock_key_strings[AF_MAX+1] = {
	_sock_locks("k-clock-")
247
};
248
static const char *const af_family_rlock_key_strings[AF_MAX+1] = {
249
	_sock_locks("rlock-")
250 251
};
static const char *const af_family_wlock_key_strings[AF_MAX+1] = {
252
	_sock_locks("wlock-")
253 254
};
static const char *const af_family_elock_key_strings[AF_MAX+1] = {
255
	_sock_locks("elock-")
256
};
257 258

/*
259
 * sk_callback_lock and sk queues locking rules are per-address-family,
260 261 262
 * so split the lock classes by using a per-AF key:
 */
static struct lock_class_key af_callback_keys[AF_MAX];
263 264 265
static struct lock_class_key af_rlock_keys[AF_MAX];
static struct lock_class_key af_wlock_keys[AF_MAX];
static struct lock_class_key af_elock_keys[AF_MAX];
266
static struct lock_class_key af_kern_callback_keys[AF_MAX];
267

L
Linus Torvalds 已提交
268
/* Run time adjustable parameters. */
269
__u32 sysctl_wmem_max __read_mostly = SK_WMEM_MAX;
270
EXPORT_SYMBOL(sysctl_wmem_max);
271
__u32 sysctl_rmem_max __read_mostly = SK_RMEM_MAX;
272
EXPORT_SYMBOL(sysctl_rmem_max);
273 274
__u32 sysctl_wmem_default __read_mostly = SK_WMEM_MAX;
__u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX;
L
Linus Torvalds 已提交
275

L
Lucas De Marchi 已提交
276
/* Maximal space eaten by iovec or ancillary data plus some space */
277
int sysctl_optmem_max __read_mostly = sizeof(unsigned long)*(2*UIO_MAXIOV+512);
E
Eric Dumazet 已提交
278
EXPORT_SYMBOL(sysctl_optmem_max);
L
Linus Torvalds 已提交
279

280 281
int sysctl_tstamp_allow_data __read_mostly = 1;

282 283
DEFINE_STATIC_KEY_FALSE(memalloc_socks_key);
EXPORT_SYMBOL_GPL(memalloc_socks_key);
284

285 286 287 288 289 290 291 292 293 294 295 296
/**
 * sk_set_memalloc - sets %SOCK_MEMALLOC
 * @sk: socket to set it on
 *
 * Set %SOCK_MEMALLOC on a socket for access to emergency reserves.
 * It's the responsibility of the admin to adjust min_free_kbytes
 * to meet the requirements
 */
void sk_set_memalloc(struct sock *sk)
{
	sock_set_flag(sk, SOCK_MEMALLOC);
	sk->sk_allocation |= __GFP_MEMALLOC;
297
	static_branch_inc(&memalloc_socks_key);
298 299 300 301 302 303 304
}
EXPORT_SYMBOL_GPL(sk_set_memalloc);

void sk_clear_memalloc(struct sock *sk)
{
	sock_reset_flag(sk, SOCK_MEMALLOC);
	sk->sk_allocation &= ~__GFP_MEMALLOC;
305
	static_branch_dec(&memalloc_socks_key);
306 307 308

	/*
	 * SOCK_MEMALLOC is allowed to ignore rmem limits to ensure forward
309 310 311 312
	 * progress of swapping. SOCK_MEMALLOC may be cleared while
	 * it has rmem allocations due to the last swapfile being deactivated
	 * but there is a risk that the socket is unusable due to exceeding
	 * the rmem limits. Reclaim the reserves and obey rmem limits again.
313
	 */
314
	sk_mem_reclaim(sk);
315 316 317
}
EXPORT_SYMBOL_GPL(sk_clear_memalloc);

318 319 320
int __sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
{
	int ret;
321
	unsigned int noreclaim_flag;
322 323 324 325

	/* these should have been dropped before queueing */
	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));

326
	noreclaim_flag = memalloc_noreclaim_save();
327
	ret = sk->sk_backlog_rcv(sk, skb);
328
	memalloc_noreclaim_restore(noreclaim_flag);
329 330 331 332 333

	return ret;
}
EXPORT_SYMBOL(__sk_backlog_rcv);

334
static int sock_get_timeout(long timeo, void *optval, bool old_timeval)
335
{
336
	struct __kernel_sock_timeval tv;
337 338 339 340 341 342 343 344 345

	if (timeo == MAX_SCHEDULE_TIMEOUT) {
		tv.tv_sec = 0;
		tv.tv_usec = 0;
	} else {
		tv.tv_sec = timeo / HZ;
		tv.tv_usec = ((timeo % HZ) * USEC_PER_SEC) / HZ;
	}

346
	if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
347 348 349 350 351
		struct old_timeval32 tv32 = { tv.tv_sec, tv.tv_usec };
		*(struct old_timeval32 *)optval = tv32;
		return sizeof(tv32);
	}

352 353 354 355 356
	if (old_timeval) {
		struct __kernel_old_timeval old_tv;
		old_tv.tv_sec = tv.tv_sec;
		old_tv.tv_usec = tv.tv_usec;
		*(struct __kernel_old_timeval *)optval = old_tv;
357
		return sizeof(old_tv);
358 359
	}

360 361
	*(struct __kernel_sock_timeval *)optval = tv;
	return sizeof(tv);
362 363
}

364 365
static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen,
			    bool old_timeval)
L
Linus Torvalds 已提交
366
{
367
	struct __kernel_sock_timeval tv;
L
Linus Torvalds 已提交
368

369
	if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
370 371 372 373 374
		struct old_timeval32 tv32;

		if (optlen < sizeof(tv32))
			return -EINVAL;

375
		if (copy_from_sockptr(&tv32, optval, sizeof(tv32)))
376 377 378
			return -EFAULT;
		tv.tv_sec = tv32.tv_sec;
		tv.tv_usec = tv32.tv_usec;
379 380 381 382 383
	} else if (old_timeval) {
		struct __kernel_old_timeval old_tv;

		if (optlen < sizeof(old_tv))
			return -EINVAL;
384
		if (copy_from_sockptr(&old_tv, optval, sizeof(old_tv)))
385 386 387
			return -EFAULT;
		tv.tv_sec = old_tv.tv_sec;
		tv.tv_usec = old_tv.tv_usec;
388 389 390
	} else {
		if (optlen < sizeof(tv))
			return -EINVAL;
391
		if (copy_from_sockptr(&tv, optval, sizeof(tv)))
392 393
			return -EFAULT;
	}
394 395
	if (tv.tv_usec < 0 || tv.tv_usec >= USEC_PER_SEC)
		return -EDOM;
L
Linus Torvalds 已提交
396

397
	if (tv.tv_sec < 0) {
398 399
		static int warned __read_mostly;

400
		*timeo_p = 0;
401
		if (warned < 10 && net_ratelimit()) {
402
			warned++;
J
Joe Perches 已提交
403 404
			pr_info("%s: `%s' (pid %d) tries to set negative timeout\n",
				__func__, current->comm, task_pid_nr(current));
405
		}
406 407
		return 0;
	}
L
Linus Torvalds 已提交
408 409 410
	*timeo_p = MAX_SCHEDULE_TIMEOUT;
	if (tv.tv_sec == 0 && tv.tv_usec == 0)
		return 0;
411 412
	if (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1))
		*timeo_p = tv.tv_sec * HZ + DIV_ROUND_UP((unsigned long)tv.tv_usec, USEC_PER_SEC / HZ);
L
Linus Torvalds 已提交
413 414 415
	return 0;
}

416 417 418 419 420 421 422 423 424 425 426
static bool sock_needs_netstamp(const struct sock *sk)
{
	switch (sk->sk_family) {
	case AF_UNSPEC:
	case AF_UNIX:
		return false;
	default:
		return true;
	}
}

E
Eric Dumazet 已提交
427
static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
428
{
E
Eric Dumazet 已提交
429 430
	if (sk->sk_flags & flags) {
		sk->sk_flags &= ~flags;
431 432
		if (sock_needs_netstamp(sk) &&
		    !(sk->sk_flags & SK_FLAGS_TIMESTAMP))
433
			net_disable_timestamp();
L
Linus Torvalds 已提交
434 435 436 437
	}
}


438
int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
439
{
440 441
	unsigned long flags;
	struct sk_buff_head *list = &sk->sk_receive_queue;
442

E
Eric Dumazet 已提交
443
	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
E
Eric Dumazet 已提交
444
		atomic_inc(&sk->sk_drops);
445
		trace_sock_rcvqueue_full(sk, skb);
E
Eric Dumazet 已提交
446
		return -ENOMEM;
447 448
	}

449
	if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
E
Eric Dumazet 已提交
450 451
		atomic_inc(&sk->sk_drops);
		return -ENOBUFS;
452 453
	}

454 455
	skb->dev = NULL;
	skb_set_owner_r(skb, sk);
456

E
Eric Dumazet 已提交
457 458 459 460 461
	/* we escape from rcu protected region, make sure we dont leak
	 * a norefcounted dst
	 */
	skb_dst_force(skb);

462
	spin_lock_irqsave(&list->lock, flags);
463
	sock_skb_set_dropcount(sk, skb);
464 465
	__skb_queue_tail(list, skb);
	spin_unlock_irqrestore(&list->lock, flags);
466 467

	if (!sock_flag(sk, SOCK_DEAD))
468
		sk->sk_data_ready(sk);
E
Eric Dumazet 已提交
469
	return 0;
470
}
471 472 473 474 475 476 477 478 479 480 481 482
EXPORT_SYMBOL(__sock_queue_rcv_skb);

int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
	int err;

	err = sk_filter(sk, skb);
	if (err)
		return err;

	return __sock_queue_rcv_skb(sk, skb);
}
483 484
EXPORT_SYMBOL(sock_queue_rcv_skb);

485
int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
486
		     const int nested, unsigned int trim_cap, bool refcounted)
487 488 489
{
	int rc = NET_RX_SUCCESS;

490
	if (sk_filter_trim_cap(sk, skb, trim_cap))
491 492 493 494
		goto discard_and_relse;

	skb->dev = NULL;

495
	if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
496 497 498
		atomic_inc(&sk->sk_drops);
		goto discard_and_relse;
	}
499 500 501 502
	if (nested)
		bh_lock_sock_nested(sk);
	else
		bh_lock_sock(sk);
I
Ingo Molnar 已提交
503 504 505 506 507 508
	if (!sock_owned_by_user(sk)) {
		/*
		 * trylock + unlock semantics:
		 */
		mutex_acquire(&sk->sk_lock.dep_map, 0, 1, _RET_IP_);

P
Peter Zijlstra 已提交
509
		rc = sk_backlog_rcv(sk, skb);
I
Ingo Molnar 已提交
510

511
		mutex_release(&sk->sk_lock.dep_map, _RET_IP_);
512
	} else if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf))) {
Z
Zhu Yi 已提交
513 514 515 516 517
		bh_unlock_sock(sk);
		atomic_inc(&sk->sk_drops);
		goto discard_and_relse;
	}

518 519
	bh_unlock_sock(sk);
out:
520 521
	if (refcounted)
		sock_put(sk);
522 523 524 525 526
	return rc;
discard_and_relse:
	kfree_skb(skb);
	goto out;
}
527
EXPORT_SYMBOL(__sk_receive_skb);
528 529 530

struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
{
E
Eric Dumazet 已提交
531
	struct dst_entry *dst = __sk_dst_get(sk);
532 533

	if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
K
Krishna Kumar 已提交
534
		sk_tx_queue_clear(sk);
535
		sk->sk_dst_pending_confirm = 0;
536
		RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558
		dst_release(dst);
		return NULL;
	}

	return dst;
}
EXPORT_SYMBOL(__sk_dst_check);

struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie)
{
	struct dst_entry *dst = sk_dst_get(sk);

	if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
		sk_dst_reset(sk);
		dst_release(dst);
		return NULL;
	}

	return dst;
}
EXPORT_SYMBOL(sk_dst_check);

C
Christoph Hellwig 已提交
559
static int sock_bindtoindex_locked(struct sock *sk, int ifindex)
560 561 562
{
	int ret = -ENOPROTOOPT;
#ifdef CONFIG_NETDEVICES
563
	struct net *net = sock_net(sk);
564 565 566

	/* Sorry... */
	ret = -EPERM;
567
	if (sk->sk_bound_dev_if && !ns_capable(net->user_ns, CAP_NET_RAW))
568 569
		goto out;

570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586
	ret = -EINVAL;
	if (ifindex < 0)
		goto out;

	sk->sk_bound_dev_if = ifindex;
	if (sk->sk_prot->rehash)
		sk->sk_prot->rehash(sk);
	sk_dst_reset(sk);

	ret = 0;

out:
#endif

	return ret;
}

587
int sock_bindtoindex(struct sock *sk, int ifindex, bool lock_sk)
C
Christoph Hellwig 已提交
588 589 590
{
	int ret;

591 592
	if (lock_sk)
		lock_sock(sk);
C
Christoph Hellwig 已提交
593
	ret = sock_bindtoindex_locked(sk, ifindex);
594 595
	if (lock_sk)
		release_sock(sk);
C
Christoph Hellwig 已提交
596 597 598 599 600

	return ret;
}
EXPORT_SYMBOL(sock_bindtoindex);

601
static int sock_setbindtodevice(struct sock *sk, sockptr_t optval, int optlen)
602 603 604 605 606 607 608
{
	int ret = -ENOPROTOOPT;
#ifdef CONFIG_NETDEVICES
	struct net *net = sock_net(sk);
	char devname[IFNAMSIZ];
	int index;

609 610 611 612 613 614 615 616 617 618 619 620 621 622
	ret = -EINVAL;
	if (optlen < 0)
		goto out;

	/* Bind this socket to a particular device like "eth0",
	 * as specified in the passed interface name. If the
	 * name is "" or the option length is zero the socket
	 * is not bound.
	 */
	if (optlen > IFNAMSIZ - 1)
		optlen = IFNAMSIZ - 1;
	memset(devname, 0, sizeof(devname));

	ret = -EFAULT;
623
	if (copy_from_sockptr(devname, optval, optlen))
624 625
		goto out;

626 627
	index = 0;
	if (devname[0] != '\0') {
628
		struct net_device *dev;
629

630 631 632 633 634
		rcu_read_lock();
		dev = dev_get_by_name_rcu(net, devname);
		if (dev)
			index = dev->ifindex;
		rcu_read_unlock();
635 636 637 638 639
		ret = -ENODEV;
		if (!dev)
			goto out;
	}

640
	return sock_bindtoindex(sk, index, true);
641 642 643 644 645 646
out:
#endif

	return ret;
}

647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663
static int sock_getbindtodevice(struct sock *sk, char __user *optval,
				int __user *optlen, int len)
{
	int ret = -ENOPROTOOPT;
#ifdef CONFIG_NETDEVICES
	struct net *net = sock_net(sk);
	char devname[IFNAMSIZ];

	if (sk->sk_bound_dev_if == 0) {
		len = 0;
		goto zero;
	}

	ret = -EINVAL;
	if (len < IFNAMSIZ)
		goto out;

664 665
	ret = netdev_get_name(net, devname, sk->sk_bound_dev_if);
	if (ret)
666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686
		goto out;

	len = strlen(devname) + 1;

	ret = -EFAULT;
	if (copy_to_user(optval, devname, len))
		goto out;

zero:
	ret = -EFAULT;
	if (put_user(len, optlen))
		goto out;

	ret = 0;

out:
#endif

	return ret;
}

687 688 689 690 691 692 693 694 695 696 697 698 699 700
bool sk_mc_loop(struct sock *sk)
{
	if (dev_recursion_level())
		return false;
	if (!sk)
		return true;
	switch (sk->sk_family) {
	case AF_INET:
		return inet_sk(sk)->mc_loop;
#if IS_ENABLED(CONFIG_IPV6)
	case AF_INET6:
		return inet6_sk(sk)->mc_loop;
#endif
	}
701
	WARN_ON_ONCE(1);
702 703 704 705
	return true;
}
EXPORT_SYMBOL(sk_mc_loop);

C
Christoph Hellwig 已提交
706 707 708 709 710 711 712 713
void sock_set_reuseaddr(struct sock *sk)
{
	lock_sock(sk);
	sk->sk_reuse = SK_CAN_REUSE;
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_reuseaddr);

C
Christoph Hellwig 已提交
714 715 716 717 718 719 720 721
void sock_set_reuseport(struct sock *sk)
{
	lock_sock(sk);
	sk->sk_reuseport = true;
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_reuseport);

C
Christoph Hellwig 已提交
722 723 724 725 726 727 728 729 730
void sock_no_linger(struct sock *sk)
{
	lock_sock(sk);
	sk->sk_lingertime = 0;
	sock_set_flag(sk, SOCK_LINGER);
	release_sock(sk);
}
EXPORT_SYMBOL(sock_no_linger);

C
Christoph Hellwig 已提交
731 732 733 734 735 736 737 738
void sock_set_priority(struct sock *sk, u32 priority)
{
	lock_sock(sk);
	sk->sk_priority = priority;
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_priority);

C
Christoph Hellwig 已提交
739 740 741 742 743 744 745 746 747 748 749
void sock_set_sndtimeo(struct sock *sk, s64 secs)
{
	lock_sock(sk);
	if (secs && secs < MAX_SCHEDULE_TIMEOUT / HZ - 1)
		sk->sk_sndtimeo = secs * HZ;
	else
		sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_sndtimeo);

750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771
static void __sock_set_timestamps(struct sock *sk, bool val, bool new, bool ns)
{
	if (val)  {
		sock_valbool_flag(sk, SOCK_TSTAMP_NEW, new);
		sock_valbool_flag(sk, SOCK_RCVTSTAMPNS, ns);
		sock_set_flag(sk, SOCK_RCVTSTAMP);
		sock_enable_timestamp(sk, SOCK_TIMESTAMP);
	} else {
		sock_reset_flag(sk, SOCK_RCVTSTAMP);
		sock_reset_flag(sk, SOCK_RCVTSTAMPNS);
		sock_reset_flag(sk, SOCK_TSTAMP_NEW);
	}
}

void sock_enable_timestamps(struct sock *sk)
{
	lock_sock(sk);
	__sock_set_timestamps(sk, true, false, true);
	release_sock(sk);
}
EXPORT_SYMBOL(sock_enable_timestamps);

C
Christoph Hellwig 已提交
772 773 774 775 776 777 778 779 780 781
void sock_set_keepalive(struct sock *sk)
{
	lock_sock(sk);
	if (sk->sk_prot->keepalive)
		sk->sk_prot->keepalive(sk, true);
	sock_valbool_flag(sk, SOCK_KEEPOPEN, true);
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_keepalive);

C
Christoph Hellwig 已提交
782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810
static void __sock_set_rcvbuf(struct sock *sk, int val)
{
	/* Ensure val * 2 fits into an int, to prevent max_t() from treating it
	 * as a negative value.
	 */
	val = min_t(int, val, INT_MAX / 2);
	sk->sk_userlocks |= SOCK_RCVBUF_LOCK;

	/* We double it on the way in to account for "struct sk_buff" etc.
	 * overhead.   Applications assume that the SO_RCVBUF setting they make
	 * will allow that much actual data to be received on that socket.
	 *
	 * Applications are unaware that "struct sk_buff" and other overheads
	 * allocate from the receive buffer during socket buffer allocation.
	 *
	 * And after considering the possible alternatives, returning the value
	 * we actually used in getsockopt is the most desirable behavior.
	 */
	WRITE_ONCE(sk->sk_rcvbuf, max_t(int, val * 2, SOCK_MIN_RCVBUF));
}

void sock_set_rcvbuf(struct sock *sk, int val)
{
	lock_sock(sk);
	__sock_set_rcvbuf(sk, val);
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_rcvbuf);

A
Alexander Aring 已提交
811 812 813 814 815 816 817 818
void sock_set_mark(struct sock *sk, u32 val)
{
	lock_sock(sk);
	sk->sk_mark = val;
	release_sock(sk);
}
EXPORT_SYMBOL(sock_set_mark);

L
Linus Torvalds 已提交
819 820 821 822 823 824
/*
 *	This is meant for all protocols to use and covers goings on
 *	at the socket level. Everything here is generic.
 */

int sock_setsockopt(struct socket *sock, int level, int optname,
825
		    sockptr_t optval, unsigned int optlen)
L
Linus Torvalds 已提交
826
{
827
	struct sock_txtime sk_txtime;
E
Eric Dumazet 已提交
828
	struct sock *sk = sock->sk;
L
Linus Torvalds 已提交
829 830 831 832
	int val;
	int valbool;
	struct linger ling;
	int ret = 0;
833

L
Linus Torvalds 已提交
834 835 836 837
	/*
	 *	Options without arguments
	 */

838
	if (optname == SO_BINDTODEVICE)
839
		return sock_setbindtodevice(sk, optval, optlen);
840

841 842
	if (optlen < sizeof(int))
		return -EINVAL;
843

844
	if (copy_from_sockptr(&val, optval, sizeof(val)))
L
Linus Torvalds 已提交
845
		return -EFAULT;
846

E
Eric Dumazet 已提交
847
	valbool = val ? 1 : 0;
L
Linus Torvalds 已提交
848 849 850

	lock_sock(sk);

E
Eric Dumazet 已提交
851
	switch (optname) {
852
	case SO_DEBUG:
E
Eric Dumazet 已提交
853
		if (val && !capable(CAP_NET_ADMIN))
854
			ret = -EACCES;
E
Eric Dumazet 已提交
855
		else
856
			sock_valbool_flag(sk, SOCK_DBG, valbool);
857 858
		break;
	case SO_REUSEADDR:
859
		sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
860
		break;
T
Tom Herbert 已提交
861 862 863
	case SO_REUSEPORT:
		sk->sk_reuseport = valbool;
		break;
864
	case SO_TYPE:
865
	case SO_PROTOCOL:
866
	case SO_DOMAIN:
867 868 869 870
	case SO_ERROR:
		ret = -ENOPROTOOPT;
		break;
	case SO_DONTROUTE:
871
		sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);
872
		sk_dst_reset(sk);
873 874 875 876 877 878
		break;
	case SO_BROADCAST:
		sock_valbool_flag(sk, SOCK_BROADCAST, valbool);
		break;
	case SO_SNDBUF:
		/* Don't error on this BSD doesn't and if you think
879 880 881 882 883
		 * about it this is right. Otherwise apps have to
		 * play 'guess the biggest size' games. RCVBUF/SNDBUF
		 * are treated in BSD as hints
		 */
		val = min_t(u32, val, sysctl_wmem_max);
884
set_sndbuf:
885 886 887 888
		/* Ensure val * 2 fits into an int, to prevent max_t()
		 * from treating it as a negative value.
		 */
		val = min_t(int, val, INT_MAX / 2);
889
		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
890 891
		WRITE_ONCE(sk->sk_sndbuf,
			   max_t(int, val * 2, SOCK_MIN_SNDBUF));
892
		/* Wake up sending tasks if we upped the value. */
893 894
		sk->sk_write_space(sk);
		break;
L
Linus Torvalds 已提交
895

896 897 898 899 900
	case SO_SNDBUFFORCE:
		if (!capable(CAP_NET_ADMIN)) {
			ret = -EPERM;
			break;
		}
901 902 903 904 905 906

		/* No negative values (to prevent underflow, as val will be
		 * multiplied by 2).
		 */
		if (val < 0)
			val = 0;
907
		goto set_sndbuf;
908

909 910
	case SO_RCVBUF:
		/* Don't error on this BSD doesn't and if you think
911 912 913 914
		 * about it this is right. Otherwise apps have to
		 * play 'guess the biggest size' games. RCVBUF/SNDBUF
		 * are treated in BSD as hints
		 */
C
Christoph Hellwig 已提交
915
		__sock_set_rcvbuf(sk, min_t(u32, val, sysctl_rmem_max));
916 917 918 919 920
		break;

	case SO_RCVBUFFORCE:
		if (!capable(CAP_NET_ADMIN)) {
			ret = -EPERM;
L
Linus Torvalds 已提交
921
			break;
922
		}
923 924 925 926

		/* No negative values (to prevent underflow, as val will be
		 * multiplied by 2).
		 */
C
Christoph Hellwig 已提交
927 928
		__sock_set_rcvbuf(sk, max(val, 0));
		break;
L
Linus Torvalds 已提交
929

930
	case SO_KEEPALIVE:
931 932
		if (sk->sk_prot->keepalive)
			sk->sk_prot->keepalive(sk, valbool);
933 934 935 936 937 938 939 940
		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
		break;

	case SO_OOBINLINE:
		sock_valbool_flag(sk, SOCK_URGINLINE, valbool);
		break;

	case SO_NO_CHECK:
941
		sk->sk_no_check_tx = valbool;
942 943 944
		break;

	case SO_PRIORITY:
945 946
		if ((val >= 0 && val <= 6) ||
		    ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
947 948 949 950 951 952 953 954
			sk->sk_priority = val;
		else
			ret = -EPERM;
		break;

	case SO_LINGER:
		if (optlen < sizeof(ling)) {
			ret = -EINVAL;	/* 1003.1g */
L
Linus Torvalds 已提交
955
			break;
956
		}
957
		if (copy_from_sockptr(&ling, optval, sizeof(ling))) {
958
			ret = -EFAULT;
L
Linus Torvalds 已提交
959
			break;
960 961 962 963
		}
		if (!ling.l_onoff)
			sock_reset_flag(sk, SOCK_LINGER);
		else {
L
Linus Torvalds 已提交
964
#if (BITS_PER_LONG == 32)
965 966
			if ((unsigned int)ling.l_linger >= MAX_SCHEDULE_TIMEOUT/HZ)
				sk->sk_lingertime = MAX_SCHEDULE_TIMEOUT;
L
Linus Torvalds 已提交
967
			else
968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983
#endif
				sk->sk_lingertime = (unsigned int)ling.l_linger * HZ;
			sock_set_flag(sk, SOCK_LINGER);
		}
		break;

	case SO_BSDCOMPAT:
		break;

	case SO_PASSCRED:
		if (valbool)
			set_bit(SOCK_PASSCRED, &sock->flags);
		else
			clear_bit(SOCK_PASSCRED, &sock->flags);
		break;

984
	case SO_TIMESTAMP_OLD:
985 986
		__sock_set_timestamps(sk, valbool, false, false);
		break;
987
	case SO_TIMESTAMP_NEW:
988 989
		__sock_set_timestamps(sk, valbool, true, false);
		break;
990
	case SO_TIMESTAMPNS_OLD:
991 992
		__sock_set_timestamps(sk, valbool, false, true);
		break;
993
	case SO_TIMESTAMPNS_NEW:
994
		__sock_set_timestamps(sk, valbool, true, true);
995
		break;
D
Deepa Dinamani 已提交
996 997
	case SO_TIMESTAMPING_NEW:
		sock_set_flag(sk, SOCK_TSTAMP_NEW);
998
		/* fall through */
999
	case SO_TIMESTAMPING_OLD:
1000
		if (val & ~SOF_TIMESTAMPING_MASK) {
1001
			ret = -EINVAL;
1002 1003
			break;
		}
1004

1005
		if (val & SOF_TIMESTAMPING_OPT_ID &&
1006
		    !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
1007 1008
			if (sk->sk_protocol == IPPROTO_TCP &&
			    sk->sk_type == SOCK_STREAM) {
1009 1010
				if ((1 << sk->sk_state) &
				    (TCPF_CLOSE | TCPF_LISTEN)) {
1011 1012 1013 1014 1015 1016 1017 1018
					ret = -EINVAL;
					break;
				}
				sk->sk_tskey = tcp_sk(sk)->snd_una;
			} else {
				sk->sk_tskey = 0;
			}
		}
1019 1020 1021 1022 1023 1024 1025

		if (val & SOF_TIMESTAMPING_OPT_STATS &&
		    !(val & SOF_TIMESTAMPING_OPT_TSONLY)) {
			ret = -EINVAL;
			break;
		}

1026
		sk->sk_tsflags = val;
1027 1028 1029
		if (val & SOF_TIMESTAMPING_RX_SOFTWARE)
			sock_enable_timestamp(sk,
					      SOCK_TIMESTAMPING_RX_SOFTWARE);
D
Deepa Dinamani 已提交
1030 1031 1032 1033
		else {
			if (optname == SO_TIMESTAMPING_NEW)
				sock_reset_flag(sk, SOCK_TSTAMP_NEW);

1034
			sock_disable_timestamp(sk,
E
Eric Dumazet 已提交
1035
					       (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE));
D
Deepa Dinamani 已提交
1036
		}
1037 1038
		break;

1039 1040 1041
	case SO_RCVLOWAT:
		if (val < 0)
			val = INT_MAX;
1042 1043 1044
		if (sock->ops->set_rcvlowat)
			ret = sock->ops->set_rcvlowat(sk, val);
		else
1045
			WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
1046 1047
		break;

1048
	case SO_RCVTIMEO_OLD:
1049
	case SO_RCVTIMEO_NEW:
1050
		ret = sock_set_timeout(&sk->sk_rcvtimeo, optval,
1051
				       optlen, optname == SO_RCVTIMEO_OLD);
1052 1053
		break;

1054
	case SO_SNDTIMEO_OLD:
1055
	case SO_SNDTIMEO_NEW:
1056
		ret = sock_set_timeout(&sk->sk_sndtimeo, optval,
1057
				       optlen, optname == SO_SNDTIMEO_OLD);
1058
		break;
L
Linus Torvalds 已提交
1059

1060 1061
	case SO_ATTACH_FILTER: {
		struct sock_fprog fprog;
1062

1063
		ret = copy_bpf_fprog_from_user(&fprog, optval, optlen);
1064
		if (!ret)
1065 1066
			ret = sk_attach_filter(&fprog, sk);
		break;
1067
	}
1068 1069 1070 1071 1072 1073
	case SO_ATTACH_BPF:
		ret = -EINVAL;
		if (optlen == sizeof(u32)) {
			u32 ufd;

			ret = -EFAULT;
1074
			if (copy_from_sockptr(&ufd, optval, sizeof(ufd)))
1075 1076 1077 1078 1079 1080
				break;

			ret = sk_attach_bpf(ufd, sk);
		}
		break;

1081 1082
	case SO_ATTACH_REUSEPORT_CBPF: {
		struct sock_fprog fprog;
1083

1084
		ret = copy_bpf_fprog_from_user(&fprog, optval, optlen);
1085
		if (!ret)
1086 1087
			ret = sk_reuseport_attach_filter(&fprog, sk);
		break;
1088
	}
1089 1090 1091 1092 1093 1094
	case SO_ATTACH_REUSEPORT_EBPF:
		ret = -EINVAL;
		if (optlen == sizeof(u32)) {
			u32 ufd;

			ret = -EFAULT;
1095
			if (copy_from_sockptr(&ufd, optval, sizeof(ufd)))
1096 1097 1098 1099 1100 1101
				break;

			ret = sk_reuseport_attach_bpf(ufd, sk);
		}
		break;

1102 1103 1104 1105
	case SO_DETACH_REUSEPORT_BPF:
		ret = reuseport_detach_prog(sk);
		break;

1106
	case SO_DETACH_FILTER:
1107
		ret = sk_detach_filter(sk);
1108
		break;
L
Linus Torvalds 已提交
1109

1110 1111 1112 1113 1114 1115 1116
	case SO_LOCK_FILTER:
		if (sock_flag(sk, SOCK_FILTER_LOCKED) && !valbool)
			ret = -EPERM;
		else
			sock_valbool_flag(sk, SOCK_FILTER_LOCKED, valbool);
		break;

1117 1118 1119 1120 1121 1122
	case SO_PASSSEC:
		if (valbool)
			set_bit(SOCK_PASSSEC, &sock->flags);
		else
			clear_bit(SOCK_PASSSEC, &sock->flags);
		break;
1123
	case SO_MARK:
1124
		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
1125
			ret = -EPERM;
1126
		} else if (val != sk->sk_mark) {
1127
			sk->sk_mark = val;
1128 1129
			sk_dst_reset(sk);
		}
1130
		break;
C
Catherine Zhang 已提交
1131

1132
	case SO_RXQ_OVFL:
1133
		sock_valbool_flag(sk, SOCK_RXQ_OVFL, valbool);
1134
		break;
1135 1136 1137 1138 1139

	case SO_WIFI_STATUS:
		sock_valbool_flag(sk, SOCK_WIFI_STATUS, valbool);
		break;

1140 1141
	case SO_PEEK_OFF:
		if (sock->ops->set_peek_off)
1142
			ret = sock->ops->set_peek_off(sk, val);
1143 1144 1145
		else
			ret = -EOPNOTSUPP;
		break;
1146 1147 1148 1149 1150

	case SO_NOFCS:
		sock_valbool_flag(sk, SOCK_NOFCS, valbool);
		break;

1151 1152 1153 1154
	case SO_SELECT_ERR_QUEUE:
		sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
		break;

1155
#ifdef CONFIG_NET_RX_BUSY_POLL
1156
	case SO_BUSY_POLL:
1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167
		/* allow unprivileged users to decrease the value */
		if ((val > sk->sk_ll_usec) && !capable(CAP_NET_ADMIN))
			ret = -EPERM;
		else {
			if (val < 0)
				ret = -EINVAL;
			else
				sk->sk_ll_usec = val;
		}
		break;
#endif
E
Eric Dumazet 已提交
1168 1169

	case SO_MAX_PACING_RATE:
1170 1171 1172 1173 1174
		{
		unsigned long ulval = (val == ~0U) ? ~0UL : val;

		if (sizeof(ulval) != sizeof(val) &&
		    optlen >= sizeof(ulval) &&
1175
		    copy_from_sockptr(&ulval, optval, sizeof(ulval))) {
1176 1177 1178 1179
			ret = -EFAULT;
			break;
		}
		if (ulval != ~0UL)
1180 1181 1182
			cmpxchg(&sk->sk_pacing_status,
				SK_PACING_NONE,
				SK_PACING_NEEDED);
1183 1184
		sk->sk_max_pacing_rate = ulval;
		sk->sk_pacing_rate = min(sk->sk_pacing_rate, ulval);
E
Eric Dumazet 已提交
1185
		break;
1186
		}
1187
	case SO_INCOMING_CPU:
1188
		WRITE_ONCE(sk->sk_incoming_cpu, val);
1189 1190
		break;

1191 1192 1193 1194
	case SO_CNX_ADVICE:
		if (val == 1)
			dst_negative_advice(sk);
		break;
1195 1196

	case SO_ZEROCOPY:
1197
		if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6) {
W
Willem de Bruijn 已提交
1198 1199 1200 1201
			if (!((sk->sk_type == SOCK_STREAM &&
			       sk->sk_protocol == IPPROTO_TCP) ||
			      (sk->sk_type == SOCK_DGRAM &&
			       sk->sk_protocol == IPPROTO_UDP)))
1202 1203
				ret = -ENOTSUPP;
		} else if (sk->sk_family != PF_RDS) {
1204
			ret = -ENOTSUPP;
1205 1206 1207 1208 1209 1210 1211
		}
		if (!ret) {
			if (val < 0 || val > 1)
				ret = -EINVAL;
			else
				sock_valbool_flag(sk, SOCK_ZEROCOPY, valbool);
		}
1212 1213
		break;

1214
	case SO_TXTIME:
1215
		if (optlen != sizeof(struct sock_txtime)) {
1216
			ret = -EINVAL;
1217
			break;
1218
		} else if (copy_from_sockptr(&sk_txtime, optval,
1219 1220
			   sizeof(struct sock_txtime))) {
			ret = -EFAULT;
1221
			break;
1222 1223
		} else if (sk_txtime.flags & ~SOF_TXTIME_FLAGS_MASK) {
			ret = -EINVAL;
1224 1225 1226 1227 1228 1229 1230 1231 1232
			break;
		}
		/* CLOCK_MONOTONIC is only used by sch_fq, and this packet
		 * scheduler has enough safe guards.
		 */
		if (sk_txtime.clockid != CLOCK_MONOTONIC &&
		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
			ret = -EPERM;
			break;
1233
		}
1234 1235 1236 1237 1238 1239
		sock_valbool_flag(sk, SOCK_TXTIME, true);
		sk->sk_clockid = sk_txtime.clockid;
		sk->sk_txtime_deadline_mode =
			!!(sk_txtime.flags & SOF_TXTIME_DEADLINE_MODE);
		sk->sk_txtime_report_errors =
			!!(sk_txtime.flags & SOF_TXTIME_REPORT_ERRORS);
1240 1241
		break;

1242
	case SO_BINDTOIFINDEX:
C
Christoph Hellwig 已提交
1243
		ret = sock_bindtoindex_locked(sk, val);
1244 1245
		break;

1246 1247 1248
	default:
		ret = -ENOPROTOOPT;
		break;
1249
	}
L
Linus Torvalds 已提交
1250 1251 1252
	release_sock(sk);
	return ret;
}
E
Eric Dumazet 已提交
1253
EXPORT_SYMBOL(sock_setsockopt);
L
Linus Torvalds 已提交
1254 1255


S
stephen hemminger 已提交
1256 1257
static void cred_to_ucred(struct pid *pid, const struct cred *cred,
			  struct ucred *ucred)
1258 1259 1260 1261 1262 1263
{
	ucred->pid = pid_vnr(pid);
	ucred->uid = ucred->gid = -1;
	if (cred) {
		struct user_namespace *current_ns = current_user_ns();

1264 1265
		ucred->uid = from_kuid_munged(current_ns, cred->euid);
		ucred->gid = from_kgid_munged(current_ns, cred->egid);
1266 1267 1268
	}
}

1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280
static int groups_to_user(gid_t __user *dst, const struct group_info *src)
{
	struct user_namespace *user_ns = current_user_ns();
	int i;

	for (i = 0; i < src->ngroups; i++)
		if (put_user(from_kgid_munged(user_ns, src->gid[i]), dst + i))
			return -EFAULT;

	return 0;
}

L
Linus Torvalds 已提交
1281 1282 1283 1284
int sock_getsockopt(struct socket *sock, int level, int optname,
		    char __user *optval, int __user *optlen)
{
	struct sock *sk = sock->sk;
1285

1286
	union {
1287
		int val;
1288
		u64 val64;
1289
		unsigned long ulval;
1290
		struct linger ling;
1291 1292
		struct old_timeval32 tm32;
		struct __kernel_old_timeval tm;
1293
		struct  __kernel_sock_timeval stm;
1294
		struct sock_txtime txtime;
L
Linus Torvalds 已提交
1295
	} v;
1296

1297
	int lv = sizeof(int);
L
Linus Torvalds 已提交
1298
	int len;
1299

1300
	if (get_user(len, optlen))
1301
		return -EFAULT;
1302
	if (len < 0)
L
Linus Torvalds 已提交
1303
		return -EINVAL;
1304

1305
	memset(&v, 0, sizeof(v));
1306

E
Eric Dumazet 已提交
1307
	switch (optname) {
1308 1309 1310 1311 1312 1313 1314 1315 1316
	case SO_DEBUG:
		v.val = sock_flag(sk, SOCK_DBG);
		break;

	case SO_DONTROUTE:
		v.val = sock_flag(sk, SOCK_LOCALROUTE);
		break;

	case SO_BROADCAST:
E
Eric Dumazet 已提交
1317
		v.val = sock_flag(sk, SOCK_BROADCAST);
1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331
		break;

	case SO_SNDBUF:
		v.val = sk->sk_sndbuf;
		break;

	case SO_RCVBUF:
		v.val = sk->sk_rcvbuf;
		break;

	case SO_REUSEADDR:
		v.val = sk->sk_reuse;
		break;

T
Tom Herbert 已提交
1332 1333 1334 1335
	case SO_REUSEPORT:
		v.val = sk->sk_reuseport;
		break;

1336
	case SO_KEEPALIVE:
E
Eric Dumazet 已提交
1337
		v.val = sock_flag(sk, SOCK_KEEPOPEN);
1338 1339 1340 1341 1342 1343
		break;

	case SO_TYPE:
		v.val = sk->sk_type;
		break;

1344 1345 1346 1347
	case SO_PROTOCOL:
		v.val = sk->sk_protocol;
		break;

1348 1349 1350 1351
	case SO_DOMAIN:
		v.val = sk->sk_family;
		break;

1352 1353
	case SO_ERROR:
		v.val = -sock_error(sk);
E
Eric Dumazet 已提交
1354
		if (v.val == 0)
1355 1356 1357 1358
			v.val = xchg(&sk->sk_err_soft, 0);
		break;

	case SO_OOBINLINE:
E
Eric Dumazet 已提交
1359
		v.val = sock_flag(sk, SOCK_URGINLINE);
1360 1361 1362
		break;

	case SO_NO_CHECK:
1363
		v.val = sk->sk_no_check_tx;
1364 1365 1366 1367 1368 1369 1370 1371
		break;

	case SO_PRIORITY:
		v.val = sk->sk_priority;
		break;

	case SO_LINGER:
		lv		= sizeof(v.ling);
E
Eric Dumazet 已提交
1372
		v.ling.l_onoff	= sock_flag(sk, SOCK_LINGER);
1373 1374 1375 1376 1377 1378
		v.ling.l_linger	= sk->sk_lingertime / HZ;
		break;

	case SO_BSDCOMPAT:
		break;

1379
	case SO_TIMESTAMP_OLD:
1380
		v.val = sock_flag(sk, SOCK_RCVTSTAMP) &&
1381
				!sock_flag(sk, SOCK_TSTAMP_NEW) &&
1382 1383 1384
				!sock_flag(sk, SOCK_RCVTSTAMPNS);
		break;

1385
	case SO_TIMESTAMPNS_OLD:
1386 1387 1388 1389 1390 1391 1392 1393 1394
		v.val = sock_flag(sk, SOCK_RCVTSTAMPNS) && !sock_flag(sk, SOCK_TSTAMP_NEW);
		break;

	case SO_TIMESTAMP_NEW:
		v.val = sock_flag(sk, SOCK_RCVTSTAMP) && sock_flag(sk, SOCK_TSTAMP_NEW);
		break;

	case SO_TIMESTAMPNS_NEW:
		v.val = sock_flag(sk, SOCK_RCVTSTAMPNS) && sock_flag(sk, SOCK_TSTAMP_NEW);
1395 1396
		break;

1397
	case SO_TIMESTAMPING_OLD:
1398
		v.val = sk->sk_tsflags;
1399 1400
		break;

1401 1402 1403
	case SO_RCVTIMEO_OLD:
	case SO_RCVTIMEO_NEW:
		lv = sock_get_timeout(sk->sk_rcvtimeo, &v, SO_RCVTIMEO_OLD == optname);
1404 1405
		break;

1406 1407 1408
	case SO_SNDTIMEO_OLD:
	case SO_SNDTIMEO_NEW:
		lv = sock_get_timeout(sk->sk_sndtimeo, &v, SO_SNDTIMEO_OLD == optname);
1409
		break;
L
Linus Torvalds 已提交
1410

1411 1412 1413
	case SO_RCVLOWAT:
		v.val = sk->sk_rcvlowat;
		break;
L
Linus Torvalds 已提交
1414

1415
	case SO_SNDLOWAT:
E
Eric Dumazet 已提交
1416
		v.val = 1;
1417
		break;
L
Linus Torvalds 已提交
1418

1419
	case SO_PASSCRED:
1420
		v.val = !!test_bit(SOCK_PASSCRED, &sock->flags);
1421
		break;
L
Linus Torvalds 已提交
1422

1423
	case SO_PEERCRED:
1424 1425 1426 1427 1428 1429
	{
		struct ucred peercred;
		if (len > sizeof(peercred))
			len = sizeof(peercred);
		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
		if (copy_to_user(optval, &peercred, len))
1430 1431
			return -EFAULT;
		goto lenout;
1432
	}
L
Linus Torvalds 已提交
1433

1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454
	case SO_PEERGROUPS:
	{
		int ret, n;

		if (!sk->sk_peer_cred)
			return -ENODATA;

		n = sk->sk_peer_cred->group_info->ngroups;
		if (len < n * sizeof(gid_t)) {
			len = n * sizeof(gid_t);
			return put_user(len, optlen) ? -EFAULT : -ERANGE;
		}
		len = n * sizeof(gid_t);

		ret = groups_to_user((gid_t __user *)optval,
				     sk->sk_peer_cred->group_info);
		if (ret)
			return ret;
		goto lenout;
	}

1455 1456 1457 1458
	case SO_PEERNAME:
	{
		char address[128];

1459 1460
		lv = sock->ops->getname(sock, (struct sockaddr *)address, 2);
		if (lv < 0)
1461 1462 1463 1464 1465 1466 1467
			return -ENOTCONN;
		if (lv < len)
			return -EINVAL;
		if (copy_to_user(optval, address, len))
			return -EFAULT;
		goto lenout;
	}
L
Linus Torvalds 已提交
1468

1469 1470 1471 1472 1473 1474
	/* Dubious BSD thing... Probably nobody even uses it, but
	 * the UNIX standard wants it for whatever reason... -DaveM
	 */
	case SO_ACCEPTCONN:
		v.val = sk->sk_state == TCP_LISTEN;
		break;
L
Linus Torvalds 已提交
1475

1476
	case SO_PASSSEC:
1477
		v.val = !!test_bit(SOCK_PASSSEC, &sock->flags);
1478
		break;
C
Catherine Zhang 已提交
1479

1480 1481
	case SO_PEERSEC:
		return security_socket_getpeersec_stream(sock, optval, optlen, len);
L
Linus Torvalds 已提交
1482

1483 1484 1485 1486
	case SO_MARK:
		v.val = sk->sk_mark;
		break;

1487
	case SO_RXQ_OVFL:
E
Eric Dumazet 已提交
1488
		v.val = sock_flag(sk, SOCK_RXQ_OVFL);
1489 1490
		break;

1491
	case SO_WIFI_STATUS:
E
Eric Dumazet 已提交
1492
		v.val = sock_flag(sk, SOCK_WIFI_STATUS);
1493 1494
		break;

1495 1496 1497 1498 1499 1500
	case SO_PEEK_OFF:
		if (!sock->ops->set_peek_off)
			return -EOPNOTSUPP;

		v.val = sk->sk_peek_off;
		break;
1501
	case SO_NOFCS:
E
Eric Dumazet 已提交
1502
		v.val = sock_flag(sk, SOCK_NOFCS);
1503
		break;
1504

1505
	case SO_BINDTODEVICE:
1506 1507
		return sock_getbindtodevice(sk, optval, optlen, len);

1508 1509 1510 1511 1512 1513
	case SO_GET_FILTER:
		len = sk_get_filter(sk, (struct sock_filter __user *)optval, len);
		if (len < 0)
			return len;

		goto lenout;
1514

1515 1516 1517 1518
	case SO_LOCK_FILTER:
		v.val = sock_flag(sk, SOCK_FILTER_LOCKED);
		break;

1519 1520 1521 1522
	case SO_BPF_EXTENSIONS:
		v.val = bpf_tell_extensions();
		break;

1523 1524 1525 1526
	case SO_SELECT_ERR_QUEUE:
		v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
		break;

1527
#ifdef CONFIG_NET_RX_BUSY_POLL
1528
	case SO_BUSY_POLL:
1529 1530 1531 1532
		v.val = sk->sk_ll_usec;
		break;
#endif

E
Eric Dumazet 已提交
1533
	case SO_MAX_PACING_RATE:
1534 1535 1536 1537 1538 1539 1540
		if (sizeof(v.ulval) != sizeof(v.val) && len >= sizeof(v.ulval)) {
			lv = sizeof(v.ulval);
			v.ulval = sk->sk_max_pacing_rate;
		} else {
			/* 32bit version */
			v.val = min_t(unsigned long, sk->sk_max_pacing_rate, ~0U);
		}
E
Eric Dumazet 已提交
1541 1542
		break;

E
Eric Dumazet 已提交
1543
	case SO_INCOMING_CPU:
1544
		v.val = READ_ONCE(sk->sk_incoming_cpu);
E
Eric Dumazet 已提交
1545 1546
		break;

1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558
	case SO_MEMINFO:
	{
		u32 meminfo[SK_MEMINFO_VARS];

		sk_get_meminfo(sk, meminfo);

		len = min_t(unsigned int, len, sizeof(meminfo));
		if (copy_to_user(optval, &meminfo, len))
			return -EFAULT;

		goto lenout;
	}
1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570

#ifdef CONFIG_NET_RX_BUSY_POLL
	case SO_INCOMING_NAPI_ID:
		v.val = READ_ONCE(sk->sk_napi_id);

		/* aggregate non-NAPI IDs down to 0 */
		if (v.val < MIN_NAPI_ID)
			v.val = 0;

		break;
#endif

1571 1572 1573 1574 1575 1576 1577
	case SO_COOKIE:
		lv = sizeof(u64);
		if (len < lv)
			return -EINVAL;
		v.val64 = sock_gen_cookie(sk);
		break;

1578 1579 1580 1581
	case SO_ZEROCOPY:
		v.val = sock_flag(sk, SOCK_ZEROCOPY);
		break;

1582 1583 1584 1585 1586
	case SO_TXTIME:
		lv = sizeof(v.txtime);
		v.txtime.clockid = sk->sk_clockid;
		v.txtime.flags |= sk->sk_txtime_deadline_mode ?
				  SOF_TXTIME_DEADLINE_MODE : 0;
1587 1588
		v.txtime.flags |= sk->sk_txtime_report_errors ?
				  SOF_TXTIME_REPORT_ERRORS : 0;
1589 1590
		break;

1591 1592 1593 1594
	case SO_BINDTOIFINDEX:
		v.val = sk->sk_bound_dev_if;
		break;

1595
	default:
1596 1597 1598
		/* We implement the SO_SNDLOWAT etc to not be settable
		 * (1003.1g 7).
		 */
1599
		return -ENOPROTOOPT;
L
Linus Torvalds 已提交
1600
	}
1601

L
Linus Torvalds 已提交
1602 1603 1604 1605 1606
	if (len > lv)
		len = lv;
	if (copy_to_user(optval, &v, len))
		return -EFAULT;
lenout:
1607 1608 1609
	if (put_user(len, optlen))
		return -EFAULT;
	return 0;
L
Linus Torvalds 已提交
1610 1611
}

I
Ingo Molnar 已提交
1612 1613 1614 1615 1616
/*
 * Initialize an sk_lock.
 *
 * (We also register the sk_lock with the lock validator.)
 */
D
Dave Jones 已提交
1617
static inline void sock_lock_init(struct sock *sk)
I
Ingo Molnar 已提交
1618
{
1619 1620 1621 1622 1623 1624 1625 1626 1627 1628
	if (sk->sk_kern_sock)
		sock_lock_init_class_and_name(
			sk,
			af_family_kern_slock_key_strings[sk->sk_family],
			af_family_kern_slock_keys + sk->sk_family,
			af_family_kern_key_strings[sk->sk_family],
			af_family_kern_keys + sk->sk_family);
	else
		sock_lock_init_class_and_name(
			sk,
1629 1630 1631 1632
			af_family_slock_key_strings[sk->sk_family],
			af_family_slock_keys + sk->sk_family,
			af_family_key_strings[sk->sk_family],
			af_family_keys + sk->sk_family);
I
Ingo Molnar 已提交
1633 1634
}

E
Eric Dumazet 已提交
1635 1636 1637
/*
 * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
 * even temporarly, because of RCU lookups. sk_node should also be left as is.
1638
 * We must not copy fields between sk_dontcopy_begin and sk_dontcopy_end
E
Eric Dumazet 已提交
1639
 */
1640 1641
static void sock_copy(struct sock *nsk, const struct sock *osk)
{
1642
	const struct proto *prot = READ_ONCE(osk->sk_prot);
1643 1644 1645
#ifdef CONFIG_SECURITY_NETWORK
	void *sptr = nsk->sk_security;
#endif
1646 1647 1648
	memcpy(nsk, osk, offsetof(struct sock, sk_dontcopy_begin));

	memcpy(&nsk->sk_dontcopy_end, &osk->sk_dontcopy_end,
1649
	       prot->obj_size - offsetof(struct sock, sk_dontcopy_end));
1650

1651 1652 1653 1654 1655 1656
#ifdef CONFIG_SECURITY_NETWORK
	nsk->sk_security = sptr;
	security_sk_clone(osk, nsk);
#endif
}

1657 1658
static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
		int family)
1659 1660 1661 1662 1663
{
	struct sock *sk;
	struct kmem_cache *slab;

	slab = prot->slab;
1664 1665 1666 1667
	if (slab != NULL) {
		sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
		if (!sk)
			return sk;
1668
		if (want_init_on_alloc(priority))
E
Eric Dumazet 已提交
1669
			sk_prot_clear_nulls(sk, prot->obj_size);
1670
	} else
1671 1672
		sk = kmalloc(prot->obj_size, priority);

1673 1674 1675 1676 1677 1678
	if (sk != NULL) {
		if (security_sk_alloc(sk, family, priority))
			goto out_free;

		if (!try_module_get(prot->owner))
			goto out_free_sec;
K
Krishna Kumar 已提交
1679
		sk_tx_queue_clear(sk);
1680 1681
	}

1682
	return sk;
1683 1684 1685 1686 1687 1688 1689 1690 1691

out_free_sec:
	security_sk_free(sk);
out_free:
	if (slab != NULL)
		kmem_cache_free(slab, sk);
	else
		kfree(sk);
	return NULL;
1692 1693 1694 1695 1696
}

static void sk_prot_free(struct proto *prot, struct sock *sk)
{
	struct kmem_cache *slab;
1697
	struct module *owner;
1698

1699
	owner = prot->owner;
1700
	slab = prot->slab;
1701

T
Tejun Heo 已提交
1702
	cgroup_sk_free(&sk->sk_cgrp_data);
1703
	mem_cgroup_sk_free(sk);
1704
	security_sk_free(sk);
1705 1706 1707 1708
	if (slab != NULL)
		kmem_cache_free(slab, sk);
	else
		kfree(sk);
1709
	module_put(owner);
1710 1711
}

L
Linus Torvalds 已提交
1712 1713
/**
 *	sk_alloc - All socket objects are allocated here
1714
 *	@net: the applicable net namespace
1715 1716 1717
 *	@family: protocol family
 *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
 *	@prot: struct proto associated with this new sock instance
1718
 *	@kern: is this to be a kernel socket?
L
Linus Torvalds 已提交
1719
 */
1720
struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
1721
		      struct proto *prot, int kern)
L
Linus Torvalds 已提交
1722
{
1723
	struct sock *sk;
L
Linus Torvalds 已提交
1724

1725
	sk = sk_prot_alloc(prot, priority | __GFP_ZERO, family);
L
Linus Torvalds 已提交
1726
	if (sk) {
1727 1728 1729 1730 1731 1732
		sk->sk_family = family;
		/*
		 * See comment in struct sock definition to understand
		 * why we need sk_prot_creator -acme
		 */
		sk->sk_prot = sk->sk_prot_creator = prot;
1733
		sk->sk_kern_sock = kern;
1734
		sock_lock_init(sk);
1735
		sk->sk_net_refcnt = kern ? 0 : 1;
1736
		if (likely(sk->sk_net_refcnt)) {
1737
			get_net(net);
1738 1739 1740
			sock_inuse_add(net, 1);
		}

1741
		sock_net_set(sk, net);
1742
		refcount_set(&sk->sk_wmem_alloc, 1);
1743

1744
		mem_cgroup_sk_alloc(sk);
1745
		cgroup_sk_alloc(&sk->sk_cgrp_data);
1746 1747
		sock_update_classid(&sk->sk_cgrp_data);
		sock_update_netprioidx(&sk->sk_cgrp_data);
1748
		sk_tx_queue_clear(sk);
L
Linus Torvalds 已提交
1749
	}
1750

1751
	return sk;
L
Linus Torvalds 已提交
1752
}
E
Eric Dumazet 已提交
1753
EXPORT_SYMBOL(sk_alloc);
L
Linus Torvalds 已提交
1754

1755 1756 1757 1758
/* Sockets having SOCK_RCU_FREE will call this function after one RCU
 * grace period. This is the case for UDP sockets and TCP listeners.
 */
static void __sk_destruct(struct rcu_head *head)
L
Linus Torvalds 已提交
1759
{
1760
	struct sock *sk = container_of(head, struct sock, sk_rcu);
L
Linus Torvalds 已提交
1761 1762 1763 1764 1765
	struct sk_filter *filter;

	if (sk->sk_destruct)
		sk->sk_destruct(sk);

1766
	filter = rcu_dereference_check(sk->sk_filter,
1767
				       refcount_read(&sk->sk_wmem_alloc) == 0);
L
Linus Torvalds 已提交
1768
	if (filter) {
1769
		sk_filter_uncharge(sk, filter);
1770
		RCU_INIT_POINTER(sk->sk_filter, NULL);
L
Linus Torvalds 已提交
1771 1772
	}

E
Eric Dumazet 已提交
1773
	sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
L
Linus Torvalds 已提交
1774

1775 1776 1777 1778
#ifdef CONFIG_BPF_SYSCALL
	bpf_sk_storage_free(sk);
#endif

L
Linus Torvalds 已提交
1779
	if (atomic_read(&sk->sk_omem_alloc))
J
Joe Perches 已提交
1780 1781
		pr_debug("%s: optmem leakage (%d bytes) detected\n",
			 __func__, atomic_read(&sk->sk_omem_alloc));
L
Linus Torvalds 已提交
1782

1783 1784 1785 1786 1787
	if (sk->sk_frag.page) {
		put_page(sk->sk_frag.page);
		sk->sk_frag.page = NULL;
	}

1788 1789 1790
	if (sk->sk_peer_cred)
		put_cred(sk->sk_peer_cred);
	put_pid(sk->sk_peer_pid);
1791 1792
	if (likely(sk->sk_net_refcnt))
		put_net(sock_net(sk));
1793
	sk_prot_free(sk->sk_prot_creator, sk);
L
Linus Torvalds 已提交
1794
}
1795

1796 1797
void sk_destruct(struct sock *sk)
{
1798 1799 1800 1801 1802 1803 1804 1805
	bool use_call_rcu = sock_flag(sk, SOCK_RCU_FREE);

	if (rcu_access_pointer(sk->sk_reuseport_cb)) {
		reuseport_detach_sock(sk);
		use_call_rcu = true;
	}

	if (use_call_rcu)
1806 1807 1808 1809 1810
		call_rcu(&sk->sk_rcu, __sk_destruct);
	else
		__sk_destruct(&sk->sk_rcu);
}

1811 1812
static void __sk_free(struct sock *sk)
{
1813 1814 1815
	if (likely(sk->sk_net_refcnt))
		sock_inuse_add(sock_net(sk), -1);

1816
	if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk)))
1817 1818 1819 1820 1821
		sock_diag_broadcast_destroy(sk);
	else
		sk_destruct(sk);
}

1822 1823 1824
void sk_free(struct sock *sk)
{
	/*
L
Lucas De Marchi 已提交
1825
	 * We subtract one from sk_wmem_alloc and can know if
1826 1827 1828
	 * some packets are still in some tx queue.
	 * If not null, sock_wfree() will call __sk_free(sk) later
	 */
1829
	if (refcount_dec_and_test(&sk->sk_wmem_alloc))
1830 1831
		__sk_free(sk);
}
E
Eric Dumazet 已提交
1832
EXPORT_SYMBOL(sk_free);
L
Linus Torvalds 已提交
1833

1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854
static void sk_init_common(struct sock *sk)
{
	skb_queue_head_init(&sk->sk_receive_queue);
	skb_queue_head_init(&sk->sk_write_queue);
	skb_queue_head_init(&sk->sk_error_queue);

	rwlock_init(&sk->sk_callback_lock);
	lockdep_set_class_and_name(&sk->sk_receive_queue.lock,
			af_rlock_keys + sk->sk_family,
			af_family_rlock_key_strings[sk->sk_family]);
	lockdep_set_class_and_name(&sk->sk_write_queue.lock,
			af_wlock_keys + sk->sk_family,
			af_family_wlock_key_strings[sk->sk_family]);
	lockdep_set_class_and_name(&sk->sk_error_queue.lock,
			af_elock_keys + sk->sk_family,
			af_family_elock_key_strings[sk->sk_family]);
	lockdep_set_class_and_name(&sk->sk_callback_lock,
			af_callback_keys + sk->sk_family,
			af_family_clock_key_strings[sk->sk_family]);
}

1855 1856 1857 1858 1859 1860 1861 1862
/**
 *	sk_clone_lock - clone a socket, and lock its clone
 *	@sk: the socket to clone
 *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
 *
 *	Caller must unlock socket even in error path (bh_unlock_sock(newsk))
 */
struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
1863
{
1864
	struct proto *prot = READ_ONCE(sk->sk_prot);
1865
	struct sock *newsk;
1866
	bool is_charged = true;
1867

1868
	newsk = sk_prot_alloc(prot, priority, sk->sk_family);
1869 1870 1871
	if (newsk != NULL) {
		struct sk_filter *filter;

1872
		sock_copy(newsk, sk);
1873

1874
		newsk->sk_prot_creator = prot;
1875

1876
		/* SANITY */
1877 1878
		if (likely(newsk->sk_net_refcnt))
			get_net(sock_net(newsk));
1879 1880 1881
		sk_node_init(&newsk->sk_node);
		sock_lock_init(newsk);
		bh_lock_sock(newsk);
1882
		newsk->sk_backlog.head	= newsk->sk_backlog.tail = NULL;
Z
Zhu Yi 已提交
1883
		newsk->sk_backlog.len = 0;
1884 1885

		atomic_set(&newsk->sk_rmem_alloc, 0);
1886 1887 1888
		/*
		 * sk_wmem_alloc set to one (see sk_free() and sock_wfree())
		 */
1889
		refcount_set(&newsk->sk_wmem_alloc, 1);
1890
		atomic_set(&newsk->sk_omem_alloc, 0);
1891
		sk_init_common(newsk);
1892 1893

		newsk->sk_dst_cache	= NULL;
1894
		newsk->sk_dst_pending_confirm = 0;
1895 1896
		newsk->sk_wmem_queued	= 0;
		newsk->sk_forward_alloc = 0;
1897
		atomic_set(&newsk->sk_drops, 0);
1898 1899
		newsk->sk_send_head	= NULL;
		newsk->sk_userlocks	= sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;
W
Willem de Bruijn 已提交
1900
		atomic_set(&newsk->sk_zckey, 0);
1901 1902

		sock_reset_flag(newsk, SOCK_DONE);
1903 1904 1905 1906

		/* sk->sk_memcg will be populated at accept() time */
		newsk->sk_memcg = NULL;

1907
		cgroup_sk_clone(&newsk->sk_cgrp_data);
1908

1909 1910
		rcu_read_lock();
		filter = rcu_dereference(sk->sk_filter);
1911
		if (filter != NULL)
1912 1913 1914 1915 1916
			/* though it's an empty new sock, the charging may fail
			 * if sysctl_optmem_max was changed between creation of
			 * original socket and cloning
			 */
			is_charged = sk_filter_charge(newsk, filter);
1917 1918
		RCU_INIT_POINTER(newsk->sk_filter, filter);
		rcu_read_unlock();
1919

1920
		if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
1921 1922 1923 1924 1925 1926
			/* We need to make sure that we don't uncharge the new
			 * socket if we couldn't charge it in the first place
			 * as otherwise we uncharge the parent's filter.
			 */
			if (!is_charged)
				RCU_INIT_POINTER(newsk->sk_filter, NULL);
1927
			sk_free_unlock_clone(newsk);
1928 1929 1930
			newsk = NULL;
			goto out;
		}
1931
		RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
1932 1933 1934 1935 1936 1937

		if (bpf_sk_storage_clone(sk, newsk)) {
			sk_free_unlock_clone(newsk);
			newsk = NULL;
			goto out;
		}
1938

1939 1940 1941 1942
		/* Clear sk_user_data if parent had the pointer tagged
		 * as not suitable for copying when cloning.
		 */
		if (sk_user_data_is_nocopy(newsk))
1943
			newsk->sk_user_data = NULL;
1944

1945
		newsk->sk_err	   = 0;
1946
		newsk->sk_err_soft = 0;
1947
		newsk->sk_priority = 0;
E
Eric Dumazet 已提交
1948
		newsk->sk_incoming_cpu = raw_smp_processor_id();
1949 1950
		if (likely(newsk->sk_net_refcnt))
			sock_inuse_add(sock_net(newsk), 1);
1951

E
Eric Dumazet 已提交
1952 1953
		/*
		 * Before updating sk_refcnt, we must commit prior changes to memory
1954
		 * (Documentation/RCU/rculist_nulls.rst for details)
E
Eric Dumazet 已提交
1955 1956
		 */
		smp_wmb();
1957
		refcount_set(&newsk->sk_refcnt, 2);
1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970

		/*
		 * Increment the counter in the same struct proto as the master
		 * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that
		 * is the same as sk->sk_prot->socks, as this field was copied
		 * with memcpy).
		 *
		 * This _changes_ the previous behaviour, where
		 * tcp_create_openreq_child always was incrementing the
		 * equivalent to tcp_prot->socks (inet_sock_nr), so this have
		 * to be taken into account in all callers. -acme
		 */
		sk_refcnt_debug_inc(newsk);
1971
		sk_set_socket(newsk, NULL);
1972
		sk_tx_queue_clear(newsk);
1973
		RCU_INIT_POINTER(newsk->sk_wq, NULL);
1974 1975

		if (newsk->sk_prot->sockets_allocated)
1976
			sk_sockets_allocated_inc(newsk);
1977

1978 1979
		if (sock_needs_netstamp(sk) &&
		    newsk->sk_flags & SK_FLAGS_TIMESTAMP)
1980
			net_enable_timestamp();
1981 1982 1983 1984
	}
out:
	return newsk;
}
1985
EXPORT_SYMBOL_GPL(sk_clone_lock);
1986

1987 1988 1989 1990 1991 1992 1993 1994 1995 1996
void sk_free_unlock_clone(struct sock *sk)
{
	/* It is still raw copy of parent, so invalidate
	 * destructor and make plain sk_free() */
	sk->sk_destruct = NULL;
	bh_unlock_sock(sk);
	sk_free(sk);
}
EXPORT_SYMBOL_GPL(sk_free_unlock_clone);

1997 1998
void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
{
1999 2000
	u32 max_segs = 1;

E
Eric Dumazet 已提交
2001
	sk_dst_set(sk, dst);
2002
	sk->sk_route_caps = dst->dev->features | sk->sk_route_forced_caps;
2003
	if (sk->sk_route_caps & NETIF_F_GSO)
2004
		sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
E
Eric Dumazet 已提交
2005
	sk->sk_route_caps &= ~sk->sk_route_nocaps;
2006
	if (sk_can_gso(sk)) {
2007
		if (dst->header_len && !xfrm_dst_offload_ok(dst)) {
2008
			sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
2009
		} else {
2010
			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
2011
			sk->sk_gso_max_size = dst->dev->gso_max_size;
2012
			max_segs = max_t(u32, dst->dev->gso_max_segs, 1);
2013
		}
2014
	}
2015
	sk->sk_gso_max_segs = max_segs;
2016 2017 2018
}
EXPORT_SYMBOL_GPL(sk_setup_caps);

L
Linus Torvalds 已提交
2019 2020 2021 2022 2023
/*
 *	Simple resource managers for sockets.
 */


2024 2025
/*
 * Write buffer destructor automatically called from kfree_skb.
L
Linus Torvalds 已提交
2026 2027 2028 2029
 */
void sock_wfree(struct sk_buff *skb)
{
	struct sock *sk = skb->sk;
E
Eric Dumazet 已提交
2030
	unsigned int len = skb->truesize;
L
Linus Torvalds 已提交
2031

E
Eric Dumazet 已提交
2032 2033 2034 2035 2036
	if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) {
		/*
		 * Keep a reference on sk_wmem_alloc, this will be released
		 * after sk_write_space() call
		 */
2037
		WARN_ON(refcount_sub_and_test(len - 1, &sk->sk_wmem_alloc));
L
Linus Torvalds 已提交
2038
		sk->sk_write_space(sk);
E
Eric Dumazet 已提交
2039 2040
		len = 1;
	}
2041
	/*
E
Eric Dumazet 已提交
2042 2043
	 * if sk_wmem_alloc reaches 0, we must finish what sk_free()
	 * could not do because of in-flight packets
2044
	 */
2045
	if (refcount_sub_and_test(len, &sk->sk_wmem_alloc))
2046
		__sk_free(sk);
L
Linus Torvalds 已提交
2047
}
E
Eric Dumazet 已提交
2048
EXPORT_SYMBOL(sock_wfree);
L
Linus Torvalds 已提交
2049

E
Eric Dumazet 已提交
2050 2051 2052 2053 2054 2055 2056
/* This variant of sock_wfree() is used by TCP,
 * since it sets SOCK_USE_WRITE_QUEUE.
 */
void __sock_wfree(struct sk_buff *skb)
{
	struct sock *sk = skb->sk;

2057
	if (refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc))
E
Eric Dumazet 已提交
2058 2059 2060
		__sk_free(sk);
}

2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078
void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
{
	skb_orphan(skb);
	skb->sk = sk;
#ifdef CONFIG_INET
	if (unlikely(!sk_fullsock(sk))) {
		skb->destructor = sock_edemux;
		sock_hold(sk);
		return;
	}
#endif
	skb->destructor = sock_wfree;
	skb_set_hash_from_sk(skb, sk);
	/*
	 * We used to take a refcount on sk, but following operation
	 * is enough to guarantee sk_free() wont free this sock until
	 * all in-flight packets are completed
	 */
2079
	refcount_add(skb->truesize, &sk->sk_wmem_alloc);
2080 2081 2082
}
EXPORT_SYMBOL(skb_set_owner_w);

2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095
static bool can_skb_orphan_partial(const struct sk_buff *skb)
{
#ifdef CONFIG_TLS_DEVICE
	/* Drivers depend on in-order delivery for crypto offload,
	 * partial orphan breaks out-of-order-OK logic.
	 */
	if (skb->decrypted)
		return false;
#endif
	return (skb->destructor == sock_wfree ||
		(IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree));
}

E
Eric Dumazet 已提交
2096 2097 2098 2099
/* This helper is used by netem, as it can hold packets in its
 * delay queue. We want to allow the owner socket to send more
 * packets, as if they were already TX completed by a typical driver.
 * But we also want to keep skb->sk set because some packet schedulers
E
Eric Dumazet 已提交
2100
 * rely on it (sch_fq for example).
E
Eric Dumazet 已提交
2101
 */
2102 2103
void skb_orphan_partial(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
2104
	if (skb_is_tcp_pure_ack(skb))
E
Eric Dumazet 已提交
2105 2106
		return;

2107
	if (can_skb_orphan_partial(skb)) {
E
Eric Dumazet 已提交
2108 2109
		struct sock *sk = skb->sk;

2110
		if (refcount_inc_not_zero(&sk->sk_refcnt)) {
2111
			WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
E
Eric Dumazet 已提交
2112 2113
			skb->destructor = sock_efree;
		}
2114 2115 2116 2117 2118 2119
	} else {
		skb_orphan(skb);
	}
}
EXPORT_SYMBOL(skb_orphan_partial);

2120 2121
/*
 * Read buffer destructor automatically called from kfree_skb.
L
Linus Torvalds 已提交
2122 2123 2124 2125
 */
void sock_rfree(struct sk_buff *skb)
{
	struct sock *sk = skb->sk;
E
Eric Dumazet 已提交
2126
	unsigned int len = skb->truesize;
L
Linus Torvalds 已提交
2127

E
Eric Dumazet 已提交
2128 2129
	atomic_sub(len, &sk->sk_rmem_alloc);
	sk_mem_uncharge(sk, len);
L
Linus Torvalds 已提交
2130
}
E
Eric Dumazet 已提交
2131
EXPORT_SYMBOL(sock_rfree);
L
Linus Torvalds 已提交
2132

2133 2134 2135 2136
/*
 * Buffer destructor for skbs that are not used directly in read or write
 * path, e.g. for error handler skbs. Automatically called from kfree_skb.
 */
2137 2138 2139 2140 2141 2142
void sock_efree(struct sk_buff *skb)
{
	sock_put(skb->sk);
}
EXPORT_SYMBOL(sock_efree);

J
Joe Stringer 已提交
2143 2144 2145 2146 2147 2148
/* Buffer destructor for prefetch/receive path where reference count may
 * not be held, e.g. for listen sockets.
 */
#ifdef CONFIG_INET
void sock_pfree(struct sk_buff *skb)
{
2149 2150
	if (sk_is_refcounted(skb->sk))
		sock_gen_put(skb->sk);
J
Joe Stringer 已提交
2151 2152 2153 2154
}
EXPORT_SYMBOL(sock_pfree);
#endif /* CONFIG_INET */

2155
kuid_t sock_i_uid(struct sock *sk)
L
Linus Torvalds 已提交
2156
{
2157
	kuid_t uid;
L
Linus Torvalds 已提交
2158

E
Eric Dumazet 已提交
2159
	read_lock_bh(&sk->sk_callback_lock);
2160
	uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : GLOBAL_ROOT_UID;
E
Eric Dumazet 已提交
2161
	read_unlock_bh(&sk->sk_callback_lock);
L
Linus Torvalds 已提交
2162 2163
	return uid;
}
E
Eric Dumazet 已提交
2164
EXPORT_SYMBOL(sock_i_uid);
L
Linus Torvalds 已提交
2165 2166 2167 2168 2169

unsigned long sock_i_ino(struct sock *sk)
{
	unsigned long ino;

E
Eric Dumazet 已提交
2170
	read_lock_bh(&sk->sk_callback_lock);
L
Linus Torvalds 已提交
2171
	ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
E
Eric Dumazet 已提交
2172
	read_unlock_bh(&sk->sk_callback_lock);
L
Linus Torvalds 已提交
2173 2174
	return ino;
}
E
Eric Dumazet 已提交
2175
EXPORT_SYMBOL(sock_i_ino);
L
Linus Torvalds 已提交
2176 2177 2178 2179

/*
 * Allocate a skb from the socket's send buffer.
 */
V
Victor Fusco 已提交
2180
struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
A
Al Viro 已提交
2181
			     gfp_t priority)
L
Linus Torvalds 已提交
2182
{
2183 2184
	if (force ||
	    refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf)) {
E
Eric Dumazet 已提交
2185
		struct sk_buff *skb = alloc_skb(size, priority);
2186

L
Linus Torvalds 已提交
2187 2188 2189 2190 2191 2192 2193
		if (skb) {
			skb_set_owner_w(skb, sk);
			return skb;
		}
	}
	return NULL;
}
E
Eric Dumazet 已提交
2194
EXPORT_SYMBOL(sock_wmalloc);
L
Linus Torvalds 已提交
2195

2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222
static void sock_ofree(struct sk_buff *skb)
{
	struct sock *sk = skb->sk;

	atomic_sub(skb->truesize, &sk->sk_omem_alloc);
}

struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size,
			     gfp_t priority)
{
	struct sk_buff *skb;

	/* small safe race: SKB_TRUESIZE may differ from final skb->truesize */
	if (atomic_read(&sk->sk_omem_alloc) + SKB_TRUESIZE(size) >
	    sysctl_optmem_max)
		return NULL;

	skb = alloc_skb(size, priority);
	if (!skb)
		return NULL;

	atomic_add(skb->truesize, &sk->sk_omem_alloc);
	skb->sk = sk;
	skb->destructor = sock_ofree;
	return skb;
}

2223
/*
L
Linus Torvalds 已提交
2224
 * Allocate a memory block from the socket's option memory buffer.
2225
 */
A
Al Viro 已提交
2226
void *sock_kmalloc(struct sock *sk, int size, gfp_t priority)
L
Linus Torvalds 已提交
2227
{
2228
	if ((unsigned int)size <= sysctl_optmem_max &&
L
Linus Torvalds 已提交
2229 2230 2231
	    atomic_read(&sk->sk_omem_alloc) + size < sysctl_optmem_max) {
		void *mem;
		/* First do the add, to avoid the race if kmalloc
2232
		 * might sleep.
L
Linus Torvalds 已提交
2233 2234 2235 2236 2237 2238 2239 2240 2241
		 */
		atomic_add(size, &sk->sk_omem_alloc);
		mem = kmalloc(size, priority);
		if (mem)
			return mem;
		atomic_sub(size, &sk->sk_omem_alloc);
	}
	return NULL;
}
E
Eric Dumazet 已提交
2242
EXPORT_SYMBOL(sock_kmalloc);
L
Linus Torvalds 已提交
2243

2244 2245 2246
/* Free an option memory block. Note, we actually want the inline
 * here as this allows gcc to detect the nullify and fold away the
 * condition entirely.
L
Linus Torvalds 已提交
2247
 */
2248 2249
static inline void __sock_kfree_s(struct sock *sk, void *mem, int size,
				  const bool nullify)
L
Linus Torvalds 已提交
2250
{
2251 2252
	if (WARN_ON_ONCE(!mem))
		return;
2253
	if (nullify)
2254
		kfree_sensitive(mem);
2255 2256
	else
		kfree(mem);
L
Linus Torvalds 已提交
2257 2258
	atomic_sub(size, &sk->sk_omem_alloc);
}
2259 2260 2261 2262 2263

void sock_kfree_s(struct sock *sk, void *mem, int size)
{
	__sock_kfree_s(sk, mem, size, false);
}
E
Eric Dumazet 已提交
2264
EXPORT_SYMBOL(sock_kfree_s);
L
Linus Torvalds 已提交
2265

2266 2267 2268 2269 2270 2271
void sock_kzfree_s(struct sock *sk, void *mem, int size)
{
	__sock_kfree_s(sk, mem, size, true);
}
EXPORT_SYMBOL(sock_kzfree_s);

L
Linus Torvalds 已提交
2272 2273 2274
/* It is almost wait_for_tcp_memory minus release_sock/lock_sock.
   I think, these locks should be removed for datagram sockets.
 */
E
Eric Dumazet 已提交
2275
static long sock_wait_for_wmem(struct sock *sk, long timeo)
L
Linus Torvalds 已提交
2276 2277 2278
{
	DEFINE_WAIT(wait);

2279
	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
L
Linus Torvalds 已提交
2280 2281 2282 2283 2284 2285
	for (;;) {
		if (!timeo)
			break;
		if (signal_pending(current))
			break;
		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
E
Eric Dumazet 已提交
2286
		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
2287
		if (refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf))
L
Linus Torvalds 已提交
2288 2289 2290 2291 2292 2293 2294
			break;
		if (sk->sk_shutdown & SEND_SHUTDOWN)
			break;
		if (sk->sk_err)
			break;
		timeo = schedule_timeout(timeo);
	}
E
Eric Dumazet 已提交
2295
	finish_wait(sk_sleep(sk), &wait);
L
Linus Torvalds 已提交
2296 2297 2298 2299 2300 2301 2302 2303
	return timeo;
}


/*
 *	Generic send/receive buffer handlers
 */

H
Herbert Xu 已提交
2304 2305
struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
				     unsigned long data_len, int noblock,
2306
				     int *errcode, int max_page_order)
L
Linus Torvalds 已提交
2307
{
2308
	struct sk_buff *skb;
L
Linus Torvalds 已提交
2309 2310 2311 2312
	long timeo;
	int err;

	timeo = sock_sndtimeo(sk, noblock);
2313
	for (;;) {
L
Linus Torvalds 已提交
2314 2315 2316 2317 2318 2319 2320 2321
		err = sock_error(sk);
		if (err != 0)
			goto failure;

		err = -EPIPE;
		if (sk->sk_shutdown & SEND_SHUTDOWN)
			goto failure;

2322
		if (sk_wmem_alloc_get(sk) < READ_ONCE(sk->sk_sndbuf))
2323
			break;
2324

2325
		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
2326 2327 2328
		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
		err = -EAGAIN;
		if (!timeo)
L
Linus Torvalds 已提交
2329
			goto failure;
2330 2331 2332
		if (signal_pending(current))
			goto interrupted;
		timeo = sock_wait_for_wmem(sk, timeo);
L
Linus Torvalds 已提交
2333
	}
2334 2335 2336 2337
	skb = alloc_skb_with_frags(header_len, data_len, max_page_order,
				   errcode, sk->sk_allocation);
	if (skb)
		skb_set_owner_w(skb, sk);
L
Linus Torvalds 已提交
2338 2339 2340 2341 2342 2343 2344 2345
	return skb;

interrupted:
	err = sock_intr_errno(timeo);
failure:
	*errcode = err;
	return NULL;
}
H
Herbert Xu 已提交
2346
EXPORT_SYMBOL(sock_alloc_send_pskb);
L
Linus Torvalds 已提交
2347

2348
struct sk_buff *sock_alloc_send_skb(struct sock *sk, unsigned long size,
L
Linus Torvalds 已提交
2349 2350
				    int noblock, int *errcode)
{
2351
	return sock_alloc_send_pskb(sk, size, 0, noblock, errcode, 0);
L
Linus Torvalds 已提交
2352
}
E
Eric Dumazet 已提交
2353
EXPORT_SYMBOL(sock_alloc_send_skb);
L
Linus Torvalds 已提交
2354

2355 2356 2357
int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg,
		     struct sockcm_cookie *sockc)
{
2358 2359
	u32 tsflags;

2360 2361 2362 2363 2364 2365 2366 2367
	switch (cmsg->cmsg_type) {
	case SO_MARK:
		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
			return -EPERM;
		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
			return -EINVAL;
		sockc->mark = *(u32 *)CMSG_DATA(cmsg);
		break;
2368
	case SO_TIMESTAMPING_OLD:
2369 2370 2371 2372 2373 2374 2375 2376 2377 2378
		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
			return -EINVAL;

		tsflags = *(u32 *)CMSG_DATA(cmsg);
		if (tsflags & ~SOF_TIMESTAMPING_TX_RECORD_MASK)
			return -EINVAL;

		sockc->tsflags &= ~SOF_TIMESTAMPING_TX_RECORD_MASK;
		sockc->tsflags |= tsflags;
		break;
2379 2380 2381 2382 2383 2384 2385
	case SCM_TXTIME:
		if (!sock_flag(sk, SOCK_TXTIME))
			return -EINVAL;
		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u64)))
			return -EINVAL;
		sockc->transmit_time = get_unaligned((u64 *)CMSG_DATA(cmsg));
		break;
2386 2387 2388 2389
	/* SCM_RIGHTS and SCM_CREDENTIALS are semantically in SOL_UNIX. */
	case SCM_RIGHTS:
	case SCM_CREDENTIALS:
		break;
2390 2391 2392 2393 2394 2395 2396
	default:
		return -EINVAL;
	}
	return 0;
}
EXPORT_SYMBOL(__sock_cmsg_send);

E
Edward Jee 已提交
2397 2398 2399 2400
int sock_cmsg_send(struct sock *sk, struct msghdr *msg,
		   struct sockcm_cookie *sockc)
{
	struct cmsghdr *cmsg;
2401
	int ret;
E
Edward Jee 已提交
2402 2403 2404 2405 2406 2407

	for_each_cmsghdr(cmsg, msg) {
		if (!CMSG_OK(msg, cmsg))
			return -EINVAL;
		if (cmsg->cmsg_level != SOL_SOCKET)
			continue;
2408 2409 2410
		ret = __sock_cmsg_send(sk, msg, cmsg, sockc);
		if (ret)
			return ret;
E
Edward Jee 已提交
2411 2412 2413 2414 2415
	}
	return 0;
}
EXPORT_SYMBOL(sock_cmsg_send);

2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430
static void sk_enter_memory_pressure(struct sock *sk)
{
	if (!sk->sk_prot->enter_memory_pressure)
		return;

	sk->sk_prot->enter_memory_pressure(sk);
}

static void sk_leave_memory_pressure(struct sock *sk)
{
	if (sk->sk_prot->leave_memory_pressure) {
		sk->sk_prot->leave_memory_pressure(sk);
	} else {
		unsigned long *memory_pressure = sk->sk_prot->memory_pressure;

2431 2432
		if (memory_pressure && READ_ONCE(*memory_pressure))
			WRITE_ONCE(*memory_pressure, 0);
2433 2434 2435
	}
}

2436
#define SKB_FRAG_PAGE_ORDER	get_order(32768)
2437
DEFINE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key);
2438

E
Eric Dumazet 已提交
2439 2440 2441 2442
/**
 * skb_page_frag_refill - check that a page_frag contains enough room
 * @sz: minimum size of the fragment we want to get
 * @pfrag: pointer to page_frag
2443
 * @gfp: priority for memory allocation
E
Eric Dumazet 已提交
2444 2445 2446 2447 2448
 *
 * Note: While this allocator tries to use high order pages, there is
 * no guarantee that allocations succeed. Therefore, @sz MUST be
 * less or equal than PAGE_SIZE.
 */
2449
bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t gfp)
2450 2451
{
	if (pfrag->page) {
2452
		if (page_ref_count(pfrag->page) == 1) {
2453 2454 2455
			pfrag->offset = 0;
			return true;
		}
E
Eric Dumazet 已提交
2456
		if (pfrag->offset + sz <= pfrag->size)
2457 2458 2459 2460
			return true;
		put_page(pfrag->page);
	}

2461
	pfrag->offset = 0;
2462 2463
	if (SKB_FRAG_PAGE_ORDER &&
	    !static_branch_unlikely(&net_high_order_alloc_disable_key)) {
2464 2465 2466 2467
		/* Avoid direct reclaim but allow kswapd to wake */
		pfrag->page = alloc_pages((gfp & ~__GFP_DIRECT_RECLAIM) |
					  __GFP_COMP | __GFP_NOWARN |
					  __GFP_NORETRY,
2468
					  SKB_FRAG_PAGE_ORDER);
2469
		if (likely(pfrag->page)) {
2470
			pfrag->size = PAGE_SIZE << SKB_FRAG_PAGE_ORDER;
2471 2472
			return true;
		}
2473 2474 2475 2476 2477 2478
	}
	pfrag->page = alloc_page(gfp);
	if (likely(pfrag->page)) {
		pfrag->size = PAGE_SIZE;
		return true;
	}
E
Eric Dumazet 已提交
2479 2480 2481 2482 2483 2484 2485 2486 2487
	return false;
}
EXPORT_SYMBOL(skb_page_frag_refill);

bool sk_page_frag_refill(struct sock *sk, struct page_frag *pfrag)
{
	if (likely(skb_page_frag_refill(32U, pfrag, sk->sk_allocation)))
		return true;

2488 2489 2490 2491 2492 2493
	sk_enter_memory_pressure(sk);
	sk_stream_moderate_sndbuf(sk);
	return false;
}
EXPORT_SYMBOL(sk_page_frag_refill);

L
Linus Torvalds 已提交
2494
static void __lock_sock(struct sock *sk)
2495 2496
	__releases(&sk->sk_lock.slock)
	__acquires(&sk->sk_lock.slock)
L
Linus Torvalds 已提交
2497 2498 2499
{
	DEFINE_WAIT(wait);

2500
	for (;;) {
L
Linus Torvalds 已提交
2501 2502 2503 2504 2505
		prepare_to_wait_exclusive(&sk->sk_lock.wq, &wait,
					TASK_UNINTERRUPTIBLE);
		spin_unlock_bh(&sk->sk_lock.slock);
		schedule();
		spin_lock_bh(&sk->sk_lock.slock);
2506
		if (!sock_owned_by_user(sk))
L
Linus Torvalds 已提交
2507 2508 2509 2510 2511
			break;
	}
	finish_wait(&sk->sk_lock.wq, &wait);
}

2512
void __release_sock(struct sock *sk)
2513 2514
	__releases(&sk->sk_lock.slock)
	__acquires(&sk->sk_lock.slock)
L
Linus Torvalds 已提交
2515
{
2516
	struct sk_buff *skb, *next;
L
Linus Torvalds 已提交
2517

2518
	while ((skb = sk->sk_backlog.head) != NULL) {
L
Linus Torvalds 已提交
2519 2520
		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;

2521
		spin_unlock_bh(&sk->sk_lock.slock);
L
Linus Torvalds 已提交
2522

2523 2524
		do {
			next = skb->next;
2525
			prefetch(next);
E
Eric Dumazet 已提交
2526
			WARN_ON_ONCE(skb_dst_is_noref(skb));
2527
			skb_mark_not_on_list(skb);
P
Peter Zijlstra 已提交
2528
			sk_backlog_rcv(sk, skb);
L
Linus Torvalds 已提交
2529

2530
			cond_resched();
L
Linus Torvalds 已提交
2531 2532 2533 2534

			skb = next;
		} while (skb != NULL);

2535 2536
		spin_lock_bh(&sk->sk_lock.slock);
	}
Z
Zhu Yi 已提交
2537 2538 2539 2540 2541 2542

	/*
	 * Doing the zeroing here guarantee we can not loop forever
	 * while a wild producer attempts to flood us.
	 */
	sk->sk_backlog.len = 0;
L
Linus Torvalds 已提交
2543 2544
}

2545 2546 2547 2548 2549 2550 2551
void __sk_flush_backlog(struct sock *sk)
{
	spin_lock_bh(&sk->sk_lock.slock);
	__release_sock(sk);
	spin_unlock_bh(&sk->sk_lock.slock);
}

L
Linus Torvalds 已提交
2552 2553
/**
 * sk_wait_data - wait for data to arrive at sk_receive_queue
2554 2555
 * @sk:    sock to wait on
 * @timeo: for how long
2556
 * @skb:   last skb seen on sk_receive_queue
L
Linus Torvalds 已提交
2557 2558 2559 2560 2561 2562
 *
 * Now socket state including sk->sk_err is changed only under lock,
 * hence we may omit checks after joining wait queue.
 * We check receive queue before schedule() only as optimization;
 * it is very likely that release_sock() added new data.
 */
2563
int sk_wait_data(struct sock *sk, long *timeo, const struct sk_buff *skb)
L
Linus Torvalds 已提交
2564
{
W
WANG Cong 已提交
2565
	DEFINE_WAIT_FUNC(wait, woken_wake_function);
L
Linus Torvalds 已提交
2566 2567
	int rc;

W
WANG Cong 已提交
2568
	add_wait_queue(sk_sleep(sk), &wait);
2569
	sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
W
WANG Cong 已提交
2570
	rc = sk_wait_event(sk, timeo, skb_peek_tail(&sk->sk_receive_queue) != skb, &wait);
2571
	sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
W
WANG Cong 已提交
2572
	remove_wait_queue(sk_sleep(sk), &wait);
L
Linus Torvalds 已提交
2573 2574 2575 2576
	return rc;
}
EXPORT_SYMBOL(sk_wait_data);

2577
/**
2578
 *	__sk_mem_raise_allocated - increase memory_allocated
2579 2580
 *	@sk: socket
 *	@size: memory size to allocate
2581
 *	@amt: pages to allocate
2582 2583
 *	@kind: allocation type
 *
2584
 *	Similar to __sk_mem_schedule(), but does not update sk_forward_alloc
2585
 */
2586
int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
2587 2588
{
	struct proto *prot = sk->sk_prot;
2589
	long allocated = sk_memory_allocated_add(sk, amt);
2590
	bool charged = true;
2591

2592
	if (mem_cgroup_sockets_enabled && sk->sk_memcg &&
2593
	    !(charged = mem_cgroup_charge_skmem(sk->sk_memcg, amt)))
2594
		goto suppress_allocation;
2595 2596

	/* Under limit. */
2597
	if (allocated <= sk_prot_mem_limits(sk, 0)) {
2598
		sk_leave_memory_pressure(sk);
2599 2600 2601
		return 1;
	}

2602 2603
	/* Under pressure. */
	if (allocated > sk_prot_mem_limits(sk, 1))
2604
		sk_enter_memory_pressure(sk);
2605

2606 2607
	/* Over hard limit. */
	if (allocated > sk_prot_mem_limits(sk, 2))
2608 2609 2610 2611
		goto suppress_allocation;

	/* guarantee minimum buffer size under pressure */
	if (kind == SK_MEM_RECV) {
2612
		if (atomic_read(&sk->sk_rmem_alloc) < sk_get_rmem0(sk, prot))
2613
			return 1;
2614

2615
	} else { /* SK_MEM_SEND */
2616 2617
		int wmem0 = sk_get_wmem0(sk, prot);

2618
		if (sk->sk_type == SOCK_STREAM) {
2619
			if (sk->sk_wmem_queued < wmem0)
2620
				return 1;
2621
		} else if (refcount_read(&sk->sk_wmem_alloc) < wmem0) {
2622
				return 1;
2623
		}
2624 2625
	}

2626
	if (sk_has_memory_pressure(sk)) {
2627
		u64 alloc;
2628

2629
		if (!sk_under_memory_pressure(sk))
2630
			return 1;
2631 2632
		alloc = sk_sockets_allocated_read_positive(sk);
		if (sk_prot_mem_limits(sk, 2) > alloc *
2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650
		    sk_mem_pages(sk->sk_wmem_queued +
				 atomic_read(&sk->sk_rmem_alloc) +
				 sk->sk_forward_alloc))
			return 1;
	}

suppress_allocation:

	if (kind == SK_MEM_SEND && sk->sk_type == SOCK_STREAM) {
		sk_stream_moderate_sndbuf(sk);

		/* Fail only if socket is _under_ its sndbuf.
		 * In this case we cannot block, so that we have to fail.
		 */
		if (sk->sk_wmem_queued + size >= sk->sk_sndbuf)
			return 1;
	}

2651 2652
	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
2653

2654
	sk_memory_allocated_sub(sk, amt);
2655

2656 2657
	if (mem_cgroup_sockets_enabled && sk->sk_memcg)
		mem_cgroup_uncharge_skmem(sk->sk_memcg, amt);
2658

2659 2660
	return 0;
}
2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682
EXPORT_SYMBOL(__sk_mem_raise_allocated);

/**
 *	__sk_mem_schedule - increase sk_forward_alloc and memory_allocated
 *	@sk: socket
 *	@size: memory size to allocate
 *	@kind: allocation type
 *
 *	If kind is SK_MEM_SEND, it means wmem allocation. Otherwise it means
 *	rmem allocation. This function assumes that protocols which have
 *	memory_pressure use sk_wmem_queued as write buffer accounting.
 */
int __sk_mem_schedule(struct sock *sk, int size, int kind)
{
	int ret, amt = sk_mem_pages(size);

	sk->sk_forward_alloc += amt << SK_MEM_QUANTUM_SHIFT;
	ret = __sk_mem_raise_allocated(sk, size, amt, kind);
	if (!ret)
		sk->sk_forward_alloc -= amt << SK_MEM_QUANTUM_SHIFT;
	return ret;
}
2683 2684 2685
EXPORT_SYMBOL(__sk_mem_schedule);

/**
2686
 *	__sk_mem_reduce_allocated - reclaim memory_allocated
2687
 *	@sk: socket
2688 2689 2690
 *	@amount: number of quanta
 *
 *	Similar to __sk_mem_reclaim(), but does not update sk_forward_alloc
2691
 */
2692
void __sk_mem_reduce_allocated(struct sock *sk, int amount)
2693
{
E
Eric Dumazet 已提交
2694
	sk_memory_allocated_sub(sk, amount);
2695

2696 2697
	if (mem_cgroup_sockets_enabled && sk->sk_memcg)
		mem_cgroup_uncharge_skmem(sk->sk_memcg, amount);
2698

2699 2700 2701
	if (sk_under_memory_pressure(sk) &&
	    (sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
		sk_leave_memory_pressure(sk);
2702
}
2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715
EXPORT_SYMBOL(__sk_mem_reduce_allocated);

/**
 *	__sk_mem_reclaim - reclaim sk_forward_alloc and memory_allocated
 *	@sk: socket
 *	@amount: number of bytes (rounded down to a SK_MEM_QUANTUM multiple)
 */
void __sk_mem_reclaim(struct sock *sk, int amount)
{
	amount >>= SK_MEM_QUANTUM_SHIFT;
	sk->sk_forward_alloc -= amount << SK_MEM_QUANTUM_SHIFT;
	__sk_mem_reduce_allocated(sk, amount);
}
2716 2717
EXPORT_SYMBOL(__sk_mem_reclaim);

2718 2719 2720 2721 2722 2723
int sk_set_peek_off(struct sock *sk, int val)
{
	sk->sk_peek_off = val;
	return 0;
}
EXPORT_SYMBOL_GPL(sk_set_peek_off);
2724

L
Linus Torvalds 已提交
2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735
/*
 * Set of default routines for initialising struct proto_ops when
 * the protocol does not support a particular function. In certain
 * cases where it makes no sense for a protocol to have a "do nothing"
 * function, some default processing is provided.
 */

int sock_no_bind(struct socket *sock, struct sockaddr *saddr, int len)
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2736
EXPORT_SYMBOL(sock_no_bind);
L
Linus Torvalds 已提交
2737

2738
int sock_no_connect(struct socket *sock, struct sockaddr *saddr,
L
Linus Torvalds 已提交
2739 2740 2741 2742
		    int len, int flags)
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2743
EXPORT_SYMBOL(sock_no_connect);
L
Linus Torvalds 已提交
2744 2745 2746 2747 2748

int sock_no_socketpair(struct socket *sock1, struct socket *sock2)
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2749
EXPORT_SYMBOL(sock_no_socketpair);
L
Linus Torvalds 已提交
2750

2751 2752
int sock_no_accept(struct socket *sock, struct socket *newsock, int flags,
		   bool kern)
L
Linus Torvalds 已提交
2753 2754 2755
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2756
EXPORT_SYMBOL(sock_no_accept);
L
Linus Torvalds 已提交
2757

2758
int sock_no_getname(struct socket *sock, struct sockaddr *saddr,
2759
		    int peer)
L
Linus Torvalds 已提交
2760 2761 2762
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2763
EXPORT_SYMBOL(sock_no_getname);
L
Linus Torvalds 已提交
2764 2765 2766 2767 2768

int sock_no_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2769
EXPORT_SYMBOL(sock_no_ioctl);
L
Linus Torvalds 已提交
2770 2771 2772 2773 2774

int sock_no_listen(struct socket *sock, int backlog)
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2775
EXPORT_SYMBOL(sock_no_listen);
L
Linus Torvalds 已提交
2776 2777 2778 2779 2780

int sock_no_shutdown(struct socket *sock, int how)
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2781
EXPORT_SYMBOL(sock_no_shutdown);
L
Linus Torvalds 已提交
2782

2783
int sock_no_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
L
Linus Torvalds 已提交
2784 2785 2786
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2787
EXPORT_SYMBOL(sock_no_sendmsg);
L
Linus Torvalds 已提交
2788

2789 2790 2791 2792 2793 2794
int sock_no_sendmsg_locked(struct sock *sk, struct msghdr *m, size_t len)
{
	return -EOPNOTSUPP;
}
EXPORT_SYMBOL(sock_no_sendmsg_locked);

2795 2796
int sock_no_recvmsg(struct socket *sock, struct msghdr *m, size_t len,
		    int flags)
L
Linus Torvalds 已提交
2797 2798 2799
{
	return -EOPNOTSUPP;
}
E
Eric Dumazet 已提交
2800
EXPORT_SYMBOL(sock_no_recvmsg);
L
Linus Torvalds 已提交
2801 2802 2803 2804 2805 2806

int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
{
	/* Mirror missing mmap method error code */
	return -ENODEV;
}
E
Eric Dumazet 已提交
2807
EXPORT_SYMBOL(sock_no_mmap);
L
Linus Torvalds 已提交
2808

2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829
/*
 * When a file is received (via SCM_RIGHTS, etc), we must bump the
 * various sock-based usage counts.
 */
void __receive_sock(struct file *file)
{
	struct socket *sock;
	int error;

	/*
	 * The resulting value of "error" is ignored here since we only
	 * need to take action when the file is a socket and testing
	 * "sock" for NULL is sufficient.
	 */
	sock = sock_from_file(file, &error);
	if (sock) {
		sock_update_netprioidx(&sock->sk->sk_cgrp_data);
		sock_update_classid(&sock->sk->sk_cgrp_data);
	}
}

L
Linus Torvalds 已提交
2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841
ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
{
	ssize_t res;
	struct msghdr msg = {.msg_flags = flags};
	struct kvec iov;
	char *kaddr = kmap(page);
	iov.iov_base = kaddr + offset;
	iov.iov_len = size;
	res = kernel_sendmsg(sock, &msg, &iov, 1, size);
	kunmap(page);
	return res;
}
E
Eric Dumazet 已提交
2842
EXPORT_SYMBOL(sock_no_sendpage);
L
Linus Torvalds 已提交
2843

2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859
ssize_t sock_no_sendpage_locked(struct sock *sk, struct page *page,
				int offset, size_t size, int flags)
{
	ssize_t res;
	struct msghdr msg = {.msg_flags = flags};
	struct kvec iov;
	char *kaddr = kmap(page);

	iov.iov_base = kaddr + offset;
	iov.iov_len = size;
	res = kernel_sendmsg_locked(sk, &msg, &iov, 1, size);
	kunmap(page);
	return res;
}
EXPORT_SYMBOL(sock_no_sendpage_locked);

L
Linus Torvalds 已提交
2860 2861 2862 2863 2864 2865
/*
 *	Default Socket Callbacks
 */

static void sock_def_wakeup(struct sock *sk)
{
2866 2867 2868 2869
	struct socket_wq *wq;

	rcu_read_lock();
	wq = rcu_dereference(sk->sk_wq);
H
Herbert Xu 已提交
2870
	if (skwq_has_sleeper(wq))
2871 2872
		wake_up_interruptible_all(&wq->wait);
	rcu_read_unlock();
L
Linus Torvalds 已提交
2873 2874 2875 2876
}

static void sock_def_error_report(struct sock *sk)
{
2877 2878 2879 2880
	struct socket_wq *wq;

	rcu_read_lock();
	wq = rcu_dereference(sk->sk_wq);
H
Herbert Xu 已提交
2881
	if (skwq_has_sleeper(wq))
2882
		wake_up_interruptible_poll(&wq->wait, EPOLLERR);
2883
	sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
2884
	rcu_read_unlock();
L
Linus Torvalds 已提交
2885 2886
}

2887
void sock_def_readable(struct sock *sk)
L
Linus Torvalds 已提交
2888
{
2889 2890 2891 2892
	struct socket_wq *wq;

	rcu_read_lock();
	wq = rcu_dereference(sk->sk_wq);
H
Herbert Xu 已提交
2893
	if (skwq_has_sleeper(wq))
2894 2895
		wake_up_interruptible_sync_poll(&wq->wait, EPOLLIN | EPOLLPRI |
						EPOLLRDNORM | EPOLLRDBAND);
2896
	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
2897
	rcu_read_unlock();
L
Linus Torvalds 已提交
2898 2899 2900 2901
}

static void sock_def_write_space(struct sock *sk)
{
2902 2903 2904
	struct socket_wq *wq;

	rcu_read_lock();
L
Linus Torvalds 已提交
2905 2906 2907 2908

	/* Do not wake up a writer until he can make "significant"
	 * progress.  --DaveM
	 */
2909
	if ((refcount_read(&sk->sk_wmem_alloc) << 1) <= READ_ONCE(sk->sk_sndbuf)) {
2910
		wq = rcu_dereference(sk->sk_wq);
H
Herbert Xu 已提交
2911
		if (skwq_has_sleeper(wq))
2912 2913
			wake_up_interruptible_sync_poll(&wq->wait, EPOLLOUT |
						EPOLLWRNORM | EPOLLWRBAND);
L
Linus Torvalds 已提交
2914 2915 2916

		/* Should agree with poll, otherwise some programs break */
		if (sock_writeable(sk))
2917
			sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
L
Linus Torvalds 已提交
2918 2919
	}

2920
	rcu_read_unlock();
L
Linus Torvalds 已提交
2921 2922 2923 2924 2925 2926 2927 2928 2929 2930
}

static void sock_def_destruct(struct sock *sk)
{
}

void sk_send_sigurg(struct sock *sk)
{
	if (sk->sk_socket && sk->sk_socket->file)
		if (send_sigurg(&sk->sk_socket->file->f_owner))
2931
			sk_wake_async(sk, SOCK_WAKE_URG, POLL_PRI);
L
Linus Torvalds 已提交
2932
}
E
Eric Dumazet 已提交
2933
EXPORT_SYMBOL(sk_send_sigurg);
L
Linus Torvalds 已提交
2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944

void sk_reset_timer(struct sock *sk, struct timer_list* timer,
		    unsigned long expires)
{
	if (!mod_timer(timer, expires))
		sock_hold(sk);
}
EXPORT_SYMBOL(sk_reset_timer);

void sk_stop_timer(struct sock *sk, struct timer_list* timer)
{
2945
	if (del_timer(timer))
L
Linus Torvalds 已提交
2946 2947 2948 2949 2950 2951
		__sock_put(sk);
}
EXPORT_SYMBOL(sk_stop_timer);

void sock_init_data(struct socket *sock, struct sock *sk)
{
2952
	sk_init_common(sk);
L
Linus Torvalds 已提交
2953 2954
	sk->sk_send_head	=	NULL;

2955
	timer_setup(&sk->sk_timer, NULL, 0);
2956

L
Linus Torvalds 已提交
2957 2958 2959 2960
	sk->sk_allocation	=	GFP_KERNEL;
	sk->sk_rcvbuf		=	sysctl_rmem_default;
	sk->sk_sndbuf		=	sysctl_wmem_default;
	sk->sk_state		=	TCP_CLOSE;
2961
	sk_set_socket(sk, sock);
L
Linus Torvalds 已提交
2962 2963 2964

	sock_set_flag(sk, SOCK_ZAPPED);

2965
	if (sock) {
L
Linus Torvalds 已提交
2966
		sk->sk_type	=	sock->type;
2967
		RCU_INIT_POINTER(sk->sk_wq, &sock->wq);
L
Linus Torvalds 已提交
2968
		sock->sk	=	sk;
2969 2970
		sk->sk_uid	=	SOCK_INODE(sock)->i_uid;
	} else {
2971
		RCU_INIT_POINTER(sk->sk_wq, NULL);
2972 2973
		sk->sk_uid	=	make_kuid(sock_net(sk)->user_ns, 0);
	}
L
Linus Torvalds 已提交
2974 2975

	rwlock_init(&sk->sk_callback_lock);
2976 2977 2978 2979 2980 2981 2982 2983
	if (sk->sk_kern_sock)
		lockdep_set_class_and_name(
			&sk->sk_callback_lock,
			af_kern_callback_keys + sk->sk_family,
			af_family_kern_clock_key_strings[sk->sk_family]);
	else
		lockdep_set_class_and_name(
			&sk->sk_callback_lock,
2984 2985
			af_callback_keys + sk->sk_family,
			af_family_clock_key_strings[sk->sk_family]);
L
Linus Torvalds 已提交
2986 2987 2988 2989 2990 2991 2992

	sk->sk_state_change	=	sock_def_wakeup;
	sk->sk_data_ready	=	sock_def_readable;
	sk->sk_write_space	=	sock_def_write_space;
	sk->sk_error_report	=	sock_def_error_report;
	sk->sk_destruct		=	sock_def_destruct;

2993 2994
	sk->sk_frag.page	=	NULL;
	sk->sk_frag.offset	=	0;
2995
	sk->sk_peek_off		=	-1;
L
Linus Torvalds 已提交
2996

2997 2998
	sk->sk_peer_pid 	=	NULL;
	sk->sk_peer_cred	=	NULL;
L
Linus Torvalds 已提交
2999 3000 3001 3002 3003
	sk->sk_write_pending	=	0;
	sk->sk_rcvlowat		=	1;
	sk->sk_rcvtimeo		=	MAX_SCHEDULE_TIMEOUT;
	sk->sk_sndtimeo		=	MAX_SCHEDULE_TIMEOUT;

3004
	sk->sk_stamp = SK_DEFAULT_STAMP;
3005 3006 3007
#if BITS_PER_LONG==32
	seqlock_init(&sk->sk_stamp_seq);
#endif
W
Willem de Bruijn 已提交
3008
	atomic_set(&sk->sk_zckey, 0);
L
Linus Torvalds 已提交
3009

3010
#ifdef CONFIG_NET_RX_BUSY_POLL
E
Eliezer Tamir 已提交
3011
	sk->sk_napi_id		=	0;
3012
	sk->sk_ll_usec		=	sysctl_net_busy_read;
E
Eliezer Tamir 已提交
3013 3014
#endif

3015 3016
	sk->sk_max_pacing_rate = ~0UL;
	sk->sk_pacing_rate = ~0UL;
3017
	WRITE_ONCE(sk->sk_pacing_shift, 10);
3018
	sk->sk_incoming_cpu = -1;
3019 3020

	sk_rx_queue_clear(sk);
E
Eric Dumazet 已提交
3021 3022
	/*
	 * Before updating sk_refcnt, we must commit prior changes to memory
3023
	 * (Documentation/RCU/rculist_nulls.rst for details)
E
Eric Dumazet 已提交
3024 3025
	 */
	smp_wmb();
3026
	refcount_set(&sk->sk_refcnt, 1);
W
Wang Chen 已提交
3027
	atomic_set(&sk->sk_drops, 0);
L
Linus Torvalds 已提交
3028
}
E
Eric Dumazet 已提交
3029
EXPORT_SYMBOL(sock_init_data);
L
Linus Torvalds 已提交
3030

H
Harvey Harrison 已提交
3031
void lock_sock_nested(struct sock *sk, int subclass)
L
Linus Torvalds 已提交
3032 3033
{
	might_sleep();
I
Ingo Molnar 已提交
3034
	spin_lock_bh(&sk->sk_lock.slock);
3035
	if (sk->sk_lock.owned)
L
Linus Torvalds 已提交
3036
		__lock_sock(sk);
3037
	sk->sk_lock.owned = 1;
I
Ingo Molnar 已提交
3038 3039 3040 3041
	spin_unlock(&sk->sk_lock.slock);
	/*
	 * The sk_lock has mutex_lock() semantics here:
	 */
3042
	mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_);
I
Ingo Molnar 已提交
3043
	local_bh_enable();
L
Linus Torvalds 已提交
3044
}
3045
EXPORT_SYMBOL(lock_sock_nested);
L
Linus Torvalds 已提交
3046

H
Harvey Harrison 已提交
3047
void release_sock(struct sock *sk)
L
Linus Torvalds 已提交
3048
{
I
Ingo Molnar 已提交
3049
	spin_lock_bh(&sk->sk_lock.slock);
L
Linus Torvalds 已提交
3050 3051
	if (sk->sk_backlog.tail)
		__release_sock(sk);
E
Eric Dumazet 已提交
3052

3053 3054 3055
	/* Warning : release_cb() might need to release sk ownership,
	 * ie call sock_release_ownership(sk) before us.
	 */
E
Eric Dumazet 已提交
3056 3057 3058
	if (sk->sk_prot->release_cb)
		sk->sk_prot->release_cb(sk);

3059
	sock_release_ownership(sk);
I
Ingo Molnar 已提交
3060 3061 3062
	if (waitqueue_active(&sk->sk_lock.wq))
		wake_up(&sk->sk_lock.wq);
	spin_unlock_bh(&sk->sk_lock.slock);
L
Linus Torvalds 已提交
3063 3064 3065
}
EXPORT_SYMBOL(release_sock);

3066 3067 3068 3069 3070
/**
 * lock_sock_fast - fast version of lock_sock
 * @sk: socket
 *
 * This version should be used for very small section, where process wont block
3071 3072
 * return false if fast path is taken:
 *
3073
 *   sk_lock.slock locked, owned = 0, BH disabled
3074 3075 3076
 *
 * return true if slow path is taken:
 *
3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101
 *   sk_lock.slock unlocked, owned = 1, BH enabled
 */
bool lock_sock_fast(struct sock *sk)
{
	might_sleep();
	spin_lock_bh(&sk->sk_lock.slock);

	if (!sk->sk_lock.owned)
		/*
		 * Note : We must disable BH
		 */
		return false;

	__lock_sock(sk);
	sk->sk_lock.owned = 1;
	spin_unlock(&sk->sk_lock.slock);
	/*
	 * The sk_lock has mutex_lock() semantics here:
	 */
	mutex_acquire(&sk->sk_lock.dep_map, 0, 0, _RET_IP_);
	local_bh_enable();
	return true;
}
EXPORT_SYMBOL(lock_sock_fast);

3102 3103
int sock_gettstamp(struct socket *sock, void __user *userstamp,
		   bool timeval, bool time32)
3104
{
3105 3106
	struct sock *sk = sock->sk;
	struct timespec64 ts;
3107 3108

	sock_enable_timestamp(sk, SOCK_TIMESTAMP);
3109 3110
	ts = ktime_to_timespec64(sock_read_timestamp(sk));
	if (ts.tv_sec == -1)
L
Linus Torvalds 已提交
3111
		return -ENOENT;
3112
	if (ts.tv_sec == 0) {
3113
		ktime_t kt = ktime_get_real();
Y
YueHaibing 已提交
3114
		sock_write_timestamp(sk, kt);
3115
		ts = ktime_to_timespec64(kt);
3116
	}
L
Linus Torvalds 已提交
3117

3118 3119
	if (timeval)
		ts.tv_nsec /= 1000;
3120

3121 3122 3123 3124 3125 3126 3127 3128
#ifdef CONFIG_COMPAT_32BIT_TIME
	if (time32)
		return put_old_timespec32(&ts, userstamp);
#endif
#ifdef CONFIG_SPARC64
	/* beware of padding in sparc64 timeval */
	if (timeval && !in_compat_syscall()) {
		struct __kernel_old_timeval __user tv = {
3129 3130
			.tv_sec = ts.tv_sec,
			.tv_usec = ts.tv_nsec,
3131
		};
3132
		if (copy_to_user(userstamp, &tv, sizeof(tv)))
3133 3134
			return -EFAULT;
		return 0;
3135
	}
3136 3137
#endif
	return put_timespec64(&ts, userstamp);
3138
}
3139
EXPORT_SYMBOL(sock_gettstamp);
3140

A
Alexey Dobriyan 已提交
3141
void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
3142
{
3143
	if (!sock_flag(sk, flag)) {
E
Eric Dumazet 已提交
3144 3145
		unsigned long previous_flags = sk->sk_flags;

3146 3147 3148 3149 3150 3151
		sock_set_flag(sk, flag);
		/*
		 * we just set one of the two flags which require net
		 * time stamping, but time stamping might have been on
		 * already because of the other one
		 */
3152 3153
		if (sock_needs_netstamp(sk) &&
		    !(previous_flags & SK_FLAGS_TIMESTAMP))
3154
			net_enable_timestamp();
L
Linus Torvalds 已提交
3155 3156 3157
	}
}

3158 3159 3160 3161
int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
		       int level, int type)
{
	struct sock_exterr_skb *serr;
3162
	struct sk_buff *skb;
3163 3164 3165
	int copied, err;

	err = -EAGAIN;
3166
	skb = sock_dequeue_err_skb(sk);
3167 3168 3169 3170 3171 3172 3173 3174
	if (skb == NULL)
		goto out;

	copied = skb->len;
	if (copied > len) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}
3175
	err = skb_copy_datagram_msg(skb, 0, msg, copied);
3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193
	if (err)
		goto out_free_skb;

	sock_recv_timestamp(msg, sk, skb);

	serr = SKB_EXT_ERR(skb);
	put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);

	msg->msg_flags |= MSG_ERRQUEUE;
	err = copied;

out_free_skb:
	kfree_skb(skb);
out:
	return err;
}
EXPORT_SYMBOL(sock_recv_errqueue);

L
Linus Torvalds 已提交
3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209
/*
 *	Get a socket option on an socket.
 *
 *	FIX: POSIX 1003.1g is very ambiguous here. It states that
 *	asynchronous errors should be reported by getsockopt. We assume
 *	this means if you specify SO_ERROR (otherwise whats the point of it).
 */
int sock_common_getsockopt(struct socket *sock, int level, int optname,
			   char __user *optval, int __user *optlen)
{
	struct sock *sk = sock->sk;

	return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);
}
EXPORT_SYMBOL(sock_common_getsockopt);

3210 3211
int sock_common_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
			int flags)
L
Linus Torvalds 已提交
3212 3213 3214 3215 3216
{
	struct sock *sk = sock->sk;
	int addr_len = 0;
	int err;

3217
	err = sk->sk_prot->recvmsg(sk, msg, size, flags & MSG_DONTWAIT,
L
Linus Torvalds 已提交
3218 3219 3220 3221 3222 3223 3224 3225 3226 3227 3228
				   flags & ~MSG_DONTWAIT, &addr_len);
	if (err >= 0)
		msg->msg_namelen = addr_len;
	return err;
}
EXPORT_SYMBOL(sock_common_recvmsg);

/*
 *	Set socket options on an inet socket.
 */
int sock_common_setsockopt(struct socket *sock, int level, int optname,
3229
			   sockptr_t optval, unsigned int optlen)
L
Linus Torvalds 已提交
3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267
{
	struct sock *sk = sock->sk;

	return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen);
}
EXPORT_SYMBOL(sock_common_setsockopt);

void sk_common_release(struct sock *sk)
{
	if (sk->sk_prot->destroy)
		sk->sk_prot->destroy(sk);

	/*
	 * Observation: when sock_common_release is called, processes have
	 * no access to socket. But net still has.
	 * Step one, detach it from networking:
	 *
	 * A. Remove from hash tables.
	 */

	sk->sk_prot->unhash(sk);

	/*
	 * In this point socket cannot receive new packets, but it is possible
	 * that some packets are in flight because some CPU runs receiver and
	 * did hash table lookup before we unhashed socket. They will achieve
	 * receive queue and will be purged by socket destructor.
	 *
	 * Also we still have packets pending on receive queue and probably,
	 * our own packets waiting in device queues. sock_destroy will drain
	 * receive queue, but transmitted packets will delay socket destruction
	 * until the last reference will be released.
	 */

	sock_orphan(sk);

	xfrm_sk_free_policy(sk);

3268
	sk_refcnt_debug_release(sk);
3269

L
Linus Torvalds 已提交
3270 3271 3272 3273
	sock_put(sk);
}
EXPORT_SYMBOL(sk_common_release);

3274 3275 3276 3277 3278
void sk_get_meminfo(const struct sock *sk, u32 *mem)
{
	memset(mem, 0, sizeof(*mem) * SK_MEMINFO_VARS);

	mem[SK_MEMINFO_RMEM_ALLOC] = sk_rmem_alloc_get(sk);
3279
	mem[SK_MEMINFO_RCVBUF] = READ_ONCE(sk->sk_rcvbuf);
3280
	mem[SK_MEMINFO_WMEM_ALLOC] = sk_wmem_alloc_get(sk);
3281
	mem[SK_MEMINFO_SNDBUF] = READ_ONCE(sk->sk_sndbuf);
3282
	mem[SK_MEMINFO_FWD_ALLOC] = sk->sk_forward_alloc;
3283
	mem[SK_MEMINFO_WMEM_QUEUED] = READ_ONCE(sk->sk_wmem_queued);
3284
	mem[SK_MEMINFO_OPTMEM] = atomic_read(&sk->sk_omem_alloc);
3285
	mem[SK_MEMINFO_BACKLOG] = READ_ONCE(sk->sk_backlog.len);
3286 3287 3288
	mem[SK_MEMINFO_DROPS] = atomic_read(&sk->sk_drops);
}

3289 3290
#ifdef CONFIG_PROC_FS
#define PROTO_INUSE_NR	64	/* should be enough for the first time */
3291 3292 3293
struct prot_inuse {
	int val[PROTO_INUSE_NR];
};
3294 3295

static DECLARE_BITMAP(proto_inuse_idx, PROTO_INUSE_NR);
3296 3297 3298

void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
{
3299
	__this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
3300 3301 3302 3303 3304 3305 3306 3307 3308
}
EXPORT_SYMBOL_GPL(sock_prot_inuse_add);

int sock_prot_inuse_get(struct net *net, struct proto *prot)
{
	int cpu, idx = prot->inuse_idx;
	int res = 0;

	for_each_possible_cpu(cpu)
3309
		res += per_cpu_ptr(net->core.prot_inuse, cpu)->val[idx];
3310 3311 3312 3313 3314

	return res >= 0 ? res : 0;
}
EXPORT_SYMBOL_GPL(sock_prot_inuse_get);

3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331
static void sock_inuse_add(struct net *net, int val)
{
	this_cpu_add(*net->core.sock_inuse, val);
}

int sock_inuse_get(struct net *net)
{
	int cpu, res = 0;

	for_each_possible_cpu(cpu)
		res += *per_cpu_ptr(net->core.sock_inuse, cpu);

	return res;
}

EXPORT_SYMBOL_GPL(sock_inuse_get);

3332
static int __net_init sock_inuse_init_net(struct net *net)
3333
{
3334
	net->core.prot_inuse = alloc_percpu(struct prot_inuse);
3335 3336 3337 3338 3339 3340 3341 3342 3343 3344 3345 3346
	if (net->core.prot_inuse == NULL)
		return -ENOMEM;

	net->core.sock_inuse = alloc_percpu(int);
	if (net->core.sock_inuse == NULL)
		goto out;

	return 0;

out:
	free_percpu(net->core.prot_inuse);
	return -ENOMEM;
3347 3348
}

3349
static void __net_exit sock_inuse_exit_net(struct net *net)
3350
{
3351
	free_percpu(net->core.prot_inuse);
3352
	free_percpu(net->core.sock_inuse);
3353 3354 3355 3356 3357 3358 3359 3360 3361 3362 3363 3364 3365 3366 3367 3368
}

static struct pernet_operations net_inuse_ops = {
	.init = sock_inuse_init_net,
	.exit = sock_inuse_exit_net,
};

static __init int net_inuse_init(void)
{
	if (register_pernet_subsys(&net_inuse_ops))
		panic("Cannot initialize net inuse counters");

	return 0;
}

core_initcall(net_inuse_init);
3369

3370
static int assign_proto_idx(struct proto *prot)
3371 3372 3373 3374
{
	prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);

	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
J
Joe Perches 已提交
3375
		pr_err("PROTO_INUSE_NR exhausted\n");
3376
		return -ENOSPC;
3377 3378 3379
	}

	set_bit(prot->inuse_idx, proto_inuse_idx);
3380
	return 0;
3381 3382 3383 3384 3385 3386 3387 3388
}

static void release_proto_idx(struct proto *prot)
{
	if (prot->inuse_idx != PROTO_INUSE_NR - 1)
		clear_bit(prot->inuse_idx, proto_inuse_idx);
}
#else
3389
static inline int assign_proto_idx(struct proto *prot)
3390
{
3391
	return 0;
3392 3393 3394 3395 3396
}

static inline void release_proto_idx(struct proto *prot)
{
}
3397 3398 3399 3400

static void sock_inuse_add(struct net *net, int val)
{
}
3401 3402
#endif

3403 3404 3405 3406 3407 3408 3409 3410 3411 3412
static void tw_prot_cleanup(struct timewait_sock_ops *twsk_prot)
{
	if (!twsk_prot)
		return;
	kfree(twsk_prot->twsk_slab_name);
	twsk_prot->twsk_slab_name = NULL;
	kmem_cache_destroy(twsk_prot->twsk_slab);
	twsk_prot->twsk_slab = NULL;
}

3413 3414 3415 3416 3417 3418
static void req_prot_cleanup(struct request_sock_ops *rsk_prot)
{
	if (!rsk_prot)
		return;
	kfree(rsk_prot->slab_name);
	rsk_prot->slab_name = NULL;
3419 3420
	kmem_cache_destroy(rsk_prot->slab);
	rsk_prot->slab = NULL;
3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436
}

static int req_prot_init(const struct proto *prot)
{
	struct request_sock_ops *rsk_prot = prot->rsk_prot;

	if (!rsk_prot)
		return 0;

	rsk_prot->slab_name = kasprintf(GFP_KERNEL, "request_sock_%s",
					prot->name);
	if (!rsk_prot->slab_name)
		return -ENOMEM;

	rsk_prot->slab = kmem_cache_create(rsk_prot->slab_name,
					   rsk_prot->obj_size, 0,
3437 3438
					   SLAB_ACCOUNT | prot->slab_flags,
					   NULL);
3439 3440 3441 3442 3443 3444 3445 3446 3447

	if (!rsk_prot->slab) {
		pr_crit("%s: Can't create request sock SLAB cache!\n",
			prot->name);
		return -ENOMEM;
	}
	return 0;
}

3448 3449
int proto_register(struct proto *prot, int alloc_slab)
{
3450 3451
	int ret = -ENOBUFS;

L
Linus Torvalds 已提交
3452
	if (alloc_slab) {
3453 3454
		prot->slab = kmem_cache_create_usercopy(prot->name,
					prot->obj_size, 0,
3455 3456
					SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT |
					prot->slab_flags,
3457
					prot->useroffset, prot->usersize,
3458
					NULL);
L
Linus Torvalds 已提交
3459 3460

		if (prot->slab == NULL) {
J
Joe Perches 已提交
3461 3462
			pr_crit("%s: Can't create sock SLAB cache!\n",
				prot->name);
3463
			goto out;
L
Linus Torvalds 已提交
3464
		}
3465

3466 3467
		if (req_prot_init(prot))
			goto out_free_request_sock_slab;
3468

3469
		if (prot->twsk_prot != NULL) {
3470
			prot->twsk_prot->twsk_slab_name = kasprintf(GFP_KERNEL, "tw_sock_%s", prot->name);
3471

3472
			if (prot->twsk_prot->twsk_slab_name == NULL)
3473 3474
				goto out_free_request_sock_slab;

3475
			prot->twsk_prot->twsk_slab =
3476
				kmem_cache_create(prot->twsk_prot->twsk_slab_name,
3477
						  prot->twsk_prot->twsk_obj_size,
3478
						  0,
3479
						  SLAB_ACCOUNT |
3480
						  prot->slab_flags,
3481
						  NULL);
3482
			if (prot->twsk_prot->twsk_slab == NULL)
3483
				goto out_free_timewait_sock_slab;
3484
		}
L
Linus Torvalds 已提交
3485 3486
	}

3487
	mutex_lock(&proto_list_mutex);
3488 3489 3490
	ret = assign_proto_idx(prot);
	if (ret) {
		mutex_unlock(&proto_list_mutex);
3491
		goto out_free_timewait_sock_slab;
3492
	}
L
Linus Torvalds 已提交
3493
	list_add(&prot->node, &proto_list);
3494
	mutex_unlock(&proto_list_mutex);
3495
	return ret;
3496

3497
out_free_timewait_sock_slab:
3498
	if (alloc_slab && prot->twsk_prot)
3499
		tw_prot_cleanup(prot->twsk_prot);
3500
out_free_request_sock_slab:
3501 3502
	if (alloc_slab) {
		req_prot_cleanup(prot->rsk_prot);
3503

3504 3505 3506
		kmem_cache_destroy(prot->slab);
		prot->slab = NULL;
	}
3507
out:
3508
	return ret;
L
Linus Torvalds 已提交
3509 3510 3511 3512 3513
}
EXPORT_SYMBOL(proto_register);

void proto_unregister(struct proto *prot)
{
3514
	mutex_lock(&proto_list_mutex);
3515
	release_proto_idx(prot);
3516
	list_del(&prot->node);
3517
	mutex_unlock(&proto_list_mutex);
L
Linus Torvalds 已提交
3518

3519 3520
	kmem_cache_destroy(prot->slab);
	prot->slab = NULL;
L
Linus Torvalds 已提交
3521

3522
	req_prot_cleanup(prot->rsk_prot);
3523
	tw_prot_cleanup(prot->twsk_prot);
L
Linus Torvalds 已提交
3524 3525 3526
}
EXPORT_SYMBOL(proto_unregister);

3527 3528 3529 3530 3531 3532 3533 3534 3535 3536 3537 3538
int sock_load_diag_module(int family, int protocol)
{
	if (!protocol) {
		if (!sock_is_registered(family))
			return -ENOENT;

		return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
				      NETLINK_SOCK_DIAG, family);
	}

#ifdef CONFIG_INET
	if (family == AF_INET &&
3539
	    protocol != IPPROTO_RAW &&
3540
	    protocol < MAX_INET_PROTOS &&
3541 3542 3543 3544 3545 3546 3547 3548 3549
	    !rcu_access_pointer(inet_protos[protocol]))
		return -ENOENT;
#endif

	return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
			      NETLINK_SOCK_DIAG, family, protocol);
}
EXPORT_SYMBOL(sock_load_diag_module);

L
Linus Torvalds 已提交
3550 3551
#ifdef CONFIG_PROC_FS
static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
3552
	__acquires(proto_list_mutex)
L
Linus Torvalds 已提交
3553
{
3554
	mutex_lock(&proto_list_mutex);
3555
	return seq_list_start_head(&proto_list, *pos);
L
Linus Torvalds 已提交
3556 3557 3558 3559
}

static void *proto_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
3560
	return seq_list_next(v, &proto_list, pos);
L
Linus Torvalds 已提交
3561 3562 3563
}

static void proto_seq_stop(struct seq_file *seq, void *v)
3564
	__releases(proto_list_mutex)
L
Linus Torvalds 已提交
3565
{
3566
	mutex_unlock(&proto_list_mutex);
L
Linus Torvalds 已提交
3567 3568 3569 3570 3571 3572
}

static char proto_method_implemented(const void *method)
{
	return method == NULL ? 'n' : 'y';
}
3573 3574
static long sock_prot_memory_allocated(struct proto *proto)
{
3575
	return proto->memory_allocated != NULL ? proto_memory_allocated(proto) : -1L;
3576 3577
}

3578
static const char *sock_prot_memory_pressure(struct proto *proto)
3579 3580 3581 3582
{
	return proto->memory_pressure != NULL ?
	proto_memory_pressure(proto) ? "yes" : "no" : "NI";
}
L
Linus Torvalds 已提交
3583 3584 3585

static void proto_seq_printf(struct seq_file *seq, struct proto *proto)
{
3586

E
Eric Dumazet 已提交
3587
	seq_printf(seq, "%-9s %4u %6d  %6ld   %-3s %6u   %-3s  %-10s "
L
Linus Torvalds 已提交
3588 3589 3590
			"%2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c\n",
		   proto->name,
		   proto->obj_size,
3591
		   sock_prot_inuse_get(seq_file_net(seq), proto),
3592 3593
		   sock_prot_memory_allocated(proto),
		   sock_prot_memory_pressure(proto),
L
Linus Torvalds 已提交
3594 3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619
		   proto->max_header,
		   proto->slab == NULL ? "no" : "yes",
		   module_name(proto->owner),
		   proto_method_implemented(proto->close),
		   proto_method_implemented(proto->connect),
		   proto_method_implemented(proto->disconnect),
		   proto_method_implemented(proto->accept),
		   proto_method_implemented(proto->ioctl),
		   proto_method_implemented(proto->init),
		   proto_method_implemented(proto->destroy),
		   proto_method_implemented(proto->shutdown),
		   proto_method_implemented(proto->setsockopt),
		   proto_method_implemented(proto->getsockopt),
		   proto_method_implemented(proto->sendmsg),
		   proto_method_implemented(proto->recvmsg),
		   proto_method_implemented(proto->sendpage),
		   proto_method_implemented(proto->bind),
		   proto_method_implemented(proto->backlog_rcv),
		   proto_method_implemented(proto->hash),
		   proto_method_implemented(proto->unhash),
		   proto_method_implemented(proto->get_port),
		   proto_method_implemented(proto->enter_memory_pressure));
}

static int proto_seq_show(struct seq_file *seq, void *v)
{
3620
	if (v == &proto_list)
L
Linus Torvalds 已提交
3621 3622 3623 3624 3625 3626 3627 3628 3629 3630 3631
		seq_printf(seq, "%-9s %-4s %-8s %-6s %-5s %-7s %-4s %-10s %s",
			   "protocol",
			   "size",
			   "sockets",
			   "memory",
			   "press",
			   "maxhdr",
			   "slab",
			   "module",
			   "cl co di ac io in de sh ss gs se re sp bi br ha uh gp em\n");
	else
3632
		proto_seq_printf(seq, list_entry(v, struct proto, node));
L
Linus Torvalds 已提交
3633 3634 3635
	return 0;
}

3636
static const struct seq_operations proto_seq_ops = {
L
Linus Torvalds 已提交
3637 3638 3639 3640 3641 3642
	.start  = proto_seq_start,
	.next   = proto_seq_next,
	.stop   = proto_seq_stop,
	.show   = proto_seq_show,
};

3643 3644
static __net_init int proto_init_net(struct net *net)
{
3645 3646
	if (!proc_create_net("protocols", 0444, net->proc_net, &proto_seq_ops,
			sizeof(struct seq_net_private)))
3647 3648 3649 3650 3651 3652 3653
		return -ENOMEM;

	return 0;
}

static __net_exit void proto_exit_net(struct net *net)
{
3654
	remove_proc_entry("protocols", net->proc_net);
3655 3656 3657 3658 3659 3660
}


static __net_initdata struct pernet_operations proto_net_ops = {
	.init = proto_init_net,
	.exit = proto_exit_net,
L
Linus Torvalds 已提交
3661 3662 3663 3664
};

static int __init proto_init(void)
{
3665
	return register_pernet_subsys(&proto_net_ops);
L
Linus Torvalds 已提交
3666 3667 3668 3669 3670
}

subsys_initcall(proto_init);

#endif /* PROC_FS */
3671 3672 3673 3674 3675 3676

#ifdef CONFIG_NET_RX_BUSY_POLL
bool sk_busy_loop_end(void *p, unsigned long start_time)
{
	struct sock *sk = p;

3677
	return !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
3678 3679 3680 3681
	       sk_busy_loop_timeout(sk, start_time);
}
EXPORT_SYMBOL(sk_busy_loop_end);
#endif /* CONFIG_NET_RX_BUSY_POLL */
3682 3683 3684 3685 3686 3687 3688 3689

int sock_bind_add(struct sock *sk, struct sockaddr *addr, int addr_len)
{
	if (!sk->sk_prot->bind_add)
		return -EOPNOTSUPP;
	return sk->sk_prot->bind_add(sk, addr, addr_len);
}
EXPORT_SYMBOL(sock_bind_add);