path: root/net/socket.c (plain)
blob: 68b1bba36bc8af77822af89df1d3e275483304e9

1	/*
2	* NET An implementation of the SOCKET network access protocol.
3	*
4	* Version: @(#)socket.c 1.1.93 18/02/95
5	*
6	* Authors: Orest Zborowski, <obz@Kodak.COM>
7	* Ross Biro
8	* Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9	*
10	* Fixes:
11	* Anonymous : NOTSOCK/BADF cleanup. Error fix in
12	* shutdown()
13	* Alan Cox : verify_area() fixes
14	* Alan Cox : Removed DDI
15	* Jonathan Kamens : SOCK_DGRAM reconnect bug
16	* Alan Cox : Moved a load of checks to the very
17	* top level.
18	* Alan Cox : Move address structures to/from user
19	* mode above the protocol layers.
20	* Rob Janssen : Allow 0 length sends.
21	* Alan Cox : Asynchronous I/O support (cribbed from the
22	* tty drivers).
23	* Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24	* Jeff Uphoff : Made max number of sockets command-line
25	* configurable.
26	* Matti Aarnio : Made the number of sockets dynamic,
27	* to be allocated when needed, and mr.
28	* Uphoff's max is used as max to be
29	* allowed to allocate.
30	* Linus : Argh. removed all the socket allocation
31	* altogether: it's in the inode now.
32	* Alan Cox : Made sock_alloc()/sock_release() public
33	* for NetROM and future kernel nfsd type
34	* stuff.
35	* Alan Cox : sendmsg/recvmsg basics.
36	* Tom Dyas : Export net symbols.
37	* Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38	* Alan Cox : Added thread locking to sys_* calls
39	* for sockets. May have errors at the
40	* moment.
41	* Kevin Buhr : Fixed the dumb errors in the above.
42	* Andi Kleen : Some small cleanups, optimizations,
43	* and fixed a copy_from_user() bug.
44	* Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
45	* Tigran Aivazian : Made listen(2) backlog sanity checks
46	* protocol-independent
47	*
48	*
49	* This program is free software; you can redistribute it and/or
50	* modify it under the terms of the GNU General Public License
51	* as published by the Free Software Foundation; either version
52	* 2 of the License, or (at your option) any later version.
53	*
54	*
55	* This module is effectively the top level interface to the BSD socket
56	* paradigm.
57	*
58	* Based upon Swansea University Computer Society NET3.039
59	*/
60
61	#include <linux/mm.h>
62	#include <linux/socket.h>
63	#include <linux/file.h>
64	#include <linux/net.h>
65	#include <linux/interrupt.h>
66	#include <linux/thread_info.h>
67	#include <linux/rcupdate.h>
68	#include <linux/netdevice.h>
69	#include <linux/proc_fs.h>
70	#include <linux/seq_file.h>
71	#include <linux/mutex.h>
72	#include <linux/if_bridge.h>
73	#include <linux/if_frad.h>
74	#include <linux/if_vlan.h>
75	#include <linux/ptp_classify.h>
76	#include <linux/init.h>
77	#include <linux/poll.h>
78	#include <linux/cache.h>
79	#include <linux/module.h>
80	#include <linux/highmem.h>
81	#include <linux/mount.h>
82	#include <linux/security.h>
83	#include <linux/syscalls.h>
84	#include <linux/compat.h>
85	#include <linux/kmod.h>
86	#include <linux/audit.h>
87	#include <linux/wireless.h>
88	#include <linux/nsproxy.h>
89	#include <linux/magic.h>
90	#include <linux/slab.h>
91	#include <linux/xattr.h>
92	#include <linux/nospec.h>
93
94	#include <asm/uaccess.h>
95	#include <asm/unistd.h>
96
97	#include <net/compat.h>
98	#include <net/wext.h>
99	#include <net/cls_cgroup.h>
100
101	#include <net/sock.h>
102	#include <linux/netfilter.h>
103
104	#include <linux/if_tun.h>
105	#include <linux/ipv6_route.h>
106	#include <linux/route.h>
107	#include <linux/sockios.h>
108	#include <linux/atalk.h>
109	#include <net/busy_poll.h>
110	#include <linux/errqueue.h>
111
112	#ifdef CONFIG_NET_RX_BUSY_POLL
113	unsigned int sysctl_net_busy_read __read_mostly;
114	unsigned int sysctl_net_busy_poll __read_mostly;
115	#endif
116
117	static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
118	static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
119	static int sock_mmap(struct file *file, struct vm_area_struct *vma);
120
121	static int sock_close(struct inode *inode, struct file *file);
122	static unsigned int sock_poll(struct file *file,
123	struct poll_table_struct *wait);
124	static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
125	#ifdef CONFIG_COMPAT
126	static long compat_sock_ioctl(struct file *file,
127	unsigned int cmd, unsigned long arg);
128	#endif
129	static int sock_fasync(int fd, struct file *filp, int on);
130	static ssize_t sock_sendpage(struct file *file, struct page *page,
131	int offset, size_t size, loff_t *ppos, int more);
132	static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
133	struct pipe_inode_info *pipe, size_t len,
134	unsigned int flags);
135
136	/*
137	* Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
138	* in the operation structures but are done directly via the socketcall() multiplexor.
139	*/
140
141	static const struct file_operations socket_file_ops = {
142	.owner = THIS_MODULE,
143	.llseek = no_llseek,
144	.read_iter = sock_read_iter,
145	.write_iter = sock_write_iter,
146	.poll = sock_poll,
147	.unlocked_ioctl = sock_ioctl,
148	#ifdef CONFIG_COMPAT
149	.compat_ioctl = compat_sock_ioctl,
150	#endif
151	.mmap = sock_mmap,
152	.release = sock_close,
153	.fasync = sock_fasync,
154	.sendpage = sock_sendpage,
155	.splice_write = generic_splice_sendpage,
156	.splice_read = sock_splice_read,
157	};
158
159	/*
160	* The protocol list. Each protocol is registered in here.
161	*/
162
163	static DEFINE_SPINLOCK(net_family_lock);
164	static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
165
166	/*
167	* Statistics counters of the socket lists
168	*/
169
170	static DEFINE_PER_CPU(int, sockets_in_use);
171
172	/*
173	* Support routines.
174	* Move socket addresses back and forth across the kernel/user
175	* divide and look after the messy bits.
176	*/
177
178	/**
179	* move_addr_to_kernel - copy a socket address into kernel space
180	* @uaddr: Address in user space
181	* @kaddr: Address in kernel space
182	* @ulen: Length in user space
183	*
184	* The address is copied into kernel space. If the provided address is
185	* too long an error code of -EINVAL is returned. If the copy gives
186	* invalid addresses -EFAULT is returned. On a success 0 is returned.
187	*/
188
189	int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
190	{
191	if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
192	return -EINVAL;
193	if (ulen == 0)
194	return 0;
195	if (copy_from_user(kaddr, uaddr, ulen))
196	return -EFAULT;
197	return audit_sockaddr(ulen, kaddr);
198	}
199
200	/**
201	* move_addr_to_user - copy an address to user space
202	* @kaddr: kernel space address
203	* @klen: length of address in kernel
204	* @uaddr: user space address
205	* @ulen: pointer to user length field
206	*
207	* The value pointed to by ulen on entry is the buffer length available.
208	* This is overwritten with the buffer space used. -EINVAL is returned
209	* if an overlong buffer is specified or a negative buffer size. -EFAULT
210	* is returned if either the buffer or the length field are not
211	* accessible.
212	* After copying the data up to the limit the user specifies, the true
213	* length of the data is written over the length limit the user
214	* specified. Zero is returned for a success.
215	*/
216
217	static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
218	void __user *uaddr, int __user *ulen)
219	{
220	int err;
221	int len;
222
223	BUG_ON(klen > sizeof(struct sockaddr_storage));
224	err = get_user(len, ulen);
225	if (err)
226	return err;
227	if (len > klen)
228	len = klen;
229	if (len < 0)
230	return -EINVAL;
231	if (len) {
232	if (audit_sockaddr(klen, kaddr))
233	return -ENOMEM;
234	if (copy_to_user(uaddr, kaddr, len))
235	return -EFAULT;
236	}
237	/*
238	* "fromlen shall refer to the value before truncation.."
239	* 1003.1g
240	*/
241	return __put_user(klen, ulen);
242	}
243
244	static struct kmem_cache *sock_inode_cachep __read_mostly;
245
246	static struct inode *sock_alloc_inode(struct super_block *sb)
247	{
248	struct socket_alloc *ei;
249	struct socket_wq *wq;
250
251	ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
252	if (!ei)
253	return NULL;
254	wq = kmalloc(sizeof(*wq), GFP_KERNEL);
255	if (!wq) {
256	kmem_cache_free(sock_inode_cachep, ei);
257	return NULL;
258	}
259	init_waitqueue_head(&wq->wait);
260	wq->fasync_list = NULL;
261	wq->flags = 0;
262	RCU_INIT_POINTER(ei->socket.wq, wq);
263
264	ei->socket.state = SS_UNCONNECTED;
265	ei->socket.flags = 0;
266	ei->socket.ops = NULL;
267	ei->socket.sk = NULL;
268	ei->socket.file = NULL;
269
270	return &ei->vfs_inode;
271	}
272
273	static void sock_destroy_inode(struct inode *inode)
274	{
275	struct socket_alloc *ei;
276	struct socket_wq *wq;
277
278	ei = container_of(inode, struct socket_alloc, vfs_inode);
279	wq = rcu_dereference_protected(ei->socket.wq, 1);
280	kfree_rcu(wq, rcu);
281	kmem_cache_free(sock_inode_cachep, ei);
282	}
283
284	static void init_once(void *foo)
285	{
286	struct socket_alloc *ei = (struct socket_alloc *)foo;
287
288	inode_init_once(&ei->vfs_inode);
289	}
290
291	static int init_inodecache(void)
292	{
293	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
294	sizeof(struct socket_alloc),
295	0,
296	(SLAB_HWCACHE_ALIGN |
297	SLAB_RECLAIM_ACCOUNT |
298	SLAB_MEM_SPREAD | SLAB_ACCOUNT),
299	init_once);
300	if (sock_inode_cachep == NULL)
301	return -ENOMEM;
302	return 0;
303	}
304
305	static const struct super_operations sockfs_ops = {
306	.alloc_inode = sock_alloc_inode,
307	.destroy_inode = sock_destroy_inode,
308	.statfs = simple_statfs,
309	};
310
311	/*
312	* sockfs_dname() is called from d_path().
313	*/
314	static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
315	{
316	return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
317	d_inode(dentry)->i_ino);
318	}
319
320	static const struct dentry_operations sockfs_dentry_operations = {
321	.d_dname = sockfs_dname,
322	};
323
324	static int sockfs_xattr_get(const struct xattr_handler *handler,
325	struct dentry *dentry, struct inode *inode,
326	const char *suffix, void *value, size_t size)
327	{
328	if (value) {
329	if (dentry->d_name.len + 1 > size)
330	return -ERANGE;
331	memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
332	}
333	return dentry->d_name.len + 1;
334	}
335
336	#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
337	#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
338	#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
339
340	static const struct xattr_handler sockfs_xattr_handler = {
341	.name = XATTR_NAME_SOCKPROTONAME,
342	.get = sockfs_xattr_get,
343	};
344
345	static int sockfs_security_xattr_set(const struct xattr_handler *handler,
346	struct dentry *dentry, struct inode *inode,
347	const char *suffix, const void *value,
348	size_t size, int flags)
349	{
350	/* Handled by LSM. */
351	return -EAGAIN;
352	}
353
354	static const struct xattr_handler sockfs_security_xattr_handler = {
355	.prefix = XATTR_SECURITY_PREFIX,
356	.set = sockfs_security_xattr_set,
357	};
358
359	static const struct xattr_handler *sockfs_xattr_handlers[] = {
360	&sockfs_xattr_handler,
361	&sockfs_security_xattr_handler,
362	NULL
363	};
364
365	static struct dentry *sockfs_mount(struct file_system_type *fs_type,
366	int flags, const char *dev_name, void *data)
367	{
368	return mount_pseudo_xattr(fs_type, "socket:", &sockfs_ops,
369	sockfs_xattr_handlers,
370	&sockfs_dentry_operations, SOCKFS_MAGIC);
371	}
372
373	static struct vfsmount *sock_mnt __read_mostly;
374
375	static struct file_system_type sock_fs_type = {
376	.name = "sockfs",
377	.mount = sockfs_mount,
378	.kill_sb = kill_anon_super,
379	};
380
381	/*
382	* Obtains the first available file descriptor and sets it up for use.
383	*
384	* These functions create file structures and maps them to fd space
385	* of the current process. On success it returns file descriptor
386	* and file struct implicitly stored in sock->file.
387	* Note that another thread may close file descriptor before we return
388	* from this function. We use the fact that now we do not refer
389	* to socket after mapping. If one day we will need it, this
390	* function will increment ref. count on file by 1.
391	*
392	* In any case returned fd MAY BE not valid!
393	* This race condition is unavoidable
394	* with shared fd spaces, we cannot solve it inside kernel,
395	* but we take care of internal coherence yet.
396	*/
397
398	struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
399	{
400	struct qstr name = { .name = "" };
401	struct path path;
402	struct file *file;
403
404	if (dname) {
405	name.name = dname;
406	name.len = strlen(name.name);
407	} else if (sock->sk) {
408	name.name = sock->sk->sk_prot_creator->name;
409	name.len = strlen(name.name);
410	}
411	path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
412	if (unlikely(!path.dentry))
413	return ERR_PTR(-ENOMEM);
414	path.mnt = mntget(sock_mnt);
415
416	d_instantiate(path.dentry, SOCK_INODE(sock));
417
418	file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
419	&socket_file_ops);
420	if (IS_ERR(file)) {
421	/* drop dentry, keep inode */
422	ihold(d_inode(path.dentry));
423	path_put(&path);
424	return file;
425	}
426
427	sock->file = file;
428	file->f_flags = O_RDWR | (flags & O_NONBLOCK);
429	file->private_data = sock;
430	return file;
431	}
432	EXPORT_SYMBOL(sock_alloc_file);
433
434	static int sock_map_fd(struct socket *sock, int flags)
435	{
436	struct file *newfile;
437	int fd = get_unused_fd_flags(flags);
438	if (unlikely(fd < 0))
439	return fd;
440
441	newfile = sock_alloc_file(sock, flags, NULL);
442	if (likely(!IS_ERR(newfile))) {
443	fd_install(fd, newfile);
444	return fd;
445	}
446
447	put_unused_fd(fd);
448	return PTR_ERR(newfile);
449	}
450
451	struct socket *sock_from_file(struct file *file, int *err)
452	{
453	if (file->f_op == &socket_file_ops)
454	return file->private_data; /* set in sock_map_fd */
455
456	*err = -ENOTSOCK;
457	return NULL;
458	}
459	EXPORT_SYMBOL(sock_from_file);
460
461	/**
462	* sockfd_lookup - Go from a file number to its socket slot
463	* @fd: file handle
464	* @err: pointer to an error code return
465	*
466	* The file handle passed in is locked and the socket it is bound
467	* too is returned. If an error occurs the err pointer is overwritten
468	* with a negative errno code and NULL is returned. The function checks
469	* for both invalid handles and passing a handle which is not a socket.
470	*
471	* On a success the socket object pointer is returned.
472	*/
473
474	struct socket *sockfd_lookup(int fd, int *err)
475	{
476	struct file *file;
477	struct socket *sock;
478
479	file = fget(fd);
480	if (!file) {
481	*err = -EBADF;
482	return NULL;
483	}
484
485	sock = sock_from_file(file, err);
486	if (!sock)
487	fput(file);
488	return sock;
489	}
490	EXPORT_SYMBOL(sockfd_lookup);
491
492	static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
493	{
494	struct fd f = fdget(fd);
495	struct socket *sock;
496
497	*err = -EBADF;
498	if (f.file) {
499	sock = sock_from_file(f.file, err);
500	if (likely(sock)) {
501	*fput_needed = f.flags;
502	return sock;
503	}
504	fdput(f);
505	}
506	return NULL;
507	}
508
509	static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
510	size_t size)
511	{
512	ssize_t len;
513	ssize_t used = 0;
514
515	len = security_inode_listsecurity(d_inode(dentry), buffer, size);
516	if (len < 0)
517	return len;
518	used += len;
519	if (buffer) {
520	if (size < used)
521	return -ERANGE;
522	buffer += len;
523	}
524
525	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
526	used += len;
527	if (buffer) {
528	if (size < used)
529	return -ERANGE;
530	memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
531	buffer += len;
532	}
533
534	return used;
535	}
536
537	static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
538	{
539	int err = simple_setattr(dentry, iattr);
540
541	if (!err && (iattr->ia_valid & ATTR_UID)) {
542	struct socket *sock = SOCKET_I(d_inode(dentry));
543
544	if (sock->sk)
545	sock->sk->sk_uid = iattr->ia_uid;
546	else
547	err = -ENOENT;
548	}
549
550	return err;
551	}
552
553	static const struct inode_operations sockfs_inode_ops = {
554	.listxattr = sockfs_listxattr,
555	.setattr = sockfs_setattr,
556	};
557
558	/**
559	* sock_alloc - allocate a socket
560	*
561	* Allocate a new inode and socket object. The two are bound together
562	* and initialised. The socket is then returned. If we are out of inodes
563	* NULL is returned.
564	*/
565
566	struct socket *sock_alloc(void)
567	{
568	struct inode *inode;
569	struct socket *sock;
570
571	inode = new_inode_pseudo(sock_mnt->mnt_sb);
572	if (!inode)
573	return NULL;
574
575	sock = SOCKET_I(inode);
576
577	kmemcheck_annotate_bitfield(sock, type);
578	inode->i_ino = get_next_ino();
579	inode->i_mode = S_IFSOCK | S_IRWXUGO;
580	inode->i_uid = current_fsuid();
581	inode->i_gid = current_fsgid();
582	inode->i_op = &sockfs_inode_ops;
583
584	this_cpu_add(sockets_in_use, 1);
585	return sock;
586	}
587	EXPORT_SYMBOL(sock_alloc);
588
589	/**
590	* sock_release - close a socket
591	* @sock: socket to close
592	*
593	* The socket is released from the protocol stack if it has a release
594	* callback, and the inode is then released if the socket is bound to
595	* an inode not a file.
596	*/
597
598	static void __sock_release(struct socket *sock, struct inode *inode)
599	{
600	if (sock->ops) {
601	struct module *owner = sock->ops->owner;
602
603	if (inode)
604	inode_lock(inode);
605	sock->ops->release(sock);
606	sock->sk = NULL;
607	if (inode)
608	inode_unlock(inode);
609	sock->ops = NULL;
610	module_put(owner);
611	}
612
613	if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
614	pr_err("%s: fasync list not empty!\n", __func__);
615
616	this_cpu_sub(sockets_in_use, 1);
617	if (!sock->file) {
618	iput(SOCK_INODE(sock));
619	return;
620	}
621	sock->file = NULL;
622	}
623
624	void sock_release(struct socket *sock)
625	{
626	__sock_release(sock, NULL);
627	}
628	EXPORT_SYMBOL(sock_release);
629
630	void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
631	{
632	u8 flags = *tx_flags;
633
634	if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
635	flags |= SKBTX_HW_TSTAMP;
636
637	if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
638	flags |= SKBTX_SW_TSTAMP;
639
640	if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
641	flags |= SKBTX_SCHED_TSTAMP;
642
643	*tx_flags = flags;
644	}
645	EXPORT_SYMBOL(__sock_tx_timestamp);
646
647	static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
648	{
649	int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
650	BUG_ON(ret == -EIOCBQUEUED);
651	return ret;
652	}
653
654	int sock_sendmsg(struct socket *sock, struct msghdr *msg)
655	{
656	int err = security_socket_sendmsg(sock, msg,
657	msg_data_left(msg));
658
659	return err ?: sock_sendmsg_nosec(sock, msg);
660	}
661	EXPORT_SYMBOL(sock_sendmsg);
662
663	int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
664	struct kvec *vec, size_t num, size_t size)
665	{
666	iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
667	return sock_sendmsg(sock, msg);
668	}
669	EXPORT_SYMBOL(kernel_sendmsg);
670
671	/*
672	* called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
673	*/
674	void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
675	struct sk_buff *skb)
676	{
677	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
678	struct scm_timestamping tss;
679	int empty = 1;
680	struct skb_shared_hwtstamps *shhwtstamps =
681	skb_hwtstamps(skb);
682
683	/* Race occurred between timestamp enabling and packet
684	receiving. Fill in the current time for now. */
685	if (need_software_tstamp && skb->tstamp.tv64 == 0)
686	__net_timestamp(skb);
687
688	if (need_software_tstamp) {
689	if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
690	struct timeval tv;
691	skb_get_timestamp(skb, &tv);
692	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
693	sizeof(tv), &tv);
694	} else {
695	struct timespec ts;
696	skb_get_timestampns(skb, &ts);
697	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
698	sizeof(ts), &ts);
699	}
700	}
701
702	memset(&tss, 0, sizeof(tss));
703	if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
704	ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
705	empty = 0;
706	if (shhwtstamps &&
707	(sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
708	ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
709	empty = 0;
710	if (!empty)
711	put_cmsg(msg, SOL_SOCKET,
712	SCM_TIMESTAMPING, sizeof(tss), &tss);
713	}
714	EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
715
716	void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
717	struct sk_buff *skb)
718	{
719	int ack;
720
721	if (!sock_flag(sk, SOCK_WIFI_STATUS))
722	return;
723	if (!skb->wifi_acked_valid)
724	return;
725
726	ack = skb->wifi_acked;
727
728	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
729	}
730	EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
731
732	static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
733	struct sk_buff *skb)
734	{
735	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
736	put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
737	sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
738	}
739
740	void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
741	struct sk_buff *skb)
742	{
743	sock_recv_timestamp(msg, sk, skb);
744	sock_recv_drops(msg, sk, skb);
745	}
746	EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
747
748	static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
749	int flags)
750	{
751	return sock->ops->recvmsg(sock, msg, msg_data_left(msg), flags);
752	}
753
754	int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
755	{
756	int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
757
758	return err ?: sock_recvmsg_nosec(sock, msg, flags);
759	}
760	EXPORT_SYMBOL(sock_recvmsg);
761
762	/**
763	* kernel_recvmsg - Receive a message from a socket (kernel space)
764	* @sock: The socket to receive the message from
765	* @msg: Received message
766	* @vec: Input s/g array for message data
767	* @num: Size of input s/g array
768	* @size: Number of bytes to read
769	* @flags: Message flags (MSG_DONTWAIT, etc...)
770	*
771	* On return the msg structure contains the scatter/gather array passed in the
772	* vec argument. The array is modified so that it consists of the unfilled
773	* portion of the original array.
774	*
775	* The returned value is the total number of bytes received, or an error.
776	*/
777	int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
778	struct kvec *vec, size_t num, size_t size, int flags)
779	{
780	mm_segment_t oldfs = get_fs();
781	int result;
782
783	iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
784	set_fs(KERNEL_DS);
785	result = sock_recvmsg(sock, msg, flags);
786	set_fs(oldfs);
787	return result;
788	}
789	EXPORT_SYMBOL(kernel_recvmsg);
790
791	static ssize_t sock_sendpage(struct file *file, struct page *page,
792	int offset, size_t size, loff_t *ppos, int more)
793	{
794	struct socket *sock;
795	int flags;
796
797	sock = file->private_data;
798
799	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
800	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
801	flags |= more;
802
803	return kernel_sendpage(sock, page, offset, size, flags);
804	}
805
806	static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
807	struct pipe_inode_info *pipe, size_t len,
808	unsigned int flags)
809	{
810	struct socket *sock = file->private_data;
811
812	if (unlikely(!sock->ops->splice_read))
813	return -EINVAL;
814
815	return sock->ops->splice_read(sock, ppos, pipe, len, flags);
816	}
817
818	static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
819	{
820	struct file *file = iocb->ki_filp;
821	struct socket *sock = file->private_data;
822	struct msghdr msg = {.msg_iter = *to,
823	.msg_iocb = iocb};
824	ssize_t res;
825
826	if (file->f_flags & O_NONBLOCK)
827	msg.msg_flags = MSG_DONTWAIT;
828
829	if (iocb->ki_pos != 0)
830	return -ESPIPE;
831
832	if (!iov_iter_count(to)) /* Match SYS5 behaviour */
833	return 0;
834
835	res = sock_recvmsg(sock, &msg, msg.msg_flags);
836	*to = msg.msg_iter;
837	return res;
838	}
839
840	static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
841	{
842	struct file *file = iocb->ki_filp;
843	struct socket *sock = file->private_data;
844	struct msghdr msg = {.msg_iter = *from,
845	.msg_iocb = iocb};
846	ssize_t res;
847
848	if (iocb->ki_pos != 0)
849	return -ESPIPE;
850
851	if (file->f_flags & O_NONBLOCK)
852	msg.msg_flags = MSG_DONTWAIT;
853
854	if (sock->type == SOCK_SEQPACKET)
855	msg.msg_flags |= MSG_EOR;
856
857	res = sock_sendmsg(sock, &msg);
858	*from = msg.msg_iter;
859	return res;
860	}
861
862	/*
863	* Atomic setting of ioctl hooks to avoid race
864	* with module unload.
865	*/
866
867	static DEFINE_MUTEX(br_ioctl_mutex);
868	static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
869
870	void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
871	{
872	mutex_lock(&br_ioctl_mutex);
873	br_ioctl_hook = hook;
874	mutex_unlock(&br_ioctl_mutex);
875	}
876	EXPORT_SYMBOL(brioctl_set);
877
878	static DEFINE_MUTEX(vlan_ioctl_mutex);
879	static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
880
881	void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
882	{
883	mutex_lock(&vlan_ioctl_mutex);
884	vlan_ioctl_hook = hook;
885	mutex_unlock(&vlan_ioctl_mutex);
886	}
887	EXPORT_SYMBOL(vlan_ioctl_set);
888
889	static DEFINE_MUTEX(dlci_ioctl_mutex);
890	static int (*dlci_ioctl_hook) (unsigned int, void __user *);
891
892	void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
893	{
894	mutex_lock(&dlci_ioctl_mutex);
895	dlci_ioctl_hook = hook;
896	mutex_unlock(&dlci_ioctl_mutex);
897	}
898	EXPORT_SYMBOL(dlci_ioctl_set);
899
900	static long sock_do_ioctl(struct net *net, struct socket *sock,
901	unsigned int cmd, unsigned long arg)
902	{
903	int err;
904	void __user *argp = (void __user *)arg;
905
906	err = sock->ops->ioctl(sock, cmd, arg);
907
908	/*
909	* If this ioctl is unknown try to hand it down
910	* to the NIC driver.
911	*/
912	if (err == -ENOIOCTLCMD)
913	err = dev_ioctl(net, cmd, argp);
914
915	return err;
916	}
917
918	/*
919	* With an ioctl, arg may well be a user mode pointer, but we don't know
920	* what to do with it - that's up to the protocol still.
921	*/
922
923	static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
924	{
925	struct socket *sock;
926	struct sock *sk;
927	void __user *argp = (void __user *)arg;
928	int pid, err;
929	struct net *net;
930
931	sock = file->private_data;
932	sk = sock->sk;
933	net = sock_net(sk);
934	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
935	err = dev_ioctl(net, cmd, argp);
936	} else
937	#ifdef CONFIG_WEXT_CORE
938	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
939	err = dev_ioctl(net, cmd, argp);
940	} else
941	#endif
942	switch (cmd) {
943	case FIOSETOWN:
944	case SIOCSPGRP:
945	err = -EFAULT;
946	if (get_user(pid, (int __user *)argp))
947	break;
948	f_setown(sock->file, pid, 1);
949	err = 0;
950	break;
951	case FIOGETOWN:
952	case SIOCGPGRP:
953	err = put_user(f_getown(sock->file),
954	(int __user *)argp);
955	break;
956	case SIOCGIFBR:
957	case SIOCSIFBR:
958	case SIOCBRADDBR:
959	case SIOCBRDELBR:
960	err = -ENOPKG;
961	if (!br_ioctl_hook)
962	request_module("bridge");
963
964	mutex_lock(&br_ioctl_mutex);
965	if (br_ioctl_hook)
966	err = br_ioctl_hook(net, cmd, argp);
967	mutex_unlock(&br_ioctl_mutex);
968	break;
969	case SIOCGIFVLAN:
970	case SIOCSIFVLAN:
971	err = -ENOPKG;
972	if (!vlan_ioctl_hook)
973	request_module("8021q");
974
975	mutex_lock(&vlan_ioctl_mutex);
976	if (vlan_ioctl_hook)
977	err = vlan_ioctl_hook(net, argp);
978	mutex_unlock(&vlan_ioctl_mutex);
979	break;
980	case SIOCADDDLCI:
981	case SIOCDELDLCI:
982	err = -ENOPKG;
983	if (!dlci_ioctl_hook)
984	request_module("dlci");
985
986	mutex_lock(&dlci_ioctl_mutex);
987	if (dlci_ioctl_hook)
988	err = dlci_ioctl_hook(cmd, argp);
989	mutex_unlock(&dlci_ioctl_mutex);
990	break;
991	default:
992	err = sock_do_ioctl(net, sock, cmd, arg);
993	break;
994	}
995	return err;
996	}
997
998	int sock_create_lite(int family, int type, int protocol, struct socket **res)
999	{
1000	int err;
1001	struct socket *sock = NULL;
1002
1003	err = security_socket_create(family, type, protocol, 1);
1004	if (err)
1005	goto out;
1006
1007	sock = sock_alloc();
1008	if (!sock) {
1009	err = -ENOMEM;
1010	goto out;
1011	}
1012
1013	sock->type = type;
1014	err = security_socket_post_create(sock, family, type, protocol, 1);
1015	if (err)
1016	goto out_release;
1017
1018	out:
1019	*res = sock;
1020	return err;
1021	out_release:
1022	sock_release(sock);
1023	sock = NULL;
1024	goto out;
1025	}
1026	EXPORT_SYMBOL(sock_create_lite);
1027
1028	/* No kernel lock held - perfect */
1029	static unsigned int sock_poll(struct file *file, poll_table *wait)
1030	{
1031	unsigned int busy_flag = 0;
1032	struct socket *sock;
1033
1034	/*
1035	* We can't return errors to poll, so it's either yes or no.
1036	*/
1037	sock = file->private_data;
1038
1039	if (sk_can_busy_loop(sock->sk)) {
1040	/* this socket can poll_ll so tell the system call */
1041	busy_flag = POLL_BUSY_LOOP;
1042
1043	/* once, only if requested by syscall */
1044	if (wait && (wait->_key & POLL_BUSY_LOOP))
1045	sk_busy_loop(sock->sk, 1);
1046	}
1047
1048	return busy_flag | sock->ops->poll(file, sock, wait);
1049	}
1050
1051	static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1052	{
1053	struct socket *sock = file->private_data;
1054
1055	return sock->ops->mmap(file, sock, vma);
1056	}
1057
1058	static int sock_close(struct inode *inode, struct file *filp)
1059	{
1060	__sock_release(SOCKET_I(inode), inode);
1061	return 0;
1062	}
1063
1064	/*
1065	* Update the socket async list
1066	*
1067	* Fasync_list locking strategy.
1068	*
1069	* 1. fasync_list is modified only under process context socket lock
1070	* i.e. under semaphore.
1071	* 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1072	* or under socket lock
1073	*/
1074
1075	static int sock_fasync(int fd, struct file *filp, int on)
1076	{
1077	struct socket *sock = filp->private_data;
1078	struct sock *sk = sock->sk;
1079	struct socket_wq *wq;
1080
1081	if (sk == NULL)
1082	return -EINVAL;
1083
1084	lock_sock(sk);
1085	wq = rcu_dereference_protected(sock->wq, lockdep_sock_is_held(sk));
1086	fasync_helper(fd, filp, on, &wq->fasync_list);
1087
1088	if (!wq->fasync_list)
1089	sock_reset_flag(sk, SOCK_FASYNC);
1090	else
1091	sock_set_flag(sk, SOCK_FASYNC);
1092
1093	release_sock(sk);
1094	return 0;
1095	}
1096
1097	/* This function may be called only under rcu_lock */
1098
1099	int sock_wake_async(struct socket_wq *wq, int how, int band)
1100	{
1101	if (!wq || !wq->fasync_list)
1102	return -1;
1103
1104	switch (how) {
1105	case SOCK_WAKE_WAITD:
1106	if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1107	break;
1108	goto call_kill;
1109	case SOCK_WAKE_SPACE:
1110	if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1111	break;
1112	/* fall through */
1113	case SOCK_WAKE_IO:
1114	call_kill:
1115	kill_fasync(&wq->fasync_list, SIGIO, band);
1116	break;
1117	case SOCK_WAKE_URG:
1118	kill_fasync(&wq->fasync_list, SIGURG, band);
1119	}
1120
1121	return 0;
1122	}
1123	EXPORT_SYMBOL(sock_wake_async);
1124
1125	int __sock_create(struct net *net, int family, int type, int protocol,
1126	struct socket **res, int kern)
1127	{
1128	int err;
1129	struct socket *sock;
1130	const struct net_proto_family *pf;
1131
1132	/*
1133	* Check protocol is in range
1134	*/
1135	if (family < 0 || family >= NPROTO)
1136	return -EAFNOSUPPORT;
1137	if (type < 0 || type >= SOCK_MAX)
1138	return -EINVAL;
1139
1140	/* Compatibility.
1141
1142	This uglymoron is moved from INET layer to here to avoid
1143	deadlock in module load.
1144	*/
1145	if (family == PF_INET && type == SOCK_PACKET) {
1146	pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1147	current->comm);
1148	family = PF_PACKET;
1149	}
1150
1151	err = security_socket_create(family, type, protocol, kern);
1152	if (err)
1153	return err;
1154
1155	/*
1156	* Allocate the socket and allow the family to set things up. if
1157	* the protocol is 0, the family is instructed to select an appropriate
1158	* default.
1159	*/
1160	sock = sock_alloc();
1161	if (!sock) {
1162	net_warn_ratelimited("socket: no more sockets\n");
1163	return -ENFILE; /* Not exactly a match, but its the
1164	closest posix thing */
1165	}
1166
1167	sock->type = type;
1168
1169	#ifdef CONFIG_MODULES
1170	/* Attempt to load a protocol module if the find failed.
1171	*
1172	* 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1173	* requested real, full-featured networking support upon configuration.
1174	* Otherwise module support will break!
1175	*/
1176	if (rcu_access_pointer(net_families[family]) == NULL)
1177	request_module("net-pf-%d", family);
1178	#endif
1179
1180	rcu_read_lock();
1181	pf = rcu_dereference(net_families[family]);
1182	err = -EAFNOSUPPORT;
1183	if (!pf)
1184	goto out_release;
1185
1186	/*
1187	* We will call the ->create function, that possibly is in a loadable
1188	* module, so we have to bump that loadable module refcnt first.
1189	*/
1190	if (!try_module_get(pf->owner))
1191	goto out_release;
1192
1193	/* Now protected by module ref count */
1194	rcu_read_unlock();
1195
1196	err = pf->create(net, sock, protocol, kern);
1197	if (err < 0)
1198	goto out_module_put;
1199
1200	/*
1201	* Now to bump the refcnt of the [loadable] module that owns this
1202	* socket at sock_release time we decrement its refcnt.
1203	*/
1204	if (!try_module_get(sock->ops->owner))
1205	goto out_module_busy;
1206
1207	/*
1208	* Now that we're done with the ->create function, the [loadable]
1209	* module can have its refcnt decremented
1210	*/
1211	module_put(pf->owner);
1212	err = security_socket_post_create(sock, family, type, protocol, kern);
1213	if (err)
1214	goto out_sock_release;
1215	*res = sock;
1216
1217	return 0;
1218
1219	out_module_busy:
1220	err = -EAFNOSUPPORT;
1221	out_module_put:
1222	sock->ops = NULL;
1223	module_put(pf->owner);
1224	out_sock_release:
1225	sock_release(sock);
1226	return err;
1227
1228	out_release:
1229	rcu_read_unlock();
1230	goto out_sock_release;
1231	}
1232	EXPORT_SYMBOL(__sock_create);
1233
1234	int sock_create(int family, int type, int protocol, struct socket **res)
1235	{
1236	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1237	}
1238	EXPORT_SYMBOL(sock_create);
1239
1240	int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1241	{
1242	return __sock_create(net, family, type, protocol, res, 1);
1243	}
1244	EXPORT_SYMBOL(sock_create_kern);
1245
1246	SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1247	{
1248	int retval;
1249	struct socket *sock;
1250	int flags;
1251
1252	/* Check the SOCK_* constants for consistency. */
1253	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1254	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1255	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1256	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1257
1258	flags = type & ~SOCK_TYPE_MASK;
1259	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1260	return -EINVAL;
1261	type &= SOCK_TYPE_MASK;
1262
1263	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1264	flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1265
1266	retval = sock_create(family, type, protocol, &sock);
1267	if (retval < 0)
1268	goto out;
1269
1270	retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1271	if (retval < 0)
1272	goto out_release;
1273
1274	out:
1275	/* It may be already another descriptor 8) Not kernel problem. */
1276	return retval;
1277
1278	out_release:
1279	sock_release(sock);
1280	return retval;
1281	}
1282
1283	/*
1284	* Create a pair of connected sockets.
1285	*/
1286
1287	SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1288	int __user *, usockvec)
1289	{
1290	struct socket *sock1, *sock2;
1291	int fd1, fd2, err;
1292	struct file *newfile1, *newfile2;
1293	int flags;
1294
1295	flags = type & ~SOCK_TYPE_MASK;
1296	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1297	return -EINVAL;
1298	type &= SOCK_TYPE_MASK;
1299
1300	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1301	flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1302
1303	/*
1304	* Obtain the first socket and check if the underlying protocol
1305	* supports the socketpair call.
1306	*/
1307
1308	err = sock_create(family, type, protocol, &sock1);
1309	if (err < 0)
1310	goto out;
1311
1312	err = sock_create(family, type, protocol, &sock2);
1313	if (err < 0)
1314	goto out_release_1;
1315
1316	err = sock1->ops->socketpair(sock1, sock2);
1317	if (err < 0)
1318	goto out_release_both;
1319
1320	fd1 = get_unused_fd_flags(flags);
1321	if (unlikely(fd1 < 0)) {
1322	err = fd1;
1323	goto out_release_both;
1324	}
1325
1326	fd2 = get_unused_fd_flags(flags);
1327	if (unlikely(fd2 < 0)) {
1328	err = fd2;
1329	goto out_put_unused_1;
1330	}
1331
1332	newfile1 = sock_alloc_file(sock1, flags, NULL);
1333	if (IS_ERR(newfile1)) {
1334	err = PTR_ERR(newfile1);
1335	goto out_put_unused_both;
1336	}
1337
1338	newfile2 = sock_alloc_file(sock2, flags, NULL);
1339	if (IS_ERR(newfile2)) {
1340	err = PTR_ERR(newfile2);
1341	goto out_fput_1;
1342	}
1343
1344	err = put_user(fd1, &usockvec[0]);
1345	if (err)
1346	goto out_fput_both;
1347
1348	err = put_user(fd2, &usockvec[1]);
1349	if (err)
1350	goto out_fput_both;
1351
1352	audit_fd_pair(fd1, fd2);
1353
1354	fd_install(fd1, newfile1);
1355	fd_install(fd2, newfile2);
1356	/* fd1 and fd2 may be already another descriptors.
1357	* Not kernel problem.
1358	*/
1359
1360	return 0;
1361
1362	out_fput_both:
1363	fput(newfile2);
1364	fput(newfile1);
1365	put_unused_fd(fd2);
1366	put_unused_fd(fd1);
1367	goto out;
1368
1369	out_fput_1:
1370	fput(newfile1);
1371	put_unused_fd(fd2);
1372	put_unused_fd(fd1);
1373	sock_release(sock2);
1374	goto out;
1375
1376	out_put_unused_both:
1377	put_unused_fd(fd2);
1378	out_put_unused_1:
1379	put_unused_fd(fd1);
1380	out_release_both:
1381	sock_release(sock2);
1382	out_release_1:
1383	sock_release(sock1);
1384	out:
1385	return err;
1386	}
1387
1388	/*
1389	* Bind a name to a socket. Nothing much to do here since it's
1390	* the protocol's responsibility to handle the local address.
1391	*
1392	* We move the socket address to kernel space before we call
1393	* the protocol layer (having also checked the address is ok).
1394	*/
1395
1396	SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1397	{
1398	struct socket *sock;
1399	struct sockaddr_storage address;
1400	int err, fput_needed;
1401
1402	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1403	if (sock) {
1404	err = move_addr_to_kernel(umyaddr, addrlen, &address);
1405	if (err >= 0) {
1406	err = security_socket_bind(sock,
1407	(struct sockaddr *)&address,
1408	addrlen);
1409	if (!err)
1410	err = sock->ops->bind(sock,
1411	(struct sockaddr *)
1412	&address, addrlen);
1413	}
1414	fput_light(sock->file, fput_needed);
1415	}
1416	return err;
1417	}
1418
1419	/*
1420	* Perform a listen. Basically, we allow the protocol to do anything
1421	* necessary for a listen, and if that works, we mark the socket as
1422	* ready for listening.
1423	*/
1424
1425	SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1426	{
1427	struct socket *sock;
1428	int err, fput_needed;
1429	int somaxconn;
1430
1431	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1432	if (sock) {
1433	somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1434	if ((unsigned int)backlog > somaxconn)
1435	backlog = somaxconn;
1436
1437	err = security_socket_listen(sock, backlog);
1438	if (!err)
1439	err = sock->ops->listen(sock, backlog);
1440
1441	fput_light(sock->file, fput_needed);
1442	}
1443	return err;
1444	}
1445
1446	/*
1447	* For accept, we attempt to create a new socket, set up the link
1448	* with the client, wake up the client, then return the new
1449	* connected fd. We collect the address of the connector in kernel
1450	* space and move it to user at the very end. This is unclean because
1451	* we open the socket then return an error.
1452	*
1453	* 1003.1g adds the ability to recvmsg() to query connection pending
1454	* status to recvmsg. We need to add that support in a way thats
1455	* clean when we restucture accept also.
1456	*/
1457
1458	SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1459	int __user *, upeer_addrlen, int, flags)
1460	{
1461	struct socket *sock, *newsock;
1462	struct file *newfile;
1463	int err, len, newfd, fput_needed;
1464	struct sockaddr_storage address;
1465
1466	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1467	return -EINVAL;
1468
1469	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1470	flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1471
1472	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1473	if (!sock)
1474	goto out;
1475
1476	err = -ENFILE;
1477	newsock = sock_alloc();
1478	if (!newsock)
1479	goto out_put;
1480
1481	newsock->type = sock->type;
1482	newsock->ops = sock->ops;
1483
1484	/*
1485	* We don't need try_module_get here, as the listening socket (sock)
1486	* has the protocol module (sock->ops->owner) held.
1487	*/
1488	__module_get(newsock->ops->owner);
1489
1490	newfd = get_unused_fd_flags(flags);
1491	if (unlikely(newfd < 0)) {
1492	err = newfd;
1493	sock_release(newsock);
1494	goto out_put;
1495	}
1496	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1497	if (IS_ERR(newfile)) {
1498	err = PTR_ERR(newfile);
1499	put_unused_fd(newfd);
1500	sock_release(newsock);
1501	goto out_put;
1502	}
1503
1504	err = security_socket_accept(sock, newsock);
1505	if (err)
1506	goto out_fd;
1507
1508	err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1509	if (err < 0)
1510	goto out_fd;
1511
1512	if (upeer_sockaddr) {
1513	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1514	&len, 2) < 0) {
1515	err = -ECONNABORTED;
1516	goto out_fd;
1517	}
1518	err = move_addr_to_user(&address,
1519	len, upeer_sockaddr, upeer_addrlen);
1520	if (err < 0)
1521	goto out_fd;
1522	}
1523
1524	/* File flags are not inherited via accept() unlike another OSes. */
1525
1526	fd_install(newfd, newfile);
1527	err = newfd;
1528
1529	out_put:
1530	fput_light(sock->file, fput_needed);
1531	out:
1532	return err;
1533	out_fd:
1534	fput(newfile);
1535	put_unused_fd(newfd);
1536	goto out_put;
1537	}
1538
1539	SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1540	int __user *, upeer_addrlen)
1541	{
1542	return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1543	}
1544
1545	/*
1546	* Attempt to connect to a socket with the server address. The address
1547	* is in user space so we verify it is OK and move it to kernel space.
1548	*
1549	* For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1550	* break bindings
1551	*
1552	* NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1553	* other SEQPACKET protocols that take time to connect() as it doesn't
1554	* include the -EINPROGRESS status for such sockets.
1555	*/
1556
1557	SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1558	int, addrlen)
1559	{
1560	struct socket *sock;
1561	struct sockaddr_storage address;
1562	int err, fput_needed;
1563
1564	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1565	if (!sock)
1566	goto out;
1567	err = move_addr_to_kernel(uservaddr, addrlen, &address);
1568	if (err < 0)
1569	goto out_put;
1570
1571	err =
1572	security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1573	if (err)
1574	goto out_put;
1575
1576	err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1577	sock->file->f_flags);
1578	out_put:
1579	fput_light(sock->file, fput_needed);
1580	out:
1581	return err;
1582	}
1583
1584	/*
1585	* Get the local address ('name') of a socket object. Move the obtained
1586	* name to user space.
1587	*/
1588
1589	SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1590	int __user *, usockaddr_len)
1591	{
1592	struct socket *sock;
1593	struct sockaddr_storage address;
1594	int len, err, fput_needed;
1595
1596	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1597	if (!sock)
1598	goto out;
1599
1600	err = security_socket_getsockname(sock);
1601	if (err)
1602	goto out_put;
1603
1604	err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1605	if (err)
1606	goto out_put;
1607	err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1608
1609	out_put:
1610	fput_light(sock->file, fput_needed);
1611	out:
1612	return err;
1613	}
1614
1615	/*
1616	* Get the remote address ('name') of a socket object. Move the obtained
1617	* name to user space.
1618	*/
1619
1620	SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1621	int __user *, usockaddr_len)
1622	{
1623	struct socket *sock;
1624	struct sockaddr_storage address;
1625	int len, err, fput_needed;
1626
1627	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1628	if (sock != NULL) {
1629	err = security_socket_getpeername(sock);
1630	if (err) {
1631	fput_light(sock->file, fput_needed);
1632	return err;
1633	}
1634
1635	err =
1636	sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1637	1);
1638	if (!err)
1639	err = move_addr_to_user(&address, len, usockaddr,
1640	usockaddr_len);
1641	fput_light(sock->file, fput_needed);
1642	}
1643	return err;
1644	}
1645
1646	/*
1647	* Send a datagram to a given address. We move the address into kernel
1648	* space and check the user space data area is readable before invoking
1649	* the protocol.
1650	*/
1651
1652	SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1653	unsigned int, flags, struct sockaddr __user *, addr,
1654	int, addr_len)
1655	{
1656	struct socket *sock;
1657	struct sockaddr_storage address;
1658	int err;
1659	struct msghdr msg;
1660	struct iovec iov;
1661	int fput_needed;
1662
1663	err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1664	if (unlikely(err))
1665	return err;
1666	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1667	if (!sock)
1668	goto out;
1669
1670	msg.msg_name = NULL;
1671	msg.msg_control = NULL;
1672	msg.msg_controllen = 0;
1673	msg.msg_namelen = 0;
1674	if (addr) {
1675	err = move_addr_to_kernel(addr, addr_len, &address);
1676	if (err < 0)
1677	goto out_put;
1678	msg.msg_name = (struct sockaddr *)&address;
1679	msg.msg_namelen = addr_len;
1680	}
1681	if (sock->file->f_flags & O_NONBLOCK)
1682	flags |= MSG_DONTWAIT;
1683	msg.msg_flags = flags;
1684	err = sock_sendmsg(sock, &msg);
1685
1686	out_put:
1687	fput_light(sock->file, fput_needed);
1688	out:
1689	return err;
1690	}
1691
1692	/*
1693	* Send a datagram down a socket.
1694	*/
1695
1696	SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1697	unsigned int, flags)
1698	{
1699	return sys_sendto(fd, buff, len, flags, NULL, 0);
1700	}
1701
1702	/*
1703	* Receive a frame from the socket and optionally record the address of the
1704	* sender. We verify the buffers are writable and if needed move the
1705	* sender address from kernel to user space.
1706	*/
1707
1708	SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1709	unsigned int, flags, struct sockaddr __user *, addr,
1710	int __user *, addr_len)
1711	{
1712	struct socket *sock;
1713	struct iovec iov;
1714	struct msghdr msg;
1715	struct sockaddr_storage address;
1716	int err, err2;
1717	int fput_needed;
1718
1719	err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1720	if (unlikely(err))
1721	return err;
1722	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1723	if (!sock)
1724	goto out;
1725
1726	msg.msg_control = NULL;
1727	msg.msg_controllen = 0;
1728	/* Save some cycles and don't copy the address if not needed */
1729	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1730	/* We assume all kernel code knows the size of sockaddr_storage */
1731	msg.msg_namelen = 0;
1732	msg.msg_iocb = NULL;
1733	msg.msg_flags = 0;
1734	if (sock->file->f_flags & O_NONBLOCK)
1735	flags |= MSG_DONTWAIT;
1736	err = sock_recvmsg(sock, &msg, flags);
1737
1738	if (err >= 0 && addr != NULL) {
1739	err2 = move_addr_to_user(&address,
1740	msg.msg_namelen, addr, addr_len);
1741	if (err2 < 0)
1742	err = err2;
1743	}
1744
1745	fput_light(sock->file, fput_needed);
1746	out:
1747	return err;
1748	}
1749
1750	/*
1751	* Receive a datagram from a socket.
1752	*/
1753
1754	SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1755	unsigned int, flags)
1756	{
1757	return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1758	}
1759
1760	/*
1761	* Set a socket option. Because we don't know the option lengths we have
1762	* to pass the user mode parameter for the protocols to sort out.
1763	*/
1764
1765	SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1766	char __user *, optval, int, optlen)
1767	{
1768	int err, fput_needed;
1769	struct socket *sock;
1770
1771	if (optlen < 0)
1772	return -EINVAL;
1773
1774	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1775	if (sock != NULL) {
1776	err = security_socket_setsockopt(sock, level, optname);
1777	if (err)
1778	goto out_put;
1779
1780	if (level == SOL_SOCKET)
1781	err =
1782	sock_setsockopt(sock, level, optname, optval,
1783	optlen);
1784	else
1785	err =
1786	sock->ops->setsockopt(sock, level, optname, optval,
1787	optlen);
1788	out_put:
1789	fput_light(sock->file, fput_needed);
1790	}
1791	return err;
1792	}
1793
1794	/*
1795	* Get a socket option. Because we don't know the option lengths we have
1796	* to pass a user mode parameter for the protocols to sort out.
1797	*/
1798
1799	SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1800	char __user *, optval, int __user *, optlen)
1801	{
1802	int err, fput_needed;
1803	struct socket *sock;
1804
1805	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1806	if (sock != NULL) {
1807	err = security_socket_getsockopt(sock, level, optname);
1808	if (err)
1809	goto out_put;
1810
1811	if (level == SOL_SOCKET)
1812	err =
1813	sock_getsockopt(sock, level, optname, optval,
1814	optlen);
1815	else
1816	err =
1817	sock->ops->getsockopt(sock, level, optname, optval,
1818	optlen);
1819	out_put:
1820	fput_light(sock->file, fput_needed);
1821	}
1822	return err;
1823	}
1824
1825	/*
1826	* Shutdown a socket.
1827	*/
1828
1829	SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1830	{
1831	int err, fput_needed;
1832	struct socket *sock;
1833
1834	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1835	if (sock != NULL) {
1836	err = security_socket_shutdown(sock, how);
1837	if (!err)
1838	err = sock->ops->shutdown(sock, how);
1839	fput_light(sock->file, fput_needed);
1840	}
1841	return err;
1842	}
1843
1844	/* A couple of helpful macros for getting the address of the 32/64 bit
1845	* fields which are the same type (int / unsigned) on our platforms.
1846	*/
1847	#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1848	#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1849	#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1850
1851	struct used_address {
1852	struct sockaddr_storage name;
1853	unsigned int name_len;
1854	};
1855
1856	static int copy_msghdr_from_user(struct msghdr *kmsg,
1857	struct user_msghdr __user *umsg,
1858	struct sockaddr __user **save_addr,
1859	struct iovec **iov)
1860	{
1861	struct sockaddr __user *uaddr;
1862	struct iovec __user *uiov;
1863	size_t nr_segs;
1864	ssize_t err;
1865
1866	if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1867	__get_user(uaddr, &umsg->msg_name) ||
1868	__get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1869	__get_user(uiov, &umsg->msg_iov) ||
1870	__get_user(nr_segs, &umsg->msg_iovlen) ||
1871	__get_user(kmsg->msg_control, &umsg->msg_control) ||
1872	__get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1873	__get_user(kmsg->msg_flags, &umsg->msg_flags))
1874	return -EFAULT;
1875
1876	if (!uaddr)
1877	kmsg->msg_namelen = 0;
1878
1879	if (kmsg->msg_namelen < 0)
1880	return -EINVAL;
1881
1882	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
1883	kmsg->msg_namelen = sizeof(struct sockaddr_storage);
1884
1885	if (save_addr)
1886	*save_addr = uaddr;
1887
1888	if (uaddr && kmsg->msg_namelen) {
1889	if (!save_addr) {
1890	err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1891	kmsg->msg_name);
1892	if (err < 0)
1893	return err;
1894	}
1895	} else {
1896	kmsg->msg_name = NULL;
1897	kmsg->msg_namelen = 0;
1898	}
1899
1900	if (nr_segs > UIO_MAXIOV)
1901	return -EMSGSIZE;
1902
1903	kmsg->msg_iocb = NULL;
1904
1905	return import_iovec(save_addr ? READ : WRITE, uiov, nr_segs,
1906	UIO_FASTIOV, iov, &kmsg->msg_iter);
1907	}
1908
1909	static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
1910	struct msghdr *msg_sys, unsigned int flags,
1911	struct used_address *used_address,
1912	unsigned int allowed_msghdr_flags)
1913	{
1914	struct compat_msghdr __user *msg_compat =
1915	(struct compat_msghdr __user *)msg;
1916	struct sockaddr_storage address;
1917	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1918	unsigned char ctl[sizeof(struct cmsghdr) + 20]
1919	__attribute__ ((aligned(sizeof(__kernel_size_t))));
1920	/* 20 is size of ipv6_pktinfo */
1921	unsigned char *ctl_buf = ctl;
1922	int ctl_len;
1923	ssize_t err;
1924
1925	msg_sys->msg_name = &address;
1926
1927	if (MSG_CMSG_COMPAT & flags)
1928	err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
1929	else
1930	err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
1931	if (err < 0)
1932	return err;
1933
1934	err = -ENOBUFS;
1935
1936	if (msg_sys->msg_controllen > INT_MAX)
1937	goto out_freeiov;
1938	flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
1939	ctl_len = msg_sys->msg_controllen;
1940	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
1941	err =
1942	cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
1943	sizeof(ctl));
1944	if (err)
1945	goto out_freeiov;
1946	ctl_buf = msg_sys->msg_control;
1947	ctl_len = msg_sys->msg_controllen;
1948	} else if (ctl_len) {
1949	if (ctl_len > sizeof(ctl)) {
1950	ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
1951	if (ctl_buf == NULL)
1952	goto out_freeiov;
1953	}
1954	err = -EFAULT;
1955	/*
1956	* Careful! Before this, msg_sys->msg_control contains a user pointer.
1957	* Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1958	* checking falls down on this.
1959	*/
1960	if (copy_from_user(ctl_buf,
1961	(void __user __force *)msg_sys->msg_control,
1962	ctl_len))
1963	goto out_freectl;
1964	msg_sys->msg_control = ctl_buf;
1965	}
1966	msg_sys->msg_flags = flags;
1967
1968	if (sock->file->f_flags & O_NONBLOCK)
1969	msg_sys->msg_flags |= MSG_DONTWAIT;
1970	/*
1971	* If this is sendmmsg() and current destination address is same as
1972	* previously succeeded address, omit asking LSM's decision.
1973	* used_address->name_len is initialized to UINT_MAX so that the first
1974	* destination address never matches.
1975	*/
1976	if (used_address && msg_sys->msg_name &&
1977	used_address->name_len == msg_sys->msg_namelen &&
1978	!memcmp(&used_address->name, msg_sys->msg_name,
1979	used_address->name_len)) {
1980	err = sock_sendmsg_nosec(sock, msg_sys);
1981	goto out_freectl;
1982	}
1983	err = sock_sendmsg(sock, msg_sys);
1984	/*
1985	* If this is sendmmsg() and sending to current destination address was
1986	* successful, remember it.
1987	*/
1988	if (used_address && err >= 0) {
1989	used_address->name_len = msg_sys->msg_namelen;
1990	if (msg_sys->msg_name)
1991	memcpy(&used_address->name, msg_sys->msg_name,
1992	used_address->name_len);
1993	}
1994
1995	out_freectl:
1996	if (ctl_buf != ctl)
1997	sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1998	out_freeiov:
1999	kfree(iov);
2000	return err;
2001	}
2002
2003	/*
2004	* BSD sendmsg interface
2005	*/
2006
2007	long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2008	{
2009	int fput_needed, err;
2010	struct msghdr msg_sys;
2011	struct socket *sock;
2012
2013	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2014	if (!sock)
2015	goto out;
2016
2017	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
2018
2019	fput_light(sock->file, fput_needed);
2020	out:
2021	return err;
2022	}
2023
2024	SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2025	{
2026	if (flags & MSG_CMSG_COMPAT)
2027	return -EINVAL;
2028	return __sys_sendmsg(fd, msg, flags);
2029	}
2030
2031	/*
2032	* Linux sendmmsg interface
2033	*/
2034
2035	int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2036	unsigned int flags)
2037	{
2038	int fput_needed, err, datagrams;
2039	struct socket *sock;
2040	struct mmsghdr __user *entry;
2041	struct compat_mmsghdr __user *compat_entry;
2042	struct msghdr msg_sys;
2043	struct used_address used_address;
2044	unsigned int oflags = flags;
2045
2046	if (vlen > UIO_MAXIOV)
2047	vlen = UIO_MAXIOV;
2048
2049	datagrams = 0;
2050
2051	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2052	if (!sock)
2053	return err;
2054
2055	used_address.name_len = UINT_MAX;
2056	entry = mmsg;
2057	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2058	err = 0;
2059	flags |= MSG_BATCH;
2060
2061	while (datagrams < vlen) {
2062	if (datagrams == vlen - 1)
2063	flags = oflags;
2064
2065	if (MSG_CMSG_COMPAT & flags) {
2066	err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2067	&msg_sys, flags, &used_address, MSG_EOR);
2068	if (err < 0)
2069	break;
2070	err = __put_user(err, &compat_entry->msg_len);
2071	++compat_entry;
2072	} else {
2073	err = ___sys_sendmsg(sock,
2074	(struct user_msghdr __user *)entry,
2075	&msg_sys, flags, &used_address, MSG_EOR);
2076	if (err < 0)
2077	break;
2078	err = put_user(err, &entry->msg_len);
2079	++entry;
2080	}
2081
2082	if (err)
2083	break;
2084	++datagrams;
2085	if (msg_data_left(&msg_sys))
2086	break;
2087	cond_resched();
2088	}
2089
2090	fput_light(sock->file, fput_needed);
2091
2092	/* We only return an error if no datagrams were able to be sent */
2093	if (datagrams != 0)
2094	return datagrams;
2095
2096	return err;
2097	}
2098
2099	SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2100	unsigned int, vlen, unsigned int, flags)
2101	{
2102	if (flags & MSG_CMSG_COMPAT)
2103	return -EINVAL;
2104	return __sys_sendmmsg(fd, mmsg, vlen, flags);
2105	}
2106
2107	static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
2108	struct msghdr *msg_sys, unsigned int flags, int nosec)
2109	{
2110	struct compat_msghdr __user *msg_compat =
2111	(struct compat_msghdr __user *)msg;
2112	struct iovec iovstack[UIO_FASTIOV];
2113	struct iovec *iov = iovstack;
2114	unsigned long cmsg_ptr;
2115	int len;
2116	ssize_t err;
2117
2118	/* kernel mode address */
2119	struct sockaddr_storage addr;
2120
2121	/* user mode address pointers */
2122	struct sockaddr __user *uaddr;
2123	int __user *uaddr_len = COMPAT_NAMELEN(msg);
2124
2125	msg_sys->msg_name = &addr;
2126
2127	if (MSG_CMSG_COMPAT & flags)
2128	err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
2129	else
2130	err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
2131	if (err < 0)
2132	return err;
2133
2134	cmsg_ptr = (unsigned long)msg_sys->msg_control;
2135	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2136
2137	/* We assume all kernel code knows the size of sockaddr_storage */
2138	msg_sys->msg_namelen = 0;
2139
2140	if (sock->file->f_flags & O_NONBLOCK)
2141	flags |= MSG_DONTWAIT;
2142	err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys, flags);
2143	if (err < 0)
2144	goto out_freeiov;
2145	len = err;
2146
2147	if (uaddr != NULL) {
2148	err = move_addr_to_user(&addr,
2149	msg_sys->msg_namelen, uaddr,
2150	uaddr_len);
2151	if (err < 0)
2152	goto out_freeiov;
2153	}
2154	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2155	COMPAT_FLAGS(msg));
2156	if (err)
2157	goto out_freeiov;
2158	if (MSG_CMSG_COMPAT & flags)
2159	err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2160	&msg_compat->msg_controllen);
2161	else
2162	err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2163	&msg->msg_controllen);
2164	if (err)
2165	goto out_freeiov;
2166	err = len;
2167
2168	out_freeiov:
2169	kfree(iov);
2170	return err;
2171	}
2172
2173	/*
2174	* BSD recvmsg interface
2175	*/
2176
2177	long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2178	{
2179	int fput_needed, err;
2180	struct msghdr msg_sys;
2181	struct socket *sock;
2182
2183	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2184	if (!sock)
2185	goto out;
2186
2187	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2188
2189	fput_light(sock->file, fput_needed);
2190	out:
2191	return err;
2192	}
2193
2194	SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2195	unsigned int, flags)
2196	{
2197	if (flags & MSG_CMSG_COMPAT)
2198	return -EINVAL;
2199	return __sys_recvmsg(fd, msg, flags);
2200	}
2201
2202	/*
2203	* Linux recvmmsg interface
2204	*/
2205
2206	int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2207	unsigned int flags, struct timespec *timeout)
2208	{
2209	int fput_needed, err, datagrams;
2210	struct socket *sock;
2211	struct mmsghdr __user *entry;
2212	struct compat_mmsghdr __user *compat_entry;
2213	struct msghdr msg_sys;
2214	struct timespec64 end_time;
2215	struct timespec64 timeout64;
2216
2217	if (timeout &&
2218	poll_select_set_timeout(&end_time, timeout->tv_sec,
2219	timeout->tv_nsec))
2220	return -EINVAL;
2221
2222	datagrams = 0;
2223
2224	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2225	if (!sock)
2226	return err;
2227
2228	err = sock_error(sock->sk);
2229	if (err) {
2230	datagrams = err;
2231	goto out_put;
2232	}
2233
2234	entry = mmsg;
2235	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2236
2237	while (datagrams < vlen) {
2238	/*
2239	* No need to ask LSM for more than the first datagram.
2240	*/
2241	if (MSG_CMSG_COMPAT & flags) {
2242	err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2243	&msg_sys, flags & ~MSG_WAITFORONE,
2244	datagrams);
2245	if (err < 0)
2246	break;
2247	err = __put_user(err, &compat_entry->msg_len);
2248	++compat_entry;
2249	} else {
2250	err = ___sys_recvmsg(sock,
2251	(struct user_msghdr __user *)entry,
2252	&msg_sys, flags & ~MSG_WAITFORONE,
2253	datagrams);
2254	if (err < 0)
2255	break;
2256	err = put_user(err, &entry->msg_len);
2257	++entry;
2258	}
2259
2260	if (err)
2261	break;
2262	++datagrams;
2263
2264	/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2265	if (flags & MSG_WAITFORONE)
2266	flags |= MSG_DONTWAIT;
2267
2268	if (timeout) {
2269	ktime_get_ts64(&timeout64);
2270	*timeout = timespec64_to_timespec(
2271	timespec64_sub(end_time, timeout64));
2272	if (timeout->tv_sec < 0) {
2273	timeout->tv_sec = timeout->tv_nsec = 0;
2274	break;
2275	}
2276
2277	/* Timeout, return less than vlen datagrams */
2278	if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2279	break;
2280	}
2281
2282	/* Out of band data, return right away */
2283	if (msg_sys.msg_flags & MSG_OOB)
2284	break;
2285	cond_resched();
2286	}
2287
2288	if (err == 0)
2289	goto out_put;
2290
2291	if (datagrams == 0) {
2292	datagrams = err;
2293	goto out_put;
2294	}
2295
2296	/*
2297	* We may return less entries than requested (vlen) if the
2298	* sock is non block and there aren't enough datagrams...
2299	*/
2300	if (err != -EAGAIN) {
2301	/*
2302	* ... or if recvmsg returns an error after we
2303	* received some datagrams, where we record the
2304	* error to return on the next call or if the
2305	* app asks about it using getsockopt(SO_ERROR).
2306	*/
2307	sock->sk->sk_err = -err;
2308	}
2309	out_put:
2310	fput_light(sock->file, fput_needed);
2311
2312	return datagrams;
2313	}
2314
2315	SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2316	unsigned int, vlen, unsigned int, flags,
2317	struct timespec __user *, timeout)
2318	{
2319	int datagrams;
2320	struct timespec timeout_sys;
2321
2322	if (flags & MSG_CMSG_COMPAT)
2323	return -EINVAL;
2324
2325	if (!timeout)
2326	return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2327
2328	if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2329	return -EFAULT;
2330
2331	datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2332
2333	if (datagrams > 0 &&
2334	copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2335	datagrams = -EFAULT;
2336
2337	return datagrams;
2338	}
2339
2340	#ifdef __ARCH_WANT_SYS_SOCKETCALL
2341	/* Argument list sizes for sys_socketcall */
2342	#define AL(x) ((x) * sizeof(unsigned long))
2343	static const unsigned char nargs[21] = {
2344	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2345	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2346	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2347	AL(4), AL(5), AL(4)
2348	};
2349
2350	#undef AL
2351
2352	/*
2353	* System call vectors.
2354	*
2355	* Argument checking cleaned up. Saved 20% in size.
2356	* This function doesn't need to set the kernel lock because
2357	* it is set by the callees.
2358	*/
2359
2360	SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2361	{
2362	unsigned long a[AUDITSC_ARGS];
2363	unsigned long a0, a1;
2364	int err;
2365	unsigned int len;
2366
2367	if (call < 1 || call > SYS_SENDMMSG)
2368	return -EINVAL;
2369	call = array_index_nospec(call, SYS_SENDMMSG + 1);
2370
2371	len = nargs[call];
2372	if (len > sizeof(a))
2373	return -EINVAL;
2374
2375	/* copy_from_user should be SMP safe. */
2376	if (copy_from_user(a, args, len))
2377	return -EFAULT;
2378
2379	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2380	if (err)
2381	return err;
2382
2383	a0 = a[0];
2384	a1 = a[1];
2385
2386	switch (call) {
2387	case SYS_SOCKET:
2388	err = sys_socket(a0, a1, a[2]);
2389	break;
2390	case SYS_BIND:
2391	err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2392	break;
2393	case SYS_CONNECT:
2394	err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2395	break;
2396	case SYS_LISTEN:
2397	err = sys_listen(a0, a1);
2398	break;
2399	case SYS_ACCEPT:
2400	err = sys_accept4(a0, (struct sockaddr __user *)a1,
2401	(int __user *)a[2], 0);
2402	break;
2403	case SYS_GETSOCKNAME:
2404	err =
2405	sys_getsockname(a0, (struct sockaddr __user *)a1,
2406	(int __user *)a[2]);
2407	break;
2408	case SYS_GETPEERNAME:
2409	err =
2410	sys_getpeername(a0, (struct sockaddr __user *)a1,
2411	(int __user *)a[2]);
2412	break;
2413	case SYS_SOCKETPAIR:
2414	err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2415	break;
2416	case SYS_SEND:
2417	err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2418	break;
2419	case SYS_SENDTO:
2420	err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2421	(struct sockaddr __user *)a[4], a[5]);
2422	break;
2423	case SYS_RECV:
2424	err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2425	break;
2426	case SYS_RECVFROM:
2427	err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2428	(struct sockaddr __user *)a[4],
2429	(int __user *)a[5]);
2430	break;
2431	case SYS_SHUTDOWN:
2432	err = sys_shutdown(a0, a1);
2433	break;
2434	case SYS_SETSOCKOPT:
2435	err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2436	break;
2437	case SYS_GETSOCKOPT:
2438	err =
2439	sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2440	(int __user *)a[4]);
2441	break;
2442	case SYS_SENDMSG:
2443	err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2444	break;
2445	case SYS_SENDMMSG:
2446	err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2447	break;
2448	case SYS_RECVMSG:
2449	err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2450	break;
2451	case SYS_RECVMMSG:
2452	err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2453	(struct timespec __user *)a[4]);
2454	break;
2455	case SYS_ACCEPT4:
2456	err = sys_accept4(a0, (struct sockaddr __user *)a1,
2457	(int __user *)a[2], a[3]);
2458	break;
2459	default:
2460	err = -EINVAL;
2461	break;
2462	}
2463	return err;
2464	}
2465
2466	#endif /* __ARCH_WANT_SYS_SOCKETCALL */
2467
2468	/**
2469	* sock_register - add a socket protocol handler
2470	* @ops: description of protocol
2471	*
2472	* This function is called by a protocol handler that wants to
2473	* advertise its address family, and have it linked into the
2474	* socket interface. The value ops->family corresponds to the
2475	* socket system call protocol family.
2476	*/
2477	int sock_register(const struct net_proto_family *ops)
2478	{
2479	int err;
2480
2481	if (ops->family >= NPROTO) {
2482	pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
2483	return -ENOBUFS;
2484	}
2485
2486	spin_lock(&net_family_lock);
2487	if (rcu_dereference_protected(net_families[ops->family],
2488	lockdep_is_held(&net_family_lock)))
2489	err = -EEXIST;
2490	else {
2491	rcu_assign_pointer(net_families[ops->family], ops);
2492	err = 0;
2493	}
2494	spin_unlock(&net_family_lock);
2495
2496	pr_info("NET: Registered protocol family %d\n", ops->family);
2497	return err;
2498	}
2499	EXPORT_SYMBOL(sock_register);
2500
2501	/**
2502	* sock_unregister - remove a protocol handler
2503	* @family: protocol family to remove
2504	*
2505	* This function is called by a protocol handler that wants to
2506	* remove its address family, and have it unlinked from the
2507	* new socket creation.
2508	*
2509	* If protocol handler is a module, then it can use module reference
2510	* counts to protect against new references. If protocol handler is not
2511	* a module then it needs to provide its own protection in
2512	* the ops->create routine.
2513	*/
2514	void sock_unregister(int family)
2515	{
2516	BUG_ON(family < 0 || family >= NPROTO);
2517
2518	spin_lock(&net_family_lock);
2519	RCU_INIT_POINTER(net_families[family], NULL);
2520	spin_unlock(&net_family_lock);
2521
2522	synchronize_rcu();
2523
2524	pr_info("NET: Unregistered protocol family %d\n", family);
2525	}
2526	EXPORT_SYMBOL(sock_unregister);
2527
2528	static int __init sock_init(void)
2529	{
2530	int err;
2531	/*
2532	* Initialize the network sysctl infrastructure.
2533	*/
2534	err = net_sysctl_init();
2535	if (err)
2536	goto out;
2537
2538	/*
2539	* Initialize skbuff SLAB cache
2540	*/
2541	skb_init();
2542
2543	/*
2544	* Initialize the protocols module.
2545	*/
2546
2547	init_inodecache();
2548
2549	err = register_filesystem(&sock_fs_type);
2550	if (err)
2551	goto out_fs;
2552	sock_mnt = kern_mount(&sock_fs_type);
2553	if (IS_ERR(sock_mnt)) {
2554	err = PTR_ERR(sock_mnt);
2555	goto out_mount;
2556	}
2557
2558	/* The real protocol initialization is performed in later initcalls.
2559	*/
2560
2561	#ifdef CONFIG_NETFILTER
2562	err = netfilter_init();
2563	if (err)
2564	goto out;
2565	#endif
2566
2567	ptp_classifier_init();
2568
2569	out:
2570	return err;
2571
2572	out_mount:
2573	unregister_filesystem(&sock_fs_type);
2574	out_fs:
2575	goto out;
2576	}
2577
2578	core_initcall(sock_init); /* early initcall */
2579
2580	static int __init jit_init(void)
2581	{
2582	#ifdef CONFIG_BPF_JIT_ALWAYS_ON
2583	bpf_jit_enable = 1;
2584	#endif
2585	return 0;
2586	}
2587	pure_initcall(jit_init);
2588
2589	#ifdef CONFIG_PROC_FS
2590	void socket_seq_show(struct seq_file *seq)
2591	{
2592	int cpu;
2593	int counter = 0;
2594
2595	for_each_possible_cpu(cpu)
2596	counter += per_cpu(sockets_in_use, cpu);
2597
2598	/* It can be negative, by the way. 8) */
2599	if (counter < 0)
2600	counter = 0;
2601
2602	seq_printf(seq, "sockets: used %d\n", counter);
2603	}
2604	#endif /* CONFIG_PROC_FS */
2605
2606	#ifdef CONFIG_COMPAT
2607	static int do_siocgstamp(struct net *net, struct socket *sock,
2608	unsigned int cmd, void __user *up)
2609	{
2610	mm_segment_t old_fs = get_fs();
2611	struct timeval ktv;
2612	int err;
2613
2614	set_fs(KERNEL_DS);
2615	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2616	set_fs(old_fs);
2617	if (!err)
2618	err = compat_put_timeval(&ktv, up);
2619
2620	return err;
2621	}
2622
2623	static int do_siocgstampns(struct net *net, struct socket *sock,
2624	unsigned int cmd, void __user *up)
2625	{
2626	mm_segment_t old_fs = get_fs();
2627	struct timespec kts;
2628	int err;
2629
2630	set_fs(KERNEL_DS);
2631	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2632	set_fs(old_fs);
2633	if (!err)
2634	err = compat_put_timespec(&kts, up);
2635
2636	return err;
2637	}
2638
2639	static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2640	{
2641	struct ifreq __user *uifr;
2642	int err;
2643
2644	uifr = compat_alloc_user_space(sizeof(struct ifreq));
2645	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2646	return -EFAULT;
2647
2648	err = dev_ioctl(net, SIOCGIFNAME, uifr);
2649	if (err)
2650	return err;
2651
2652	if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2653	return -EFAULT;
2654
2655	return 0;
2656	}
2657
2658	static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2659	{
2660	struct compat_ifconf ifc32;
2661	struct ifconf ifc;
2662	struct ifconf __user *uifc;
2663	struct compat_ifreq __user *ifr32;
2664	struct ifreq __user *ifr;
2665	unsigned int i, j;
2666	int err;
2667
2668	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2669	return -EFAULT;
2670
2671	memset(&ifc, 0, sizeof(ifc));
2672	if (ifc32.ifcbuf == 0) {
2673	ifc32.ifc_len = 0;
2674	ifc.ifc_len = 0;
2675	ifc.ifc_req = NULL;
2676	uifc = compat_alloc_user_space(sizeof(struct ifconf));
2677	} else {
2678	size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2679	sizeof(struct ifreq);
2680	uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2681	ifc.ifc_len = len;
2682	ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2683	ifr32 = compat_ptr(ifc32.ifcbuf);
2684	for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2685	if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2686	return -EFAULT;
2687	ifr++;
2688	ifr32++;
2689	}
2690	}
2691	if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2692	return -EFAULT;
2693
2694	err = dev_ioctl(net, SIOCGIFCONF, uifc);
2695	if (err)
2696	return err;
2697
2698	if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2699	return -EFAULT;
2700
2701	ifr = ifc.ifc_req;
2702	ifr32 = compat_ptr(ifc32.ifcbuf);
2703	for (i = 0, j = 0;
2704	i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2705	i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2706	if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2707	return -EFAULT;
2708	ifr32++;
2709	ifr++;
2710	}
2711
2712	if (ifc32.ifcbuf == 0) {
2713	/* Translate from 64-bit structure multiple to
2714	* a 32-bit one.
2715	*/
2716	i = ifc.ifc_len;
2717	i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2718	ifc32.ifc_len = i;
2719	} else {
2720	ifc32.ifc_len = i;
2721	}
2722	if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2723	return -EFAULT;
2724
2725	return 0;
2726	}
2727
2728	static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2729	{
2730	struct compat_ethtool_rxnfc __user *compat_rxnfc;
2731	bool convert_in = false, convert_out = false;
2732	size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2733	struct ethtool_rxnfc __user *rxnfc;
2734	struct ifreq __user *ifr;
2735	u32 rule_cnt = 0, actual_rule_cnt;
2736	u32 ethcmd;
2737	u32 data;
2738	int ret;
2739
2740	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2741	return -EFAULT;
2742
2743	compat_rxnfc = compat_ptr(data);
2744
2745	if (get_user(ethcmd, &compat_rxnfc->cmd))
2746	return -EFAULT;
2747
2748	/* Most ethtool structures are defined without padding.
2749	* Unfortunately struct ethtool_rxnfc is an exception.
2750	*/
2751	switch (ethcmd) {
2752	default:
2753	break;
2754	case ETHTOOL_GRXCLSRLALL:
2755	/* Buffer size is variable */
2756	if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2757	return -EFAULT;
2758	if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2759	return -ENOMEM;
2760	buf_size += rule_cnt * sizeof(u32);
2761	/* fall through */
2762	case ETHTOOL_GRXRINGS:
2763	case ETHTOOL_GRXCLSRLCNT:
2764	case ETHTOOL_GRXCLSRULE:
2765	case ETHTOOL_SRXCLSRLINS:
2766	convert_out = true;
2767	/* fall through */
2768	case ETHTOOL_SRXCLSRLDEL:
2769	buf_size += sizeof(struct ethtool_rxnfc);
2770	convert_in = true;
2771	break;
2772	}
2773
2774	ifr = compat_alloc_user_space(buf_size);
2775	rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
2776
2777	if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2778	return -EFAULT;
2779
2780	if (put_user(convert_in ? rxnfc : compat_ptr(data),
2781	&ifr->ifr_ifru.ifru_data))
2782	return -EFAULT;
2783
2784	if (convert_in) {
2785	/* We expect there to be holes between fs.m_ext and
2786	* fs.ring_cookie and at the end of fs, but nowhere else.
2787	*/
2788	BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2789	sizeof(compat_rxnfc->fs.m_ext) !=
2790	offsetof(struct ethtool_rxnfc, fs.m_ext) +
2791	sizeof(rxnfc->fs.m_ext));
2792	BUILD_BUG_ON(
2793	offsetof(struct compat_ethtool_rxnfc, fs.location) -
2794	offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2795	offsetof(struct ethtool_rxnfc, fs.location) -
2796	offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2797
2798	if (copy_in_user(rxnfc, compat_rxnfc,
2799	(void __user *)(&rxnfc->fs.m_ext + 1) -
2800	(void __user *)rxnfc) ||
2801	copy_in_user(&rxnfc->fs.ring_cookie,
2802	&compat_rxnfc->fs.ring_cookie,
2803	(void __user *)(&rxnfc->fs.location + 1) -
2804	(void __user *)&rxnfc->fs.ring_cookie))
2805	return -EFAULT;
2806	if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2807	if (put_user(rule_cnt, &rxnfc->rule_cnt))
2808	return -EFAULT;
2809	} else if (copy_in_user(&rxnfc->rule_cnt,
2810	&compat_rxnfc->rule_cnt,
2811	sizeof(rxnfc->rule_cnt)))
2812	return -EFAULT;
2813	}
2814
2815	ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2816	if (ret)
2817	return ret;
2818
2819	if (convert_out) {
2820	if (copy_in_user(compat_rxnfc, rxnfc,
2821	(const void __user *)(&rxnfc->fs.m_ext + 1) -
2822	(const void __user *)rxnfc) ||
2823	copy_in_user(&compat_rxnfc->fs.ring_cookie,
2824	&rxnfc->fs.ring_cookie,
2825	(const void __user *)(&rxnfc->fs.location + 1) -
2826	(const void __user *)&rxnfc->fs.ring_cookie) ||
2827	copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2828	sizeof(rxnfc->rule_cnt)))
2829	return -EFAULT;
2830
2831	if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2832	/* As an optimisation, we only copy the actual
2833	* number of rules that the underlying
2834	* function returned. Since Mallory might
2835	* change the rule count in user memory, we
2836	* check that it is less than the rule count
2837	* originally given (as the user buffer size),
2838	* which has been range-checked.
2839	*/
2840	if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2841	return -EFAULT;
2842	if (actual_rule_cnt < rule_cnt)
2843	rule_cnt = actual_rule_cnt;
2844	if (copy_in_user(&compat_rxnfc->rule_locs[0],
2845	&rxnfc->rule_locs[0],
2846	rule_cnt * sizeof(u32)))
2847	return -EFAULT;
2848	}
2849	}
2850
2851	return 0;
2852	}
2853
2854	static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2855	{
2856	void __user *uptr;
2857	compat_uptr_t uptr32;
2858	struct ifreq __user *uifr;
2859
2860	uifr = compat_alloc_user_space(sizeof(*uifr));
2861	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2862	return -EFAULT;
2863
2864	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2865	return -EFAULT;
2866
2867	uptr = compat_ptr(uptr32);
2868
2869	if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2870	return -EFAULT;
2871
2872	return dev_ioctl(net, SIOCWANDEV, uifr);
2873	}
2874
2875	static int bond_ioctl(struct net *net, unsigned int cmd,
2876	struct compat_ifreq __user *ifr32)
2877	{
2878	struct ifreq kifr;
2879	mm_segment_t old_fs;
2880	int err;
2881
2882	switch (cmd) {
2883	case SIOCBONDENSLAVE:
2884	case SIOCBONDRELEASE:
2885	case SIOCBONDSETHWADDR:
2886	case SIOCBONDCHANGEACTIVE:
2887	if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2888	return -EFAULT;
2889
2890	old_fs = get_fs();
2891	set_fs(KERNEL_DS);
2892	err = dev_ioctl(net, cmd,
2893	(struct ifreq __user __force *) &kifr);
2894	set_fs(old_fs);
2895
2896	return err;
2897	default:
2898	return -ENOIOCTLCMD;
2899	}
2900	}
2901
2902	/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2903	static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
2904	struct compat_ifreq __user *u_ifreq32)
2905	{
2906	struct ifreq __user *u_ifreq64;
2907	char tmp_buf[IFNAMSIZ];
2908	void __user *data64;
2909	u32 data32;
2910
2911	if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2912	IFNAMSIZ))
2913	return -EFAULT;
2914	if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2915	return -EFAULT;
2916	data64 = compat_ptr(data32);
2917
2918	u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2919
2920	if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2921	IFNAMSIZ))
2922	return -EFAULT;
2923	if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2924	return -EFAULT;
2925
2926	return dev_ioctl(net, cmd, u_ifreq64);
2927	}
2928
2929	static int dev_ifsioc(struct net *net, struct socket *sock,
2930	unsigned int cmd, struct compat_ifreq __user *uifr32)
2931	{
2932	struct ifreq __user *uifr;
2933	int err;
2934
2935	uifr = compat_alloc_user_space(sizeof(*uifr));
2936	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2937	return -EFAULT;
2938
2939	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2940
2941	if (!err) {
2942	switch (cmd) {
2943	case SIOCGIFFLAGS:
2944	case SIOCGIFMETRIC:
2945	case SIOCGIFMTU:
2946	case SIOCGIFMEM:
2947	case SIOCGIFHWADDR:
2948	case SIOCGIFINDEX:
2949	case SIOCGIFADDR:
2950	case SIOCGIFBRDADDR:
2951	case SIOCGIFDSTADDR:
2952	case SIOCGIFNETMASK:
2953	case SIOCGIFPFLAGS:
2954	case SIOCGIFTXQLEN:
2955	case SIOCGMIIPHY:
2956	case SIOCGMIIREG:
2957	if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
2958	err = -EFAULT;
2959	break;
2960	}
2961	}
2962	return err;
2963	}
2964
2965	static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2966	struct compat_ifreq __user *uifr32)
2967	{
2968	struct ifreq ifr;
2969	struct compat_ifmap __user *uifmap32;
2970	mm_segment_t old_fs;
2971	int err;
2972
2973	uifmap32 = &uifr32->ifr_ifru.ifru_map;
2974	err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
2975	err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2976	err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2977	err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2978	err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2979	err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2980	err |= get_user(ifr.ifr_map.port, &uifmap32->port);
2981	if (err)
2982	return -EFAULT;
2983
2984	old_fs = get_fs();
2985	set_fs(KERNEL_DS);
2986	err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
2987	set_fs(old_fs);
2988
2989	if (cmd == SIOCGIFMAP && !err) {
2990	err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
2991	err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2992	err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2993	err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2994	err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2995	err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2996	err |= put_user(ifr.ifr_map.port, &uifmap32->port);
2997	if (err)
2998	err = -EFAULT;
2999	}
3000	return err;
3001	}
3002
3003	struct rtentry32 {
3004	u32 rt_pad1;
3005	struct sockaddr rt_dst; /* target address */
3006	struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3007	struct sockaddr rt_genmask; /* target network mask (IP) */
3008	unsigned short rt_flags;
3009	short rt_pad2;
3010	u32 rt_pad3;
3011	unsigned char rt_tos;
3012	unsigned char rt_class;
3013	short rt_pad4;
3014	short rt_metric; /* +1 for binary compatibility! */
3015	/* char * */ u32 rt_dev; /* forcing the device at add */
3016	u32 rt_mtu; /* per route MTU/Window */
3017	u32 rt_window; /* Window clamping */
3018	unsigned short rt_irtt; /* Initial RTT */
3019	};
3020
3021	struct in6_rtmsg32 {
3022	struct in6_addr rtmsg_dst;
3023	struct in6_addr rtmsg_src;
3024	struct in6_addr rtmsg_gateway;
3025	u32 rtmsg_type;
3026	u16 rtmsg_dst_len;
3027	u16 rtmsg_src_len;
3028	u32 rtmsg_metric;
3029	u32 rtmsg_info;
3030	u32 rtmsg_flags;
3031	s32 rtmsg_ifindex;
3032	};
3033
3034	static int routing_ioctl(struct net *net, struct socket *sock,
3035	unsigned int cmd, void __user *argp)
3036	{
3037	int ret;
3038	void *r = NULL;
3039	struct in6_rtmsg r6;
3040	struct rtentry r4;
3041	char devname[16];
3042	u32 rtdev;
3043	mm_segment_t old_fs = get_fs();
3044
3045	if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3046	struct in6_rtmsg32 __user *ur6 = argp;
3047	ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3048	3 * sizeof(struct in6_addr));
3049	ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3050	ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3051	ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3052	ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3053	ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3054	ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3055	ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3056
3057	r = (void *) &r6;
3058	} else { /* ipv4 */
3059	struct rtentry32 __user *ur4 = argp;
3060	ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3061	3 * sizeof(struct sockaddr));
3062	ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3063	ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3064	ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3065	ret |= get_user(r4.rt_window, &(ur4->rt_window));
3066	ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3067	ret |= get_user(rtdev, &(ur4->rt_dev));
3068	if (rtdev) {
3069	ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3070	r4.rt_dev = (char __user __force *)devname;
3071	devname[15] = 0;
3072	} else
3073	r4.rt_dev = NULL;
3074
3075	r = (void *) &r4;
3076	}
3077
3078	if (ret) {
3079	ret = -EFAULT;
3080	goto out;
3081	}
3082
3083	set_fs(KERNEL_DS);
3084	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3085	set_fs(old_fs);
3086
3087	out:
3088	return ret;
3089	}
3090
3091	/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3092	* for some operations; this forces use of the newer bridge-utils that
3093	* use compatible ioctls
3094	*/
3095	static int old_bridge_ioctl(compat_ulong_t __user *argp)
3096	{
3097	compat_ulong_t tmp;
3098
3099	if (get_user(tmp, argp))
3100	return -EFAULT;
3101	if (tmp == BRCTL_GET_VERSION)
3102	return BRCTL_VERSION + 1;
3103	return -EINVAL;
3104	}
3105
3106	static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3107	unsigned int cmd, unsigned long arg)
3108	{
3109	void __user *argp = compat_ptr(arg);
3110	struct sock *sk = sock->sk;
3111	struct net *net = sock_net(sk);
3112
3113	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3114	return compat_ifr_data_ioctl(net, cmd, argp);
3115
3116	switch (cmd) {
3117	case SIOCSIFBR:
3118	case SIOCGIFBR:
3119	return old_bridge_ioctl(argp);
3120	case SIOCGIFNAME:
3121	return dev_ifname32(net, argp);
3122	case SIOCGIFCONF:
3123	return dev_ifconf(net, argp);
3124	case SIOCETHTOOL:
3125	return ethtool_ioctl(net, argp);
3126	case SIOCWANDEV:
3127	return compat_siocwandev(net, argp);
3128	case SIOCGIFMAP:
3129	case SIOCSIFMAP:
3130	return compat_sioc_ifmap(net, cmd, argp);
3131	case SIOCBONDENSLAVE:
3132	case SIOCBONDRELEASE:
3133	case SIOCBONDSETHWADDR:
3134	case SIOCBONDCHANGEACTIVE:
3135	return bond_ioctl(net, cmd, argp);
3136	case SIOCADDRT:
3137	case SIOCDELRT:
3138	return routing_ioctl(net, sock, cmd, argp);
3139	case SIOCGSTAMP:
3140	return do_siocgstamp(net, sock, cmd, argp);
3141	case SIOCGSTAMPNS:
3142	return do_siocgstampns(net, sock, cmd, argp);
3143	case SIOCBONDSLAVEINFOQUERY:
3144	case SIOCBONDINFOQUERY:
3145	case SIOCSHWTSTAMP:
3146	case SIOCGHWTSTAMP:
3147	return compat_ifr_data_ioctl(net, cmd, argp);
3148
3149	case FIOSETOWN:
3150	case SIOCSPGRP:
3151	case FIOGETOWN:
3152	case SIOCGPGRP:
3153	case SIOCBRADDBR:
3154	case SIOCBRDELBR:
3155	case SIOCGIFVLAN:
3156	case SIOCSIFVLAN:
3157	case SIOCADDDLCI:
3158	case SIOCDELDLCI:
3159	return sock_ioctl(file, cmd, arg);
3160
3161	case SIOCGIFFLAGS:
3162	case SIOCSIFFLAGS:
3163	case SIOCGIFMETRIC:
3164	case SIOCSIFMETRIC:
3165	case SIOCGIFMTU:
3166	case SIOCSIFMTU:
3167	case SIOCGIFMEM:
3168	case SIOCSIFMEM:
3169	case SIOCGIFHWADDR:
3170	case SIOCSIFHWADDR:
3171	case SIOCADDMULTI:
3172	case SIOCDELMULTI:
3173	case SIOCGIFINDEX:
3174	case SIOCGIFADDR:
3175	case SIOCSIFADDR:
3176	case SIOCSIFHWBROADCAST:
3177	case SIOCDIFADDR:
3178	case SIOCGIFBRDADDR:
3179	case SIOCSIFBRDADDR:
3180	case SIOCGIFDSTADDR:
3181	case SIOCSIFDSTADDR:
3182	case SIOCGIFNETMASK:
3183	case SIOCSIFNETMASK:
3184	case SIOCSIFPFLAGS:
3185	case SIOCGIFPFLAGS:
3186	case SIOCGIFTXQLEN:
3187	case SIOCSIFTXQLEN:
3188	case SIOCBRADDIF:
3189	case SIOCBRDELIF:
3190	case SIOCSIFNAME:
3191	case SIOCGMIIPHY:
3192	case SIOCGMIIREG:
3193	case SIOCSMIIREG:
3194	return dev_ifsioc(net, sock, cmd, argp);
3195
3196	case SIOCSARP:
3197	case SIOCGARP:
3198	case SIOCDARP:
3199	case SIOCATMARK:
3200	return sock_do_ioctl(net, sock, cmd, arg);
3201	}
3202
3203	return -ENOIOCTLCMD;
3204	}
3205
3206	static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3207	unsigned long arg)
3208	{
3209	struct socket *sock = file->private_data;
3210	int ret = -ENOIOCTLCMD;
3211	struct sock *sk;
3212	struct net *net;
3213
3214	sk = sock->sk;
3215	net = sock_net(sk);
3216
3217	if (sock->ops->compat_ioctl)
3218	ret = sock->ops->compat_ioctl(sock, cmd, arg);
3219
3220	if (ret == -ENOIOCTLCMD &&
3221	(cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3222	ret = compat_wext_handle_ioctl(net, cmd, arg);
3223
3224	if (ret == -ENOIOCTLCMD)
3225	ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3226
3227	return ret;
3228	}
3229	#endif
3230
3231	int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3232	{
3233	return sock->ops->bind(sock, addr, addrlen);
3234	}
3235	EXPORT_SYMBOL(kernel_bind);
3236
3237	int kernel_listen(struct socket *sock, int backlog)
3238	{
3239	return sock->ops->listen(sock, backlog);
3240	}
3241	EXPORT_SYMBOL(kernel_listen);
3242
3243	int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3244	{
3245	struct sock *sk = sock->sk;
3246	int err;
3247
3248	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3249	newsock);
3250	if (err < 0)
3251	goto done;
3252
3253	err = sock->ops->accept(sock, *newsock, flags);
3254	if (err < 0) {
3255	sock_release(*newsock);
3256	*newsock = NULL;
3257	goto done;
3258	}
3259
3260	(*newsock)->ops = sock->ops;
3261	__module_get((*newsock)->ops->owner);
3262
3263	done:
3264	return err;
3265	}
3266	EXPORT_SYMBOL(kernel_accept);
3267
3268	int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3269	int flags)
3270	{
3271	return sock->ops->connect(sock, addr, addrlen, flags);
3272	}
3273	EXPORT_SYMBOL(kernel_connect);
3274
3275	int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3276	int *addrlen)
3277	{
3278	return sock->ops->getname(sock, addr, addrlen, 0);
3279	}
3280	EXPORT_SYMBOL(kernel_getsockname);
3281
3282	int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3283	int *addrlen)
3284	{
3285	return sock->ops->getname(sock, addr, addrlen, 1);
3286	}
3287	EXPORT_SYMBOL(kernel_getpeername);
3288
3289	int kernel_getsockopt(struct socket *sock, int level, int optname,
3290	char *optval, int *optlen)
3291	{
3292	mm_segment_t oldfs = get_fs();
3293	char __user *uoptval;
3294	int __user *uoptlen;
3295	int err;
3296
3297	uoptval = (char __user __force *) optval;
3298	uoptlen = (int __user __force *) optlen;
3299
3300	set_fs(KERNEL_DS);
3301	if (level == SOL_SOCKET)
3302	err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3303	else
3304	err = sock->ops->getsockopt(sock, level, optname, uoptval,
3305	uoptlen);
3306	set_fs(oldfs);
3307	return err;
3308	}
3309	EXPORT_SYMBOL(kernel_getsockopt);
3310
3311	int kernel_setsockopt(struct socket *sock, int level, int optname,
3312	char *optval, unsigned int optlen)
3313	{
3314	mm_segment_t oldfs = get_fs();
3315	char __user *uoptval;
3316	int err;
3317
3318	uoptval = (char __user __force *) optval;
3319
3320	set_fs(KERNEL_DS);
3321	if (level == SOL_SOCKET)
3322	err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3323	else
3324	err = sock->ops->setsockopt(sock, level, optname, uoptval,
3325	optlen);
3326	set_fs(oldfs);
3327	return err;
3328	}
3329	EXPORT_SYMBOL(kernel_setsockopt);
3330
3331	int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3332	size_t size, int flags)
3333	{
3334	if (sock->ops->sendpage)
3335	return sock->ops->sendpage(sock, page, offset, size, flags);
3336
3337	return sock_no_sendpage(sock, page, offset, size, flags);
3338	}
3339	EXPORT_SYMBOL(kernel_sendpage);
3340
3341	int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3342	{
3343	mm_segment_t oldfs = get_fs();
3344	int err;
3345
3346	set_fs(KERNEL_DS);
3347	err = sock->ops->ioctl(sock, cmd, arg);
3348	set_fs(oldfs);
3349
3350	return err;
3351	}
3352	EXPORT_SYMBOL(kernel_sock_ioctl);
3353
3354	int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3355	{
3356	return sock->ops->shutdown(sock, how);
3357	}
3358	EXPORT_SYMBOL(kernel_sock_shutdown);
3359