Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
socket.c
Go to the documentation of this file.
1 /*
2  * NET An implementation of the SOCKET network access protocol.
3  *
4  * Version: @(#)socket.c 1.1.93 18/02/95
5  *
6  * Authors: Orest Zborowski, <[email protected]>
7  * Ross Biro
8  * Fred N. van Kempen, <[email protected]>
9  *
10  * Fixes:
11  * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12  * shutdown()
13  * Alan Cox : verify_area() fixes
14  * Alan Cox : Removed DDI
15  * Jonathan Kamens : SOCK_DGRAM reconnect bug
16  * Alan Cox : Moved a load of checks to the very
17  * top level.
18  * Alan Cox : Move address structures to/from user
19  * mode above the protocol layers.
20  * Rob Janssen : Allow 0 length sends.
21  * Alan Cox : Asynchronous I/O support (cribbed from the
22  * tty drivers).
23  * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24  * Jeff Uphoff : Made max number of sockets command-line
25  * configurable.
26  * Matti Aarnio : Made the number of sockets dynamic,
27  * to be allocated when needed, and mr.
28  * Uphoff's max is used as max to be
29  * allowed to allocate.
30  * Linus : Argh. removed all the socket allocation
31  * altogether: it's in the inode now.
32  * Alan Cox : Made sock_alloc()/sock_release() public
33  * for NetROM and future kernel nfsd type
34  * stuff.
35  * Alan Cox : sendmsg/recvmsg basics.
36  * Tom Dyas : Export net symbols.
37  * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38  * Alan Cox : Added thread locking to sys_* calls
39  * for sockets. May have errors at the
40  * moment.
41  * Kevin Buhr : Fixed the dumb errors in the above.
42  * Andi Kleen : Some small cleanups, optimizations,
43  * and fixed a copy_from_user() bug.
44  * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
45  * Tigran Aivazian : Made listen(2) backlog sanity checks
46  * protocol-independent
47  *
48  *
49  * This program is free software; you can redistribute it and/or
50  * modify it under the terms of the GNU General Public License
51  * as published by the Free Software Foundation; either version
52  * 2 of the License, or (at your option) any later version.
53  *
54  *
55  * This module is effectively the top level interface to the BSD socket
56  * paradigm.
57  *
58  * Based upon Swansea University Computer Society NET3.039
59  */
60 
61 #include <linux/mm.h>
62 #include <linux/socket.h>
63 #include <linux/file.h>
64 #include <linux/net.h>
65 #include <linux/interrupt.h>
66 #include <linux/thread_info.h>
67 #include <linux/rcupdate.h>
68 #include <linux/netdevice.h>
69 #include <linux/proc_fs.h>
70 #include <linux/seq_file.h>
71 #include <linux/mutex.h>
72 #include <linux/wanrouter.h>
73 #include <linux/if_bridge.h>
74 #include <linux/if_frad.h>
75 #include <linux/if_vlan.h>
76 #include <linux/init.h>
77 #include <linux/poll.h>
78 #include <linux/cache.h>
79 #include <linux/module.h>
80 #include <linux/highmem.h>
81 #include <linux/mount.h>
82 #include <linux/security.h>
83 #include <linux/syscalls.h>
84 #include <linux/compat.h>
85 #include <linux/kmod.h>
86 #include <linux/audit.h>
87 #include <linux/wireless.h>
88 #include <linux/nsproxy.h>
89 #include <linux/magic.h>
90 #include <linux/slab.h>
91 #include <linux/xattr.h>
92 
93 #include <asm/uaccess.h>
94 #include <asm/unistd.h>
95 
96 #include <net/compat.h>
97 #include <net/wext.h>
98 #include <net/cls_cgroup.h>
99 
100 #include <net/sock.h>
101 #include <linux/netfilter.h>
102 
103 #include <linux/if_tun.h>
104 #include <linux/ipv6_route.h>
105 #include <linux/route.h>
106 #include <linux/sockios.h>
107 #include <linux/atalk.h>
108 
109 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
110 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
111  unsigned long nr_segs, loff_t pos);
112 static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
113  unsigned long nr_segs, loff_t pos);
114 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
115 
116 static int sock_close(struct inode *inode, struct file *file);
117 static unsigned int sock_poll(struct file *file,
118  struct poll_table_struct *wait);
119 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
120 #ifdef CONFIG_COMPAT
121 static long compat_sock_ioctl(struct file *file,
122  unsigned int cmd, unsigned long arg);
123 #endif
124 static int sock_fasync(int fd, struct file *filp, int on);
125 static ssize_t sock_sendpage(struct file *file, struct page *page,
126  int offset, size_t size, loff_t *ppos, int more);
127 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
128  struct pipe_inode_info *pipe, size_t len,
129  unsigned int flags);
130 
131 /*
132  * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
133  * in the operation structures but are done directly via the socketcall() multiplexor.
134  */
135 
136 static const struct file_operations socket_file_ops = {
137  .owner = THIS_MODULE,
138  .llseek = no_llseek,
139  .aio_read = sock_aio_read,
140  .aio_write = sock_aio_write,
141  .poll = sock_poll,
142  .unlocked_ioctl = sock_ioctl,
143 #ifdef CONFIG_COMPAT
144  .compat_ioctl = compat_sock_ioctl,
145 #endif
146  .mmap = sock_mmap,
147  .open = sock_no_open, /* special open code to disallow open via /proc */
148  .release = sock_close,
149  .fasync = sock_fasync,
150  .sendpage = sock_sendpage,
151  .splice_write = generic_splice_sendpage,
152  .splice_read = sock_splice_read,
153 };
154 
155 /*
156  * The protocol list. Each protocol is registered in here.
157  */
158 
159 static DEFINE_SPINLOCK(net_family_lock);
160 static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
161 
162 /*
163  * Statistics counters of the socket lists
164  */
165 
166 static DEFINE_PER_CPU(int, sockets_in_use);
167 
168 /*
169  * Support routines.
170  * Move socket addresses back and forth across the kernel/user
171  * divide and look after the messy bits.
172  */
173 
185 int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
186 {
187  if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
188  return -EINVAL;
189  if (ulen == 0)
190  return 0;
191  if (copy_from_user(kaddr, uaddr, ulen))
192  return -EFAULT;
193  return audit_sockaddr(ulen, kaddr);
194 }
195 
213 static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
214  void __user *uaddr, int __user *ulen)
215 {
216  int err;
217  int len;
218 
219  err = get_user(len, ulen);
220  if (err)
221  return err;
222  if (len > klen)
223  len = klen;
224  if (len < 0 || len > sizeof(struct sockaddr_storage))
225  return -EINVAL;
226  if (len) {
227  if (audit_sockaddr(klen, kaddr))
228  return -ENOMEM;
229  if (copy_to_user(uaddr, kaddr, len))
230  return -EFAULT;
231  }
232  /*
233  * "fromlen shall refer to the value before truncation.."
234  * 1003.1g
235  */
236  return __put_user(klen, ulen);
237 }
238 
239 static struct kmem_cache *sock_inode_cachep __read_mostly;
240 
241 static struct inode *sock_alloc_inode(struct super_block *sb)
242 {
243  struct socket_alloc *ei;
244  struct socket_wq *wq;
245 
246  ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
247  if (!ei)
248  return NULL;
249  wq = kmalloc(sizeof(*wq), GFP_KERNEL);
250  if (!wq) {
251  kmem_cache_free(sock_inode_cachep, ei);
252  return NULL;
253  }
255  wq->fasync_list = NULL;
256  RCU_INIT_POINTER(ei->socket.wq, wq);
257 
258  ei->socket.state = SS_UNCONNECTED;
259  ei->socket.flags = 0;
260  ei->socket.ops = NULL;
261  ei->socket.sk = NULL;
262  ei->socket.file = NULL;
263 
264  return &ei->vfs_inode;
265 }
266 
267 static void sock_destroy_inode(struct inode *inode)
268 {
269  struct socket_alloc *ei;
270  struct socket_wq *wq;
271 
272  ei = container_of(inode, struct socket_alloc, vfs_inode);
273  wq = rcu_dereference_protected(ei->socket.wq, 1);
274  kfree_rcu(wq, rcu);
275  kmem_cache_free(sock_inode_cachep, ei);
276 }
277 
278 static void init_once(void *foo)
279 {
280  struct socket_alloc *ei = (struct socket_alloc *)foo;
281 
283 }
284 
285 static int init_inodecache(void)
286 {
287  sock_inode_cachep = kmem_cache_create("sock_inode_cache",
288  sizeof(struct socket_alloc),
289  0,
293  init_once);
294  if (sock_inode_cachep == NULL)
295  return -ENOMEM;
296  return 0;
297 }
298 
299 static const struct super_operations sockfs_ops = {
300  .alloc_inode = sock_alloc_inode,
301  .destroy_inode = sock_destroy_inode,
302  .statfs = simple_statfs,
303 };
304 
305 /*
306  * sockfs_dname() is called from d_path().
307  */
308 static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
309 {
310  return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
311  dentry->d_inode->i_ino);
312 }
313 
314 static const struct dentry_operations sockfs_dentry_operations = {
315  .d_dname = sockfs_dname,
316 };
317 
318 static struct dentry *sockfs_mount(struct file_system_type *fs_type,
319  int flags, const char *dev_name, void *data)
320 {
321  return mount_pseudo(fs_type, "socket:", &sockfs_ops,
322  &sockfs_dentry_operations, SOCKFS_MAGIC);
323 }
324 
325 static struct vfsmount *sock_mnt __read_mostly;
326 
327 static struct file_system_type sock_fs_type = {
328  .name = "sockfs",
329  .mount = sockfs_mount,
330  .kill_sb = kill_anon_super,
331 };
332 
333 /*
334  * Obtains the first available file descriptor and sets it up for use.
335  *
336  * These functions create file structures and maps them to fd space
337  * of the current process. On success it returns file descriptor
338  * and file struct implicitly stored in sock->file.
339  * Note that another thread may close file descriptor before we return
340  * from this function. We use the fact that now we do not refer
341  * to socket after mapping. If one day we will need it, this
342  * function will increment ref. count on file by 1.
343  *
344  * In any case returned fd MAY BE not valid!
345  * This race condition is unavoidable
346  * with shared fd spaces, we cannot solve it inside kernel,
347  * but we take care of internal coherence yet.
348  */
349 
350 struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
351 {
352  struct qstr name = { .name = "" };
353  struct path path;
354  struct file *file;
355 
356  if (dname) {
357  name.name = dname;
358  name.len = strlen(name.name);
359  } else if (sock->sk) {
360  name.name = sock->sk->sk_prot_creator->name;
361  name.len = strlen(name.name);
362  }
363  path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
364  if (unlikely(!path.dentry))
365  return ERR_PTR(-ENOMEM);
366  path.mnt = mntget(sock_mnt);
367 
368  d_instantiate(path.dentry, SOCK_INODE(sock));
369  SOCK_INODE(sock)->i_fop = &socket_file_ops;
370 
371  file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
372  &socket_file_ops);
373  if (unlikely(!file)) {
374  /* drop dentry, keep inode */
375  ihold(path.dentry->d_inode);
376  path_put(&path);
377  return ERR_PTR(-ENFILE);
378  }
379 
380  sock->file = file;
381  file->f_flags = O_RDWR | (flags & O_NONBLOCK);
382  file->f_pos = 0;
383  file->private_data = sock;
384  return file;
385 }
387 
388 static int sock_map_fd(struct socket *sock, int flags)
389 {
390  struct file *newfile;
391  int fd = get_unused_fd_flags(flags);
392  if (unlikely(fd < 0))
393  return fd;
394 
395  newfile = sock_alloc_file(sock, flags, NULL);
396  if (likely(!IS_ERR(newfile))) {
397  fd_install(fd, newfile);
398  return fd;
399  }
400 
401  put_unused_fd(fd);
402  return PTR_ERR(newfile);
403 }
404 
405 struct socket *sock_from_file(struct file *file, int *err)
406 {
407  if (file->f_op == &socket_file_ops)
408  return file->private_data; /* set in sock_map_fd */
409 
410  *err = -ENOTSOCK;
411  return NULL;
412 }
414 
428 struct socket *sockfd_lookup(int fd, int *err)
429 {
430  struct file *file;
431  struct socket *sock;
432 
433  file = fget(fd);
434  if (!file) {
435  *err = -EBADF;
436  return NULL;
437  }
438 
439  sock = sock_from_file(file, err);
440  if (!sock)
441  fput(file);
442  return sock;
443 }
445 
446 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
447 {
448  struct file *file;
449  struct socket *sock;
450 
451  *err = -EBADF;
452  file = fget_light(fd, fput_needed);
453  if (file) {
454  sock = sock_from_file(file, err);
455  if (sock)
456  return sock;
457  fput_light(file, *fput_needed);
458  }
459  return NULL;
460 }
461 
462 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
463 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
464 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
465 static ssize_t sockfs_getxattr(struct dentry *dentry,
466  const char *name, void *value, size_t size)
467 {
468  const char *proto_name;
469  size_t proto_size;
470  int error;
471 
472  error = -ENODATA;
474  proto_name = dentry->d_name.name;
475  proto_size = strlen(proto_name);
476 
477  if (value) {
478  error = -ERANGE;
479  if (proto_size + 1 > size)
480  goto out;
481 
482  strncpy(value, proto_name, proto_size + 1);
483  }
484  error = proto_size + 1;
485  }
486 
487 out:
488  return error;
489 }
490 
491 static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
492  size_t size)
493 {
494  ssize_t len;
495  ssize_t used = 0;
496 
497  len = security_inode_listsecurity(dentry->d_inode, buffer, size);
498  if (len < 0)
499  return len;
500  used += len;
501  if (buffer) {
502  if (size < used)
503  return -ERANGE;
504  buffer += len;
505  }
506 
507  len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
508  used += len;
509  if (buffer) {
510  if (size < used)
511  return -ERANGE;
512  memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
513  buffer += len;
514  }
515 
516  return used;
517 }
518 
519 static const struct inode_operations sockfs_inode_ops = {
520  .getxattr = sockfs_getxattr,
521  .listxattr = sockfs_listxattr,
522 };
523 
532 static struct socket *sock_alloc(void)
533 {
534  struct inode *inode;
535  struct socket *sock;
536 
537  inode = new_inode_pseudo(sock_mnt->mnt_sb);
538  if (!inode)
539  return NULL;
540 
541  sock = SOCKET_I(inode);
542 
544  inode->i_ino = get_next_ino();
545  inode->i_mode = S_IFSOCK | S_IRWXUGO;
546  inode->i_uid = current_fsuid();
547  inode->i_gid = current_fsgid();
548  inode->i_op = &sockfs_inode_ops;
549 
550  this_cpu_add(sockets_in_use, 1);
551  return sock;
552 }
553 
554 /*
555  * In theory you can't get an open on this inode, but /proc provides
556  * a back door. Remember to keep it shut otherwise you'll let the
557  * creepy crawlies in.
558  */
559 
560 static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
561 {
562  return -ENXIO;
563 }
564 
566  .owner = THIS_MODULE,
567  .open = sock_no_open,
568  .llseek = noop_llseek,
569 };
570 
580 void sock_release(struct socket *sock)
581 {
582  if (sock->ops) {
583  struct module *owner = sock->ops->owner;
584 
585  sock->ops->release(sock);
586  sock->ops = NULL;
587  module_put(owner);
588  }
589 
590  if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
591  printk(KERN_ERR "sock_release: fasync list not empty!\n");
592 
594  return;
595 
596  this_cpu_sub(sockets_in_use, 1);
597  if (!sock->file) {
598  iput(SOCK_INODE(sock));
599  return;
600  }
601  sock->file = NULL;
602 }
604 
605 int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
606 {
607  *tx_flags = 0;
608  if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
609  *tx_flags |= SKBTX_HW_TSTAMP;
610  if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
611  *tx_flags |= SKBTX_SW_TSTAMP;
612  if (sock_flag(sk, SOCK_WIFI_STATUS))
613  *tx_flags |= SKBTX_WIFI_STATUS;
614  return 0;
615 }
617 
618 static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
619  struct msghdr *msg, size_t size)
620 {
621  struct sock_iocb *si = kiocb_to_siocb(iocb);
622 
623  sock_update_classid(sock->sk);
624 
625  si->sock = sock;
626  si->scm = NULL;
627  si->msg = msg;
628  si->size = size;
629 
630  return sock->ops->sendmsg(iocb, sock, msg, size);
631 }
632 
633 static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
634  struct msghdr *msg, size_t size)
635 {
636  int err = security_socket_sendmsg(sock, msg, size);
637 
638  return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
639 }
640 
641 int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
642 {
643  struct kiocb iocb;
644  struct sock_iocb siocb;
645  int ret;
646 
647  init_sync_kiocb(&iocb, NULL);
648  iocb.private = &siocb;
649  ret = __sock_sendmsg(&iocb, sock, msg, size);
650  if (-EIOCBQUEUED == ret)
651  ret = wait_on_sync_kiocb(&iocb);
652  return ret;
653 }
655 
656 static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
657 {
658  struct kiocb iocb;
659  struct sock_iocb siocb;
660  int ret;
661 
662  init_sync_kiocb(&iocb, NULL);
663  iocb.private = &siocb;
664  ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
665  if (-EIOCBQUEUED == ret)
666  ret = wait_on_sync_kiocb(&iocb);
667  return ret;
668 }
669 
670 int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
671  struct kvec *vec, size_t num, size_t size)
672 {
673  mm_segment_t oldfs = get_fs();
674  int result;
675 
676  set_fs(KERNEL_DS);
677  /*
678  * the following is safe, since for compiler definitions of kvec and
679  * iovec are identical, yielding the same in-core layout and alignment
680  */
681  msg->msg_iov = (struct iovec *)vec;
682  msg->msg_iovlen = num;
683  result = sock_sendmsg(sock, msg, size);
684  set_fs(oldfs);
685  return result;
686 }
688 
689 static int ktime2ts(ktime_t kt, struct timespec *ts)
690 {
691  if (kt.tv64) {
692  *ts = ktime_to_timespec(kt);
693  return 1;
694  } else {
695  return 0;
696  }
697 }
698 
699 /*
700  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
701  */
702 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
703  struct sk_buff *skb)
704 {
705  int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
706  struct timespec ts[3];
707  int empty = 1;
708  struct skb_shared_hwtstamps *shhwtstamps =
709  skb_hwtstamps(skb);
710 
711  /* Race occurred between timestamp enabling and packet
712  receiving. Fill in the current time for now. */
713  if (need_software_tstamp && skb->tstamp.tv64 == 0)
714  __net_timestamp(skb);
715 
716  if (need_software_tstamp) {
717  if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
718  struct timeval tv;
719  skb_get_timestamp(skb, &tv);
721  sizeof(tv), &tv);
722  } else {
723  skb_get_timestampns(skb, &ts[0]);
725  sizeof(ts[0]), &ts[0]);
726  }
727  }
728 
729 
730  memset(ts, 0, sizeof(ts));
731  if (skb->tstamp.tv64 &&
732  sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE)) {
733  skb_get_timestampns(skb, ts + 0);
734  empty = 0;
735  }
736  if (shhwtstamps) {
737  if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
738  ktime2ts(shhwtstamps->syststamp, ts + 1))
739  empty = 0;
740  if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
741  ktime2ts(shhwtstamps->hwtstamp, ts + 2))
742  empty = 0;
743  }
744  if (!empty)
745  put_cmsg(msg, SOL_SOCKET,
746  SCM_TIMESTAMPING, sizeof(ts), &ts);
747 }
749 
750 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
751  struct sk_buff *skb)
752 {
753  int ack;
754 
755  if (!sock_flag(sk, SOCK_WIFI_STATUS))
756  return;
757  if (!skb->wifi_acked_valid)
758  return;
759 
760  ack = skb->wifi_acked;
761 
762  put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
763 }
765 
766 static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
767  struct sk_buff *skb)
768 {
769  if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
771  sizeof(__u32), &skb->dropcount);
772 }
773 
774 void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
775  struct sk_buff *skb)
776 {
777  sock_recv_timestamp(msg, sk, skb);
778  sock_recv_drops(msg, sk, skb);
779 }
781 
782 static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
783  struct msghdr *msg, size_t size, int flags)
784 {
785  struct sock_iocb *si = kiocb_to_siocb(iocb);
786 
787  sock_update_classid(sock->sk);
788 
789  si->sock = sock;
790  si->scm = NULL;
791  si->msg = msg;
792  si->size = size;
793  si->flags = flags;
794 
795  return sock->ops->recvmsg(iocb, sock, msg, size, flags);
796 }
797 
798 static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
799  struct msghdr *msg, size_t size, int flags)
800 {
801  int err = security_socket_recvmsg(sock, msg, size, flags);
802 
803  return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
804 }
805 
806 int sock_recvmsg(struct socket *sock, struct msghdr *msg,
807  size_t size, int flags)
808 {
809  struct kiocb iocb;
810  struct sock_iocb siocb;
811  int ret;
812 
813  init_sync_kiocb(&iocb, NULL);
814  iocb.private = &siocb;
815  ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
816  if (-EIOCBQUEUED == ret)
817  ret = wait_on_sync_kiocb(&iocb);
818  return ret;
819 }
821 
822 static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
823  size_t size, int flags)
824 {
825  struct kiocb iocb;
826  struct sock_iocb siocb;
827  int ret;
828 
829  init_sync_kiocb(&iocb, NULL);
830  iocb.private = &siocb;
831  ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
832  if (-EIOCBQUEUED == ret)
833  ret = wait_on_sync_kiocb(&iocb);
834  return ret;
835 }
836 
852 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
853  struct kvec *vec, size_t num, size_t size, int flags)
854 {
855  mm_segment_t oldfs = get_fs();
856  int result;
857 
858  set_fs(KERNEL_DS);
859  /*
860  * the following is safe, since for compiler definitions of kvec and
861  * iovec are identical, yielding the same in-core layout and alignment
862  */
863  msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
864  result = sock_recvmsg(sock, msg, size, flags);
865  set_fs(oldfs);
866  return result;
867 }
869 
870 static void sock_aio_dtor(struct kiocb *iocb)
871 {
872  kfree(iocb->private);
873 }
874 
875 static ssize_t sock_sendpage(struct file *file, struct page *page,
876  int offset, size_t size, loff_t *ppos, int more)
877 {
878  struct socket *sock;
879  int flags;
880 
881  sock = file->private_data;
882 
883  flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
884  /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
885  flags |= more;
886 
887  return kernel_sendpage(sock, page, offset, size, flags);
888 }
889 
890 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
891  struct pipe_inode_info *pipe, size_t len,
892  unsigned int flags)
893 {
894  struct socket *sock = file->private_data;
895 
896  if (unlikely(!sock->ops->splice_read))
897  return -EINVAL;
898 
899  sock_update_classid(sock->sk);
900 
901  return sock->ops->splice_read(sock, ppos, pipe, len, flags);
902 }
903 
904 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
905  struct sock_iocb *siocb)
906 {
907  if (!is_sync_kiocb(iocb)) {
908  siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
909  if (!siocb)
910  return NULL;
911  iocb->ki_dtor = sock_aio_dtor;
912  }
913 
914  siocb->kiocb = iocb;
915  iocb->private = siocb;
916  return siocb;
917 }
918 
919 static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
920  struct file *file, const struct iovec *iov,
921  unsigned long nr_segs)
922 {
923  struct socket *sock = file->private_data;
924  size_t size = 0;
925  int i;
926 
927  for (i = 0; i < nr_segs; i++)
928  size += iov[i].iov_len;
929 
930  msg->msg_name = NULL;
931  msg->msg_namelen = 0;
932  msg->msg_control = NULL;
933  msg->msg_controllen = 0;
934  msg->msg_iov = (struct iovec *)iov;
935  msg->msg_iovlen = nr_segs;
936  msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
937 
938  return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
939 }
940 
941 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
942  unsigned long nr_segs, loff_t pos)
943 {
944  struct sock_iocb siocb, *x;
945 
946  if (pos != 0)
947  return -ESPIPE;
948 
949  if (iocb->ki_left == 0) /* Match SYS5 behaviour */
950  return 0;
951 
952 
953  x = alloc_sock_iocb(iocb, &siocb);
954  if (!x)
955  return -ENOMEM;
956  return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
957 }
958 
959 static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
960  struct file *file, const struct iovec *iov,
961  unsigned long nr_segs)
962 {
963  struct socket *sock = file->private_data;
964  size_t size = 0;
965  int i;
966 
967  for (i = 0; i < nr_segs; i++)
968  size += iov[i].iov_len;
969 
970  msg->msg_name = NULL;
971  msg->msg_namelen = 0;
972  msg->msg_control = NULL;
973  msg->msg_controllen = 0;
974  msg->msg_iov = (struct iovec *)iov;
975  msg->msg_iovlen = nr_segs;
976  msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
977  if (sock->type == SOCK_SEQPACKET)
978  msg->msg_flags |= MSG_EOR;
979 
980  return __sock_sendmsg(iocb, sock, msg, size);
981 }
982 
983 static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
984  unsigned long nr_segs, loff_t pos)
985 {
986  struct sock_iocb siocb, *x;
987 
988  if (pos != 0)
989  return -ESPIPE;
990 
991  x = alloc_sock_iocb(iocb, &siocb);
992  if (!x)
993  return -ENOMEM;
994 
995  return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
996 }
997 
998 /*
999  * Atomic setting of ioctl hooks to avoid race
1000  * with module unload.
1001  */
1002 
1003 static DEFINE_MUTEX(br_ioctl_mutex);
1004 static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1005 
1006 void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1007 {
1008  mutex_lock(&br_ioctl_mutex);
1009  br_ioctl_hook = hook;
1010  mutex_unlock(&br_ioctl_mutex);
1011 }
1013 
1014 static DEFINE_MUTEX(vlan_ioctl_mutex);
1015 static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1016 
1017 void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1018 {
1019  mutex_lock(&vlan_ioctl_mutex);
1020  vlan_ioctl_hook = hook;
1021  mutex_unlock(&vlan_ioctl_mutex);
1022 }
1024 
1025 static DEFINE_MUTEX(dlci_ioctl_mutex);
1026 static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1027 
1028 void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1029 {
1030  mutex_lock(&dlci_ioctl_mutex);
1031  dlci_ioctl_hook = hook;
1032  mutex_unlock(&dlci_ioctl_mutex);
1033 }
1035 
1036 static long sock_do_ioctl(struct net *net, struct socket *sock,
1037  unsigned int cmd, unsigned long arg)
1038 {
1039  int err;
1040  void __user *argp = (void __user *)arg;
1041 
1042  err = sock->ops->ioctl(sock, cmd, arg);
1043 
1044  /*
1045  * If this ioctl is unknown try to hand it down
1046  * to the NIC driver.
1047  */
1048  if (err == -ENOIOCTLCMD)
1049  err = dev_ioctl(net, cmd, argp);
1050 
1051  return err;
1052 }
1053 
1054 /*
1055  * With an ioctl, arg may well be a user mode pointer, but we don't know
1056  * what to do with it - that's up to the protocol still.
1057  */
1058 
1059 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1060 {
1061  struct socket *sock;
1062  struct sock *sk;
1063  void __user *argp = (void __user *)arg;
1064  int pid, err;
1065  struct net *net;
1066 
1067  sock = file->private_data;
1068  sk = sock->sk;
1069  net = sock_net(sk);
1070  if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
1071  err = dev_ioctl(net, cmd, argp);
1072  } else
1073 #ifdef CONFIG_WEXT_CORE
1074  if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
1075  err = dev_ioctl(net, cmd, argp);
1076  } else
1077 #endif
1078  switch (cmd) {
1079  case FIOSETOWN:
1080  case SIOCSPGRP:
1081  err = -EFAULT;
1082  if (get_user(pid, (int __user *)argp))
1083  break;
1084  err = f_setown(sock->file, pid, 1);
1085  break;
1086  case FIOGETOWN:
1087  case SIOCGPGRP:
1088  err = put_user(f_getown(sock->file),
1089  (int __user *)argp);
1090  break;
1091  case SIOCGIFBR:
1092  case SIOCSIFBR:
1093  case SIOCBRADDBR:
1094  case SIOCBRDELBR:
1095  err = -ENOPKG;
1096  if (!br_ioctl_hook)
1097  request_module("bridge");
1098 
1099  mutex_lock(&br_ioctl_mutex);
1100  if (br_ioctl_hook)
1101  err = br_ioctl_hook(net, cmd, argp);
1102  mutex_unlock(&br_ioctl_mutex);
1103  break;
1104  case SIOCGIFVLAN:
1105  case SIOCSIFVLAN:
1106  err = -ENOPKG;
1107  if (!vlan_ioctl_hook)
1108  request_module("8021q");
1109 
1110  mutex_lock(&vlan_ioctl_mutex);
1111  if (vlan_ioctl_hook)
1112  err = vlan_ioctl_hook(net, argp);
1113  mutex_unlock(&vlan_ioctl_mutex);
1114  break;
1115  case SIOCADDDLCI:
1116  case SIOCDELDLCI:
1117  err = -ENOPKG;
1118  if (!dlci_ioctl_hook)
1119  request_module("dlci");
1120 
1121  mutex_lock(&dlci_ioctl_mutex);
1122  if (dlci_ioctl_hook)
1123  err = dlci_ioctl_hook(cmd, argp);
1124  mutex_unlock(&dlci_ioctl_mutex);
1125  break;
1126  default:
1127  err = sock_do_ioctl(net, sock, cmd, arg);
1128  break;
1129  }
1130  return err;
1131 }
1132 
1133 int sock_create_lite(int family, int type, int protocol, struct socket **res)
1134 {
1135  int err;
1136  struct socket *sock = NULL;
1137 
1138  err = security_socket_create(family, type, protocol, 1);
1139  if (err)
1140  goto out;
1141 
1142  sock = sock_alloc();
1143  if (!sock) {
1144  err = -ENOMEM;
1145  goto out;
1146  }
1147 
1148  sock->type = type;
1149  err = security_socket_post_create(sock, family, type, protocol, 1);
1150  if (err)
1151  goto out_release;
1152 
1153 out:
1154  *res = sock;
1155  return err;
1156 out_release:
1157  sock_release(sock);
1158  sock = NULL;
1159  goto out;
1160 }
1162 
1163 /* No kernel lock held - perfect */
1164 static unsigned int sock_poll(struct file *file, poll_table *wait)
1165 {
1166  struct socket *sock;
1167 
1168  /*
1169  * We can't return errors to poll, so it's either yes or no.
1170  */
1171  sock = file->private_data;
1172  return sock->ops->poll(file, sock, wait);
1173 }
1174 
1175 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1176 {
1177  struct socket *sock = file->private_data;
1178 
1179  return sock->ops->mmap(file, sock, vma);
1180 }
1181 
1182 static int sock_close(struct inode *inode, struct file *filp)
1183 {
1184  /*
1185  * It was possible the inode is NULL we were
1186  * closing an unfinished socket.
1187  */
1188 
1189  if (!inode) {
1190  printk(KERN_DEBUG "sock_close: NULL inode\n");
1191  return 0;
1192  }
1193  sock_release(SOCKET_I(inode));
1194  return 0;
1195 }
1196 
1197 /*
1198  * Update the socket async list
1199  *
1200  * Fasync_list locking strategy.
1201  *
1202  * 1. fasync_list is modified only under process context socket lock
1203  * i.e. under semaphore.
1204  * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1205  * or under socket lock
1206  */
1207 
1208 static int sock_fasync(int fd, struct file *filp, int on)
1209 {
1210  struct socket *sock = filp->private_data;
1211  struct sock *sk = sock->sk;
1212  struct socket_wq *wq;
1213 
1214  if (sk == NULL)
1215  return -EINVAL;
1216 
1217  lock_sock(sk);
1219  fasync_helper(fd, filp, on, &wq->fasync_list);
1220 
1221  if (!wq->fasync_list)
1222  sock_reset_flag(sk, SOCK_FASYNC);
1223  else
1224  sock_set_flag(sk, SOCK_FASYNC);
1225 
1226  release_sock(sk);
1227  return 0;
1228 }
1229 
1230 /* This function may be called only under socket lock or callback_lock or rcu_lock */
1231 
1232 int sock_wake_async(struct socket *sock, int how, int band)
1233 {
1234  struct socket_wq *wq;
1235 
1236  if (!sock)
1237  return -1;
1238  rcu_read_lock();
1239  wq = rcu_dereference(sock->wq);
1240  if (!wq || !wq->fasync_list) {
1241  rcu_read_unlock();
1242  return -1;
1243  }
1244  switch (how) {
1245  case SOCK_WAKE_WAITD:
1246  if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1247  break;
1248  goto call_kill;
1249  case SOCK_WAKE_SPACE:
1251  break;
1252  /* fall through */
1253  case SOCK_WAKE_IO:
1254 call_kill:
1255  kill_fasync(&wq->fasync_list, SIGIO, band);
1256  break;
1257  case SOCK_WAKE_URG:
1258  kill_fasync(&wq->fasync_list, SIGURG, band);
1259  }
1260  rcu_read_unlock();
1261  return 0;
1262 }
1264 
1265 int __sock_create(struct net *net, int family, int type, int protocol,
1266  struct socket **res, int kern)
1267 {
1268  int err;
1269  struct socket *sock;
1270  const struct net_proto_family *pf;
1271 
1272  /*
1273  * Check protocol is in range
1274  */
1275  if (family < 0 || family >= NPROTO)
1276  return -EAFNOSUPPORT;
1278  return -EINVAL;
1279 
1280  /* Compatibility.
1281 
1282  This uglymoron is moved from INET layer to here to avoid
1283  deadlock in module load.
1284  */
1285  if (family == PF_INET && type == SOCK_PACKET) {
1286  static int warned;
1287  if (!warned) {
1288  warned = 1;
1289  printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1290  current->comm);
1291  }
1292  family = PF_PACKET;
1293  }
1294 
1295  err = security_socket_create(family, type, protocol, kern);
1296  if (err)
1297  return err;
1298 
1299  /*
1300  * Allocate the socket and allow the family to set things up. if
1301  * the protocol is 0, the family is instructed to select an appropriate
1302  * default.
1303  */
1304  sock = sock_alloc();
1305  if (!sock) {
1306  net_warn_ratelimited("socket: no more sockets\n");
1307  return -ENFILE; /* Not exactly a match, but its the
1308  closest posix thing */
1309  }
1310 
1311  sock->type = type;
1312 
1313 #ifdef CONFIG_MODULES
1314  /* Attempt to load a protocol module if the find failed.
1315  *
1316  * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1317  * requested real, full-featured networking support upon configuration.
1318  * Otherwise module support will break!
1319  */
1320  if (rcu_access_pointer(net_families[family]) == NULL)
1321  request_module("net-pf-%d", family);
1322 #endif
1323 
1324  rcu_read_lock();
1325  pf = rcu_dereference(net_families[family]);
1326  err = -EAFNOSUPPORT;
1327  if (!pf)
1328  goto out_release;
1329 
1330  /*
1331  * We will call the ->create function, that possibly is in a loadable
1332  * module, so we have to bump that loadable module refcnt first.
1333  */
1334  if (!try_module_get(pf->owner))
1335  goto out_release;
1336 
1337  /* Now protected by module ref count */
1338  rcu_read_unlock();
1339 
1340  err = pf->create(net, sock, protocol, kern);
1341  if (err < 0)
1342  goto out_module_put;
1343 
1344  /*
1345  * Now to bump the refcnt of the [loadable] module that owns this
1346  * socket at sock_release time we decrement its refcnt.
1347  */
1348  if (!try_module_get(sock->ops->owner))
1349  goto out_module_busy;
1350 
1351  /*
1352  * Now that we're done with the ->create function, the [loadable]
1353  * module can have its refcnt decremented
1354  */
1355  module_put(pf->owner);
1356  err = security_socket_post_create(sock, family, type, protocol, kern);
1357  if (err)
1358  goto out_sock_release;
1359  *res = sock;
1360 
1361  return 0;
1362 
1363 out_module_busy:
1364  err = -EAFNOSUPPORT;
1365 out_module_put:
1366  sock->ops = NULL;
1367  module_put(pf->owner);
1368 out_sock_release:
1369  sock_release(sock);
1370  return err;
1371 
1372 out_release:
1373  rcu_read_unlock();
1374  goto out_sock_release;
1375 }
1377 
1378 int sock_create(int family, int type, int protocol, struct socket **res)
1379 {
1380  return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1381 }
1383 
1384 int sock_create_kern(int family, int type, int protocol, struct socket **res)
1385 {
1386  return __sock_create(&init_net, family, type, protocol, res, 1);
1387 }
1389 
1391 {
1392  int retval;
1393  struct socket *sock;
1394  int flags;
1395 
1396  /* Check the SOCK_* constants for consistency. */
1400  BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1401 
1402  flags = type & ~SOCK_TYPE_MASK;
1403  if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1404  return -EINVAL;
1405  type &= SOCK_TYPE_MASK;
1406 
1407  if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1408  flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1409 
1410  retval = sock_create(family, type, protocol, &sock);
1411  if (retval < 0)
1412  goto out;
1413 
1414  retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1415  if (retval < 0)
1416  goto out_release;
1417 
1418 out:
1419  /* It may be already another descriptor 8) Not kernel problem. */
1420  return retval;
1421 
1422 out_release:
1423  sock_release(sock);
1424  return retval;
1425 }
1426 
1427 /*
1428  * Create a pair of connected sockets.
1429  */
1430 
1431 SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1432  int __user *, usockvec)
1433 {
1434  struct socket *sock1, *sock2;
1435  int fd1, fd2, err;
1436  struct file *newfile1, *newfile2;
1437  int flags;
1438 
1439  flags = type & ~SOCK_TYPE_MASK;
1440  if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1441  return -EINVAL;
1442  type &= SOCK_TYPE_MASK;
1443 
1444  if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1445  flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1446 
1447  /*
1448  * Obtain the first socket and check if the underlying protocol
1449  * supports the socketpair call.
1450  */
1451 
1452  err = sock_create(family, type, protocol, &sock1);
1453  if (err < 0)
1454  goto out;
1455 
1456  err = sock_create(family, type, protocol, &sock2);
1457  if (err < 0)
1458  goto out_release_1;
1459 
1460  err = sock1->ops->socketpair(sock1, sock2);
1461  if (err < 0)
1462  goto out_release_both;
1463 
1464  fd1 = get_unused_fd_flags(flags);
1465  if (unlikely(fd1 < 0)) {
1466  err = fd1;
1467  goto out_release_both;
1468  }
1469  fd2 = get_unused_fd_flags(flags);
1470  if (unlikely(fd2 < 0)) {
1471  err = fd2;
1472  put_unused_fd(fd1);
1473  goto out_release_both;
1474  }
1475 
1476  newfile1 = sock_alloc_file(sock1, flags, NULL);
1477  if (unlikely(IS_ERR(newfile1))) {
1478  err = PTR_ERR(newfile1);
1479  put_unused_fd(fd1);
1480  put_unused_fd(fd2);
1481  goto out_release_both;
1482  }
1483 
1484  newfile2 = sock_alloc_file(sock2, flags, NULL);
1485  if (IS_ERR(newfile2)) {
1486  err = PTR_ERR(newfile2);
1487  fput(newfile1);
1488  put_unused_fd(fd1);
1489  put_unused_fd(fd2);
1490  sock_release(sock2);
1491  goto out;
1492  }
1493 
1494  audit_fd_pair(fd1, fd2);
1495  fd_install(fd1, newfile1);
1496  fd_install(fd2, newfile2);
1497  /* fd1 and fd2 may be already another descriptors.
1498  * Not kernel problem.
1499  */
1500 
1501  err = put_user(fd1, &usockvec[0]);
1502  if (!err)
1503  err = put_user(fd2, &usockvec[1]);
1504  if (!err)
1505  return 0;
1506 
1507  sys_close(fd2);
1508  sys_close(fd1);
1509  return err;
1510 
1511 out_release_both:
1512  sock_release(sock2);
1513 out_release_1:
1514  sock_release(sock1);
1515 out:
1516  return err;
1517 }
1518 
1519 /*
1520  * Bind a name to a socket. Nothing much to do here since it's
1521  * the protocol's responsibility to handle the local address.
1522  *
1523  * We move the socket address to kernel space before we call
1524  * the protocol layer (having also checked the address is ok).
1525  */
1526 
1527 SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1528 {
1529  struct socket *sock;
1530  struct sockaddr_storage address;
1531  int err, fput_needed;
1532 
1533  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1534  if (sock) {
1535  err = move_addr_to_kernel(umyaddr, addrlen, &address);
1536  if (err >= 0) {
1537  err = security_socket_bind(sock,
1538  (struct sockaddr *)&address,
1539  addrlen);
1540  if (!err)
1541  err = sock->ops->bind(sock,
1542  (struct sockaddr *)
1543  &address, addrlen);
1544  }
1545  fput_light(sock->file, fput_needed);
1546  }
1547  return err;
1548 }
1549 
1550 /*
1551  * Perform a listen. Basically, we allow the protocol to do anything
1552  * necessary for a listen, and if that works, we mark the socket as
1553  * ready for listening.
1554  */
1555 
1556 SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1557 {
1558  struct socket *sock;
1559  int err, fput_needed;
1560  int somaxconn;
1561 
1562  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1563  if (sock) {
1564  somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1565  if ((unsigned int)backlog > somaxconn)
1566  backlog = somaxconn;
1567 
1568  err = security_socket_listen(sock, backlog);
1569  if (!err)
1570  err = sock->ops->listen(sock, backlog);
1571 
1572  fput_light(sock->file, fput_needed);
1573  }
1574  return err;
1575 }
1576 
1577 /*
1578  * For accept, we attempt to create a new socket, set up the link
1579  * with the client, wake up the client, then return the new
1580  * connected fd. We collect the address of the connector in kernel
1581  * space and move it to user at the very end. This is unclean because
1582  * we open the socket then return an error.
1583  *
1584  * 1003.1g adds the ability to recvmsg() to query connection pending
1585  * status to recvmsg. We need to add that support in a way thats
1586  * clean when we restucture accept also.
1587  */
1588 
1589 SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1590  int __user *, upeer_addrlen, int, flags)
1591 {
1592  struct socket *sock, *newsock;
1593  struct file *newfile;
1594  int err, len, newfd, fput_needed;
1595  struct sockaddr_storage address;
1596 
1597  if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1598  return -EINVAL;
1599 
1600  if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1601  flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1602 
1603  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1604  if (!sock)
1605  goto out;
1606 
1607  err = -ENFILE;
1608  newsock = sock_alloc();
1609  if (!newsock)
1610  goto out_put;
1611 
1612  newsock->type = sock->type;
1613  newsock->ops = sock->ops;
1614 
1615  /*
1616  * We don't need try_module_get here, as the listening socket (sock)
1617  * has the protocol module (sock->ops->owner) held.
1618  */
1619  __module_get(newsock->ops->owner);
1620 
1621  newfd = get_unused_fd_flags(flags);
1622  if (unlikely(newfd < 0)) {
1623  err = newfd;
1624  sock_release(newsock);
1625  goto out_put;
1626  }
1627  newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1628  if (unlikely(IS_ERR(newfile))) {
1629  err = PTR_ERR(newfile);
1630  put_unused_fd(newfd);
1631  sock_release(newsock);
1632  goto out_put;
1633  }
1634 
1635  err = security_socket_accept(sock, newsock);
1636  if (err)
1637  goto out_fd;
1638 
1639  err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1640  if (err < 0)
1641  goto out_fd;
1642 
1643  if (upeer_sockaddr) {
1644  if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1645  &len, 2) < 0) {
1646  err = -ECONNABORTED;
1647  goto out_fd;
1648  }
1649  err = move_addr_to_user(&address,
1650  len, upeer_sockaddr, upeer_addrlen);
1651  if (err < 0)
1652  goto out_fd;
1653  }
1654 
1655  /* File flags are not inherited via accept() unlike another OSes. */
1656 
1657  fd_install(newfd, newfile);
1658  err = newfd;
1659 
1660 out_put:
1661  fput_light(sock->file, fput_needed);
1662 out:
1663  return err;
1664 out_fd:
1665  fput(newfile);
1666  put_unused_fd(newfd);
1667  goto out_put;
1668 }
1669 
1670 SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1671  int __user *, upeer_addrlen)
1672 {
1673  return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1674 }
1675 
1676 /*
1677  * Attempt to connect to a socket with the server address. The address
1678  * is in user space so we verify it is OK and move it to kernel space.
1679  *
1680  * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1681  * break bindings
1682  *
1683  * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1684  * other SEQPACKET protocols that take time to connect() as it doesn't
1685  * include the -EINPROGRESS status for such sockets.
1686  */
1687 
1688 SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1689  int, addrlen)
1690 {
1691  struct socket *sock;
1692  struct sockaddr_storage address;
1693  int err, fput_needed;
1694 
1695  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1696  if (!sock)
1697  goto out;
1698  err = move_addr_to_kernel(uservaddr, addrlen, &address);
1699  if (err < 0)
1700  goto out_put;
1701 
1702  err =
1703  security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1704  if (err)
1705  goto out_put;
1706 
1707  err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1708  sock->file->f_flags);
1709 out_put:
1710  fput_light(sock->file, fput_needed);
1711 out:
1712  return err;
1713 }
1714 
1715 /*
1716  * Get the local address ('name') of a socket object. Move the obtained
1717  * name to user space.
1718  */
1719 
1720 SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1721  int __user *, usockaddr_len)
1722 {
1723  struct socket *sock;
1724  struct sockaddr_storage address;
1725  int len, err, fput_needed;
1726 
1727  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1728  if (!sock)
1729  goto out;
1730 
1731  err = security_socket_getsockname(sock);
1732  if (err)
1733  goto out_put;
1734 
1735  err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1736  if (err)
1737  goto out_put;
1738  err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1739 
1740 out_put:
1741  fput_light(sock->file, fput_needed);
1742 out:
1743  return err;
1744 }
1745 
1746 /*
1747  * Get the remote address ('name') of a socket object. Move the obtained
1748  * name to user space.
1749  */
1750 
1751 SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1752  int __user *, usockaddr_len)
1753 {
1754  struct socket *sock;
1755  struct sockaddr_storage address;
1756  int len, err, fput_needed;
1757 
1758  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1759  if (sock != NULL) {
1760  err = security_socket_getpeername(sock);
1761  if (err) {
1762  fput_light(sock->file, fput_needed);
1763  return err;
1764  }
1765 
1766  err =
1767  sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1768  1);
1769  if (!err)
1770  err = move_addr_to_user(&address, len, usockaddr,
1771  usockaddr_len);
1772  fput_light(sock->file, fput_needed);
1773  }
1774  return err;
1775 }
1776 
1777 /*
1778  * Send a datagram to a given address. We move the address into kernel
1779  * space and check the user space data area is readable before invoking
1780  * the protocol.
1781  */
1782 
1783 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1784  unsigned int, flags, struct sockaddr __user *, addr,
1785  int, addr_len)
1786 {
1787  struct socket *sock;
1788  struct sockaddr_storage address;
1789  int err;
1790  struct msghdr msg;
1791  struct iovec iov;
1792  int fput_needed;
1793 
1794  if (len > INT_MAX)
1795  len = INT_MAX;
1796  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1797  if (!sock)
1798  goto out;
1799 
1800  iov.iov_base = buff;
1801  iov.iov_len = len;
1802  msg.msg_name = NULL;
1803  msg.msg_iov = &iov;
1804  msg.msg_iovlen = 1;
1805  msg.msg_control = NULL;
1806  msg.msg_controllen = 0;
1807  msg.msg_namelen = 0;
1808  if (addr) {
1809  err = move_addr_to_kernel(addr, addr_len, &address);
1810  if (err < 0)
1811  goto out_put;
1812  msg.msg_name = (struct sockaddr *)&address;
1813  msg.msg_namelen = addr_len;
1814  }
1815  if (sock->file->f_flags & O_NONBLOCK)
1816  flags |= MSG_DONTWAIT;
1817  msg.msg_flags = flags;
1818  err = sock_sendmsg(sock, &msg, len);
1819 
1820 out_put:
1821  fput_light(sock->file, fput_needed);
1822 out:
1823  return err;
1824 }
1825 
1826 /*
1827  * Send a datagram down a socket.
1828  */
1829 
1830 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1831  unsigned int, flags)
1832 {
1833  return sys_sendto(fd, buff, len, flags, NULL, 0);
1834 }
1835 
1836 /*
1837  * Receive a frame from the socket and optionally record the address of the
1838  * sender. We verify the buffers are writable and if needed move the
1839  * sender address from kernel to user space.
1840  */
1841 
1842 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1843  unsigned int, flags, struct sockaddr __user *, addr,
1844  int __user *, addr_len)
1845 {
1846  struct socket *sock;
1847  struct iovec iov;
1848  struct msghdr msg;
1849  struct sockaddr_storage address;
1850  int err, err2;
1851  int fput_needed;
1852 
1853  if (size > INT_MAX)
1854  size = INT_MAX;
1855  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1856  if (!sock)
1857  goto out;
1858 
1859  msg.msg_control = NULL;
1860  msg.msg_controllen = 0;
1861  msg.msg_iovlen = 1;
1862  msg.msg_iov = &iov;
1863  iov.iov_len = size;
1864  iov.iov_base = ubuf;
1865  msg.msg_name = (struct sockaddr *)&address;
1866  msg.msg_namelen = sizeof(address);
1867  if (sock->file->f_flags & O_NONBLOCK)
1868  flags |= MSG_DONTWAIT;
1869  err = sock_recvmsg(sock, &msg, size, flags);
1870 
1871  if (err >= 0 && addr != NULL) {
1872  err2 = move_addr_to_user(&address,
1873  msg.msg_namelen, addr, addr_len);
1874  if (err2 < 0)
1875  err = err2;
1876  }
1877 
1878  fput_light(sock->file, fput_needed);
1879 out:
1880  return err;
1881 }
1882 
1883 /*
1884  * Receive a datagram from a socket.
1885  */
1886 
1887 asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
1888  unsigned int flags)
1889 {
1890  return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1891 }
1892 
1893 /*
1894  * Set a socket option. Because we don't know the option lengths we have
1895  * to pass the user mode parameter for the protocols to sort out.
1896  */
1897 
1898 SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1899  char __user *, optval, int, optlen)
1900 {
1901  int err, fput_needed;
1902  struct socket *sock;
1903 
1904  if (optlen < 0)
1905  return -EINVAL;
1906 
1907  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1908  if (sock != NULL) {
1909  err = security_socket_setsockopt(sock, level, optname);
1910  if (err)
1911  goto out_put;
1912 
1913  if (level == SOL_SOCKET)
1914  err =
1915  sock_setsockopt(sock, level, optname, optval,
1916  optlen);
1917  else
1918  err =
1919  sock->ops->setsockopt(sock, level, optname, optval,
1920  optlen);
1921 out_put:
1922  fput_light(sock->file, fput_needed);
1923  }
1924  return err;
1925 }
1926 
1927 /*
1928  * Get a socket option. Because we don't know the option lengths we have
1929  * to pass a user mode parameter for the protocols to sort out.
1930  */
1931 
1932 SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1933  char __user *, optval, int __user *, optlen)
1934 {
1935  int err, fput_needed;
1936  struct socket *sock;
1937 
1938  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1939  if (sock != NULL) {
1940  err = security_socket_getsockopt(sock, level, optname);
1941  if (err)
1942  goto out_put;
1943 
1944  if (level == SOL_SOCKET)
1945  err =
1946  sock_getsockopt(sock, level, optname, optval,
1947  optlen);
1948  else
1949  err =
1950  sock->ops->getsockopt(sock, level, optname, optval,
1951  optlen);
1952 out_put:
1953  fput_light(sock->file, fput_needed);
1954  }
1955  return err;
1956 }
1957 
1958 /*
1959  * Shutdown a socket.
1960  */
1961 
1962 SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1963 {
1964  int err, fput_needed;
1965  struct socket *sock;
1966 
1967  sock = sockfd_lookup_light(fd, &err, &fput_needed);
1968  if (sock != NULL) {
1969  err = security_socket_shutdown(sock, how);
1970  if (!err)
1971  err = sock->ops->shutdown(sock, how);
1972  fput_light(sock->file, fput_needed);
1973  }
1974  return err;
1975 }
1976 
1977 /* A couple of helpful macros for getting the address of the 32/64 bit
1978  * fields which are the same type (int / unsigned) on our platforms.
1979  */
1980 #define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1981 #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1982 #define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1983 
1986  unsigned int name_len;
1987 };
1988 
1989 static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
1990  struct msghdr *msg_sys, unsigned int flags,
1991  struct used_address *used_address)
1992 {
1993  struct compat_msghdr __user *msg_compat =
1994  (struct compat_msghdr __user *)msg;
1995  struct sockaddr_storage address;
1996  struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1997  unsigned char ctl[sizeof(struct cmsghdr) + 20]
1998  __attribute__ ((aligned(sizeof(__kernel_size_t))));
1999  /* 20 is size of ipv6_pktinfo */
2000  unsigned char *ctl_buf = ctl;
2001  int err, ctl_len, total_len;
2002 
2003  err = -EFAULT;
2004  if (MSG_CMSG_COMPAT & flags) {
2005  if (get_compat_msghdr(msg_sys, msg_compat))
2006  return -EFAULT;
2007  } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
2008  return -EFAULT;
2009 
2010  if (msg_sys->msg_iovlen > UIO_FASTIOV) {
2011  err = -EMSGSIZE;
2012  if (msg_sys->msg_iovlen > UIO_MAXIOV)
2013  goto out;
2014  err = -ENOMEM;
2015  iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2016  GFP_KERNEL);
2017  if (!iov)
2018  goto out;
2019  }
2020 
2021  /* This will also move the address data into kernel space */
2022  if (MSG_CMSG_COMPAT & flags) {
2023  err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
2024  } else
2025  err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
2026  if (err < 0)
2027  goto out_freeiov;
2028  total_len = err;
2029 
2030  err = -ENOBUFS;
2031 
2032  if (msg_sys->msg_controllen > INT_MAX)
2033  goto out_freeiov;
2034  ctl_len = msg_sys->msg_controllen;
2035  if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
2036  err =
2037  cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
2038  sizeof(ctl));
2039  if (err)
2040  goto out_freeiov;
2041  ctl_buf = msg_sys->msg_control;
2042  ctl_len = msg_sys->msg_controllen;
2043  } else if (ctl_len) {
2044  if (ctl_len > sizeof(ctl)) {
2045  ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
2046  if (ctl_buf == NULL)
2047  goto out_freeiov;
2048  }
2049  err = -EFAULT;
2050  /*
2051  * Careful! Before this, msg_sys->msg_control contains a user pointer.
2052  * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2053  * checking falls down on this.
2054  */
2055  if (copy_from_user(ctl_buf,
2056  (void __user __force *)msg_sys->msg_control,
2057  ctl_len))
2058  goto out_freectl;
2059  msg_sys->msg_control = ctl_buf;
2060  }
2061  msg_sys->msg_flags = flags;
2062 
2063  if (sock->file->f_flags & O_NONBLOCK)
2064  msg_sys->msg_flags |= MSG_DONTWAIT;
2065  /*
2066  * If this is sendmmsg() and current destination address is same as
2067  * previously succeeded address, omit asking LSM's decision.
2068  * used_address->name_len is initialized to UINT_MAX so that the first
2069  * destination address never matches.
2070  */
2071  if (used_address && msg_sys->msg_name &&
2072  used_address->name_len == msg_sys->msg_namelen &&
2073  !memcmp(&used_address->name, msg_sys->msg_name,
2074  used_address->name_len)) {
2075  err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2076  goto out_freectl;
2077  }
2078  err = sock_sendmsg(sock, msg_sys, total_len);
2079  /*
2080  * If this is sendmmsg() and sending to current destination address was
2081  * successful, remember it.
2082  */
2083  if (used_address && err >= 0) {
2084  used_address->name_len = msg_sys->msg_namelen;
2085  if (msg_sys->msg_name)
2086  memcpy(&used_address->name, msg_sys->msg_name,
2087  used_address->name_len);
2088  }
2089 
2090 out_freectl:
2091  if (ctl_buf != ctl)
2092  sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2093 out_freeiov:
2094  if (iov != iovstack)
2095  kfree(iov);
2096 out:
2097  return err;
2098 }
2099 
2100 /*
2101  * BSD sendmsg interface
2102  */
2103 
2104 SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
2105 {
2106  int fput_needed, err;
2107  struct msghdr msg_sys;
2108  struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2109 
2110  if (!sock)
2111  goto out;
2112 
2113  err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
2114 
2115  fput_light(sock->file, fput_needed);
2116 out:
2117  return err;
2118 }
2119 
2120 /*
2121  * Linux sendmmsg interface
2122  */
2123 
2124 int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2125  unsigned int flags)
2126 {
2127  int fput_needed, err, datagrams;
2128  struct socket *sock;
2129  struct mmsghdr __user *entry;
2130  struct compat_mmsghdr __user *compat_entry;
2131  struct msghdr msg_sys;
2132  struct used_address used_address;
2133 
2134  if (vlen > UIO_MAXIOV)
2135  vlen = UIO_MAXIOV;
2136 
2137  datagrams = 0;
2138 
2139  sock = sockfd_lookup_light(fd, &err, &fput_needed);
2140  if (!sock)
2141  return err;
2142 
2143  used_address.name_len = UINT_MAX;
2144  entry = mmsg;
2145  compat_entry = (struct compat_mmsghdr __user *)mmsg;
2146  err = 0;
2147 
2148  while (datagrams < vlen) {
2149  if (MSG_CMSG_COMPAT & flags) {
2150  err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
2151  &msg_sys, flags, &used_address);
2152  if (err < 0)
2153  break;
2154  err = __put_user(err, &compat_entry->msg_len);
2155  ++compat_entry;
2156  } else {
2157  err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
2158  &msg_sys, flags, &used_address);
2159  if (err < 0)
2160  break;
2161  err = put_user(err, &entry->msg_len);
2162  ++entry;
2163  }
2164 
2165  if (err)
2166  break;
2167  ++datagrams;
2168  }
2169 
2170  fput_light(sock->file, fput_needed);
2171 
2172  /* We only return an error if no datagrams were able to be sent */
2173  if (datagrams != 0)
2174  return datagrams;
2175 
2176  return err;
2177 }
2178 
2179 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2180  unsigned int, vlen, unsigned int, flags)
2181 {
2182  return __sys_sendmmsg(fd, mmsg, vlen, flags);
2183 }
2184 
2185 static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
2186  struct msghdr *msg_sys, unsigned int flags, int nosec)
2187 {
2188  struct compat_msghdr __user *msg_compat =
2189  (struct compat_msghdr __user *)msg;
2190  struct iovec iovstack[UIO_FASTIOV];
2191  struct iovec *iov = iovstack;
2192  unsigned long cmsg_ptr;
2193  int err, total_len, len;
2194 
2195  /* kernel mode address */
2196  struct sockaddr_storage addr;
2197 
2198  /* user mode address pointers */
2199  struct sockaddr __user *uaddr;
2200  int __user *uaddr_len;
2201 
2202  if (MSG_CMSG_COMPAT & flags) {
2203  if (get_compat_msghdr(msg_sys, msg_compat))
2204  return -EFAULT;
2205  } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
2206  return -EFAULT;
2207 
2208  if (msg_sys->msg_iovlen > UIO_FASTIOV) {
2209  err = -EMSGSIZE;
2210  if (msg_sys->msg_iovlen > UIO_MAXIOV)
2211  goto out;
2212  err = -ENOMEM;
2213  iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
2214  GFP_KERNEL);
2215  if (!iov)
2216  goto out;
2217  }
2218 
2219  /*
2220  * Save the user-mode address (verify_iovec will change the
2221  * kernel msghdr to use the kernel address space)
2222  */
2223 
2224  uaddr = (__force void __user *)msg_sys->msg_name;
2225  uaddr_len = COMPAT_NAMELEN(msg);
2226  if (MSG_CMSG_COMPAT & flags) {
2227  err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
2228  } else
2229  err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
2230  if (err < 0)
2231  goto out_freeiov;
2232  total_len = err;
2233 
2234  cmsg_ptr = (unsigned long)msg_sys->msg_control;
2235  msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2236 
2237  if (sock->file->f_flags & O_NONBLOCK)
2238  flags |= MSG_DONTWAIT;
2239  err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2240  total_len, flags);
2241  if (err < 0)
2242  goto out_freeiov;
2243  len = err;
2244 
2245  if (uaddr != NULL) {
2246  err = move_addr_to_user(&addr,
2247  msg_sys->msg_namelen, uaddr,
2248  uaddr_len);
2249  if (err < 0)
2250  goto out_freeiov;
2251  }
2252  err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2253  COMPAT_FLAGS(msg));
2254  if (err)
2255  goto out_freeiov;
2256  if (MSG_CMSG_COMPAT & flags)
2257  err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2258  &msg_compat->msg_controllen);
2259  else
2260  err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2261  &msg->msg_controllen);
2262  if (err)
2263  goto out_freeiov;
2264  err = len;
2265 
2266 out_freeiov:
2267  if (iov != iovstack)
2268  kfree(iov);
2269 out:
2270  return err;
2271 }
2272 
2273 /*
2274  * BSD recvmsg interface
2275  */
2276 
2277 SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2278  unsigned int, flags)
2279 {
2280  int fput_needed, err;
2281  struct msghdr msg_sys;
2282  struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2283 
2284  if (!sock)
2285  goto out;
2286 
2287  err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2288 
2289  fput_light(sock->file, fput_needed);
2290 out:
2291  return err;
2292 }
2293 
2294 /*
2295  * Linux recvmmsg interface
2296  */
2297 
2298 int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2299  unsigned int flags, struct timespec *timeout)
2300 {
2301  int fput_needed, err, datagrams;
2302  struct socket *sock;
2303  struct mmsghdr __user *entry;
2304  struct compat_mmsghdr __user *compat_entry;
2305  struct msghdr msg_sys;
2306  struct timespec end_time;
2307 
2308  if (timeout &&
2309  poll_select_set_timeout(&end_time, timeout->tv_sec,
2310  timeout->tv_nsec))
2311  return -EINVAL;
2312 
2313  datagrams = 0;
2314 
2315  sock = sockfd_lookup_light(fd, &err, &fput_needed);
2316  if (!sock)
2317  return err;
2318 
2319  err = sock_error(sock->sk);
2320  if (err)
2321  goto out_put;
2322 
2323  entry = mmsg;
2324  compat_entry = (struct compat_mmsghdr __user *)mmsg;
2325 
2326  while (datagrams < vlen) {
2327  /*
2328  * No need to ask LSM for more than the first datagram.
2329  */
2330  if (MSG_CMSG_COMPAT & flags) {
2331  err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
2332  &msg_sys, flags & ~MSG_WAITFORONE,
2333  datagrams);
2334  if (err < 0)
2335  break;
2336  err = __put_user(err, &compat_entry->msg_len);
2337  ++compat_entry;
2338  } else {
2339  err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
2340  &msg_sys, flags & ~MSG_WAITFORONE,
2341  datagrams);
2342  if (err < 0)
2343  break;
2344  err = put_user(err, &entry->msg_len);
2345  ++entry;
2346  }
2347 
2348  if (err)
2349  break;
2350  ++datagrams;
2351 
2352  /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2353  if (flags & MSG_WAITFORONE)
2354  flags |= MSG_DONTWAIT;
2355 
2356  if (timeout) {
2357  ktime_get_ts(timeout);
2358  *timeout = timespec_sub(end_time, *timeout);
2359  if (timeout->tv_sec < 0) {
2360  timeout->tv_sec = timeout->tv_nsec = 0;
2361  break;
2362  }
2363 
2364  /* Timeout, return less than vlen datagrams */
2365  if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2366  break;
2367  }
2368 
2369  /* Out of band data, return right away */
2370  if (msg_sys.msg_flags & MSG_OOB)
2371  break;
2372  }
2373 
2374 out_put:
2375  fput_light(sock->file, fput_needed);
2376 
2377  if (err == 0)
2378  return datagrams;
2379 
2380  if (datagrams != 0) {
2381  /*
2382  * We may return less entries than requested (vlen) if the
2383  * sock is non block and there aren't enough datagrams...
2384  */
2385  if (err != -EAGAIN) {
2386  /*
2387  * ... or if recvmsg returns an error after we
2388  * received some datagrams, where we record the
2389  * error to return on the next call or if the
2390  * app asks about it using getsockopt(SO_ERROR).
2391  */
2392  sock->sk->sk_err = -err;
2393  }
2394 
2395  return datagrams;
2396  }
2397 
2398  return err;
2399 }
2400 
2401 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2402  unsigned int, vlen, unsigned int, flags,
2403  struct timespec __user *, timeout)
2404 {
2405  int datagrams;
2406  struct timespec timeout_sys;
2407 
2408  if (!timeout)
2409  return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2410 
2411  if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2412  return -EFAULT;
2413 
2414  datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2415 
2416  if (datagrams > 0 &&
2417  copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2418  datagrams = -EFAULT;
2419 
2420  return datagrams;
2421 }
2422 
2423 #ifdef __ARCH_WANT_SYS_SOCKETCALL
2424 /* Argument list sizes for sys_socketcall */
2425 #define AL(x) ((x) * sizeof(unsigned long))
2426 static const unsigned char nargs[21] = {
2427  AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2428  AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2429  AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2430  AL(4), AL(5), AL(4)
2431 };
2432 
2433 #undef AL
2434 
2435 /*
2436  * System call vectors.
2437  *
2438  * Argument checking cleaned up. Saved 20% in size.
2439  * This function doesn't need to set the kernel lock because
2440  * it is set by the callees.
2441  */
2442 
2443 SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2444 {
2445  unsigned long a[6];
2446  unsigned long a0, a1;
2447  int err;
2448  unsigned int len;
2449 
2450  if (call < 1 || call > SYS_SENDMMSG)
2451  return -EINVAL;
2452 
2453  len = nargs[call];
2454  if (len > sizeof(a))
2455  return -EINVAL;
2456 
2457  /* copy_from_user should be SMP safe. */
2458  if (copy_from_user(a, args, len))
2459  return -EFAULT;
2460 
2461  audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2462 
2463  a0 = a[0];
2464  a1 = a[1];
2465 
2466  switch (call) {
2467  case SYS_SOCKET:
2468  err = sys_socket(a0, a1, a[2]);
2469  break;
2470  case SYS_BIND:
2471  err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2472  break;
2473  case SYS_CONNECT:
2474  err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2475  break;
2476  case SYS_LISTEN:
2477  err = sys_listen(a0, a1);
2478  break;
2479  case SYS_ACCEPT:
2480  err = sys_accept4(a0, (struct sockaddr __user *)a1,
2481  (int __user *)a[2], 0);
2482  break;
2483  case SYS_GETSOCKNAME:
2484  err =
2485  sys_getsockname(a0, (struct sockaddr __user *)a1,
2486  (int __user *)a[2]);
2487  break;
2488  case SYS_GETPEERNAME:
2489  err =
2490  sys_getpeername(a0, (struct sockaddr __user *)a1,
2491  (int __user *)a[2]);
2492  break;
2493  case SYS_SOCKETPAIR:
2494  err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2495  break;
2496  case SYS_SEND:
2497  err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2498  break;
2499  case SYS_SENDTO:
2500  err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2501  (struct sockaddr __user *)a[4], a[5]);
2502  break;
2503  case SYS_RECV:
2504  err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2505  break;
2506  case SYS_RECVFROM:
2507  err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2508  (struct sockaddr __user *)a[4],
2509  (int __user *)a[5]);
2510  break;
2511  case SYS_SHUTDOWN:
2512  err = sys_shutdown(a0, a1);
2513  break;
2514  case SYS_SETSOCKOPT:
2515  err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2516  break;
2517  case SYS_GETSOCKOPT:
2518  err =
2519  sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2520  (int __user *)a[4]);
2521  break;
2522  case SYS_SENDMSG:
2523  err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2524  break;
2525  case SYS_SENDMMSG:
2526  err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2527  break;
2528  case SYS_RECVMSG:
2529  err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2530  break;
2531  case SYS_RECVMMSG:
2532  err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2533  (struct timespec __user *)a[4]);
2534  break;
2535  case SYS_ACCEPT4:
2536  err = sys_accept4(a0, (struct sockaddr __user *)a1,
2537  (int __user *)a[2], a[3]);
2538  break;
2539  default:
2540  err = -EINVAL;
2541  break;
2542  }
2543  return err;
2544 }
2545 
2546 #endif /* __ARCH_WANT_SYS_SOCKETCALL */
2547 
2557 int sock_register(const struct net_proto_family *ops)
2558 {
2559  int err;
2560 
2561  if (ops->family >= NPROTO) {
2562  printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2563  NPROTO);
2564  return -ENOBUFS;
2565  }
2566 
2567  spin_lock(&net_family_lock);
2568  if (rcu_dereference_protected(net_families[ops->family],
2569  lockdep_is_held(&net_family_lock)))
2570  err = -EEXIST;
2571  else {
2572  rcu_assign_pointer(net_families[ops->family], ops);
2573  err = 0;
2574  }
2575  spin_unlock(&net_family_lock);
2576 
2577  printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
2578  return err;
2579 }
2581 
2596 {
2597  BUG_ON(family < 0 || family >= NPROTO);
2598 
2599  spin_lock(&net_family_lock);
2600  RCU_INIT_POINTER(net_families[family], NULL);
2601  spin_unlock(&net_family_lock);
2602 
2603  synchronize_rcu();
2604 
2605  printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
2606 }
2608 
2609 static int __init sock_init(void)
2610 {
2611  int err;
2612  /*
2613  * Initialize the network sysctl infrastructure.
2614  */
2615  err = net_sysctl_init();
2616  if (err)
2617  goto out;
2618 
2619  /*
2620  * Initialize skbuff SLAB cache
2621  */
2622  skb_init();
2623 
2624  /*
2625  * Initialize the protocols module.
2626  */
2627 
2628  init_inodecache();
2629 
2630  err = register_filesystem(&sock_fs_type);
2631  if (err)
2632  goto out_fs;
2633  sock_mnt = kern_mount(&sock_fs_type);
2634  if (IS_ERR(sock_mnt)) {
2635  err = PTR_ERR(sock_mnt);
2636  goto out_mount;
2637  }
2638 
2639  /* The real protocol initialization is performed in later initcalls.
2640  */
2641 
2642 #ifdef CONFIG_NETFILTER
2643  netfilter_init();
2644 #endif
2645 
2646 #ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2648 #endif
2649 
2650 out:
2651  return err;
2652 
2653 out_mount:
2654  unregister_filesystem(&sock_fs_type);
2655 out_fs:
2656  goto out;
2657 }
2658 
2659 core_initcall(sock_init); /* early initcall */
2660 
2661 #ifdef CONFIG_PROC_FS
2662 void socket_seq_show(struct seq_file *seq)
2663 {
2664  int cpu;
2665  int counter = 0;
2666 
2668  counter += per_cpu(sockets_in_use, cpu);
2669 
2670  /* It can be negative, by the way. 8) */
2671  if (counter < 0)
2672  counter = 0;
2673 
2674  seq_printf(seq, "sockets: used %d\n", counter);
2675 }
2676 #endif /* CONFIG_PROC_FS */
2677 
2678 #ifdef CONFIG_COMPAT
2679 static int do_siocgstamp(struct net *net, struct socket *sock,
2680  unsigned int cmd, void __user *up)
2681 {
2682  mm_segment_t old_fs = get_fs();
2683  struct timeval ktv;
2684  int err;
2685 
2686  set_fs(KERNEL_DS);
2687  err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2688  set_fs(old_fs);
2689  if (!err)
2690  err = compat_put_timeval(&ktv, up);
2691 
2692  return err;
2693 }
2694 
2695 static int do_siocgstampns(struct net *net, struct socket *sock,
2696  unsigned int cmd, void __user *up)
2697 {
2698  mm_segment_t old_fs = get_fs();
2699  struct timespec kts;
2700  int err;
2701 
2702  set_fs(KERNEL_DS);
2703  err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2704  set_fs(old_fs);
2705  if (!err)
2706  err = compat_put_timespec(&kts, up);
2707 
2708  return err;
2709 }
2710 
2711 static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2712 {
2713  struct ifreq __user *uifr;
2714  int err;
2715 
2716  uifr = compat_alloc_user_space(sizeof(struct ifreq));
2717  if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2718  return -EFAULT;
2719 
2720  err = dev_ioctl(net, SIOCGIFNAME, uifr);
2721  if (err)
2722  return err;
2723 
2724  if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2725  return -EFAULT;
2726 
2727  return 0;
2728 }
2729 
2730 static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2731 {
2732  struct compat_ifconf ifc32;
2733  struct ifconf ifc;
2734  struct ifconf __user *uifc;
2735  struct compat_ifreq __user *ifr32;
2736  struct ifreq __user *ifr;
2737  unsigned int i, j;
2738  int err;
2739 
2740  if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2741  return -EFAULT;
2742 
2743  memset(&ifc, 0, sizeof(ifc));
2744  if (ifc32.ifcbuf == 0) {
2745  ifc32.ifc_len = 0;
2746  ifc.ifc_len = 0;
2747  ifc.ifc_req = NULL;
2748  uifc = compat_alloc_user_space(sizeof(struct ifconf));
2749  } else {
2750  size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2751  sizeof(struct ifreq);
2752  uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2753  ifc.ifc_len = len;
2754  ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2755  ifr32 = compat_ptr(ifc32.ifcbuf);
2756  for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2757  if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2758  return -EFAULT;
2759  ifr++;
2760  ifr32++;
2761  }
2762  }
2763  if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2764  return -EFAULT;
2765 
2766  err = dev_ioctl(net, SIOCGIFCONF, uifc);
2767  if (err)
2768  return err;
2769 
2770  if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2771  return -EFAULT;
2772 
2773  ifr = ifc.ifc_req;
2774  ifr32 = compat_ptr(ifc32.ifcbuf);
2775  for (i = 0, j = 0;
2776  i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2777  i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2778  if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2779  return -EFAULT;
2780  ifr32++;
2781  ifr++;
2782  }
2783 
2784  if (ifc32.ifcbuf == 0) {
2785  /* Translate from 64-bit structure multiple to
2786  * a 32-bit one.
2787  */
2788  i = ifc.ifc_len;
2789  i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2790  ifc32.ifc_len = i;
2791  } else {
2792  ifc32.ifc_len = i;
2793  }
2794  if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2795  return -EFAULT;
2796 
2797  return 0;
2798 }
2799 
2800 static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2801 {
2802  struct compat_ethtool_rxnfc __user *compat_rxnfc;
2803  bool convert_in = false, convert_out = false;
2804  size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2805  struct ethtool_rxnfc __user *rxnfc;
2806  struct ifreq __user *ifr;
2807  u32 rule_cnt = 0, actual_rule_cnt;
2808  u32 ethcmd;
2809  u32 data;
2810  int ret;
2811 
2812  if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2813  return -EFAULT;
2814 
2815  compat_rxnfc = compat_ptr(data);
2816 
2817  if (get_user(ethcmd, &compat_rxnfc->cmd))
2818  return -EFAULT;
2819 
2820  /* Most ethtool structures are defined without padding.
2821  * Unfortunately struct ethtool_rxnfc is an exception.
2822  */
2823  switch (ethcmd) {
2824  default:
2825  break;
2826  case ETHTOOL_GRXCLSRLALL:
2827  /* Buffer size is variable */
2828  if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2829  return -EFAULT;
2830  if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2831  return -ENOMEM;
2832  buf_size += rule_cnt * sizeof(u32);
2833  /* fall through */
2834  case ETHTOOL_GRXRINGS:
2835  case ETHTOOL_GRXCLSRLCNT:
2836  case ETHTOOL_GRXCLSRULE:
2837  case ETHTOOL_SRXCLSRLINS:
2838  convert_out = true;
2839  /* fall through */
2840  case ETHTOOL_SRXCLSRLDEL:
2841  buf_size += sizeof(struct ethtool_rxnfc);
2842  convert_in = true;
2843  break;
2844  }
2845 
2846  ifr = compat_alloc_user_space(buf_size);
2847  rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
2848 
2849  if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2850  return -EFAULT;
2851 
2852  if (put_user(convert_in ? rxnfc : compat_ptr(data),
2853  &ifr->ifr_ifru.ifru_data))
2854  return -EFAULT;
2855 
2856  if (convert_in) {
2857  /* We expect there to be holes between fs.m_ext and
2858  * fs.ring_cookie and at the end of fs, but nowhere else.
2859  */
2860  BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2861  sizeof(compat_rxnfc->fs.m_ext) !=
2862  offsetof(struct ethtool_rxnfc, fs.m_ext) +
2863  sizeof(rxnfc->fs.m_ext));
2864  BUILD_BUG_ON(
2865  offsetof(struct compat_ethtool_rxnfc, fs.location) -
2866  offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2867  offsetof(struct ethtool_rxnfc, fs.location) -
2868  offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2869 
2870  if (copy_in_user(rxnfc, compat_rxnfc,
2871  (void *)(&rxnfc->fs.m_ext + 1) -
2872  (void *)rxnfc) ||
2873  copy_in_user(&rxnfc->fs.ring_cookie,
2874  &compat_rxnfc->fs.ring_cookie,
2875  (void *)(&rxnfc->fs.location + 1) -
2876  (void *)&rxnfc->fs.ring_cookie) ||
2877  copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2878  sizeof(rxnfc->rule_cnt)))
2879  return -EFAULT;
2880  }
2881 
2882  ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2883  if (ret)
2884  return ret;
2885 
2886  if (convert_out) {
2887  if (copy_in_user(compat_rxnfc, rxnfc,
2888  (const void *)(&rxnfc->fs.m_ext + 1) -
2889  (const void *)rxnfc) ||
2890  copy_in_user(&compat_rxnfc->fs.ring_cookie,
2891  &rxnfc->fs.ring_cookie,
2892  (const void *)(&rxnfc->fs.location + 1) -
2893  (const void *)&rxnfc->fs.ring_cookie) ||
2894  copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2895  sizeof(rxnfc->rule_cnt)))
2896  return -EFAULT;
2897 
2898  if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2899  /* As an optimisation, we only copy the actual
2900  * number of rules that the underlying
2901  * function returned. Since Mallory might
2902  * change the rule count in user memory, we
2903  * check that it is less than the rule count
2904  * originally given (as the user buffer size),
2905  * which has been range-checked.
2906  */
2907  if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2908  return -EFAULT;
2909  if (actual_rule_cnt < rule_cnt)
2910  rule_cnt = actual_rule_cnt;
2911  if (copy_in_user(&compat_rxnfc->rule_locs[0],
2912  &rxnfc->rule_locs[0],
2913  rule_cnt * sizeof(u32)))
2914  return -EFAULT;
2915  }
2916  }
2917 
2918  return 0;
2919 }
2920 
2921 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2922 {
2923  void __user *uptr;
2924  compat_uptr_t uptr32;
2925  struct ifreq __user *uifr;
2926 
2927  uifr = compat_alloc_user_space(sizeof(*uifr));
2928  if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2929  return -EFAULT;
2930 
2931  if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2932  return -EFAULT;
2933 
2934  uptr = compat_ptr(uptr32);
2935 
2936  if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2937  return -EFAULT;
2938 
2939  return dev_ioctl(net, SIOCWANDEV, uifr);
2940 }
2941 
2942 static int bond_ioctl(struct net *net, unsigned int cmd,
2943  struct compat_ifreq __user *ifr32)
2944 {
2945  struct ifreq kifr;
2946  struct ifreq __user *uifr;
2947  mm_segment_t old_fs;
2948  int err;
2949  u32 data;
2950  void __user *datap;
2951 
2952  switch (cmd) {
2953  case SIOCBONDENSLAVE:
2954  case SIOCBONDRELEASE:
2955  case SIOCBONDSETHWADDR:
2956  case SIOCBONDCHANGEACTIVE:
2957  if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2958  return -EFAULT;
2959 
2960  old_fs = get_fs();
2961  set_fs(KERNEL_DS);
2962  err = dev_ioctl(net, cmd,
2963  (struct ifreq __user __force *) &kifr);
2964  set_fs(old_fs);
2965 
2966  return err;
2968  case SIOCBONDINFOQUERY:
2969  uifr = compat_alloc_user_space(sizeof(*uifr));
2970  if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2971  return -EFAULT;
2972 
2973  if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2974  return -EFAULT;
2975 
2976  datap = compat_ptr(data);
2977  if (put_user(datap, &uifr->ifr_ifru.ifru_data))
2978  return -EFAULT;
2979 
2980  return dev_ioctl(net, cmd, uifr);
2981  default:
2982  return -ENOIOCTLCMD;
2983  }
2984 }
2985 
2986 static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
2987  struct compat_ifreq __user *u_ifreq32)
2988 {
2989  struct ifreq __user *u_ifreq64;
2990  char tmp_buf[IFNAMSIZ];
2991  void __user *data64;
2992  u32 data32;
2993 
2994  if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2995  IFNAMSIZ))
2996  return -EFAULT;
2997  if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2998  return -EFAULT;
2999  data64 = compat_ptr(data32);
3000 
3001  u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
3002 
3003  /* Don't check these user accesses, just let that get trapped
3004  * in the ioctl handler instead.
3005  */
3006  if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
3007  IFNAMSIZ))
3008  return -EFAULT;
3009  if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
3010  return -EFAULT;
3011 
3012  return dev_ioctl(net, cmd, u_ifreq64);
3013 }
3014 
3015 static int dev_ifsioc(struct net *net, struct socket *sock,
3016  unsigned int cmd, struct compat_ifreq __user *uifr32)
3017 {
3018  struct ifreq __user *uifr;
3019  int err;
3020 
3021  uifr = compat_alloc_user_space(sizeof(*uifr));
3022  if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3023  return -EFAULT;
3024 
3025  err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3026 
3027  if (!err) {
3028  switch (cmd) {
3029  case SIOCGIFFLAGS:
3030  case SIOCGIFMETRIC:
3031  case SIOCGIFMTU:
3032  case SIOCGIFMEM:
3033  case SIOCGIFHWADDR:
3034  case SIOCGIFINDEX:
3035  case SIOCGIFADDR:
3036  case SIOCGIFBRDADDR:
3037  case SIOCGIFDSTADDR:
3038  case SIOCGIFNETMASK:
3039  case SIOCGIFPFLAGS:
3040  case SIOCGIFTXQLEN:
3041  case SIOCGMIIPHY:
3042  case SIOCGMIIREG:
3043  if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
3044  err = -EFAULT;
3045  break;
3046  }
3047  }
3048  return err;
3049 }
3050 
3051 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3052  struct compat_ifreq __user *uifr32)
3053 {
3054  struct ifreq ifr;
3055  struct compat_ifmap __user *uifmap32;
3056  mm_segment_t old_fs;
3057  int err;
3058 
3059  uifmap32 = &uifr32->ifr_ifru.ifru_map;
3060  err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3061  err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3062  err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3063  err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3064  err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
3065  err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
3066  err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
3067  if (err)
3068  return -EFAULT;
3069 
3070  old_fs = get_fs();
3071  set_fs(KERNEL_DS);
3072  err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
3073  set_fs(old_fs);
3074 
3075  if (cmd == SIOCGIFMAP && !err) {
3076  err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3077  err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3078  err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3079  err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3080  err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
3081  err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
3082  err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
3083  if (err)
3084  err = -EFAULT;
3085  }
3086  return err;
3087 }
3088 
3089 static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
3090 {
3091  void __user *uptr;
3092  compat_uptr_t uptr32;
3093  struct ifreq __user *uifr;
3094 
3095  uifr = compat_alloc_user_space(sizeof(*uifr));
3096  if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
3097  return -EFAULT;
3098 
3099  if (get_user(uptr32, &uifr32->ifr_data))
3100  return -EFAULT;
3101 
3102  uptr = compat_ptr(uptr32);
3103 
3104  if (put_user(uptr, &uifr->ifr_data))
3105  return -EFAULT;
3106 
3107  return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
3108 }
3109 
3110 struct rtentry32 {
3111  u32 rt_pad1;
3112  struct sockaddr rt_dst; /* target address */
3113  struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3114  struct sockaddr rt_genmask; /* target network mask (IP) */
3115  unsigned short rt_flags;
3116  short rt_pad2;
3117  u32 rt_pad3;
3118  unsigned char rt_tos;
3119  unsigned char rt_class;
3120  short rt_pad4;
3121  short rt_metric; /* +1 for binary compatibility! */
3122  /* char * */ u32 rt_dev; /* forcing the device at add */
3123  u32 rt_mtu; /* per route MTU/Window */
3124  u32 rt_window; /* Window clamping */
3125  unsigned short rt_irtt; /* Initial RTT */
3126 };
3127 
3128 struct in6_rtmsg32 {
3129  struct in6_addr rtmsg_dst;
3130  struct in6_addr rtmsg_src;
3131  struct in6_addr rtmsg_gateway;
3132  u32 rtmsg_type;
3133  u16 rtmsg_dst_len;
3134  u16 rtmsg_src_len;
3135  u32 rtmsg_metric;
3136  u32 rtmsg_info;
3137  u32 rtmsg_flags;
3138  s32 rtmsg_ifindex;
3139 };
3140 
3141 static int routing_ioctl(struct net *net, struct socket *sock,
3142  unsigned int cmd, void __user *argp)
3143 {
3144  int ret;
3145  void *r = NULL;
3146  struct in6_rtmsg r6;
3147  struct rtentry r4;
3148  char devname[16];
3149  u32 rtdev;
3150  mm_segment_t old_fs = get_fs();
3151 
3152  if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3153  struct in6_rtmsg32 __user *ur6 = argp;
3154  ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3155  3 * sizeof(struct in6_addr));
3156  ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3157  ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3158  ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3159  ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3160  ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3161  ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3162  ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3163 
3164  r = (void *) &r6;
3165  } else { /* ipv4 */
3166  struct rtentry32 __user *ur4 = argp;
3167  ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3168  3 * sizeof(struct sockaddr));
3169  ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
3170  ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
3171  ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
3172  ret |= __get_user(r4.rt_window, &(ur4->rt_window));
3173  ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
3174  ret |= __get_user(rtdev, &(ur4->rt_dev));
3175  if (rtdev) {
3176  ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3177  r4.rt_dev = (char __user __force *)devname;
3178  devname[15] = 0;
3179  } else
3180  r4.rt_dev = NULL;
3181 
3182  r = (void *) &r4;
3183  }
3184 
3185  if (ret) {
3186  ret = -EFAULT;
3187  goto out;
3188  }
3189 
3190  set_fs(KERNEL_DS);
3191  ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3192  set_fs(old_fs);
3193 
3194 out:
3195  return ret;
3196 }
3197 
3198 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3199  * for some operations; this forces use of the newer bridge-utils that
3200  * use compatible ioctls
3201  */
3202 static int old_bridge_ioctl(compat_ulong_t __user *argp)
3203 {
3205 
3206  if (get_user(tmp, argp))
3207  return -EFAULT;
3208  if (tmp == BRCTL_GET_VERSION)
3209  return BRCTL_VERSION + 1;
3210  return -EINVAL;
3211 }
3212 
3213 static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3214  unsigned int cmd, unsigned long arg)
3215 {
3216  void __user *argp = compat_ptr(arg);
3217  struct sock *sk = sock->sk;
3218  struct net *net = sock_net(sk);
3219 
3220  if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3221  return siocdevprivate_ioctl(net, cmd, argp);
3222 
3223  switch (cmd) {
3224  case SIOCSIFBR:
3225  case SIOCGIFBR:
3226  return old_bridge_ioctl(argp);
3227  case SIOCGIFNAME:
3228  return dev_ifname32(net, argp);
3229  case SIOCGIFCONF:
3230  return dev_ifconf(net, argp);
3231  case SIOCETHTOOL:
3232  return ethtool_ioctl(net, argp);
3233  case SIOCWANDEV:
3234  return compat_siocwandev(net, argp);
3235  case SIOCGIFMAP:
3236  case SIOCSIFMAP:
3237  return compat_sioc_ifmap(net, cmd, argp);
3238  case SIOCBONDENSLAVE:
3239  case SIOCBONDRELEASE:
3240  case SIOCBONDSETHWADDR:
3242  case SIOCBONDINFOQUERY:
3243  case SIOCBONDCHANGEACTIVE:
3244  return bond_ioctl(net, cmd, argp);
3245  case SIOCADDRT:
3246  case SIOCDELRT:
3247  return routing_ioctl(net, sock, cmd, argp);
3248  case SIOCGSTAMP:
3249  return do_siocgstamp(net, sock, cmd, argp);
3250  case SIOCGSTAMPNS:
3251  return do_siocgstampns(net, sock, cmd, argp);
3252  case SIOCSHWTSTAMP:
3253  return compat_siocshwtstamp(net, argp);
3254 
3255  case FIOSETOWN:
3256  case SIOCSPGRP:
3257  case FIOGETOWN:
3258  case SIOCGPGRP:
3259  case SIOCBRADDBR:
3260  case SIOCBRDELBR:
3261  case SIOCGIFVLAN:
3262  case SIOCSIFVLAN:
3263  case SIOCADDDLCI:
3264  case SIOCDELDLCI:
3265  return sock_ioctl(file, cmd, arg);
3266 
3267  case SIOCGIFFLAGS:
3268  case SIOCSIFFLAGS:
3269  case SIOCGIFMETRIC:
3270  case SIOCSIFMETRIC:
3271  case SIOCGIFMTU:
3272  case SIOCSIFMTU:
3273  case SIOCGIFMEM:
3274  case SIOCSIFMEM:
3275  case SIOCGIFHWADDR:
3276  case SIOCSIFHWADDR:
3277  case SIOCADDMULTI:
3278  case SIOCDELMULTI:
3279  case SIOCGIFINDEX:
3280  case SIOCGIFADDR:
3281  case SIOCSIFADDR:
3282  case SIOCSIFHWBROADCAST:
3283  case SIOCDIFADDR:
3284  case SIOCGIFBRDADDR:
3285  case SIOCSIFBRDADDR:
3286  case SIOCGIFDSTADDR:
3287  case SIOCSIFDSTADDR:
3288  case SIOCGIFNETMASK:
3289  case SIOCSIFNETMASK:
3290  case SIOCSIFPFLAGS:
3291  case SIOCGIFPFLAGS:
3292  case SIOCGIFTXQLEN:
3293  case SIOCSIFTXQLEN:
3294  case SIOCBRADDIF:
3295  case SIOCBRDELIF:
3296  case SIOCSIFNAME:
3297  case SIOCGMIIPHY:
3298  case SIOCGMIIREG:
3299  case SIOCSMIIREG:
3300  return dev_ifsioc(net, sock, cmd, argp);
3301 
3302  case SIOCSARP:
3303  case SIOCGARP:
3304  case SIOCDARP:
3305  case SIOCATMARK:
3306  return sock_do_ioctl(net, sock, cmd, arg);
3307  }
3308 
3309  return -ENOIOCTLCMD;
3310 }
3311 
3312 static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3313  unsigned long arg)
3314 {
3315  struct socket *sock = file->private_data;
3316  int ret = -ENOIOCTLCMD;
3317  struct sock *sk;
3318  struct net *net;
3319 
3320  sk = sock->sk;
3321  net = sock_net(sk);
3322 
3323  if (sock->ops->compat_ioctl)
3324  ret = sock->ops->compat_ioctl(sock, cmd, arg);
3325 
3326  if (ret == -ENOIOCTLCMD &&
3327  (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3328  ret = compat_wext_handle_ioctl(net, cmd, arg);
3329 
3330  if (ret == -ENOIOCTLCMD)
3331  ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3332 
3333  return ret;
3334 }
3335 #endif
3336 
3337 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3338 {
3339  return sock->ops->bind(sock, addr, addrlen);
3340 }
3342 
3343 int kernel_listen(struct socket *sock, int backlog)
3344 {
3345  return sock->ops->listen(sock, backlog);
3346 }
3348 
3349 int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3350 {
3351  struct sock *sk = sock->sk;
3352  int err;
3353 
3354  err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3355  newsock);
3356  if (err < 0)
3357  goto done;
3358 
3359  err = sock->ops->accept(sock, *newsock, flags);
3360  if (err < 0) {
3361  sock_release(*newsock);
3362  *newsock = NULL;
3363  goto done;
3364  }
3365 
3366  (*newsock)->ops = sock->ops;
3367  __module_get((*newsock)->ops->owner);
3368 
3369 done:
3370  return err;
3371 }
3373 
3374 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3375  int flags)
3376 {
3377  return sock->ops->connect(sock, addr, addrlen, flags);
3378 }
3380 
3381 int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3382  int *addrlen)
3383 {
3384  return sock->ops->getname(sock, addr, addrlen, 0);
3385 }
3387 
3388 int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3389  int *addrlen)
3390 {
3391  return sock->ops->getname(sock, addr, addrlen, 1);
3392 }
3394 
3395 int kernel_getsockopt(struct socket *sock, int level, int optname,
3396  char *optval, int *optlen)
3397 {
3398  mm_segment_t oldfs = get_fs();
3399  char __user *uoptval;
3400  int __user *uoptlen;
3401  int err;
3402 
3403  uoptval = (char __user __force *) optval;
3404  uoptlen = (int __user __force *) optlen;
3405 
3406  set_fs(KERNEL_DS);
3407  if (level == SOL_SOCKET)
3408  err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3409  else
3410  err = sock->ops->getsockopt(sock, level, optname, uoptval,
3411  uoptlen);
3412  set_fs(oldfs);
3413  return err;
3414 }
3416 
3417 int kernel_setsockopt(struct socket *sock, int level, int optname,
3418  char *optval, unsigned int optlen)
3419 {
3420  mm_segment_t oldfs = get_fs();
3421  char __user *uoptval;
3422  int err;
3423 
3424  uoptval = (char __user __force *) optval;
3425 
3426  set_fs(KERNEL_DS);
3427  if (level == SOL_SOCKET)
3428  err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3429  else
3430  err = sock->ops->setsockopt(sock, level, optname, uoptval,
3431  optlen);
3432  set_fs(oldfs);
3433  return err;
3434 }
3436 
3437 int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3438  size_t size, int flags)
3439 {
3440  sock_update_classid(sock->sk);
3441 
3442  if (sock->ops->sendpage)
3443  return sock->ops->sendpage(sock, page, offset, size, flags);
3444 
3445  return sock_no_sendpage(sock, page, offset, size, flags);
3446 }
3448 
3449 int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3450 {
3451  mm_segment_t oldfs = get_fs();
3452  int err;
3453 
3454  set_fs(KERNEL_DS);
3455  err = sock->ops->ioctl(sock, cmd, arg);
3456  set_fs(oldfs);
3457 
3458  return err;
3459 }
3461 
3462 int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3463 {
3464  return sock->ops->shutdown(sock, how);
3465 }