• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * NET		An implementation of the SOCKET network access protocol.
3  *
4  * Version:	@(#)socket.c	1.1.93	18/02/95
5  *
6  * Authors:	Orest Zborowski, <obz@Kodak.COM>
7  *		Ross Biro
8  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9  *
10  * Fixes:
11  *		Anonymous	:	NOTSOCK/BADF cleanup. Error fix in
12  *					shutdown()
13  *		Alan Cox	:	verify_area() fixes
14  *		Alan Cox	:	Removed DDI
15  *		Jonathan Kamens	:	SOCK_DGRAM reconnect bug
16  *		Alan Cox	:	Moved a load of checks to the very
17  *					top level.
18  *		Alan Cox	:	Move address structures to/from user
19  *					mode above the protocol layers.
20  *		Rob Janssen	:	Allow 0 length sends.
21  *		Alan Cox	:	Asynchronous I/O support (cribbed from the
22  *					tty drivers).
23  *		Niibe Yutaka	:	Asynchronous I/O for writes (4.4BSD style)
24  *		Jeff Uphoff	:	Made max number of sockets command-line
25  *					configurable.
26  *		Matti Aarnio	:	Made the number of sockets dynamic,
27  *					to be allocated when needed, and mr.
28  *					Uphoff's max is used as max to be
29  *					allowed to allocate.
30  *		Linus		:	Argh. removed all the socket allocation
31  *					altogether: it's in the inode now.
32  *		Alan Cox	:	Made sock_alloc()/sock_release() public
33  *					for NetROM and future kernel nfsd type
34  *					stuff.
35  *		Alan Cox	:	sendmsg/recvmsg basics.
36  *		Tom Dyas	:	Export net symbols.
37  *		Marcin Dalecki	:	Fixed problems with CONFIG_NET="n".
38  *		Alan Cox	:	Added thread locking to sys_* calls
39  *					for sockets. May have errors at the
40  *					moment.
41  *		Kevin Buhr	:	Fixed the dumb errors in the above.
42  *		Andi Kleen	:	Some small cleanups, optimizations,
43  *					and fixed a copy_from_user() bug.
44  *		Tigran Aivazian	:	sys_send(args) calls sys_sendto(args, NULL, 0)
45  *		Tigran Aivazian	:	Made listen(2) backlog sanity checks
46  *					protocol-independent
47  *
48  *
49  *		This program is free software; you can redistribute it and/or
50  *		modify it under the terms of the GNU General Public License
51  *		as published by the Free Software Foundation; either version
52  *		2 of the License, or (at your option) any later version.
53  *
54  *
55  *	This module is effectively the top level interface to the BSD socket
56  *	paradigm.
57  *
58  *	Based upon Swansea University Computer Society NET3.039
59  */
60 
61 #include <linux/mm.h>
62 #include <linux/socket.h>
63 #include <linux/file.h>
64 #include <linux/net.h>
65 #include <linux/interrupt.h>
66 #include <linux/thread_info.h>
67 #include <linux/rcupdate.h>
68 #include <linux/netdevice.h>
69 #include <linux/proc_fs.h>
70 #include <linux/seq_file.h>
71 #include <linux/mutex.h>
72 #include <linux/if_bridge.h>
73 #include <linux/if_frad.h>
74 #include <linux/if_vlan.h>
75 #include <linux/ptp_classify.h>
76 #include <linux/init.h>
77 #include <linux/poll.h>
78 #include <linux/cache.h>
79 #include <linux/module.h>
80 #include <linux/highmem.h>
81 #include <linux/mount.h>
82 #include <linux/security.h>
83 #include <linux/syscalls.h>
84 #include <linux/compat.h>
85 #include <linux/kmod.h>
86 #include <linux/audit.h>
87 #include <linux/wireless.h>
88 #include <linux/nsproxy.h>
89 #include <linux/magic.h>
90 #include <linux/slab.h>
91 #include <linux/xattr.h>
92 
93 #include <asm/uaccess.h>
94 #include <asm/unistd.h>
95 
96 #include <net/compat.h>
97 #include <net/wext.h>
98 #include <net/cls_cgroup.h>
99 
100 #include <net/sock.h>
101 #include <linux/netfilter.h>
102 
103 #include <linux/if_tun.h>
104 #include <linux/ipv6_route.h>
105 #include <linux/route.h>
106 #include <linux/sockios.h>
107 #include <linux/atalk.h>
108 #include <net/busy_poll.h>
109 #include <linux/errqueue.h>
110 
111 #ifdef CONFIG_NET_RX_BUSY_POLL
112 unsigned int sysctl_net_busy_read __read_mostly;
113 unsigned int sysctl_net_busy_poll __read_mostly;
114 #endif
115 
116 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
117 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
118 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
119 
120 static int sock_close(struct inode *inode, struct file *file);
121 static unsigned int sock_poll(struct file *file,
122 			      struct poll_table_struct *wait);
123 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
124 #ifdef CONFIG_COMPAT
125 static long compat_sock_ioctl(struct file *file,
126 			      unsigned int cmd, unsigned long arg);
127 #endif
128 static int sock_fasync(int fd, struct file *filp, int on);
129 static ssize_t sock_sendpage(struct file *file, struct page *page,
130 			     int offset, size_t size, loff_t *ppos, int more);
131 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
132 				struct pipe_inode_info *pipe, size_t len,
133 				unsigned int flags);
134 
135 /*
136  *	Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
137  *	in the operation structures but are done directly via the socketcall() multiplexor.
138  */
139 
140 static const struct file_operations socket_file_ops = {
141 	.owner =	THIS_MODULE,
142 	.llseek =	no_llseek,
143 	.read_iter =	sock_read_iter,
144 	.write_iter =	sock_write_iter,
145 	.poll =		sock_poll,
146 	.unlocked_ioctl = sock_ioctl,
147 #ifdef CONFIG_COMPAT
148 	.compat_ioctl = compat_sock_ioctl,
149 #endif
150 	.mmap =		sock_mmap,
151 	.release =	sock_close,
152 	.fasync =	sock_fasync,
153 	.sendpage =	sock_sendpage,
154 	.splice_write = generic_splice_sendpage,
155 	.splice_read =	sock_splice_read,
156 };
157 
158 /*
159  *	The protocol list. Each protocol is registered in here.
160  */
161 
162 static DEFINE_SPINLOCK(net_family_lock);
163 static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
164 
165 /*
166  *	Statistics counters of the socket lists
167  */
168 
169 static DEFINE_PER_CPU(int, sockets_in_use);
170 
171 /*
172  * Support routines.
173  * Move socket addresses back and forth across the kernel/user
174  * divide and look after the messy bits.
175  */
176 
177 /**
178  *	move_addr_to_kernel	-	copy a socket address into kernel space
179  *	@uaddr: Address in user space
180  *	@kaddr: Address in kernel space
181  *	@ulen: Length in user space
182  *
183  *	The address is copied into kernel space. If the provided address is
184  *	too long an error code of -EINVAL is returned. If the copy gives
185  *	invalid addresses -EFAULT is returned. On a success 0 is returned.
186  */
187 
move_addr_to_kernel(void __user * uaddr,int ulen,struct sockaddr_storage * kaddr)188 int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
189 {
190 	if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
191 		return -EINVAL;
192 	if (ulen == 0)
193 		return 0;
194 	if (copy_from_user(kaddr, uaddr, ulen))
195 		return -EFAULT;
196 	return audit_sockaddr(ulen, kaddr);
197 }
198 
199 /**
200  *	move_addr_to_user	-	copy an address to user space
201  *	@kaddr: kernel space address
202  *	@klen: length of address in kernel
203  *	@uaddr: user space address
204  *	@ulen: pointer to user length field
205  *
206  *	The value pointed to by ulen on entry is the buffer length available.
207  *	This is overwritten with the buffer space used. -EINVAL is returned
208  *	if an overlong buffer is specified or a negative buffer size. -EFAULT
209  *	is returned if either the buffer or the length field are not
210  *	accessible.
211  *	After copying the data up to the limit the user specifies, the true
212  *	length of the data is written over the length limit the user
213  *	specified. Zero is returned for a success.
214  */
215 
move_addr_to_user(struct sockaddr_storage * kaddr,int klen,void __user * uaddr,int __user * ulen)216 static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
217 			     void __user *uaddr, int __user *ulen)
218 {
219 	int err;
220 	int len;
221 
222 	BUG_ON(klen > sizeof(struct sockaddr_storage));
223 	err = get_user(len, ulen);
224 	if (err)
225 		return err;
226 	if (len > klen)
227 		len = klen;
228 	if (len < 0)
229 		return -EINVAL;
230 	if (len) {
231 		if (audit_sockaddr(klen, kaddr))
232 			return -ENOMEM;
233 		if (copy_to_user(uaddr, kaddr, len))
234 			return -EFAULT;
235 	}
236 	/*
237 	 *      "fromlen shall refer to the value before truncation.."
238 	 *                      1003.1g
239 	 */
240 	return __put_user(klen, ulen);
241 }
242 
243 static struct kmem_cache *sock_inode_cachep __read_mostly;
244 
sock_alloc_inode(struct super_block * sb)245 static struct inode *sock_alloc_inode(struct super_block *sb)
246 {
247 	struct socket_alloc *ei;
248 	struct socket_wq *wq;
249 
250 	ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
251 	if (!ei)
252 		return NULL;
253 	wq = kmalloc(sizeof(*wq), GFP_KERNEL);
254 	if (!wq) {
255 		kmem_cache_free(sock_inode_cachep, ei);
256 		return NULL;
257 	}
258 	init_waitqueue_head(&wq->wait);
259 	wq->fasync_list = NULL;
260 	wq->flags = 0;
261 	RCU_INIT_POINTER(ei->socket.wq, wq);
262 
263 	ei->socket.state = SS_UNCONNECTED;
264 	ei->socket.flags = 0;
265 	ei->socket.ops = NULL;
266 	ei->socket.sk = NULL;
267 	ei->socket.file = NULL;
268 
269 	return &ei->vfs_inode;
270 }
271 
sock_destroy_inode(struct inode * inode)272 static void sock_destroy_inode(struct inode *inode)
273 {
274 	struct socket_alloc *ei;
275 	struct socket_wq *wq;
276 
277 	ei = container_of(inode, struct socket_alloc, vfs_inode);
278 	wq = rcu_dereference_protected(ei->socket.wq, 1);
279 	kfree_rcu(wq, rcu);
280 	kmem_cache_free(sock_inode_cachep, ei);
281 }
282 
init_once(void * foo)283 static void init_once(void *foo)
284 {
285 	struct socket_alloc *ei = (struct socket_alloc *)foo;
286 
287 	inode_init_once(&ei->vfs_inode);
288 }
289 
init_inodecache(void)290 static int init_inodecache(void)
291 {
292 	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
293 					      sizeof(struct socket_alloc),
294 					      0,
295 					      (SLAB_HWCACHE_ALIGN |
296 					       SLAB_RECLAIM_ACCOUNT |
297 					       SLAB_MEM_SPREAD | SLAB_ACCOUNT),
298 					      init_once);
299 	if (sock_inode_cachep == NULL)
300 		return -ENOMEM;
301 	return 0;
302 }
303 
304 static const struct super_operations sockfs_ops = {
305 	.alloc_inode	= sock_alloc_inode,
306 	.destroy_inode	= sock_destroy_inode,
307 	.statfs		= simple_statfs,
308 };
309 
310 /*
311  * sockfs_dname() is called from d_path().
312  */
sockfs_dname(struct dentry * dentry,char * buffer,int buflen)313 static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
314 {
315 	return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
316 				d_inode(dentry)->i_ino);
317 }
318 
319 static const struct dentry_operations sockfs_dentry_operations = {
320 	.d_dname  = sockfs_dname,
321 };
322 
sockfs_xattr_get(const struct xattr_handler * handler,struct dentry * dentry,struct inode * inode,const char * suffix,void * value,size_t size)323 static int sockfs_xattr_get(const struct xattr_handler *handler,
324 			    struct dentry *dentry, struct inode *inode,
325 			    const char *suffix, void *value, size_t size)
326 {
327 	if (value) {
328 		if (dentry->d_name.len + 1 > size)
329 			return -ERANGE;
330 		memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
331 	}
332 	return dentry->d_name.len + 1;
333 }
334 
335 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
336 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
337 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
338 
339 static const struct xattr_handler sockfs_xattr_handler = {
340 	.name = XATTR_NAME_SOCKPROTONAME,
341 	.get = sockfs_xattr_get,
342 };
343 
sockfs_security_xattr_set(const struct xattr_handler * handler,struct dentry * dentry,struct inode * inode,const char * suffix,const void * value,size_t size,int flags)344 static int sockfs_security_xattr_set(const struct xattr_handler *handler,
345 				     struct dentry *dentry, struct inode *inode,
346 				     const char *suffix, const void *value,
347 				     size_t size, int flags)
348 {
349 	/* Handled by LSM. */
350 	return -EAGAIN;
351 }
352 
353 static const struct xattr_handler sockfs_security_xattr_handler = {
354 	.prefix = XATTR_SECURITY_PREFIX,
355 	.set = sockfs_security_xattr_set,
356 };
357 
358 static const struct xattr_handler *sockfs_xattr_handlers[] = {
359 	&sockfs_xattr_handler,
360 	&sockfs_security_xattr_handler,
361 	NULL
362 };
363 
sockfs_mount(struct file_system_type * fs_type,int flags,const char * dev_name,void * data)364 static struct dentry *sockfs_mount(struct file_system_type *fs_type,
365 			 int flags, const char *dev_name, void *data)
366 {
367 	return mount_pseudo_xattr(fs_type, "socket:", &sockfs_ops,
368 				  sockfs_xattr_handlers,
369 				  &sockfs_dentry_operations, SOCKFS_MAGIC);
370 }
371 
372 static struct vfsmount *sock_mnt __read_mostly;
373 
374 static struct file_system_type sock_fs_type = {
375 	.name =		"sockfs",
376 	.mount =	sockfs_mount,
377 	.kill_sb =	kill_anon_super,
378 };
379 
380 /*
381  *	Obtains the first available file descriptor and sets it up for use.
382  *
383  *	These functions create file structures and maps them to fd space
384  *	of the current process. On success it returns file descriptor
385  *	and file struct implicitly stored in sock->file.
386  *	Note that another thread may close file descriptor before we return
387  *	from this function. We use the fact that now we do not refer
388  *	to socket after mapping. If one day we will need it, this
389  *	function will increment ref. count on file by 1.
390  *
391  *	In any case returned fd MAY BE not valid!
392  *	This race condition is unavoidable
393  *	with shared fd spaces, we cannot solve it inside kernel,
394  *	but we take care of internal coherence yet.
395  */
396 
sock_alloc_file(struct socket * sock,int flags,const char * dname)397 struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
398 {
399 	struct qstr name = { .name = "" };
400 	struct path path;
401 	struct file *file;
402 
403 	if (dname) {
404 		name.name = dname;
405 		name.len = strlen(name.name);
406 	} else if (sock->sk) {
407 		name.name = sock->sk->sk_prot_creator->name;
408 		name.len = strlen(name.name);
409 	}
410 	path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
411 	if (unlikely(!path.dentry))
412 		return ERR_PTR(-ENOMEM);
413 	path.mnt = mntget(sock_mnt);
414 
415 	d_instantiate(path.dentry, SOCK_INODE(sock));
416 
417 	file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
418 		  &socket_file_ops);
419 	if (IS_ERR(file)) {
420 		/* drop dentry, keep inode */
421 		ihold(d_inode(path.dentry));
422 		path_put(&path);
423 		return file;
424 	}
425 
426 	sock->file = file;
427 	file->f_flags = O_RDWR | (flags & O_NONBLOCK);
428 	file->private_data = sock;
429 	return file;
430 }
431 EXPORT_SYMBOL(sock_alloc_file);
432 
sock_map_fd(struct socket * sock,int flags)433 static int sock_map_fd(struct socket *sock, int flags)
434 {
435 	struct file *newfile;
436 	int fd = get_unused_fd_flags(flags);
437 	if (unlikely(fd < 0))
438 		return fd;
439 
440 	newfile = sock_alloc_file(sock, flags, NULL);
441 	if (likely(!IS_ERR(newfile))) {
442 		fd_install(fd, newfile);
443 		return fd;
444 	}
445 
446 	put_unused_fd(fd);
447 	return PTR_ERR(newfile);
448 }
449 
sock_from_file(struct file * file,int * err)450 struct socket *sock_from_file(struct file *file, int *err)
451 {
452 	if (file->f_op == &socket_file_ops)
453 		return file->private_data;	/* set in sock_map_fd */
454 
455 	*err = -ENOTSOCK;
456 	return NULL;
457 }
458 EXPORT_SYMBOL(sock_from_file);
459 
460 /**
461  *	sockfd_lookup - Go from a file number to its socket slot
462  *	@fd: file handle
463  *	@err: pointer to an error code return
464  *
465  *	The file handle passed in is locked and the socket it is bound
466  *	too is returned. If an error occurs the err pointer is overwritten
467  *	with a negative errno code and NULL is returned. The function checks
468  *	for both invalid handles and passing a handle which is not a socket.
469  *
470  *	On a success the socket object pointer is returned.
471  */
472 
sockfd_lookup(int fd,int * err)473 struct socket *sockfd_lookup(int fd, int *err)
474 {
475 	struct file *file;
476 	struct socket *sock;
477 
478 	file = fget(fd);
479 	if (!file) {
480 		*err = -EBADF;
481 		return NULL;
482 	}
483 
484 	sock = sock_from_file(file, err);
485 	if (!sock)
486 		fput(file);
487 	return sock;
488 }
489 EXPORT_SYMBOL(sockfd_lookup);
490 
sockfd_lookup_light(int fd,int * err,int * fput_needed)491 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
492 {
493 	struct fd f = fdget(fd);
494 	struct socket *sock;
495 
496 	*err = -EBADF;
497 	if (f.file) {
498 		sock = sock_from_file(f.file, err);
499 		if (likely(sock)) {
500 			*fput_needed = f.flags;
501 			return sock;
502 		}
503 		fdput(f);
504 	}
505 	return NULL;
506 }
507 
sockfs_listxattr(struct dentry * dentry,char * buffer,size_t size)508 static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
509 				size_t size)
510 {
511 	ssize_t len;
512 	ssize_t used = 0;
513 
514 	len = security_inode_listsecurity(d_inode(dentry), buffer, size);
515 	if (len < 0)
516 		return len;
517 	used += len;
518 	if (buffer) {
519 		if (size < used)
520 			return -ERANGE;
521 		buffer += len;
522 	}
523 
524 	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
525 	used += len;
526 	if (buffer) {
527 		if (size < used)
528 			return -ERANGE;
529 		memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
530 		buffer += len;
531 	}
532 
533 	return used;
534 }
535 
sockfs_setattr(struct dentry * dentry,struct iattr * iattr)536 static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
537 {
538 	int err = simple_setattr(dentry, iattr);
539 
540 	if (!err && (iattr->ia_valid & ATTR_UID)) {
541 		struct socket *sock = SOCKET_I(d_inode(dentry));
542 
543 		sock->sk->sk_uid = iattr->ia_uid;
544 	}
545 
546 	return err;
547 }
548 
549 static const struct inode_operations sockfs_inode_ops = {
550 	.listxattr = sockfs_listxattr,
551 	.setattr = sockfs_setattr,
552 };
553 
554 /**
555  *	sock_alloc	-	allocate a socket
556  *
557  *	Allocate a new inode and socket object. The two are bound together
558  *	and initialised. The socket is then returned. If we are out of inodes
559  *	NULL is returned.
560  */
561 
sock_alloc(void)562 struct socket *sock_alloc(void)
563 {
564 	struct inode *inode;
565 	struct socket *sock;
566 
567 	inode = new_inode_pseudo(sock_mnt->mnt_sb);
568 	if (!inode)
569 		return NULL;
570 
571 	sock = SOCKET_I(inode);
572 
573 	kmemcheck_annotate_bitfield(sock, type);
574 	inode->i_ino = get_next_ino();
575 	inode->i_mode = S_IFSOCK | S_IRWXUGO;
576 	inode->i_uid = current_fsuid();
577 	inode->i_gid = current_fsgid();
578 	inode->i_op = &sockfs_inode_ops;
579 
580 	this_cpu_add(sockets_in_use, 1);
581 	return sock;
582 }
583 EXPORT_SYMBOL(sock_alloc);
584 
585 /**
586  *	sock_release	-	close a socket
587  *	@sock: socket to close
588  *
589  *	The socket is released from the protocol stack if it has a release
590  *	callback, and the inode is then released if the socket is bound to
591  *	an inode not a file.
592  */
593 
sock_release(struct socket * sock)594 void sock_release(struct socket *sock)
595 {
596 	if (sock->ops) {
597 		struct module *owner = sock->ops->owner;
598 
599 		sock->ops->release(sock);
600 		sock->ops = NULL;
601 		module_put(owner);
602 	}
603 
604 	if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
605 		pr_err("%s: fasync list not empty!\n", __func__);
606 
607 	this_cpu_sub(sockets_in_use, 1);
608 	if (!sock->file) {
609 		iput(SOCK_INODE(sock));
610 		return;
611 	}
612 	sock->file = NULL;
613 }
614 EXPORT_SYMBOL(sock_release);
615 
__sock_tx_timestamp(__u16 tsflags,__u8 * tx_flags)616 void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
617 {
618 	u8 flags = *tx_flags;
619 
620 	if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
621 		flags |= SKBTX_HW_TSTAMP;
622 
623 	if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
624 		flags |= SKBTX_SW_TSTAMP;
625 
626 	if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
627 		flags |= SKBTX_SCHED_TSTAMP;
628 
629 	*tx_flags = flags;
630 }
631 EXPORT_SYMBOL(__sock_tx_timestamp);
632 
sock_sendmsg_nosec(struct socket * sock,struct msghdr * msg)633 static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
634 {
635 	int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
636 	BUG_ON(ret == -EIOCBQUEUED);
637 	return ret;
638 }
639 
sock_sendmsg(struct socket * sock,struct msghdr * msg)640 int sock_sendmsg(struct socket *sock, struct msghdr *msg)
641 {
642 	int err = security_socket_sendmsg(sock, msg,
643 					  msg_data_left(msg));
644 
645 	return err ?: sock_sendmsg_nosec(sock, msg);
646 }
647 EXPORT_SYMBOL(sock_sendmsg);
648 
kernel_sendmsg(struct socket * sock,struct msghdr * msg,struct kvec * vec,size_t num,size_t size)649 int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
650 		   struct kvec *vec, size_t num, size_t size)
651 {
652 	iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
653 	return sock_sendmsg(sock, msg);
654 }
655 EXPORT_SYMBOL(kernel_sendmsg);
656 
657 /*
658  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
659  */
__sock_recv_timestamp(struct msghdr * msg,struct sock * sk,struct sk_buff * skb)660 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
661 	struct sk_buff *skb)
662 {
663 	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
664 	struct scm_timestamping tss;
665 	int empty = 1;
666 	struct skb_shared_hwtstamps *shhwtstamps =
667 		skb_hwtstamps(skb);
668 
669 	/* Race occurred between timestamp enabling and packet
670 	   receiving.  Fill in the current time for now. */
671 	if (need_software_tstamp && skb->tstamp.tv64 == 0)
672 		__net_timestamp(skb);
673 
674 	if (need_software_tstamp) {
675 		if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
676 			struct timeval tv;
677 			skb_get_timestamp(skb, &tv);
678 			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
679 				 sizeof(tv), &tv);
680 		} else {
681 			struct timespec ts;
682 			skb_get_timestampns(skb, &ts);
683 			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
684 				 sizeof(ts), &ts);
685 		}
686 	}
687 
688 	memset(&tss, 0, sizeof(tss));
689 	if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
690 	    ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
691 		empty = 0;
692 	if (shhwtstamps &&
693 	    (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
694 	    ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
695 		empty = 0;
696 	if (!empty)
697 		put_cmsg(msg, SOL_SOCKET,
698 			 SCM_TIMESTAMPING, sizeof(tss), &tss);
699 }
700 EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
701 
__sock_recv_wifi_status(struct msghdr * msg,struct sock * sk,struct sk_buff * skb)702 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
703 	struct sk_buff *skb)
704 {
705 	int ack;
706 
707 	if (!sock_flag(sk, SOCK_WIFI_STATUS))
708 		return;
709 	if (!skb->wifi_acked_valid)
710 		return;
711 
712 	ack = skb->wifi_acked;
713 
714 	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
715 }
716 EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
717 
sock_recv_drops(struct msghdr * msg,struct sock * sk,struct sk_buff * skb)718 static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
719 				   struct sk_buff *skb)
720 {
721 	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
722 		put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
723 			sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
724 }
725 
__sock_recv_ts_and_drops(struct msghdr * msg,struct sock * sk,struct sk_buff * skb)726 void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
727 	struct sk_buff *skb)
728 {
729 	sock_recv_timestamp(msg, sk, skb);
730 	sock_recv_drops(msg, sk, skb);
731 }
732 EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
733 
sock_recvmsg_nosec(struct socket * sock,struct msghdr * msg,int flags)734 static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
735 				     int flags)
736 {
737 	return sock->ops->recvmsg(sock, msg, msg_data_left(msg), flags);
738 }
739 
sock_recvmsg(struct socket * sock,struct msghdr * msg,int flags)740 int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
741 {
742 	int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
743 
744 	return err ?: sock_recvmsg_nosec(sock, msg, flags);
745 }
746 EXPORT_SYMBOL(sock_recvmsg);
747 
748 /**
749  * kernel_recvmsg - Receive a message from a socket (kernel space)
750  * @sock:       The socket to receive the message from
751  * @msg:        Received message
752  * @vec:        Input s/g array for message data
753  * @num:        Size of input s/g array
754  * @size:       Number of bytes to read
755  * @flags:      Message flags (MSG_DONTWAIT, etc...)
756  *
757  * On return the msg structure contains the scatter/gather array passed in the
758  * vec argument. The array is modified so that it consists of the unfilled
759  * portion of the original array.
760  *
761  * The returned value is the total number of bytes received, or an error.
762  */
kernel_recvmsg(struct socket * sock,struct msghdr * msg,struct kvec * vec,size_t num,size_t size,int flags)763 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
764 		   struct kvec *vec, size_t num, size_t size, int flags)
765 {
766 	mm_segment_t oldfs = get_fs();
767 	int result;
768 
769 	iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
770 	set_fs(KERNEL_DS);
771 	result = sock_recvmsg(sock, msg, flags);
772 	set_fs(oldfs);
773 	return result;
774 }
775 EXPORT_SYMBOL(kernel_recvmsg);
776 
sock_sendpage(struct file * file,struct page * page,int offset,size_t size,loff_t * ppos,int more)777 static ssize_t sock_sendpage(struct file *file, struct page *page,
778 			     int offset, size_t size, loff_t *ppos, int more)
779 {
780 	struct socket *sock;
781 	int flags;
782 
783 	sock = file->private_data;
784 
785 	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
786 	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
787 	flags |= more;
788 
789 	return kernel_sendpage(sock, page, offset, size, flags);
790 }
791 
sock_splice_read(struct file * file,loff_t * ppos,struct pipe_inode_info * pipe,size_t len,unsigned int flags)792 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
793 				struct pipe_inode_info *pipe, size_t len,
794 				unsigned int flags)
795 {
796 	struct socket *sock = file->private_data;
797 
798 	if (unlikely(!sock->ops->splice_read))
799 		return -EINVAL;
800 
801 	return sock->ops->splice_read(sock, ppos, pipe, len, flags);
802 }
803 
sock_read_iter(struct kiocb * iocb,struct iov_iter * to)804 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
805 {
806 	struct file *file = iocb->ki_filp;
807 	struct socket *sock = file->private_data;
808 	struct msghdr msg = {.msg_iter = *to,
809 			     .msg_iocb = iocb};
810 	ssize_t res;
811 
812 	if (file->f_flags & O_NONBLOCK)
813 		msg.msg_flags = MSG_DONTWAIT;
814 
815 	if (iocb->ki_pos != 0)
816 		return -ESPIPE;
817 
818 	if (!iov_iter_count(to))	/* Match SYS5 behaviour */
819 		return 0;
820 
821 	res = sock_recvmsg(sock, &msg, msg.msg_flags);
822 	*to = msg.msg_iter;
823 	return res;
824 }
825 
sock_write_iter(struct kiocb * iocb,struct iov_iter * from)826 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
827 {
828 	struct file *file = iocb->ki_filp;
829 	struct socket *sock = file->private_data;
830 	struct msghdr msg = {.msg_iter = *from,
831 			     .msg_iocb = iocb};
832 	ssize_t res;
833 
834 	if (iocb->ki_pos != 0)
835 		return -ESPIPE;
836 
837 	if (file->f_flags & O_NONBLOCK)
838 		msg.msg_flags = MSG_DONTWAIT;
839 
840 	if (sock->type == SOCK_SEQPACKET)
841 		msg.msg_flags |= MSG_EOR;
842 
843 	res = sock_sendmsg(sock, &msg);
844 	*from = msg.msg_iter;
845 	return res;
846 }
847 
848 /*
849  * Atomic setting of ioctl hooks to avoid race
850  * with module unload.
851  */
852 
853 static DEFINE_MUTEX(br_ioctl_mutex);
854 static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
855 
brioctl_set(int (* hook)(struct net *,unsigned int,void __user *))856 void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
857 {
858 	mutex_lock(&br_ioctl_mutex);
859 	br_ioctl_hook = hook;
860 	mutex_unlock(&br_ioctl_mutex);
861 }
862 EXPORT_SYMBOL(brioctl_set);
863 
864 static DEFINE_MUTEX(vlan_ioctl_mutex);
865 static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
866 
vlan_ioctl_set(int (* hook)(struct net *,void __user *))867 void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
868 {
869 	mutex_lock(&vlan_ioctl_mutex);
870 	vlan_ioctl_hook = hook;
871 	mutex_unlock(&vlan_ioctl_mutex);
872 }
873 EXPORT_SYMBOL(vlan_ioctl_set);
874 
875 static DEFINE_MUTEX(dlci_ioctl_mutex);
876 static int (*dlci_ioctl_hook) (unsigned int, void __user *);
877 
dlci_ioctl_set(int (* hook)(unsigned int,void __user *))878 void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
879 {
880 	mutex_lock(&dlci_ioctl_mutex);
881 	dlci_ioctl_hook = hook;
882 	mutex_unlock(&dlci_ioctl_mutex);
883 }
884 EXPORT_SYMBOL(dlci_ioctl_set);
885 
sock_do_ioctl(struct net * net,struct socket * sock,unsigned int cmd,unsigned long arg)886 static long sock_do_ioctl(struct net *net, struct socket *sock,
887 				 unsigned int cmd, unsigned long arg)
888 {
889 	int err;
890 	void __user *argp = (void __user *)arg;
891 
892 	err = sock->ops->ioctl(sock, cmd, arg);
893 
894 	/*
895 	 * If this ioctl is unknown try to hand it down
896 	 * to the NIC driver.
897 	 */
898 	if (err == -ENOIOCTLCMD)
899 		err = dev_ioctl(net, cmd, argp);
900 
901 	return err;
902 }
903 
904 /*
905  *	With an ioctl, arg may well be a user mode pointer, but we don't know
906  *	what to do with it - that's up to the protocol still.
907  */
908 
sock_ioctl(struct file * file,unsigned cmd,unsigned long arg)909 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
910 {
911 	struct socket *sock;
912 	struct sock *sk;
913 	void __user *argp = (void __user *)arg;
914 	int pid, err;
915 	struct net *net;
916 
917 	sock = file->private_data;
918 	sk = sock->sk;
919 	net = sock_net(sk);
920 	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
921 		err = dev_ioctl(net, cmd, argp);
922 	} else
923 #ifdef CONFIG_WEXT_CORE
924 	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
925 		err = dev_ioctl(net, cmd, argp);
926 	} else
927 #endif
928 		switch (cmd) {
929 		case FIOSETOWN:
930 		case SIOCSPGRP:
931 			err = -EFAULT;
932 			if (get_user(pid, (int __user *)argp))
933 				break;
934 			f_setown(sock->file, pid, 1);
935 			err = 0;
936 			break;
937 		case FIOGETOWN:
938 		case SIOCGPGRP:
939 			err = put_user(f_getown(sock->file),
940 				       (int __user *)argp);
941 			break;
942 		case SIOCGIFBR:
943 		case SIOCSIFBR:
944 		case SIOCBRADDBR:
945 		case SIOCBRDELBR:
946 			err = -ENOPKG;
947 			if (!br_ioctl_hook)
948 				request_module("bridge");
949 
950 			mutex_lock(&br_ioctl_mutex);
951 			if (br_ioctl_hook)
952 				err = br_ioctl_hook(net, cmd, argp);
953 			mutex_unlock(&br_ioctl_mutex);
954 			break;
955 		case SIOCGIFVLAN:
956 		case SIOCSIFVLAN:
957 			err = -ENOPKG;
958 			if (!vlan_ioctl_hook)
959 				request_module("8021q");
960 
961 			mutex_lock(&vlan_ioctl_mutex);
962 			if (vlan_ioctl_hook)
963 				err = vlan_ioctl_hook(net, argp);
964 			mutex_unlock(&vlan_ioctl_mutex);
965 			break;
966 		case SIOCADDDLCI:
967 		case SIOCDELDLCI:
968 			err = -ENOPKG;
969 			if (!dlci_ioctl_hook)
970 				request_module("dlci");
971 
972 			mutex_lock(&dlci_ioctl_mutex);
973 			if (dlci_ioctl_hook)
974 				err = dlci_ioctl_hook(cmd, argp);
975 			mutex_unlock(&dlci_ioctl_mutex);
976 			break;
977 		default:
978 			err = sock_do_ioctl(net, sock, cmd, arg);
979 			break;
980 		}
981 	return err;
982 }
983 
sock_create_lite(int family,int type,int protocol,struct socket ** res)984 int sock_create_lite(int family, int type, int protocol, struct socket **res)
985 {
986 	int err;
987 	struct socket *sock = NULL;
988 
989 	err = security_socket_create(family, type, protocol, 1);
990 	if (err)
991 		goto out;
992 
993 	sock = sock_alloc();
994 	if (!sock) {
995 		err = -ENOMEM;
996 		goto out;
997 	}
998 
999 	sock->type = type;
1000 	err = security_socket_post_create(sock, family, type, protocol, 1);
1001 	if (err)
1002 		goto out_release;
1003 
1004 out:
1005 	*res = sock;
1006 	return err;
1007 out_release:
1008 	sock_release(sock);
1009 	sock = NULL;
1010 	goto out;
1011 }
1012 EXPORT_SYMBOL(sock_create_lite);
1013 
1014 /* No kernel lock held - perfect */
sock_poll(struct file * file,poll_table * wait)1015 static unsigned int sock_poll(struct file *file, poll_table *wait)
1016 {
1017 	unsigned int busy_flag = 0;
1018 	struct socket *sock;
1019 
1020 	/*
1021 	 *      We can't return errors to poll, so it's either yes or no.
1022 	 */
1023 	sock = file->private_data;
1024 
1025 	if (sk_can_busy_loop(sock->sk)) {
1026 		/* this socket can poll_ll so tell the system call */
1027 		busy_flag = POLL_BUSY_LOOP;
1028 
1029 		/* once, only if requested by syscall */
1030 		if (wait && (wait->_key & POLL_BUSY_LOOP))
1031 			sk_busy_loop(sock->sk, 1);
1032 	}
1033 
1034 	return busy_flag | sock->ops->poll(file, sock, wait);
1035 }
1036 
sock_mmap(struct file * file,struct vm_area_struct * vma)1037 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1038 {
1039 	struct socket *sock = file->private_data;
1040 
1041 	return sock->ops->mmap(file, sock, vma);
1042 }
1043 
sock_close(struct inode * inode,struct file * filp)1044 static int sock_close(struct inode *inode, struct file *filp)
1045 {
1046 	sock_release(SOCKET_I(inode));
1047 	return 0;
1048 }
1049 
1050 /*
1051  *	Update the socket async list
1052  *
1053  *	Fasync_list locking strategy.
1054  *
1055  *	1. fasync_list is modified only under process context socket lock
1056  *	   i.e. under semaphore.
1057  *	2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1058  *	   or under socket lock
1059  */
1060 
sock_fasync(int fd,struct file * filp,int on)1061 static int sock_fasync(int fd, struct file *filp, int on)
1062 {
1063 	struct socket *sock = filp->private_data;
1064 	struct sock *sk = sock->sk;
1065 	struct socket_wq *wq;
1066 
1067 	if (sk == NULL)
1068 		return -EINVAL;
1069 
1070 	lock_sock(sk);
1071 	wq = rcu_dereference_protected(sock->wq, lockdep_sock_is_held(sk));
1072 	fasync_helper(fd, filp, on, &wq->fasync_list);
1073 
1074 	if (!wq->fasync_list)
1075 		sock_reset_flag(sk, SOCK_FASYNC);
1076 	else
1077 		sock_set_flag(sk, SOCK_FASYNC);
1078 
1079 	release_sock(sk);
1080 	return 0;
1081 }
1082 
1083 /* This function may be called only under rcu_lock */
1084 
sock_wake_async(struct socket_wq * wq,int how,int band)1085 int sock_wake_async(struct socket_wq *wq, int how, int band)
1086 {
1087 	if (!wq || !wq->fasync_list)
1088 		return -1;
1089 
1090 	switch (how) {
1091 	case SOCK_WAKE_WAITD:
1092 		if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1093 			break;
1094 		goto call_kill;
1095 	case SOCK_WAKE_SPACE:
1096 		if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1097 			break;
1098 		/* fall through */
1099 	case SOCK_WAKE_IO:
1100 call_kill:
1101 		kill_fasync(&wq->fasync_list, SIGIO, band);
1102 		break;
1103 	case SOCK_WAKE_URG:
1104 		kill_fasync(&wq->fasync_list, SIGURG, band);
1105 	}
1106 
1107 	return 0;
1108 }
1109 EXPORT_SYMBOL(sock_wake_async);
1110 
__sock_create(struct net * net,int family,int type,int protocol,struct socket ** res,int kern)1111 int __sock_create(struct net *net, int family, int type, int protocol,
1112 			 struct socket **res, int kern)
1113 {
1114 	int err;
1115 	struct socket *sock;
1116 	const struct net_proto_family *pf;
1117 
1118 	/*
1119 	 *      Check protocol is in range
1120 	 */
1121 	if (family < 0 || family >= NPROTO)
1122 		return -EAFNOSUPPORT;
1123 	if (type < 0 || type >= SOCK_MAX)
1124 		return -EINVAL;
1125 
1126 	/* Compatibility.
1127 
1128 	   This uglymoron is moved from INET layer to here to avoid
1129 	   deadlock in module load.
1130 	 */
1131 	if (family == PF_INET && type == SOCK_PACKET) {
1132 		pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1133 			     current->comm);
1134 		family = PF_PACKET;
1135 	}
1136 
1137 	err = security_socket_create(family, type, protocol, kern);
1138 	if (err)
1139 		return err;
1140 
1141 	/*
1142 	 *	Allocate the socket and allow the family to set things up. if
1143 	 *	the protocol is 0, the family is instructed to select an appropriate
1144 	 *	default.
1145 	 */
1146 	sock = sock_alloc();
1147 	if (!sock) {
1148 		net_warn_ratelimited("socket: no more sockets\n");
1149 		return -ENFILE;	/* Not exactly a match, but its the
1150 				   closest posix thing */
1151 	}
1152 
1153 	sock->type = type;
1154 
1155 #ifdef CONFIG_MODULES
1156 	/* Attempt to load a protocol module if the find failed.
1157 	 *
1158 	 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1159 	 * requested real, full-featured networking support upon configuration.
1160 	 * Otherwise module support will break!
1161 	 */
1162 	if (rcu_access_pointer(net_families[family]) == NULL)
1163 		request_module("net-pf-%d", family);
1164 #endif
1165 
1166 	rcu_read_lock();
1167 	pf = rcu_dereference(net_families[family]);
1168 	err = -EAFNOSUPPORT;
1169 	if (!pf)
1170 		goto out_release;
1171 
1172 	/*
1173 	 * We will call the ->create function, that possibly is in a loadable
1174 	 * module, so we have to bump that loadable module refcnt first.
1175 	 */
1176 	if (!try_module_get(pf->owner))
1177 		goto out_release;
1178 
1179 	/* Now protected by module ref count */
1180 	rcu_read_unlock();
1181 
1182 	err = pf->create(net, sock, protocol, kern);
1183 	if (err < 0)
1184 		goto out_module_put;
1185 
1186 	/*
1187 	 * Now to bump the refcnt of the [loadable] module that owns this
1188 	 * socket at sock_release time we decrement its refcnt.
1189 	 */
1190 	if (!try_module_get(sock->ops->owner))
1191 		goto out_module_busy;
1192 
1193 	/*
1194 	 * Now that we're done with the ->create function, the [loadable]
1195 	 * module can have its refcnt decremented
1196 	 */
1197 	module_put(pf->owner);
1198 	err = security_socket_post_create(sock, family, type, protocol, kern);
1199 	if (err)
1200 		goto out_sock_release;
1201 	*res = sock;
1202 
1203 	return 0;
1204 
1205 out_module_busy:
1206 	err = -EAFNOSUPPORT;
1207 out_module_put:
1208 	sock->ops = NULL;
1209 	module_put(pf->owner);
1210 out_sock_release:
1211 	sock_release(sock);
1212 	return err;
1213 
1214 out_release:
1215 	rcu_read_unlock();
1216 	goto out_sock_release;
1217 }
1218 EXPORT_SYMBOL(__sock_create);
1219 
sock_create(int family,int type,int protocol,struct socket ** res)1220 int sock_create(int family, int type, int protocol, struct socket **res)
1221 {
1222 	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1223 }
1224 EXPORT_SYMBOL(sock_create);
1225 
sock_create_kern(struct net * net,int family,int type,int protocol,struct socket ** res)1226 int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1227 {
1228 	return __sock_create(net, family, type, protocol, res, 1);
1229 }
1230 EXPORT_SYMBOL(sock_create_kern);
1231 
SYSCALL_DEFINE3(socket,int,family,int,type,int,protocol)1232 SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1233 {
1234 	int retval;
1235 	struct socket *sock;
1236 	int flags;
1237 
1238 	/* Check the SOCK_* constants for consistency.  */
1239 	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1240 	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1241 	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1242 	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1243 
1244 	flags = type & ~SOCK_TYPE_MASK;
1245 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1246 		return -EINVAL;
1247 	type &= SOCK_TYPE_MASK;
1248 
1249 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1250 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1251 
1252 	retval = sock_create(family, type, protocol, &sock);
1253 	if (retval < 0)
1254 		goto out;
1255 
1256 	retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1257 	if (retval < 0)
1258 		goto out_release;
1259 
1260 out:
1261 	/* It may be already another descriptor 8) Not kernel problem. */
1262 	return retval;
1263 
1264 out_release:
1265 	sock_release(sock);
1266 	return retval;
1267 }
1268 
1269 /*
1270  *	Create a pair of connected sockets.
1271  */
1272 
SYSCALL_DEFINE4(socketpair,int,family,int,type,int,protocol,int __user *,usockvec)1273 SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1274 		int __user *, usockvec)
1275 {
1276 	struct socket *sock1, *sock2;
1277 	int fd1, fd2, err;
1278 	struct file *newfile1, *newfile2;
1279 	int flags;
1280 
1281 	flags = type & ~SOCK_TYPE_MASK;
1282 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1283 		return -EINVAL;
1284 	type &= SOCK_TYPE_MASK;
1285 
1286 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1287 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1288 
1289 	/*
1290 	 * Obtain the first socket and check if the underlying protocol
1291 	 * supports the socketpair call.
1292 	 */
1293 
1294 	err = sock_create(family, type, protocol, &sock1);
1295 	if (err < 0)
1296 		goto out;
1297 
1298 	err = sock_create(family, type, protocol, &sock2);
1299 	if (err < 0)
1300 		goto out_release_1;
1301 
1302 	err = sock1->ops->socketpair(sock1, sock2);
1303 	if (err < 0)
1304 		goto out_release_both;
1305 
1306 	fd1 = get_unused_fd_flags(flags);
1307 	if (unlikely(fd1 < 0)) {
1308 		err = fd1;
1309 		goto out_release_both;
1310 	}
1311 
1312 	fd2 = get_unused_fd_flags(flags);
1313 	if (unlikely(fd2 < 0)) {
1314 		err = fd2;
1315 		goto out_put_unused_1;
1316 	}
1317 
1318 	newfile1 = sock_alloc_file(sock1, flags, NULL);
1319 	if (IS_ERR(newfile1)) {
1320 		err = PTR_ERR(newfile1);
1321 		goto out_put_unused_both;
1322 	}
1323 
1324 	newfile2 = sock_alloc_file(sock2, flags, NULL);
1325 	if (IS_ERR(newfile2)) {
1326 		err = PTR_ERR(newfile2);
1327 		goto out_fput_1;
1328 	}
1329 
1330 	err = put_user(fd1, &usockvec[0]);
1331 	if (err)
1332 		goto out_fput_both;
1333 
1334 	err = put_user(fd2, &usockvec[1]);
1335 	if (err)
1336 		goto out_fput_both;
1337 
1338 	audit_fd_pair(fd1, fd2);
1339 
1340 	fd_install(fd1, newfile1);
1341 	fd_install(fd2, newfile2);
1342 	/* fd1 and fd2 may be already another descriptors.
1343 	 * Not kernel problem.
1344 	 */
1345 
1346 	return 0;
1347 
1348 out_fput_both:
1349 	fput(newfile2);
1350 	fput(newfile1);
1351 	put_unused_fd(fd2);
1352 	put_unused_fd(fd1);
1353 	goto out;
1354 
1355 out_fput_1:
1356 	fput(newfile1);
1357 	put_unused_fd(fd2);
1358 	put_unused_fd(fd1);
1359 	sock_release(sock2);
1360 	goto out;
1361 
1362 out_put_unused_both:
1363 	put_unused_fd(fd2);
1364 out_put_unused_1:
1365 	put_unused_fd(fd1);
1366 out_release_both:
1367 	sock_release(sock2);
1368 out_release_1:
1369 	sock_release(sock1);
1370 out:
1371 	return err;
1372 }
1373 
1374 /*
1375  *	Bind a name to a socket. Nothing much to do here since it's
1376  *	the protocol's responsibility to handle the local address.
1377  *
1378  *	We move the socket address to kernel space before we call
1379  *	the protocol layer (having also checked the address is ok).
1380  */
1381 
SYSCALL_DEFINE3(bind,int,fd,struct sockaddr __user *,umyaddr,int,addrlen)1382 SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1383 {
1384 	struct socket *sock;
1385 	struct sockaddr_storage address;
1386 	int err, fput_needed;
1387 
1388 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1389 	if (sock) {
1390 		err = move_addr_to_kernel(umyaddr, addrlen, &address);
1391 		if (err >= 0) {
1392 			err = security_socket_bind(sock,
1393 						   (struct sockaddr *)&address,
1394 						   addrlen);
1395 			if (!err)
1396 				err = sock->ops->bind(sock,
1397 						      (struct sockaddr *)
1398 						      &address, addrlen);
1399 		}
1400 		fput_light(sock->file, fput_needed);
1401 	}
1402 	return err;
1403 }
1404 
1405 /*
1406  *	Perform a listen. Basically, we allow the protocol to do anything
1407  *	necessary for a listen, and if that works, we mark the socket as
1408  *	ready for listening.
1409  */
1410 
SYSCALL_DEFINE2(listen,int,fd,int,backlog)1411 SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1412 {
1413 	struct socket *sock;
1414 	int err, fput_needed;
1415 	int somaxconn;
1416 
1417 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1418 	if (sock) {
1419 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1420 		if ((unsigned int)backlog > somaxconn)
1421 			backlog = somaxconn;
1422 
1423 		err = security_socket_listen(sock, backlog);
1424 		if (!err)
1425 			err = sock->ops->listen(sock, backlog);
1426 
1427 		fput_light(sock->file, fput_needed);
1428 	}
1429 	return err;
1430 }
1431 
1432 /*
1433  *	For accept, we attempt to create a new socket, set up the link
1434  *	with the client, wake up the client, then return the new
1435  *	connected fd. We collect the address of the connector in kernel
1436  *	space and move it to user at the very end. This is unclean because
1437  *	we open the socket then return an error.
1438  *
1439  *	1003.1g adds the ability to recvmsg() to query connection pending
1440  *	status to recvmsg. We need to add that support in a way thats
1441  *	clean when we restucture accept also.
1442  */
1443 
SYSCALL_DEFINE4(accept4,int,fd,struct sockaddr __user *,upeer_sockaddr,int __user *,upeer_addrlen,int,flags)1444 SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1445 		int __user *, upeer_addrlen, int, flags)
1446 {
1447 	struct socket *sock, *newsock;
1448 	struct file *newfile;
1449 	int err, len, newfd, fput_needed;
1450 	struct sockaddr_storage address;
1451 
1452 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1453 		return -EINVAL;
1454 
1455 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1456 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1457 
1458 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1459 	if (!sock)
1460 		goto out;
1461 
1462 	err = -ENFILE;
1463 	newsock = sock_alloc();
1464 	if (!newsock)
1465 		goto out_put;
1466 
1467 	newsock->type = sock->type;
1468 	newsock->ops = sock->ops;
1469 
1470 	/*
1471 	 * We don't need try_module_get here, as the listening socket (sock)
1472 	 * has the protocol module (sock->ops->owner) held.
1473 	 */
1474 	__module_get(newsock->ops->owner);
1475 
1476 	newfd = get_unused_fd_flags(flags);
1477 	if (unlikely(newfd < 0)) {
1478 		err = newfd;
1479 		sock_release(newsock);
1480 		goto out_put;
1481 	}
1482 	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1483 	if (IS_ERR(newfile)) {
1484 		err = PTR_ERR(newfile);
1485 		put_unused_fd(newfd);
1486 		sock_release(newsock);
1487 		goto out_put;
1488 	}
1489 
1490 	err = security_socket_accept(sock, newsock);
1491 	if (err)
1492 		goto out_fd;
1493 
1494 	err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1495 	if (err < 0)
1496 		goto out_fd;
1497 
1498 	if (upeer_sockaddr) {
1499 		if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1500 					  &len, 2) < 0) {
1501 			err = -ECONNABORTED;
1502 			goto out_fd;
1503 		}
1504 		err = move_addr_to_user(&address,
1505 					len, upeer_sockaddr, upeer_addrlen);
1506 		if (err < 0)
1507 			goto out_fd;
1508 	}
1509 
1510 	/* File flags are not inherited via accept() unlike another OSes. */
1511 
1512 	fd_install(newfd, newfile);
1513 	err = newfd;
1514 
1515 out_put:
1516 	fput_light(sock->file, fput_needed);
1517 out:
1518 	return err;
1519 out_fd:
1520 	fput(newfile);
1521 	put_unused_fd(newfd);
1522 	goto out_put;
1523 }
1524 
SYSCALL_DEFINE3(accept,int,fd,struct sockaddr __user *,upeer_sockaddr,int __user *,upeer_addrlen)1525 SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1526 		int __user *, upeer_addrlen)
1527 {
1528 	return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1529 }
1530 
1531 /*
1532  *	Attempt to connect to a socket with the server address.  The address
1533  *	is in user space so we verify it is OK and move it to kernel space.
1534  *
1535  *	For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1536  *	break bindings
1537  *
1538  *	NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1539  *	other SEQPACKET protocols that take time to connect() as it doesn't
1540  *	include the -EINPROGRESS status for such sockets.
1541  */
1542 
SYSCALL_DEFINE3(connect,int,fd,struct sockaddr __user *,uservaddr,int,addrlen)1543 SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1544 		int, addrlen)
1545 {
1546 	struct socket *sock;
1547 	struct sockaddr_storage address;
1548 	int err, fput_needed;
1549 
1550 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1551 	if (!sock)
1552 		goto out;
1553 	err = move_addr_to_kernel(uservaddr, addrlen, &address);
1554 	if (err < 0)
1555 		goto out_put;
1556 
1557 	err =
1558 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1559 	if (err)
1560 		goto out_put;
1561 
1562 	err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1563 				 sock->file->f_flags);
1564 out_put:
1565 	fput_light(sock->file, fput_needed);
1566 out:
1567 	return err;
1568 }
1569 
1570 /*
1571  *	Get the local address ('name') of a socket object. Move the obtained
1572  *	name to user space.
1573  */
1574 
SYSCALL_DEFINE3(getsockname,int,fd,struct sockaddr __user *,usockaddr,int __user *,usockaddr_len)1575 SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1576 		int __user *, usockaddr_len)
1577 {
1578 	struct socket *sock;
1579 	struct sockaddr_storage address;
1580 	int len, err, fput_needed;
1581 
1582 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1583 	if (!sock)
1584 		goto out;
1585 
1586 	err = security_socket_getsockname(sock);
1587 	if (err)
1588 		goto out_put;
1589 
1590 	err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1591 	if (err)
1592 		goto out_put;
1593 	err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1594 
1595 out_put:
1596 	fput_light(sock->file, fput_needed);
1597 out:
1598 	return err;
1599 }
1600 
1601 /*
1602  *	Get the remote address ('name') of a socket object. Move the obtained
1603  *	name to user space.
1604  */
1605 
SYSCALL_DEFINE3(getpeername,int,fd,struct sockaddr __user *,usockaddr,int __user *,usockaddr_len)1606 SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1607 		int __user *, usockaddr_len)
1608 {
1609 	struct socket *sock;
1610 	struct sockaddr_storage address;
1611 	int len, err, fput_needed;
1612 
1613 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1614 	if (sock != NULL) {
1615 		err = security_socket_getpeername(sock);
1616 		if (err) {
1617 			fput_light(sock->file, fput_needed);
1618 			return err;
1619 		}
1620 
1621 		err =
1622 		    sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1623 				       1);
1624 		if (!err)
1625 			err = move_addr_to_user(&address, len, usockaddr,
1626 						usockaddr_len);
1627 		fput_light(sock->file, fput_needed);
1628 	}
1629 	return err;
1630 }
1631 
1632 /*
1633  *	Send a datagram to a given address. We move the address into kernel
1634  *	space and check the user space data area is readable before invoking
1635  *	the protocol.
1636  */
1637 
SYSCALL_DEFINE6(sendto,int,fd,void __user *,buff,size_t,len,unsigned int,flags,struct sockaddr __user *,addr,int,addr_len)1638 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1639 		unsigned int, flags, struct sockaddr __user *, addr,
1640 		int, addr_len)
1641 {
1642 	struct socket *sock;
1643 	struct sockaddr_storage address;
1644 	int err;
1645 	struct msghdr msg;
1646 	struct iovec iov;
1647 	int fput_needed;
1648 
1649 	err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1650 	if (unlikely(err))
1651 		return err;
1652 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1653 	if (!sock)
1654 		goto out;
1655 
1656 	msg.msg_name = NULL;
1657 	msg.msg_control = NULL;
1658 	msg.msg_controllen = 0;
1659 	msg.msg_namelen = 0;
1660 	if (addr) {
1661 		err = move_addr_to_kernel(addr, addr_len, &address);
1662 		if (err < 0)
1663 			goto out_put;
1664 		msg.msg_name = (struct sockaddr *)&address;
1665 		msg.msg_namelen = addr_len;
1666 	}
1667 	if (sock->file->f_flags & O_NONBLOCK)
1668 		flags |= MSG_DONTWAIT;
1669 	msg.msg_flags = flags;
1670 	err = sock_sendmsg(sock, &msg);
1671 
1672 out_put:
1673 	fput_light(sock->file, fput_needed);
1674 out:
1675 	return err;
1676 }
1677 
1678 /*
1679  *	Send a datagram down a socket.
1680  */
1681 
SYSCALL_DEFINE4(send,int,fd,void __user *,buff,size_t,len,unsigned int,flags)1682 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1683 		unsigned int, flags)
1684 {
1685 	return sys_sendto(fd, buff, len, flags, NULL, 0);
1686 }
1687 
1688 /*
1689  *	Receive a frame from the socket and optionally record the address of the
1690  *	sender. We verify the buffers are writable and if needed move the
1691  *	sender address from kernel to user space.
1692  */
1693 
SYSCALL_DEFINE6(recvfrom,int,fd,void __user *,ubuf,size_t,size,unsigned int,flags,struct sockaddr __user *,addr,int __user *,addr_len)1694 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1695 		unsigned int, flags, struct sockaddr __user *, addr,
1696 		int __user *, addr_len)
1697 {
1698 	struct socket *sock;
1699 	struct iovec iov;
1700 	struct msghdr msg;
1701 	struct sockaddr_storage address;
1702 	int err, err2;
1703 	int fput_needed;
1704 
1705 	err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1706 	if (unlikely(err))
1707 		return err;
1708 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1709 	if (!sock)
1710 		goto out;
1711 
1712 	msg.msg_control = NULL;
1713 	msg.msg_controllen = 0;
1714 	/* Save some cycles and don't copy the address if not needed */
1715 	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1716 	/* We assume all kernel code knows the size of sockaddr_storage */
1717 	msg.msg_namelen = 0;
1718 	msg.msg_iocb = NULL;
1719 	msg.msg_flags = 0;
1720 	if (sock->file->f_flags & O_NONBLOCK)
1721 		flags |= MSG_DONTWAIT;
1722 	err = sock_recvmsg(sock, &msg, flags);
1723 
1724 	if (err >= 0 && addr != NULL) {
1725 		err2 = move_addr_to_user(&address,
1726 					 msg.msg_namelen, addr, addr_len);
1727 		if (err2 < 0)
1728 			err = err2;
1729 	}
1730 
1731 	fput_light(sock->file, fput_needed);
1732 out:
1733 	return err;
1734 }
1735 
1736 /*
1737  *	Receive a datagram from a socket.
1738  */
1739 
SYSCALL_DEFINE4(recv,int,fd,void __user *,ubuf,size_t,size,unsigned int,flags)1740 SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1741 		unsigned int, flags)
1742 {
1743 	return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1744 }
1745 
1746 /*
1747  *	Set a socket option. Because we don't know the option lengths we have
1748  *	to pass the user mode parameter for the protocols to sort out.
1749  */
1750 
SYSCALL_DEFINE5(setsockopt,int,fd,int,level,int,optname,char __user *,optval,int,optlen)1751 SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1752 		char __user *, optval, int, optlen)
1753 {
1754 	int err, fput_needed;
1755 	struct socket *sock;
1756 
1757 	if (optlen < 0)
1758 		return -EINVAL;
1759 
1760 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1761 	if (sock != NULL) {
1762 		err = security_socket_setsockopt(sock, level, optname);
1763 		if (err)
1764 			goto out_put;
1765 
1766 		if (level == SOL_SOCKET)
1767 			err =
1768 			    sock_setsockopt(sock, level, optname, optval,
1769 					    optlen);
1770 		else
1771 			err =
1772 			    sock->ops->setsockopt(sock, level, optname, optval,
1773 						  optlen);
1774 out_put:
1775 		fput_light(sock->file, fput_needed);
1776 	}
1777 	return err;
1778 }
1779 
1780 /*
1781  *	Get a socket option. Because we don't know the option lengths we have
1782  *	to pass a user mode parameter for the protocols to sort out.
1783  */
1784 
SYSCALL_DEFINE5(getsockopt,int,fd,int,level,int,optname,char __user *,optval,int __user *,optlen)1785 SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1786 		char __user *, optval, int __user *, optlen)
1787 {
1788 	int err, fput_needed;
1789 	struct socket *sock;
1790 
1791 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1792 	if (sock != NULL) {
1793 		err = security_socket_getsockopt(sock, level, optname);
1794 		if (err)
1795 			goto out_put;
1796 
1797 		if (level == SOL_SOCKET)
1798 			err =
1799 			    sock_getsockopt(sock, level, optname, optval,
1800 					    optlen);
1801 		else
1802 			err =
1803 			    sock->ops->getsockopt(sock, level, optname, optval,
1804 						  optlen);
1805 out_put:
1806 		fput_light(sock->file, fput_needed);
1807 	}
1808 	return err;
1809 }
1810 
1811 /*
1812  *	Shutdown a socket.
1813  */
1814 
SYSCALL_DEFINE2(shutdown,int,fd,int,how)1815 SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1816 {
1817 	int err, fput_needed;
1818 	struct socket *sock;
1819 
1820 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1821 	if (sock != NULL) {
1822 		err = security_socket_shutdown(sock, how);
1823 		if (!err)
1824 			err = sock->ops->shutdown(sock, how);
1825 		fput_light(sock->file, fput_needed);
1826 	}
1827 	return err;
1828 }
1829 
1830 /* A couple of helpful macros for getting the address of the 32/64 bit
1831  * fields which are the same type (int / unsigned) on our platforms.
1832  */
1833 #define COMPAT_MSG(msg, member)	((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1834 #define COMPAT_NAMELEN(msg)	COMPAT_MSG(msg, msg_namelen)
1835 #define COMPAT_FLAGS(msg)	COMPAT_MSG(msg, msg_flags)
1836 
1837 struct used_address {
1838 	struct sockaddr_storage name;
1839 	unsigned int name_len;
1840 };
1841 
copy_msghdr_from_user(struct msghdr * kmsg,struct user_msghdr __user * umsg,struct sockaddr __user ** save_addr,struct iovec ** iov)1842 static int copy_msghdr_from_user(struct msghdr *kmsg,
1843 				 struct user_msghdr __user *umsg,
1844 				 struct sockaddr __user **save_addr,
1845 				 struct iovec **iov)
1846 {
1847 	struct sockaddr __user *uaddr;
1848 	struct iovec __user *uiov;
1849 	size_t nr_segs;
1850 	ssize_t err;
1851 
1852 	if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1853 	    __get_user(uaddr, &umsg->msg_name) ||
1854 	    __get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1855 	    __get_user(uiov, &umsg->msg_iov) ||
1856 	    __get_user(nr_segs, &umsg->msg_iovlen) ||
1857 	    __get_user(kmsg->msg_control, &umsg->msg_control) ||
1858 	    __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1859 	    __get_user(kmsg->msg_flags, &umsg->msg_flags))
1860 		return -EFAULT;
1861 
1862 	if (!uaddr)
1863 		kmsg->msg_namelen = 0;
1864 
1865 	if (kmsg->msg_namelen < 0)
1866 		return -EINVAL;
1867 
1868 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
1869 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
1870 
1871 	if (save_addr)
1872 		*save_addr = uaddr;
1873 
1874 	if (uaddr && kmsg->msg_namelen) {
1875 		if (!save_addr) {
1876 			err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1877 						  kmsg->msg_name);
1878 			if (err < 0)
1879 				return err;
1880 		}
1881 	} else {
1882 		kmsg->msg_name = NULL;
1883 		kmsg->msg_namelen = 0;
1884 	}
1885 
1886 	if (nr_segs > UIO_MAXIOV)
1887 		return -EMSGSIZE;
1888 
1889 	kmsg->msg_iocb = NULL;
1890 
1891 	return import_iovec(save_addr ? READ : WRITE, uiov, nr_segs,
1892 			    UIO_FASTIOV, iov, &kmsg->msg_iter);
1893 }
1894 
___sys_sendmsg(struct socket * sock,struct user_msghdr __user * msg,struct msghdr * msg_sys,unsigned int flags,struct used_address * used_address,unsigned int allowed_msghdr_flags)1895 static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
1896 			 struct msghdr *msg_sys, unsigned int flags,
1897 			 struct used_address *used_address,
1898 			 unsigned int allowed_msghdr_flags)
1899 {
1900 	struct compat_msghdr __user *msg_compat =
1901 	    (struct compat_msghdr __user *)msg;
1902 	struct sockaddr_storage address;
1903 	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1904 	unsigned char ctl[sizeof(struct cmsghdr) + 20]
1905 	    __attribute__ ((aligned(sizeof(__kernel_size_t))));
1906 	/* 20 is size of ipv6_pktinfo */
1907 	unsigned char *ctl_buf = ctl;
1908 	int ctl_len;
1909 	ssize_t err;
1910 
1911 	msg_sys->msg_name = &address;
1912 
1913 	if (MSG_CMSG_COMPAT & flags)
1914 		err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
1915 	else
1916 		err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
1917 	if (err < 0)
1918 		return err;
1919 
1920 	err = -ENOBUFS;
1921 
1922 	if (msg_sys->msg_controllen > INT_MAX)
1923 		goto out_freeiov;
1924 	flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
1925 	ctl_len = msg_sys->msg_controllen;
1926 	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
1927 		err =
1928 		    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
1929 						     sizeof(ctl));
1930 		if (err)
1931 			goto out_freeiov;
1932 		ctl_buf = msg_sys->msg_control;
1933 		ctl_len = msg_sys->msg_controllen;
1934 	} else if (ctl_len) {
1935 		if (ctl_len > sizeof(ctl)) {
1936 			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
1937 			if (ctl_buf == NULL)
1938 				goto out_freeiov;
1939 		}
1940 		err = -EFAULT;
1941 		/*
1942 		 * Careful! Before this, msg_sys->msg_control contains a user pointer.
1943 		 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1944 		 * checking falls down on this.
1945 		 */
1946 		if (copy_from_user(ctl_buf,
1947 				   (void __user __force *)msg_sys->msg_control,
1948 				   ctl_len))
1949 			goto out_freectl;
1950 		msg_sys->msg_control = ctl_buf;
1951 	}
1952 	msg_sys->msg_flags = flags;
1953 
1954 	if (sock->file->f_flags & O_NONBLOCK)
1955 		msg_sys->msg_flags |= MSG_DONTWAIT;
1956 	/*
1957 	 * If this is sendmmsg() and current destination address is same as
1958 	 * previously succeeded address, omit asking LSM's decision.
1959 	 * used_address->name_len is initialized to UINT_MAX so that the first
1960 	 * destination address never matches.
1961 	 */
1962 	if (used_address && msg_sys->msg_name &&
1963 	    used_address->name_len == msg_sys->msg_namelen &&
1964 	    !memcmp(&used_address->name, msg_sys->msg_name,
1965 		    used_address->name_len)) {
1966 		err = sock_sendmsg_nosec(sock, msg_sys);
1967 		goto out_freectl;
1968 	}
1969 	err = sock_sendmsg(sock, msg_sys);
1970 	/*
1971 	 * If this is sendmmsg() and sending to current destination address was
1972 	 * successful, remember it.
1973 	 */
1974 	if (used_address && err >= 0) {
1975 		used_address->name_len = msg_sys->msg_namelen;
1976 		if (msg_sys->msg_name)
1977 			memcpy(&used_address->name, msg_sys->msg_name,
1978 			       used_address->name_len);
1979 	}
1980 
1981 out_freectl:
1982 	if (ctl_buf != ctl)
1983 		sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1984 out_freeiov:
1985 	kfree(iov);
1986 	return err;
1987 }
1988 
1989 /*
1990  *	BSD sendmsg interface
1991  */
1992 
__sys_sendmsg(int fd,struct user_msghdr __user * msg,unsigned flags)1993 long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
1994 {
1995 	int fput_needed, err;
1996 	struct msghdr msg_sys;
1997 	struct socket *sock;
1998 
1999 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2000 	if (!sock)
2001 		goto out;
2002 
2003 	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
2004 
2005 	fput_light(sock->file, fput_needed);
2006 out:
2007 	return err;
2008 }
2009 
SYSCALL_DEFINE3(sendmsg,int,fd,struct user_msghdr __user *,msg,unsigned int,flags)2010 SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2011 {
2012 	if (flags & MSG_CMSG_COMPAT)
2013 		return -EINVAL;
2014 	return __sys_sendmsg(fd, msg, flags);
2015 }
2016 
2017 /*
2018  *	Linux sendmmsg interface
2019  */
2020 
__sys_sendmmsg(int fd,struct mmsghdr __user * mmsg,unsigned int vlen,unsigned int flags)2021 int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2022 		   unsigned int flags)
2023 {
2024 	int fput_needed, err, datagrams;
2025 	struct socket *sock;
2026 	struct mmsghdr __user *entry;
2027 	struct compat_mmsghdr __user *compat_entry;
2028 	struct msghdr msg_sys;
2029 	struct used_address used_address;
2030 	unsigned int oflags = flags;
2031 
2032 	if (vlen > UIO_MAXIOV)
2033 		vlen = UIO_MAXIOV;
2034 
2035 	datagrams = 0;
2036 
2037 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2038 	if (!sock)
2039 		return err;
2040 
2041 	used_address.name_len = UINT_MAX;
2042 	entry = mmsg;
2043 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2044 	err = 0;
2045 	flags |= MSG_BATCH;
2046 
2047 	while (datagrams < vlen) {
2048 		if (datagrams == vlen - 1)
2049 			flags = oflags;
2050 
2051 		if (MSG_CMSG_COMPAT & flags) {
2052 			err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2053 					     &msg_sys, flags, &used_address, MSG_EOR);
2054 			if (err < 0)
2055 				break;
2056 			err = __put_user(err, &compat_entry->msg_len);
2057 			++compat_entry;
2058 		} else {
2059 			err = ___sys_sendmsg(sock,
2060 					     (struct user_msghdr __user *)entry,
2061 					     &msg_sys, flags, &used_address, MSG_EOR);
2062 			if (err < 0)
2063 				break;
2064 			err = put_user(err, &entry->msg_len);
2065 			++entry;
2066 		}
2067 
2068 		if (err)
2069 			break;
2070 		++datagrams;
2071 		if (msg_data_left(&msg_sys))
2072 			break;
2073 		cond_resched();
2074 	}
2075 
2076 	fput_light(sock->file, fput_needed);
2077 
2078 	/* We only return an error if no datagrams were able to be sent */
2079 	if (datagrams != 0)
2080 		return datagrams;
2081 
2082 	return err;
2083 }
2084 
SYSCALL_DEFINE4(sendmmsg,int,fd,struct mmsghdr __user *,mmsg,unsigned int,vlen,unsigned int,flags)2085 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2086 		unsigned int, vlen, unsigned int, flags)
2087 {
2088 	if (flags & MSG_CMSG_COMPAT)
2089 		return -EINVAL;
2090 	return __sys_sendmmsg(fd, mmsg, vlen, flags);
2091 }
2092 
___sys_recvmsg(struct socket * sock,struct user_msghdr __user * msg,struct msghdr * msg_sys,unsigned int flags,int nosec)2093 static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
2094 			 struct msghdr *msg_sys, unsigned int flags, int nosec)
2095 {
2096 	struct compat_msghdr __user *msg_compat =
2097 	    (struct compat_msghdr __user *)msg;
2098 	struct iovec iovstack[UIO_FASTIOV];
2099 	struct iovec *iov = iovstack;
2100 	unsigned long cmsg_ptr;
2101 	int len;
2102 	ssize_t err;
2103 
2104 	/* kernel mode address */
2105 	struct sockaddr_storage addr;
2106 
2107 	/* user mode address pointers */
2108 	struct sockaddr __user *uaddr;
2109 	int __user *uaddr_len = COMPAT_NAMELEN(msg);
2110 
2111 	msg_sys->msg_name = &addr;
2112 
2113 	if (MSG_CMSG_COMPAT & flags)
2114 		err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
2115 	else
2116 		err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
2117 	if (err < 0)
2118 		return err;
2119 
2120 	cmsg_ptr = (unsigned long)msg_sys->msg_control;
2121 	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2122 
2123 	/* We assume all kernel code knows the size of sockaddr_storage */
2124 	msg_sys->msg_namelen = 0;
2125 
2126 	if (sock->file->f_flags & O_NONBLOCK)
2127 		flags |= MSG_DONTWAIT;
2128 	err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys, flags);
2129 	if (err < 0)
2130 		goto out_freeiov;
2131 	len = err;
2132 
2133 	if (uaddr != NULL) {
2134 		err = move_addr_to_user(&addr,
2135 					msg_sys->msg_namelen, uaddr,
2136 					uaddr_len);
2137 		if (err < 0)
2138 			goto out_freeiov;
2139 	}
2140 	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2141 			 COMPAT_FLAGS(msg));
2142 	if (err)
2143 		goto out_freeiov;
2144 	if (MSG_CMSG_COMPAT & flags)
2145 		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2146 				 &msg_compat->msg_controllen);
2147 	else
2148 		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2149 				 &msg->msg_controllen);
2150 	if (err)
2151 		goto out_freeiov;
2152 	err = len;
2153 
2154 out_freeiov:
2155 	kfree(iov);
2156 	return err;
2157 }
2158 
2159 /*
2160  *	BSD recvmsg interface
2161  */
2162 
__sys_recvmsg(int fd,struct user_msghdr __user * msg,unsigned flags)2163 long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2164 {
2165 	int fput_needed, err;
2166 	struct msghdr msg_sys;
2167 	struct socket *sock;
2168 
2169 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2170 	if (!sock)
2171 		goto out;
2172 
2173 	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2174 
2175 	fput_light(sock->file, fput_needed);
2176 out:
2177 	return err;
2178 }
2179 
SYSCALL_DEFINE3(recvmsg,int,fd,struct user_msghdr __user *,msg,unsigned int,flags)2180 SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2181 		unsigned int, flags)
2182 {
2183 	if (flags & MSG_CMSG_COMPAT)
2184 		return -EINVAL;
2185 	return __sys_recvmsg(fd, msg, flags);
2186 }
2187 
2188 /*
2189  *     Linux recvmmsg interface
2190  */
2191 
__sys_recvmmsg(int fd,struct mmsghdr __user * mmsg,unsigned int vlen,unsigned int flags,struct timespec * timeout)2192 int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2193 		   unsigned int flags, struct timespec *timeout)
2194 {
2195 	int fput_needed, err, datagrams;
2196 	struct socket *sock;
2197 	struct mmsghdr __user *entry;
2198 	struct compat_mmsghdr __user *compat_entry;
2199 	struct msghdr msg_sys;
2200 	struct timespec64 end_time;
2201 	struct timespec64 timeout64;
2202 
2203 	if (timeout &&
2204 	    poll_select_set_timeout(&end_time, timeout->tv_sec,
2205 				    timeout->tv_nsec))
2206 		return -EINVAL;
2207 
2208 	datagrams = 0;
2209 
2210 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2211 	if (!sock)
2212 		return err;
2213 
2214 	err = sock_error(sock->sk);
2215 	if (err) {
2216 		datagrams = err;
2217 		goto out_put;
2218 	}
2219 
2220 	entry = mmsg;
2221 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2222 
2223 	while (datagrams < vlen) {
2224 		/*
2225 		 * No need to ask LSM for more than the first datagram.
2226 		 */
2227 		if (MSG_CMSG_COMPAT & flags) {
2228 			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2229 					     &msg_sys, flags & ~MSG_WAITFORONE,
2230 					     datagrams);
2231 			if (err < 0)
2232 				break;
2233 			err = __put_user(err, &compat_entry->msg_len);
2234 			++compat_entry;
2235 		} else {
2236 			err = ___sys_recvmsg(sock,
2237 					     (struct user_msghdr __user *)entry,
2238 					     &msg_sys, flags & ~MSG_WAITFORONE,
2239 					     datagrams);
2240 			if (err < 0)
2241 				break;
2242 			err = put_user(err, &entry->msg_len);
2243 			++entry;
2244 		}
2245 
2246 		if (err)
2247 			break;
2248 		++datagrams;
2249 
2250 		/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2251 		if (flags & MSG_WAITFORONE)
2252 			flags |= MSG_DONTWAIT;
2253 
2254 		if (timeout) {
2255 			ktime_get_ts64(&timeout64);
2256 			*timeout = timespec64_to_timespec(
2257 					timespec64_sub(end_time, timeout64));
2258 			if (timeout->tv_sec < 0) {
2259 				timeout->tv_sec = timeout->tv_nsec = 0;
2260 				break;
2261 			}
2262 
2263 			/* Timeout, return less than vlen datagrams */
2264 			if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2265 				break;
2266 		}
2267 
2268 		/* Out of band data, return right away */
2269 		if (msg_sys.msg_flags & MSG_OOB)
2270 			break;
2271 		cond_resched();
2272 	}
2273 
2274 	if (err == 0)
2275 		goto out_put;
2276 
2277 	if (datagrams == 0) {
2278 		datagrams = err;
2279 		goto out_put;
2280 	}
2281 
2282 	/*
2283 	 * We may return less entries than requested (vlen) if the
2284 	 * sock is non block and there aren't enough datagrams...
2285 	 */
2286 	if (err != -EAGAIN) {
2287 		/*
2288 		 * ... or  if recvmsg returns an error after we
2289 		 * received some datagrams, where we record the
2290 		 * error to return on the next call or if the
2291 		 * app asks about it using getsockopt(SO_ERROR).
2292 		 */
2293 		sock->sk->sk_err = -err;
2294 	}
2295 out_put:
2296 	fput_light(sock->file, fput_needed);
2297 
2298 	return datagrams;
2299 }
2300 
SYSCALL_DEFINE5(recvmmsg,int,fd,struct mmsghdr __user *,mmsg,unsigned int,vlen,unsigned int,flags,struct timespec __user *,timeout)2301 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2302 		unsigned int, vlen, unsigned int, flags,
2303 		struct timespec __user *, timeout)
2304 {
2305 	int datagrams;
2306 	struct timespec timeout_sys;
2307 
2308 	if (flags & MSG_CMSG_COMPAT)
2309 		return -EINVAL;
2310 
2311 	if (!timeout)
2312 		return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2313 
2314 	if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2315 		return -EFAULT;
2316 
2317 	datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2318 
2319 	if (datagrams > 0 &&
2320 	    copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2321 		datagrams = -EFAULT;
2322 
2323 	return datagrams;
2324 }
2325 
2326 #ifdef __ARCH_WANT_SYS_SOCKETCALL
2327 /* Argument list sizes for sys_socketcall */
2328 #define AL(x) ((x) * sizeof(unsigned long))
2329 static const unsigned char nargs[21] = {
2330 	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2331 	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2332 	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2333 	AL(4), AL(5), AL(4)
2334 };
2335 
2336 #undef AL
2337 
2338 /*
2339  *	System call vectors.
2340  *
2341  *	Argument checking cleaned up. Saved 20% in size.
2342  *  This function doesn't need to set the kernel lock because
2343  *  it is set by the callees.
2344  */
2345 
SYSCALL_DEFINE2(socketcall,int,call,unsigned long __user *,args)2346 SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2347 {
2348 	unsigned long a[AUDITSC_ARGS];
2349 	unsigned long a0, a1;
2350 	int err;
2351 	unsigned int len;
2352 
2353 	if (call < 1 || call > SYS_SENDMMSG)
2354 		return -EINVAL;
2355 
2356 	len = nargs[call];
2357 	if (len > sizeof(a))
2358 		return -EINVAL;
2359 
2360 	/* copy_from_user should be SMP safe. */
2361 	if (copy_from_user(a, args, len))
2362 		return -EFAULT;
2363 
2364 	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2365 	if (err)
2366 		return err;
2367 
2368 	a0 = a[0];
2369 	a1 = a[1];
2370 
2371 	switch (call) {
2372 	case SYS_SOCKET:
2373 		err = sys_socket(a0, a1, a[2]);
2374 		break;
2375 	case SYS_BIND:
2376 		err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2377 		break;
2378 	case SYS_CONNECT:
2379 		err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2380 		break;
2381 	case SYS_LISTEN:
2382 		err = sys_listen(a0, a1);
2383 		break;
2384 	case SYS_ACCEPT:
2385 		err = sys_accept4(a0, (struct sockaddr __user *)a1,
2386 				  (int __user *)a[2], 0);
2387 		break;
2388 	case SYS_GETSOCKNAME:
2389 		err =
2390 		    sys_getsockname(a0, (struct sockaddr __user *)a1,
2391 				    (int __user *)a[2]);
2392 		break;
2393 	case SYS_GETPEERNAME:
2394 		err =
2395 		    sys_getpeername(a0, (struct sockaddr __user *)a1,
2396 				    (int __user *)a[2]);
2397 		break;
2398 	case SYS_SOCKETPAIR:
2399 		err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2400 		break;
2401 	case SYS_SEND:
2402 		err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2403 		break;
2404 	case SYS_SENDTO:
2405 		err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2406 				 (struct sockaddr __user *)a[4], a[5]);
2407 		break;
2408 	case SYS_RECV:
2409 		err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2410 		break;
2411 	case SYS_RECVFROM:
2412 		err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2413 				   (struct sockaddr __user *)a[4],
2414 				   (int __user *)a[5]);
2415 		break;
2416 	case SYS_SHUTDOWN:
2417 		err = sys_shutdown(a0, a1);
2418 		break;
2419 	case SYS_SETSOCKOPT:
2420 		err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2421 		break;
2422 	case SYS_GETSOCKOPT:
2423 		err =
2424 		    sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2425 				   (int __user *)a[4]);
2426 		break;
2427 	case SYS_SENDMSG:
2428 		err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2429 		break;
2430 	case SYS_SENDMMSG:
2431 		err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2432 		break;
2433 	case SYS_RECVMSG:
2434 		err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2435 		break;
2436 	case SYS_RECVMMSG:
2437 		err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2438 				   (struct timespec __user *)a[4]);
2439 		break;
2440 	case SYS_ACCEPT4:
2441 		err = sys_accept4(a0, (struct sockaddr __user *)a1,
2442 				  (int __user *)a[2], a[3]);
2443 		break;
2444 	default:
2445 		err = -EINVAL;
2446 		break;
2447 	}
2448 	return err;
2449 }
2450 
2451 #endif				/* __ARCH_WANT_SYS_SOCKETCALL */
2452 
2453 /**
2454  *	sock_register - add a socket protocol handler
2455  *	@ops: description of protocol
2456  *
2457  *	This function is called by a protocol handler that wants to
2458  *	advertise its address family, and have it linked into the
2459  *	socket interface. The value ops->family corresponds to the
2460  *	socket system call protocol family.
2461  */
sock_register(const struct net_proto_family * ops)2462 int sock_register(const struct net_proto_family *ops)
2463 {
2464 	int err;
2465 
2466 	if (ops->family >= NPROTO) {
2467 		pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
2468 		return -ENOBUFS;
2469 	}
2470 
2471 	spin_lock(&net_family_lock);
2472 	if (rcu_dereference_protected(net_families[ops->family],
2473 				      lockdep_is_held(&net_family_lock)))
2474 		err = -EEXIST;
2475 	else {
2476 		rcu_assign_pointer(net_families[ops->family], ops);
2477 		err = 0;
2478 	}
2479 	spin_unlock(&net_family_lock);
2480 
2481 	pr_info("NET: Registered protocol family %d\n", ops->family);
2482 	return err;
2483 }
2484 EXPORT_SYMBOL(sock_register);
2485 
2486 /**
2487  *	sock_unregister - remove a protocol handler
2488  *	@family: protocol family to remove
2489  *
2490  *	This function is called by a protocol handler that wants to
2491  *	remove its address family, and have it unlinked from the
2492  *	new socket creation.
2493  *
2494  *	If protocol handler is a module, then it can use module reference
2495  *	counts to protect against new references. If protocol handler is not
2496  *	a module then it needs to provide its own protection in
2497  *	the ops->create routine.
2498  */
sock_unregister(int family)2499 void sock_unregister(int family)
2500 {
2501 	BUG_ON(family < 0 || family >= NPROTO);
2502 
2503 	spin_lock(&net_family_lock);
2504 	RCU_INIT_POINTER(net_families[family], NULL);
2505 	spin_unlock(&net_family_lock);
2506 
2507 	synchronize_rcu();
2508 
2509 	pr_info("NET: Unregistered protocol family %d\n", family);
2510 }
2511 EXPORT_SYMBOL(sock_unregister);
2512 
sock_init(void)2513 static int __init sock_init(void)
2514 {
2515 	int err;
2516 	/*
2517 	 *      Initialize the network sysctl infrastructure.
2518 	 */
2519 	err = net_sysctl_init();
2520 	if (err)
2521 		goto out;
2522 
2523 	/*
2524 	 *      Initialize skbuff SLAB cache
2525 	 */
2526 	skb_init();
2527 
2528 	/*
2529 	 *      Initialize the protocols module.
2530 	 */
2531 
2532 	init_inodecache();
2533 
2534 	err = register_filesystem(&sock_fs_type);
2535 	if (err)
2536 		goto out_fs;
2537 	sock_mnt = kern_mount(&sock_fs_type);
2538 	if (IS_ERR(sock_mnt)) {
2539 		err = PTR_ERR(sock_mnt);
2540 		goto out_mount;
2541 	}
2542 
2543 	/* The real protocol initialization is performed in later initcalls.
2544 	 */
2545 
2546 #ifdef CONFIG_NETFILTER
2547 	err = netfilter_init();
2548 	if (err)
2549 		goto out;
2550 #endif
2551 
2552 	ptp_classifier_init();
2553 
2554 out:
2555 	return err;
2556 
2557 out_mount:
2558 	unregister_filesystem(&sock_fs_type);
2559 out_fs:
2560 	goto out;
2561 }
2562 
2563 core_initcall(sock_init);	/* early initcall */
2564 
jit_init(void)2565 static int __init jit_init(void)
2566 {
2567 #ifdef CONFIG_BPF_JIT_ALWAYS_ON
2568 	bpf_jit_enable = 1;
2569 #endif
2570 	return 0;
2571 }
2572 pure_initcall(jit_init);
2573 
2574 #ifdef CONFIG_PROC_FS
socket_seq_show(struct seq_file * seq)2575 void socket_seq_show(struct seq_file *seq)
2576 {
2577 	int cpu;
2578 	int counter = 0;
2579 
2580 	for_each_possible_cpu(cpu)
2581 	    counter += per_cpu(sockets_in_use, cpu);
2582 
2583 	/* It can be negative, by the way. 8) */
2584 	if (counter < 0)
2585 		counter = 0;
2586 
2587 	seq_printf(seq, "sockets: used %d\n", counter);
2588 }
2589 #endif				/* CONFIG_PROC_FS */
2590 
2591 #ifdef CONFIG_COMPAT
do_siocgstamp(struct net * net,struct socket * sock,unsigned int cmd,void __user * up)2592 static int do_siocgstamp(struct net *net, struct socket *sock,
2593 			 unsigned int cmd, void __user *up)
2594 {
2595 	mm_segment_t old_fs = get_fs();
2596 	struct timeval ktv;
2597 	int err;
2598 
2599 	set_fs(KERNEL_DS);
2600 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2601 	set_fs(old_fs);
2602 	if (!err)
2603 		err = compat_put_timeval(&ktv, up);
2604 
2605 	return err;
2606 }
2607 
do_siocgstampns(struct net * net,struct socket * sock,unsigned int cmd,void __user * up)2608 static int do_siocgstampns(struct net *net, struct socket *sock,
2609 			   unsigned int cmd, void __user *up)
2610 {
2611 	mm_segment_t old_fs = get_fs();
2612 	struct timespec kts;
2613 	int err;
2614 
2615 	set_fs(KERNEL_DS);
2616 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2617 	set_fs(old_fs);
2618 	if (!err)
2619 		err = compat_put_timespec(&kts, up);
2620 
2621 	return err;
2622 }
2623 
dev_ifname32(struct net * net,struct compat_ifreq __user * uifr32)2624 static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2625 {
2626 	struct ifreq __user *uifr;
2627 	int err;
2628 
2629 	uifr = compat_alloc_user_space(sizeof(struct ifreq));
2630 	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2631 		return -EFAULT;
2632 
2633 	err = dev_ioctl(net, SIOCGIFNAME, uifr);
2634 	if (err)
2635 		return err;
2636 
2637 	if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2638 		return -EFAULT;
2639 
2640 	return 0;
2641 }
2642 
dev_ifconf(struct net * net,struct compat_ifconf __user * uifc32)2643 static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2644 {
2645 	struct compat_ifconf ifc32;
2646 	struct ifconf ifc;
2647 	struct ifconf __user *uifc;
2648 	struct compat_ifreq __user *ifr32;
2649 	struct ifreq __user *ifr;
2650 	unsigned int i, j;
2651 	int err;
2652 
2653 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2654 		return -EFAULT;
2655 
2656 	memset(&ifc, 0, sizeof(ifc));
2657 	if (ifc32.ifcbuf == 0) {
2658 		ifc32.ifc_len = 0;
2659 		ifc.ifc_len = 0;
2660 		ifc.ifc_req = NULL;
2661 		uifc = compat_alloc_user_space(sizeof(struct ifconf));
2662 	} else {
2663 		size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2664 			sizeof(struct ifreq);
2665 		uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2666 		ifc.ifc_len = len;
2667 		ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2668 		ifr32 = compat_ptr(ifc32.ifcbuf);
2669 		for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2670 			if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2671 				return -EFAULT;
2672 			ifr++;
2673 			ifr32++;
2674 		}
2675 	}
2676 	if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2677 		return -EFAULT;
2678 
2679 	err = dev_ioctl(net, SIOCGIFCONF, uifc);
2680 	if (err)
2681 		return err;
2682 
2683 	if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2684 		return -EFAULT;
2685 
2686 	ifr = ifc.ifc_req;
2687 	ifr32 = compat_ptr(ifc32.ifcbuf);
2688 	for (i = 0, j = 0;
2689 	     i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2690 	     i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2691 		if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2692 			return -EFAULT;
2693 		ifr32++;
2694 		ifr++;
2695 	}
2696 
2697 	if (ifc32.ifcbuf == 0) {
2698 		/* Translate from 64-bit structure multiple to
2699 		 * a 32-bit one.
2700 		 */
2701 		i = ifc.ifc_len;
2702 		i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2703 		ifc32.ifc_len = i;
2704 	} else {
2705 		ifc32.ifc_len = i;
2706 	}
2707 	if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2708 		return -EFAULT;
2709 
2710 	return 0;
2711 }
2712 
ethtool_ioctl(struct net * net,struct compat_ifreq __user * ifr32)2713 static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2714 {
2715 	struct compat_ethtool_rxnfc __user *compat_rxnfc;
2716 	bool convert_in = false, convert_out = false;
2717 	size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2718 	struct ethtool_rxnfc __user *rxnfc;
2719 	struct ifreq __user *ifr;
2720 	u32 rule_cnt = 0, actual_rule_cnt;
2721 	u32 ethcmd;
2722 	u32 data;
2723 	int ret;
2724 
2725 	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2726 		return -EFAULT;
2727 
2728 	compat_rxnfc = compat_ptr(data);
2729 
2730 	if (get_user(ethcmd, &compat_rxnfc->cmd))
2731 		return -EFAULT;
2732 
2733 	/* Most ethtool structures are defined without padding.
2734 	 * Unfortunately struct ethtool_rxnfc is an exception.
2735 	 */
2736 	switch (ethcmd) {
2737 	default:
2738 		break;
2739 	case ETHTOOL_GRXCLSRLALL:
2740 		/* Buffer size is variable */
2741 		if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2742 			return -EFAULT;
2743 		if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2744 			return -ENOMEM;
2745 		buf_size += rule_cnt * sizeof(u32);
2746 		/* fall through */
2747 	case ETHTOOL_GRXRINGS:
2748 	case ETHTOOL_GRXCLSRLCNT:
2749 	case ETHTOOL_GRXCLSRULE:
2750 	case ETHTOOL_SRXCLSRLINS:
2751 		convert_out = true;
2752 		/* fall through */
2753 	case ETHTOOL_SRXCLSRLDEL:
2754 		buf_size += sizeof(struct ethtool_rxnfc);
2755 		convert_in = true;
2756 		break;
2757 	}
2758 
2759 	ifr = compat_alloc_user_space(buf_size);
2760 	rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
2761 
2762 	if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2763 		return -EFAULT;
2764 
2765 	if (put_user(convert_in ? rxnfc : compat_ptr(data),
2766 		     &ifr->ifr_ifru.ifru_data))
2767 		return -EFAULT;
2768 
2769 	if (convert_in) {
2770 		/* We expect there to be holes between fs.m_ext and
2771 		 * fs.ring_cookie and at the end of fs, but nowhere else.
2772 		 */
2773 		BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2774 			     sizeof(compat_rxnfc->fs.m_ext) !=
2775 			     offsetof(struct ethtool_rxnfc, fs.m_ext) +
2776 			     sizeof(rxnfc->fs.m_ext));
2777 		BUILD_BUG_ON(
2778 			offsetof(struct compat_ethtool_rxnfc, fs.location) -
2779 			offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2780 			offsetof(struct ethtool_rxnfc, fs.location) -
2781 			offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2782 
2783 		if (copy_in_user(rxnfc, compat_rxnfc,
2784 				 (void __user *)(&rxnfc->fs.m_ext + 1) -
2785 				 (void __user *)rxnfc) ||
2786 		    copy_in_user(&rxnfc->fs.ring_cookie,
2787 				 &compat_rxnfc->fs.ring_cookie,
2788 				 (void __user *)(&rxnfc->fs.location + 1) -
2789 				 (void __user *)&rxnfc->fs.ring_cookie) ||
2790 		    copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2791 				 sizeof(rxnfc->rule_cnt)))
2792 			return -EFAULT;
2793 	}
2794 
2795 	ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2796 	if (ret)
2797 		return ret;
2798 
2799 	if (convert_out) {
2800 		if (copy_in_user(compat_rxnfc, rxnfc,
2801 				 (const void __user *)(&rxnfc->fs.m_ext + 1) -
2802 				 (const void __user *)rxnfc) ||
2803 		    copy_in_user(&compat_rxnfc->fs.ring_cookie,
2804 				 &rxnfc->fs.ring_cookie,
2805 				 (const void __user *)(&rxnfc->fs.location + 1) -
2806 				 (const void __user *)&rxnfc->fs.ring_cookie) ||
2807 		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2808 				 sizeof(rxnfc->rule_cnt)))
2809 			return -EFAULT;
2810 
2811 		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2812 			/* As an optimisation, we only copy the actual
2813 			 * number of rules that the underlying
2814 			 * function returned.  Since Mallory might
2815 			 * change the rule count in user memory, we
2816 			 * check that it is less than the rule count
2817 			 * originally given (as the user buffer size),
2818 			 * which has been range-checked.
2819 			 */
2820 			if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2821 				return -EFAULT;
2822 			if (actual_rule_cnt < rule_cnt)
2823 				rule_cnt = actual_rule_cnt;
2824 			if (copy_in_user(&compat_rxnfc->rule_locs[0],
2825 					 &rxnfc->rule_locs[0],
2826 					 rule_cnt * sizeof(u32)))
2827 				return -EFAULT;
2828 		}
2829 	}
2830 
2831 	return 0;
2832 }
2833 
compat_siocwandev(struct net * net,struct compat_ifreq __user * uifr32)2834 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2835 {
2836 	void __user *uptr;
2837 	compat_uptr_t uptr32;
2838 	struct ifreq __user *uifr;
2839 
2840 	uifr = compat_alloc_user_space(sizeof(*uifr));
2841 	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2842 		return -EFAULT;
2843 
2844 	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2845 		return -EFAULT;
2846 
2847 	uptr = compat_ptr(uptr32);
2848 
2849 	if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2850 		return -EFAULT;
2851 
2852 	return dev_ioctl(net, SIOCWANDEV, uifr);
2853 }
2854 
bond_ioctl(struct net * net,unsigned int cmd,struct compat_ifreq __user * ifr32)2855 static int bond_ioctl(struct net *net, unsigned int cmd,
2856 			 struct compat_ifreq __user *ifr32)
2857 {
2858 	struct ifreq kifr;
2859 	mm_segment_t old_fs;
2860 	int err;
2861 
2862 	switch (cmd) {
2863 	case SIOCBONDENSLAVE:
2864 	case SIOCBONDRELEASE:
2865 	case SIOCBONDSETHWADDR:
2866 	case SIOCBONDCHANGEACTIVE:
2867 		if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2868 			return -EFAULT;
2869 
2870 		old_fs = get_fs();
2871 		set_fs(KERNEL_DS);
2872 		err = dev_ioctl(net, cmd,
2873 				(struct ifreq __user __force *) &kifr);
2874 		set_fs(old_fs);
2875 
2876 		return err;
2877 	default:
2878 		return -ENOIOCTLCMD;
2879 	}
2880 }
2881 
2882 /* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
compat_ifr_data_ioctl(struct net * net,unsigned int cmd,struct compat_ifreq __user * u_ifreq32)2883 static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
2884 				 struct compat_ifreq __user *u_ifreq32)
2885 {
2886 	struct ifreq __user *u_ifreq64;
2887 	char tmp_buf[IFNAMSIZ];
2888 	void __user *data64;
2889 	u32 data32;
2890 
2891 	if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2892 			   IFNAMSIZ))
2893 		return -EFAULT;
2894 	if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2895 		return -EFAULT;
2896 	data64 = compat_ptr(data32);
2897 
2898 	u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2899 
2900 	if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2901 			 IFNAMSIZ))
2902 		return -EFAULT;
2903 	if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2904 		return -EFAULT;
2905 
2906 	return dev_ioctl(net, cmd, u_ifreq64);
2907 }
2908 
dev_ifsioc(struct net * net,struct socket * sock,unsigned int cmd,struct compat_ifreq __user * uifr32)2909 static int dev_ifsioc(struct net *net, struct socket *sock,
2910 			 unsigned int cmd, struct compat_ifreq __user *uifr32)
2911 {
2912 	struct ifreq __user *uifr;
2913 	int err;
2914 
2915 	uifr = compat_alloc_user_space(sizeof(*uifr));
2916 	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2917 		return -EFAULT;
2918 
2919 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2920 
2921 	if (!err) {
2922 		switch (cmd) {
2923 		case SIOCGIFFLAGS:
2924 		case SIOCGIFMETRIC:
2925 		case SIOCGIFMTU:
2926 		case SIOCGIFMEM:
2927 		case SIOCGIFHWADDR:
2928 		case SIOCGIFINDEX:
2929 		case SIOCGIFADDR:
2930 		case SIOCGIFBRDADDR:
2931 		case SIOCGIFDSTADDR:
2932 		case SIOCGIFNETMASK:
2933 		case SIOCGIFPFLAGS:
2934 		case SIOCGIFTXQLEN:
2935 		case SIOCGMIIPHY:
2936 		case SIOCGMIIREG:
2937 			if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
2938 				err = -EFAULT;
2939 			break;
2940 		}
2941 	}
2942 	return err;
2943 }
2944 
compat_sioc_ifmap(struct net * net,unsigned int cmd,struct compat_ifreq __user * uifr32)2945 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2946 			struct compat_ifreq __user *uifr32)
2947 {
2948 	struct ifreq ifr;
2949 	struct compat_ifmap __user *uifmap32;
2950 	mm_segment_t old_fs;
2951 	int err;
2952 
2953 	uifmap32 = &uifr32->ifr_ifru.ifru_map;
2954 	err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
2955 	err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2956 	err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2957 	err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2958 	err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2959 	err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2960 	err |= get_user(ifr.ifr_map.port, &uifmap32->port);
2961 	if (err)
2962 		return -EFAULT;
2963 
2964 	old_fs = get_fs();
2965 	set_fs(KERNEL_DS);
2966 	err = dev_ioctl(net, cmd, (void  __user __force *)&ifr);
2967 	set_fs(old_fs);
2968 
2969 	if (cmd == SIOCGIFMAP && !err) {
2970 		err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
2971 		err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2972 		err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2973 		err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2974 		err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2975 		err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2976 		err |= put_user(ifr.ifr_map.port, &uifmap32->port);
2977 		if (err)
2978 			err = -EFAULT;
2979 	}
2980 	return err;
2981 }
2982 
2983 struct rtentry32 {
2984 	u32		rt_pad1;
2985 	struct sockaddr rt_dst;         /* target address               */
2986 	struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
2987 	struct sockaddr rt_genmask;     /* target network mask (IP)     */
2988 	unsigned short	rt_flags;
2989 	short		rt_pad2;
2990 	u32		rt_pad3;
2991 	unsigned char	rt_tos;
2992 	unsigned char	rt_class;
2993 	short		rt_pad4;
2994 	short		rt_metric;      /* +1 for binary compatibility! */
2995 	/* char * */ u32 rt_dev;        /* forcing the device at add    */
2996 	u32		rt_mtu;         /* per route MTU/Window         */
2997 	u32		rt_window;      /* Window clamping              */
2998 	unsigned short  rt_irtt;        /* Initial RTT                  */
2999 };
3000 
3001 struct in6_rtmsg32 {
3002 	struct in6_addr		rtmsg_dst;
3003 	struct in6_addr		rtmsg_src;
3004 	struct in6_addr		rtmsg_gateway;
3005 	u32			rtmsg_type;
3006 	u16			rtmsg_dst_len;
3007 	u16			rtmsg_src_len;
3008 	u32			rtmsg_metric;
3009 	u32			rtmsg_info;
3010 	u32			rtmsg_flags;
3011 	s32			rtmsg_ifindex;
3012 };
3013 
routing_ioctl(struct net * net,struct socket * sock,unsigned int cmd,void __user * argp)3014 static int routing_ioctl(struct net *net, struct socket *sock,
3015 			 unsigned int cmd, void __user *argp)
3016 {
3017 	int ret;
3018 	void *r = NULL;
3019 	struct in6_rtmsg r6;
3020 	struct rtentry r4;
3021 	char devname[16];
3022 	u32 rtdev;
3023 	mm_segment_t old_fs = get_fs();
3024 
3025 	if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3026 		struct in6_rtmsg32 __user *ur6 = argp;
3027 		ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3028 			3 * sizeof(struct in6_addr));
3029 		ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3030 		ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3031 		ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3032 		ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3033 		ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3034 		ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3035 		ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3036 
3037 		r = (void *) &r6;
3038 	} else { /* ipv4 */
3039 		struct rtentry32 __user *ur4 = argp;
3040 		ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3041 					3 * sizeof(struct sockaddr));
3042 		ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3043 		ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3044 		ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3045 		ret |= get_user(r4.rt_window, &(ur4->rt_window));
3046 		ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3047 		ret |= get_user(rtdev, &(ur4->rt_dev));
3048 		if (rtdev) {
3049 			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3050 			r4.rt_dev = (char __user __force *)devname;
3051 			devname[15] = 0;
3052 		} else
3053 			r4.rt_dev = NULL;
3054 
3055 		r = (void *) &r4;
3056 	}
3057 
3058 	if (ret) {
3059 		ret = -EFAULT;
3060 		goto out;
3061 	}
3062 
3063 	set_fs(KERNEL_DS);
3064 	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3065 	set_fs(old_fs);
3066 
3067 out:
3068 	return ret;
3069 }
3070 
3071 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3072  * for some operations; this forces use of the newer bridge-utils that
3073  * use compatible ioctls
3074  */
old_bridge_ioctl(compat_ulong_t __user * argp)3075 static int old_bridge_ioctl(compat_ulong_t __user *argp)
3076 {
3077 	compat_ulong_t tmp;
3078 
3079 	if (get_user(tmp, argp))
3080 		return -EFAULT;
3081 	if (tmp == BRCTL_GET_VERSION)
3082 		return BRCTL_VERSION + 1;
3083 	return -EINVAL;
3084 }
3085 
compat_sock_ioctl_trans(struct file * file,struct socket * sock,unsigned int cmd,unsigned long arg)3086 static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3087 			 unsigned int cmd, unsigned long arg)
3088 {
3089 	void __user *argp = compat_ptr(arg);
3090 	struct sock *sk = sock->sk;
3091 	struct net *net = sock_net(sk);
3092 
3093 	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3094 		return compat_ifr_data_ioctl(net, cmd, argp);
3095 
3096 	switch (cmd) {
3097 	case SIOCSIFBR:
3098 	case SIOCGIFBR:
3099 		return old_bridge_ioctl(argp);
3100 	case SIOCGIFNAME:
3101 		return dev_ifname32(net, argp);
3102 	case SIOCGIFCONF:
3103 		return dev_ifconf(net, argp);
3104 	case SIOCETHTOOL:
3105 		return ethtool_ioctl(net, argp);
3106 	case SIOCWANDEV:
3107 		return compat_siocwandev(net, argp);
3108 	case SIOCGIFMAP:
3109 	case SIOCSIFMAP:
3110 		return compat_sioc_ifmap(net, cmd, argp);
3111 	case SIOCBONDENSLAVE:
3112 	case SIOCBONDRELEASE:
3113 	case SIOCBONDSETHWADDR:
3114 	case SIOCBONDCHANGEACTIVE:
3115 		return bond_ioctl(net, cmd, argp);
3116 	case SIOCADDRT:
3117 	case SIOCDELRT:
3118 		return routing_ioctl(net, sock, cmd, argp);
3119 	case SIOCGSTAMP:
3120 		return do_siocgstamp(net, sock, cmd, argp);
3121 	case SIOCGSTAMPNS:
3122 		return do_siocgstampns(net, sock, cmd, argp);
3123 	case SIOCBONDSLAVEINFOQUERY:
3124 	case SIOCBONDINFOQUERY:
3125 	case SIOCSHWTSTAMP:
3126 	case SIOCGHWTSTAMP:
3127 		return compat_ifr_data_ioctl(net, cmd, argp);
3128 
3129 	case FIOSETOWN:
3130 	case SIOCSPGRP:
3131 	case FIOGETOWN:
3132 	case SIOCGPGRP:
3133 	case SIOCBRADDBR:
3134 	case SIOCBRDELBR:
3135 	case SIOCGIFVLAN:
3136 	case SIOCSIFVLAN:
3137 	case SIOCADDDLCI:
3138 	case SIOCDELDLCI:
3139 		return sock_ioctl(file, cmd, arg);
3140 
3141 	case SIOCGIFFLAGS:
3142 	case SIOCSIFFLAGS:
3143 	case SIOCGIFMETRIC:
3144 	case SIOCSIFMETRIC:
3145 	case SIOCGIFMTU:
3146 	case SIOCSIFMTU:
3147 	case SIOCGIFMEM:
3148 	case SIOCSIFMEM:
3149 	case SIOCGIFHWADDR:
3150 	case SIOCSIFHWADDR:
3151 	case SIOCADDMULTI:
3152 	case SIOCDELMULTI:
3153 	case SIOCGIFINDEX:
3154 	case SIOCGIFADDR:
3155 	case SIOCSIFADDR:
3156 	case SIOCSIFHWBROADCAST:
3157 	case SIOCDIFADDR:
3158 	case SIOCGIFBRDADDR:
3159 	case SIOCSIFBRDADDR:
3160 	case SIOCGIFDSTADDR:
3161 	case SIOCSIFDSTADDR:
3162 	case SIOCGIFNETMASK:
3163 	case SIOCSIFNETMASK:
3164 	case SIOCSIFPFLAGS:
3165 	case SIOCGIFPFLAGS:
3166 	case SIOCGIFTXQLEN:
3167 	case SIOCSIFTXQLEN:
3168 	case SIOCBRADDIF:
3169 	case SIOCBRDELIF:
3170 	case SIOCSIFNAME:
3171 	case SIOCGMIIPHY:
3172 	case SIOCGMIIREG:
3173 	case SIOCSMIIREG:
3174 		return dev_ifsioc(net, sock, cmd, argp);
3175 
3176 	case SIOCSARP:
3177 	case SIOCGARP:
3178 	case SIOCDARP:
3179 	case SIOCATMARK:
3180 		return sock_do_ioctl(net, sock, cmd, arg);
3181 	}
3182 
3183 	return -ENOIOCTLCMD;
3184 }
3185 
compat_sock_ioctl(struct file * file,unsigned int cmd,unsigned long arg)3186 static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3187 			      unsigned long arg)
3188 {
3189 	struct socket *sock = file->private_data;
3190 	int ret = -ENOIOCTLCMD;
3191 	struct sock *sk;
3192 	struct net *net;
3193 
3194 	sk = sock->sk;
3195 	net = sock_net(sk);
3196 
3197 	if (sock->ops->compat_ioctl)
3198 		ret = sock->ops->compat_ioctl(sock, cmd, arg);
3199 
3200 	if (ret == -ENOIOCTLCMD &&
3201 	    (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3202 		ret = compat_wext_handle_ioctl(net, cmd, arg);
3203 
3204 	if (ret == -ENOIOCTLCMD)
3205 		ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3206 
3207 	return ret;
3208 }
3209 #endif
3210 
kernel_bind(struct socket * sock,struct sockaddr * addr,int addrlen)3211 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3212 {
3213 	return sock->ops->bind(sock, addr, addrlen);
3214 }
3215 EXPORT_SYMBOL(kernel_bind);
3216 
kernel_listen(struct socket * sock,int backlog)3217 int kernel_listen(struct socket *sock, int backlog)
3218 {
3219 	return sock->ops->listen(sock, backlog);
3220 }
3221 EXPORT_SYMBOL(kernel_listen);
3222 
kernel_accept(struct socket * sock,struct socket ** newsock,int flags)3223 int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3224 {
3225 	struct sock *sk = sock->sk;
3226 	int err;
3227 
3228 	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3229 			       newsock);
3230 	if (err < 0)
3231 		goto done;
3232 
3233 	err = sock->ops->accept(sock, *newsock, flags);
3234 	if (err < 0) {
3235 		sock_release(*newsock);
3236 		*newsock = NULL;
3237 		goto done;
3238 	}
3239 
3240 	(*newsock)->ops = sock->ops;
3241 	__module_get((*newsock)->ops->owner);
3242 
3243 done:
3244 	return err;
3245 }
3246 EXPORT_SYMBOL(kernel_accept);
3247 
kernel_connect(struct socket * sock,struct sockaddr * addr,int addrlen,int flags)3248 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3249 		   int flags)
3250 {
3251 	return sock->ops->connect(sock, addr, addrlen, flags);
3252 }
3253 EXPORT_SYMBOL(kernel_connect);
3254 
kernel_getsockname(struct socket * sock,struct sockaddr * addr,int * addrlen)3255 int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3256 			 int *addrlen)
3257 {
3258 	return sock->ops->getname(sock, addr, addrlen, 0);
3259 }
3260 EXPORT_SYMBOL(kernel_getsockname);
3261 
kernel_getpeername(struct socket * sock,struct sockaddr * addr,int * addrlen)3262 int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3263 			 int *addrlen)
3264 {
3265 	return sock->ops->getname(sock, addr, addrlen, 1);
3266 }
3267 EXPORT_SYMBOL(kernel_getpeername);
3268 
kernel_getsockopt(struct socket * sock,int level,int optname,char * optval,int * optlen)3269 int kernel_getsockopt(struct socket *sock, int level, int optname,
3270 			char *optval, int *optlen)
3271 {
3272 	mm_segment_t oldfs = get_fs();
3273 	char __user *uoptval;
3274 	int __user *uoptlen;
3275 	int err;
3276 
3277 	uoptval = (char __user __force *) optval;
3278 	uoptlen = (int __user __force *) optlen;
3279 
3280 	set_fs(KERNEL_DS);
3281 	if (level == SOL_SOCKET)
3282 		err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3283 	else
3284 		err = sock->ops->getsockopt(sock, level, optname, uoptval,
3285 					    uoptlen);
3286 	set_fs(oldfs);
3287 	return err;
3288 }
3289 EXPORT_SYMBOL(kernel_getsockopt);
3290 
kernel_setsockopt(struct socket * sock,int level,int optname,char * optval,unsigned int optlen)3291 int kernel_setsockopt(struct socket *sock, int level, int optname,
3292 			char *optval, unsigned int optlen)
3293 {
3294 	mm_segment_t oldfs = get_fs();
3295 	char __user *uoptval;
3296 	int err;
3297 
3298 	uoptval = (char __user __force *) optval;
3299 
3300 	set_fs(KERNEL_DS);
3301 	if (level == SOL_SOCKET)
3302 		err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3303 	else
3304 		err = sock->ops->setsockopt(sock, level, optname, uoptval,
3305 					    optlen);
3306 	set_fs(oldfs);
3307 	return err;
3308 }
3309 EXPORT_SYMBOL(kernel_setsockopt);
3310 
kernel_sendpage(struct socket * sock,struct page * page,int offset,size_t size,int flags)3311 int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3312 		    size_t size, int flags)
3313 {
3314 	if (sock->ops->sendpage)
3315 		return sock->ops->sendpage(sock, page, offset, size, flags);
3316 
3317 	return sock_no_sendpage(sock, page, offset, size, flags);
3318 }
3319 EXPORT_SYMBOL(kernel_sendpage);
3320 
kernel_sock_ioctl(struct socket * sock,int cmd,unsigned long arg)3321 int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3322 {
3323 	mm_segment_t oldfs = get_fs();
3324 	int err;
3325 
3326 	set_fs(KERNEL_DS);
3327 	err = sock->ops->ioctl(sock, cmd, arg);
3328 	set_fs(oldfs);
3329 
3330 	return err;
3331 }
3332 EXPORT_SYMBOL(kernel_sock_ioctl);
3333 
kernel_sock_shutdown(struct socket * sock,enum sock_shutdown_cmd how)3334 int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3335 {
3336 	return sock->ops->shutdown(sock, how);
3337 }
3338 EXPORT_SYMBOL(kernel_sock_shutdown);
3339