The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/socket.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*
    2  * NET          An implementation of the SOCKET network access protocol.
    3  *
    4  * Version:     @(#)socket.c    1.1.93  18/02/95
    5  *
    6  * Authors:     Orest Zborowski, <obz@Kodak.COM>
    7  *              Ross Biro
    8  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
    9  *
   10  * Fixes:
   11  *              Anonymous       :       NOTSOCK/BADF cleanup. Error fix in
   12  *                                      shutdown()
   13  *              Alan Cox        :       verify_area() fixes
   14  *              Alan Cox        :       Removed DDI
   15  *              Jonathan Kamens :       SOCK_DGRAM reconnect bug
   16  *              Alan Cox        :       Moved a load of checks to the very
   17  *                                      top level.
   18  *              Alan Cox        :       Move address structures to/from user
   19  *                                      mode above the protocol layers.
   20  *              Rob Janssen     :       Allow 0 length sends.
   21  *              Alan Cox        :       Asynchronous I/O support (cribbed from the
   22  *                                      tty drivers).
   23  *              Niibe Yutaka    :       Asynchronous I/O for writes (4.4BSD style)
   24  *              Jeff Uphoff     :       Made max number of sockets command-line
   25  *                                      configurable.
   26  *              Matti Aarnio    :       Made the number of sockets dynamic,
   27  *                                      to be allocated when needed, and mr.
   28  *                                      Uphoff's max is used as max to be
   29  *                                      allowed to allocate.
   30  *              Linus           :       Argh. removed all the socket allocation
   31  *                                      altogether: it's in the inode now.
   32  *              Alan Cox        :       Made sock_alloc()/sock_release() public
   33  *                                      for NetROM and future kernel nfsd type
   34  *                                      stuff.
   35  *              Alan Cox        :       sendmsg/recvmsg basics.
   36  *              Tom Dyas        :       Export net symbols.
   37  *              Marcin Dalecki  :       Fixed problems with CONFIG_NET="n".
   38  *              Alan Cox        :       Added thread locking to sys_* calls
   39  *                                      for sockets. May have errors at the
   40  *                                      moment.
   41  *              Kevin Buhr      :       Fixed the dumb errors in the above.
   42  *              Andi Kleen      :       Some small cleanups, optimizations,
   43  *                                      and fixed a copy_from_user() bug.
   44  *              Tigran Aivazian :       sys_send(args) calls sys_sendto(args, NULL, 0)
   45  *              Tigran Aivazian :       Made listen(2) backlog sanity checks
   46  *                                      protocol-independent
   47  *
   48  *
   49  *              This program is free software; you can redistribute it and/or
   50  *              modify it under the terms of the GNU General Public License
   51  *              as published by the Free Software Foundation; either version
   52  *              2 of the License, or (at your option) any later version.
   53  *
   54  *
   55  *      This module is effectively the top level interface to the BSD socket
   56  *      paradigm.
   57  *
   58  *      Based upon Swansea University Computer Society NET3.039
   59  */
   60 
   61 #include <linux/mm.h>
   62 #include <linux/socket.h>
   63 #include <linux/file.h>
   64 #include <linux/net.h>
   65 #include <linux/interrupt.h>
   66 #include <linux/thread_info.h>
   67 #include <linux/rcupdate.h>
   68 #include <linux/netdevice.h>
   69 #include <linux/proc_fs.h>
   70 #include <linux/seq_file.h>
   71 #include <linux/mutex.h>
   72 #include <linux/wanrouter.h>
   73 #include <linux/if_bridge.h>
   74 #include <linux/if_frad.h>
   75 #include <linux/if_vlan.h>
   76 #include <linux/init.h>
   77 #include <linux/poll.h>
   78 #include <linux/cache.h>
   79 #include <linux/module.h>
   80 #include <linux/highmem.h>
   81 #include <linux/mount.h>
   82 #include <linux/security.h>
   83 #include <linux/syscalls.h>
   84 #include <linux/compat.h>
   85 #include <linux/kmod.h>
   86 #include <linux/audit.h>
   87 #include <linux/wireless.h>
   88 #include <linux/nsproxy.h>
   89 #include <linux/magic.h>
   90 #include <linux/slab.h>
   91 #include <linux/xattr.h>
   92 
   93 #include <asm/uaccess.h>
   94 #include <asm/unistd.h>
   95 
   96 #include <net/compat.h>
   97 #include <net/wext.h>
   98 #include <net/cls_cgroup.h>
   99 
  100 #include <net/sock.h>
  101 #include <linux/netfilter.h>
  102 
  103 #include <linux/if_tun.h>
  104 #include <linux/ipv6_route.h>
  105 #include <linux/route.h>
  106 #include <linux/sockios.h>
  107 #include <linux/atalk.h>
  108 
  109 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
  110 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
  111                          unsigned long nr_segs, loff_t pos);
  112 static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
  113                           unsigned long nr_segs, loff_t pos);
  114 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
  115 
  116 static int sock_close(struct inode *inode, struct file *file);
  117 static unsigned int sock_poll(struct file *file,
  118                               struct poll_table_struct *wait);
  119 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
  120 #ifdef CONFIG_COMPAT
  121 static long compat_sock_ioctl(struct file *file,
  122                               unsigned int cmd, unsigned long arg);
  123 #endif
  124 static int sock_fasync(int fd, struct file *filp, int on);
  125 static ssize_t sock_sendpage(struct file *file, struct page *page,
  126                              int offset, size_t size, loff_t *ppos, int more);
  127 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
  128                                 struct pipe_inode_info *pipe, size_t len,
  129                                 unsigned int flags);
  130 
  131 /*
  132  *      Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
  133  *      in the operation structures but are done directly via the socketcall() multiplexor.
  134  */
  135 
  136 static const struct file_operations socket_file_ops = {
  137         .owner =        THIS_MODULE,
  138         .llseek =       no_llseek,
  139         .aio_read =     sock_aio_read,
  140         .aio_write =    sock_aio_write,
  141         .poll =         sock_poll,
  142         .unlocked_ioctl = sock_ioctl,
  143 #ifdef CONFIG_COMPAT
  144         .compat_ioctl = compat_sock_ioctl,
  145 #endif
  146         .mmap =         sock_mmap,
  147         .open =         sock_no_open,   /* special open code to disallow open via /proc */
  148         .release =      sock_close,
  149         .fasync =       sock_fasync,
  150         .sendpage =     sock_sendpage,
  151         .splice_write = generic_splice_sendpage,
  152         .splice_read =  sock_splice_read,
  153 };
  154 
  155 /*
  156  *      The protocol list. Each protocol is registered in here.
  157  */
  158 
  159 static DEFINE_SPINLOCK(net_family_lock);
  160 static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
  161 
  162 /*
  163  *      Statistics counters of the socket lists
  164  */
  165 
  166 static DEFINE_PER_CPU(int, sockets_in_use);
  167 
  168 /*
  169  * Support routines.
  170  * Move socket addresses back and forth across the kernel/user
  171  * divide and look after the messy bits.
  172  */
  173 
  174 /**
  175  *      move_addr_to_kernel     -       copy a socket address into kernel space
  176  *      @uaddr: Address in user space
  177  *      @kaddr: Address in kernel space
  178  *      @ulen: Length in user space
  179  *
  180  *      The address is copied into kernel space. If the provided address is
  181  *      too long an error code of -EINVAL is returned. If the copy gives
  182  *      invalid addresses -EFAULT is returned. On a success 0 is returned.
  183  */
  184 
  185 int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
  186 {
  187         if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
  188                 return -EINVAL;
  189         if (ulen == 0)
  190                 return 0;
  191         if (copy_from_user(kaddr, uaddr, ulen))
  192                 return -EFAULT;
  193         return audit_sockaddr(ulen, kaddr);
  194 }
  195 
  196 /**
  197  *      move_addr_to_user       -       copy an address to user space
  198  *      @kaddr: kernel space address
  199  *      @klen: length of address in kernel
  200  *      @uaddr: user space address
  201  *      @ulen: pointer to user length field
  202  *
  203  *      The value pointed to by ulen on entry is the buffer length available.
  204  *      This is overwritten with the buffer space used. -EINVAL is returned
  205  *      if an overlong buffer is specified or a negative buffer size. -EFAULT
  206  *      is returned if either the buffer or the length field are not
  207  *      accessible.
  208  *      After copying the data up to the limit the user specifies, the true
  209  *      length of the data is written over the length limit the user
  210  *      specified. Zero is returned for a success.
  211  */
  212 
  213 static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
  214                              void __user *uaddr, int __user *ulen)
  215 {
  216         int err;
  217         int len;
  218 
  219         err = get_user(len, ulen);
  220         if (err)
  221                 return err;
  222         if (len > klen)
  223                 len = klen;
  224         if (len < 0 || len > sizeof(struct sockaddr_storage))
  225                 return -EINVAL;
  226         if (len) {
  227                 if (audit_sockaddr(klen, kaddr))
  228                         return -ENOMEM;
  229                 if (copy_to_user(uaddr, kaddr, len))
  230                         return -EFAULT;
  231         }
  232         /*
  233          *      "fromlen shall refer to the value before truncation.."
  234          *                      1003.1g
  235          */
  236         return __put_user(klen, ulen);
  237 }
  238 
  239 static struct kmem_cache *sock_inode_cachep __read_mostly;
  240 
  241 static struct inode *sock_alloc_inode(struct super_block *sb)
  242 {
  243         struct socket_alloc *ei;
  244         struct socket_wq *wq;
  245 
  246         ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
  247         if (!ei)
  248                 return NULL;
  249         wq = kmalloc(sizeof(*wq), GFP_KERNEL);
  250         if (!wq) {
  251                 kmem_cache_free(sock_inode_cachep, ei);
  252                 return NULL;
  253         }
  254         init_waitqueue_head(&wq->wait);
  255         wq->fasync_list = NULL;
  256         RCU_INIT_POINTER(ei->socket.wq, wq);
  257 
  258         ei->socket.state = SS_UNCONNECTED;
  259         ei->socket.flags = 0;
  260         ei->socket.ops = NULL;
  261         ei->socket.sk = NULL;
  262         ei->socket.file = NULL;
  263 
  264         return &ei->vfs_inode;
  265 }
  266 
  267 static void sock_destroy_inode(struct inode *inode)
  268 {
  269         struct socket_alloc *ei;
  270         struct socket_wq *wq;
  271 
  272         ei = container_of(inode, struct socket_alloc, vfs_inode);
  273         wq = rcu_dereference_protected(ei->socket.wq, 1);
  274         kfree_rcu(wq, rcu);
  275         kmem_cache_free(sock_inode_cachep, ei);
  276 }
  277 
  278 static void init_once(void *foo)
  279 {
  280         struct socket_alloc *ei = (struct socket_alloc *)foo;
  281 
  282         inode_init_once(&ei->vfs_inode);
  283 }
  284 
  285 static int init_inodecache(void)
  286 {
  287         sock_inode_cachep = kmem_cache_create("sock_inode_cache",
  288                                               sizeof(struct socket_alloc),
  289                                               0,
  290                                               (SLAB_HWCACHE_ALIGN |
  291                                                SLAB_RECLAIM_ACCOUNT |
  292                                                SLAB_MEM_SPREAD),
  293                                               init_once);
  294         if (sock_inode_cachep == NULL)
  295                 return -ENOMEM;
  296         return 0;
  297 }
  298 
  299 static const struct super_operations sockfs_ops = {
  300         .alloc_inode    = sock_alloc_inode,
  301         .destroy_inode  = sock_destroy_inode,
  302         .statfs         = simple_statfs,
  303 };
  304 
  305 /*
  306  * sockfs_dname() is called from d_path().
  307  */
  308 static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
  309 {
  310         return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
  311                                 dentry->d_inode->i_ino);
  312 }
  313 
  314 static const struct dentry_operations sockfs_dentry_operations = {
  315         .d_dname  = sockfs_dname,
  316 };
  317 
  318 static struct dentry *sockfs_mount(struct file_system_type *fs_type,
  319                          int flags, const char *dev_name, void *data)
  320 {
  321         return mount_pseudo(fs_type, "socket:", &sockfs_ops,
  322                 &sockfs_dentry_operations, SOCKFS_MAGIC);
  323 }
  324 
  325 static struct vfsmount *sock_mnt __read_mostly;
  326 
  327 static struct file_system_type sock_fs_type = {
  328         .name =         "sockfs",
  329         .mount =        sockfs_mount,
  330         .kill_sb =      kill_anon_super,
  331 };
  332 
  333 /*
  334  *      Obtains the first available file descriptor and sets it up for use.
  335  *
  336  *      These functions create file structures and maps them to fd space
  337  *      of the current process. On success it returns file descriptor
  338  *      and file struct implicitly stored in sock->file.
  339  *      Note that another thread may close file descriptor before we return
  340  *      from this function. We use the fact that now we do not refer
  341  *      to socket after mapping. If one day we will need it, this
  342  *      function will increment ref. count on file by 1.
  343  *
  344  *      In any case returned fd MAY BE not valid!
  345  *      This race condition is unavoidable
  346  *      with shared fd spaces, we cannot solve it inside kernel,
  347  *      but we take care of internal coherence yet.
  348  */
  349 
  350 struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
  351 {
  352         struct qstr name = { .name = "" };
  353         struct path path;
  354         struct file *file;
  355 
  356         if (dname) {
  357                 name.name = dname;
  358                 name.len = strlen(name.name);
  359         } else if (sock->sk) {
  360                 name.name = sock->sk->sk_prot_creator->name;
  361                 name.len = strlen(name.name);
  362         }
  363         path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
  364         if (unlikely(!path.dentry))
  365                 return ERR_PTR(-ENOMEM);
  366         path.mnt = mntget(sock_mnt);
  367 
  368         d_instantiate(path.dentry, SOCK_INODE(sock));
  369         SOCK_INODE(sock)->i_fop = &socket_file_ops;
  370 
  371         file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
  372                   &socket_file_ops);
  373         if (unlikely(!file)) {
  374                 /* drop dentry, keep inode */
  375                 ihold(path.dentry->d_inode);
  376                 path_put(&path);
  377                 return ERR_PTR(-ENFILE);
  378         }
  379 
  380         sock->file = file;
  381         file->f_flags = O_RDWR | (flags & O_NONBLOCK);
  382         file->f_pos = 0;
  383         file->private_data = sock;
  384         return file;
  385 }
  386 EXPORT_SYMBOL(sock_alloc_file);
  387 
  388 static int sock_map_fd(struct socket *sock, int flags)
  389 {
  390         struct file *newfile;
  391         int fd = get_unused_fd_flags(flags);
  392         if (unlikely(fd < 0))
  393                 return fd;
  394 
  395         newfile = sock_alloc_file(sock, flags, NULL);
  396         if (likely(!IS_ERR(newfile))) {
  397                 fd_install(fd, newfile);
  398                 return fd;
  399         }
  400 
  401         put_unused_fd(fd);
  402         return PTR_ERR(newfile);
  403 }
  404 
  405 struct socket *sock_from_file(struct file *file, int *err)
  406 {
  407         if (file->f_op == &socket_file_ops)
  408                 return file->private_data;      /* set in sock_map_fd */
  409 
  410         *err = -ENOTSOCK;
  411         return NULL;
  412 }
  413 EXPORT_SYMBOL(sock_from_file);
  414 
  415 /**
  416  *      sockfd_lookup - Go from a file number to its socket slot
  417  *      @fd: file handle
  418  *      @err: pointer to an error code return
  419  *
  420  *      The file handle passed in is locked and the socket it is bound
  421  *      too is returned. If an error occurs the err pointer is overwritten
  422  *      with a negative errno code and NULL is returned. The function checks
  423  *      for both invalid handles and passing a handle which is not a socket.
  424  *
  425  *      On a success the socket object pointer is returned.
  426  */
  427 
  428 struct socket *sockfd_lookup(int fd, int *err)
  429 {
  430         struct file *file;
  431         struct socket *sock;
  432 
  433         file = fget(fd);
  434         if (!file) {
  435                 *err = -EBADF;
  436                 return NULL;
  437         }
  438 
  439         sock = sock_from_file(file, err);
  440         if (!sock)
  441                 fput(file);
  442         return sock;
  443 }
  444 EXPORT_SYMBOL(sockfd_lookup);
  445 
  446 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
  447 {
  448         struct file *file;
  449         struct socket *sock;
  450 
  451         *err = -EBADF;
  452         file = fget_light(fd, fput_needed);
  453         if (file) {
  454                 sock = sock_from_file(file, err);
  455                 if (sock)
  456                         return sock;
  457                 fput_light(file, *fput_needed);
  458         }
  459         return NULL;
  460 }
  461 
  462 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
  463 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
  464 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
  465 static ssize_t sockfs_getxattr(struct dentry *dentry,
  466                                const char *name, void *value, size_t size)
  467 {
  468         const char *proto_name;
  469         size_t proto_size;
  470         int error;
  471 
  472         error = -ENODATA;
  473         if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
  474                 proto_name = dentry->d_name.name;
  475                 proto_size = strlen(proto_name);
  476 
  477                 if (value) {
  478                         error = -ERANGE;
  479                         if (proto_size + 1 > size)
  480                                 goto out;
  481 
  482                         strncpy(value, proto_name, proto_size + 1);
  483                 }
  484                 error = proto_size + 1;
  485         }
  486 
  487 out:
  488         return error;
  489 }
  490 
  491 static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
  492                                 size_t size)
  493 {
  494         ssize_t len;
  495         ssize_t used = 0;
  496 
  497         len = security_inode_listsecurity(dentry->d_inode, buffer, size);
  498         if (len < 0)
  499                 return len;
  500         used += len;
  501         if (buffer) {
  502                 if (size < used)
  503                         return -ERANGE;
  504                 buffer += len;
  505         }
  506 
  507         len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
  508         used += len;
  509         if (buffer) {
  510                 if (size < used)
  511                         return -ERANGE;
  512                 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
  513                 buffer += len;
  514         }
  515 
  516         return used;
  517 }
  518 
  519 static const struct inode_operations sockfs_inode_ops = {
  520         .getxattr = sockfs_getxattr,
  521         .listxattr = sockfs_listxattr,
  522 };
  523 
  524 /**
  525  *      sock_alloc      -       allocate a socket
  526  *
  527  *      Allocate a new inode and socket object. The two are bound together
  528  *      and initialised. The socket is then returned. If we are out of inodes
  529  *      NULL is returned.
  530  */
  531 
  532 static struct socket *sock_alloc(void)
  533 {
  534         struct inode *inode;
  535         struct socket *sock;
  536 
  537         inode = new_inode_pseudo(sock_mnt->mnt_sb);
  538         if (!inode)
  539                 return NULL;
  540 
  541         sock = SOCKET_I(inode);
  542 
  543         kmemcheck_annotate_bitfield(sock, type);
  544         inode->i_ino = get_next_ino();
  545         inode->i_mode = S_IFSOCK | S_IRWXUGO;
  546         inode->i_uid = current_fsuid();
  547         inode->i_gid = current_fsgid();
  548         inode->i_op = &sockfs_inode_ops;
  549 
  550         this_cpu_add(sockets_in_use, 1);
  551         return sock;
  552 }
  553 
  554 /*
  555  *      In theory you can't get an open on this inode, but /proc provides
  556  *      a back door. Remember to keep it shut otherwise you'll let the
  557  *      creepy crawlies in.
  558  */
  559 
  560 static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
  561 {
  562         return -ENXIO;
  563 }
  564 
  565 const struct file_operations bad_sock_fops = {
  566         .owner = THIS_MODULE,
  567         .open = sock_no_open,
  568         .llseek = noop_llseek,
  569 };
  570 
  571 /**
  572  *      sock_release    -       close a socket
  573  *      @sock: socket to close
  574  *
  575  *      The socket is released from the protocol stack if it has a release
  576  *      callback, and the inode is then released if the socket is bound to
  577  *      an inode not a file.
  578  */
  579 
  580 void sock_release(struct socket *sock)
  581 {
  582         if (sock->ops) {
  583                 struct module *owner = sock->ops->owner;
  584 
  585                 sock->ops->release(sock);
  586                 sock->ops = NULL;
  587                 module_put(owner);
  588         }
  589 
  590         if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
  591                 printk(KERN_ERR "sock_release: fasync list not empty!\n");
  592 
  593         if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
  594                 return;
  595 
  596         this_cpu_sub(sockets_in_use, 1);
  597         if (!sock->file) {
  598                 iput(SOCK_INODE(sock));
  599                 return;
  600         }
  601         sock->file = NULL;
  602 }
  603 EXPORT_SYMBOL(sock_release);
  604 
  605 int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
  606 {
  607         *tx_flags = 0;
  608         if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
  609                 *tx_flags |= SKBTX_HW_TSTAMP;
  610         if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
  611                 *tx_flags |= SKBTX_SW_TSTAMP;
  612         if (sock_flag(sk, SOCK_WIFI_STATUS))
  613                 *tx_flags |= SKBTX_WIFI_STATUS;
  614         return 0;
  615 }
  616 EXPORT_SYMBOL(sock_tx_timestamp);
  617 
  618 static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
  619                                        struct msghdr *msg, size_t size)
  620 {
  621         struct sock_iocb *si = kiocb_to_siocb(iocb);
  622 
  623         si->sock = sock;
  624         si->scm = NULL;
  625         si->msg = msg;
  626         si->size = size;
  627 
  628         return sock->ops->sendmsg(iocb, sock, msg, size);
  629 }
  630 
  631 static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
  632                                  struct msghdr *msg, size_t size)
  633 {
  634         int err = security_socket_sendmsg(sock, msg, size);
  635 
  636         return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
  637 }
  638 
  639 int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
  640 {
  641         struct kiocb iocb;
  642         struct sock_iocb siocb;
  643         int ret;
  644 
  645         init_sync_kiocb(&iocb, NULL);
  646         iocb.private = &siocb;
  647         ret = __sock_sendmsg(&iocb, sock, msg, size);
  648         if (-EIOCBQUEUED == ret)
  649                 ret = wait_on_sync_kiocb(&iocb);
  650         return ret;
  651 }
  652 EXPORT_SYMBOL(sock_sendmsg);
  653 
  654 static int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
  655 {
  656         struct kiocb iocb;
  657         struct sock_iocb siocb;
  658         int ret;
  659 
  660         init_sync_kiocb(&iocb, NULL);
  661         iocb.private = &siocb;
  662         ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
  663         if (-EIOCBQUEUED == ret)
  664                 ret = wait_on_sync_kiocb(&iocb);
  665         return ret;
  666 }
  667 
  668 int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
  669                    struct kvec *vec, size_t num, size_t size)
  670 {
  671         mm_segment_t oldfs = get_fs();
  672         int result;
  673 
  674         set_fs(KERNEL_DS);
  675         /*
  676          * the following is safe, since for compiler definitions of kvec and
  677          * iovec are identical, yielding the same in-core layout and alignment
  678          */
  679         msg->msg_iov = (struct iovec *)vec;
  680         msg->msg_iovlen = num;
  681         result = sock_sendmsg(sock, msg, size);
  682         set_fs(oldfs);
  683         return result;
  684 }
  685 EXPORT_SYMBOL(kernel_sendmsg);
  686 
  687 static int ktime2ts(ktime_t kt, struct timespec *ts)
  688 {
  689         if (kt.tv64) {
  690                 *ts = ktime_to_timespec(kt);
  691                 return 1;
  692         } else {
  693                 return 0;
  694         }
  695 }
  696 
  697 /*
  698  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
  699  */
  700 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
  701         struct sk_buff *skb)
  702 {
  703         int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
  704         struct timespec ts[3];
  705         int empty = 1;
  706         struct skb_shared_hwtstamps *shhwtstamps =
  707                 skb_hwtstamps(skb);
  708 
  709         /* Race occurred between timestamp enabling and packet
  710            receiving.  Fill in the current time for now. */
  711         if (need_software_tstamp && skb->tstamp.tv64 == 0)
  712                 __net_timestamp(skb);
  713 
  714         if (need_software_tstamp) {
  715                 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
  716                         struct timeval tv;
  717                         skb_get_timestamp(skb, &tv);
  718                         put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
  719                                  sizeof(tv), &tv);
  720                 } else {
  721                         skb_get_timestampns(skb, &ts[0]);
  722                         put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
  723                                  sizeof(ts[0]), &ts[0]);
  724                 }
  725         }
  726 
  727 
  728         memset(ts, 0, sizeof(ts));
  729         if (skb->tstamp.tv64 &&
  730             sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE)) {
  731                 skb_get_timestampns(skb, ts + 0);
  732                 empty = 0;
  733         }
  734         if (shhwtstamps) {
  735                 if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
  736                     ktime2ts(shhwtstamps->syststamp, ts + 1))
  737                         empty = 0;
  738                 if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
  739                     ktime2ts(shhwtstamps->hwtstamp, ts + 2))
  740                         empty = 0;
  741         }
  742         if (!empty)
  743                 put_cmsg(msg, SOL_SOCKET,
  744                          SCM_TIMESTAMPING, sizeof(ts), &ts);
  745 }
  746 EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
  747 
  748 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
  749         struct sk_buff *skb)
  750 {
  751         int ack;
  752 
  753         if (!sock_flag(sk, SOCK_WIFI_STATUS))
  754                 return;
  755         if (!skb->wifi_acked_valid)
  756                 return;
  757 
  758         ack = skb->wifi_acked;
  759 
  760         put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
  761 }
  762 EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
  763 
  764 static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
  765                                    struct sk_buff *skb)
  766 {
  767         if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
  768                 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
  769                         sizeof(__u32), &skb->dropcount);
  770 }
  771 
  772 void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
  773         struct sk_buff *skb)
  774 {
  775         sock_recv_timestamp(msg, sk, skb);
  776         sock_recv_drops(msg, sk, skb);
  777 }
  778 EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
  779 
  780 static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
  781                                        struct msghdr *msg, size_t size, int flags)
  782 {
  783         struct sock_iocb *si = kiocb_to_siocb(iocb);
  784 
  785         si->sock = sock;
  786         si->scm = NULL;
  787         si->msg = msg;
  788         si->size = size;
  789         si->flags = flags;
  790 
  791         return sock->ops->recvmsg(iocb, sock, msg, size, flags);
  792 }
  793 
  794 static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
  795                                  struct msghdr *msg, size_t size, int flags)
  796 {
  797         int err = security_socket_recvmsg(sock, msg, size, flags);
  798 
  799         return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
  800 }
  801 
  802 int sock_recvmsg(struct socket *sock, struct msghdr *msg,
  803                  size_t size, int flags)
  804 {
  805         struct kiocb iocb;
  806         struct sock_iocb siocb;
  807         int ret;
  808 
  809         init_sync_kiocb(&iocb, NULL);
  810         iocb.private = &siocb;
  811         ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
  812         if (-EIOCBQUEUED == ret)
  813                 ret = wait_on_sync_kiocb(&iocb);
  814         return ret;
  815 }
  816 EXPORT_SYMBOL(sock_recvmsg);
  817 
  818 static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
  819                               size_t size, int flags)
  820 {
  821         struct kiocb iocb;
  822         struct sock_iocb siocb;
  823         int ret;
  824 
  825         init_sync_kiocb(&iocb, NULL);
  826         iocb.private = &siocb;
  827         ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
  828         if (-EIOCBQUEUED == ret)
  829                 ret = wait_on_sync_kiocb(&iocb);
  830         return ret;
  831 }
  832 
  833 /**
  834  * kernel_recvmsg - Receive a message from a socket (kernel space)
  835  * @sock:       The socket to receive the message from
  836  * @msg:        Received message
  837  * @vec:        Input s/g array for message data
  838  * @num:        Size of input s/g array
  839  * @size:       Number of bytes to read
  840  * @flags:      Message flags (MSG_DONTWAIT, etc...)
  841  *
  842  * On return the msg structure contains the scatter/gather array passed in the
  843  * vec argument. The array is modified so that it consists of the unfilled
  844  * portion of the original array.
  845  *
  846  * The returned value is the total number of bytes received, or an error.
  847  */
  848 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
  849                    struct kvec *vec, size_t num, size_t size, int flags)
  850 {
  851         mm_segment_t oldfs = get_fs();
  852         int result;
  853 
  854         set_fs(KERNEL_DS);
  855         /*
  856          * the following is safe, since for compiler definitions of kvec and
  857          * iovec are identical, yielding the same in-core layout and alignment
  858          */
  859         msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
  860         result = sock_recvmsg(sock, msg, size, flags);
  861         set_fs(oldfs);
  862         return result;
  863 }
  864 EXPORT_SYMBOL(kernel_recvmsg);
  865 
  866 static void sock_aio_dtor(struct kiocb *iocb)
  867 {
  868         kfree(iocb->private);
  869 }
  870 
  871 static ssize_t sock_sendpage(struct file *file, struct page *page,
  872                              int offset, size_t size, loff_t *ppos, int more)
  873 {
  874         struct socket *sock;
  875         int flags;
  876 
  877         sock = file->private_data;
  878 
  879         flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
  880         /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
  881         flags |= more;
  882 
  883         return kernel_sendpage(sock, page, offset, size, flags);
  884 }
  885 
  886 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
  887                                 struct pipe_inode_info *pipe, size_t len,
  888                                 unsigned int flags)
  889 {
  890         struct socket *sock = file->private_data;
  891 
  892         if (unlikely(!sock->ops->splice_read))
  893                 return -EINVAL;
  894 
  895         return sock->ops->splice_read(sock, ppos, pipe, len, flags);
  896 }
  897 
  898 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
  899                                          struct sock_iocb *siocb)
  900 {
  901         if (!is_sync_kiocb(iocb)) {
  902                 siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
  903                 if (!siocb)
  904                         return NULL;
  905                 iocb->ki_dtor = sock_aio_dtor;
  906         }
  907 
  908         siocb->kiocb = iocb;
  909         iocb->private = siocb;
  910         return siocb;
  911 }
  912 
  913 static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
  914                 struct file *file, const struct iovec *iov,
  915                 unsigned long nr_segs)
  916 {
  917         struct socket *sock = file->private_data;
  918         size_t size = 0;
  919         int i;
  920 
  921         for (i = 0; i < nr_segs; i++)
  922                 size += iov[i].iov_len;
  923 
  924         msg->msg_name = NULL;
  925         msg->msg_namelen = 0;
  926         msg->msg_control = NULL;
  927         msg->msg_controllen = 0;
  928         msg->msg_iov = (struct iovec *)iov;
  929         msg->msg_iovlen = nr_segs;
  930         msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
  931 
  932         return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
  933 }
  934 
  935 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
  936                                 unsigned long nr_segs, loff_t pos)
  937 {
  938         struct sock_iocb siocb, *x;
  939 
  940         if (pos != 0)
  941                 return -ESPIPE;
  942 
  943         if (iocb->ki_left == 0) /* Match SYS5 behaviour */
  944                 return 0;
  945 
  946 
  947         x = alloc_sock_iocb(iocb, &siocb);
  948         if (!x)
  949                 return -ENOMEM;
  950         return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
  951 }
  952 
  953 static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
  954                         struct file *file, const struct iovec *iov,
  955                         unsigned long nr_segs)
  956 {
  957         struct socket *sock = file->private_data;
  958         size_t size = 0;
  959         int i;
  960 
  961         for (i = 0; i < nr_segs; i++)
  962                 size += iov[i].iov_len;
  963 
  964         msg->msg_name = NULL;
  965         msg->msg_namelen = 0;
  966         msg->msg_control = NULL;
  967         msg->msg_controllen = 0;
  968         msg->msg_iov = (struct iovec *)iov;
  969         msg->msg_iovlen = nr_segs;
  970         msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
  971         if (sock->type == SOCK_SEQPACKET)
  972                 msg->msg_flags |= MSG_EOR;
  973 
  974         return __sock_sendmsg(iocb, sock, msg, size);
  975 }
  976 
  977 static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
  978                           unsigned long nr_segs, loff_t pos)
  979 {
  980         struct sock_iocb siocb, *x;
  981 
  982         if (pos != 0)
  983                 return -ESPIPE;
  984 
  985         x = alloc_sock_iocb(iocb, &siocb);
  986         if (!x)
  987                 return -ENOMEM;
  988 
  989         return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
  990 }
  991 
  992 /*
  993  * Atomic setting of ioctl hooks to avoid race
  994  * with module unload.
  995  */
  996 
  997 static DEFINE_MUTEX(br_ioctl_mutex);
  998 static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
  999 
 1000 void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
 1001 {
 1002         mutex_lock(&br_ioctl_mutex);
 1003         br_ioctl_hook = hook;
 1004         mutex_unlock(&br_ioctl_mutex);
 1005 }
 1006 EXPORT_SYMBOL(brioctl_set);
 1007 
 1008 static DEFINE_MUTEX(vlan_ioctl_mutex);
 1009 static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
 1010 
 1011 void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
 1012 {
 1013         mutex_lock(&vlan_ioctl_mutex);
 1014         vlan_ioctl_hook = hook;
 1015         mutex_unlock(&vlan_ioctl_mutex);
 1016 }
 1017 EXPORT_SYMBOL(vlan_ioctl_set);
 1018 
 1019 static DEFINE_MUTEX(dlci_ioctl_mutex);
 1020 static int (*dlci_ioctl_hook) (unsigned int, void __user *);
 1021 
 1022 void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
 1023 {
 1024         mutex_lock(&dlci_ioctl_mutex);
 1025         dlci_ioctl_hook = hook;
 1026         mutex_unlock(&dlci_ioctl_mutex);
 1027 }
 1028 EXPORT_SYMBOL(dlci_ioctl_set);
 1029 
 1030 static long sock_do_ioctl(struct net *net, struct socket *sock,
 1031                                  unsigned int cmd, unsigned long arg)
 1032 {
 1033         int err;
 1034         void __user *argp = (void __user *)arg;
 1035 
 1036         err = sock->ops->ioctl(sock, cmd, arg);
 1037 
 1038         /*
 1039          * If this ioctl is unknown try to hand it down
 1040          * to the NIC driver.
 1041          */
 1042         if (err == -ENOIOCTLCMD)
 1043                 err = dev_ioctl(net, cmd, argp);
 1044 
 1045         return err;
 1046 }
 1047 
 1048 /*
 1049  *      With an ioctl, arg may well be a user mode pointer, but we don't know
 1050  *      what to do with it - that's up to the protocol still.
 1051  */
 1052 
 1053 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 1054 {
 1055         struct socket *sock;
 1056         struct sock *sk;
 1057         void __user *argp = (void __user *)arg;
 1058         int pid, err;
 1059         struct net *net;
 1060 
 1061         sock = file->private_data;
 1062         sk = sock->sk;
 1063         net = sock_net(sk);
 1064         if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
 1065                 err = dev_ioctl(net, cmd, argp);
 1066         } else
 1067 #ifdef CONFIG_WEXT_CORE
 1068         if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
 1069                 err = dev_ioctl(net, cmd, argp);
 1070         } else
 1071 #endif
 1072                 switch (cmd) {
 1073                 case FIOSETOWN:
 1074                 case SIOCSPGRP:
 1075                         err = -EFAULT;
 1076                         if (get_user(pid, (int __user *)argp))
 1077                                 break;
 1078                         err = f_setown(sock->file, pid, 1);
 1079                         break;
 1080                 case FIOGETOWN:
 1081                 case SIOCGPGRP:
 1082                         err = put_user(f_getown(sock->file),
 1083                                        (int __user *)argp);
 1084                         break;
 1085                 case SIOCGIFBR:
 1086                 case SIOCSIFBR:
 1087                 case SIOCBRADDBR:
 1088                 case SIOCBRDELBR:
 1089                         err = -ENOPKG;
 1090                         if (!br_ioctl_hook)
 1091                                 request_module("bridge");
 1092 
 1093                         mutex_lock(&br_ioctl_mutex);
 1094                         if (br_ioctl_hook)
 1095                                 err = br_ioctl_hook(net, cmd, argp);
 1096                         mutex_unlock(&br_ioctl_mutex);
 1097                         break;
 1098                 case SIOCGIFVLAN:
 1099                 case SIOCSIFVLAN:
 1100                         err = -ENOPKG;
 1101                         if (!vlan_ioctl_hook)
 1102                                 request_module("8021q");
 1103 
 1104                         mutex_lock(&vlan_ioctl_mutex);
 1105                         if (vlan_ioctl_hook)
 1106                                 err = vlan_ioctl_hook(net, argp);
 1107                         mutex_unlock(&vlan_ioctl_mutex);
 1108                         break;
 1109                 case SIOCADDDLCI:
 1110                 case SIOCDELDLCI:
 1111                         err = -ENOPKG;
 1112                         if (!dlci_ioctl_hook)
 1113                                 request_module("dlci");
 1114 
 1115                         mutex_lock(&dlci_ioctl_mutex);
 1116                         if (dlci_ioctl_hook)
 1117                                 err = dlci_ioctl_hook(cmd, argp);
 1118                         mutex_unlock(&dlci_ioctl_mutex);
 1119                         break;
 1120                 default:
 1121                         err = sock_do_ioctl(net, sock, cmd, arg);
 1122                         break;
 1123                 }
 1124         return err;
 1125 }
 1126 
 1127 int sock_create_lite(int family, int type, int protocol, struct socket **res)
 1128 {
 1129         int err;
 1130         struct socket *sock = NULL;
 1131 
 1132         err = security_socket_create(family, type, protocol, 1);
 1133         if (err)
 1134                 goto out;
 1135 
 1136         sock = sock_alloc();
 1137         if (!sock) {
 1138                 err = -ENOMEM;
 1139                 goto out;
 1140         }
 1141 
 1142         sock->type = type;
 1143         err = security_socket_post_create(sock, family, type, protocol, 1);
 1144         if (err)
 1145                 goto out_release;
 1146 
 1147 out:
 1148         *res = sock;
 1149         return err;
 1150 out_release:
 1151         sock_release(sock);
 1152         sock = NULL;
 1153         goto out;
 1154 }
 1155 EXPORT_SYMBOL(sock_create_lite);
 1156 
 1157 /* No kernel lock held - perfect */
 1158 static unsigned int sock_poll(struct file *file, poll_table *wait)
 1159 {
 1160         struct socket *sock;
 1161 
 1162         /*
 1163          *      We can't return errors to poll, so it's either yes or no.
 1164          */
 1165         sock = file->private_data;
 1166         return sock->ops->poll(file, sock, wait);
 1167 }
 1168 
 1169 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
 1170 {
 1171         struct socket *sock = file->private_data;
 1172 
 1173         return sock->ops->mmap(file, sock, vma);
 1174 }
 1175 
 1176 static int sock_close(struct inode *inode, struct file *filp)
 1177 {
 1178         /*
 1179          *      It was possible the inode is NULL we were
 1180          *      closing an unfinished socket.
 1181          */
 1182 
 1183         if (!inode) {
 1184                 printk(KERN_DEBUG "sock_close: NULL inode\n");
 1185                 return 0;
 1186         }
 1187         sock_release(SOCKET_I(inode));
 1188         return 0;
 1189 }
 1190 
 1191 /*
 1192  *      Update the socket async list
 1193  *
 1194  *      Fasync_list locking strategy.
 1195  *
 1196  *      1. fasync_list is modified only under process context socket lock
 1197  *         i.e. under semaphore.
 1198  *      2. fasync_list is used under read_lock(&sk->sk_callback_lock)
 1199  *         or under socket lock
 1200  */
 1201 
 1202 static int sock_fasync(int fd, struct file *filp, int on)
 1203 {
 1204         struct socket *sock = filp->private_data;
 1205         struct sock *sk = sock->sk;
 1206         struct socket_wq *wq;
 1207 
 1208         if (sk == NULL)
 1209                 return -EINVAL;
 1210 
 1211         lock_sock(sk);
 1212         wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
 1213         fasync_helper(fd, filp, on, &wq->fasync_list);
 1214 
 1215         if (!wq->fasync_list)
 1216                 sock_reset_flag(sk, SOCK_FASYNC);
 1217         else
 1218                 sock_set_flag(sk, SOCK_FASYNC);
 1219 
 1220         release_sock(sk);
 1221         return 0;
 1222 }
 1223 
 1224 /* This function may be called only under socket lock or callback_lock or rcu_lock */
 1225 
 1226 int sock_wake_async(struct socket *sock, int how, int band)
 1227 {
 1228         struct socket_wq *wq;
 1229 
 1230         if (!sock)
 1231                 return -1;
 1232         rcu_read_lock();
 1233         wq = rcu_dereference(sock->wq);
 1234         if (!wq || !wq->fasync_list) {
 1235                 rcu_read_unlock();
 1236                 return -1;
 1237         }
 1238         switch (how) {
 1239         case SOCK_WAKE_WAITD:
 1240                 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
 1241                         break;
 1242                 goto call_kill;
 1243         case SOCK_WAKE_SPACE:
 1244                 if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
 1245                         break;
 1246                 /* fall through */
 1247         case SOCK_WAKE_IO:
 1248 call_kill:
 1249                 kill_fasync(&wq->fasync_list, SIGIO, band);
 1250                 break;
 1251         case SOCK_WAKE_URG:
 1252                 kill_fasync(&wq->fasync_list, SIGURG, band);
 1253         }
 1254         rcu_read_unlock();
 1255         return 0;
 1256 }
 1257 EXPORT_SYMBOL(sock_wake_async);
 1258 
 1259 int __sock_create(struct net *net, int family, int type, int protocol,
 1260                          struct socket **res, int kern)
 1261 {
 1262         int err;
 1263         struct socket *sock;
 1264         const struct net_proto_family *pf;
 1265 
 1266         /*
 1267          *      Check protocol is in range
 1268          */
 1269         if (family < 0 || family >= NPROTO)
 1270                 return -EAFNOSUPPORT;
 1271         if (type < 0 || type >= SOCK_MAX)
 1272                 return -EINVAL;
 1273 
 1274         /* Compatibility.
 1275 
 1276            This uglymoron is moved from INET layer to here to avoid
 1277            deadlock in module load.
 1278          */
 1279         if (family == PF_INET && type == SOCK_PACKET) {
 1280                 static int warned;
 1281                 if (!warned) {
 1282                         warned = 1;
 1283                         printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
 1284                                current->comm);
 1285                 }
 1286                 family = PF_PACKET;
 1287         }
 1288 
 1289         err = security_socket_create(family, type, protocol, kern);
 1290         if (err)
 1291                 return err;
 1292 
 1293         /*
 1294          *      Allocate the socket and allow the family to set things up. if
 1295          *      the protocol is 0, the family is instructed to select an appropriate
 1296          *      default.
 1297          */
 1298         sock = sock_alloc();
 1299         if (!sock) {
 1300                 net_warn_ratelimited("socket: no more sockets\n");
 1301                 return -ENFILE; /* Not exactly a match, but its the
 1302                                    closest posix thing */
 1303         }
 1304 
 1305         sock->type = type;
 1306 
 1307 #ifdef CONFIG_MODULES
 1308         /* Attempt to load a protocol module if the find failed.
 1309          *
 1310          * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
 1311          * requested real, full-featured networking support upon configuration.
 1312          * Otherwise module support will break!
 1313          */
 1314         if (rcu_access_pointer(net_families[family]) == NULL)
 1315                 request_module("net-pf-%d", family);
 1316 #endif
 1317 
 1318         rcu_read_lock();
 1319         pf = rcu_dereference(net_families[family]);
 1320         err = -EAFNOSUPPORT;
 1321         if (!pf)
 1322                 goto out_release;
 1323 
 1324         /*
 1325          * We will call the ->create function, that possibly is in a loadable
 1326          * module, so we have to bump that loadable module refcnt first.
 1327          */
 1328         if (!try_module_get(pf->owner))
 1329                 goto out_release;
 1330 
 1331         /* Now protected by module ref count */
 1332         rcu_read_unlock();
 1333 
 1334         err = pf->create(net, sock, protocol, kern);
 1335         if (err < 0)
 1336                 goto out_module_put;
 1337 
 1338         /*
 1339          * Now to bump the refcnt of the [loadable] module that owns this
 1340          * socket at sock_release time we decrement its refcnt.
 1341          */
 1342         if (!try_module_get(sock->ops->owner))
 1343                 goto out_module_busy;
 1344 
 1345         /*
 1346          * Now that we're done with the ->create function, the [loadable]
 1347          * module can have its refcnt decremented
 1348          */
 1349         module_put(pf->owner);
 1350         err = security_socket_post_create(sock, family, type, protocol, kern);
 1351         if (err)
 1352                 goto out_sock_release;
 1353         *res = sock;
 1354 
 1355         return 0;
 1356 
 1357 out_module_busy:
 1358         err = -EAFNOSUPPORT;
 1359 out_module_put:
 1360         sock->ops = NULL;
 1361         module_put(pf->owner);
 1362 out_sock_release:
 1363         sock_release(sock);
 1364         return err;
 1365 
 1366 out_release:
 1367         rcu_read_unlock();
 1368         goto out_sock_release;
 1369 }
 1370 EXPORT_SYMBOL(__sock_create);
 1371 
 1372 int sock_create(int family, int type, int protocol, struct socket **res)
 1373 {
 1374         return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
 1375 }
 1376 EXPORT_SYMBOL(sock_create);
 1377 
 1378 int sock_create_kern(int family, int type, int protocol, struct socket **res)
 1379 {
 1380         return __sock_create(&init_net, family, type, protocol, res, 1);
 1381 }
 1382 EXPORT_SYMBOL(sock_create_kern);
 1383 
 1384 SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
 1385 {
 1386         int retval;
 1387         struct socket *sock;
 1388         int flags;
 1389 
 1390         /* Check the SOCK_* constants for consistency.  */
 1391         BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
 1392         BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
 1393         BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
 1394         BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
 1395 
 1396         flags = type & ~SOCK_TYPE_MASK;
 1397         if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 1398                 return -EINVAL;
 1399         type &= SOCK_TYPE_MASK;
 1400 
 1401         if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
 1402                 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 1403 
 1404         retval = sock_create(family, type, protocol, &sock);
 1405         if (retval < 0)
 1406                 goto out;
 1407 
 1408         retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
 1409         if (retval < 0)
 1410                 goto out_release;
 1411 
 1412 out:
 1413         /* It may be already another descriptor 8) Not kernel problem. */
 1414         return retval;
 1415 
 1416 out_release:
 1417         sock_release(sock);
 1418         return retval;
 1419 }
 1420 
 1421 /*
 1422  *      Create a pair of connected sockets.
 1423  */
 1424 
 1425 SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
 1426                 int __user *, usockvec)
 1427 {
 1428         struct socket *sock1, *sock2;
 1429         int fd1, fd2, err;
 1430         struct file *newfile1, *newfile2;
 1431         int flags;
 1432 
 1433         flags = type & ~SOCK_TYPE_MASK;
 1434         if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 1435                 return -EINVAL;
 1436         type &= SOCK_TYPE_MASK;
 1437 
 1438         if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
 1439                 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 1440 
 1441         /*
 1442          * Obtain the first socket and check if the underlying protocol
 1443          * supports the socketpair call.
 1444          */
 1445 
 1446         err = sock_create(family, type, protocol, &sock1);
 1447         if (err < 0)
 1448                 goto out;
 1449 
 1450         err = sock_create(family, type, protocol, &sock2);
 1451         if (err < 0)
 1452                 goto out_release_1;
 1453 
 1454         err = sock1->ops->socketpair(sock1, sock2);
 1455         if (err < 0)
 1456                 goto out_release_both;
 1457 
 1458         fd1 = get_unused_fd_flags(flags);
 1459         if (unlikely(fd1 < 0)) {
 1460                 err = fd1;
 1461                 goto out_release_both;
 1462         }
 1463         fd2 = get_unused_fd_flags(flags);
 1464         if (unlikely(fd2 < 0)) {
 1465                 err = fd2;
 1466                 put_unused_fd(fd1);
 1467                 goto out_release_both;
 1468         }
 1469 
 1470         newfile1 = sock_alloc_file(sock1, flags, NULL);
 1471         if (unlikely(IS_ERR(newfile1))) {
 1472                 err = PTR_ERR(newfile1);
 1473                 put_unused_fd(fd1);
 1474                 put_unused_fd(fd2);
 1475                 goto out_release_both;
 1476         }
 1477 
 1478         newfile2 = sock_alloc_file(sock2, flags, NULL);
 1479         if (IS_ERR(newfile2)) {
 1480                 err = PTR_ERR(newfile2);
 1481                 fput(newfile1);
 1482                 put_unused_fd(fd1);
 1483                 put_unused_fd(fd2);
 1484                 sock_release(sock2);
 1485                 goto out;
 1486         }
 1487 
 1488         audit_fd_pair(fd1, fd2);
 1489         fd_install(fd1, newfile1);
 1490         fd_install(fd2, newfile2);
 1491         /* fd1 and fd2 may be already another descriptors.
 1492          * Not kernel problem.
 1493          */
 1494 
 1495         err = put_user(fd1, &usockvec[0]);
 1496         if (!err)
 1497                 err = put_user(fd2, &usockvec[1]);
 1498         if (!err)
 1499                 return 0;
 1500 
 1501         sys_close(fd2);
 1502         sys_close(fd1);
 1503         return err;
 1504 
 1505 out_release_both:
 1506         sock_release(sock2);
 1507 out_release_1:
 1508         sock_release(sock1);
 1509 out:
 1510         return err;
 1511 }
 1512 
 1513 /*
 1514  *      Bind a name to a socket. Nothing much to do here since it's
 1515  *      the protocol's responsibility to handle the local address.
 1516  *
 1517  *      We move the socket address to kernel space before we call
 1518  *      the protocol layer (having also checked the address is ok).
 1519  */
 1520 
 1521 SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
 1522 {
 1523         struct socket *sock;
 1524         struct sockaddr_storage address;
 1525         int err, fput_needed;
 1526 
 1527         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1528         if (sock) {
 1529                 err = move_addr_to_kernel(umyaddr, addrlen, &address);
 1530                 if (err >= 0) {
 1531                         err = security_socket_bind(sock,
 1532                                                    (struct sockaddr *)&address,
 1533                                                    addrlen);
 1534                         if (!err)
 1535                                 err = sock->ops->bind(sock,
 1536                                                       (struct sockaddr *)
 1537                                                       &address, addrlen);
 1538                 }
 1539                 fput_light(sock->file, fput_needed);
 1540         }
 1541         return err;
 1542 }
 1543 
 1544 /*
 1545  *      Perform a listen. Basically, we allow the protocol to do anything
 1546  *      necessary for a listen, and if that works, we mark the socket as
 1547  *      ready for listening.
 1548  */
 1549 
 1550 SYSCALL_DEFINE2(listen, int, fd, int, backlog)
 1551 {
 1552         struct socket *sock;
 1553         int err, fput_needed;
 1554         int somaxconn;
 1555 
 1556         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1557         if (sock) {
 1558                 somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
 1559                 if ((unsigned int)backlog > somaxconn)
 1560                         backlog = somaxconn;
 1561 
 1562                 err = security_socket_listen(sock, backlog);
 1563                 if (!err)
 1564                         err = sock->ops->listen(sock, backlog);
 1565 
 1566                 fput_light(sock->file, fput_needed);
 1567         }
 1568         return err;
 1569 }
 1570 
 1571 /*
 1572  *      For accept, we attempt to create a new socket, set up the link
 1573  *      with the client, wake up the client, then return the new
 1574  *      connected fd. We collect the address of the connector in kernel
 1575  *      space and move it to user at the very end. This is unclean because
 1576  *      we open the socket then return an error.
 1577  *
 1578  *      1003.1g adds the ability to recvmsg() to query connection pending
 1579  *      status to recvmsg. We need to add that support in a way thats
 1580  *      clean when we restucture accept also.
 1581  */
 1582 
 1583 SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
 1584                 int __user *, upeer_addrlen, int, flags)
 1585 {
 1586         struct socket *sock, *newsock;
 1587         struct file *newfile;
 1588         int err, len, newfd, fput_needed;
 1589         struct sockaddr_storage address;
 1590 
 1591         if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
 1592                 return -EINVAL;
 1593 
 1594         if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
 1595                 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 1596 
 1597         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1598         if (!sock)
 1599                 goto out;
 1600 
 1601         err = -ENFILE;
 1602         newsock = sock_alloc();
 1603         if (!newsock)
 1604                 goto out_put;
 1605 
 1606         newsock->type = sock->type;
 1607         newsock->ops = sock->ops;
 1608 
 1609         /*
 1610          * We don't need try_module_get here, as the listening socket (sock)
 1611          * has the protocol module (sock->ops->owner) held.
 1612          */
 1613         __module_get(newsock->ops->owner);
 1614 
 1615         newfd = get_unused_fd_flags(flags);
 1616         if (unlikely(newfd < 0)) {
 1617                 err = newfd;
 1618                 sock_release(newsock);
 1619                 goto out_put;
 1620         }
 1621         newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
 1622         if (unlikely(IS_ERR(newfile))) {
 1623                 err = PTR_ERR(newfile);
 1624                 put_unused_fd(newfd);
 1625                 sock_release(newsock);
 1626                 goto out_put;
 1627         }
 1628 
 1629         err = security_socket_accept(sock, newsock);
 1630         if (err)
 1631                 goto out_fd;
 1632 
 1633         err = sock->ops->accept(sock, newsock, sock->file->f_flags);
 1634         if (err < 0)
 1635                 goto out_fd;
 1636 
 1637         if (upeer_sockaddr) {
 1638                 if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
 1639                                           &len, 2) < 0) {
 1640                         err = -ECONNABORTED;
 1641                         goto out_fd;
 1642                 }
 1643                 err = move_addr_to_user(&address,
 1644                                         len, upeer_sockaddr, upeer_addrlen);
 1645                 if (err < 0)
 1646                         goto out_fd;
 1647         }
 1648 
 1649         /* File flags are not inherited via accept() unlike another OSes. */
 1650 
 1651         fd_install(newfd, newfile);
 1652         err = newfd;
 1653 
 1654 out_put:
 1655         fput_light(sock->file, fput_needed);
 1656 out:
 1657         return err;
 1658 out_fd:
 1659         fput(newfile);
 1660         put_unused_fd(newfd);
 1661         goto out_put;
 1662 }
 1663 
 1664 SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
 1665                 int __user *, upeer_addrlen)
 1666 {
 1667         return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
 1668 }
 1669 
 1670 /*
 1671  *      Attempt to connect to a socket with the server address.  The address
 1672  *      is in user space so we verify it is OK and move it to kernel space.
 1673  *
 1674  *      For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
 1675  *      break bindings
 1676  *
 1677  *      NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
 1678  *      other SEQPACKET protocols that take time to connect() as it doesn't
 1679  *      include the -EINPROGRESS status for such sockets.
 1680  */
 1681 
 1682 SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
 1683                 int, addrlen)
 1684 {
 1685         struct socket *sock;
 1686         struct sockaddr_storage address;
 1687         int err, fput_needed;
 1688 
 1689         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1690         if (!sock)
 1691                 goto out;
 1692         err = move_addr_to_kernel(uservaddr, addrlen, &address);
 1693         if (err < 0)
 1694                 goto out_put;
 1695 
 1696         err =
 1697             security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
 1698         if (err)
 1699                 goto out_put;
 1700 
 1701         err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
 1702                                  sock->file->f_flags);
 1703 out_put:
 1704         fput_light(sock->file, fput_needed);
 1705 out:
 1706         return err;
 1707 }
 1708 
 1709 /*
 1710  *      Get the local address ('name') of a socket object. Move the obtained
 1711  *      name to user space.
 1712  */
 1713 
 1714 SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
 1715                 int __user *, usockaddr_len)
 1716 {
 1717         struct socket *sock;
 1718         struct sockaddr_storage address;
 1719         int len, err, fput_needed;
 1720 
 1721         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1722         if (!sock)
 1723                 goto out;
 1724 
 1725         err = security_socket_getsockname(sock);
 1726         if (err)
 1727                 goto out_put;
 1728 
 1729         err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
 1730         if (err)
 1731                 goto out_put;
 1732         err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
 1733 
 1734 out_put:
 1735         fput_light(sock->file, fput_needed);
 1736 out:
 1737         return err;
 1738 }
 1739 
 1740 /*
 1741  *      Get the remote address ('name') of a socket object. Move the obtained
 1742  *      name to user space.
 1743  */
 1744 
 1745 SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
 1746                 int __user *, usockaddr_len)
 1747 {
 1748         struct socket *sock;
 1749         struct sockaddr_storage address;
 1750         int len, err, fput_needed;
 1751 
 1752         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1753         if (sock != NULL) {
 1754                 err = security_socket_getpeername(sock);
 1755                 if (err) {
 1756                         fput_light(sock->file, fput_needed);
 1757                         return err;
 1758                 }
 1759 
 1760                 err =
 1761                     sock->ops->getname(sock, (struct sockaddr *)&address, &len,
 1762                                        1);
 1763                 if (!err)
 1764                         err = move_addr_to_user(&address, len, usockaddr,
 1765                                                 usockaddr_len);
 1766                 fput_light(sock->file, fput_needed);
 1767         }
 1768         return err;
 1769 }
 1770 
 1771 /*
 1772  *      Send a datagram to a given address. We move the address into kernel
 1773  *      space and check the user space data area is readable before invoking
 1774  *      the protocol.
 1775  */
 1776 
 1777 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 1778                 unsigned int, flags, struct sockaddr __user *, addr,
 1779                 int, addr_len)
 1780 {
 1781         struct socket *sock;
 1782         struct sockaddr_storage address;
 1783         int err;
 1784         struct msghdr msg;
 1785         struct iovec iov;
 1786         int fput_needed;
 1787 
 1788         if (len > INT_MAX)
 1789                 len = INT_MAX;
 1790         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1791         if (!sock)
 1792                 goto out;
 1793 
 1794         iov.iov_base = buff;
 1795         iov.iov_len = len;
 1796         msg.msg_name = NULL;
 1797         msg.msg_iov = &iov;
 1798         msg.msg_iovlen = 1;
 1799         msg.msg_control = NULL;
 1800         msg.msg_controllen = 0;
 1801         msg.msg_namelen = 0;
 1802         if (addr) {
 1803                 err = move_addr_to_kernel(addr, addr_len, &address);
 1804                 if (err < 0)
 1805                         goto out_put;
 1806                 msg.msg_name = (struct sockaddr *)&address;
 1807                 msg.msg_namelen = addr_len;
 1808         }
 1809         if (sock->file->f_flags & O_NONBLOCK)
 1810                 flags |= MSG_DONTWAIT;
 1811         msg.msg_flags = flags;
 1812         err = sock_sendmsg(sock, &msg, len);
 1813 
 1814 out_put:
 1815         fput_light(sock->file, fput_needed);
 1816 out:
 1817         return err;
 1818 }
 1819 
 1820 /*
 1821  *      Send a datagram down a socket.
 1822  */
 1823 
 1824 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
 1825                 unsigned int, flags)
 1826 {
 1827         return sys_sendto(fd, buff, len, flags, NULL, 0);
 1828 }
 1829 
 1830 /*
 1831  *      Receive a frame from the socket and optionally record the address of the
 1832  *      sender. We verify the buffers are writable and if needed move the
 1833  *      sender address from kernel to user space.
 1834  */
 1835 
 1836 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 1837                 unsigned int, flags, struct sockaddr __user *, addr,
 1838                 int __user *, addr_len)
 1839 {
 1840         struct socket *sock;
 1841         struct iovec iov;
 1842         struct msghdr msg;
 1843         struct sockaddr_storage address;
 1844         int err, err2;
 1845         int fput_needed;
 1846 
 1847         if (size > INT_MAX)
 1848                 size = INT_MAX;
 1849         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1850         if (!sock)
 1851                 goto out;
 1852 
 1853         msg.msg_control = NULL;
 1854         msg.msg_controllen = 0;
 1855         msg.msg_iovlen = 1;
 1856         msg.msg_iov = &iov;
 1857         iov.iov_len = size;
 1858         iov.iov_base = ubuf;
 1859         msg.msg_name = (struct sockaddr *)&address;
 1860         msg.msg_namelen = sizeof(address);
 1861         if (sock->file->f_flags & O_NONBLOCK)
 1862                 flags |= MSG_DONTWAIT;
 1863         err = sock_recvmsg(sock, &msg, size, flags);
 1864 
 1865         if (err >= 0 && addr != NULL) {
 1866                 err2 = move_addr_to_user(&address,
 1867                                          msg.msg_namelen, addr, addr_len);
 1868                 if (err2 < 0)
 1869                         err = err2;
 1870         }
 1871 
 1872         fput_light(sock->file, fput_needed);
 1873 out:
 1874         return err;
 1875 }
 1876 
 1877 /*
 1878  *      Receive a datagram from a socket.
 1879  */
 1880 
 1881 asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
 1882                          unsigned int flags)
 1883 {
 1884         return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
 1885 }
 1886 
 1887 /*
 1888  *      Set a socket option. Because we don't know the option lengths we have
 1889  *      to pass the user mode parameter for the protocols to sort out.
 1890  */
 1891 
 1892 SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
 1893                 char __user *, optval, int, optlen)
 1894 {
 1895         int err, fput_needed;
 1896         struct socket *sock;
 1897 
 1898         if (optlen < 0)
 1899                 return -EINVAL;
 1900 
 1901         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1902         if (sock != NULL) {
 1903                 err = security_socket_setsockopt(sock, level, optname);
 1904                 if (err)
 1905                         goto out_put;
 1906 
 1907                 if (level == SOL_SOCKET)
 1908                         err =
 1909                             sock_setsockopt(sock, level, optname, optval,
 1910                                             optlen);
 1911                 else
 1912                         err =
 1913                             sock->ops->setsockopt(sock, level, optname, optval,
 1914                                                   optlen);
 1915 out_put:
 1916                 fput_light(sock->file, fput_needed);
 1917         }
 1918         return err;
 1919 }
 1920 
 1921 /*
 1922  *      Get a socket option. Because we don't know the option lengths we have
 1923  *      to pass a user mode parameter for the protocols to sort out.
 1924  */
 1925 
 1926 SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
 1927                 char __user *, optval, int __user *, optlen)
 1928 {
 1929         int err, fput_needed;
 1930         struct socket *sock;
 1931 
 1932         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1933         if (sock != NULL) {
 1934                 err = security_socket_getsockopt(sock, level, optname);
 1935                 if (err)
 1936                         goto out_put;
 1937 
 1938                 if (level == SOL_SOCKET)
 1939                         err =
 1940                             sock_getsockopt(sock, level, optname, optval,
 1941                                             optlen);
 1942                 else
 1943                         err =
 1944                             sock->ops->getsockopt(sock, level, optname, optval,
 1945                                                   optlen);
 1946 out_put:
 1947                 fput_light(sock->file, fput_needed);
 1948         }
 1949         return err;
 1950 }
 1951 
 1952 /*
 1953  *      Shutdown a socket.
 1954  */
 1955 
 1956 SYSCALL_DEFINE2(shutdown, int, fd, int, how)
 1957 {
 1958         int err, fput_needed;
 1959         struct socket *sock;
 1960 
 1961         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 1962         if (sock != NULL) {
 1963                 err = security_socket_shutdown(sock, how);
 1964                 if (!err)
 1965                         err = sock->ops->shutdown(sock, how);
 1966                 fput_light(sock->file, fput_needed);
 1967         }
 1968         return err;
 1969 }
 1970 
 1971 /* A couple of helpful macros for getting the address of the 32/64 bit
 1972  * fields which are the same type (int / unsigned) on our platforms.
 1973  */
 1974 #define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
 1975 #define COMPAT_NAMELEN(msg)     COMPAT_MSG(msg, msg_namelen)
 1976 #define COMPAT_FLAGS(msg)       COMPAT_MSG(msg, msg_flags)
 1977 
 1978 struct used_address {
 1979         struct sockaddr_storage name;
 1980         unsigned int name_len;
 1981 };
 1982 
 1983 static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
 1984                          struct msghdr *msg_sys, unsigned int flags,
 1985                          struct used_address *used_address)
 1986 {
 1987         struct compat_msghdr __user *msg_compat =
 1988             (struct compat_msghdr __user *)msg;
 1989         struct sockaddr_storage address;
 1990         struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
 1991         unsigned char ctl[sizeof(struct cmsghdr) + 20]
 1992             __attribute__ ((aligned(sizeof(__kernel_size_t))));
 1993         /* 20 is size of ipv6_pktinfo */
 1994         unsigned char *ctl_buf = ctl;
 1995         int err, ctl_len, total_len;
 1996 
 1997         err = -EFAULT;
 1998         if (MSG_CMSG_COMPAT & flags) {
 1999                 if (get_compat_msghdr(msg_sys, msg_compat))
 2000                         return -EFAULT;
 2001         } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
 2002                 return -EFAULT;
 2003 
 2004         if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 2005                 err = -EMSGSIZE;
 2006                 if (msg_sys->msg_iovlen > UIO_MAXIOV)
 2007                         goto out;
 2008                 err = -ENOMEM;
 2009                 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
 2010                               GFP_KERNEL);
 2011                 if (!iov)
 2012                         goto out;
 2013         }
 2014 
 2015         /* This will also move the address data into kernel space */
 2016         if (MSG_CMSG_COMPAT & flags) {
 2017                 err = verify_compat_iovec(msg_sys, iov, &address, VERIFY_READ);
 2018         } else
 2019                 err = verify_iovec(msg_sys, iov, &address, VERIFY_READ);
 2020         if (err < 0)
 2021                 goto out_freeiov;
 2022         total_len = err;
 2023 
 2024         err = -ENOBUFS;
 2025 
 2026         if (msg_sys->msg_controllen > INT_MAX)
 2027                 goto out_freeiov;
 2028         ctl_len = msg_sys->msg_controllen;
 2029         if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
 2030                 err =
 2031                     cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
 2032                                                      sizeof(ctl));
 2033                 if (err)
 2034                         goto out_freeiov;
 2035                 ctl_buf = msg_sys->msg_control;
 2036                 ctl_len = msg_sys->msg_controllen;
 2037         } else if (ctl_len) {
 2038                 if (ctl_len > sizeof(ctl)) {
 2039                         ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
 2040                         if (ctl_buf == NULL)
 2041                                 goto out_freeiov;
 2042                 }
 2043                 err = -EFAULT;
 2044                 /*
 2045                  * Careful! Before this, msg_sys->msg_control contains a user pointer.
 2046                  * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
 2047                  * checking falls down on this.
 2048                  */
 2049                 if (copy_from_user(ctl_buf,
 2050                                    (void __user __force *)msg_sys->msg_control,
 2051                                    ctl_len))
 2052                         goto out_freectl;
 2053                 msg_sys->msg_control = ctl_buf;
 2054         }
 2055         msg_sys->msg_flags = flags;
 2056 
 2057         if (sock->file->f_flags & O_NONBLOCK)
 2058                 msg_sys->msg_flags |= MSG_DONTWAIT;
 2059         /*
 2060          * If this is sendmmsg() and current destination address is same as
 2061          * previously succeeded address, omit asking LSM's decision.
 2062          * used_address->name_len is initialized to UINT_MAX so that the first
 2063          * destination address never matches.
 2064          */
 2065         if (used_address && msg_sys->msg_name &&
 2066             used_address->name_len == msg_sys->msg_namelen &&
 2067             !memcmp(&used_address->name, msg_sys->msg_name,
 2068                     used_address->name_len)) {
 2069                 err = sock_sendmsg_nosec(sock, msg_sys, total_len);
 2070                 goto out_freectl;
 2071         }
 2072         err = sock_sendmsg(sock, msg_sys, total_len);
 2073         /*
 2074          * If this is sendmmsg() and sending to current destination address was
 2075          * successful, remember it.
 2076          */
 2077         if (used_address && err >= 0) {
 2078                 used_address->name_len = msg_sys->msg_namelen;
 2079                 if (msg_sys->msg_name)
 2080                         memcpy(&used_address->name, msg_sys->msg_name,
 2081                                used_address->name_len);
 2082         }
 2083 
 2084 out_freectl:
 2085         if (ctl_buf != ctl)
 2086                 sock_kfree_s(sock->sk, ctl_buf, ctl_len);
 2087 out_freeiov:
 2088         if (iov != iovstack)
 2089                 kfree(iov);
 2090 out:
 2091         return err;
 2092 }
 2093 
 2094 /*
 2095  *      BSD sendmsg interface
 2096  */
 2097 
 2098 SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
 2099 {
 2100         int fput_needed, err;
 2101         struct msghdr msg_sys;
 2102         struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 2103 
 2104         if (!sock)
 2105                 goto out;
 2106 
 2107         err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
 2108 
 2109         fput_light(sock->file, fput_needed);
 2110 out:
 2111         return err;
 2112 }
 2113 
 2114 /*
 2115  *      Linux sendmmsg interface
 2116  */
 2117 
 2118 int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 2119                    unsigned int flags)
 2120 {
 2121         int fput_needed, err, datagrams;
 2122         struct socket *sock;
 2123         struct mmsghdr __user *entry;
 2124         struct compat_mmsghdr __user *compat_entry;
 2125         struct msghdr msg_sys;
 2126         struct used_address used_address;
 2127 
 2128         if (vlen > UIO_MAXIOV)
 2129                 vlen = UIO_MAXIOV;
 2130 
 2131         datagrams = 0;
 2132 
 2133         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 2134         if (!sock)
 2135                 return err;
 2136 
 2137         used_address.name_len = UINT_MAX;
 2138         entry = mmsg;
 2139         compat_entry = (struct compat_mmsghdr __user *)mmsg;
 2140         err = 0;
 2141 
 2142         while (datagrams < vlen) {
 2143                 if (MSG_CMSG_COMPAT & flags) {
 2144                         err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
 2145                                             &msg_sys, flags, &used_address);
 2146                         if (err < 0)
 2147                                 break;
 2148                         err = __put_user(err, &compat_entry->msg_len);
 2149                         ++compat_entry;
 2150                 } else {
 2151                         err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
 2152                                             &msg_sys, flags, &used_address);
 2153                         if (err < 0)
 2154                                 break;
 2155                         err = put_user(err, &entry->msg_len);
 2156                         ++entry;
 2157                 }
 2158 
 2159                 if (err)
 2160                         break;
 2161                 ++datagrams;
 2162         }
 2163 
 2164         fput_light(sock->file, fput_needed);
 2165 
 2166         /* We only return an error if no datagrams were able to be sent */
 2167         if (datagrams != 0)
 2168                 return datagrams;
 2169 
 2170         return err;
 2171 }
 2172 
 2173 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 2174                 unsigned int, vlen, unsigned int, flags)
 2175 {
 2176         return __sys_sendmmsg(fd, mmsg, vlen, flags);
 2177 }
 2178 
 2179 static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
 2180                          struct msghdr *msg_sys, unsigned int flags, int nosec)
 2181 {
 2182         struct compat_msghdr __user *msg_compat =
 2183             (struct compat_msghdr __user *)msg;
 2184         struct iovec iovstack[UIO_FASTIOV];
 2185         struct iovec *iov = iovstack;
 2186         unsigned long cmsg_ptr;
 2187         int err, total_len, len;
 2188 
 2189         /* kernel mode address */
 2190         struct sockaddr_storage addr;
 2191 
 2192         /* user mode address pointers */
 2193         struct sockaddr __user *uaddr;
 2194         int __user *uaddr_len;
 2195 
 2196         if (MSG_CMSG_COMPAT & flags) {
 2197                 if (get_compat_msghdr(msg_sys, msg_compat))
 2198                         return -EFAULT;
 2199         } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
 2200                 return -EFAULT;
 2201 
 2202         if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 2203                 err = -EMSGSIZE;
 2204                 if (msg_sys->msg_iovlen > UIO_MAXIOV)
 2205                         goto out;
 2206                 err = -ENOMEM;
 2207                 iov = kmalloc(msg_sys->msg_iovlen * sizeof(struct iovec),
 2208                               GFP_KERNEL);
 2209                 if (!iov)
 2210                         goto out;
 2211         }
 2212 
 2213         /*
 2214          *      Save the user-mode address (verify_iovec will change the
 2215          *      kernel msghdr to use the kernel address space)
 2216          */
 2217 
 2218         uaddr = (__force void __user *)msg_sys->msg_name;
 2219         uaddr_len = COMPAT_NAMELEN(msg);
 2220         if (MSG_CMSG_COMPAT & flags) {
 2221                 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
 2222         } else
 2223                 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
 2224         if (err < 0)
 2225                 goto out_freeiov;
 2226         total_len = err;
 2227 
 2228         cmsg_ptr = (unsigned long)msg_sys->msg_control;
 2229         msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
 2230 
 2231         if (sock->file->f_flags & O_NONBLOCK)
 2232                 flags |= MSG_DONTWAIT;
 2233         err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
 2234                                                           total_len, flags);
 2235         if (err < 0)
 2236                 goto out_freeiov;
 2237         len = err;
 2238 
 2239         if (uaddr != NULL) {
 2240                 err = move_addr_to_user(&addr,
 2241                                         msg_sys->msg_namelen, uaddr,
 2242                                         uaddr_len);
 2243                 if (err < 0)
 2244                         goto out_freeiov;
 2245         }
 2246         err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
 2247                          COMPAT_FLAGS(msg));
 2248         if (err)
 2249                 goto out_freeiov;
 2250         if (MSG_CMSG_COMPAT & flags)
 2251                 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
 2252                                  &msg_compat->msg_controllen);
 2253         else
 2254                 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
 2255                                  &msg->msg_controllen);
 2256         if (err)
 2257                 goto out_freeiov;
 2258         err = len;
 2259 
 2260 out_freeiov:
 2261         if (iov != iovstack)
 2262                 kfree(iov);
 2263 out:
 2264         return err;
 2265 }
 2266 
 2267 /*
 2268  *      BSD recvmsg interface
 2269  */
 2270 
 2271 SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
 2272                 unsigned int, flags)
 2273 {
 2274         int fput_needed, err;
 2275         struct msghdr msg_sys;
 2276         struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
 2277 
 2278         if (!sock)
 2279                 goto out;
 2280 
 2281         err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
 2282 
 2283         fput_light(sock->file, fput_needed);
 2284 out:
 2285         return err;
 2286 }
 2287 
 2288 /*
 2289  *     Linux recvmmsg interface
 2290  */
 2291 
 2292 int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 2293                    unsigned int flags, struct timespec *timeout)
 2294 {
 2295         int fput_needed, err, datagrams;
 2296         struct socket *sock;
 2297         struct mmsghdr __user *entry;
 2298         struct compat_mmsghdr __user *compat_entry;
 2299         struct msghdr msg_sys;
 2300         struct timespec end_time;
 2301 
 2302         if (timeout &&
 2303             poll_select_set_timeout(&end_time, timeout->tv_sec,
 2304                                     timeout->tv_nsec))
 2305                 return -EINVAL;
 2306 
 2307         datagrams = 0;
 2308 
 2309         sock = sockfd_lookup_light(fd, &err, &fput_needed);
 2310         if (!sock)
 2311                 return err;
 2312 
 2313         err = sock_error(sock->sk);
 2314         if (err)
 2315                 goto out_put;
 2316 
 2317         entry = mmsg;
 2318         compat_entry = (struct compat_mmsghdr __user *)mmsg;
 2319 
 2320         while (datagrams < vlen) {
 2321                 /*
 2322                  * No need to ask LSM for more than the first datagram.
 2323                  */
 2324                 if (MSG_CMSG_COMPAT & flags) {
 2325                         err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
 2326                                             &msg_sys, flags & ~MSG_WAITFORONE,
 2327                                             datagrams);
 2328                         if (err < 0)
 2329                                 break;
 2330                         err = __put_user(err, &compat_entry->msg_len);
 2331                         ++compat_entry;
 2332                 } else {
 2333                         err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
 2334                                             &msg_sys, flags & ~MSG_WAITFORONE,
 2335                                             datagrams);
 2336                         if (err < 0)
 2337                                 break;
 2338                         err = put_user(err, &entry->msg_len);
 2339                         ++entry;
 2340                 }
 2341 
 2342                 if (err)
 2343                         break;
 2344                 ++datagrams;
 2345 
 2346                 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
 2347                 if (flags & MSG_WAITFORONE)
 2348                         flags |= MSG_DONTWAIT;
 2349 
 2350                 if (timeout) {
 2351                         ktime_get_ts(timeout);
 2352                         *timeout = timespec_sub(end_time, *timeout);
 2353                         if (timeout->tv_sec < 0) {
 2354                                 timeout->tv_sec = timeout->tv_nsec = 0;
 2355                                 break;
 2356                         }
 2357 
 2358                         /* Timeout, return less than vlen datagrams */
 2359                         if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
 2360                                 break;
 2361                 }
 2362 
 2363                 /* Out of band data, return right away */
 2364                 if (msg_sys.msg_flags & MSG_OOB)
 2365                         break;
 2366         }
 2367 
 2368 out_put:
 2369         fput_light(sock->file, fput_needed);
 2370 
 2371         if (err == 0)
 2372                 return datagrams;
 2373 
 2374         if (datagrams != 0) {
 2375                 /*
 2376                  * We may return less entries than requested (vlen) if the
 2377                  * sock is non block and there aren't enough datagrams...
 2378                  */
 2379                 if (err != -EAGAIN) {
 2380                         /*
 2381                          * ... or  if recvmsg returns an error after we
 2382                          * received some datagrams, where we record the
 2383                          * error to return on the next call or if the
 2384                          * app asks about it using getsockopt(SO_ERROR).
 2385                          */
 2386                         sock->sk->sk_err = -err;
 2387                 }
 2388 
 2389                 return datagrams;
 2390         }
 2391 
 2392         return err;
 2393 }
 2394 
 2395 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
 2396                 unsigned int, vlen, unsigned int, flags,
 2397                 struct timespec __user *, timeout)
 2398 {
 2399         int datagrams;
 2400         struct timespec timeout_sys;
 2401 
 2402         if (!timeout)
 2403                 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
 2404 
 2405         if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
 2406                 return -EFAULT;
 2407 
 2408         datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
 2409 
 2410         if (datagrams > 0 &&
 2411             copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
 2412                 datagrams = -EFAULT;
 2413 
 2414         return datagrams;
 2415 }
 2416 
 2417 #ifdef __ARCH_WANT_SYS_SOCKETCALL
 2418 /* Argument list sizes for sys_socketcall */
 2419 #define AL(x) ((x) * sizeof(unsigned long))
 2420 static const unsigned char nargs[21] = {
 2421         AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
 2422         AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
 2423         AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
 2424         AL(4), AL(5), AL(4)
 2425 };
 2426 
 2427 #undef AL
 2428 
 2429 /*
 2430  *      System call vectors.
 2431  *
 2432  *      Argument checking cleaned up. Saved 20% in size.
 2433  *  This function doesn't need to set the kernel lock because
 2434  *  it is set by the callees.
 2435  */
 2436 
 2437 SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 2438 {
 2439         unsigned long a[6];
 2440         unsigned long a0, a1;
 2441         int err;
 2442         unsigned int len;
 2443 
 2444         if (call < 1 || call > SYS_SENDMMSG)
 2445                 return -EINVAL;
 2446 
 2447         len = nargs[call];
 2448         if (len > sizeof(a))
 2449                 return -EINVAL;
 2450 
 2451         /* copy_from_user should be SMP safe. */
 2452         if (copy_from_user(a, args, len))
 2453                 return -EFAULT;
 2454 
 2455         audit_socketcall(nargs[call] / sizeof(unsigned long), a);
 2456 
 2457         a0 = a[0];
 2458         a1 = a[1];
 2459 
 2460         switch (call) {
 2461         case SYS_SOCKET:
 2462                 err = sys_socket(a0, a1, a[2]);
 2463                 break;
 2464         case SYS_BIND:
 2465                 err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
 2466                 break;
 2467         case SYS_CONNECT:
 2468                 err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
 2469                 break;
 2470         case SYS_LISTEN:
 2471                 err = sys_listen(a0, a1);
 2472                 break;
 2473         case SYS_ACCEPT:
 2474                 err = sys_accept4(a0, (struct sockaddr __user *)a1,
 2475                                   (int __user *)a[2], 0);
 2476                 break;
 2477         case SYS_GETSOCKNAME:
 2478                 err =
 2479                     sys_getsockname(a0, (struct sockaddr __user *)a1,
 2480                                     (int __user *)a[2]);
 2481                 break;
 2482         case SYS_GETPEERNAME:
 2483                 err =
 2484                     sys_getpeername(a0, (struct sockaddr __user *)a1,
 2485                                     (int __user *)a[2]);
 2486                 break;
 2487         case SYS_SOCKETPAIR:
 2488                 err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
 2489                 break;
 2490         case SYS_SEND:
 2491                 err = sys_send(a0, (void __user *)a1, a[2], a[3]);
 2492                 break;
 2493         case SYS_SENDTO:
 2494                 err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
 2495                                  (struct sockaddr __user *)a[4], a[5]);
 2496                 break;
 2497         case SYS_RECV:
 2498                 err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
 2499                 break;
 2500         case SYS_RECVFROM:
 2501                 err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
 2502                                    (struct sockaddr __user *)a[4],
 2503                                    (int __user *)a[5]);
 2504                 break;
 2505         case SYS_SHUTDOWN:
 2506                 err = sys_shutdown(a0, a1);
 2507                 break;
 2508         case SYS_SETSOCKOPT:
 2509                 err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
 2510                 break;
 2511         case SYS_GETSOCKOPT:
 2512                 err =
 2513                     sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
 2514                                    (int __user *)a[4]);
 2515                 break;
 2516         case SYS_SENDMSG:
 2517                 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
 2518                 break;
 2519         case SYS_SENDMMSG:
 2520                 err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
 2521                 break;
 2522         case SYS_RECVMSG:
 2523                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
 2524                 break;
 2525         case SYS_RECVMMSG:
 2526                 err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
 2527                                    (struct timespec __user *)a[4]);
 2528                 break;
 2529         case SYS_ACCEPT4:
 2530                 err = sys_accept4(a0, (struct sockaddr __user *)a1,
 2531                                   (int __user *)a[2], a[3]);
 2532                 break;
 2533         default:
 2534                 err = -EINVAL;
 2535                 break;
 2536         }
 2537         return err;
 2538 }
 2539 
 2540 #endif                          /* __ARCH_WANT_SYS_SOCKETCALL */
 2541 
 2542 /**
 2543  *      sock_register - add a socket protocol handler
 2544  *      @ops: description of protocol
 2545  *
 2546  *      This function is called by a protocol handler that wants to
 2547  *      advertise its address family, and have it linked into the
 2548  *      socket interface. The value ops->family coresponds to the
 2549  *      socket system call protocol family.
 2550  */
 2551 int sock_register(const struct net_proto_family *ops)
 2552 {
 2553         int err;
 2554 
 2555         if (ops->family >= NPROTO) {
 2556                 printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
 2557                        NPROTO);
 2558                 return -ENOBUFS;
 2559         }
 2560 
 2561         spin_lock(&net_family_lock);
 2562         if (rcu_dereference_protected(net_families[ops->family],
 2563                                       lockdep_is_held(&net_family_lock)))
 2564                 err = -EEXIST;
 2565         else {
 2566                 rcu_assign_pointer(net_families[ops->family], ops);
 2567                 err = 0;
 2568         }
 2569         spin_unlock(&net_family_lock);
 2570 
 2571         printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
 2572         return err;
 2573 }
 2574 EXPORT_SYMBOL(sock_register);
 2575 
 2576 /**
 2577  *      sock_unregister - remove a protocol handler
 2578  *      @family: protocol family to remove
 2579  *
 2580  *      This function is called by a protocol handler that wants to
 2581  *      remove its address family, and have it unlinked from the
 2582  *      new socket creation.
 2583  *
 2584  *      If protocol handler is a module, then it can use module reference
 2585  *      counts to protect against new references. If protocol handler is not
 2586  *      a module then it needs to provide its own protection in
 2587  *      the ops->create routine.
 2588  */
 2589 void sock_unregister(int family)
 2590 {
 2591         BUG_ON(family < 0 || family >= NPROTO);
 2592 
 2593         spin_lock(&net_family_lock);
 2594         RCU_INIT_POINTER(net_families[family], NULL);
 2595         spin_unlock(&net_family_lock);
 2596 
 2597         synchronize_rcu();
 2598 
 2599         printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
 2600 }
 2601 EXPORT_SYMBOL(sock_unregister);
 2602 
 2603 static int __init sock_init(void)
 2604 {
 2605         int err;
 2606         /*
 2607          *      Initialize the network sysctl infrastructure.
 2608          */
 2609         err = net_sysctl_init();
 2610         if (err)
 2611                 goto out;
 2612 
 2613         /*
 2614          *      Initialize skbuff SLAB cache
 2615          */
 2616         skb_init();
 2617 
 2618         /*
 2619          *      Initialize the protocols module.
 2620          */
 2621 
 2622         init_inodecache();
 2623 
 2624         err = register_filesystem(&sock_fs_type);
 2625         if (err)
 2626                 goto out_fs;
 2627         sock_mnt = kern_mount(&sock_fs_type);
 2628         if (IS_ERR(sock_mnt)) {
 2629                 err = PTR_ERR(sock_mnt);
 2630                 goto out_mount;
 2631         }
 2632 
 2633         /* The real protocol initialization is performed in later initcalls.
 2634          */
 2635 
 2636 #ifdef CONFIG_NETFILTER
 2637         netfilter_init();
 2638 #endif
 2639 
 2640 #ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
 2641         skb_timestamping_init();
 2642 #endif
 2643 
 2644 out:
 2645         return err;
 2646 
 2647 out_mount:
 2648         unregister_filesystem(&sock_fs_type);
 2649 out_fs:
 2650         goto out;
 2651 }
 2652 
 2653 core_initcall(sock_init);       /* early initcall */
 2654 
 2655 #ifdef CONFIG_PROC_FS
 2656 void socket_seq_show(struct seq_file *seq)
 2657 {
 2658         int cpu;
 2659         int counter = 0;
 2660 
 2661         for_each_possible_cpu(cpu)
 2662             counter += per_cpu(sockets_in_use, cpu);
 2663 
 2664         /* It can be negative, by the way. 8) */
 2665         if (counter < 0)
 2666                 counter = 0;
 2667 
 2668         seq_printf(seq, "sockets: used %d\n", counter);
 2669 }
 2670 #endif                          /* CONFIG_PROC_FS */
 2671 
 2672 #ifdef CONFIG_COMPAT
 2673 static int do_siocgstamp(struct net *net, struct socket *sock,
 2674                          unsigned int cmd, void __user *up)
 2675 {
 2676         mm_segment_t old_fs = get_fs();
 2677         struct timeval ktv;
 2678         int err;
 2679 
 2680         set_fs(KERNEL_DS);
 2681         err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
 2682         set_fs(old_fs);
 2683         if (!err)
 2684                 err = compat_put_timeval(&ktv, up);
 2685 
 2686         return err;
 2687 }
 2688 
 2689 static int do_siocgstampns(struct net *net, struct socket *sock,
 2690                            unsigned int cmd, void __user *up)
 2691 {
 2692         mm_segment_t old_fs = get_fs();
 2693         struct timespec kts;
 2694         int err;
 2695 
 2696         set_fs(KERNEL_DS);
 2697         err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
 2698         set_fs(old_fs);
 2699         if (!err)
 2700                 err = compat_put_timespec(&kts, up);
 2701 
 2702         return err;
 2703 }
 2704 
 2705 static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
 2706 {
 2707         struct ifreq __user *uifr;
 2708         int err;
 2709 
 2710         uifr = compat_alloc_user_space(sizeof(struct ifreq));
 2711         if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
 2712                 return -EFAULT;
 2713 
 2714         err = dev_ioctl(net, SIOCGIFNAME, uifr);
 2715         if (err)
 2716                 return err;
 2717 
 2718         if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
 2719                 return -EFAULT;
 2720 
 2721         return 0;
 2722 }
 2723 
 2724 static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
 2725 {
 2726         struct compat_ifconf ifc32;
 2727         struct ifconf ifc;
 2728         struct ifconf __user *uifc;
 2729         struct compat_ifreq __user *ifr32;
 2730         struct ifreq __user *ifr;
 2731         unsigned int i, j;
 2732         int err;
 2733 
 2734         if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
 2735                 return -EFAULT;
 2736 
 2737         memset(&ifc, 0, sizeof(ifc));
 2738         if (ifc32.ifcbuf == 0) {
 2739                 ifc32.ifc_len = 0;
 2740                 ifc.ifc_len = 0;
 2741                 ifc.ifc_req = NULL;
 2742                 uifc = compat_alloc_user_space(sizeof(struct ifconf));
 2743         } else {
 2744                 size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
 2745                         sizeof(struct ifreq);
 2746                 uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
 2747                 ifc.ifc_len = len;
 2748                 ifr = ifc.ifc_req = (void __user *)(uifc + 1);
 2749                 ifr32 = compat_ptr(ifc32.ifcbuf);
 2750                 for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
 2751                         if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
 2752                                 return -EFAULT;
 2753                         ifr++;
 2754                         ifr32++;
 2755                 }
 2756         }
 2757         if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
 2758                 return -EFAULT;
 2759 
 2760         err = dev_ioctl(net, SIOCGIFCONF, uifc);
 2761         if (err)
 2762                 return err;
 2763 
 2764         if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
 2765                 return -EFAULT;
 2766 
 2767         ifr = ifc.ifc_req;
 2768         ifr32 = compat_ptr(ifc32.ifcbuf);
 2769         for (i = 0, j = 0;
 2770              i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
 2771              i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
 2772                 if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
 2773                         return -EFAULT;
 2774                 ifr32++;
 2775                 ifr++;
 2776         }
 2777 
 2778         if (ifc32.ifcbuf == 0) {
 2779                 /* Translate from 64-bit structure multiple to
 2780                  * a 32-bit one.
 2781                  */
 2782                 i = ifc.ifc_len;
 2783                 i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
 2784                 ifc32.ifc_len = i;
 2785         } else {
 2786                 ifc32.ifc_len = i;
 2787         }
 2788         if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
 2789                 return -EFAULT;
 2790 
 2791         return 0;
 2792 }
 2793 
 2794 static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
 2795 {
 2796         struct compat_ethtool_rxnfc __user *compat_rxnfc;
 2797         bool convert_in = false, convert_out = false;
 2798         size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
 2799         struct ethtool_rxnfc __user *rxnfc;
 2800         struct ifreq __user *ifr;
 2801         u32 rule_cnt = 0, actual_rule_cnt;
 2802         u32 ethcmd;
 2803         u32 data;
 2804         int ret;
 2805 
 2806         if (get_user(data, &ifr32->ifr_ifru.ifru_data))
 2807                 return -EFAULT;
 2808 
 2809         compat_rxnfc = compat_ptr(data);
 2810 
 2811         if (get_user(ethcmd, &compat_rxnfc->cmd))
 2812                 return -EFAULT;
 2813 
 2814         /* Most ethtool structures are defined without padding.
 2815          * Unfortunately struct ethtool_rxnfc is an exception.
 2816          */
 2817         switch (ethcmd) {
 2818         default:
 2819                 break;
 2820         case ETHTOOL_GRXCLSRLALL:
 2821                 /* Buffer size is variable */
 2822                 if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
 2823                         return -EFAULT;
 2824                 if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
 2825                         return -ENOMEM;
 2826                 buf_size += rule_cnt * sizeof(u32);
 2827                 /* fall through */
 2828         case ETHTOOL_GRXRINGS:
 2829         case ETHTOOL_GRXCLSRLCNT:
 2830         case ETHTOOL_GRXCLSRULE:
 2831         case ETHTOOL_SRXCLSRLINS:
 2832                 convert_out = true;
 2833                 /* fall through */
 2834         case ETHTOOL_SRXCLSRLDEL:
 2835                 buf_size += sizeof(struct ethtool_rxnfc);
 2836                 convert_in = true;
 2837                 break;
 2838         }
 2839 
 2840         ifr = compat_alloc_user_space(buf_size);
 2841         rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
 2842 
 2843         if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
 2844                 return -EFAULT;
 2845 
 2846         if (put_user(convert_in ? rxnfc : compat_ptr(data),
 2847                      &ifr->ifr_ifru.ifru_data))
 2848                 return -EFAULT;
 2849 
 2850         if (convert_in) {
 2851                 /* We expect there to be holes between fs.m_ext and
 2852                  * fs.ring_cookie and at the end of fs, but nowhere else.
 2853                  */
 2854                 BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
 2855                              sizeof(compat_rxnfc->fs.m_ext) !=
 2856                              offsetof(struct ethtool_rxnfc, fs.m_ext) +
 2857                              sizeof(rxnfc->fs.m_ext));
 2858                 BUILD_BUG_ON(
 2859                         offsetof(struct compat_ethtool_rxnfc, fs.location) -
 2860                         offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
 2861                         offsetof(struct ethtool_rxnfc, fs.location) -
 2862                         offsetof(struct ethtool_rxnfc, fs.ring_cookie));
 2863 
 2864                 if (copy_in_user(rxnfc, compat_rxnfc,
 2865                                  (void *)(&rxnfc->fs.m_ext + 1) -
 2866                                  (void *)rxnfc) ||
 2867                     copy_in_user(&rxnfc->fs.ring_cookie,
 2868                                  &compat_rxnfc->fs.ring_cookie,
 2869                                  (void *)(&rxnfc->fs.location + 1) -
 2870                                  (void *)&rxnfc->fs.ring_cookie) ||
 2871                     copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
 2872                                  sizeof(rxnfc->rule_cnt)))
 2873                         return -EFAULT;
 2874         }
 2875 
 2876         ret = dev_ioctl(net, SIOCETHTOOL, ifr);
 2877         if (ret)
 2878                 return ret;
 2879 
 2880         if (convert_out) {
 2881                 if (copy_in_user(compat_rxnfc, rxnfc,
 2882                                  (const void *)(&rxnfc->fs.m_ext + 1) -
 2883                                  (const void *)rxnfc) ||
 2884                     copy_in_user(&compat_rxnfc->fs.ring_cookie,
 2885                                  &rxnfc->fs.ring_cookie,
 2886                                  (const void *)(&rxnfc->fs.location + 1) -
 2887                                  (const void *)&rxnfc->fs.ring_cookie) ||
 2888                     copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
 2889                                  sizeof(rxnfc->rule_cnt)))
 2890                         return -EFAULT;
 2891 
 2892                 if (ethcmd == ETHTOOL_GRXCLSRLALL) {
 2893                         /* As an optimisation, we only copy the actual
 2894                          * number of rules that the underlying
 2895                          * function returned.  Since Mallory might
 2896                          * change the rule count in user memory, we
 2897                          * check that it is less than the rule count
 2898                          * originally given (as the user buffer size),
 2899                          * which has been range-checked.
 2900                          */
 2901                         if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
 2902                                 return -EFAULT;
 2903                         if (actual_rule_cnt < rule_cnt)
 2904                                 rule_cnt = actual_rule_cnt;
 2905                         if (copy_in_user(&compat_rxnfc->rule_locs[0],
 2906                                          &rxnfc->rule_locs[0],
 2907                                          rule_cnt * sizeof(u32)))
 2908                                 return -EFAULT;
 2909                 }
 2910         }
 2911 
 2912         return 0;
 2913 }
 2914 
 2915 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
 2916 {
 2917         void __user *uptr;
 2918         compat_uptr_t uptr32;
 2919         struct ifreq __user *uifr;
 2920 
 2921         uifr = compat_alloc_user_space(sizeof(*uifr));
 2922         if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
 2923                 return -EFAULT;
 2924 
 2925         if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
 2926                 return -EFAULT;
 2927 
 2928         uptr = compat_ptr(uptr32);
 2929 
 2930         if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
 2931                 return -EFAULT;
 2932 
 2933         return dev_ioctl(net, SIOCWANDEV, uifr);
 2934 }
 2935 
 2936 static int bond_ioctl(struct net *net, unsigned int cmd,
 2937                          struct compat_ifreq __user *ifr32)
 2938 {
 2939         struct ifreq kifr;
 2940         struct ifreq __user *uifr;
 2941         mm_segment_t old_fs;
 2942         int err;
 2943         u32 data;
 2944         void __user *datap;
 2945 
 2946         switch (cmd) {
 2947         case SIOCBONDENSLAVE:
 2948         case SIOCBONDRELEASE:
 2949         case SIOCBONDSETHWADDR:
 2950         case SIOCBONDCHANGEACTIVE:
 2951                 if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
 2952                         return -EFAULT;
 2953 
 2954                 old_fs = get_fs();
 2955                 set_fs(KERNEL_DS);
 2956                 err = dev_ioctl(net, cmd,
 2957                                 (struct ifreq __user __force *) &kifr);
 2958                 set_fs(old_fs);
 2959 
 2960                 return err;
 2961         case SIOCBONDSLAVEINFOQUERY:
 2962         case SIOCBONDINFOQUERY:
 2963                 uifr = compat_alloc_user_space(sizeof(*uifr));
 2964                 if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
 2965                         return -EFAULT;
 2966 
 2967                 if (get_user(data, &ifr32->ifr_ifru.ifru_data))
 2968                         return -EFAULT;
 2969 
 2970                 datap = compat_ptr(data);
 2971                 if (put_user(datap, &uifr->ifr_ifru.ifru_data))
 2972                         return -EFAULT;
 2973 
 2974                 return dev_ioctl(net, cmd, uifr);
 2975         default:
 2976                 return -ENOIOCTLCMD;
 2977         }
 2978 }
 2979 
 2980 static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
 2981                                  struct compat_ifreq __user *u_ifreq32)
 2982 {
 2983         struct ifreq __user *u_ifreq64;
 2984         char tmp_buf[IFNAMSIZ];
 2985         void __user *data64;
 2986         u32 data32;
 2987 
 2988         if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
 2989                            IFNAMSIZ))
 2990                 return -EFAULT;
 2991         if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
 2992                 return -EFAULT;
 2993         data64 = compat_ptr(data32);
 2994 
 2995         u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
 2996 
 2997         /* Don't check these user accesses, just let that get trapped
 2998          * in the ioctl handler instead.
 2999          */
 3000         if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
 3001                          IFNAMSIZ))
 3002                 return -EFAULT;
 3003         if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
 3004                 return -EFAULT;
 3005 
 3006         return dev_ioctl(net, cmd, u_ifreq64);
 3007 }
 3008 
 3009 static int dev_ifsioc(struct net *net, struct socket *sock,
 3010                          unsigned int cmd, struct compat_ifreq __user *uifr32)
 3011 {
 3012         struct ifreq __user *uifr;
 3013         int err;
 3014 
 3015         uifr = compat_alloc_user_space(sizeof(*uifr));
 3016         if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
 3017                 return -EFAULT;
 3018 
 3019         err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
 3020 
 3021         if (!err) {
 3022                 switch (cmd) {
 3023                 case SIOCGIFFLAGS:
 3024                 case SIOCGIFMETRIC:
 3025                 case SIOCGIFMTU:
 3026                 case SIOCGIFMEM:
 3027                 case SIOCGIFHWADDR:
 3028                 case SIOCGIFINDEX:
 3029                 case SIOCGIFADDR:
 3030                 case SIOCGIFBRDADDR:
 3031                 case SIOCGIFDSTADDR:
 3032                 case SIOCGIFNETMASK:
 3033                 case SIOCGIFPFLAGS:
 3034                 case SIOCGIFTXQLEN:
 3035                 case SIOCGMIIPHY:
 3036                 case SIOCGMIIREG:
 3037                         if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
 3038                                 err = -EFAULT;
 3039                         break;
 3040                 }
 3041         }
 3042         return err;
 3043 }
 3044 
 3045 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
 3046                         struct compat_ifreq __user *uifr32)
 3047 {
 3048         struct ifreq ifr;
 3049         struct compat_ifmap __user *uifmap32;
 3050         mm_segment_t old_fs;
 3051         int err;
 3052 
 3053         uifmap32 = &uifr32->ifr_ifru.ifru_map;
 3054         err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
 3055         err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
 3056         err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
 3057         err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
 3058         err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
 3059         err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
 3060         err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
 3061         if (err)
 3062                 return -EFAULT;
 3063 
 3064         old_fs = get_fs();
 3065         set_fs(KERNEL_DS);
 3066         err = dev_ioctl(net, cmd, (void  __user __force *)&ifr);
 3067         set_fs(old_fs);
 3068 
 3069         if (cmd == SIOCGIFMAP && !err) {
 3070                 err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
 3071                 err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
 3072                 err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
 3073                 err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
 3074                 err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
 3075                 err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
 3076                 err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
 3077                 if (err)
 3078                         err = -EFAULT;
 3079         }
 3080         return err;
 3081 }
 3082 
 3083 static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
 3084 {
 3085         void __user *uptr;
 3086         compat_uptr_t uptr32;
 3087         struct ifreq __user *uifr;
 3088 
 3089         uifr = compat_alloc_user_space(sizeof(*uifr));
 3090         if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
 3091                 return -EFAULT;
 3092 
 3093         if (get_user(uptr32, &uifr32->ifr_data))
 3094                 return -EFAULT;
 3095 
 3096         uptr = compat_ptr(uptr32);
 3097 
 3098         if (put_user(uptr, &uifr->ifr_data))
 3099                 return -EFAULT;
 3100 
 3101         return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
 3102 }
 3103 
 3104 struct rtentry32 {
 3105         u32             rt_pad1;
 3106         struct sockaddr rt_dst;         /* target address               */
 3107         struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
 3108         struct sockaddr rt_genmask;     /* target network mask (IP)     */
 3109         unsigned short  rt_flags;
 3110         short           rt_pad2;
 3111         u32             rt_pad3;
 3112         unsigned char   rt_tos;
 3113         unsigned char   rt_class;
 3114         short           rt_pad4;
 3115         short           rt_metric;      /* +1 for binary compatibility! */
 3116         /* char * */ u32 rt_dev;        /* forcing the device at add    */
 3117         u32             rt_mtu;         /* per route MTU/Window         */
 3118         u32             rt_window;      /* Window clamping              */
 3119         unsigned short  rt_irtt;        /* Initial RTT                  */
 3120 };
 3121 
 3122 struct in6_rtmsg32 {
 3123         struct in6_addr         rtmsg_dst;
 3124         struct in6_addr         rtmsg_src;
 3125         struct in6_addr         rtmsg_gateway;
 3126         u32                     rtmsg_type;
 3127         u16                     rtmsg_dst_len;
 3128         u16                     rtmsg_src_len;
 3129         u32                     rtmsg_metric;
 3130         u32                     rtmsg_info;
 3131         u32                     rtmsg_flags;
 3132         s32                     rtmsg_ifindex;
 3133 };
 3134 
 3135 static int routing_ioctl(struct net *net, struct socket *sock,
 3136                          unsigned int cmd, void __user *argp)
 3137 {
 3138         int ret;
 3139         void *r = NULL;
 3140         struct in6_rtmsg r6;
 3141         struct rtentry r4;
 3142         char devname[16];
 3143         u32 rtdev;
 3144         mm_segment_t old_fs = get_fs();
 3145 
 3146         if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
 3147                 struct in6_rtmsg32 __user *ur6 = argp;
 3148                 ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
 3149                         3 * sizeof(struct in6_addr));
 3150                 ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
 3151                 ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
 3152                 ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
 3153                 ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
 3154                 ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
 3155                 ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
 3156                 ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
 3157 
 3158                 r = (void *) &r6;
 3159         } else { /* ipv4 */
 3160                 struct rtentry32 __user *ur4 = argp;
 3161                 ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
 3162                                         3 * sizeof(struct sockaddr));
 3163                 ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
 3164                 ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
 3165                 ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
 3166                 ret |= __get_user(r4.rt_window, &(ur4->rt_window));
 3167                 ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
 3168                 ret |= __get_user(rtdev, &(ur4->rt_dev));
 3169                 if (rtdev) {
 3170                         ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
 3171                         r4.rt_dev = (char __user __force *)devname;
 3172                         devname[15] = 0;
 3173                 } else
 3174                         r4.rt_dev = NULL;
 3175 
 3176                 r = (void *) &r4;
 3177         }
 3178 
 3179         if (ret) {
 3180                 ret = -EFAULT;
 3181                 goto out;
 3182         }
 3183 
 3184         set_fs(KERNEL_DS);
 3185         ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
 3186         set_fs(old_fs);
 3187 
 3188 out:
 3189         return ret;
 3190 }
 3191 
 3192 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
 3193  * for some operations; this forces use of the newer bridge-utils that
 3194  * use compatible ioctls
 3195  */
 3196 static int old_bridge_ioctl(compat_ulong_t __user *argp)
 3197 {
 3198         compat_ulong_t tmp;
 3199 
 3200         if (get_user(tmp, argp))
 3201                 return -EFAULT;
 3202         if (tmp == BRCTL_GET_VERSION)
 3203                 return BRCTL_VERSION + 1;
 3204         return -EINVAL;
 3205 }
 3206 
 3207 static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
 3208                          unsigned int cmd, unsigned long arg)
 3209 {
 3210         void __user *argp = compat_ptr(arg);
 3211         struct sock *sk = sock->sk;
 3212         struct net *net = sock_net(sk);
 3213 
 3214         if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
 3215                 return siocdevprivate_ioctl(net, cmd, argp);
 3216 
 3217         switch (cmd) {
 3218         case SIOCSIFBR:
 3219         case SIOCGIFBR:
 3220                 return old_bridge_ioctl(argp);
 3221         case SIOCGIFNAME:
 3222                 return dev_ifname32(net, argp);
 3223         case SIOCGIFCONF:
 3224                 return dev_ifconf(net, argp);
 3225         case SIOCETHTOOL:
 3226                 return ethtool_ioctl(net, argp);
 3227         case SIOCWANDEV:
 3228                 return compat_siocwandev(net, argp);
 3229         case SIOCGIFMAP:
 3230         case SIOCSIFMAP:
 3231                 return compat_sioc_ifmap(net, cmd, argp);
 3232         case SIOCBONDENSLAVE:
 3233         case SIOCBONDRELEASE:
 3234         case SIOCBONDSETHWADDR:
 3235         case SIOCBONDSLAVEINFOQUERY:
 3236         case SIOCBONDINFOQUERY:
 3237         case SIOCBONDCHANGEACTIVE:
 3238                 return bond_ioctl(net, cmd, argp);
 3239         case SIOCADDRT:
 3240         case SIOCDELRT:
 3241                 return routing_ioctl(net, sock, cmd, argp);
 3242         case SIOCGSTAMP:
 3243                 return do_siocgstamp(net, sock, cmd, argp);
 3244         case SIOCGSTAMPNS:
 3245                 return do_siocgstampns(net, sock, cmd, argp);
 3246         case SIOCSHWTSTAMP:
 3247                 return compat_siocshwtstamp(net, argp);
 3248 
 3249         case FIOSETOWN:
 3250         case SIOCSPGRP:
 3251         case FIOGETOWN:
 3252         case SIOCGPGRP:
 3253         case SIOCBRADDBR:
 3254         case SIOCBRDELBR:
 3255         case SIOCGIFVLAN:
 3256         case SIOCSIFVLAN:
 3257         case SIOCADDDLCI:
 3258         case SIOCDELDLCI:
 3259                 return sock_ioctl(file, cmd, arg);
 3260 
 3261         case SIOCGIFFLAGS:
 3262         case SIOCSIFFLAGS:
 3263         case SIOCGIFMETRIC:
 3264         case SIOCSIFMETRIC:
 3265         case SIOCGIFMTU:
 3266         case SIOCSIFMTU:
 3267         case SIOCGIFMEM:
 3268         case SIOCSIFMEM:
 3269         case SIOCGIFHWADDR:
 3270         case SIOCSIFHWADDR:
 3271         case SIOCADDMULTI:
 3272         case SIOCDELMULTI:
 3273         case SIOCGIFINDEX:
 3274         case SIOCGIFADDR:
 3275         case SIOCSIFADDR:
 3276         case SIOCSIFHWBROADCAST:
 3277         case SIOCDIFADDR:
 3278         case SIOCGIFBRDADDR:
 3279         case SIOCSIFBRDADDR:
 3280         case SIOCGIFDSTADDR:
 3281         case SIOCSIFDSTADDR:
 3282         case SIOCGIFNETMASK:
 3283         case SIOCSIFNETMASK:
 3284         case SIOCSIFPFLAGS:
 3285         case SIOCGIFPFLAGS:
 3286         case SIOCGIFTXQLEN:
 3287         case SIOCSIFTXQLEN:
 3288         case SIOCBRADDIF:
 3289         case SIOCBRDELIF:
 3290         case SIOCSIFNAME:
 3291         case SIOCGMIIPHY:
 3292         case SIOCGMIIREG:
 3293         case SIOCSMIIREG:
 3294                 return dev_ifsioc(net, sock, cmd, argp);
 3295 
 3296         case SIOCSARP:
 3297         case SIOCGARP:
 3298         case SIOCDARP:
 3299         case SIOCATMARK:
 3300                 return sock_do_ioctl(net, sock, cmd, arg);
 3301         }
 3302 
 3303         return -ENOIOCTLCMD;
 3304 }
 3305 
 3306 static long compat_sock_ioctl(struct file *file, unsigned int cmd,
 3307                               unsigned long arg)
 3308 {
 3309         struct socket *sock = file->private_data;
 3310         int ret = -ENOIOCTLCMD;
 3311         struct sock *sk;
 3312         struct net *net;
 3313 
 3314         sk = sock->sk;
 3315         net = sock_net(sk);
 3316 
 3317         if (sock->ops->compat_ioctl)
 3318                 ret = sock->ops->compat_ioctl(sock, cmd, arg);
 3319 
 3320         if (ret == -ENOIOCTLCMD &&
 3321             (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
 3322                 ret = compat_wext_handle_ioctl(net, cmd, arg);
 3323 
 3324         if (ret == -ENOIOCTLCMD)
 3325                 ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
 3326 
 3327         return ret;
 3328 }
 3329 #endif
 3330 
 3331 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
 3332 {
 3333         return sock->ops->bind(sock, addr, addrlen);
 3334 }
 3335 EXPORT_SYMBOL(kernel_bind);
 3336 
 3337 int kernel_listen(struct socket *sock, int backlog)
 3338 {
 3339         return sock->ops->listen(sock, backlog);
 3340 }
 3341 EXPORT_SYMBOL(kernel_listen);
 3342 
 3343 int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
 3344 {
 3345         struct sock *sk = sock->sk;
 3346         int err;
 3347 
 3348         err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
 3349                                newsock);
 3350         if (err < 0)
 3351                 goto done;
 3352 
 3353         err = sock->ops->accept(sock, *newsock, flags);
 3354         if (err < 0) {
 3355                 sock_release(*newsock);
 3356                 *newsock = NULL;
 3357                 goto done;
 3358         }
 3359 
 3360         (*newsock)->ops = sock->ops;
 3361         __module_get((*newsock)->ops->owner);
 3362 
 3363 done:
 3364         return err;
 3365 }
 3366 EXPORT_SYMBOL(kernel_accept);
 3367 
 3368 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
 3369                    int flags)
 3370 {
 3371         return sock->ops->connect(sock, addr, addrlen, flags);
 3372 }
 3373 EXPORT_SYMBOL(kernel_connect);
 3374 
 3375 int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
 3376                          int *addrlen)
 3377 {
 3378         return sock->ops->getname(sock, addr, addrlen, 0);
 3379 }
 3380 EXPORT_SYMBOL(kernel_getsockname);
 3381 
 3382 int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
 3383                          int *addrlen)
 3384 {
 3385         return sock->ops->getname(sock, addr, addrlen, 1);
 3386 }
 3387 EXPORT_SYMBOL(kernel_getpeername);
 3388 
 3389 int kernel_getsockopt(struct socket *sock, int level, int optname,
 3390                         char *optval, int *optlen)
 3391 {
 3392         mm_segment_t oldfs = get_fs();
 3393         char __user *uoptval;
 3394         int __user *uoptlen;
 3395         int err;
 3396 
 3397         uoptval = (char __user __force *) optval;
 3398         uoptlen = (int __user __force *) optlen;
 3399 
 3400         set_fs(KERNEL_DS);
 3401         if (level == SOL_SOCKET)
 3402                 err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
 3403         else
 3404                 err = sock->ops->getsockopt(sock, level, optname, uoptval,
 3405                                             uoptlen);
 3406         set_fs(oldfs);
 3407         return err;
 3408 }
 3409 EXPORT_SYMBOL(kernel_getsockopt);
 3410 
 3411 int kernel_setsockopt(struct socket *sock, int level, int optname,
 3412                         char *optval, unsigned int optlen)
 3413 {
 3414         mm_segment_t oldfs = get_fs();
 3415         char __user *uoptval;
 3416         int err;
 3417 
 3418         uoptval = (char __user __force *) optval;
 3419 
 3420         set_fs(KERNEL_DS);
 3421         if (level == SOL_SOCKET)
 3422                 err = sock_setsockopt(sock, level, optname, uoptval, optlen);
 3423         else
 3424                 err = sock->ops->setsockopt(sock, level, optname, uoptval,
 3425                                             optlen);
 3426         set_fs(oldfs);
 3427         return err;
 3428 }
 3429 EXPORT_SYMBOL(kernel_setsockopt);
 3430 
 3431 int kernel_sendpage(struct socket *sock, struct page *page, int offset,
 3432                     size_t size, int flags)
 3433 {
 3434         if (sock->ops->sendpage)
 3435                 return sock->ops->sendpage(sock, page, offset, size, flags);
 3436 
 3437         return sock_no_sendpage(sock, page, offset, size, flags);
 3438 }
 3439 EXPORT_SYMBOL(kernel_sendpage);
 3440 
 3441 int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
 3442 {
 3443         mm_segment_t oldfs = get_fs();
 3444         int err;
 3445 
 3446         set_fs(KERNEL_DS);
 3447         err = sock->ops->ioctl(sock, cmd, arg);
 3448         set_fs(oldfs);
 3449 
 3450         return err;
 3451 }
 3452 EXPORT_SYMBOL(kernel_sock_ioctl);
 3453 
 3454 int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
 3455 {
 3456         return sock->ops->shutdown(sock, how);
 3457 }
 3458 EXPORT_SYMBOL(kernel_sock_shutdown);

Cache object: ca616c451c27935185ad75e015cca935


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.