Root/net/socket.c

1/*
2 * NET An implementation of the SOCKET network access protocol.
3 *
4 * Version: @(#)socket.c 1.1.93 18/02/95
5 *
6 * Authors: Orest Zborowski, <obz@Kodak.COM>
7 * Ross Biro
8 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
9 *
10 * Fixes:
11 * Anonymous : NOTSOCK/BADF cleanup. Error fix in
12 * shutdown()
13 * Alan Cox : verify_area() fixes
14 * Alan Cox : Removed DDI
15 * Jonathan Kamens : SOCK_DGRAM reconnect bug
16 * Alan Cox : Moved a load of checks to the very
17 * top level.
18 * Alan Cox : Move address structures to/from user
19 * mode above the protocol layers.
20 * Rob Janssen : Allow 0 length sends.
21 * Alan Cox : Asynchronous I/O support (cribbed from the
22 * tty drivers).
23 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24 * Jeff Uphoff : Made max number of sockets command-line
25 * configurable.
26 * Matti Aarnio : Made the number of sockets dynamic,
27 * to be allocated when needed, and mr.
28 * Uphoff's max is used as max to be
29 * allowed to allocate.
30 * Linus : Argh. removed all the socket allocation
31 * altogether: it's in the inode now.
32 * Alan Cox : Made sock_alloc()/sock_release() public
33 * for NetROM and future kernel nfsd type
34 * stuff.
35 * Alan Cox : sendmsg/recvmsg basics.
36 * Tom Dyas : Export net symbols.
37 * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38 * Alan Cox : Added thread locking to sys_* calls
39 * for sockets. May have errors at the
40 * moment.
41 * Kevin Buhr : Fixed the dumb errors in the above.
42 * Andi Kleen : Some small cleanups, optimizations,
43 * and fixed a copy_from_user() bug.
44 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
45 * Tigran Aivazian : Made listen(2) backlog sanity checks
46 * protocol-independent
47 *
48 *
49 * This program is free software; you can redistribute it and/or
50 * modify it under the terms of the GNU General Public License
51 * as published by the Free Software Foundation; either version
52 * 2 of the License, or (at your option) any later version.
53 *
54 *
55 * This module is effectively the top level interface to the BSD socket
56 * paradigm.
57 *
58 * Based upon Swansea University Computer Society NET3.039
59 */
60
61#include <linux/mm.h>
62#include <linux/socket.h>
63#include <linux/file.h>
64#include <linux/net.h>
65#include <linux/interrupt.h>
66#include <linux/thread_info.h>
67#include <linux/rcupdate.h>
68#include <linux/netdevice.h>
69#include <linux/proc_fs.h>
70#include <linux/seq_file.h>
71#include <linux/mutex.h>
72#include <linux/wanrouter.h>
73#include <linux/if_bridge.h>
74#include <linux/if_frad.h>
75#include <linux/if_vlan.h>
76#include <linux/init.h>
77#include <linux/poll.h>
78#include <linux/cache.h>
79#include <linux/module.h>
80#include <linux/highmem.h>
81#include <linux/mount.h>
82#include <linux/security.h>
83#include <linux/syscalls.h>
84#include <linux/compat.h>
85#include <linux/kmod.h>
86#include <linux/audit.h>
87#include <linux/wireless.h>
88#include <linux/nsproxy.h>
89#include <linux/magic.h>
90#include <linux/slab.h>
91
92#include <asm/uaccess.h>
93#include <asm/unistd.h>
94
95#include <net/compat.h>
96#include <net/wext.h>
97#include <net/cls_cgroup.h>
98
99#include <net/sock.h>
100#include <linux/netfilter.h>
101
102#include <linux/if_tun.h>
103#include <linux/ipv6_route.h>
104#include <linux/route.h>
105#include <linux/sockios.h>
106#include <linux/atalk.h>
107
108static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
109static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
110             unsigned long nr_segs, loff_t pos);
111static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
112              unsigned long nr_segs, loff_t pos);
113static int sock_mmap(struct file *file, struct vm_area_struct *vma);
114
115static int sock_close(struct inode *inode, struct file *file);
116static unsigned int sock_poll(struct file *file,
117                  struct poll_table_struct *wait);
118static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
119#ifdef CONFIG_COMPAT
120static long compat_sock_ioctl(struct file *file,
121                  unsigned int cmd, unsigned long arg);
122#endif
123static int sock_fasync(int fd, struct file *filp, int on);
124static ssize_t sock_sendpage(struct file *file, struct page *page,
125                 int offset, size_t size, loff_t *ppos, int more);
126static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
127                struct pipe_inode_info *pipe, size_t len,
128                unsigned int flags);
129
130/*
131 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
132 * in the operation structures but are done directly via the socketcall() multiplexor.
133 */
134
135static const struct file_operations socket_file_ops = {
136    .owner = THIS_MODULE,
137    .llseek = no_llseek,
138    .aio_read = sock_aio_read,
139    .aio_write = sock_aio_write,
140    .poll = sock_poll,
141    .unlocked_ioctl = sock_ioctl,
142#ifdef CONFIG_COMPAT
143    .compat_ioctl = compat_sock_ioctl,
144#endif
145    .mmap = sock_mmap,
146    .open = sock_no_open, /* special open code to disallow open via /proc */
147    .release = sock_close,
148    .fasync = sock_fasync,
149    .sendpage = sock_sendpage,
150    .splice_write = generic_splice_sendpage,
151    .splice_read = sock_splice_read,
152};
153
154/*
155 * The protocol list. Each protocol is registered in here.
156 */
157
158static DEFINE_SPINLOCK(net_family_lock);
159static const struct net_proto_family *net_families[NPROTO] __read_mostly;
160
161/*
162 * Statistics counters of the socket lists
163 */
164
165static DEFINE_PER_CPU(int, sockets_in_use);
166
167/*
168 * Support routines.
169 * Move socket addresses back and forth across the kernel/user
170 * divide and look after the messy bits.
171 */
172
173/**
174 * move_addr_to_kernel - copy a socket address into kernel space
175 * @uaddr: Address in user space
176 * @kaddr: Address in kernel space
177 * @ulen: Length in user space
178 *
179 * The address is copied into kernel space. If the provided address is
180 * too long an error code of -EINVAL is returned. If the copy gives
181 * invalid addresses -EFAULT is returned. On a success 0 is returned.
182 */
183
184int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr *kaddr)
185{
186    if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
187        return -EINVAL;
188    if (ulen == 0)
189        return 0;
190    if (copy_from_user(kaddr, uaddr, ulen))
191        return -EFAULT;
192    return audit_sockaddr(ulen, kaddr);
193}
194
195/**
196 * move_addr_to_user - copy an address to user space
197 * @kaddr: kernel space address
198 * @klen: length of address in kernel
199 * @uaddr: user space address
200 * @ulen: pointer to user length field
201 *
202 * The value pointed to by ulen on entry is the buffer length available.
203 * This is overwritten with the buffer space used. -EINVAL is returned
204 * if an overlong buffer is specified or a negative buffer size. -EFAULT
205 * is returned if either the buffer or the length field are not
206 * accessible.
207 * After copying the data up to the limit the user specifies, the true
208 * length of the data is written over the length limit the user
209 * specified. Zero is returned for a success.
210 */
211
212int move_addr_to_user(struct sockaddr *kaddr, int klen, void __user *uaddr,
213              int __user *ulen)
214{
215    int err;
216    int len;
217
218    err = get_user(len, ulen);
219    if (err)
220        return err;
221    if (len > klen)
222        len = klen;
223    if (len < 0 || len > sizeof(struct sockaddr_storage))
224        return -EINVAL;
225    if (len) {
226        if (audit_sockaddr(klen, kaddr))
227            return -ENOMEM;
228        if (copy_to_user(uaddr, kaddr, len))
229            return -EFAULT;
230    }
231    /*
232     * "fromlen shall refer to the value before truncation.."
233     * 1003.1g
234     */
235    return __put_user(klen, ulen);
236}
237
238static struct kmem_cache *sock_inode_cachep __read_mostly;
239
240static struct inode *sock_alloc_inode(struct super_block *sb)
241{
242    struct socket_alloc *ei;
243
244    ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
245    if (!ei)
246        return NULL;
247    ei->socket.wq = kmalloc(sizeof(struct socket_wq), GFP_KERNEL);
248    if (!ei->socket.wq) {
249        kmem_cache_free(sock_inode_cachep, ei);
250        return NULL;
251    }
252    init_waitqueue_head(&ei->socket.wq->wait);
253    ei->socket.wq->fasync_list = NULL;
254
255    ei->socket.state = SS_UNCONNECTED;
256    ei->socket.flags = 0;
257    ei->socket.ops = NULL;
258    ei->socket.sk = NULL;
259    ei->socket.file = NULL;
260
261    return &ei->vfs_inode;
262}
263
264
265static void wq_free_rcu(struct rcu_head *head)
266{
267    struct socket_wq *wq = container_of(head, struct socket_wq, rcu);
268
269    kfree(wq);
270}
271
272static void sock_destroy_inode(struct inode *inode)
273{
274    struct socket_alloc *ei;
275
276    ei = container_of(inode, struct socket_alloc, vfs_inode);
277    call_rcu(&ei->socket.wq->rcu, wq_free_rcu);
278    kmem_cache_free(sock_inode_cachep, ei);
279}
280
281static void init_once(void *foo)
282{
283    struct socket_alloc *ei = (struct socket_alloc *)foo;
284
285    inode_init_once(&ei->vfs_inode);
286}
287
288static int init_inodecache(void)
289{
290    sock_inode_cachep = kmem_cache_create("sock_inode_cache",
291                          sizeof(struct socket_alloc),
292                          0,
293                          (SLAB_HWCACHE_ALIGN |
294                           SLAB_RECLAIM_ACCOUNT |
295                           SLAB_MEM_SPREAD),
296                          init_once);
297    if (sock_inode_cachep == NULL)
298        return -ENOMEM;
299    return 0;
300}
301
302static const struct super_operations sockfs_ops = {
303    .alloc_inode = sock_alloc_inode,
304    .destroy_inode = sock_destroy_inode,
305    .statfs = simple_statfs,
306};
307
308static int sockfs_get_sb(struct file_system_type *fs_type,
309             int flags, const char *dev_name, void *data,
310             struct vfsmount *mnt)
311{
312    return get_sb_pseudo(fs_type, "socket:", &sockfs_ops, SOCKFS_MAGIC,
313                 mnt);
314}
315
316static struct vfsmount *sock_mnt __read_mostly;
317
318static struct file_system_type sock_fs_type = {
319    .name = "sockfs",
320    .get_sb = sockfs_get_sb,
321    .kill_sb = kill_anon_super,
322};
323
324/*
325 * sockfs_dname() is called from d_path().
326 */
327static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
328{
329    return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
330                dentry->d_inode->i_ino);
331}
332
333static const struct dentry_operations sockfs_dentry_operations = {
334    .d_dname = sockfs_dname,
335};
336
337/*
338 * Obtains the first available file descriptor and sets it up for use.
339 *
340 * These functions create file structures and maps them to fd space
341 * of the current process. On success it returns file descriptor
342 * and file struct implicitly stored in sock->file.
343 * Note that another thread may close file descriptor before we return
344 * from this function. We use the fact that now we do not refer
345 * to socket after mapping. If one day we will need it, this
346 * function will increment ref. count on file by 1.
347 *
348 * In any case returned fd MAY BE not valid!
349 * This race condition is unavoidable
350 * with shared fd spaces, we cannot solve it inside kernel,
351 * but we take care of internal coherence yet.
352 */
353
354static int sock_alloc_file(struct socket *sock, struct file **f, int flags)
355{
356    struct qstr name = { .name = "" };
357    struct path path;
358    struct file *file;
359    int fd;
360
361    fd = get_unused_fd_flags(flags);
362    if (unlikely(fd < 0))
363        return fd;
364
365    path.dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
366    if (unlikely(!path.dentry)) {
367        put_unused_fd(fd);
368        return -ENOMEM;
369    }
370    path.mnt = mntget(sock_mnt);
371
372    path.dentry->d_op = &sockfs_dentry_operations;
373    d_instantiate(path.dentry, SOCK_INODE(sock));
374    SOCK_INODE(sock)->i_fop = &socket_file_ops;
375
376    file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
377          &socket_file_ops);
378    if (unlikely(!file)) {
379        /* drop dentry, keep inode */
380        atomic_inc(&path.dentry->d_inode->i_count);
381        path_put(&path);
382        put_unused_fd(fd);
383        return -ENFILE;
384    }
385
386    sock->file = file;
387    file->f_flags = O_RDWR | (flags & O_NONBLOCK);
388    file->f_pos = 0;
389    file->private_data = sock;
390
391    *f = file;
392    return fd;
393}
394
395int sock_map_fd(struct socket *sock, int flags)
396{
397    struct file *newfile;
398    int fd = sock_alloc_file(sock, &newfile, flags);
399
400    if (likely(fd >= 0))
401        fd_install(fd, newfile);
402
403    return fd;
404}
405EXPORT_SYMBOL(sock_map_fd);
406
407static struct socket *sock_from_file(struct file *file, int *err)
408{
409    if (file->f_op == &socket_file_ops)
410        return file->private_data; /* set in sock_map_fd */
411
412    *err = -ENOTSOCK;
413    return NULL;
414}
415
416/**
417 * sockfd_lookup - Go from a file number to its socket slot
418 * @fd: file handle
419 * @err: pointer to an error code return
420 *
421 * The file handle passed in is locked and the socket it is bound
422 * too is returned. If an error occurs the err pointer is overwritten
423 * with a negative errno code and NULL is returned. The function checks
424 * for both invalid handles and passing a handle which is not a socket.
425 *
426 * On a success the socket object pointer is returned.
427 */
428
429struct socket *sockfd_lookup(int fd, int *err)
430{
431    struct file *file;
432    struct socket *sock;
433
434    file = fget(fd);
435    if (!file) {
436        *err = -EBADF;
437        return NULL;
438    }
439
440    sock = sock_from_file(file, err);
441    if (!sock)
442        fput(file);
443    return sock;
444}
445EXPORT_SYMBOL(sockfd_lookup);
446
447static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
448{
449    struct file *file;
450    struct socket *sock;
451
452    *err = -EBADF;
453    file = fget_light(fd, fput_needed);
454    if (file) {
455        sock = sock_from_file(file, err);
456        if (sock)
457            return sock;
458        fput_light(file, *fput_needed);
459    }
460    return NULL;
461}
462
463/**
464 * sock_alloc - allocate a socket
465 *
466 * Allocate a new inode and socket object. The two are bound together
467 * and initialised. The socket is then returned. If we are out of inodes
468 * NULL is returned.
469 */
470
471static struct socket *sock_alloc(void)
472{
473    struct inode *inode;
474    struct socket *sock;
475
476    inode = new_inode(sock_mnt->mnt_sb);
477    if (!inode)
478        return NULL;
479
480    sock = SOCKET_I(inode);
481
482    kmemcheck_annotate_bitfield(sock, type);
483    inode->i_mode = S_IFSOCK | S_IRWXUGO;
484    inode->i_uid = current_fsuid();
485    inode->i_gid = current_fsgid();
486
487    percpu_add(sockets_in_use, 1);
488    return sock;
489}
490
491/*
492 * In theory you can't get an open on this inode, but /proc provides
493 * a back door. Remember to keep it shut otherwise you'll let the
494 * creepy crawlies in.
495 */
496
497static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
498{
499    return -ENXIO;
500}
501
502const struct file_operations bad_sock_fops = {
503    .owner = THIS_MODULE,
504    .open = sock_no_open,
505};
506
507/**
508 * sock_release - close a socket
509 * @sock: socket to close
510 *
511 * The socket is released from the protocol stack if it has a release
512 * callback, and the inode is then released if the socket is bound to
513 * an inode not a file.
514 */
515
516void sock_release(struct socket *sock)
517{
518    if (sock->ops) {
519        struct module *owner = sock->ops->owner;
520
521        sock->ops->release(sock);
522        sock->ops = NULL;
523        module_put(owner);
524    }
525
526    if (sock->wq->fasync_list)
527        printk(KERN_ERR "sock_release: fasync list not empty!\n");
528
529    percpu_sub(sockets_in_use, 1);
530    if (!sock->file) {
531        iput(SOCK_INODE(sock));
532        return;
533    }
534    sock->file = NULL;
535}
536EXPORT_SYMBOL(sock_release);
537
538int sock_tx_timestamp(struct msghdr *msg, struct sock *sk,
539              union skb_shared_tx *shtx)
540{
541    shtx->flags = 0;
542    if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
543        shtx->hardware = 1;
544    if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
545        shtx->software = 1;
546    return 0;
547}
548EXPORT_SYMBOL(sock_tx_timestamp);
549
550static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
551                 struct msghdr *msg, size_t size)
552{
553    struct sock_iocb *si = kiocb_to_siocb(iocb);
554    int err;
555
556    sock_update_classid(sock->sk);
557
558    si->sock = sock;
559    si->scm = NULL;
560    si->msg = msg;
561    si->size = size;
562
563    err = security_socket_sendmsg(sock, msg, size);
564    if (err)
565        return err;
566
567    return sock->ops->sendmsg(iocb, sock, msg, size);
568}
569
570int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
571{
572    struct kiocb iocb;
573    struct sock_iocb siocb;
574    int ret;
575
576    init_sync_kiocb(&iocb, NULL);
577    iocb.private = &siocb;
578    ret = __sock_sendmsg(&iocb, sock, msg, size);
579    if (-EIOCBQUEUED == ret)
580        ret = wait_on_sync_kiocb(&iocb);
581    return ret;
582}
583EXPORT_SYMBOL(sock_sendmsg);
584
585int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
586           struct kvec *vec, size_t num, size_t size)
587{
588    mm_segment_t oldfs = get_fs();
589    int result;
590
591    set_fs(KERNEL_DS);
592    /*
593     * the following is safe, since for compiler definitions of kvec and
594     * iovec are identical, yielding the same in-core layout and alignment
595     */
596    msg->msg_iov = (struct iovec *)vec;
597    msg->msg_iovlen = num;
598    result = sock_sendmsg(sock, msg, size);
599    set_fs(oldfs);
600    return result;
601}
602EXPORT_SYMBOL(kernel_sendmsg);
603
604static int ktime2ts(ktime_t kt, struct timespec *ts)
605{
606    if (kt.tv64) {
607        *ts = ktime_to_timespec(kt);
608        return 1;
609    } else {
610        return 0;
611    }
612}
613
614/*
615 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
616 */
617void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
618    struct sk_buff *skb)
619{
620    int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
621    struct timespec ts[3];
622    int empty = 1;
623    struct skb_shared_hwtstamps *shhwtstamps =
624        skb_hwtstamps(skb);
625
626    /* Race occurred between timestamp enabling and packet
627       receiving. Fill in the current time for now. */
628    if (need_software_tstamp && skb->tstamp.tv64 == 0)
629        __net_timestamp(skb);
630
631    if (need_software_tstamp) {
632        if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
633            struct timeval tv;
634            skb_get_timestamp(skb, &tv);
635            put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
636                 sizeof(tv), &tv);
637        } else {
638            skb_get_timestampns(skb, &ts[0]);
639            put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
640                 sizeof(ts[0]), &ts[0]);
641        }
642    }
643
644
645    memset(ts, 0, sizeof(ts));
646    if (skb->tstamp.tv64 &&
647        sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE)) {
648        skb_get_timestampns(skb, ts + 0);
649        empty = 0;
650    }
651    if (shhwtstamps) {
652        if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE) &&
653            ktime2ts(shhwtstamps->syststamp, ts + 1))
654            empty = 0;
655        if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE) &&
656            ktime2ts(shhwtstamps->hwtstamp, ts + 2))
657            empty = 0;
658    }
659    if (!empty)
660        put_cmsg(msg, SOL_SOCKET,
661             SCM_TIMESTAMPING, sizeof(ts), &ts);
662}
663EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
664
665inline void sock_recv_drops(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
666{
667    if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
668        put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
669            sizeof(__u32), &skb->dropcount);
670}
671
672void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
673    struct sk_buff *skb)
674{
675    sock_recv_timestamp(msg, sk, skb);
676    sock_recv_drops(msg, sk, skb);
677}
678EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
679
680static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
681                       struct msghdr *msg, size_t size, int flags)
682{
683    struct sock_iocb *si = kiocb_to_siocb(iocb);
684
685    sock_update_classid(sock->sk);
686
687    si->sock = sock;
688    si->scm = NULL;
689    si->msg = msg;
690    si->size = size;
691    si->flags = flags;
692
693    return sock->ops->recvmsg(iocb, sock, msg, size, flags);
694}
695
696static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
697                 struct msghdr *msg, size_t size, int flags)
698{
699    int err = security_socket_recvmsg(sock, msg, size, flags);
700
701    return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
702}
703
704int sock_recvmsg(struct socket *sock, struct msghdr *msg,
705         size_t size, int flags)
706{
707    struct kiocb iocb;
708    struct sock_iocb siocb;
709    int ret;
710
711    init_sync_kiocb(&iocb, NULL);
712    iocb.private = &siocb;
713    ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
714    if (-EIOCBQUEUED == ret)
715        ret = wait_on_sync_kiocb(&iocb);
716    return ret;
717}
718EXPORT_SYMBOL(sock_recvmsg);
719
720static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
721                  size_t size, int flags)
722{
723    struct kiocb iocb;
724    struct sock_iocb siocb;
725    int ret;
726
727    init_sync_kiocb(&iocb, NULL);
728    iocb.private = &siocb;
729    ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
730    if (-EIOCBQUEUED == ret)
731        ret = wait_on_sync_kiocb(&iocb);
732    return ret;
733}
734
735int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
736           struct kvec *vec, size_t num, size_t size, int flags)
737{
738    mm_segment_t oldfs = get_fs();
739    int result;
740
741    set_fs(KERNEL_DS);
742    /*
743     * the following is safe, since for compiler definitions of kvec and
744     * iovec are identical, yielding the same in-core layout and alignment
745     */
746    msg->msg_iov = (struct iovec *)vec, msg->msg_iovlen = num;
747    result = sock_recvmsg(sock, msg, size, flags);
748    set_fs(oldfs);
749    return result;
750}
751EXPORT_SYMBOL(kernel_recvmsg);
752
753static void sock_aio_dtor(struct kiocb *iocb)
754{
755    kfree(iocb->private);
756}
757
758static ssize_t sock_sendpage(struct file *file, struct page *page,
759                 int offset, size_t size, loff_t *ppos, int more)
760{
761    struct socket *sock;
762    int flags;
763
764    sock = file->private_data;
765
766    flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
767    if (more)
768        flags |= MSG_MORE;
769
770    return kernel_sendpage(sock, page, offset, size, flags);
771}
772
773static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
774                struct pipe_inode_info *pipe, size_t len,
775                unsigned int flags)
776{
777    struct socket *sock = file->private_data;
778
779    if (unlikely(!sock->ops->splice_read))
780        return -EINVAL;
781
782    sock_update_classid(sock->sk);
783
784    return sock->ops->splice_read(sock, ppos, pipe, len, flags);
785}
786
787static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
788                     struct sock_iocb *siocb)
789{
790    if (!is_sync_kiocb(iocb)) {
791        siocb = kmalloc(sizeof(*siocb), GFP_KERNEL);
792        if (!siocb)
793            return NULL;
794        iocb->ki_dtor = sock_aio_dtor;
795    }
796
797    siocb->kiocb = iocb;
798    iocb->private = siocb;
799    return siocb;
800}
801
802static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
803        struct file *file, const struct iovec *iov,
804        unsigned long nr_segs)
805{
806    struct socket *sock = file->private_data;
807    size_t size = 0;
808    int i;
809
810    for (i = 0; i < nr_segs; i++)
811        size += iov[i].iov_len;
812
813    msg->msg_name = NULL;
814    msg->msg_namelen = 0;
815    msg->msg_control = NULL;
816    msg->msg_controllen = 0;
817    msg->msg_iov = (struct iovec *)iov;
818    msg->msg_iovlen = nr_segs;
819    msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
820
821    return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
822}
823
824static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
825                unsigned long nr_segs, loff_t pos)
826{
827    struct sock_iocb siocb, *x;
828
829    if (pos != 0)
830        return -ESPIPE;
831
832    if (iocb->ki_left == 0) /* Match SYS5 behaviour */
833        return 0;
834
835
836    x = alloc_sock_iocb(iocb, &siocb);
837    if (!x)
838        return -ENOMEM;
839    return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
840}
841
842static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
843            struct file *file, const struct iovec *iov,
844            unsigned long nr_segs)
845{
846    struct socket *sock = file->private_data;
847    size_t size = 0;
848    int i;
849
850    for (i = 0; i < nr_segs; i++)
851        size += iov[i].iov_len;
852
853    msg->msg_name = NULL;
854    msg->msg_namelen = 0;
855    msg->msg_control = NULL;
856    msg->msg_controllen = 0;
857    msg->msg_iov = (struct iovec *)iov;
858    msg->msg_iovlen = nr_segs;
859    msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
860    if (sock->type == SOCK_SEQPACKET)
861        msg->msg_flags |= MSG_EOR;
862
863    return __sock_sendmsg(iocb, sock, msg, size);
864}
865
866static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
867              unsigned long nr_segs, loff_t pos)
868{
869    struct sock_iocb siocb, *x;
870
871    if (pos != 0)
872        return -ESPIPE;
873
874    x = alloc_sock_iocb(iocb, &siocb);
875    if (!x)
876        return -ENOMEM;
877
878    return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
879}
880
881/*
882 * Atomic setting of ioctl hooks to avoid race
883 * with module unload.
884 */
885
886static DEFINE_MUTEX(br_ioctl_mutex);
887static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
888
889void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
890{
891    mutex_lock(&br_ioctl_mutex);
892    br_ioctl_hook = hook;
893    mutex_unlock(&br_ioctl_mutex);
894}
895EXPORT_SYMBOL(brioctl_set);
896
897static DEFINE_MUTEX(vlan_ioctl_mutex);
898static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
899
900void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
901{
902    mutex_lock(&vlan_ioctl_mutex);
903    vlan_ioctl_hook = hook;
904    mutex_unlock(&vlan_ioctl_mutex);
905}
906EXPORT_SYMBOL(vlan_ioctl_set);
907
908static DEFINE_MUTEX(dlci_ioctl_mutex);
909static int (*dlci_ioctl_hook) (unsigned int, void __user *);
910
911void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
912{
913    mutex_lock(&dlci_ioctl_mutex);
914    dlci_ioctl_hook = hook;
915    mutex_unlock(&dlci_ioctl_mutex);
916}
917EXPORT_SYMBOL(dlci_ioctl_set);
918
919static long sock_do_ioctl(struct net *net, struct socket *sock,
920                 unsigned int cmd, unsigned long arg)
921{
922    int err;
923    void __user *argp = (void __user *)arg;
924
925    err = sock->ops->ioctl(sock, cmd, arg);
926
927    /*
928     * If this ioctl is unknown try to hand it down
929     * to the NIC driver.
930     */
931    if (err == -ENOIOCTLCMD)
932        err = dev_ioctl(net, cmd, argp);
933
934    return err;
935}
936
937/*
938 * With an ioctl, arg may well be a user mode pointer, but we don't know
939 * what to do with it - that's up to the protocol still.
940 */
941
942static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
943{
944    struct socket *sock;
945    struct sock *sk;
946    void __user *argp = (void __user *)arg;
947    int pid, err;
948    struct net *net;
949
950    sock = file->private_data;
951    sk = sock->sk;
952    net = sock_net(sk);
953    if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
954        err = dev_ioctl(net, cmd, argp);
955    } else
956#ifdef CONFIG_WEXT_CORE
957    if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
958        err = dev_ioctl(net, cmd, argp);
959    } else
960#endif
961        switch (cmd) {
962        case FIOSETOWN:
963        case SIOCSPGRP:
964            err = -EFAULT;
965            if (get_user(pid, (int __user *)argp))
966                break;
967            err = f_setown(sock->file, pid, 1);
968            break;
969        case FIOGETOWN:
970        case SIOCGPGRP:
971            err = put_user(f_getown(sock->file),
972                       (int __user *)argp);
973            break;
974        case SIOCGIFBR:
975        case SIOCSIFBR:
976        case SIOCBRADDBR:
977        case SIOCBRDELBR:
978            err = -ENOPKG;
979            if (!br_ioctl_hook)
980                request_module("bridge");
981
982            mutex_lock(&br_ioctl_mutex);
983            if (br_ioctl_hook)
984                err = br_ioctl_hook(net, cmd, argp);
985            mutex_unlock(&br_ioctl_mutex);
986            break;
987        case SIOCGIFVLAN:
988        case SIOCSIFVLAN:
989            err = -ENOPKG;
990            if (!vlan_ioctl_hook)
991                request_module("8021q");
992
993            mutex_lock(&vlan_ioctl_mutex);
994            if (vlan_ioctl_hook)
995                err = vlan_ioctl_hook(net, argp);
996            mutex_unlock(&vlan_ioctl_mutex);
997            break;
998        case SIOCADDDLCI:
999        case SIOCDELDLCI:
1000            err = -ENOPKG;
1001            if (!dlci_ioctl_hook)
1002                request_module("dlci");
1003
1004            mutex_lock(&dlci_ioctl_mutex);
1005            if (dlci_ioctl_hook)
1006                err = dlci_ioctl_hook(cmd, argp);
1007            mutex_unlock(&dlci_ioctl_mutex);
1008            break;
1009        default:
1010            err = sock_do_ioctl(net, sock, cmd, arg);
1011            break;
1012        }
1013    return err;
1014}
1015
1016int sock_create_lite(int family, int type, int protocol, struct socket **res)
1017{
1018    int err;
1019    struct socket *sock = NULL;
1020
1021    err = security_socket_create(family, type, protocol, 1);
1022    if (err)
1023        goto out;
1024
1025    sock = sock_alloc();
1026    if (!sock) {
1027        err = -ENOMEM;
1028        goto out;
1029    }
1030
1031    sock->type = type;
1032    err = security_socket_post_create(sock, family, type, protocol, 1);
1033    if (err)
1034        goto out_release;
1035
1036out:
1037    *res = sock;
1038    return err;
1039out_release:
1040    sock_release(sock);
1041    sock = NULL;
1042    goto out;
1043}
1044EXPORT_SYMBOL(sock_create_lite);
1045
1046/* No kernel lock held - perfect */
1047static unsigned int sock_poll(struct file *file, poll_table *wait)
1048{
1049    struct socket *sock;
1050
1051    /*
1052     * We can't return errors to poll, so it's either yes or no.
1053     */
1054    sock = file->private_data;
1055    return sock->ops->poll(file, sock, wait);
1056}
1057
1058static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1059{
1060    struct socket *sock = file->private_data;
1061
1062    return sock->ops->mmap(file, sock, vma);
1063}
1064
1065static int sock_close(struct inode *inode, struct file *filp)
1066{
1067    /*
1068     * It was possible the inode is NULL we were
1069     * closing an unfinished socket.
1070     */
1071
1072    if (!inode) {
1073        printk(KERN_DEBUG "sock_close: NULL inode\n");
1074        return 0;
1075    }
1076    sock_release(SOCKET_I(inode));
1077    return 0;
1078}
1079
1080/*
1081 * Update the socket async list
1082 *
1083 * Fasync_list locking strategy.
1084 *
1085 * 1. fasync_list is modified only under process context socket lock
1086 * i.e. under semaphore.
1087 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1088 * or under socket lock
1089 */
1090
1091static int sock_fasync(int fd, struct file *filp, int on)
1092{
1093    struct socket *sock = filp->private_data;
1094    struct sock *sk = sock->sk;
1095
1096    if (sk == NULL)
1097        return -EINVAL;
1098
1099    lock_sock(sk);
1100
1101    fasync_helper(fd, filp, on, &sock->wq->fasync_list);
1102
1103    if (!sock->wq->fasync_list)
1104        sock_reset_flag(sk, SOCK_FASYNC);
1105    else
1106        sock_set_flag(sk, SOCK_FASYNC);
1107
1108    release_sock(sk);
1109    return 0;
1110}
1111
1112/* This function may be called only under socket lock or callback_lock or rcu_lock */
1113
1114int sock_wake_async(struct socket *sock, int how, int band)
1115{
1116    struct socket_wq *wq;
1117
1118    if (!sock)
1119        return -1;
1120    rcu_read_lock();
1121    wq = rcu_dereference(sock->wq);
1122    if (!wq || !wq->fasync_list) {
1123        rcu_read_unlock();
1124        return -1;
1125    }
1126    switch (how) {
1127    case SOCK_WAKE_WAITD:
1128        if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1129            break;
1130        goto call_kill;
1131    case SOCK_WAKE_SPACE:
1132        if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1133            break;
1134        /* fall through */
1135    case SOCK_WAKE_IO:
1136call_kill:
1137        kill_fasync(&wq->fasync_list, SIGIO, band);
1138        break;
1139    case SOCK_WAKE_URG:
1140        kill_fasync(&wq->fasync_list, SIGURG, band);
1141    }
1142    rcu_read_unlock();
1143    return 0;
1144}
1145EXPORT_SYMBOL(sock_wake_async);
1146
1147static int __sock_create(struct net *net, int family, int type, int protocol,
1148             struct socket **res, int kern)
1149{
1150    int err;
1151    struct socket *sock;
1152    const struct net_proto_family *pf;
1153
1154    /*
1155     * Check protocol is in range
1156     */
1157    if (family < 0 || family >= NPROTO)
1158        return -EAFNOSUPPORT;
1159    if (type < 0 || type >= SOCK_MAX)
1160        return -EINVAL;
1161
1162    /* Compatibility.
1163
1164       This uglymoron is moved from INET layer to here to avoid
1165       deadlock in module load.
1166     */
1167    if (family == PF_INET && type == SOCK_PACKET) {
1168        static int warned;
1169        if (!warned) {
1170            warned = 1;
1171            printk(KERN_INFO "%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1172                   current->comm);
1173        }
1174        family = PF_PACKET;
1175    }
1176
1177    err = security_socket_create(family, type, protocol, kern);
1178    if (err)
1179        return err;
1180
1181    /*
1182     * Allocate the socket and allow the family to set things up. if
1183     * the protocol is 0, the family is instructed to select an appropriate
1184     * default.
1185     */
1186    sock = sock_alloc();
1187    if (!sock) {
1188        if (net_ratelimit())
1189            printk(KERN_WARNING "socket: no more sockets\n");
1190        return -ENFILE; /* Not exactly a match, but its the
1191                   closest posix thing */
1192    }
1193
1194    sock->type = type;
1195
1196#ifdef CONFIG_MODULES
1197    /* Attempt to load a protocol module if the find failed.
1198     *
1199     * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1200     * requested real, full-featured networking support upon configuration.
1201     * Otherwise module support will break!
1202     */
1203    if (net_families[family] == NULL)
1204        request_module("net-pf-%d", family);
1205#endif
1206
1207    rcu_read_lock();
1208    pf = rcu_dereference(net_families[family]);
1209    err = -EAFNOSUPPORT;
1210    if (!pf)
1211        goto out_release;
1212
1213    /*
1214     * We will call the ->create function, that possibly is in a loadable
1215     * module, so we have to bump that loadable module refcnt first.
1216     */
1217    if (!try_module_get(pf->owner))
1218        goto out_release;
1219
1220    /* Now protected by module ref count */
1221    rcu_read_unlock();
1222
1223    err = pf->create(net, sock, protocol, kern);
1224    if (err < 0)
1225        goto out_module_put;
1226
1227    /*
1228     * Now to bump the refcnt of the [loadable] module that owns this
1229     * socket at sock_release time we decrement its refcnt.
1230     */
1231    if (!try_module_get(sock->ops->owner))
1232        goto out_module_busy;
1233
1234    /*
1235     * Now that we're done with the ->create function, the [loadable]
1236     * module can have its refcnt decremented
1237     */
1238    module_put(pf->owner);
1239    err = security_socket_post_create(sock, family, type, protocol, kern);
1240    if (err)
1241        goto out_sock_release;
1242    *res = sock;
1243
1244    return 0;
1245
1246out_module_busy:
1247    err = -EAFNOSUPPORT;
1248out_module_put:
1249    sock->ops = NULL;
1250    module_put(pf->owner);
1251out_sock_release:
1252    sock_release(sock);
1253    return err;
1254
1255out_release:
1256    rcu_read_unlock();
1257    goto out_sock_release;
1258}
1259
1260int sock_create(int family, int type, int protocol, struct socket **res)
1261{
1262    return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1263}
1264EXPORT_SYMBOL(sock_create);
1265
1266int sock_create_kern(int family, int type, int protocol, struct socket **res)
1267{
1268    return __sock_create(&init_net, family, type, protocol, res, 1);
1269}
1270EXPORT_SYMBOL(sock_create_kern);
1271
1272SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1273{
1274    int retval;
1275    struct socket *sock;
1276    int flags;
1277
1278    /* Check the SOCK_* constants for consistency. */
1279    BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1280    BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1281    BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1282    BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1283
1284    flags = type & ~SOCK_TYPE_MASK;
1285    if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1286        return -EINVAL;
1287    type &= SOCK_TYPE_MASK;
1288
1289    if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1290        flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1291
1292    retval = sock_create(family, type, protocol, &sock);
1293    if (retval < 0)
1294        goto out;
1295
1296    retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1297    if (retval < 0)
1298        goto out_release;
1299
1300out:
1301    /* It may be already another descriptor 8) Not kernel problem. */
1302    return retval;
1303
1304out_release:
1305    sock_release(sock);
1306    return retval;
1307}
1308
1309/*
1310 * Create a pair of connected sockets.
1311 */
1312
1313SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1314        int __user *, usockvec)
1315{
1316    struct socket *sock1, *sock2;
1317    int fd1, fd2, err;
1318    struct file *newfile1, *newfile2;
1319    int flags;
1320
1321    flags = type & ~SOCK_TYPE_MASK;
1322    if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1323        return -EINVAL;
1324    type &= SOCK_TYPE_MASK;
1325
1326    if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1327        flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1328
1329    /*
1330     * Obtain the first socket and check if the underlying protocol
1331     * supports the socketpair call.
1332     */
1333
1334    err = sock_create(family, type, protocol, &sock1);
1335    if (err < 0)
1336        goto out;
1337
1338    err = sock_create(family, type, protocol, &sock2);
1339    if (err < 0)
1340        goto out_release_1;
1341
1342    err = sock1->ops->socketpair(sock1, sock2);
1343    if (err < 0)
1344        goto out_release_both;
1345
1346    fd1 = sock_alloc_file(sock1, &newfile1, flags);
1347    if (unlikely(fd1 < 0)) {
1348        err = fd1;
1349        goto out_release_both;
1350    }
1351
1352    fd2 = sock_alloc_file(sock2, &newfile2, flags);
1353    if (unlikely(fd2 < 0)) {
1354        err = fd2;
1355        fput(newfile1);
1356        put_unused_fd(fd1);
1357        sock_release(sock2);
1358        goto out;
1359    }
1360
1361    audit_fd_pair(fd1, fd2);
1362    fd_install(fd1, newfile1);
1363    fd_install(fd2, newfile2);
1364    /* fd1 and fd2 may be already another descriptors.
1365     * Not kernel problem.
1366     */
1367
1368    err = put_user(fd1, &usockvec[0]);
1369    if (!err)
1370        err = put_user(fd2, &usockvec[1]);
1371    if (!err)
1372        return 0;
1373
1374    sys_close(fd2);
1375    sys_close(fd1);
1376    return err;
1377
1378out_release_both:
1379    sock_release(sock2);
1380out_release_1:
1381    sock_release(sock1);
1382out:
1383    return err;
1384}
1385
1386/*
1387 * Bind a name to a socket. Nothing much to do here since it's
1388 * the protocol's responsibility to handle the local address.
1389 *
1390 * We move the socket address to kernel space before we call
1391 * the protocol layer (having also checked the address is ok).
1392 */
1393
1394SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1395{
1396    struct socket *sock;
1397    struct sockaddr_storage address;
1398    int err, fput_needed;
1399
1400    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1401    if (sock) {
1402        err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
1403        if (err >= 0) {
1404            err = security_socket_bind(sock,
1405                           (struct sockaddr *)&address,
1406                           addrlen);
1407            if (!err)
1408                err = sock->ops->bind(sock,
1409                              (struct sockaddr *)
1410                              &address, addrlen);
1411        }
1412        fput_light(sock->file, fput_needed);
1413    }
1414    return err;
1415}
1416
1417/*
1418 * Perform a listen. Basically, we allow the protocol to do anything
1419 * necessary for a listen, and if that works, we mark the socket as
1420 * ready for listening.
1421 */
1422
1423SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1424{
1425    struct socket *sock;
1426    int err, fput_needed;
1427    int somaxconn;
1428
1429    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1430    if (sock) {
1431        somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1432        if ((unsigned)backlog > somaxconn)
1433            backlog = somaxconn;
1434
1435        err = security_socket_listen(sock, backlog);
1436        if (!err)
1437            err = sock->ops->listen(sock, backlog);
1438
1439        fput_light(sock->file, fput_needed);
1440    }
1441    return err;
1442}
1443
1444/*
1445 * For accept, we attempt to create a new socket, set up the link
1446 * with the client, wake up the client, then return the new
1447 * connected fd. We collect the address of the connector in kernel
1448 * space and move it to user at the very end. This is unclean because
1449 * we open the socket then return an error.
1450 *
1451 * 1003.1g adds the ability to recvmsg() to query connection pending
1452 * status to recvmsg. We need to add that support in a way thats
1453 * clean when we restucture accept also.
1454 */
1455
1456SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1457        int __user *, upeer_addrlen, int, flags)
1458{
1459    struct socket *sock, *newsock;
1460    struct file *newfile;
1461    int err, len, newfd, fput_needed;
1462    struct sockaddr_storage address;
1463
1464    if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1465        return -EINVAL;
1466
1467    if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1468        flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1469
1470    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1471    if (!sock)
1472        goto out;
1473
1474    err = -ENFILE;
1475    newsock = sock_alloc();
1476    if (!newsock)
1477        goto out_put;
1478
1479    newsock->type = sock->type;
1480    newsock->ops = sock->ops;
1481
1482    /*
1483     * We don't need try_module_get here, as the listening socket (sock)
1484     * has the protocol module (sock->ops->owner) held.
1485     */
1486    __module_get(newsock->ops->owner);
1487
1488    newfd = sock_alloc_file(newsock, &newfile, flags);
1489    if (unlikely(newfd < 0)) {
1490        err = newfd;
1491        sock_release(newsock);
1492        goto out_put;
1493    }
1494
1495    err = security_socket_accept(sock, newsock);
1496    if (err)
1497        goto out_fd;
1498
1499    err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1500    if (err < 0)
1501        goto out_fd;
1502
1503    if (upeer_sockaddr) {
1504        if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1505                      &len, 2) < 0) {
1506            err = -ECONNABORTED;
1507            goto out_fd;
1508        }
1509        err = move_addr_to_user((struct sockaddr *)&address,
1510                    len, upeer_sockaddr, upeer_addrlen);
1511        if (err < 0)
1512            goto out_fd;
1513    }
1514
1515    /* File flags are not inherited via accept() unlike another OSes. */
1516
1517    fd_install(newfd, newfile);
1518    err = newfd;
1519
1520out_put:
1521    fput_light(sock->file, fput_needed);
1522out:
1523    return err;
1524out_fd:
1525    fput(newfile);
1526    put_unused_fd(newfd);
1527    goto out_put;
1528}
1529
1530SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1531        int __user *, upeer_addrlen)
1532{
1533    return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1534}
1535
1536/*
1537 * Attempt to connect to a socket with the server address. The address
1538 * is in user space so we verify it is OK and move it to kernel space.
1539 *
1540 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1541 * break bindings
1542 *
1543 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1544 * other SEQPACKET protocols that take time to connect() as it doesn't
1545 * include the -EINPROGRESS status for such sockets.
1546 */
1547
1548SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1549        int, addrlen)
1550{
1551    struct socket *sock;
1552    struct sockaddr_storage address;
1553    int err, fput_needed;
1554
1555    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1556    if (!sock)
1557        goto out;
1558    err = move_addr_to_kernel(uservaddr, addrlen, (struct sockaddr *)&address);
1559    if (err < 0)
1560        goto out_put;
1561
1562    err =
1563        security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1564    if (err)
1565        goto out_put;
1566
1567    err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1568                 sock->file->f_flags);
1569out_put:
1570    fput_light(sock->file, fput_needed);
1571out:
1572    return err;
1573}
1574
1575/*
1576 * Get the local address ('name') of a socket object. Move the obtained
1577 * name to user space.
1578 */
1579
1580SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1581        int __user *, usockaddr_len)
1582{
1583    struct socket *sock;
1584    struct sockaddr_storage address;
1585    int len, err, fput_needed;
1586
1587    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1588    if (!sock)
1589        goto out;
1590
1591    err = security_socket_getsockname(sock);
1592    if (err)
1593        goto out_put;
1594
1595    err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1596    if (err)
1597        goto out_put;
1598    err = move_addr_to_user((struct sockaddr *)&address, len, usockaddr, usockaddr_len);
1599
1600out_put:
1601    fput_light(sock->file, fput_needed);
1602out:
1603    return err;
1604}
1605
1606/*
1607 * Get the remote address ('name') of a socket object. Move the obtained
1608 * name to user space.
1609 */
1610
1611SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1612        int __user *, usockaddr_len)
1613{
1614    struct socket *sock;
1615    struct sockaddr_storage address;
1616    int len, err, fput_needed;
1617
1618    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1619    if (sock != NULL) {
1620        err = security_socket_getpeername(sock);
1621        if (err) {
1622            fput_light(sock->file, fput_needed);
1623            return err;
1624        }
1625
1626        err =
1627            sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1628                       1);
1629        if (!err)
1630            err = move_addr_to_user((struct sockaddr *)&address, len, usockaddr,
1631                        usockaddr_len);
1632        fput_light(sock->file, fput_needed);
1633    }
1634    return err;
1635}
1636
1637/*
1638 * Send a datagram to a given address. We move the address into kernel
1639 * space and check the user space data area is readable before invoking
1640 * the protocol.
1641 */
1642
1643SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1644        unsigned, flags, struct sockaddr __user *, addr,
1645        int, addr_len)
1646{
1647    struct socket *sock;
1648    struct sockaddr_storage address;
1649    int err;
1650    struct msghdr msg;
1651    struct iovec iov;
1652    int fput_needed;
1653
1654    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1655    if (!sock)
1656        goto out;
1657
1658    iov.iov_base = buff;
1659    iov.iov_len = len;
1660    msg.msg_name = NULL;
1661    msg.msg_iov = &iov;
1662    msg.msg_iovlen = 1;
1663    msg.msg_control = NULL;
1664    msg.msg_controllen = 0;
1665    msg.msg_namelen = 0;
1666    if (addr) {
1667        err = move_addr_to_kernel(addr, addr_len, (struct sockaddr *)&address);
1668        if (err < 0)
1669            goto out_put;
1670        msg.msg_name = (struct sockaddr *)&address;
1671        msg.msg_namelen = addr_len;
1672    }
1673    if (sock->file->f_flags & O_NONBLOCK)
1674        flags |= MSG_DONTWAIT;
1675    msg.msg_flags = flags;
1676    err = sock_sendmsg(sock, &msg, len);
1677
1678out_put:
1679    fput_light(sock->file, fput_needed);
1680out:
1681    return err;
1682}
1683
1684/*
1685 * Send a datagram down a socket.
1686 */
1687
1688SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1689        unsigned, flags)
1690{
1691    return sys_sendto(fd, buff, len, flags, NULL, 0);
1692}
1693
1694/*
1695 * Receive a frame from the socket and optionally record the address of the
1696 * sender. We verify the buffers are writable and if needed move the
1697 * sender address from kernel to user space.
1698 */
1699
1700SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1701        unsigned, flags, struct sockaddr __user *, addr,
1702        int __user *, addr_len)
1703{
1704    struct socket *sock;
1705    struct iovec iov;
1706    struct msghdr msg;
1707    struct sockaddr_storage address;
1708    int err, err2;
1709    int fput_needed;
1710
1711    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1712    if (!sock)
1713        goto out;
1714
1715    msg.msg_control = NULL;
1716    msg.msg_controllen = 0;
1717    msg.msg_iovlen = 1;
1718    msg.msg_iov = &iov;
1719    iov.iov_len = size;
1720    iov.iov_base = ubuf;
1721    msg.msg_name = (struct sockaddr *)&address;
1722    msg.msg_namelen = sizeof(address);
1723    if (sock->file->f_flags & O_NONBLOCK)
1724        flags |= MSG_DONTWAIT;
1725    err = sock_recvmsg(sock, &msg, size, flags);
1726
1727    if (err >= 0 && addr != NULL) {
1728        err2 = move_addr_to_user((struct sockaddr *)&address,
1729                     msg.msg_namelen, addr, addr_len);
1730        if (err2 < 0)
1731            err = err2;
1732    }
1733
1734    fput_light(sock->file, fput_needed);
1735out:
1736    return err;
1737}
1738
1739/*
1740 * Receive a datagram from a socket.
1741 */
1742
1743asmlinkage long sys_recv(int fd, void __user *ubuf, size_t size,
1744             unsigned flags)
1745{
1746    return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1747}
1748
1749/*
1750 * Set a socket option. Because we don't know the option lengths we have
1751 * to pass the user mode parameter for the protocols to sort out.
1752 */
1753
1754SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1755        char __user *, optval, int, optlen)
1756{
1757    int err, fput_needed;
1758    struct socket *sock;
1759
1760    if (optlen < 0)
1761        return -EINVAL;
1762
1763    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1764    if (sock != NULL) {
1765        err = security_socket_setsockopt(sock, level, optname);
1766        if (err)
1767            goto out_put;
1768
1769        if (level == SOL_SOCKET)
1770            err =
1771                sock_setsockopt(sock, level, optname, optval,
1772                        optlen);
1773        else
1774            err =
1775                sock->ops->setsockopt(sock, level, optname, optval,
1776                          optlen);
1777out_put:
1778        fput_light(sock->file, fput_needed);
1779    }
1780    return err;
1781}
1782
1783/*
1784 * Get a socket option. Because we don't know the option lengths we have
1785 * to pass a user mode parameter for the protocols to sort out.
1786 */
1787
1788SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1789        char __user *, optval, int __user *, optlen)
1790{
1791    int err, fput_needed;
1792    struct socket *sock;
1793
1794    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1795    if (sock != NULL) {
1796        err = security_socket_getsockopt(sock, level, optname);
1797        if (err)
1798            goto out_put;
1799
1800        if (level == SOL_SOCKET)
1801            err =
1802                sock_getsockopt(sock, level, optname, optval,
1803                        optlen);
1804        else
1805            err =
1806                sock->ops->getsockopt(sock, level, optname, optval,
1807                          optlen);
1808out_put:
1809        fput_light(sock->file, fput_needed);
1810    }
1811    return err;
1812}
1813
1814/*
1815 * Shutdown a socket.
1816 */
1817
1818SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1819{
1820    int err, fput_needed;
1821    struct socket *sock;
1822
1823    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1824    if (sock != NULL) {
1825        err = security_socket_shutdown(sock, how);
1826        if (!err)
1827            err = sock->ops->shutdown(sock, how);
1828        fput_light(sock->file, fput_needed);
1829    }
1830    return err;
1831}
1832
1833/* A couple of helpful macros for getting the address of the 32/64 bit
1834 * fields which are the same type (int / unsigned) on our platforms.
1835 */
1836#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1837#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1838#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1839
1840/*
1841 * BSD sendmsg interface
1842 */
1843
1844SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
1845{
1846    struct compat_msghdr __user *msg_compat =
1847        (struct compat_msghdr __user *)msg;
1848    struct socket *sock;
1849    struct sockaddr_storage address;
1850    struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1851    unsigned char ctl[sizeof(struct cmsghdr) + 20]
1852        __attribute__ ((aligned(sizeof(__kernel_size_t))));
1853    /* 20 is size of ipv6_pktinfo */
1854    unsigned char *ctl_buf = ctl;
1855    struct msghdr msg_sys;
1856    int err, ctl_len, iov_size, total_len;
1857    int fput_needed;
1858
1859    err = -EFAULT;
1860    if (MSG_CMSG_COMPAT & flags) {
1861        if (get_compat_msghdr(&msg_sys, msg_compat))
1862            return -EFAULT;
1863    } else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))
1864        return -EFAULT;
1865
1866    sock = sockfd_lookup_light(fd, &err, &fput_needed);
1867    if (!sock)
1868        goto out;
1869
1870    /* do not move before msg_sys is valid */
1871    err = -EMSGSIZE;
1872    if (msg_sys.msg_iovlen > UIO_MAXIOV)
1873        goto out_put;
1874
1875    /* Check whether to allocate the iovec area */
1876    err = -ENOMEM;
1877    iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
1878    if (msg_sys.msg_iovlen > UIO_FASTIOV) {
1879        iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
1880        if (!iov)
1881            goto out_put;
1882    }
1883
1884    /* This will also move the address data into kernel space */
1885    if (MSG_CMSG_COMPAT & flags) {
1886        err = verify_compat_iovec(&msg_sys, iov,
1887                      (struct sockaddr *)&address,
1888                      VERIFY_READ);
1889    } else
1890        err = verify_iovec(&msg_sys, iov,
1891                   (struct sockaddr *)&address,
1892                   VERIFY_READ);
1893    if (err < 0)
1894        goto out_freeiov;
1895    total_len = err;
1896
1897    err = -ENOBUFS;
1898
1899    if (msg_sys.msg_controllen > INT_MAX)
1900        goto out_freeiov;
1901    ctl_len = msg_sys.msg_controllen;
1902    if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
1903        err =
1904            cmsghdr_from_user_compat_to_kern(&msg_sys, sock->sk, ctl,
1905                             sizeof(ctl));
1906        if (err)
1907            goto out_freeiov;
1908        ctl_buf = msg_sys.msg_control;
1909        ctl_len = msg_sys.msg_controllen;
1910    } else if (ctl_len) {
1911        if (ctl_len > sizeof(ctl)) {
1912            ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
1913            if (ctl_buf == NULL)
1914                goto out_freeiov;
1915        }
1916        err = -EFAULT;
1917        /*
1918         * Careful! Before this, msg_sys.msg_control contains a user pointer.
1919         * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1920         * checking falls down on this.
1921         */
1922        if (copy_from_user(ctl_buf, (void __user *)msg_sys.msg_control,
1923                   ctl_len))
1924            goto out_freectl;
1925        msg_sys.msg_control = ctl_buf;
1926    }
1927    msg_sys.msg_flags = flags;
1928
1929    if (sock->file->f_flags & O_NONBLOCK)
1930        msg_sys.msg_flags |= MSG_DONTWAIT;
1931    err = sock_sendmsg(sock, &msg_sys, total_len);
1932
1933out_freectl:
1934    if (ctl_buf != ctl)
1935        sock_kfree_s(sock->sk, ctl_buf, ctl_len);
1936out_freeiov:
1937    if (iov != iovstack)
1938        sock_kfree_s(sock->sk, iov, iov_size);
1939out_put:
1940    fput_light(sock->file, fput_needed);
1941out:
1942    return err;
1943}
1944
1945static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
1946             struct msghdr *msg_sys, unsigned flags, int nosec)
1947{
1948    struct compat_msghdr __user *msg_compat =
1949        (struct compat_msghdr __user *)msg;
1950    struct iovec iovstack[UIO_FASTIOV];
1951    struct iovec *iov = iovstack;
1952    unsigned long cmsg_ptr;
1953    int err, iov_size, total_len, len;
1954
1955    /* kernel mode address */
1956    struct sockaddr_storage addr;
1957
1958    /* user mode address pointers */
1959    struct sockaddr __user *uaddr;
1960    int __user *uaddr_len;
1961
1962    if (MSG_CMSG_COMPAT & flags) {
1963        if (get_compat_msghdr(msg_sys, msg_compat))
1964            return -EFAULT;
1965    } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
1966        return -EFAULT;
1967
1968    err = -EMSGSIZE;
1969    if (msg_sys->msg_iovlen > UIO_MAXIOV)
1970        goto out;
1971
1972    /* Check whether to allocate the iovec area */
1973    err = -ENOMEM;
1974    iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
1975    if (msg_sys->msg_iovlen > UIO_FASTIOV) {
1976        iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
1977        if (!iov)
1978            goto out;
1979    }
1980
1981    /*
1982     * Save the user-mode address (verify_iovec will change the
1983     * kernel msghdr to use the kernel address space)
1984     */
1985
1986    uaddr = (__force void __user *)msg_sys->msg_name;
1987    uaddr_len = COMPAT_NAMELEN(msg);
1988    if (MSG_CMSG_COMPAT & flags) {
1989        err = verify_compat_iovec(msg_sys, iov,
1990                      (struct sockaddr *)&addr,
1991                      VERIFY_WRITE);
1992    } else
1993        err = verify_iovec(msg_sys, iov,
1994                   (struct sockaddr *)&addr,
1995                   VERIFY_WRITE);
1996    if (err < 0)
1997        goto out_freeiov;
1998    total_len = err;
1999
2000    cmsg_ptr = (unsigned long)msg_sys->msg_control;
2001    msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2002
2003    if (sock->file->f_flags & O_NONBLOCK)
2004        flags |= MSG_DONTWAIT;
2005    err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2006                              total_len, flags);
2007    if (err < 0)
2008        goto out_freeiov;
2009    len = err;
2010
2011    if (uaddr != NULL) {
2012        err = move_addr_to_user((struct sockaddr *)&addr,
2013                    msg_sys->msg_namelen, uaddr,
2014                    uaddr_len);
2015        if (err < 0)
2016            goto out_freeiov;
2017    }
2018    err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2019             COMPAT_FLAGS(msg));
2020    if (err)
2021        goto out_freeiov;
2022    if (MSG_CMSG_COMPAT & flags)
2023        err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2024                 &msg_compat->msg_controllen);
2025    else
2026        err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2027                 &msg->msg_controllen);
2028    if (err)
2029        goto out_freeiov;
2030    err = len;
2031
2032out_freeiov:
2033    if (iov != iovstack)
2034        sock_kfree_s(sock->sk, iov, iov_size);
2035out:
2036    return err;
2037}
2038
2039/*
2040 * BSD recvmsg interface
2041 */
2042
2043SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
2044        unsigned int, flags)
2045{
2046    int fput_needed, err;
2047    struct msghdr msg_sys;
2048    struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
2049
2050    if (!sock)
2051        goto out;
2052
2053    err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2054
2055    fput_light(sock->file, fput_needed);
2056out:
2057    return err;
2058}
2059
2060/*
2061 * Linux recvmmsg interface
2062 */
2063
2064int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2065           unsigned int flags, struct timespec *timeout)
2066{
2067    int fput_needed, err, datagrams;
2068    struct socket *sock;
2069    struct mmsghdr __user *entry;
2070    struct compat_mmsghdr __user *compat_entry;
2071    struct msghdr msg_sys;
2072    struct timespec end_time;
2073
2074    if (timeout &&
2075        poll_select_set_timeout(&end_time, timeout->tv_sec,
2076                    timeout->tv_nsec))
2077        return -EINVAL;
2078
2079    datagrams = 0;
2080
2081    sock = sockfd_lookup_light(fd, &err, &fput_needed);
2082    if (!sock)
2083        return err;
2084
2085    err = sock_error(sock->sk);
2086    if (err)
2087        goto out_put;
2088
2089    entry = mmsg;
2090    compat_entry = (struct compat_mmsghdr __user *)mmsg;
2091
2092    while (datagrams < vlen) {
2093        /*
2094         * No need to ask LSM for more than the first datagram.
2095         */
2096        if (MSG_CMSG_COMPAT & flags) {
2097            err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
2098                        &msg_sys, flags, datagrams);
2099            if (err < 0)
2100                break;
2101            err = __put_user(err, &compat_entry->msg_len);
2102            ++compat_entry;
2103        } else {
2104            err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
2105                        &msg_sys, flags, datagrams);
2106            if (err < 0)
2107                break;
2108            err = put_user(err, &entry->msg_len);
2109            ++entry;
2110        }
2111
2112        if (err)
2113            break;
2114        ++datagrams;
2115
2116        /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2117        if (flags & MSG_WAITFORONE)
2118            flags |= MSG_DONTWAIT;
2119
2120        if (timeout) {
2121            ktime_get_ts(timeout);
2122            *timeout = timespec_sub(end_time, *timeout);
2123            if (timeout->tv_sec < 0) {
2124                timeout->tv_sec = timeout->tv_nsec = 0;
2125                break;
2126            }
2127
2128            /* Timeout, return less than vlen datagrams */
2129            if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2130                break;
2131        }
2132
2133        /* Out of band data, return right away */
2134        if (msg_sys.msg_flags & MSG_OOB)
2135            break;
2136    }
2137
2138out_put:
2139    fput_light(sock->file, fput_needed);
2140
2141    if (err == 0)
2142        return datagrams;
2143
2144    if (datagrams != 0) {
2145        /*
2146         * We may return less entries than requested (vlen) if the
2147         * sock is non block and there aren't enough datagrams...
2148         */
2149        if (err != -EAGAIN) {
2150            /*
2151             * ... or if recvmsg returns an error after we
2152             * received some datagrams, where we record the
2153             * error to return on the next call or if the
2154             * app asks about it using getsockopt(SO_ERROR).
2155             */
2156            sock->sk->sk_err = -err;
2157        }
2158
2159        return datagrams;
2160    }
2161
2162    return err;
2163}
2164
2165SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2166        unsigned int, vlen, unsigned int, flags,
2167        struct timespec __user *, timeout)
2168{
2169    int datagrams;
2170    struct timespec timeout_sys;
2171
2172    if (!timeout)
2173        return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2174
2175    if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2176        return -EFAULT;
2177
2178    datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2179
2180    if (datagrams > 0 &&
2181        copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2182        datagrams = -EFAULT;
2183
2184    return datagrams;
2185}
2186
2187#ifdef __ARCH_WANT_SYS_SOCKETCALL
2188/* Argument list sizes for sys_socketcall */
2189#define AL(x) ((x) * sizeof(unsigned long))
2190static const unsigned char nargs[20] = {
2191    AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2192    AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2193    AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2194    AL(4), AL(5)
2195};
2196
2197#undef AL
2198
2199/*
2200 * System call vectors.
2201 *
2202 * Argument checking cleaned up. Saved 20% in size.
2203 * This function doesn't need to set the kernel lock because
2204 * it is set by the callees.
2205 */
2206
2207SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2208{
2209    unsigned long a[6];
2210    unsigned long a0, a1;
2211    int err;
2212    unsigned int len;
2213
2214    if (call < 1 || call > SYS_RECVMMSG)
2215        return -EINVAL;
2216
2217    len = nargs[call];
2218    if (len > sizeof(a))
2219        return -EINVAL;
2220
2221    /* copy_from_user should be SMP safe. */
2222    if (copy_from_user(a, args, len))
2223        return -EFAULT;
2224
2225    audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2226
2227    a0 = a[0];
2228    a1 = a[1];
2229
2230    switch (call) {
2231    case SYS_SOCKET:
2232        err = sys_socket(a0, a1, a[2]);
2233        break;
2234    case SYS_BIND:
2235        err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2236        break;
2237    case SYS_CONNECT:
2238        err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2239        break;
2240    case SYS_LISTEN:
2241        err = sys_listen(a0, a1);
2242        break;
2243    case SYS_ACCEPT:
2244        err = sys_accept4(a0, (struct sockaddr __user *)a1,
2245                  (int __user *)a[2], 0);
2246        break;
2247    case SYS_GETSOCKNAME:
2248        err =
2249            sys_getsockname(a0, (struct sockaddr __user *)a1,
2250                    (int __user *)a[2]);
2251        break;
2252    case SYS_GETPEERNAME:
2253        err =
2254            sys_getpeername(a0, (struct sockaddr __user *)a1,
2255                    (int __user *)a[2]);
2256        break;
2257    case SYS_SOCKETPAIR:
2258        err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2259        break;
2260    case SYS_SEND:
2261        err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2262        break;
2263    case SYS_SENDTO:
2264        err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2265                 (struct sockaddr __user *)a[4], a[5]);
2266        break;
2267    case SYS_RECV:
2268        err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2269        break;
2270    case SYS_RECVFROM:
2271        err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2272                   (struct sockaddr __user *)a[4],
2273                   (int __user *)a[5]);
2274        break;
2275    case SYS_SHUTDOWN:
2276        err = sys_shutdown(a0, a1);
2277        break;
2278    case SYS_SETSOCKOPT:
2279        err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2280        break;
2281    case SYS_GETSOCKOPT:
2282        err =
2283            sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2284                   (int __user *)a[4]);
2285        break;
2286    case SYS_SENDMSG:
2287        err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
2288        break;
2289    case SYS_RECVMSG:
2290        err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
2291        break;
2292    case SYS_RECVMMSG:
2293        err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2294                   (struct timespec __user *)a[4]);
2295        break;
2296    case SYS_ACCEPT4:
2297        err = sys_accept4(a0, (struct sockaddr __user *)a1,
2298                  (int __user *)a[2], a[3]);
2299        break;
2300    default:
2301        err = -EINVAL;
2302        break;
2303    }
2304    return err;
2305}
2306
2307#endif /* __ARCH_WANT_SYS_SOCKETCALL */
2308
2309/**
2310 * sock_register - add a socket protocol handler
2311 * @ops: description of protocol
2312 *
2313 * This function is called by a protocol handler that wants to
2314 * advertise its address family, and have it linked into the
2315 * socket interface. The value ops->family coresponds to the
2316 * socket system call protocol family.
2317 */
2318int sock_register(const struct net_proto_family *ops)
2319{
2320    int err;
2321
2322    if (ops->family >= NPROTO) {
2323        printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
2324               NPROTO);
2325        return -ENOBUFS;
2326    }
2327
2328    spin_lock(&net_family_lock);
2329    if (net_families[ops->family])
2330        err = -EEXIST;
2331    else {
2332        net_families[ops->family] = ops;
2333        err = 0;
2334    }
2335    spin_unlock(&net_family_lock);
2336
2337    printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
2338    return err;
2339}
2340EXPORT_SYMBOL(sock_register);
2341
2342/**
2343 * sock_unregister - remove a protocol handler
2344 * @family: protocol family to remove
2345 *
2346 * This function is called by a protocol handler that wants to
2347 * remove its address family, and have it unlinked from the
2348 * new socket creation.
2349 *
2350 * If protocol handler is a module, then it can use module reference
2351 * counts to protect against new references. If protocol handler is not
2352 * a module then it needs to provide its own protection in
2353 * the ops->create routine.
2354 */
2355void sock_unregister(int family)
2356{
2357    BUG_ON(family < 0 || family >= NPROTO);
2358
2359    spin_lock(&net_family_lock);
2360    net_families[family] = NULL;
2361    spin_unlock(&net_family_lock);
2362
2363    synchronize_rcu();
2364
2365    printk(KERN_INFO "NET: Unregistered protocol family %d\n", family);
2366}
2367EXPORT_SYMBOL(sock_unregister);
2368
2369static int __init sock_init(void)
2370{
2371    /*
2372     * Initialize sock SLAB cache.
2373     */
2374
2375    sk_init();
2376
2377    /*
2378     * Initialize skbuff SLAB cache
2379     */
2380    skb_init();
2381
2382    /*
2383     * Initialize the protocols module.
2384     */
2385
2386    init_inodecache();
2387    register_filesystem(&sock_fs_type);
2388    sock_mnt = kern_mount(&sock_fs_type);
2389
2390    /* The real protocol initialization is performed in later initcalls.
2391     */
2392
2393#ifdef CONFIG_NETFILTER
2394    netfilter_init();
2395#endif
2396
2397#ifdef CONFIG_NETWORK_PHY_TIMESTAMPING
2398    skb_timestamping_init();
2399#endif
2400
2401    return 0;
2402}
2403
2404core_initcall(sock_init); /* early initcall */
2405
2406#ifdef CONFIG_PROC_FS
2407void socket_seq_show(struct seq_file *seq)
2408{
2409    int cpu;
2410    int counter = 0;
2411
2412    for_each_possible_cpu(cpu)
2413        counter += per_cpu(sockets_in_use, cpu);
2414
2415    /* It can be negative, by the way. 8) */
2416    if (counter < 0)
2417        counter = 0;
2418
2419    seq_printf(seq, "sockets: used %d\n", counter);
2420}
2421#endif /* CONFIG_PROC_FS */
2422
2423#ifdef CONFIG_COMPAT
2424static int do_siocgstamp(struct net *net, struct socket *sock,
2425             unsigned int cmd, struct compat_timeval __user *up)
2426{
2427    mm_segment_t old_fs = get_fs();
2428    struct timeval ktv;
2429    int err;
2430
2431    set_fs(KERNEL_DS);
2432    err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2433    set_fs(old_fs);
2434    if (!err) {
2435        err = put_user(ktv.tv_sec, &up->tv_sec);
2436        err |= __put_user(ktv.tv_usec, &up->tv_usec);
2437    }
2438    return err;
2439}
2440
2441static int do_siocgstampns(struct net *net, struct socket *sock,
2442             unsigned int cmd, struct compat_timespec __user *up)
2443{
2444    mm_segment_t old_fs = get_fs();
2445    struct timespec kts;
2446    int err;
2447
2448    set_fs(KERNEL_DS);
2449    err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2450    set_fs(old_fs);
2451    if (!err) {
2452        err = put_user(kts.tv_sec, &up->tv_sec);
2453        err |= __put_user(kts.tv_nsec, &up->tv_nsec);
2454    }
2455    return err;
2456}
2457
2458static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2459{
2460    struct ifreq __user *uifr;
2461    int err;
2462
2463    uifr = compat_alloc_user_space(sizeof(struct ifreq));
2464    if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2465        return -EFAULT;
2466
2467    err = dev_ioctl(net, SIOCGIFNAME, uifr);
2468    if (err)
2469        return err;
2470
2471    if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2472        return -EFAULT;
2473
2474    return 0;
2475}
2476
2477static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2478{
2479    struct compat_ifconf ifc32;
2480    struct ifconf ifc;
2481    struct ifconf __user *uifc;
2482    struct compat_ifreq __user *ifr32;
2483    struct ifreq __user *ifr;
2484    unsigned int i, j;
2485    int err;
2486
2487    if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2488        return -EFAULT;
2489
2490    if (ifc32.ifcbuf == 0) {
2491        ifc32.ifc_len = 0;
2492        ifc.ifc_len = 0;
2493        ifc.ifc_req = NULL;
2494        uifc = compat_alloc_user_space(sizeof(struct ifconf));
2495    } else {
2496        size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2497            sizeof(struct ifreq);
2498        uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2499        ifc.ifc_len = len;
2500        ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2501        ifr32 = compat_ptr(ifc32.ifcbuf);
2502        for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2503            if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2504                return -EFAULT;
2505            ifr++;
2506            ifr32++;
2507        }
2508    }
2509    if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2510        return -EFAULT;
2511
2512    err = dev_ioctl(net, SIOCGIFCONF, uifc);
2513    if (err)
2514        return err;
2515
2516    if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2517        return -EFAULT;
2518
2519    ifr = ifc.ifc_req;
2520    ifr32 = compat_ptr(ifc32.ifcbuf);
2521    for (i = 0, j = 0;
2522         i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2523         i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2524        if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2525            return -EFAULT;
2526        ifr32++;
2527        ifr++;
2528    }
2529
2530    if (ifc32.ifcbuf == 0) {
2531        /* Translate from 64-bit structure multiple to
2532         * a 32-bit one.
2533         */
2534        i = ifc.ifc_len;
2535        i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2536        ifc32.ifc_len = i;
2537    } else {
2538        ifc32.ifc_len = i;
2539    }
2540    if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2541        return -EFAULT;
2542
2543    return 0;
2544}
2545
2546static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2547{
2548    struct ifreq __user *ifr;
2549    u32 data;
2550    void __user *datap;
2551
2552    ifr = compat_alloc_user_space(sizeof(*ifr));
2553
2554    if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2555        return -EFAULT;
2556
2557    if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2558        return -EFAULT;
2559
2560    datap = compat_ptr(data);
2561    if (put_user(datap, &ifr->ifr_ifru.ifru_data))
2562        return -EFAULT;
2563
2564    return dev_ioctl(net, SIOCETHTOOL, ifr);
2565}
2566
2567static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2568{
2569    void __user *uptr;
2570    compat_uptr_t uptr32;
2571    struct ifreq __user *uifr;
2572
2573    uifr = compat_alloc_user_space(sizeof(*uifr));
2574    if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2575        return -EFAULT;
2576
2577    if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2578        return -EFAULT;
2579
2580    uptr = compat_ptr(uptr32);
2581
2582    if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2583        return -EFAULT;
2584
2585    return dev_ioctl(net, SIOCWANDEV, uifr);
2586}
2587
2588static int bond_ioctl(struct net *net, unsigned int cmd,
2589             struct compat_ifreq __user *ifr32)
2590{
2591    struct ifreq kifr;
2592    struct ifreq __user *uifr;
2593    mm_segment_t old_fs;
2594    int err;
2595    u32 data;
2596    void __user *datap;
2597
2598    switch (cmd) {
2599    case SIOCBONDENSLAVE:
2600    case SIOCBONDRELEASE:
2601    case SIOCBONDSETHWADDR:
2602    case SIOCBONDCHANGEACTIVE:
2603        if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2604            return -EFAULT;
2605
2606        old_fs = get_fs();
2607        set_fs(KERNEL_DS);
2608        err = dev_ioctl(net, cmd, &kifr);
2609        set_fs(old_fs);
2610
2611        return err;
2612    case SIOCBONDSLAVEINFOQUERY:
2613    case SIOCBONDINFOQUERY:
2614        uifr = compat_alloc_user_space(sizeof(*uifr));
2615        if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2616            return -EFAULT;
2617
2618        if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2619            return -EFAULT;
2620
2621        datap = compat_ptr(data);
2622        if (put_user(datap, &uifr->ifr_ifru.ifru_data))
2623            return -EFAULT;
2624
2625        return dev_ioctl(net, cmd, uifr);
2626    default:
2627        return -EINVAL;
2628    }
2629}
2630
2631static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
2632                 struct compat_ifreq __user *u_ifreq32)
2633{
2634    struct ifreq __user *u_ifreq64;
2635    char tmp_buf[IFNAMSIZ];
2636    void __user *data64;
2637    u32 data32;
2638
2639    if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2640               IFNAMSIZ))
2641        return -EFAULT;
2642    if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2643        return -EFAULT;
2644    data64 = compat_ptr(data32);
2645
2646    u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2647
2648    /* Don't check these user accesses, just let that get trapped
2649     * in the ioctl handler instead.
2650     */
2651    if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2652             IFNAMSIZ))
2653        return -EFAULT;
2654    if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2655        return -EFAULT;
2656
2657    return dev_ioctl(net, cmd, u_ifreq64);
2658}
2659
2660static int dev_ifsioc(struct net *net, struct socket *sock,
2661             unsigned int cmd, struct compat_ifreq __user *uifr32)
2662{
2663    struct ifreq __user *uifr;
2664    int err;
2665
2666    uifr = compat_alloc_user_space(sizeof(*uifr));
2667    if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2668        return -EFAULT;
2669
2670    err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2671
2672    if (!err) {
2673        switch (cmd) {
2674        case SIOCGIFFLAGS:
2675        case SIOCGIFMETRIC:
2676        case SIOCGIFMTU:
2677        case SIOCGIFMEM:
2678        case SIOCGIFHWADDR:
2679        case SIOCGIFINDEX:
2680        case SIOCGIFADDR:
2681        case SIOCGIFBRDADDR:
2682        case SIOCGIFDSTADDR:
2683        case SIOCGIFNETMASK:
2684        case SIOCGIFPFLAGS:
2685        case SIOCGIFTXQLEN:
2686        case SIOCGMIIPHY:
2687        case SIOCGMIIREG:
2688            if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
2689                err = -EFAULT;
2690            break;
2691        }
2692    }
2693    return err;
2694}
2695
2696static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2697            struct compat_ifreq __user *uifr32)
2698{
2699    struct ifreq ifr;
2700    struct compat_ifmap __user *uifmap32;
2701    mm_segment_t old_fs;
2702    int err;
2703
2704    uifmap32 = &uifr32->ifr_ifru.ifru_map;
2705    err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
2706    err |= __get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2707    err |= __get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2708    err |= __get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2709    err |= __get_user(ifr.ifr_map.irq, &uifmap32->irq);
2710    err |= __get_user(ifr.ifr_map.dma, &uifmap32->dma);
2711    err |= __get_user(ifr.ifr_map.port, &uifmap32->port);
2712    if (err)
2713        return -EFAULT;
2714
2715    old_fs = get_fs();
2716    set_fs(KERNEL_DS);
2717    err = dev_ioctl(net, cmd, (void __user *)&ifr);
2718    set_fs(old_fs);
2719
2720    if (cmd == SIOCGIFMAP && !err) {
2721        err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
2722        err |= __put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2723        err |= __put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2724        err |= __put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2725        err |= __put_user(ifr.ifr_map.irq, &uifmap32->irq);
2726        err |= __put_user(ifr.ifr_map.dma, &uifmap32->dma);
2727        err |= __put_user(ifr.ifr_map.port, &uifmap32->port);
2728        if (err)
2729            err = -EFAULT;
2730    }
2731    return err;
2732}
2733
2734static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
2735{
2736    void __user *uptr;
2737    compat_uptr_t uptr32;
2738    struct ifreq __user *uifr;
2739
2740    uifr = compat_alloc_user_space(sizeof(*uifr));
2741    if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2742        return -EFAULT;
2743
2744    if (get_user(uptr32, &uifr32->ifr_data))
2745        return -EFAULT;
2746
2747    uptr = compat_ptr(uptr32);
2748
2749    if (put_user(uptr, &uifr->ifr_data))
2750        return -EFAULT;
2751
2752    return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
2753}
2754
2755struct rtentry32 {
2756    u32 rt_pad1;
2757    struct sockaddr rt_dst; /* target address */
2758    struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
2759    struct sockaddr rt_genmask; /* target network mask (IP) */
2760    unsigned short rt_flags;
2761    short rt_pad2;
2762    u32 rt_pad3;
2763    unsigned char rt_tos;
2764    unsigned char rt_class;
2765    short rt_pad4;
2766    short rt_metric; /* +1 for binary compatibility! */
2767    /* char * */ u32 rt_dev; /* forcing the device at add */
2768    u32 rt_mtu; /* per route MTU/Window */
2769    u32 rt_window; /* Window clamping */
2770    unsigned short rt_irtt; /* Initial RTT */
2771};
2772
2773struct in6_rtmsg32 {
2774    struct in6_addr rtmsg_dst;
2775    struct in6_addr rtmsg_src;
2776    struct in6_addr rtmsg_gateway;
2777    u32 rtmsg_type;
2778    u16 rtmsg_dst_len;
2779    u16 rtmsg_src_len;
2780    u32 rtmsg_metric;
2781    u32 rtmsg_info;
2782    u32 rtmsg_flags;
2783    s32 rtmsg_ifindex;
2784};
2785
2786static int routing_ioctl(struct net *net, struct socket *sock,
2787             unsigned int cmd, void __user *argp)
2788{
2789    int ret;
2790    void *r = NULL;
2791    struct in6_rtmsg r6;
2792    struct rtentry r4;
2793    char devname[16];
2794    u32 rtdev;
2795    mm_segment_t old_fs = get_fs();
2796
2797    if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
2798        struct in6_rtmsg32 __user *ur6 = argp;
2799        ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
2800            3 * sizeof(struct in6_addr));
2801        ret |= __get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
2802        ret |= __get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
2803        ret |= __get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
2804        ret |= __get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
2805        ret |= __get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
2806        ret |= __get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
2807        ret |= __get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
2808
2809        r = (void *) &r6;
2810    } else { /* ipv4 */
2811        struct rtentry32 __user *ur4 = argp;
2812        ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
2813                    3 * sizeof(struct sockaddr));
2814        ret |= __get_user(r4.rt_flags, &(ur4->rt_flags));
2815        ret |= __get_user(r4.rt_metric, &(ur4->rt_metric));
2816        ret |= __get_user(r4.rt_mtu, &(ur4->rt_mtu));
2817        ret |= __get_user(r4.rt_window, &(ur4->rt_window));
2818        ret |= __get_user(r4.rt_irtt, &(ur4->rt_irtt));
2819        ret |= __get_user(rtdev, &(ur4->rt_dev));
2820        if (rtdev) {
2821            ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
2822            r4.rt_dev = devname; devname[15] = 0;
2823        } else
2824            r4.rt_dev = NULL;
2825
2826        r = (void *) &r4;
2827    }
2828
2829    if (ret) {
2830        ret = -EFAULT;
2831        goto out;
2832    }
2833
2834    set_fs(KERNEL_DS);
2835    ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
2836    set_fs(old_fs);
2837
2838out:
2839    return ret;
2840}
2841
2842/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
2843 * for some operations; this forces use of the newer bridge-utils that
2844 * use compatiable ioctls
2845 */
2846static int old_bridge_ioctl(compat_ulong_t __user *argp)
2847{
2848    compat_ulong_t tmp;
2849
2850    if (get_user(tmp, argp))
2851        return -EFAULT;
2852    if (tmp == BRCTL_GET_VERSION)
2853        return BRCTL_VERSION + 1;
2854    return -EINVAL;
2855}
2856
2857static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
2858             unsigned int cmd, unsigned long arg)
2859{
2860    void __user *argp = compat_ptr(arg);
2861    struct sock *sk = sock->sk;
2862    struct net *net = sock_net(sk);
2863
2864    if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
2865        return siocdevprivate_ioctl(net, cmd, argp);
2866
2867    switch (cmd) {
2868    case SIOCSIFBR:
2869    case SIOCGIFBR:
2870        return old_bridge_ioctl(argp);
2871    case SIOCGIFNAME:
2872        return dev_ifname32(net, argp);
2873    case SIOCGIFCONF:
2874        return dev_ifconf(net, argp);
2875    case SIOCETHTOOL:
2876        return ethtool_ioctl(net, argp);
2877    case SIOCWANDEV:
2878        return compat_siocwandev(net, argp);
2879    case SIOCGIFMAP:
2880    case SIOCSIFMAP:
2881        return compat_sioc_ifmap(net, cmd, argp);
2882    case SIOCBONDENSLAVE:
2883    case SIOCBONDRELEASE:
2884    case SIOCBONDSETHWADDR:
2885    case SIOCBONDSLAVEINFOQUERY:
2886    case SIOCBONDINFOQUERY:
2887    case SIOCBONDCHANGEACTIVE:
2888        return bond_ioctl(net, cmd, argp);
2889    case SIOCADDRT:
2890    case SIOCDELRT:
2891        return routing_ioctl(net, sock, cmd, argp);
2892    case SIOCGSTAMP:
2893        return do_siocgstamp(net, sock, cmd, argp);
2894    case SIOCGSTAMPNS:
2895        return do_siocgstampns(net, sock, cmd, argp);
2896    case SIOCSHWTSTAMP:
2897        return compat_siocshwtstamp(net, argp);
2898
2899    case FIOSETOWN:
2900    case SIOCSPGRP:
2901    case FIOGETOWN:
2902    case SIOCGPGRP:
2903    case SIOCBRADDBR:
2904    case SIOCBRDELBR:
2905    case SIOCGIFVLAN:
2906    case SIOCSIFVLAN:
2907    case SIOCADDDLCI:
2908    case SIOCDELDLCI:
2909        return sock_ioctl(file, cmd, arg);
2910
2911    case SIOCGIFFLAGS:
2912    case SIOCSIFFLAGS:
2913    case SIOCGIFMETRIC:
2914    case SIOCSIFMETRIC:
2915    case SIOCGIFMTU:
2916    case SIOCSIFMTU:
2917    case SIOCGIFMEM:
2918    case SIOCSIFMEM:
2919    case SIOCGIFHWADDR:
2920    case SIOCSIFHWADDR:
2921    case SIOCADDMULTI:
2922    case SIOCDELMULTI:
2923    case SIOCGIFINDEX:
2924    case SIOCGIFADDR:
2925    case SIOCSIFADDR:
2926    case SIOCSIFHWBROADCAST:
2927    case SIOCDIFADDR:
2928    case SIOCGIFBRDADDR:
2929    case SIOCSIFBRDADDR:
2930    case SIOCGIFDSTADDR:
2931    case SIOCSIFDSTADDR:
2932    case SIOCGIFNETMASK:
2933    case SIOCSIFNETMASK:
2934    case SIOCSIFPFLAGS:
2935    case SIOCGIFPFLAGS:
2936    case SIOCGIFTXQLEN:
2937    case SIOCSIFTXQLEN:
2938    case SIOCBRADDIF:
2939    case SIOCBRDELIF:
2940    case SIOCSIFNAME:
2941    case SIOCGMIIPHY:
2942    case SIOCGMIIREG:
2943    case SIOCSMIIREG:
2944        return dev_ifsioc(net, sock, cmd, argp);
2945
2946    case SIOCSARP:
2947    case SIOCGARP:
2948    case SIOCDARP:
2949    case SIOCATMARK:
2950        return sock_do_ioctl(net, sock, cmd, arg);
2951    }
2952
2953    /* Prevent warning from compat_sys_ioctl, these always
2954     * result in -EINVAL in the native case anyway. */
2955    switch (cmd) {
2956    case SIOCRTMSG:
2957    case SIOCGIFCOUNT:
2958    case SIOCSRARP:
2959    case SIOCGRARP:
2960    case SIOCDRARP:
2961    case SIOCSIFLINK:
2962    case SIOCGIFSLAVE:
2963    case SIOCSIFSLAVE:
2964        return -EINVAL;
2965    }
2966
2967    return -ENOIOCTLCMD;
2968}
2969
2970static long compat_sock_ioctl(struct file *file, unsigned cmd,
2971                  unsigned long arg)
2972{
2973    struct socket *sock = file->private_data;
2974    int ret = -ENOIOCTLCMD;
2975    struct sock *sk;
2976    struct net *net;
2977
2978    sk = sock->sk;
2979    net = sock_net(sk);
2980
2981    if (sock->ops->compat_ioctl)
2982        ret = sock->ops->compat_ioctl(sock, cmd, arg);
2983
2984    if (ret == -ENOIOCTLCMD &&
2985        (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
2986        ret = compat_wext_handle_ioctl(net, cmd, arg);
2987
2988    if (ret == -ENOIOCTLCMD)
2989        ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
2990
2991    return ret;
2992}
2993#endif
2994
2995int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
2996{
2997    return sock->ops->bind(sock, addr, addrlen);
2998}
2999EXPORT_SYMBOL(kernel_bind);
3000
3001int kernel_listen(struct socket *sock, int backlog)
3002{
3003    return sock->ops->listen(sock, backlog);
3004}
3005EXPORT_SYMBOL(kernel_listen);
3006
3007int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3008{
3009    struct sock *sk = sock->sk;
3010    int err;
3011
3012    err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3013                   newsock);
3014    if (err < 0)
3015        goto done;
3016
3017    err = sock->ops->accept(sock, *newsock, flags);
3018    if (err < 0) {
3019        sock_release(*newsock);
3020        *newsock = NULL;
3021        goto done;
3022    }
3023
3024    (*newsock)->ops = sock->ops;
3025    __module_get((*newsock)->ops->owner);
3026
3027done:
3028    return err;
3029}
3030EXPORT_SYMBOL(kernel_accept);
3031
3032int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3033           int flags)
3034{
3035    return sock->ops->connect(sock, addr, addrlen, flags);
3036}
3037EXPORT_SYMBOL(kernel_connect);
3038
3039int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3040             int *addrlen)
3041{
3042    return sock->ops->getname(sock, addr, addrlen, 0);
3043}
3044EXPORT_SYMBOL(kernel_getsockname);
3045
3046int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3047             int *addrlen)
3048{
3049    return sock->ops->getname(sock, addr, addrlen, 1);
3050}
3051EXPORT_SYMBOL(kernel_getpeername);
3052
3053int kernel_getsockopt(struct socket *sock, int level, int optname,
3054            char *optval, int *optlen)
3055{
3056    mm_segment_t oldfs = get_fs();
3057    int err;
3058
3059    set_fs(KERNEL_DS);
3060    if (level == SOL_SOCKET)
3061        err = sock_getsockopt(sock, level, optname, optval, optlen);
3062    else
3063        err = sock->ops->getsockopt(sock, level, optname, optval,
3064                        optlen);
3065    set_fs(oldfs);
3066    return err;
3067}
3068EXPORT_SYMBOL(kernel_getsockopt);
3069
3070int kernel_setsockopt(struct socket *sock, int level, int optname,
3071            char *optval, unsigned int optlen)
3072{
3073    mm_segment_t oldfs = get_fs();
3074    int err;
3075
3076    set_fs(KERNEL_DS);
3077    if (level == SOL_SOCKET)
3078        err = sock_setsockopt(sock, level, optname, optval, optlen);
3079    else
3080        err = sock->ops->setsockopt(sock, level, optname, optval,
3081                        optlen);
3082    set_fs(oldfs);
3083    return err;
3084}
3085EXPORT_SYMBOL(kernel_setsockopt);
3086
3087int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3088            size_t size, int flags)
3089{
3090    sock_update_classid(sock->sk);
3091
3092    if (sock->ops->sendpage)
3093        return sock->ops->sendpage(sock, page, offset, size, flags);
3094
3095    return sock_no_sendpage(sock, page, offset, size, flags);
3096}
3097EXPORT_SYMBOL(kernel_sendpage);
3098
3099int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3100{
3101    mm_segment_t oldfs = get_fs();
3102    int err;
3103
3104    set_fs(KERNEL_DS);
3105    err = sock->ops->ioctl(sock, cmd, arg);
3106    set_fs(oldfs);
3107
3108    return err;
3109}
3110EXPORT_SYMBOL(kernel_sock_ioctl);
3111
3112int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3113{
3114    return sock->ops->shutdown(sock, how);
3115}
3116EXPORT_SYMBOL(kernel_sock_shutdown);
3117

Archive Download this file



interactive