socket.c 88 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NET An implementation of the SOCKET network access protocol.
  4. *
  5. * Version: @(#)socket.c 1.1.93 18/02/95
  6. *
  7. * Authors: Orest Zborowski, <obz@Kodak.COM>
  8. * Ross Biro
  9. * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  10. *
  11. * Fixes:
  12. * Anonymous : NOTSOCK/BADF cleanup. Error fix in
  13. * shutdown()
  14. * Alan Cox : verify_area() fixes
  15. * Alan Cox : Removed DDI
  16. * Jonathan Kamens : SOCK_DGRAM reconnect bug
  17. * Alan Cox : Moved a load of checks to the very
  18. * top level.
  19. * Alan Cox : Move address structures to/from user
  20. * mode above the protocol layers.
  21. * Rob Janssen : Allow 0 length sends.
  22. * Alan Cox : Asynchronous I/O support (cribbed from the
  23. * tty drivers).
  24. * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
  25. * Jeff Uphoff : Made max number of sockets command-line
  26. * configurable.
  27. * Matti Aarnio : Made the number of sockets dynamic,
  28. * to be allocated when needed, and mr.
  29. * Uphoff's max is used as max to be
  30. * allowed to allocate.
  31. * Linus : Argh. removed all the socket allocation
  32. * altogether: it's in the inode now.
  33. * Alan Cox : Made sock_alloc()/sock_release() public
  34. * for NetROM and future kernel nfsd type
  35. * stuff.
  36. * Alan Cox : sendmsg/recvmsg basics.
  37. * Tom Dyas : Export net symbols.
  38. * Marcin Dalecki : Fixed problems with CONFIG_NET="n".
  39. * Alan Cox : Added thread locking to sys_* calls
  40. * for sockets. May have errors at the
  41. * moment.
  42. * Kevin Buhr : Fixed the dumb errors in the above.
  43. * Andi Kleen : Some small cleanups, optimizations,
  44. * and fixed a copy_from_user() bug.
  45. * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
  46. * Tigran Aivazian : Made listen(2) backlog sanity checks
  47. * protocol-independent
  48. *
  49. * This module is effectively the top level interface to the BSD socket
  50. * paradigm.
  51. *
  52. * Based upon Swansea University Computer Society NET3.039
  53. */
  54. #include <linux/mm.h>
  55. #include <linux/socket.h>
  56. #include <linux/file.h>
  57. #include <linux/net.h>
  58. #include <linux/interrupt.h>
  59. #include <linux/thread_info.h>
  60. #include <linux/rcupdate.h>
  61. #include <linux/netdevice.h>
  62. #include <linux/proc_fs.h>
  63. #include <linux/seq_file.h>
  64. #include <linux/mutex.h>
  65. #include <linux/if_bridge.h>
  66. #include <linux/if_frad.h>
  67. #include <linux/if_vlan.h>
  68. #include <linux/ptp_classify.h>
  69. #include <linux/init.h>
  70. #include <linux/poll.h>
  71. #include <linux/cache.h>
  72. #include <linux/module.h>
  73. #include <linux/highmem.h>
  74. #include <linux/mount.h>
  75. #include <linux/pseudo_fs.h>
  76. #include <linux/security.h>
  77. #include <linux/syscalls.h>
  78. #include <linux/compat.h>
  79. #include <linux/kmod.h>
  80. #include <linux/audit.h>
  81. #include <linux/wireless.h>
  82. #include <linux/nsproxy.h>
  83. #include <linux/magic.h>
  84. #include <linux/slab.h>
  85. #include <linux/xattr.h>
  86. #include <linux/nospec.h>
  87. #include <linux/indirect_call_wrapper.h>
  88. #include <linux/uaccess.h>
  89. #include <asm/unistd.h>
  90. #include <net/compat.h>
  91. #include <net/wext.h>
  92. #include <net/cls_cgroup.h>
  93. #include <net/sock.h>
  94. #include <linux/netfilter.h>
  95. #include <linux/if_tun.h>
  96. #include <linux/ipv6_route.h>
  97. #include <linux/route.h>
  98. #include <linux/termios.h>
  99. #include <linux/sockios.h>
  100. #include <net/busy_poll.h>
  101. #include <linux/errqueue.h>
  102. #ifdef CONFIG_NET_RX_BUSY_POLL
  103. unsigned int sysctl_net_busy_read __read_mostly;
  104. unsigned int sysctl_net_busy_poll __read_mostly;
  105. #endif
  106. static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
  107. static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
  108. static int sock_mmap(struct file *file, struct vm_area_struct *vma);
  109. static int sock_close(struct inode *inode, struct file *file);
  110. static __poll_t sock_poll(struct file *file,
  111. struct poll_table_struct *wait);
  112. static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
  113. #ifdef CONFIG_COMPAT
  114. static long compat_sock_ioctl(struct file *file,
  115. unsigned int cmd, unsigned long arg);
  116. #endif
  117. static int sock_fasync(int fd, struct file *filp, int on);
  118. static ssize_t sock_sendpage(struct file *file, struct page *page,
  119. int offset, size_t size, loff_t *ppos, int more);
  120. static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
  121. struct pipe_inode_info *pipe, size_t len,
  122. unsigned int flags);
  123. #ifdef CONFIG_PROC_FS
  124. static void sock_show_fdinfo(struct seq_file *m, struct file *f)
  125. {
  126. struct socket *sock = f->private_data;
  127. if (sock->ops->show_fdinfo)
  128. sock->ops->show_fdinfo(m, sock);
  129. }
  130. #else
  131. #define sock_show_fdinfo NULL
  132. #endif
  133. /*
  134. * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
  135. * in the operation structures but are done directly via the socketcall() multiplexor.
  136. */
  137. static const struct file_operations socket_file_ops = {
  138. .owner = THIS_MODULE,
  139. .llseek = no_llseek,
  140. .read_iter = sock_read_iter,
  141. .write_iter = sock_write_iter,
  142. .poll = sock_poll,
  143. .unlocked_ioctl = sock_ioctl,
  144. #ifdef CONFIG_COMPAT
  145. .compat_ioctl = compat_sock_ioctl,
  146. #endif
  147. .mmap = sock_mmap,
  148. .release = sock_close,
  149. .fasync = sock_fasync,
  150. .sendpage = sock_sendpage,
  151. .splice_write = generic_splice_sendpage,
  152. .splice_read = sock_splice_read,
  153. .show_fdinfo = sock_show_fdinfo,
  154. };
  155. /*
  156. * The protocol list. Each protocol is registered in here.
  157. */
  158. static DEFINE_SPINLOCK(net_family_lock);
  159. static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
  160. /*
  161. * Support routines.
  162. * Move socket addresses back and forth across the kernel/user
  163. * divide and look after the messy bits.
  164. */
  165. /**
  166. * move_addr_to_kernel - copy a socket address into kernel space
  167. * @uaddr: Address in user space
  168. * @kaddr: Address in kernel space
  169. * @ulen: Length in user space
  170. *
  171. * The address is copied into kernel space. If the provided address is
  172. * too long an error code of -EINVAL is returned. If the copy gives
  173. * invalid addresses -EFAULT is returned. On a success 0 is returned.
  174. */
  175. int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
  176. {
  177. if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
  178. return -EINVAL;
  179. if (ulen == 0)
  180. return 0;
  181. if (copy_from_user(kaddr, uaddr, ulen))
  182. return -EFAULT;
  183. return audit_sockaddr(ulen, kaddr);
  184. }
  185. /**
  186. * move_addr_to_user - copy an address to user space
  187. * @kaddr: kernel space address
  188. * @klen: length of address in kernel
  189. * @uaddr: user space address
  190. * @ulen: pointer to user length field
  191. *
  192. * The value pointed to by ulen on entry is the buffer length available.
  193. * This is overwritten with the buffer space used. -EINVAL is returned
  194. * if an overlong buffer is specified or a negative buffer size. -EFAULT
  195. * is returned if either the buffer or the length field are not
  196. * accessible.
  197. * After copying the data up to the limit the user specifies, the true
  198. * length of the data is written over the length limit the user
  199. * specified. Zero is returned for a success.
  200. */
  201. static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
  202. void __user *uaddr, int __user *ulen)
  203. {
  204. int err;
  205. int len;
  206. BUG_ON(klen > sizeof(struct sockaddr_storage));
  207. err = get_user(len, ulen);
  208. if (err)
  209. return err;
  210. if (len > klen)
  211. len = klen;
  212. if (len < 0)
  213. return -EINVAL;
  214. if (len) {
  215. if (audit_sockaddr(klen, kaddr))
  216. return -ENOMEM;
  217. if (copy_to_user(uaddr, kaddr, len))
  218. return -EFAULT;
  219. }
  220. /*
  221. * "fromlen shall refer to the value before truncation.."
  222. * 1003.1g
  223. */
  224. return __put_user(klen, ulen);
  225. }
  226. static struct kmem_cache *sock_inode_cachep __ro_after_init;
  227. static struct inode *sock_alloc_inode(struct super_block *sb)
  228. {
  229. struct socket_alloc *ei;
  230. ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
  231. if (!ei)
  232. return NULL;
  233. init_waitqueue_head(&ei->socket.wq.wait);
  234. ei->socket.wq.fasync_list = NULL;
  235. ei->socket.wq.flags = 0;
  236. ei->socket.state = SS_UNCONNECTED;
  237. ei->socket.flags = 0;
  238. ei->socket.ops = NULL;
  239. ei->socket.sk = NULL;
  240. ei->socket.file = NULL;
  241. return &ei->vfs_inode;
  242. }
  243. static void sock_free_inode(struct inode *inode)
  244. {
  245. struct socket_alloc *ei;
  246. ei = container_of(inode, struct socket_alloc, vfs_inode);
  247. kmem_cache_free(sock_inode_cachep, ei);
  248. }
  249. static void init_once(void *foo)
  250. {
  251. struct socket_alloc *ei = (struct socket_alloc *)foo;
  252. inode_init_once(&ei->vfs_inode);
  253. }
  254. static void init_inodecache(void)
  255. {
  256. sock_inode_cachep = kmem_cache_create("sock_inode_cache",
  257. sizeof(struct socket_alloc),
  258. 0,
  259. (SLAB_HWCACHE_ALIGN |
  260. SLAB_RECLAIM_ACCOUNT |
  261. SLAB_MEM_SPREAD | SLAB_ACCOUNT),
  262. init_once);
  263. BUG_ON(sock_inode_cachep == NULL);
  264. }
  265. static const struct super_operations sockfs_ops = {
  266. .alloc_inode = sock_alloc_inode,
  267. .free_inode = sock_free_inode,
  268. .statfs = simple_statfs,
  269. };
  270. /*
  271. * sockfs_dname() is called from d_path().
  272. */
  273. static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
  274. {
  275. return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
  276. d_inode(dentry)->i_ino);
  277. }
  278. static const struct dentry_operations sockfs_dentry_operations = {
  279. .d_dname = sockfs_dname,
  280. };
  281. static int sockfs_xattr_get(const struct xattr_handler *handler,
  282. struct dentry *dentry, struct inode *inode,
  283. const char *suffix, void *value, size_t size,
  284. int flags)
  285. {
  286. if (value) {
  287. if (dentry->d_name.len + 1 > size)
  288. return -ERANGE;
  289. memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
  290. }
  291. return dentry->d_name.len + 1;
  292. }
  293. #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
  294. #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
  295. #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
  296. static const struct xattr_handler sockfs_xattr_handler = {
  297. .name = XATTR_NAME_SOCKPROTONAME,
  298. .get = sockfs_xattr_get,
  299. };
  300. static int sockfs_security_xattr_set(const struct xattr_handler *handler,
  301. struct dentry *dentry, struct inode *inode,
  302. const char *suffix, const void *value,
  303. size_t size, int flags)
  304. {
  305. /* Handled by LSM. */
  306. return -EAGAIN;
  307. }
  308. static const struct xattr_handler sockfs_security_xattr_handler = {
  309. .prefix = XATTR_SECURITY_PREFIX,
  310. .set = sockfs_security_xattr_set,
  311. };
  312. static const struct xattr_handler *sockfs_xattr_handlers[] = {
  313. &sockfs_xattr_handler,
  314. &sockfs_security_xattr_handler,
  315. NULL
  316. };
  317. static int sockfs_init_fs_context(struct fs_context *fc)
  318. {
  319. struct pseudo_fs_context *ctx = init_pseudo(fc, SOCKFS_MAGIC);
  320. if (!ctx)
  321. return -ENOMEM;
  322. ctx->ops = &sockfs_ops;
  323. ctx->dops = &sockfs_dentry_operations;
  324. ctx->xattr = sockfs_xattr_handlers;
  325. return 0;
  326. }
  327. static struct vfsmount *sock_mnt __read_mostly;
  328. static struct file_system_type sock_fs_type = {
  329. .name = "sockfs",
  330. .init_fs_context = sockfs_init_fs_context,
  331. .kill_sb = kill_anon_super,
  332. };
  333. /*
  334. * Obtains the first available file descriptor and sets it up for use.
  335. *
  336. * These functions create file structures and maps them to fd space
  337. * of the current process. On success it returns file descriptor
  338. * and file struct implicitly stored in sock->file.
  339. * Note that another thread may close file descriptor before we return
  340. * from this function. We use the fact that now we do not refer
  341. * to socket after mapping. If one day we will need it, this
  342. * function will increment ref. count on file by 1.
  343. *
  344. * In any case returned fd MAY BE not valid!
  345. * This race condition is unavoidable
  346. * with shared fd spaces, we cannot solve it inside kernel,
  347. * but we take care of internal coherence yet.
  348. */
  349. /**
  350. * sock_alloc_file - Bind a &socket to a &file
  351. * @sock: socket
  352. * @flags: file status flags
  353. * @dname: protocol name
  354. *
  355. * Returns the &file bound with @sock, implicitly storing it
  356. * in sock->file. If dname is %NULL, sets to "".
  357. * On failure the return is a ERR pointer (see linux/err.h).
  358. * This function uses GFP_KERNEL internally.
  359. */
  360. struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
  361. {
  362. struct file *file;
  363. if (!dname)
  364. dname = sock->sk ? sock->sk->sk_prot_creator->name : "";
  365. file = alloc_file_pseudo(SOCK_INODE(sock), sock_mnt, dname,
  366. O_RDWR | (flags & O_NONBLOCK),
  367. &socket_file_ops);
  368. if (IS_ERR(file)) {
  369. sock_release(sock);
  370. return file;
  371. }
  372. sock->file = file;
  373. file->private_data = sock;
  374. stream_open(SOCK_INODE(sock), file);
  375. return file;
  376. }
  377. EXPORT_SYMBOL(sock_alloc_file);
  378. static int sock_map_fd(struct socket *sock, int flags)
  379. {
  380. struct file *newfile;
  381. int fd = get_unused_fd_flags(flags);
  382. if (unlikely(fd < 0)) {
  383. sock_release(sock);
  384. return fd;
  385. }
  386. newfile = sock_alloc_file(sock, flags, NULL);
  387. if (!IS_ERR(newfile)) {
  388. fd_install(fd, newfile);
  389. return fd;
  390. }
  391. put_unused_fd(fd);
  392. return PTR_ERR(newfile);
  393. }
  394. /**
  395. * sock_from_file - Return the &socket bounded to @file.
  396. * @file: file
  397. * @err: pointer to an error code return
  398. *
  399. * On failure returns %NULL and assigns -ENOTSOCK to @err.
  400. */
  401. struct socket *sock_from_file(struct file *file, int *err)
  402. {
  403. if (file->f_op == &socket_file_ops)
  404. return file->private_data; /* set in sock_map_fd */
  405. *err = -ENOTSOCK;
  406. return NULL;
  407. }
  408. EXPORT_SYMBOL(sock_from_file);
  409. /**
  410. * sockfd_lookup - Go from a file number to its socket slot
  411. * @fd: file handle
  412. * @err: pointer to an error code return
  413. *
  414. * The file handle passed in is locked and the socket it is bound
  415. * to is returned. If an error occurs the err pointer is overwritten
  416. * with a negative errno code and NULL is returned. The function checks
  417. * for both invalid handles and passing a handle which is not a socket.
  418. *
  419. * On a success the socket object pointer is returned.
  420. */
  421. struct socket *sockfd_lookup(int fd, int *err)
  422. {
  423. struct file *file;
  424. struct socket *sock;
  425. file = fget(fd);
  426. if (!file) {
  427. *err = -EBADF;
  428. return NULL;
  429. }
  430. sock = sock_from_file(file, err);
  431. if (!sock)
  432. fput(file);
  433. return sock;
  434. }
  435. EXPORT_SYMBOL(sockfd_lookup);
  436. static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
  437. {
  438. struct fd f = fdget(fd);
  439. struct socket *sock;
  440. *err = -EBADF;
  441. if (f.file) {
  442. sock = sock_from_file(f.file, err);
  443. if (likely(sock)) {
  444. *fput_needed = f.flags & FDPUT_FPUT;
  445. return sock;
  446. }
  447. fdput(f);
  448. }
  449. return NULL;
  450. }
  451. static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
  452. size_t size)
  453. {
  454. ssize_t len;
  455. ssize_t used = 0;
  456. len = security_inode_listsecurity(d_inode(dentry), buffer, size);
  457. if (len < 0)
  458. return len;
  459. used += len;
  460. if (buffer) {
  461. if (size < used)
  462. return -ERANGE;
  463. buffer += len;
  464. }
  465. len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
  466. used += len;
  467. if (buffer) {
  468. if (size < used)
  469. return -ERANGE;
  470. memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
  471. buffer += len;
  472. }
  473. return used;
  474. }
  475. static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
  476. {
  477. int err = simple_setattr(dentry, iattr);
  478. if (!err && (iattr->ia_valid & ATTR_UID)) {
  479. struct socket *sock = SOCKET_I(d_inode(dentry));
  480. if (sock->sk)
  481. sock->sk->sk_uid = iattr->ia_uid;
  482. else
  483. err = -ENOENT;
  484. }
  485. return err;
  486. }
  487. static const struct inode_operations sockfs_inode_ops = {
  488. .listxattr = sockfs_listxattr,
  489. .setattr = sockfs_setattr,
  490. };
  491. /**
  492. * sock_alloc - allocate a socket
  493. *
  494. * Allocate a new inode and socket object. The two are bound together
  495. * and initialised. The socket is then returned. If we are out of inodes
  496. * NULL is returned. This functions uses GFP_KERNEL internally.
  497. */
  498. struct socket *sock_alloc(void)
  499. {
  500. struct inode *inode;
  501. struct socket *sock;
  502. inode = new_inode_pseudo(sock_mnt->mnt_sb);
  503. if (!inode)
  504. return NULL;
  505. sock = SOCKET_I(inode);
  506. inode->i_ino = get_next_ino();
  507. inode->i_mode = S_IFSOCK | S_IRWXUGO;
  508. inode->i_uid = current_fsuid();
  509. inode->i_gid = current_fsgid();
  510. inode->i_op = &sockfs_inode_ops;
  511. return sock;
  512. }
  513. EXPORT_SYMBOL(sock_alloc);
  514. static void __sock_release(struct socket *sock, struct inode *inode)
  515. {
  516. if (sock->ops) {
  517. struct module *owner = sock->ops->owner;
  518. if (inode)
  519. inode_lock(inode);
  520. sock->ops->release(sock);
  521. sock->sk = NULL;
  522. if (inode)
  523. inode_unlock(inode);
  524. sock->ops = NULL;
  525. module_put(owner);
  526. }
  527. if (sock->wq.fasync_list)
  528. pr_err("%s: fasync list not empty!\n", __func__);
  529. if (!sock->file) {
  530. iput(SOCK_INODE(sock));
  531. return;
  532. }
  533. sock->file = NULL;
  534. }
  535. /**
  536. * sock_release - close a socket
  537. * @sock: socket to close
  538. *
  539. * The socket is released from the protocol stack if it has a release
  540. * callback, and the inode is then released if the socket is bound to
  541. * an inode not a file.
  542. */
  543. void sock_release(struct socket *sock)
  544. {
  545. __sock_release(sock, NULL);
  546. }
  547. EXPORT_SYMBOL(sock_release);
  548. void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
  549. {
  550. u8 flags = *tx_flags;
  551. if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
  552. flags |= SKBTX_HW_TSTAMP;
  553. if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
  554. flags |= SKBTX_SW_TSTAMP;
  555. if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
  556. flags |= SKBTX_SCHED_TSTAMP;
  557. *tx_flags = flags;
  558. }
  559. EXPORT_SYMBOL(__sock_tx_timestamp);
  560. INDIRECT_CALLABLE_DECLARE(int inet_sendmsg(struct socket *, struct msghdr *,
  561. size_t));
  562. INDIRECT_CALLABLE_DECLARE(int inet6_sendmsg(struct socket *, struct msghdr *,
  563. size_t));
  564. static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
  565. {
  566. int ret = INDIRECT_CALL_INET(sock->ops->sendmsg, inet6_sendmsg,
  567. inet_sendmsg, sock, msg,
  568. msg_data_left(msg));
  569. BUG_ON(ret == -EIOCBQUEUED);
  570. return ret;
  571. }
  572. /**
  573. * sock_sendmsg - send a message through @sock
  574. * @sock: socket
  575. * @msg: message to send
  576. *
  577. * Sends @msg through @sock, passing through LSM.
  578. * Returns the number of bytes sent, or an error code.
  579. */
  580. int sock_sendmsg(struct socket *sock, struct msghdr *msg)
  581. {
  582. int err = security_socket_sendmsg(sock, msg,
  583. msg_data_left(msg));
  584. return err ?: sock_sendmsg_nosec(sock, msg);
  585. }
  586. EXPORT_SYMBOL(sock_sendmsg);
  587. /**
  588. * kernel_sendmsg - send a message through @sock (kernel-space)
  589. * @sock: socket
  590. * @msg: message header
  591. * @vec: kernel vec
  592. * @num: vec array length
  593. * @size: total message data size
  594. *
  595. * Builds the message data with @vec and sends it through @sock.
  596. * Returns the number of bytes sent, or an error code.
  597. */
  598. int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
  599. struct kvec *vec, size_t num, size_t size)
  600. {
  601. iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size);
  602. return sock_sendmsg(sock, msg);
  603. }
  604. EXPORT_SYMBOL(kernel_sendmsg);
  605. /**
  606. * kernel_sendmsg_locked - send a message through @sock (kernel-space)
  607. * @sk: sock
  608. * @msg: message header
  609. * @vec: output s/g array
  610. * @num: output s/g array length
  611. * @size: total message data size
  612. *
  613. * Builds the message data with @vec and sends it through @sock.
  614. * Returns the number of bytes sent, or an error code.
  615. * Caller must hold @sk.
  616. */
  617. int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
  618. struct kvec *vec, size_t num, size_t size)
  619. {
  620. struct socket *sock = sk->sk_socket;
  621. if (!sock->ops->sendmsg_locked)
  622. return sock_no_sendmsg_locked(sk, msg, size);
  623. iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size);
  624. return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg));
  625. }
  626. EXPORT_SYMBOL(kernel_sendmsg_locked);
  627. static bool skb_is_err_queue(const struct sk_buff *skb)
  628. {
  629. /* pkt_type of skbs enqueued on the error queue are set to
  630. * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
  631. * in recvmsg, since skbs received on a local socket will never
  632. * have a pkt_type of PACKET_OUTGOING.
  633. */
  634. return skb->pkt_type == PACKET_OUTGOING;
  635. }
  636. /* On transmit, software and hardware timestamps are returned independently.
  637. * As the two skb clones share the hardware timestamp, which may be updated
  638. * before the software timestamp is received, a hardware TX timestamp may be
  639. * returned only if there is no software TX timestamp. Ignore false software
  640. * timestamps, which may be made in the __sock_recv_timestamp() call when the
  641. * option SO_TIMESTAMP_OLD(NS) is enabled on the socket, even when the skb has a
  642. * hardware timestamp.
  643. */
  644. static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp)
  645. {
  646. return skb->tstamp && !false_tstamp && skb_is_err_queue(skb);
  647. }
  648. static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb)
  649. {
  650. struct scm_ts_pktinfo ts_pktinfo;
  651. struct net_device *orig_dev;
  652. if (!skb_mac_header_was_set(skb))
  653. return;
  654. memset(&ts_pktinfo, 0, sizeof(ts_pktinfo));
  655. rcu_read_lock();
  656. orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
  657. if (orig_dev)
  658. ts_pktinfo.if_index = orig_dev->ifindex;
  659. rcu_read_unlock();
  660. ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb);
  661. put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
  662. sizeof(ts_pktinfo), &ts_pktinfo);
  663. }
  664. /*
  665. * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
  666. */
  667. void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
  668. struct sk_buff *skb)
  669. {
  670. int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
  671. int new_tstamp = sock_flag(sk, SOCK_TSTAMP_NEW);
  672. struct scm_timestamping_internal tss;
  673. int empty = 1, false_tstamp = 0;
  674. struct skb_shared_hwtstamps *shhwtstamps =
  675. skb_hwtstamps(skb);
  676. /* Race occurred between timestamp enabling and packet
  677. receiving. Fill in the current time for now. */
  678. if (need_software_tstamp && skb->tstamp == 0) {
  679. __net_timestamp(skb);
  680. false_tstamp = 1;
  681. }
  682. if (need_software_tstamp) {
  683. if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
  684. if (new_tstamp) {
  685. struct __kernel_sock_timeval tv;
  686. skb_get_new_timestamp(skb, &tv);
  687. put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_NEW,
  688. sizeof(tv), &tv);
  689. } else {
  690. struct __kernel_old_timeval tv;
  691. skb_get_timestamp(skb, &tv);
  692. put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_OLD,
  693. sizeof(tv), &tv);
  694. }
  695. } else {
  696. if (new_tstamp) {
  697. struct __kernel_timespec ts;
  698. skb_get_new_timestampns(skb, &ts);
  699. put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_NEW,
  700. sizeof(ts), &ts);
  701. } else {
  702. struct __kernel_old_timespec ts;
  703. skb_get_timestampns(skb, &ts);
  704. put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_OLD,
  705. sizeof(ts), &ts);
  706. }
  707. }
  708. }
  709. memset(&tss, 0, sizeof(tss));
  710. if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
  711. ktime_to_timespec64_cond(skb->tstamp, tss.ts + 0))
  712. empty = 0;
  713. if (shhwtstamps &&
  714. (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
  715. !skb_is_swtx_tstamp(skb, false_tstamp) &&
  716. ktime_to_timespec64_cond(shhwtstamps->hwtstamp, tss.ts + 2)) {
  717. empty = 0;
  718. if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) &&
  719. !skb_is_err_queue(skb))
  720. put_ts_pktinfo(msg, skb);
  721. }
  722. if (!empty) {
  723. if (sock_flag(sk, SOCK_TSTAMP_NEW))
  724. put_cmsg_scm_timestamping64(msg, &tss);
  725. else
  726. put_cmsg_scm_timestamping(msg, &tss);
  727. if (skb_is_err_queue(skb) && skb->len &&
  728. SKB_EXT_ERR(skb)->opt_stats)
  729. put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
  730. skb->len, skb->data);
  731. }
  732. }
  733. EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
  734. void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
  735. struct sk_buff *skb)
  736. {
  737. int ack;
  738. if (!sock_flag(sk, SOCK_WIFI_STATUS))
  739. return;
  740. if (!skb->wifi_acked_valid)
  741. return;
  742. ack = skb->wifi_acked;
  743. put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
  744. }
  745. EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
  746. static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
  747. struct sk_buff *skb)
  748. {
  749. if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
  750. put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
  751. sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
  752. }
  753. void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
  754. struct sk_buff *skb)
  755. {
  756. sock_recv_timestamp(msg, sk, skb);
  757. sock_recv_drops(msg, sk, skb);
  758. }
  759. EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
  760. INDIRECT_CALLABLE_DECLARE(int inet_recvmsg(struct socket *, struct msghdr *,
  761. size_t, int));
  762. INDIRECT_CALLABLE_DECLARE(int inet6_recvmsg(struct socket *, struct msghdr *,
  763. size_t, int));
  764. static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
  765. int flags)
  766. {
  767. return INDIRECT_CALL_INET(sock->ops->recvmsg, inet6_recvmsg,
  768. inet_recvmsg, sock, msg, msg_data_left(msg),
  769. flags);
  770. }
  771. /**
  772. * sock_recvmsg - receive a message from @sock
  773. * @sock: socket
  774. * @msg: message to receive
  775. * @flags: message flags
  776. *
  777. * Receives @msg from @sock, passing through LSM. Returns the total number
  778. * of bytes received, or an error.
  779. */
  780. int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
  781. {
  782. int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
  783. return err ?: sock_recvmsg_nosec(sock, msg, flags);
  784. }
  785. EXPORT_SYMBOL(sock_recvmsg);
  786. /**
  787. * kernel_recvmsg - Receive a message from a socket (kernel space)
  788. * @sock: The socket to receive the message from
  789. * @msg: Received message
  790. * @vec: Input s/g array for message data
  791. * @num: Size of input s/g array
  792. * @size: Number of bytes to read
  793. * @flags: Message flags (MSG_DONTWAIT, etc...)
  794. *
  795. * On return the msg structure contains the scatter/gather array passed in the
  796. * vec argument. The array is modified so that it consists of the unfilled
  797. * portion of the original array.
  798. *
  799. * The returned value is the total number of bytes received, or an error.
  800. */
  801. int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
  802. struct kvec *vec, size_t num, size_t size, int flags)
  803. {
  804. msg->msg_control_is_user = false;
  805. iov_iter_kvec(&msg->msg_iter, READ, vec, num, size);
  806. return sock_recvmsg(sock, msg, flags);
  807. }
  808. EXPORT_SYMBOL(kernel_recvmsg);
  809. static ssize_t sock_sendpage(struct file *file, struct page *page,
  810. int offset, size_t size, loff_t *ppos, int more)
  811. {
  812. struct socket *sock;
  813. int flags;
  814. sock = file->private_data;
  815. flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
  816. /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
  817. flags |= more;
  818. return kernel_sendpage(sock, page, offset, size, flags);
  819. }
  820. static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
  821. struct pipe_inode_info *pipe, size_t len,
  822. unsigned int flags)
  823. {
  824. struct socket *sock = file->private_data;
  825. if (unlikely(!sock->ops->splice_read))
  826. return generic_file_splice_read(file, ppos, pipe, len, flags);
  827. return sock->ops->splice_read(sock, ppos, pipe, len, flags);
  828. }
  829. static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
  830. {
  831. struct file *file = iocb->ki_filp;
  832. struct socket *sock = file->private_data;
  833. struct msghdr msg = {.msg_iter = *to,
  834. .msg_iocb = iocb};
  835. ssize_t res;
  836. if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
  837. msg.msg_flags = MSG_DONTWAIT;
  838. if (iocb->ki_pos != 0)
  839. return -ESPIPE;
  840. if (!iov_iter_count(to)) /* Match SYS5 behaviour */
  841. return 0;
  842. res = sock_recvmsg(sock, &msg, msg.msg_flags);
  843. *to = msg.msg_iter;
  844. return res;
  845. }
  846. static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
  847. {
  848. struct file *file = iocb->ki_filp;
  849. struct socket *sock = file->private_data;
  850. struct msghdr msg = {.msg_iter = *from,
  851. .msg_iocb = iocb};
  852. ssize_t res;
  853. if (iocb->ki_pos != 0)
  854. return -ESPIPE;
  855. if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
  856. msg.msg_flags = MSG_DONTWAIT;
  857. if (sock->type == SOCK_SEQPACKET)
  858. msg.msg_flags |= MSG_EOR;
  859. res = sock_sendmsg(sock, &msg);
  860. *from = msg.msg_iter;
  861. return res;
  862. }
  863. /*
  864. * Atomic setting of ioctl hooks to avoid race
  865. * with module unload.
  866. */
  867. static DEFINE_MUTEX(br_ioctl_mutex);
  868. static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
  869. void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
  870. {
  871. mutex_lock(&br_ioctl_mutex);
  872. br_ioctl_hook = hook;
  873. mutex_unlock(&br_ioctl_mutex);
  874. }
  875. EXPORT_SYMBOL(brioctl_set);
  876. static DEFINE_MUTEX(vlan_ioctl_mutex);
  877. static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
  878. void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
  879. {
  880. mutex_lock(&vlan_ioctl_mutex);
  881. vlan_ioctl_hook = hook;
  882. mutex_unlock(&vlan_ioctl_mutex);
  883. }
  884. EXPORT_SYMBOL(vlan_ioctl_set);
  885. static DEFINE_MUTEX(dlci_ioctl_mutex);
  886. static int (*dlci_ioctl_hook) (unsigned int, void __user *);
  887. void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
  888. {
  889. mutex_lock(&dlci_ioctl_mutex);
  890. dlci_ioctl_hook = hook;
  891. mutex_unlock(&dlci_ioctl_mutex);
  892. }
  893. EXPORT_SYMBOL(dlci_ioctl_set);
  894. static long sock_do_ioctl(struct net *net, struct socket *sock,
  895. unsigned int cmd, unsigned long arg)
  896. {
  897. int err;
  898. void __user *argp = (void __user *)arg;
  899. err = sock->ops->ioctl(sock, cmd, arg);
  900. /*
  901. * If this ioctl is unknown try to hand it down
  902. * to the NIC driver.
  903. */
  904. if (err != -ENOIOCTLCMD)
  905. return err;
  906. if (cmd == SIOCGIFCONF) {
  907. struct ifconf ifc;
  908. if (copy_from_user(&ifc, argp, sizeof(struct ifconf)))
  909. return -EFAULT;
  910. rtnl_lock();
  911. err = dev_ifconf(net, &ifc, sizeof(struct ifreq));
  912. rtnl_unlock();
  913. if (!err && copy_to_user(argp, &ifc, sizeof(struct ifconf)))
  914. err = -EFAULT;
  915. } else if (is_socket_ioctl_cmd(cmd)) {
  916. struct ifreq ifr;
  917. bool need_copyout;
  918. if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
  919. return -EFAULT;
  920. err = dev_ioctl(net, cmd, &ifr, &need_copyout);
  921. if (!err && need_copyout)
  922. if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
  923. return -EFAULT;
  924. } else {
  925. err = -ENOTTY;
  926. }
  927. return err;
  928. }
  929. /*
  930. * With an ioctl, arg may well be a user mode pointer, but we don't know
  931. * what to do with it - that's up to the protocol still.
  932. */
  933. static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
  934. {
  935. struct socket *sock;
  936. struct sock *sk;
  937. void __user *argp = (void __user *)arg;
  938. int pid, err;
  939. struct net *net;
  940. sock = file->private_data;
  941. sk = sock->sk;
  942. net = sock_net(sk);
  943. if (unlikely(cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))) {
  944. struct ifreq ifr;
  945. bool need_copyout;
  946. if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
  947. return -EFAULT;
  948. err = dev_ioctl(net, cmd, &ifr, &need_copyout);
  949. if (!err && need_copyout)
  950. if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
  951. return -EFAULT;
  952. } else
  953. #ifdef CONFIG_WEXT_CORE
  954. if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
  955. err = wext_handle_ioctl(net, cmd, argp);
  956. } else
  957. #endif
  958. switch (cmd) {
  959. case FIOSETOWN:
  960. case SIOCSPGRP:
  961. err = -EFAULT;
  962. if (get_user(pid, (int __user *)argp))
  963. break;
  964. err = f_setown(sock->file, pid, 1);
  965. break;
  966. case FIOGETOWN:
  967. case SIOCGPGRP:
  968. err = put_user(f_getown(sock->file),
  969. (int __user *)argp);
  970. break;
  971. case SIOCGIFBR:
  972. case SIOCSIFBR:
  973. case SIOCBRADDBR:
  974. case SIOCBRDELBR:
  975. err = -ENOPKG;
  976. if (!br_ioctl_hook)
  977. request_module("bridge");
  978. mutex_lock(&br_ioctl_mutex);
  979. if (br_ioctl_hook)
  980. err = br_ioctl_hook(net, cmd, argp);
  981. mutex_unlock(&br_ioctl_mutex);
  982. break;
  983. case SIOCGIFVLAN:
  984. case SIOCSIFVLAN:
  985. err = -ENOPKG;
  986. if (!vlan_ioctl_hook)
  987. request_module("8021q");
  988. mutex_lock(&vlan_ioctl_mutex);
  989. if (vlan_ioctl_hook)
  990. err = vlan_ioctl_hook(net, argp);
  991. mutex_unlock(&vlan_ioctl_mutex);
  992. break;
  993. case SIOCADDDLCI:
  994. case SIOCDELDLCI:
  995. err = -ENOPKG;
  996. if (!dlci_ioctl_hook)
  997. request_module("dlci");
  998. mutex_lock(&dlci_ioctl_mutex);
  999. if (dlci_ioctl_hook)
  1000. err = dlci_ioctl_hook(cmd, argp);
  1001. mutex_unlock(&dlci_ioctl_mutex);
  1002. break;
  1003. case SIOCGSKNS:
  1004. err = -EPERM;
  1005. if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
  1006. break;
  1007. err = open_related_ns(&net->ns, get_net_ns);
  1008. break;
  1009. case SIOCGSTAMP_OLD:
  1010. case SIOCGSTAMPNS_OLD:
  1011. if (!sock->ops->gettstamp) {
  1012. err = -ENOIOCTLCMD;
  1013. break;
  1014. }
  1015. err = sock->ops->gettstamp(sock, argp,
  1016. cmd == SIOCGSTAMP_OLD,
  1017. !IS_ENABLED(CONFIG_64BIT));
  1018. break;
  1019. case SIOCGSTAMP_NEW:
  1020. case SIOCGSTAMPNS_NEW:
  1021. if (!sock->ops->gettstamp) {
  1022. err = -ENOIOCTLCMD;
  1023. break;
  1024. }
  1025. err = sock->ops->gettstamp(sock, argp,
  1026. cmd == SIOCGSTAMP_NEW,
  1027. false);
  1028. break;
  1029. default:
  1030. err = sock_do_ioctl(net, sock, cmd, arg);
  1031. break;
  1032. }
  1033. return err;
  1034. }
  1035. /**
  1036. * sock_create_lite - creates a socket
  1037. * @family: protocol family (AF_INET, ...)
  1038. * @type: communication type (SOCK_STREAM, ...)
  1039. * @protocol: protocol (0, ...)
  1040. * @res: new socket
  1041. *
  1042. * Creates a new socket and assigns it to @res, passing through LSM.
  1043. * The new socket initialization is not complete, see kernel_accept().
  1044. * Returns 0 or an error. On failure @res is set to %NULL.
  1045. * This function internally uses GFP_KERNEL.
  1046. */
  1047. int sock_create_lite(int family, int type, int protocol, struct socket **res)
  1048. {
  1049. int err;
  1050. struct socket *sock = NULL;
  1051. err = security_socket_create(family, type, protocol, 1);
  1052. if (err)
  1053. goto out;
  1054. sock = sock_alloc();
  1055. if (!sock) {
  1056. err = -ENOMEM;
  1057. goto out;
  1058. }
  1059. sock->type = type;
  1060. err = security_socket_post_create(sock, family, type, protocol, 1);
  1061. if (err)
  1062. goto out_release;
  1063. out:
  1064. *res = sock;
  1065. return err;
  1066. out_release:
  1067. sock_release(sock);
  1068. sock = NULL;
  1069. goto out;
  1070. }
  1071. EXPORT_SYMBOL(sock_create_lite);
  1072. /* No kernel lock held - perfect */
  1073. static __poll_t sock_poll(struct file *file, poll_table *wait)
  1074. {
  1075. struct socket *sock = file->private_data;
  1076. __poll_t events = poll_requested_events(wait), flag = 0;
  1077. if (!sock->ops->poll)
  1078. return 0;
  1079. if (sk_can_busy_loop(sock->sk)) {
  1080. /* poll once if requested by the syscall */
  1081. if (events & POLL_BUSY_LOOP)
  1082. sk_busy_loop(sock->sk, 1);
  1083. /* if this socket can poll_ll, tell the system call */
  1084. flag = POLL_BUSY_LOOP;
  1085. }
  1086. return sock->ops->poll(file, sock, wait) | flag;
  1087. }
  1088. static int sock_mmap(struct file *file, struct vm_area_struct *vma)
  1089. {
  1090. struct socket *sock = file->private_data;
  1091. return sock->ops->mmap(file, sock, vma);
  1092. }
  1093. static int sock_close(struct inode *inode, struct file *filp)
  1094. {
  1095. __sock_release(SOCKET_I(inode), inode);
  1096. return 0;
  1097. }
  1098. /*
  1099. * Update the socket async list
  1100. *
  1101. * Fasync_list locking strategy.
  1102. *
  1103. * 1. fasync_list is modified only under process context socket lock
  1104. * i.e. under semaphore.
  1105. * 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
  1106. * or under socket lock
  1107. */
  1108. static int sock_fasync(int fd, struct file *filp, int on)
  1109. {
  1110. struct socket *sock = filp->private_data;
  1111. struct sock *sk = sock->sk;
  1112. struct socket_wq *wq = &sock->wq;
  1113. if (sk == NULL)
  1114. return -EINVAL;
  1115. lock_sock(sk);
  1116. fasync_helper(fd, filp, on, &wq->fasync_list);
  1117. if (!wq->fasync_list)
  1118. sock_reset_flag(sk, SOCK_FASYNC);
  1119. else
  1120. sock_set_flag(sk, SOCK_FASYNC);
  1121. release_sock(sk);
  1122. return 0;
  1123. }
  1124. /* This function may be called only under rcu_lock */
  1125. int sock_wake_async(struct socket_wq *wq, int how, int band)
  1126. {
  1127. if (!wq || !wq->fasync_list)
  1128. return -1;
  1129. switch (how) {
  1130. case SOCK_WAKE_WAITD:
  1131. if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
  1132. break;
  1133. goto call_kill;
  1134. case SOCK_WAKE_SPACE:
  1135. if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
  1136. break;
  1137. fallthrough;
  1138. case SOCK_WAKE_IO:
  1139. call_kill:
  1140. kill_fasync(&wq->fasync_list, SIGIO, band);
  1141. break;
  1142. case SOCK_WAKE_URG:
  1143. kill_fasync(&wq->fasync_list, SIGURG, band);
  1144. }
  1145. return 0;
  1146. }
  1147. EXPORT_SYMBOL(sock_wake_async);
  1148. /**
  1149. * __sock_create - creates a socket
  1150. * @net: net namespace
  1151. * @family: protocol family (AF_INET, ...)
  1152. * @type: communication type (SOCK_STREAM, ...)
  1153. * @protocol: protocol (0, ...)
  1154. * @res: new socket
  1155. * @kern: boolean for kernel space sockets
  1156. *
  1157. * Creates a new socket and assigns it to @res, passing through LSM.
  1158. * Returns 0 or an error. On failure @res is set to %NULL. @kern must
  1159. * be set to true if the socket resides in kernel space.
  1160. * This function internally uses GFP_KERNEL.
  1161. */
  1162. int __sock_create(struct net *net, int family, int type, int protocol,
  1163. struct socket **res, int kern)
  1164. {
  1165. int err;
  1166. struct socket *sock;
  1167. const struct net_proto_family *pf;
  1168. /*
  1169. * Check protocol is in range
  1170. */
  1171. if (family < 0 || family >= NPROTO)
  1172. return -EAFNOSUPPORT;
  1173. if (type < 0 || type >= SOCK_MAX)
  1174. return -EINVAL;
  1175. /* Compatibility.
  1176. This uglymoron is moved from INET layer to here to avoid
  1177. deadlock in module load.
  1178. */
  1179. if (family == PF_INET && type == SOCK_PACKET) {
  1180. pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
  1181. current->comm);
  1182. family = PF_PACKET;
  1183. }
  1184. err = security_socket_create(family, type, protocol, kern);
  1185. if (err)
  1186. return err;
  1187. /*
  1188. * Allocate the socket and allow the family to set things up. if
  1189. * the protocol is 0, the family is instructed to select an appropriate
  1190. * default.
  1191. */
  1192. sock = sock_alloc();
  1193. if (!sock) {
  1194. net_warn_ratelimited("socket: no more sockets\n");
  1195. return -ENFILE; /* Not exactly a match, but its the
  1196. closest posix thing */
  1197. }
  1198. sock->type = type;
  1199. #ifdef CONFIG_MODULES
  1200. /* Attempt to load a protocol module if the find failed.
  1201. *
  1202. * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
  1203. * requested real, full-featured networking support upon configuration.
  1204. * Otherwise module support will break!
  1205. */
  1206. if (rcu_access_pointer(net_families[family]) == NULL)
  1207. request_module("net-pf-%d", family);
  1208. #endif
  1209. rcu_read_lock();
  1210. pf = rcu_dereference(net_families[family]);
  1211. err = -EAFNOSUPPORT;
  1212. if (!pf)
  1213. goto out_release;
  1214. /*
  1215. * We will call the ->create function, that possibly is in a loadable
  1216. * module, so we have to bump that loadable module refcnt first.
  1217. */
  1218. if (!try_module_get(pf->owner))
  1219. goto out_release;
  1220. /* Now protected by module ref count */
  1221. rcu_read_unlock();
  1222. err = pf->create(net, sock, protocol, kern);
  1223. if (err < 0)
  1224. goto out_module_put;
  1225. /*
  1226. * Now to bump the refcnt of the [loadable] module that owns this
  1227. * socket at sock_release time we decrement its refcnt.
  1228. */
  1229. if (!try_module_get(sock->ops->owner))
  1230. goto out_module_busy;
  1231. /*
  1232. * Now that we're done with the ->create function, the [loadable]
  1233. * module can have its refcnt decremented
  1234. */
  1235. module_put(pf->owner);
  1236. err = security_socket_post_create(sock, family, type, protocol, kern);
  1237. if (err)
  1238. goto out_sock_release;
  1239. *res = sock;
  1240. return 0;
  1241. out_module_busy:
  1242. err = -EAFNOSUPPORT;
  1243. out_module_put:
  1244. sock->ops = NULL;
  1245. module_put(pf->owner);
  1246. out_sock_release:
  1247. sock_release(sock);
  1248. return err;
  1249. out_release:
  1250. rcu_read_unlock();
  1251. goto out_sock_release;
  1252. }
  1253. EXPORT_SYMBOL(__sock_create);
  1254. /**
  1255. * sock_create - creates a socket
  1256. * @family: protocol family (AF_INET, ...)
  1257. * @type: communication type (SOCK_STREAM, ...)
  1258. * @protocol: protocol (0, ...)
  1259. * @res: new socket
  1260. *
  1261. * A wrapper around __sock_create().
  1262. * Returns 0 or an error. This function internally uses GFP_KERNEL.
  1263. */
  1264. int sock_create(int family, int type, int protocol, struct socket **res)
  1265. {
  1266. return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
  1267. }
  1268. EXPORT_SYMBOL(sock_create);
  1269. /**
  1270. * sock_create_kern - creates a socket (kernel space)
  1271. * @net: net namespace
  1272. * @family: protocol family (AF_INET, ...)
  1273. * @type: communication type (SOCK_STREAM, ...)
  1274. * @protocol: protocol (0, ...)
  1275. * @res: new socket
  1276. *
  1277. * A wrapper around __sock_create().
  1278. * Returns 0 or an error. This function internally uses GFP_KERNEL.
  1279. */
  1280. int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
  1281. {
  1282. return __sock_create(net, family, type, protocol, res, 1);
  1283. }
  1284. EXPORT_SYMBOL(sock_create_kern);
  1285. int __sys_socket(int family, int type, int protocol)
  1286. {
  1287. int retval;
  1288. struct socket *sock;
  1289. int flags;
  1290. /* Check the SOCK_* constants for consistency. */
  1291. BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
  1292. BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
  1293. BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
  1294. BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
  1295. flags = type & ~SOCK_TYPE_MASK;
  1296. if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
  1297. return -EINVAL;
  1298. type &= SOCK_TYPE_MASK;
  1299. if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
  1300. flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
  1301. retval = sock_create(family, type, protocol, &sock);
  1302. if (retval < 0)
  1303. return retval;
  1304. return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
  1305. }
  1306. SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
  1307. {
  1308. return __sys_socket(family, type, protocol);
  1309. }
  1310. /*
  1311. * Create a pair of connected sockets.
  1312. */
  1313. int __sys_socketpair(int family, int type, int protocol, int __user *usockvec)
  1314. {
  1315. struct socket *sock1, *sock2;
  1316. int fd1, fd2, err;
  1317. struct file *newfile1, *newfile2;
  1318. int flags;
  1319. flags = type & ~SOCK_TYPE_MASK;
  1320. if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
  1321. return -EINVAL;
  1322. type &= SOCK_TYPE_MASK;
  1323. if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
  1324. flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
  1325. /*
  1326. * reserve descriptors and make sure we won't fail
  1327. * to return them to userland.
  1328. */
  1329. fd1 = get_unused_fd_flags(flags);
  1330. if (unlikely(fd1 < 0))
  1331. return fd1;
  1332. fd2 = get_unused_fd_flags(flags);
  1333. if (unlikely(fd2 < 0)) {
  1334. put_unused_fd(fd1);
  1335. return fd2;
  1336. }
  1337. err = put_user(fd1, &usockvec[0]);
  1338. if (err)
  1339. goto out;
  1340. err = put_user(fd2, &usockvec[1]);
  1341. if (err)
  1342. goto out;
  1343. /*
  1344. * Obtain the first socket and check if the underlying protocol
  1345. * supports the socketpair call.
  1346. */
  1347. err = sock_create(family, type, protocol, &sock1);
  1348. if (unlikely(err < 0))
  1349. goto out;
  1350. err = sock_create(family, type, protocol, &sock2);
  1351. if (unlikely(err < 0)) {
  1352. sock_release(sock1);
  1353. goto out;
  1354. }
  1355. err = security_socket_socketpair(sock1, sock2);
  1356. if (unlikely(err)) {
  1357. sock_release(sock2);
  1358. sock_release(sock1);
  1359. goto out;
  1360. }
  1361. err = sock1->ops->socketpair(sock1, sock2);
  1362. if (unlikely(err < 0)) {
  1363. sock_release(sock2);
  1364. sock_release(sock1);
  1365. goto out;
  1366. }
  1367. newfile1 = sock_alloc_file(sock1, flags, NULL);
  1368. if (IS_ERR(newfile1)) {
  1369. err = PTR_ERR(newfile1);
  1370. sock_release(sock2);
  1371. goto out;
  1372. }
  1373. newfile2 = sock_alloc_file(sock2, flags, NULL);
  1374. if (IS_ERR(newfile2)) {
  1375. err = PTR_ERR(newfile2);
  1376. fput(newfile1);
  1377. goto out;
  1378. }
  1379. audit_fd_pair(fd1, fd2);
  1380. fd_install(fd1, newfile1);
  1381. fd_install(fd2, newfile2);
  1382. return 0;
  1383. out:
  1384. put_unused_fd(fd2);
  1385. put_unused_fd(fd1);
  1386. return err;
  1387. }
  1388. SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
  1389. int __user *, usockvec)
  1390. {
  1391. return __sys_socketpair(family, type, protocol, usockvec);
  1392. }
  1393. /*
  1394. * Bind a name to a socket. Nothing much to do here since it's
  1395. * the protocol's responsibility to handle the local address.
  1396. *
  1397. * We move the socket address to kernel space before we call
  1398. * the protocol layer (having also checked the address is ok).
  1399. */
  1400. int __sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
  1401. {
  1402. struct socket *sock;
  1403. struct sockaddr_storage address;
  1404. int err, fput_needed;
  1405. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1406. if (sock) {
  1407. err = move_addr_to_kernel(umyaddr, addrlen, &address);
  1408. if (!err) {
  1409. err = security_socket_bind(sock,
  1410. (struct sockaddr *)&address,
  1411. addrlen);
  1412. if (!err)
  1413. err = sock->ops->bind(sock,
  1414. (struct sockaddr *)
  1415. &address, addrlen);
  1416. }
  1417. fput_light(sock->file, fput_needed);
  1418. }
  1419. return err;
  1420. }
  1421. SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
  1422. {
  1423. return __sys_bind(fd, umyaddr, addrlen);
  1424. }
  1425. /*
  1426. * Perform a listen. Basically, we allow the protocol to do anything
  1427. * necessary for a listen, and if that works, we mark the socket as
  1428. * ready for listening.
  1429. */
  1430. int __sys_listen(int fd, int backlog)
  1431. {
  1432. struct socket *sock;
  1433. int err, fput_needed;
  1434. int somaxconn;
  1435. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1436. if (sock) {
  1437. somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
  1438. if ((unsigned int)backlog > somaxconn)
  1439. backlog = somaxconn;
  1440. err = security_socket_listen(sock, backlog);
  1441. if (!err)
  1442. err = sock->ops->listen(sock, backlog);
  1443. fput_light(sock->file, fput_needed);
  1444. }
  1445. return err;
  1446. }
  1447. SYSCALL_DEFINE2(listen, int, fd, int, backlog)
  1448. {
  1449. return __sys_listen(fd, backlog);
  1450. }
  1451. int __sys_accept4_file(struct file *file, unsigned file_flags,
  1452. struct sockaddr __user *upeer_sockaddr,
  1453. int __user *upeer_addrlen, int flags,
  1454. unsigned long nofile)
  1455. {
  1456. struct socket *sock, *newsock;
  1457. struct file *newfile;
  1458. int err, len, newfd;
  1459. struct sockaddr_storage address;
  1460. if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
  1461. return -EINVAL;
  1462. if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
  1463. flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
  1464. sock = sock_from_file(file, &err);
  1465. if (!sock)
  1466. goto out;
  1467. err = -ENFILE;
  1468. newsock = sock_alloc();
  1469. if (!newsock)
  1470. goto out;
  1471. newsock->type = sock->type;
  1472. newsock->ops = sock->ops;
  1473. /*
  1474. * We don't need try_module_get here, as the listening socket (sock)
  1475. * has the protocol module (sock->ops->owner) held.
  1476. */
  1477. __module_get(newsock->ops->owner);
  1478. newfd = __get_unused_fd_flags(flags, nofile);
  1479. if (unlikely(newfd < 0)) {
  1480. err = newfd;
  1481. sock_release(newsock);
  1482. goto out;
  1483. }
  1484. newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
  1485. if (IS_ERR(newfile)) {
  1486. err = PTR_ERR(newfile);
  1487. put_unused_fd(newfd);
  1488. goto out;
  1489. }
  1490. err = security_socket_accept(sock, newsock);
  1491. if (err)
  1492. goto out_fd;
  1493. err = sock->ops->accept(sock, newsock, sock->file->f_flags | file_flags,
  1494. false);
  1495. if (err < 0)
  1496. goto out_fd;
  1497. if (upeer_sockaddr) {
  1498. len = newsock->ops->getname(newsock,
  1499. (struct sockaddr *)&address, 2);
  1500. if (len < 0) {
  1501. err = -ECONNABORTED;
  1502. goto out_fd;
  1503. }
  1504. err = move_addr_to_user(&address,
  1505. len, upeer_sockaddr, upeer_addrlen);
  1506. if (err < 0)
  1507. goto out_fd;
  1508. }
  1509. /* File flags are not inherited via accept() unlike another OSes. */
  1510. fd_install(newfd, newfile);
  1511. err = newfd;
  1512. out:
  1513. return err;
  1514. out_fd:
  1515. fput(newfile);
  1516. put_unused_fd(newfd);
  1517. goto out;
  1518. }
  1519. /*
  1520. * For accept, we attempt to create a new socket, set up the link
  1521. * with the client, wake up the client, then return the new
  1522. * connected fd. We collect the address of the connector in kernel
  1523. * space and move it to user at the very end. This is unclean because
  1524. * we open the socket then return an error.
  1525. *
  1526. * 1003.1g adds the ability to recvmsg() to query connection pending
  1527. * status to recvmsg. We need to add that support in a way thats
  1528. * clean when we restructure accept also.
  1529. */
  1530. int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
  1531. int __user *upeer_addrlen, int flags)
  1532. {
  1533. int ret = -EBADF;
  1534. struct fd f;
  1535. f = fdget(fd);
  1536. if (f.file) {
  1537. ret = __sys_accept4_file(f.file, 0, upeer_sockaddr,
  1538. upeer_addrlen, flags,
  1539. rlimit(RLIMIT_NOFILE));
  1540. fdput(f);
  1541. }
  1542. return ret;
  1543. }
  1544. SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
  1545. int __user *, upeer_addrlen, int, flags)
  1546. {
  1547. return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags);
  1548. }
  1549. SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
  1550. int __user *, upeer_addrlen)
  1551. {
  1552. return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
  1553. }
  1554. /*
  1555. * Attempt to connect to a socket with the server address. The address
  1556. * is in user space so we verify it is OK and move it to kernel space.
  1557. *
  1558. * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
  1559. * break bindings
  1560. *
  1561. * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
  1562. * other SEQPACKET protocols that take time to connect() as it doesn't
  1563. * include the -EINPROGRESS status for such sockets.
  1564. */
  1565. int __sys_connect_file(struct file *file, struct sockaddr_storage *address,
  1566. int addrlen, int file_flags)
  1567. {
  1568. struct socket *sock;
  1569. int err;
  1570. sock = sock_from_file(file, &err);
  1571. if (!sock)
  1572. goto out;
  1573. err =
  1574. security_socket_connect(sock, (struct sockaddr *)address, addrlen);
  1575. if (err)
  1576. goto out;
  1577. err = sock->ops->connect(sock, (struct sockaddr *)address, addrlen,
  1578. sock->file->f_flags | file_flags);
  1579. out:
  1580. return err;
  1581. }
  1582. int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
  1583. {
  1584. int ret = -EBADF;
  1585. struct fd f;
  1586. f = fdget(fd);
  1587. if (f.file) {
  1588. struct sockaddr_storage address;
  1589. ret = move_addr_to_kernel(uservaddr, addrlen, &address);
  1590. if (!ret)
  1591. ret = __sys_connect_file(f.file, &address, addrlen, 0);
  1592. fdput(f);
  1593. }
  1594. return ret;
  1595. }
  1596. SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
  1597. int, addrlen)
  1598. {
  1599. return __sys_connect(fd, uservaddr, addrlen);
  1600. }
  1601. /*
  1602. * Get the local address ('name') of a socket object. Move the obtained
  1603. * name to user space.
  1604. */
  1605. int __sys_getsockname(int fd, struct sockaddr __user *usockaddr,
  1606. int __user *usockaddr_len)
  1607. {
  1608. struct socket *sock;
  1609. struct sockaddr_storage address;
  1610. int err, fput_needed;
  1611. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1612. if (!sock)
  1613. goto out;
  1614. err = security_socket_getsockname(sock);
  1615. if (err)
  1616. goto out_put;
  1617. err = sock->ops->getname(sock, (struct sockaddr *)&address, 0);
  1618. if (err < 0)
  1619. goto out_put;
  1620. /* "err" is actually length in this case */
  1621. err = move_addr_to_user(&address, err, usockaddr, usockaddr_len);
  1622. out_put:
  1623. fput_light(sock->file, fput_needed);
  1624. out:
  1625. return err;
  1626. }
  1627. SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
  1628. int __user *, usockaddr_len)
  1629. {
  1630. return __sys_getsockname(fd, usockaddr, usockaddr_len);
  1631. }
  1632. /*
  1633. * Get the remote address ('name') of a socket object. Move the obtained
  1634. * name to user space.
  1635. */
  1636. int __sys_getpeername(int fd, struct sockaddr __user *usockaddr,
  1637. int __user *usockaddr_len)
  1638. {
  1639. struct socket *sock;
  1640. struct sockaddr_storage address;
  1641. int err, fput_needed;
  1642. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1643. if (sock != NULL) {
  1644. err = security_socket_getpeername(sock);
  1645. if (err) {
  1646. fput_light(sock->file, fput_needed);
  1647. return err;
  1648. }
  1649. err = sock->ops->getname(sock, (struct sockaddr *)&address, 1);
  1650. if (err >= 0)
  1651. /* "err" is actually length in this case */
  1652. err = move_addr_to_user(&address, err, usockaddr,
  1653. usockaddr_len);
  1654. fput_light(sock->file, fput_needed);
  1655. }
  1656. return err;
  1657. }
  1658. SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
  1659. int __user *, usockaddr_len)
  1660. {
  1661. return __sys_getpeername(fd, usockaddr, usockaddr_len);
  1662. }
  1663. /*
  1664. * Send a datagram to a given address. We move the address into kernel
  1665. * space and check the user space data area is readable before invoking
  1666. * the protocol.
  1667. */
  1668. int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
  1669. struct sockaddr __user *addr, int addr_len)
  1670. {
  1671. struct socket *sock;
  1672. struct sockaddr_storage address;
  1673. int err;
  1674. struct msghdr msg;
  1675. struct iovec iov;
  1676. int fput_needed;
  1677. err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
  1678. if (unlikely(err))
  1679. return err;
  1680. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1681. if (!sock)
  1682. goto out;
  1683. msg.msg_name = NULL;
  1684. msg.msg_control = NULL;
  1685. msg.msg_controllen = 0;
  1686. msg.msg_namelen = 0;
  1687. if (addr) {
  1688. err = move_addr_to_kernel(addr, addr_len, &address);
  1689. if (err < 0)
  1690. goto out_put;
  1691. msg.msg_name = (struct sockaddr *)&address;
  1692. msg.msg_namelen = addr_len;
  1693. }
  1694. if (sock->file->f_flags & O_NONBLOCK)
  1695. flags |= MSG_DONTWAIT;
  1696. msg.msg_flags = flags;
  1697. err = sock_sendmsg(sock, &msg);
  1698. out_put:
  1699. fput_light(sock->file, fput_needed);
  1700. out:
  1701. return err;
  1702. }
  1703. SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
  1704. unsigned int, flags, struct sockaddr __user *, addr,
  1705. int, addr_len)
  1706. {
  1707. return __sys_sendto(fd, buff, len, flags, addr, addr_len);
  1708. }
  1709. /*
  1710. * Send a datagram down a socket.
  1711. */
  1712. SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
  1713. unsigned int, flags)
  1714. {
  1715. return __sys_sendto(fd, buff, len, flags, NULL, 0);
  1716. }
  1717. /*
  1718. * Receive a frame from the socket and optionally record the address of the
  1719. * sender. We verify the buffers are writable and if needed move the
  1720. * sender address from kernel to user space.
  1721. */
  1722. int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
  1723. struct sockaddr __user *addr, int __user *addr_len)
  1724. {
  1725. struct socket *sock;
  1726. struct iovec iov;
  1727. struct msghdr msg;
  1728. struct sockaddr_storage address;
  1729. int err, err2;
  1730. int fput_needed;
  1731. err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
  1732. if (unlikely(err))
  1733. return err;
  1734. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1735. if (!sock)
  1736. goto out;
  1737. msg.msg_control = NULL;
  1738. msg.msg_controllen = 0;
  1739. /* Save some cycles and don't copy the address if not needed */
  1740. msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
  1741. /* We assume all kernel code knows the size of sockaddr_storage */
  1742. msg.msg_namelen = 0;
  1743. msg.msg_iocb = NULL;
  1744. msg.msg_flags = 0;
  1745. if (sock->file->f_flags & O_NONBLOCK)
  1746. flags |= MSG_DONTWAIT;
  1747. err = sock_recvmsg(sock, &msg, flags);
  1748. if (err >= 0 && addr != NULL) {
  1749. err2 = move_addr_to_user(&address,
  1750. msg.msg_namelen, addr, addr_len);
  1751. if (err2 < 0)
  1752. err = err2;
  1753. }
  1754. fput_light(sock->file, fput_needed);
  1755. out:
  1756. return err;
  1757. }
  1758. SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
  1759. unsigned int, flags, struct sockaddr __user *, addr,
  1760. int __user *, addr_len)
  1761. {
  1762. return __sys_recvfrom(fd, ubuf, size, flags, addr, addr_len);
  1763. }
  1764. /*
  1765. * Receive a datagram from a socket.
  1766. */
  1767. SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
  1768. unsigned int, flags)
  1769. {
  1770. return __sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
  1771. }
  1772. static bool sock_use_custom_sol_socket(const struct socket *sock)
  1773. {
  1774. const struct sock *sk = sock->sk;
  1775. /* Use sock->ops->setsockopt() for MPTCP */
  1776. return IS_ENABLED(CONFIG_MPTCP) &&
  1777. sk->sk_protocol == IPPROTO_MPTCP &&
  1778. sk->sk_type == SOCK_STREAM &&
  1779. (sk->sk_family == AF_INET || sk->sk_family == AF_INET6);
  1780. }
  1781. /*
  1782. * Set a socket option. Because we don't know the option lengths we have
  1783. * to pass the user mode parameter for the protocols to sort out.
  1784. */
  1785. int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval,
  1786. int optlen)
  1787. {
  1788. sockptr_t optval = USER_SOCKPTR(user_optval);
  1789. char *kernel_optval = NULL;
  1790. int err, fput_needed;
  1791. struct socket *sock;
  1792. if (optlen < 0)
  1793. return -EINVAL;
  1794. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1795. if (!sock)
  1796. return err;
  1797. err = security_socket_setsockopt(sock, level, optname);
  1798. if (err)
  1799. goto out_put;
  1800. if (!in_compat_syscall())
  1801. err = BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock->sk, &level, &optname,
  1802. user_optval, &optlen,
  1803. &kernel_optval);
  1804. if (err < 0)
  1805. goto out_put;
  1806. if (err > 0) {
  1807. err = 0;
  1808. goto out_put;
  1809. }
  1810. if (kernel_optval)
  1811. optval = KERNEL_SOCKPTR(kernel_optval);
  1812. if (level == SOL_SOCKET && !sock_use_custom_sol_socket(sock))
  1813. err = sock_setsockopt(sock, level, optname, optval, optlen);
  1814. else if (unlikely(!sock->ops->setsockopt))
  1815. err = -EOPNOTSUPP;
  1816. else
  1817. err = sock->ops->setsockopt(sock, level, optname, optval,
  1818. optlen);
  1819. kfree(kernel_optval);
  1820. out_put:
  1821. fput_light(sock->file, fput_needed);
  1822. return err;
  1823. }
  1824. SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
  1825. char __user *, optval, int, optlen)
  1826. {
  1827. return __sys_setsockopt(fd, level, optname, optval, optlen);
  1828. }
  1829. /*
  1830. * Get a socket option. Because we don't know the option lengths we have
  1831. * to pass a user mode parameter for the protocols to sort out.
  1832. */
  1833. int __sys_getsockopt(int fd, int level, int optname, char __user *optval,
  1834. int __user *optlen)
  1835. {
  1836. int err, fput_needed;
  1837. struct socket *sock;
  1838. int max_optlen;
  1839. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1840. if (!sock)
  1841. return err;
  1842. err = security_socket_getsockopt(sock, level, optname);
  1843. if (err)
  1844. goto out_put;
  1845. if (!in_compat_syscall())
  1846. max_optlen = BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen);
  1847. if (level == SOL_SOCKET)
  1848. err = sock_getsockopt(sock, level, optname, optval, optlen);
  1849. else if (unlikely(!sock->ops->getsockopt))
  1850. err = -EOPNOTSUPP;
  1851. else
  1852. err = sock->ops->getsockopt(sock, level, optname, optval,
  1853. optlen);
  1854. if (!in_compat_syscall())
  1855. err = BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock->sk, level, optname,
  1856. optval, optlen, max_optlen,
  1857. err);
  1858. out_put:
  1859. fput_light(sock->file, fput_needed);
  1860. return err;
  1861. }
  1862. SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
  1863. char __user *, optval, int __user *, optlen)
  1864. {
  1865. return __sys_getsockopt(fd, level, optname, optval, optlen);
  1866. }
  1867. /*
  1868. * Shutdown a socket.
  1869. */
  1870. int __sys_shutdown(int fd, int how)
  1871. {
  1872. int err, fput_needed;
  1873. struct socket *sock;
  1874. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  1875. if (sock != NULL) {
  1876. err = security_socket_shutdown(sock, how);
  1877. if (!err)
  1878. err = sock->ops->shutdown(sock, how);
  1879. fput_light(sock->file, fput_needed);
  1880. }
  1881. return err;
  1882. }
  1883. SYSCALL_DEFINE2(shutdown, int, fd, int, how)
  1884. {
  1885. return __sys_shutdown(fd, how);
  1886. }
  1887. /* A couple of helpful macros for getting the address of the 32/64 bit
  1888. * fields which are the same type (int / unsigned) on our platforms.
  1889. */
  1890. #define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
  1891. #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
  1892. #define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
  1893. struct used_address {
  1894. struct sockaddr_storage name;
  1895. unsigned int name_len;
  1896. };
  1897. int __copy_msghdr_from_user(struct msghdr *kmsg,
  1898. struct user_msghdr __user *umsg,
  1899. struct sockaddr __user **save_addr,
  1900. struct iovec __user **uiov, size_t *nsegs)
  1901. {
  1902. struct user_msghdr msg;
  1903. ssize_t err;
  1904. if (copy_from_user(&msg, umsg, sizeof(*umsg)))
  1905. return -EFAULT;
  1906. kmsg->msg_control_is_user = true;
  1907. kmsg->msg_control_user = msg.msg_control;
  1908. kmsg->msg_controllen = msg.msg_controllen;
  1909. kmsg->msg_flags = msg.msg_flags;
  1910. kmsg->msg_namelen = msg.msg_namelen;
  1911. if (!msg.msg_name)
  1912. kmsg->msg_namelen = 0;
  1913. if (kmsg->msg_namelen < 0)
  1914. return -EINVAL;
  1915. if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
  1916. kmsg->msg_namelen = sizeof(struct sockaddr_storage);
  1917. if (save_addr)
  1918. *save_addr = msg.msg_name;
  1919. if (msg.msg_name && kmsg->msg_namelen) {
  1920. if (!save_addr) {
  1921. err = move_addr_to_kernel(msg.msg_name,
  1922. kmsg->msg_namelen,
  1923. kmsg->msg_name);
  1924. if (err < 0)
  1925. return err;
  1926. }
  1927. } else {
  1928. kmsg->msg_name = NULL;
  1929. kmsg->msg_namelen = 0;
  1930. }
  1931. if (msg.msg_iovlen > UIO_MAXIOV)
  1932. return -EMSGSIZE;
  1933. kmsg->msg_iocb = NULL;
  1934. *uiov = msg.msg_iov;
  1935. *nsegs = msg.msg_iovlen;
  1936. return 0;
  1937. }
  1938. static int copy_msghdr_from_user(struct msghdr *kmsg,
  1939. struct user_msghdr __user *umsg,
  1940. struct sockaddr __user **save_addr,
  1941. struct iovec **iov)
  1942. {
  1943. struct user_msghdr msg;
  1944. ssize_t err;
  1945. err = __copy_msghdr_from_user(kmsg, umsg, save_addr, &msg.msg_iov,
  1946. &msg.msg_iovlen);
  1947. if (err)
  1948. return err;
  1949. err = import_iovec(save_addr ? READ : WRITE,
  1950. msg.msg_iov, msg.msg_iovlen,
  1951. UIO_FASTIOV, iov, &kmsg->msg_iter);
  1952. return err < 0 ? err : 0;
  1953. }
  1954. static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
  1955. unsigned int flags, struct used_address *used_address,
  1956. unsigned int allowed_msghdr_flags)
  1957. {
  1958. unsigned char ctl[sizeof(struct cmsghdr) + 20]
  1959. __aligned(sizeof(__kernel_size_t));
  1960. /* 20 is size of ipv6_pktinfo */
  1961. unsigned char *ctl_buf = ctl;
  1962. int ctl_len;
  1963. ssize_t err;
  1964. err = -ENOBUFS;
  1965. if (msg_sys->msg_controllen > INT_MAX)
  1966. goto out;
  1967. flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
  1968. ctl_len = msg_sys->msg_controllen;
  1969. if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
  1970. err =
  1971. cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
  1972. sizeof(ctl));
  1973. if (err)
  1974. goto out;
  1975. ctl_buf = msg_sys->msg_control;
  1976. ctl_len = msg_sys->msg_controllen;
  1977. } else if (ctl_len) {
  1978. BUILD_BUG_ON(sizeof(struct cmsghdr) !=
  1979. CMSG_ALIGN(sizeof(struct cmsghdr)));
  1980. if (ctl_len > sizeof(ctl)) {
  1981. ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
  1982. if (ctl_buf == NULL)
  1983. goto out;
  1984. }
  1985. err = -EFAULT;
  1986. if (copy_from_user(ctl_buf, msg_sys->msg_control_user, ctl_len))
  1987. goto out_freectl;
  1988. msg_sys->msg_control = ctl_buf;
  1989. msg_sys->msg_control_is_user = false;
  1990. }
  1991. msg_sys->msg_flags = flags;
  1992. if (sock->file->f_flags & O_NONBLOCK)
  1993. msg_sys->msg_flags |= MSG_DONTWAIT;
  1994. /*
  1995. * If this is sendmmsg() and current destination address is same as
  1996. * previously succeeded address, omit asking LSM's decision.
  1997. * used_address->name_len is initialized to UINT_MAX so that the first
  1998. * destination address never matches.
  1999. */
  2000. if (used_address && msg_sys->msg_name &&
  2001. used_address->name_len == msg_sys->msg_namelen &&
  2002. !memcmp(&used_address->name, msg_sys->msg_name,
  2003. used_address->name_len)) {
  2004. err = sock_sendmsg_nosec(sock, msg_sys);
  2005. goto out_freectl;
  2006. }
  2007. err = sock_sendmsg(sock, msg_sys);
  2008. /*
  2009. * If this is sendmmsg() and sending to current destination address was
  2010. * successful, remember it.
  2011. */
  2012. if (used_address && err >= 0) {
  2013. used_address->name_len = msg_sys->msg_namelen;
  2014. if (msg_sys->msg_name)
  2015. memcpy(&used_address->name, msg_sys->msg_name,
  2016. used_address->name_len);
  2017. }
  2018. out_freectl:
  2019. if (ctl_buf != ctl)
  2020. sock_kfree_s(sock->sk, ctl_buf, ctl_len);
  2021. out:
  2022. return err;
  2023. }
  2024. int sendmsg_copy_msghdr(struct msghdr *msg,
  2025. struct user_msghdr __user *umsg, unsigned flags,
  2026. struct iovec **iov)
  2027. {
  2028. int err;
  2029. if (flags & MSG_CMSG_COMPAT) {
  2030. struct compat_msghdr __user *msg_compat;
  2031. msg_compat = (struct compat_msghdr __user *) umsg;
  2032. err = get_compat_msghdr(msg, msg_compat, NULL, iov);
  2033. } else {
  2034. err = copy_msghdr_from_user(msg, umsg, NULL, iov);
  2035. }
  2036. if (err < 0)
  2037. return err;
  2038. return 0;
  2039. }
  2040. static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
  2041. struct msghdr *msg_sys, unsigned int flags,
  2042. struct used_address *used_address,
  2043. unsigned int allowed_msghdr_flags)
  2044. {
  2045. struct sockaddr_storage address;
  2046. struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
  2047. ssize_t err;
  2048. msg_sys->msg_name = &address;
  2049. err = sendmsg_copy_msghdr(msg_sys, msg, flags, &iov);
  2050. if (err < 0)
  2051. return err;
  2052. err = ____sys_sendmsg(sock, msg_sys, flags, used_address,
  2053. allowed_msghdr_flags);
  2054. kfree(iov);
  2055. return err;
  2056. }
  2057. /*
  2058. * BSD sendmsg interface
  2059. */
  2060. long __sys_sendmsg_sock(struct socket *sock, struct msghdr *msg,
  2061. unsigned int flags)
  2062. {
  2063. /* disallow ancillary data requests from this path */
  2064. if (msg->msg_control || msg->msg_controllen)
  2065. return -EINVAL;
  2066. return ____sys_sendmsg(sock, msg, flags, NULL, 0);
  2067. }
  2068. long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
  2069. bool forbid_cmsg_compat)
  2070. {
  2071. int fput_needed, err;
  2072. struct msghdr msg_sys;
  2073. struct socket *sock;
  2074. if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
  2075. return -EINVAL;
  2076. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  2077. if (!sock)
  2078. goto out;
  2079. err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
  2080. fput_light(sock->file, fput_needed);
  2081. out:
  2082. return err;
  2083. }
  2084. SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
  2085. {
  2086. return __sys_sendmsg(fd, msg, flags, true);
  2087. }
  2088. /*
  2089. * Linux sendmmsg interface
  2090. */
  2091. int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
  2092. unsigned int flags, bool forbid_cmsg_compat)
  2093. {
  2094. int fput_needed, err, datagrams;
  2095. struct socket *sock;
  2096. struct mmsghdr __user *entry;
  2097. struct compat_mmsghdr __user *compat_entry;
  2098. struct msghdr msg_sys;
  2099. struct used_address used_address;
  2100. unsigned int oflags = flags;
  2101. if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
  2102. return -EINVAL;
  2103. if (vlen > UIO_MAXIOV)
  2104. vlen = UIO_MAXIOV;
  2105. datagrams = 0;
  2106. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  2107. if (!sock)
  2108. return err;
  2109. used_address.name_len = UINT_MAX;
  2110. entry = mmsg;
  2111. compat_entry = (struct compat_mmsghdr __user *)mmsg;
  2112. err = 0;
  2113. flags |= MSG_BATCH;
  2114. while (datagrams < vlen) {
  2115. if (datagrams == vlen - 1)
  2116. flags = oflags;
  2117. if (MSG_CMSG_COMPAT & flags) {
  2118. err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
  2119. &msg_sys, flags, &used_address, MSG_EOR);
  2120. if (err < 0)
  2121. break;
  2122. err = __put_user(err, &compat_entry->msg_len);
  2123. ++compat_entry;
  2124. } else {
  2125. err = ___sys_sendmsg(sock,
  2126. (struct user_msghdr __user *)entry,
  2127. &msg_sys, flags, &used_address, MSG_EOR);
  2128. if (err < 0)
  2129. break;
  2130. err = put_user(err, &entry->msg_len);
  2131. ++entry;
  2132. }
  2133. if (err)
  2134. break;
  2135. ++datagrams;
  2136. if (msg_data_left(&msg_sys))
  2137. break;
  2138. cond_resched();
  2139. }
  2140. fput_light(sock->file, fput_needed);
  2141. /* We only return an error if no datagrams were able to be sent */
  2142. if (datagrams != 0)
  2143. return datagrams;
  2144. return err;
  2145. }
  2146. SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
  2147. unsigned int, vlen, unsigned int, flags)
  2148. {
  2149. return __sys_sendmmsg(fd, mmsg, vlen, flags, true);
  2150. }
  2151. int recvmsg_copy_msghdr(struct msghdr *msg,
  2152. struct user_msghdr __user *umsg, unsigned flags,
  2153. struct sockaddr __user **uaddr,
  2154. struct iovec **iov)
  2155. {
  2156. ssize_t err;
  2157. if (MSG_CMSG_COMPAT & flags) {
  2158. struct compat_msghdr __user *msg_compat;
  2159. msg_compat = (struct compat_msghdr __user *) umsg;
  2160. err = get_compat_msghdr(msg, msg_compat, uaddr, iov);
  2161. } else {
  2162. err = copy_msghdr_from_user(msg, umsg, uaddr, iov);
  2163. }
  2164. if (err < 0)
  2165. return err;
  2166. return 0;
  2167. }
  2168. static int ____sys_recvmsg(struct socket *sock, struct msghdr *msg_sys,
  2169. struct user_msghdr __user *msg,
  2170. struct sockaddr __user *uaddr,
  2171. unsigned int flags, int nosec)
  2172. {
  2173. struct compat_msghdr __user *msg_compat =
  2174. (struct compat_msghdr __user *) msg;
  2175. int __user *uaddr_len = COMPAT_NAMELEN(msg);
  2176. struct sockaddr_storage addr;
  2177. unsigned long cmsg_ptr;
  2178. int len;
  2179. ssize_t err;
  2180. msg_sys->msg_name = &addr;
  2181. cmsg_ptr = (unsigned long)msg_sys->msg_control;
  2182. msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
  2183. /* We assume all kernel code knows the size of sockaddr_storage */
  2184. msg_sys->msg_namelen = 0;
  2185. if (sock->file->f_flags & O_NONBLOCK)
  2186. flags |= MSG_DONTWAIT;
  2187. if (unlikely(nosec))
  2188. err = sock_recvmsg_nosec(sock, msg_sys, flags);
  2189. else
  2190. err = sock_recvmsg(sock, msg_sys, flags);
  2191. if (err < 0)
  2192. goto out;
  2193. len = err;
  2194. if (uaddr != NULL) {
  2195. err = move_addr_to_user(&addr,
  2196. msg_sys->msg_namelen, uaddr,
  2197. uaddr_len);
  2198. if (err < 0)
  2199. goto out;
  2200. }
  2201. err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
  2202. COMPAT_FLAGS(msg));
  2203. if (err)
  2204. goto out;
  2205. if (MSG_CMSG_COMPAT & flags)
  2206. err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
  2207. &msg_compat->msg_controllen);
  2208. else
  2209. err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
  2210. &msg->msg_controllen);
  2211. if (err)
  2212. goto out;
  2213. err = len;
  2214. out:
  2215. return err;
  2216. }
  2217. static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
  2218. struct msghdr *msg_sys, unsigned int flags, int nosec)
  2219. {
  2220. struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
  2221. /* user mode address pointers */
  2222. struct sockaddr __user *uaddr;
  2223. ssize_t err;
  2224. err = recvmsg_copy_msghdr(msg_sys, msg, flags, &uaddr, &iov);
  2225. if (err < 0)
  2226. return err;
  2227. err = ____sys_recvmsg(sock, msg_sys, msg, uaddr, flags, nosec);
  2228. kfree(iov);
  2229. return err;
  2230. }
  2231. /*
  2232. * BSD recvmsg interface
  2233. */
  2234. long __sys_recvmsg_sock(struct socket *sock, struct msghdr *msg,
  2235. struct user_msghdr __user *umsg,
  2236. struct sockaddr __user *uaddr, unsigned int flags)
  2237. {
  2238. if (msg->msg_control || msg->msg_controllen) {
  2239. /* disallow ancillary data reqs unless cmsg is plain data */
  2240. if (!(sock->ops->flags & PROTO_CMSG_DATA_ONLY))
  2241. return -EINVAL;
  2242. }
  2243. return ____sys_recvmsg(sock, msg, umsg, uaddr, flags, 0);
  2244. }
  2245. long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
  2246. bool forbid_cmsg_compat)
  2247. {
  2248. int fput_needed, err;
  2249. struct msghdr msg_sys;
  2250. struct socket *sock;
  2251. if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
  2252. return -EINVAL;
  2253. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  2254. if (!sock)
  2255. goto out;
  2256. err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
  2257. fput_light(sock->file, fput_needed);
  2258. out:
  2259. return err;
  2260. }
  2261. SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
  2262. unsigned int, flags)
  2263. {
  2264. return __sys_recvmsg(fd, msg, flags, true);
  2265. }
  2266. /*
  2267. * Linux recvmmsg interface
  2268. */
  2269. static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
  2270. unsigned int vlen, unsigned int flags,
  2271. struct timespec64 *timeout)
  2272. {
  2273. int fput_needed, err, datagrams;
  2274. struct socket *sock;
  2275. struct mmsghdr __user *entry;
  2276. struct compat_mmsghdr __user *compat_entry;
  2277. struct msghdr msg_sys;
  2278. struct timespec64 end_time;
  2279. struct timespec64 timeout64;
  2280. if (timeout &&
  2281. poll_select_set_timeout(&end_time, timeout->tv_sec,
  2282. timeout->tv_nsec))
  2283. return -EINVAL;
  2284. datagrams = 0;
  2285. sock = sockfd_lookup_light(fd, &err, &fput_needed);
  2286. if (!sock)
  2287. return err;
  2288. if (likely(!(flags & MSG_ERRQUEUE))) {
  2289. err = sock_error(sock->sk);
  2290. if (err) {
  2291. datagrams = err;
  2292. goto out_put;
  2293. }
  2294. }
  2295. entry = mmsg;
  2296. compat_entry = (struct compat_mmsghdr __user *)mmsg;
  2297. while (datagrams < vlen) {
  2298. /*
  2299. * No need to ask LSM for more than the first datagram.
  2300. */
  2301. if (MSG_CMSG_COMPAT & flags) {
  2302. err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
  2303. &msg_sys, flags & ~MSG_WAITFORONE,
  2304. datagrams);
  2305. if (err < 0)
  2306. break;
  2307. err = __put_user(err, &compat_entry->msg_len);
  2308. ++compat_entry;
  2309. } else {
  2310. err = ___sys_recvmsg(sock,
  2311. (struct user_msghdr __user *)entry,
  2312. &msg_sys, flags & ~MSG_WAITFORONE,
  2313. datagrams);
  2314. if (err < 0)
  2315. break;
  2316. err = put_user(err, &entry->msg_len);
  2317. ++entry;
  2318. }
  2319. if (err)
  2320. break;
  2321. ++datagrams;
  2322. /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
  2323. if (flags & MSG_WAITFORONE)
  2324. flags |= MSG_DONTWAIT;
  2325. if (timeout) {
  2326. ktime_get_ts64(&timeout64);
  2327. *timeout = timespec64_sub(end_time, timeout64);
  2328. if (timeout->tv_sec < 0) {
  2329. timeout->tv_sec = timeout->tv_nsec = 0;
  2330. break;
  2331. }
  2332. /* Timeout, return less than vlen datagrams */
  2333. if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
  2334. break;
  2335. }
  2336. /* Out of band data, return right away */
  2337. if (msg_sys.msg_flags & MSG_OOB)
  2338. break;
  2339. cond_resched();
  2340. }
  2341. if (err == 0)
  2342. goto out_put;
  2343. if (datagrams == 0) {
  2344. datagrams = err;
  2345. goto out_put;
  2346. }
  2347. /*
  2348. * We may return less entries than requested (vlen) if the
  2349. * sock is non block and there aren't enough datagrams...
  2350. */
  2351. if (err != -EAGAIN) {
  2352. /*
  2353. * ... or if recvmsg returns an error after we
  2354. * received some datagrams, where we record the
  2355. * error to return on the next call or if the
  2356. * app asks about it using getsockopt(SO_ERROR).
  2357. */
  2358. sock->sk->sk_err = -err;
  2359. }
  2360. out_put:
  2361. fput_light(sock->file, fput_needed);
  2362. return datagrams;
  2363. }
  2364. int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg,
  2365. unsigned int vlen, unsigned int flags,
  2366. struct __kernel_timespec __user *timeout,
  2367. struct old_timespec32 __user *timeout32)
  2368. {
  2369. int datagrams;
  2370. struct timespec64 timeout_sys;
  2371. if (timeout && get_timespec64(&timeout_sys, timeout))
  2372. return -EFAULT;
  2373. if (timeout32 && get_old_timespec32(&timeout_sys, timeout32))
  2374. return -EFAULT;
  2375. if (!timeout && !timeout32)
  2376. return do_recvmmsg(fd, mmsg, vlen, flags, NULL);
  2377. datagrams = do_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
  2378. if (datagrams <= 0)
  2379. return datagrams;
  2380. if (timeout && put_timespec64(&timeout_sys, timeout))
  2381. datagrams = -EFAULT;
  2382. if (timeout32 && put_old_timespec32(&timeout_sys, timeout32))
  2383. datagrams = -EFAULT;
  2384. return datagrams;
  2385. }
  2386. SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
  2387. unsigned int, vlen, unsigned int, flags,
  2388. struct __kernel_timespec __user *, timeout)
  2389. {
  2390. if (flags & MSG_CMSG_COMPAT)
  2391. return -EINVAL;
  2392. return __sys_recvmmsg(fd, mmsg, vlen, flags, timeout, NULL);
  2393. }
  2394. #ifdef CONFIG_COMPAT_32BIT_TIME
  2395. SYSCALL_DEFINE5(recvmmsg_time32, int, fd, struct mmsghdr __user *, mmsg,
  2396. unsigned int, vlen, unsigned int, flags,
  2397. struct old_timespec32 __user *, timeout)
  2398. {
  2399. if (flags & MSG_CMSG_COMPAT)
  2400. return -EINVAL;
  2401. return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL, timeout);
  2402. }
  2403. #endif
  2404. #ifdef __ARCH_WANT_SYS_SOCKETCALL
  2405. /* Argument list sizes for sys_socketcall */
  2406. #define AL(x) ((x) * sizeof(unsigned long))
  2407. static const unsigned char nargs[21] = {
  2408. AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
  2409. AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
  2410. AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
  2411. AL(4), AL(5), AL(4)
  2412. };
  2413. #undef AL
  2414. /*
  2415. * System call vectors.
  2416. *
  2417. * Argument checking cleaned up. Saved 20% in size.
  2418. * This function doesn't need to set the kernel lock because
  2419. * it is set by the callees.
  2420. */
  2421. SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
  2422. {
  2423. unsigned long a[AUDITSC_ARGS];
  2424. unsigned long a0, a1;
  2425. int err;
  2426. unsigned int len;
  2427. if (call < 1 || call > SYS_SENDMMSG)
  2428. return -EINVAL;
  2429. call = array_index_nospec(call, SYS_SENDMMSG + 1);
  2430. len = nargs[call];
  2431. if (len > sizeof(a))
  2432. return -EINVAL;
  2433. /* copy_from_user should be SMP safe. */
  2434. if (copy_from_user(a, args, len))
  2435. return -EFAULT;
  2436. err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
  2437. if (err)
  2438. return err;
  2439. a0 = a[0];
  2440. a1 = a[1];
  2441. switch (call) {
  2442. case SYS_SOCKET:
  2443. err = __sys_socket(a0, a1, a[2]);
  2444. break;
  2445. case SYS_BIND:
  2446. err = __sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
  2447. break;
  2448. case SYS_CONNECT:
  2449. err = __sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
  2450. break;
  2451. case SYS_LISTEN:
  2452. err = __sys_listen(a0, a1);
  2453. break;
  2454. case SYS_ACCEPT:
  2455. err = __sys_accept4(a0, (struct sockaddr __user *)a1,
  2456. (int __user *)a[2], 0);
  2457. break;
  2458. case SYS_GETSOCKNAME:
  2459. err =
  2460. __sys_getsockname(a0, (struct sockaddr __user *)a1,
  2461. (int __user *)a[2]);
  2462. break;
  2463. case SYS_GETPEERNAME:
  2464. err =
  2465. __sys_getpeername(a0, (struct sockaddr __user *)a1,
  2466. (int __user *)a[2]);
  2467. break;
  2468. case SYS_SOCKETPAIR:
  2469. err = __sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
  2470. break;
  2471. case SYS_SEND:
  2472. err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
  2473. NULL, 0);
  2474. break;
  2475. case SYS_SENDTO:
  2476. err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
  2477. (struct sockaddr __user *)a[4], a[5]);
  2478. break;
  2479. case SYS_RECV:
  2480. err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
  2481. NULL, NULL);
  2482. break;
  2483. case SYS_RECVFROM:
  2484. err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
  2485. (struct sockaddr __user *)a[4],
  2486. (int __user *)a[5]);
  2487. break;
  2488. case SYS_SHUTDOWN:
  2489. err = __sys_shutdown(a0, a1);
  2490. break;
  2491. case SYS_SETSOCKOPT:
  2492. err = __sys_setsockopt(a0, a1, a[2], (char __user *)a[3],
  2493. a[4]);
  2494. break;
  2495. case SYS_GETSOCKOPT:
  2496. err =
  2497. __sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
  2498. (int __user *)a[4]);
  2499. break;
  2500. case SYS_SENDMSG:
  2501. err = __sys_sendmsg(a0, (struct user_msghdr __user *)a1,
  2502. a[2], true);
  2503. break;
  2504. case SYS_SENDMMSG:
  2505. err = __sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2],
  2506. a[3], true);
  2507. break;
  2508. case SYS_RECVMSG:
  2509. err = __sys_recvmsg(a0, (struct user_msghdr __user *)a1,
  2510. a[2], true);
  2511. break;
  2512. case SYS_RECVMMSG:
  2513. if (IS_ENABLED(CONFIG_64BIT))
  2514. err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
  2515. a[2], a[3],
  2516. (struct __kernel_timespec __user *)a[4],
  2517. NULL);
  2518. else
  2519. err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
  2520. a[2], a[3], NULL,
  2521. (struct old_timespec32 __user *)a[4]);
  2522. break;
  2523. case SYS_ACCEPT4:
  2524. err = __sys_accept4(a0, (struct sockaddr __user *)a1,
  2525. (int __user *)a[2], a[3]);
  2526. break;
  2527. default:
  2528. err = -EINVAL;
  2529. break;
  2530. }
  2531. return err;
  2532. }
  2533. #endif /* __ARCH_WANT_SYS_SOCKETCALL */
  2534. /**
  2535. * sock_register - add a socket protocol handler
  2536. * @ops: description of protocol
  2537. *
  2538. * This function is called by a protocol handler that wants to
  2539. * advertise its address family, and have it linked into the
  2540. * socket interface. The value ops->family corresponds to the
  2541. * socket system call protocol family.
  2542. */
  2543. int sock_register(const struct net_proto_family *ops)
  2544. {
  2545. int err;
  2546. if (ops->family >= NPROTO) {
  2547. pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
  2548. return -ENOBUFS;
  2549. }
  2550. spin_lock(&net_family_lock);
  2551. if (rcu_dereference_protected(net_families[ops->family],
  2552. lockdep_is_held(&net_family_lock)))
  2553. err = -EEXIST;
  2554. else {
  2555. rcu_assign_pointer(net_families[ops->family], ops);
  2556. err = 0;
  2557. }
  2558. spin_unlock(&net_family_lock);
  2559. pr_info("NET: Registered protocol family %d\n", ops->family);
  2560. return err;
  2561. }
  2562. EXPORT_SYMBOL(sock_register);
  2563. /**
  2564. * sock_unregister - remove a protocol handler
  2565. * @family: protocol family to remove
  2566. *
  2567. * This function is called by a protocol handler that wants to
  2568. * remove its address family, and have it unlinked from the
  2569. * new socket creation.
  2570. *
  2571. * If protocol handler is a module, then it can use module reference
  2572. * counts to protect against new references. If protocol handler is not
  2573. * a module then it needs to provide its own protection in
  2574. * the ops->create routine.
  2575. */
  2576. void sock_unregister(int family)
  2577. {
  2578. BUG_ON(family < 0 || family >= NPROTO);
  2579. spin_lock(&net_family_lock);
  2580. RCU_INIT_POINTER(net_families[family], NULL);
  2581. spin_unlock(&net_family_lock);
  2582. synchronize_rcu();
  2583. pr_info("NET: Unregistered protocol family %d\n", family);
  2584. }
  2585. EXPORT_SYMBOL(sock_unregister);
  2586. bool sock_is_registered(int family)
  2587. {
  2588. return family < NPROTO && rcu_access_pointer(net_families[family]);
  2589. }
  2590. static int __init sock_init(void)
  2591. {
  2592. int err;
  2593. /*
  2594. * Initialize the network sysctl infrastructure.
  2595. */
  2596. err = net_sysctl_init();
  2597. if (err)
  2598. goto out;
  2599. /*
  2600. * Initialize skbuff SLAB cache
  2601. */
  2602. skb_init();
  2603. /*
  2604. * Initialize the protocols module.
  2605. */
  2606. init_inodecache();
  2607. err = register_filesystem(&sock_fs_type);
  2608. if (err)
  2609. goto out;
  2610. sock_mnt = kern_mount(&sock_fs_type);
  2611. if (IS_ERR(sock_mnt)) {
  2612. err = PTR_ERR(sock_mnt);
  2613. goto out_mount;
  2614. }
  2615. /* The real protocol initialization is performed in later initcalls.
  2616. */
  2617. #ifdef CONFIG_NETFILTER
  2618. err = netfilter_init();
  2619. if (err)
  2620. goto out;
  2621. #endif
  2622. ptp_classifier_init();
  2623. out:
  2624. return err;
  2625. out_mount:
  2626. unregister_filesystem(&sock_fs_type);
  2627. goto out;
  2628. }
  2629. core_initcall(sock_init); /* early initcall */
  2630. #ifdef CONFIG_PROC_FS
  2631. void socket_seq_show(struct seq_file *seq)
  2632. {
  2633. seq_printf(seq, "sockets: used %d\n",
  2634. sock_inuse_get(seq->private));
  2635. }
  2636. #endif /* CONFIG_PROC_FS */
  2637. #ifdef CONFIG_COMPAT
  2638. static int compat_dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
  2639. {
  2640. struct compat_ifconf ifc32;
  2641. struct ifconf ifc;
  2642. int err;
  2643. if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
  2644. return -EFAULT;
  2645. ifc.ifc_len = ifc32.ifc_len;
  2646. ifc.ifc_req = compat_ptr(ifc32.ifcbuf);
  2647. rtnl_lock();
  2648. err = dev_ifconf(net, &ifc, sizeof(struct compat_ifreq));
  2649. rtnl_unlock();
  2650. if (err)
  2651. return err;
  2652. ifc32.ifc_len = ifc.ifc_len;
  2653. if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
  2654. return -EFAULT;
  2655. return 0;
  2656. }
  2657. static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
  2658. {
  2659. compat_uptr_t uptr32;
  2660. struct ifreq ifr;
  2661. void __user *saved;
  2662. int err;
  2663. if (copy_from_user(&ifr, uifr32, sizeof(struct compat_ifreq)))
  2664. return -EFAULT;
  2665. if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
  2666. return -EFAULT;
  2667. saved = ifr.ifr_settings.ifs_ifsu.raw_hdlc;
  2668. ifr.ifr_settings.ifs_ifsu.raw_hdlc = compat_ptr(uptr32);
  2669. err = dev_ioctl(net, SIOCWANDEV, &ifr, NULL);
  2670. if (!err) {
  2671. ifr.ifr_settings.ifs_ifsu.raw_hdlc = saved;
  2672. if (copy_to_user(uifr32, &ifr, sizeof(struct compat_ifreq)))
  2673. err = -EFAULT;
  2674. }
  2675. return err;
  2676. }
  2677. /* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
  2678. static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
  2679. struct compat_ifreq __user *u_ifreq32)
  2680. {
  2681. struct ifreq ifreq;
  2682. u32 data32;
  2683. if (!is_socket_ioctl_cmd(cmd))
  2684. return -ENOTTY;
  2685. if (copy_from_user(ifreq.ifr_name, u_ifreq32->ifr_name, IFNAMSIZ))
  2686. return -EFAULT;
  2687. if (get_user(data32, &u_ifreq32->ifr_data))
  2688. return -EFAULT;
  2689. ifreq.ifr_data = compat_ptr(data32);
  2690. return dev_ioctl(net, cmd, &ifreq, NULL);
  2691. }
  2692. static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
  2693. unsigned int cmd,
  2694. struct compat_ifreq __user *uifr32)
  2695. {
  2696. struct ifreq __user *uifr;
  2697. int err;
  2698. /* Handle the fact that while struct ifreq has the same *layout* on
  2699. * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
  2700. * which are handled elsewhere, it still has different *size* due to
  2701. * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
  2702. * resulting in struct ifreq being 32 and 40 bytes respectively).
  2703. * As a result, if the struct happens to be at the end of a page and
  2704. * the next page isn't readable/writable, we get a fault. To prevent
  2705. * that, copy back and forth to the full size.
  2706. */
  2707. uifr = compat_alloc_user_space(sizeof(*uifr));
  2708. if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
  2709. return -EFAULT;
  2710. err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
  2711. if (!err) {
  2712. switch (cmd) {
  2713. case SIOCGIFFLAGS:
  2714. case SIOCGIFMETRIC:
  2715. case SIOCGIFMTU:
  2716. case SIOCGIFMEM:
  2717. case SIOCGIFHWADDR:
  2718. case SIOCGIFINDEX:
  2719. case SIOCGIFADDR:
  2720. case SIOCGIFBRDADDR:
  2721. case SIOCGIFDSTADDR:
  2722. case SIOCGIFNETMASK:
  2723. case SIOCGIFPFLAGS:
  2724. case SIOCGIFTXQLEN:
  2725. case SIOCGMIIPHY:
  2726. case SIOCGMIIREG:
  2727. case SIOCGIFNAME:
  2728. if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
  2729. err = -EFAULT;
  2730. break;
  2731. }
  2732. }
  2733. return err;
  2734. }
  2735. static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
  2736. struct compat_ifreq __user *uifr32)
  2737. {
  2738. struct ifreq ifr;
  2739. struct compat_ifmap __user *uifmap32;
  2740. int err;
  2741. uifmap32 = &uifr32->ifr_ifru.ifru_map;
  2742. err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
  2743. err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
  2744. err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
  2745. err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
  2746. err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
  2747. err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
  2748. err |= get_user(ifr.ifr_map.port, &uifmap32->port);
  2749. if (err)
  2750. return -EFAULT;
  2751. err = dev_ioctl(net, cmd, &ifr, NULL);
  2752. if (cmd == SIOCGIFMAP && !err) {
  2753. err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
  2754. err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
  2755. err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
  2756. err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
  2757. err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
  2758. err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
  2759. err |= put_user(ifr.ifr_map.port, &uifmap32->port);
  2760. if (err)
  2761. err = -EFAULT;
  2762. }
  2763. return err;
  2764. }
  2765. /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
  2766. * for some operations; this forces use of the newer bridge-utils that
  2767. * use compatible ioctls
  2768. */
  2769. static int old_bridge_ioctl(compat_ulong_t __user *argp)
  2770. {
  2771. compat_ulong_t tmp;
  2772. if (get_user(tmp, argp))
  2773. return -EFAULT;
  2774. if (tmp == BRCTL_GET_VERSION)
  2775. return BRCTL_VERSION + 1;
  2776. return -EINVAL;
  2777. }
  2778. static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
  2779. unsigned int cmd, unsigned long arg)
  2780. {
  2781. void __user *argp = compat_ptr(arg);
  2782. struct sock *sk = sock->sk;
  2783. struct net *net = sock_net(sk);
  2784. if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
  2785. return compat_ifr_data_ioctl(net, cmd, argp);
  2786. switch (cmd) {
  2787. case SIOCSIFBR:
  2788. case SIOCGIFBR:
  2789. return old_bridge_ioctl(argp);
  2790. case SIOCGIFCONF:
  2791. return compat_dev_ifconf(net, argp);
  2792. case SIOCWANDEV:
  2793. return compat_siocwandev(net, argp);
  2794. case SIOCGIFMAP:
  2795. case SIOCSIFMAP:
  2796. return compat_sioc_ifmap(net, cmd, argp);
  2797. case SIOCGSTAMP_OLD:
  2798. case SIOCGSTAMPNS_OLD:
  2799. if (!sock->ops->gettstamp)
  2800. return -ENOIOCTLCMD;
  2801. return sock->ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD,
  2802. !COMPAT_USE_64BIT_TIME);
  2803. case SIOCETHTOOL:
  2804. case SIOCBONDSLAVEINFOQUERY:
  2805. case SIOCBONDINFOQUERY:
  2806. case SIOCSHWTSTAMP:
  2807. case SIOCGHWTSTAMP:
  2808. return compat_ifr_data_ioctl(net, cmd, argp);
  2809. case FIOSETOWN:
  2810. case SIOCSPGRP:
  2811. case FIOGETOWN:
  2812. case SIOCGPGRP:
  2813. case SIOCBRADDBR:
  2814. case SIOCBRDELBR:
  2815. case SIOCGIFVLAN:
  2816. case SIOCSIFVLAN:
  2817. case SIOCADDDLCI:
  2818. case SIOCDELDLCI:
  2819. case SIOCGSKNS:
  2820. case SIOCGSTAMP_NEW:
  2821. case SIOCGSTAMPNS_NEW:
  2822. return sock_ioctl(file, cmd, arg);
  2823. case SIOCGIFFLAGS:
  2824. case SIOCSIFFLAGS:
  2825. case SIOCGIFMETRIC:
  2826. case SIOCSIFMETRIC:
  2827. case SIOCGIFMTU:
  2828. case SIOCSIFMTU:
  2829. case SIOCGIFMEM:
  2830. case SIOCSIFMEM:
  2831. case SIOCGIFHWADDR:
  2832. case SIOCSIFHWADDR:
  2833. case SIOCADDMULTI:
  2834. case SIOCDELMULTI:
  2835. case SIOCGIFINDEX:
  2836. case SIOCGIFADDR:
  2837. case SIOCSIFADDR:
  2838. case SIOCSIFHWBROADCAST:
  2839. case SIOCDIFADDR:
  2840. case SIOCGIFBRDADDR:
  2841. case SIOCSIFBRDADDR:
  2842. case SIOCGIFDSTADDR:
  2843. case SIOCSIFDSTADDR:
  2844. case SIOCGIFNETMASK:
  2845. case SIOCSIFNETMASK:
  2846. case SIOCSIFPFLAGS:
  2847. case SIOCGIFPFLAGS:
  2848. case SIOCGIFTXQLEN:
  2849. case SIOCSIFTXQLEN:
  2850. case SIOCBRADDIF:
  2851. case SIOCBRDELIF:
  2852. case SIOCGIFNAME:
  2853. case SIOCSIFNAME:
  2854. case SIOCGMIIPHY:
  2855. case SIOCGMIIREG:
  2856. case SIOCSMIIREG:
  2857. case SIOCBONDENSLAVE:
  2858. case SIOCBONDRELEASE:
  2859. case SIOCBONDSETHWADDR:
  2860. case SIOCBONDCHANGEACTIVE:
  2861. return compat_ifreq_ioctl(net, sock, cmd, argp);
  2862. case SIOCSARP:
  2863. case SIOCGARP:
  2864. case SIOCDARP:
  2865. case SIOCOUTQ:
  2866. case SIOCOUTQNSD:
  2867. case SIOCATMARK:
  2868. return sock_do_ioctl(net, sock, cmd, arg);
  2869. }
  2870. return -ENOIOCTLCMD;
  2871. }
  2872. static long compat_sock_ioctl(struct file *file, unsigned int cmd,
  2873. unsigned long arg)
  2874. {
  2875. struct socket *sock = file->private_data;
  2876. int ret = -ENOIOCTLCMD;
  2877. struct sock *sk;
  2878. struct net *net;
  2879. sk = sock->sk;
  2880. net = sock_net(sk);
  2881. if (sock->ops->compat_ioctl)
  2882. ret = sock->ops->compat_ioctl(sock, cmd, arg);
  2883. if (ret == -ENOIOCTLCMD &&
  2884. (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
  2885. ret = compat_wext_handle_ioctl(net, cmd, arg);
  2886. if (ret == -ENOIOCTLCMD)
  2887. ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
  2888. return ret;
  2889. }
  2890. #endif
  2891. /**
  2892. * kernel_bind - bind an address to a socket (kernel space)
  2893. * @sock: socket
  2894. * @addr: address
  2895. * @addrlen: length of address
  2896. *
  2897. * Returns 0 or an error.
  2898. */
  2899. int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
  2900. {
  2901. return sock->ops->bind(sock, addr, addrlen);
  2902. }
  2903. EXPORT_SYMBOL(kernel_bind);
  2904. /**
  2905. * kernel_listen - move socket to listening state (kernel space)
  2906. * @sock: socket
  2907. * @backlog: pending connections queue size
  2908. *
  2909. * Returns 0 or an error.
  2910. */
  2911. int kernel_listen(struct socket *sock, int backlog)
  2912. {
  2913. return sock->ops->listen(sock, backlog);
  2914. }
  2915. EXPORT_SYMBOL(kernel_listen);
  2916. /**
  2917. * kernel_accept - accept a connection (kernel space)
  2918. * @sock: listening socket
  2919. * @newsock: new connected socket
  2920. * @flags: flags
  2921. *
  2922. * @flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0.
  2923. * If it fails, @newsock is guaranteed to be %NULL.
  2924. * Returns 0 or an error.
  2925. */
  2926. int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
  2927. {
  2928. struct sock *sk = sock->sk;
  2929. int err;
  2930. err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
  2931. newsock);
  2932. if (err < 0)
  2933. goto done;
  2934. err = sock->ops->accept(sock, *newsock, flags, true);
  2935. if (err < 0) {
  2936. sock_release(*newsock);
  2937. *newsock = NULL;
  2938. goto done;
  2939. }
  2940. (*newsock)->ops = sock->ops;
  2941. __module_get((*newsock)->ops->owner);
  2942. done:
  2943. return err;
  2944. }
  2945. EXPORT_SYMBOL(kernel_accept);
  2946. /**
  2947. * kernel_connect - connect a socket (kernel space)
  2948. * @sock: socket
  2949. * @addr: address
  2950. * @addrlen: address length
  2951. * @flags: flags (O_NONBLOCK, ...)
  2952. *
  2953. * For datagram sockets, @addr is the addres to which datagrams are sent
  2954. * by default, and the only address from which datagrams are received.
  2955. * For stream sockets, attempts to connect to @addr.
  2956. * Returns 0 or an error code.
  2957. */
  2958. int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
  2959. int flags)
  2960. {
  2961. return sock->ops->connect(sock, addr, addrlen, flags);
  2962. }
  2963. EXPORT_SYMBOL(kernel_connect);
  2964. /**
  2965. * kernel_getsockname - get the address which the socket is bound (kernel space)
  2966. * @sock: socket
  2967. * @addr: address holder
  2968. *
  2969. * Fills the @addr pointer with the address which the socket is bound.
  2970. * Returns 0 or an error code.
  2971. */
  2972. int kernel_getsockname(struct socket *sock, struct sockaddr *addr)
  2973. {
  2974. return sock->ops->getname(sock, addr, 0);
  2975. }
  2976. EXPORT_SYMBOL(kernel_getsockname);
  2977. /**
  2978. * kernel_getpeername - get the address which the socket is connected (kernel space)
  2979. * @sock: socket
  2980. * @addr: address holder
  2981. *
  2982. * Fills the @addr pointer with the address which the socket is connected.
  2983. * Returns 0 or an error code.
  2984. */
  2985. int kernel_getpeername(struct socket *sock, struct sockaddr *addr)
  2986. {
  2987. return sock->ops->getname(sock, addr, 1);
  2988. }
  2989. EXPORT_SYMBOL(kernel_getpeername);
  2990. /**
  2991. * kernel_sendpage - send a &page through a socket (kernel space)
  2992. * @sock: socket
  2993. * @page: page
  2994. * @offset: page offset
  2995. * @size: total size in bytes
  2996. * @flags: flags (MSG_DONTWAIT, ...)
  2997. *
  2998. * Returns the total amount sent in bytes or an error.
  2999. */
  3000. int kernel_sendpage(struct socket *sock, struct page *page, int offset,
  3001. size_t size, int flags)
  3002. {
  3003. if (sock->ops->sendpage) {
  3004. /* Warn in case the improper page to zero-copy send */
  3005. WARN_ONCE(!sendpage_ok(page), "improper page for zero-copy send");
  3006. return sock->ops->sendpage(sock, page, offset, size, flags);
  3007. }
  3008. return sock_no_sendpage(sock, page, offset, size, flags);
  3009. }
  3010. EXPORT_SYMBOL(kernel_sendpage);
  3011. /**
  3012. * kernel_sendpage_locked - send a &page through the locked sock (kernel space)
  3013. * @sk: sock
  3014. * @page: page
  3015. * @offset: page offset
  3016. * @size: total size in bytes
  3017. * @flags: flags (MSG_DONTWAIT, ...)
  3018. *
  3019. * Returns the total amount sent in bytes or an error.
  3020. * Caller must hold @sk.
  3021. */
  3022. int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset,
  3023. size_t size, int flags)
  3024. {
  3025. struct socket *sock = sk->sk_socket;
  3026. if (sock->ops->sendpage_locked)
  3027. return sock->ops->sendpage_locked(sk, page, offset, size,
  3028. flags);
  3029. return sock_no_sendpage_locked(sk, page, offset, size, flags);
  3030. }
  3031. EXPORT_SYMBOL(kernel_sendpage_locked);
  3032. /**
  3033. * kernel_sock_shutdown - shut down part of a full-duplex connection (kernel space)
  3034. * @sock: socket
  3035. * @how: connection part
  3036. *
  3037. * Returns 0 or an error.
  3038. */
  3039. int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
  3040. {
  3041. return sock->ops->shutdown(sock, how);
  3042. }
  3043. EXPORT_SYMBOL(kernel_sock_shutdown);
  3044. /**
  3045. * kernel_sock_ip_overhead - returns the IP overhead imposed by a socket
  3046. * @sk: socket
  3047. *
  3048. * This routine returns the IP overhead imposed by a socket i.e.
  3049. * the length of the underlying IP header, depending on whether
  3050. * this is an IPv4 or IPv6 socket and the length from IP options turned
  3051. * on at the socket. Assumes that the caller has a lock on the socket.
  3052. */
  3053. u32 kernel_sock_ip_overhead(struct sock *sk)
  3054. {
  3055. struct inet_sock *inet;
  3056. struct ip_options_rcu *opt;
  3057. u32 overhead = 0;
  3058. #if IS_ENABLED(CONFIG_IPV6)
  3059. struct ipv6_pinfo *np;
  3060. struct ipv6_txoptions *optv6 = NULL;
  3061. #endif /* IS_ENABLED(CONFIG_IPV6) */
  3062. if (!sk)
  3063. return overhead;
  3064. switch (sk->sk_family) {
  3065. case AF_INET:
  3066. inet = inet_sk(sk);
  3067. overhead += sizeof(struct iphdr);
  3068. opt = rcu_dereference_protected(inet->inet_opt,
  3069. sock_owned_by_user(sk));
  3070. if (opt)
  3071. overhead += opt->opt.optlen;
  3072. return overhead;
  3073. #if IS_ENABLED(CONFIG_IPV6)
  3074. case AF_INET6:
  3075. np = inet6_sk(sk);
  3076. overhead += sizeof(struct ipv6hdr);
  3077. if (np)
  3078. optv6 = rcu_dereference_protected(np->opt,
  3079. sock_owned_by_user(sk));
  3080. if (optv6)
  3081. overhead += (optv6->opt_flen + optv6->opt_nflen);
  3082. return overhead;
  3083. #endif /* IS_ENABLED(CONFIG_IPV6) */
  3084. default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
  3085. return overhead;
  3086. }
  3087. }
  3088. EXPORT_SYMBOL(kernel_sock_ip_overhead);