xref: /linux/net/core/sock.c (revision 7ec462100ef9142344ddbf86f2c3008b97acddbe)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * INET		An implementation of the TCP/IP protocol suite for the LINUX
4  *		operating system.  INET is implemented using the  BSD Socket
5  *		interface as the means of communication with the user level.
6  *
7  *		Generic socket support routines. Memory allocators, socket lock/release
8  *		handler for protocols to use and generic option handler.
9  *
10  * Authors:	Ross Biro
11  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
12  *		Florian La Roche, <flla@stud.uni-sb.de>
13  *		Alan Cox, <A.Cox@swansea.ac.uk>
14  *
15  * Fixes:
16  *		Alan Cox	: 	Numerous verify_area() problems
17  *		Alan Cox	:	Connecting on a connecting socket
18  *					now returns an error for tcp.
19  *		Alan Cox	:	sock->protocol is set correctly.
20  *					and is not sometimes left as 0.
21  *		Alan Cox	:	connect handles icmp errors on a
22  *					connect properly. Unfortunately there
23  *					is a restart syscall nasty there. I
24  *					can't match BSD without hacking the C
25  *					library. Ideas urgently sought!
26  *		Alan Cox	:	Disallow bind() to addresses that are
27  *					not ours - especially broadcast ones!!
28  *		Alan Cox	:	Socket 1024 _IS_ ok for users. (fencepost)
29  *		Alan Cox	:	sock_wfree/sock_rfree don't destroy sockets,
30  *					instead they leave that for the DESTROY timer.
31  *		Alan Cox	:	Clean up error flag in accept
32  *		Alan Cox	:	TCP ack handling is buggy, the DESTROY timer
33  *					was buggy. Put a remove_sock() in the handler
34  *					for memory when we hit 0. Also altered the timer
35  *					code. The ACK stuff can wait and needs major
36  *					TCP layer surgery.
37  *		Alan Cox	:	Fixed TCP ack bug, removed remove sock
38  *					and fixed timer/inet_bh race.
39  *		Alan Cox	:	Added zapped flag for TCP
40  *		Alan Cox	:	Move kfree_skb into skbuff.c and tidied up surplus code
41  *		Alan Cox	:	for new sk_buff allocations wmalloc/rmalloc now call alloc_skb
42  *		Alan Cox	:	kfree_s calls now are kfree_skbmem so we can track skb resources
43  *		Alan Cox	:	Supports socket option broadcast now as does udp. Packet and raw need fixing.
44  *		Alan Cox	:	Added RCVBUF,SNDBUF size setting. It suddenly occurred to me how easy it was so...
45  *		Rick Sladkey	:	Relaxed UDP rules for matching packets.
46  *		C.E.Hawkins	:	IFF_PROMISC/SIOCGHWADDR support
47  *	Pauline Middelink	:	identd support
48  *		Alan Cox	:	Fixed connect() taking signals I think.
49  *		Alan Cox	:	SO_LINGER supported
50  *		Alan Cox	:	Error reporting fixes
51  *		Anonymous	:	inet_create tidied up (sk->reuse setting)
52  *		Alan Cox	:	inet sockets don't set sk->type!
53  *		Alan Cox	:	Split socket option code
54  *		Alan Cox	:	Callbacks
55  *		Alan Cox	:	Nagle flag for Charles & Johannes stuff
56  *		Alex		:	Removed restriction on inet fioctl
57  *		Alan Cox	:	Splitting INET from NET core
58  *		Alan Cox	:	Fixed bogus SO_TYPE handling in getsockopt()
59  *		Adam Caldwell	:	Missing return in SO_DONTROUTE/SO_DEBUG code
60  *		Alan Cox	:	Split IP from generic code
61  *		Alan Cox	:	New kfree_skbmem()
62  *		Alan Cox	:	Make SO_DEBUG superuser only.
63  *		Alan Cox	:	Allow anyone to clear SO_DEBUG
64  *					(compatibility fix)
65  *		Alan Cox	:	Added optimistic memory grabbing for AF_UNIX throughput.
66  *		Alan Cox	:	Allocator for a socket is settable.
67  *		Alan Cox	:	SO_ERROR includes soft errors.
68  *		Alan Cox	:	Allow NULL arguments on some SO_ opts
69  *		Alan Cox	: 	Generic socket allocation to make hooks
70  *					easier (suggested by Craig Metz).
71  *		Michael Pall	:	SO_ERROR returns positive errno again
72  *              Steve Whitehouse:       Added default destructor to free
73  *                                      protocol private data.
74  *              Steve Whitehouse:       Added various other default routines
75  *                                      common to several socket families.
76  *              Chris Evans     :       Call suser() check last on F_SETOWN
77  *		Jay Schulist	:	Added SO_ATTACH_FILTER and SO_DETACH_FILTER.
78  *		Andi Kleen	:	Add sock_kmalloc()/sock_kfree_s()
79  *		Andi Kleen	:	Fix write_space callback
80  *		Chris Evans	:	Security fixes - signedness again
81  *		Arnaldo C. Melo :       cleanups, use skb_queue_purge
82  *
83  * To Fix:
84  */
85 
86 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
87 
88 #include <linux/unaligned.h>
89 #include <linux/capability.h>
90 #include <linux/errno.h>
91 #include <linux/errqueue.h>
92 #include <linux/types.h>
93 #include <linux/socket.h>
94 #include <linux/in.h>
95 #include <linux/kernel.h>
96 #include <linux/module.h>
97 #include <linux/proc_fs.h>
98 #include <linux/seq_file.h>
99 #include <linux/sched.h>
100 #include <linux/sched/mm.h>
101 #include <linux/timer.h>
102 #include <linux/string.h>
103 #include <linux/sockios.h>
104 #include <linux/net.h>
105 #include <linux/mm.h>
106 #include <linux/slab.h>
107 #include <linux/interrupt.h>
108 #include <linux/poll.h>
109 #include <linux/tcp.h>
110 #include <linux/udp.h>
111 #include <linux/init.h>
112 #include <linux/highmem.h>
113 #include <linux/user_namespace.h>
114 #include <linux/static_key.h>
115 #include <linux/memcontrol.h>
116 #include <linux/prefetch.h>
117 #include <linux/compat.h>
118 #include <linux/mroute.h>
119 #include <linux/mroute6.h>
120 #include <linux/icmpv6.h>
121 
122 #include <linux/uaccess.h>
123 
124 #include <linux/netdevice.h>
125 #include <net/protocol.h>
126 #include <linux/skbuff.h>
127 #include <linux/skbuff_ref.h>
128 #include <net/net_namespace.h>
129 #include <net/request_sock.h>
130 #include <net/sock.h>
131 #include <net/proto_memory.h>
132 #include <linux/net_tstamp.h>
133 #include <net/xfrm.h>
134 #include <linux/ipsec.h>
135 #include <net/cls_cgroup.h>
136 #include <net/netprio_cgroup.h>
137 #include <linux/sock_diag.h>
138 
139 #include <linux/filter.h>
140 #include <net/sock_reuseport.h>
141 #include <net/bpf_sk_storage.h>
142 
143 #include <trace/events/sock.h>
144 
145 #include <net/tcp.h>
146 #include <net/busy_poll.h>
147 #include <net/phonet/phonet.h>
148 
149 #include <linux/ethtool.h>
150 
151 #include "dev.h"
152 
153 static DEFINE_MUTEX(proto_list_mutex);
154 static LIST_HEAD(proto_list);
155 
156 static void sock_def_write_space_wfree(struct sock *sk);
157 static void sock_def_write_space(struct sock *sk);
158 
159 /**
160  * sk_ns_capable - General socket capability test
161  * @sk: Socket to use a capability on or through
162  * @user_ns: The user namespace of the capability to use
163  * @cap: The capability to use
164  *
165  * Test to see if the opener of the socket had when the socket was
166  * created and the current process has the capability @cap in the user
167  * namespace @user_ns.
168  */
sk_ns_capable(const struct sock * sk,struct user_namespace * user_ns,int cap)169 bool sk_ns_capable(const struct sock *sk,
170 		   struct user_namespace *user_ns, int cap)
171 {
172 	return file_ns_capable(sk->sk_socket->file, user_ns, cap) &&
173 		ns_capable(user_ns, cap);
174 }
175 EXPORT_SYMBOL(sk_ns_capable);
176 
177 /**
178  * sk_capable - Socket global capability test
179  * @sk: Socket to use a capability on or through
180  * @cap: The global capability to use
181  *
182  * Test to see if the opener of the socket had when the socket was
183  * created and the current process has the capability @cap in all user
184  * namespaces.
185  */
sk_capable(const struct sock * sk,int cap)186 bool sk_capable(const struct sock *sk, int cap)
187 {
188 	return sk_ns_capable(sk, &init_user_ns, cap);
189 }
190 EXPORT_SYMBOL(sk_capable);
191 
192 /**
193  * sk_net_capable - Network namespace socket capability test
194  * @sk: Socket to use a capability on or through
195  * @cap: The capability to use
196  *
197  * Test to see if the opener of the socket had when the socket was created
198  * and the current process has the capability @cap over the network namespace
199  * the socket is a member of.
200  */
sk_net_capable(const struct sock * sk,int cap)201 bool sk_net_capable(const struct sock *sk, int cap)
202 {
203 	return sk_ns_capable(sk, sock_net(sk)->user_ns, cap);
204 }
205 EXPORT_SYMBOL(sk_net_capable);
206 
207 /*
208  * Each address family might have different locking rules, so we have
209  * one slock key per address family and separate keys for internal and
210  * userspace sockets.
211  */
212 static struct lock_class_key af_family_keys[AF_MAX];
213 static struct lock_class_key af_family_kern_keys[AF_MAX];
214 static struct lock_class_key af_family_slock_keys[AF_MAX];
215 static struct lock_class_key af_family_kern_slock_keys[AF_MAX];
216 
217 /*
218  * Make lock validator output more readable. (we pre-construct these
219  * strings build-time, so that runtime initialization of socket
220  * locks is fast):
221  */
222 
223 #define _sock_locks(x)						  \
224   x "AF_UNSPEC",	x "AF_UNIX"     ,	x "AF_INET"     , \
225   x "AF_AX25"  ,	x "AF_IPX"      ,	x "AF_APPLETALK", \
226   x "AF_NETROM",	x "AF_BRIDGE"   ,	x "AF_ATMPVC"   , \
227   x "AF_X25"   ,	x "AF_INET6"    ,	x "AF_ROSE"     , \
228   x "AF_DECnet",	x "AF_NETBEUI"  ,	x "AF_SECURITY" , \
229   x "AF_KEY"   ,	x "AF_NETLINK"  ,	x "AF_PACKET"   , \
230   x "AF_ASH"   ,	x "AF_ECONET"   ,	x "AF_ATMSVC"   , \
231   x "AF_RDS"   ,	x "AF_SNA"      ,	x "AF_IRDA"     , \
232   x "AF_PPPOX" ,	x "AF_WANPIPE"  ,	x "AF_LLC"      , \
233   x "27"       ,	x "28"          ,	x "AF_CAN"      , \
234   x "AF_TIPC"  ,	x "AF_BLUETOOTH",	x "IUCV"        , \
235   x "AF_RXRPC" ,	x "AF_ISDN"     ,	x "AF_PHONET"   , \
236   x "AF_IEEE802154",	x "AF_CAIF"	,	x "AF_ALG"      , \
237   x "AF_NFC"   ,	x "AF_VSOCK"    ,	x "AF_KCM"      , \
238   x "AF_QIPCRTR",	x "AF_SMC"	,	x "AF_XDP"	, \
239   x "AF_MCTP"  , \
240   x "AF_MAX"
241 
242 static const char *const af_family_key_strings[AF_MAX+1] = {
243 	_sock_locks("sk_lock-")
244 };
245 static const char *const af_family_slock_key_strings[AF_MAX+1] = {
246 	_sock_locks("slock-")
247 };
248 static const char *const af_family_clock_key_strings[AF_MAX+1] = {
249 	_sock_locks("clock-")
250 };
251 
252 static const char *const af_family_kern_key_strings[AF_MAX+1] = {
253 	_sock_locks("k-sk_lock-")
254 };
255 static const char *const af_family_kern_slock_key_strings[AF_MAX+1] = {
256 	_sock_locks("k-slock-")
257 };
258 static const char *const af_family_kern_clock_key_strings[AF_MAX+1] = {
259 	_sock_locks("k-clock-")
260 };
261 static const char *const af_family_rlock_key_strings[AF_MAX+1] = {
262 	_sock_locks("rlock-")
263 };
264 static const char *const af_family_wlock_key_strings[AF_MAX+1] = {
265 	_sock_locks("wlock-")
266 };
267 static const char *const af_family_elock_key_strings[AF_MAX+1] = {
268 	_sock_locks("elock-")
269 };
270 
271 /*
272  * sk_callback_lock and sk queues locking rules are per-address-family,
273  * so split the lock classes by using a per-AF key:
274  */
275 static struct lock_class_key af_callback_keys[AF_MAX];
276 static struct lock_class_key af_rlock_keys[AF_MAX];
277 static struct lock_class_key af_wlock_keys[AF_MAX];
278 static struct lock_class_key af_elock_keys[AF_MAX];
279 static struct lock_class_key af_kern_callback_keys[AF_MAX];
280 
281 /* Run time adjustable parameters. */
282 __u32 sysctl_wmem_max __read_mostly = SK_WMEM_MAX;
283 EXPORT_SYMBOL(sysctl_wmem_max);
284 __u32 sysctl_rmem_max __read_mostly = SK_RMEM_MAX;
285 EXPORT_SYMBOL(sysctl_rmem_max);
286 __u32 sysctl_wmem_default __read_mostly = SK_WMEM_MAX;
287 __u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX;
288 
289 int sysctl_tstamp_allow_data __read_mostly = 1;
290 
291 DEFINE_STATIC_KEY_FALSE(memalloc_socks_key);
292 EXPORT_SYMBOL_GPL(memalloc_socks_key);
293 
294 /**
295  * sk_set_memalloc - sets %SOCK_MEMALLOC
296  * @sk: socket to set it on
297  *
298  * Set %SOCK_MEMALLOC on a socket for access to emergency reserves.
299  * It's the responsibility of the admin to adjust min_free_kbytes
300  * to meet the requirements
301  */
sk_set_memalloc(struct sock * sk)302 void sk_set_memalloc(struct sock *sk)
303 {
304 	sock_set_flag(sk, SOCK_MEMALLOC);
305 	sk->sk_allocation |= __GFP_MEMALLOC;
306 	static_branch_inc(&memalloc_socks_key);
307 }
308 EXPORT_SYMBOL_GPL(sk_set_memalloc);
309 
sk_clear_memalloc(struct sock * sk)310 void sk_clear_memalloc(struct sock *sk)
311 {
312 	sock_reset_flag(sk, SOCK_MEMALLOC);
313 	sk->sk_allocation &= ~__GFP_MEMALLOC;
314 	static_branch_dec(&memalloc_socks_key);
315 
316 	/*
317 	 * SOCK_MEMALLOC is allowed to ignore rmem limits to ensure forward
318 	 * progress of swapping. SOCK_MEMALLOC may be cleared while
319 	 * it has rmem allocations due to the last swapfile being deactivated
320 	 * but there is a risk that the socket is unusable due to exceeding
321 	 * the rmem limits. Reclaim the reserves and obey rmem limits again.
322 	 */
323 	sk_mem_reclaim(sk);
324 }
325 EXPORT_SYMBOL_GPL(sk_clear_memalloc);
326 
__sk_backlog_rcv(struct sock * sk,struct sk_buff * skb)327 int __sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
328 {
329 	int ret;
330 	unsigned int noreclaim_flag;
331 
332 	/* these should have been dropped before queueing */
333 	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));
334 
335 	noreclaim_flag = memalloc_noreclaim_save();
336 	ret = INDIRECT_CALL_INET(sk->sk_backlog_rcv,
337 				 tcp_v6_do_rcv,
338 				 tcp_v4_do_rcv,
339 				 sk, skb);
340 	memalloc_noreclaim_restore(noreclaim_flag);
341 
342 	return ret;
343 }
344 EXPORT_SYMBOL(__sk_backlog_rcv);
345 
sk_error_report(struct sock * sk)346 void sk_error_report(struct sock *sk)
347 {
348 	sk->sk_error_report(sk);
349 
350 	switch (sk->sk_family) {
351 	case AF_INET:
352 		fallthrough;
353 	case AF_INET6:
354 		trace_inet_sk_error_report(sk);
355 		break;
356 	default:
357 		break;
358 	}
359 }
360 EXPORT_SYMBOL(sk_error_report);
361 
sock_get_timeout(long timeo,void * optval,bool old_timeval)362 int sock_get_timeout(long timeo, void *optval, bool old_timeval)
363 {
364 	struct __kernel_sock_timeval tv;
365 
366 	if (timeo == MAX_SCHEDULE_TIMEOUT) {
367 		tv.tv_sec = 0;
368 		tv.tv_usec = 0;
369 	} else {
370 		tv.tv_sec = timeo / HZ;
371 		tv.tv_usec = ((timeo % HZ) * USEC_PER_SEC) / HZ;
372 	}
373 
374 	if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
375 		struct old_timeval32 tv32 = { tv.tv_sec, tv.tv_usec };
376 		*(struct old_timeval32 *)optval = tv32;
377 		return sizeof(tv32);
378 	}
379 
380 	if (old_timeval) {
381 		struct __kernel_old_timeval old_tv;
382 		old_tv.tv_sec = tv.tv_sec;
383 		old_tv.tv_usec = tv.tv_usec;
384 		*(struct __kernel_old_timeval *)optval = old_tv;
385 		return sizeof(old_tv);
386 	}
387 
388 	*(struct __kernel_sock_timeval *)optval = tv;
389 	return sizeof(tv);
390 }
391 EXPORT_SYMBOL(sock_get_timeout);
392 
sock_copy_user_timeval(struct __kernel_sock_timeval * tv,sockptr_t optval,int optlen,bool old_timeval)393 int sock_copy_user_timeval(struct __kernel_sock_timeval *tv,
394 			   sockptr_t optval, int optlen, bool old_timeval)
395 {
396 	if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
397 		struct old_timeval32 tv32;
398 
399 		if (optlen < sizeof(tv32))
400 			return -EINVAL;
401 
402 		if (copy_from_sockptr(&tv32, optval, sizeof(tv32)))
403 			return -EFAULT;
404 		tv->tv_sec = tv32.tv_sec;
405 		tv->tv_usec = tv32.tv_usec;
406 	} else if (old_timeval) {
407 		struct __kernel_old_timeval old_tv;
408 
409 		if (optlen < sizeof(old_tv))
410 			return -EINVAL;
411 		if (copy_from_sockptr(&old_tv, optval, sizeof(old_tv)))
412 			return -EFAULT;
413 		tv->tv_sec = old_tv.tv_sec;
414 		tv->tv_usec = old_tv.tv_usec;
415 	} else {
416 		if (optlen < sizeof(*tv))
417 			return -EINVAL;
418 		if (copy_from_sockptr(tv, optval, sizeof(*tv)))
419 			return -EFAULT;
420 	}
421 
422 	return 0;
423 }
424 EXPORT_SYMBOL(sock_copy_user_timeval);
425 
sock_set_timeout(long * timeo_p,sockptr_t optval,int optlen,bool old_timeval)426 static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen,
427 			    bool old_timeval)
428 {
429 	struct __kernel_sock_timeval tv;
430 	int err = sock_copy_user_timeval(&tv, optval, optlen, old_timeval);
431 	long val;
432 
433 	if (err)
434 		return err;
435 
436 	if (tv.tv_usec < 0 || tv.tv_usec >= USEC_PER_SEC)
437 		return -EDOM;
438 
439 	if (tv.tv_sec < 0) {
440 		static int warned __read_mostly;
441 
442 		WRITE_ONCE(*timeo_p, 0);
443 		if (warned < 10 && net_ratelimit()) {
444 			warned++;
445 			pr_info("%s: `%s' (pid %d) tries to set negative timeout\n",
446 				__func__, current->comm, task_pid_nr(current));
447 		}
448 		return 0;
449 	}
450 	val = MAX_SCHEDULE_TIMEOUT;
451 	if ((tv.tv_sec || tv.tv_usec) &&
452 	    (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)))
453 		val = tv.tv_sec * HZ + DIV_ROUND_UP((unsigned long)tv.tv_usec,
454 						    USEC_PER_SEC / HZ);
455 	WRITE_ONCE(*timeo_p, val);
456 	return 0;
457 }
458 
sock_needs_netstamp(const struct sock * sk)459 static bool sock_needs_netstamp(const struct sock *sk)
460 {
461 	switch (sk->sk_family) {
462 	case AF_UNSPEC:
463 	case AF_UNIX:
464 		return false;
465 	default:
466 		return true;
467 	}
468 }
469 
sock_disable_timestamp(struct sock * sk,unsigned long flags)470 static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
471 {
472 	if (sk->sk_flags & flags) {
473 		sk->sk_flags &= ~flags;
474 		if (sock_needs_netstamp(sk) &&
475 		    !(sk->sk_flags & SK_FLAGS_TIMESTAMP))
476 			net_disable_timestamp();
477 	}
478 }
479 
480 
__sock_queue_rcv_skb(struct sock * sk,struct sk_buff * skb)481 int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
482 {
483 	unsigned long flags;
484 	struct sk_buff_head *list = &sk->sk_receive_queue;
485 
486 	if (atomic_read(&sk->sk_rmem_alloc) >= READ_ONCE(sk->sk_rcvbuf)) {
487 		atomic_inc(&sk->sk_drops);
488 		trace_sock_rcvqueue_full(sk, skb);
489 		return -ENOMEM;
490 	}
491 
492 	if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
493 		atomic_inc(&sk->sk_drops);
494 		return -ENOBUFS;
495 	}
496 
497 	skb->dev = NULL;
498 	skb_set_owner_r(skb, sk);
499 
500 	/* we escape from rcu protected region, make sure we dont leak
501 	 * a norefcounted dst
502 	 */
503 	skb_dst_force(skb);
504 
505 	spin_lock_irqsave(&list->lock, flags);
506 	sock_skb_set_dropcount(sk, skb);
507 	__skb_queue_tail(list, skb);
508 	spin_unlock_irqrestore(&list->lock, flags);
509 
510 	if (!sock_flag(sk, SOCK_DEAD))
511 		sk->sk_data_ready(sk);
512 	return 0;
513 }
514 EXPORT_SYMBOL(__sock_queue_rcv_skb);
515 
sock_queue_rcv_skb_reason(struct sock * sk,struct sk_buff * skb,enum skb_drop_reason * reason)516 int sock_queue_rcv_skb_reason(struct sock *sk, struct sk_buff *skb,
517 			      enum skb_drop_reason *reason)
518 {
519 	enum skb_drop_reason drop_reason;
520 	int err;
521 
522 	err = sk_filter(sk, skb);
523 	if (err) {
524 		drop_reason = SKB_DROP_REASON_SOCKET_FILTER;
525 		goto out;
526 	}
527 	err = __sock_queue_rcv_skb(sk, skb);
528 	switch (err) {
529 	case -ENOMEM:
530 		drop_reason = SKB_DROP_REASON_SOCKET_RCVBUFF;
531 		break;
532 	case -ENOBUFS:
533 		drop_reason = SKB_DROP_REASON_PROTO_MEM;
534 		break;
535 	default:
536 		drop_reason = SKB_NOT_DROPPED_YET;
537 		break;
538 	}
539 out:
540 	if (reason)
541 		*reason = drop_reason;
542 	return err;
543 }
544 EXPORT_SYMBOL(sock_queue_rcv_skb_reason);
545 
__sk_receive_skb(struct sock * sk,struct sk_buff * skb,const int nested,unsigned int trim_cap,bool refcounted)546 int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
547 		     const int nested, unsigned int trim_cap, bool refcounted)
548 {
549 	int rc = NET_RX_SUCCESS;
550 
551 	if (sk_filter_trim_cap(sk, skb, trim_cap))
552 		goto discard_and_relse;
553 
554 	skb->dev = NULL;
555 
556 	if (sk_rcvqueues_full(sk, READ_ONCE(sk->sk_rcvbuf))) {
557 		atomic_inc(&sk->sk_drops);
558 		goto discard_and_relse;
559 	}
560 	if (nested)
561 		bh_lock_sock_nested(sk);
562 	else
563 		bh_lock_sock(sk);
564 	if (!sock_owned_by_user(sk)) {
565 		/*
566 		 * trylock + unlock semantics:
567 		 */
568 		mutex_acquire(&sk->sk_lock.dep_map, 0, 1, _RET_IP_);
569 
570 		rc = sk_backlog_rcv(sk, skb);
571 
572 		mutex_release(&sk->sk_lock.dep_map, _RET_IP_);
573 	} else if (sk_add_backlog(sk, skb, READ_ONCE(sk->sk_rcvbuf))) {
574 		bh_unlock_sock(sk);
575 		atomic_inc(&sk->sk_drops);
576 		goto discard_and_relse;
577 	}
578 
579 	bh_unlock_sock(sk);
580 out:
581 	if (refcounted)
582 		sock_put(sk);
583 	return rc;
584 discard_and_relse:
585 	kfree_skb(skb);
586 	goto out;
587 }
588 EXPORT_SYMBOL(__sk_receive_skb);
589 
590 INDIRECT_CALLABLE_DECLARE(struct dst_entry *ip6_dst_check(struct dst_entry *,
591 							  u32));
592 INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
593 							   u32));
__sk_dst_check(struct sock * sk,u32 cookie)594 struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
595 {
596 	struct dst_entry *dst = __sk_dst_get(sk);
597 
598 	if (dst && dst->obsolete &&
599 	    INDIRECT_CALL_INET(dst->ops->check, ip6_dst_check, ipv4_dst_check,
600 			       dst, cookie) == NULL) {
601 		sk_tx_queue_clear(sk);
602 		WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
603 		RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
604 		dst_release(dst);
605 		return NULL;
606 	}
607 
608 	return dst;
609 }
610 EXPORT_SYMBOL(__sk_dst_check);
611 
sk_dst_check(struct sock * sk,u32 cookie)612 struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie)
613 {
614 	struct dst_entry *dst = sk_dst_get(sk);
615 
616 	if (dst && dst->obsolete &&
617 	    INDIRECT_CALL_INET(dst->ops->check, ip6_dst_check, ipv4_dst_check,
618 			       dst, cookie) == NULL) {
619 		sk_dst_reset(sk);
620 		dst_release(dst);
621 		return NULL;
622 	}
623 
624 	return dst;
625 }
626 EXPORT_SYMBOL(sk_dst_check);
627 
sock_bindtoindex_locked(struct sock * sk,int ifindex)628 static int sock_bindtoindex_locked(struct sock *sk, int ifindex)
629 {
630 	int ret = -ENOPROTOOPT;
631 #ifdef CONFIG_NETDEVICES
632 	struct net *net = sock_net(sk);
633 
634 	/* Sorry... */
635 	ret = -EPERM;
636 	if (sk->sk_bound_dev_if && !ns_capable(net->user_ns, CAP_NET_RAW))
637 		goto out;
638 
639 	ret = -EINVAL;
640 	if (ifindex < 0)
641 		goto out;
642 
643 	/* Paired with all READ_ONCE() done locklessly. */
644 	WRITE_ONCE(sk->sk_bound_dev_if, ifindex);
645 
646 	if (sk->sk_prot->rehash)
647 		sk->sk_prot->rehash(sk);
648 	sk_dst_reset(sk);
649 
650 	ret = 0;
651 
652 out:
653 #endif
654 
655 	return ret;
656 }
657 
sock_bindtoindex(struct sock * sk,int ifindex,bool lock_sk)658 int sock_bindtoindex(struct sock *sk, int ifindex, bool lock_sk)
659 {
660 	int ret;
661 
662 	if (lock_sk)
663 		lock_sock(sk);
664 	ret = sock_bindtoindex_locked(sk, ifindex);
665 	if (lock_sk)
666 		release_sock(sk);
667 
668 	return ret;
669 }
670 EXPORT_SYMBOL(sock_bindtoindex);
671 
sock_setbindtodevice(struct sock * sk,sockptr_t optval,int optlen)672 static int sock_setbindtodevice(struct sock *sk, sockptr_t optval, int optlen)
673 {
674 	int ret = -ENOPROTOOPT;
675 #ifdef CONFIG_NETDEVICES
676 	struct net *net = sock_net(sk);
677 	char devname[IFNAMSIZ];
678 	int index;
679 
680 	ret = -EINVAL;
681 	if (optlen < 0)
682 		goto out;
683 
684 	/* Bind this socket to a particular device like "eth0",
685 	 * as specified in the passed interface name. If the
686 	 * name is "" or the option length is zero the socket
687 	 * is not bound.
688 	 */
689 	if (optlen > IFNAMSIZ - 1)
690 		optlen = IFNAMSIZ - 1;
691 	memset(devname, 0, sizeof(devname));
692 
693 	ret = -EFAULT;
694 	if (copy_from_sockptr(devname, optval, optlen))
695 		goto out;
696 
697 	index = 0;
698 	if (devname[0] != '\0') {
699 		struct net_device *dev;
700 
701 		rcu_read_lock();
702 		dev = dev_get_by_name_rcu(net, devname);
703 		if (dev)
704 			index = dev->ifindex;
705 		rcu_read_unlock();
706 		ret = -ENODEV;
707 		if (!dev)
708 			goto out;
709 	}
710 
711 	sockopt_lock_sock(sk);
712 	ret = sock_bindtoindex_locked(sk, index);
713 	sockopt_release_sock(sk);
714 out:
715 #endif
716 
717 	return ret;
718 }
719 
sock_getbindtodevice(struct sock * sk,sockptr_t optval,sockptr_t optlen,int len)720 static int sock_getbindtodevice(struct sock *sk, sockptr_t optval,
721 				sockptr_t optlen, int len)
722 {
723 	int ret = -ENOPROTOOPT;
724 #ifdef CONFIG_NETDEVICES
725 	int bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
726 	struct net *net = sock_net(sk);
727 	char devname[IFNAMSIZ];
728 
729 	if (bound_dev_if == 0) {
730 		len = 0;
731 		goto zero;
732 	}
733 
734 	ret = -EINVAL;
735 	if (len < IFNAMSIZ)
736 		goto out;
737 
738 	ret = netdev_get_name(net, devname, bound_dev_if);
739 	if (ret)
740 		goto out;
741 
742 	len = strlen(devname) + 1;
743 
744 	ret = -EFAULT;
745 	if (copy_to_sockptr(optval, devname, len))
746 		goto out;
747 
748 zero:
749 	ret = -EFAULT;
750 	if (copy_to_sockptr(optlen, &len, sizeof(int)))
751 		goto out;
752 
753 	ret = 0;
754 
755 out:
756 #endif
757 
758 	return ret;
759 }
760 
sk_mc_loop(const struct sock * sk)761 bool sk_mc_loop(const struct sock *sk)
762 {
763 	if (dev_recursion_level())
764 		return false;
765 	if (!sk)
766 		return true;
767 	/* IPV6_ADDRFORM can change sk->sk_family under us. */
768 	switch (READ_ONCE(sk->sk_family)) {
769 	case AF_INET:
770 		return inet_test_bit(MC_LOOP, sk);
771 #if IS_ENABLED(CONFIG_IPV6)
772 	case AF_INET6:
773 		return inet6_test_bit(MC6_LOOP, sk);
774 #endif
775 	}
776 	WARN_ON_ONCE(1);
777 	return true;
778 }
779 EXPORT_SYMBOL(sk_mc_loop);
780 
sock_set_reuseaddr(struct sock * sk)781 void sock_set_reuseaddr(struct sock *sk)
782 {
783 	lock_sock(sk);
784 	sk->sk_reuse = SK_CAN_REUSE;
785 	release_sock(sk);
786 }
787 EXPORT_SYMBOL(sock_set_reuseaddr);
788 
sock_set_reuseport(struct sock * sk)789 void sock_set_reuseport(struct sock *sk)
790 {
791 	lock_sock(sk);
792 	sk->sk_reuseport = true;
793 	release_sock(sk);
794 }
795 EXPORT_SYMBOL(sock_set_reuseport);
796 
sock_no_linger(struct sock * sk)797 void sock_no_linger(struct sock *sk)
798 {
799 	lock_sock(sk);
800 	WRITE_ONCE(sk->sk_lingertime, 0);
801 	sock_set_flag(sk, SOCK_LINGER);
802 	release_sock(sk);
803 }
804 EXPORT_SYMBOL(sock_no_linger);
805 
sock_set_priority(struct sock * sk,u32 priority)806 void sock_set_priority(struct sock *sk, u32 priority)
807 {
808 	WRITE_ONCE(sk->sk_priority, priority);
809 }
810 EXPORT_SYMBOL(sock_set_priority);
811 
sock_set_sndtimeo(struct sock * sk,s64 secs)812 void sock_set_sndtimeo(struct sock *sk, s64 secs)
813 {
814 	lock_sock(sk);
815 	if (secs && secs < MAX_SCHEDULE_TIMEOUT / HZ - 1)
816 		WRITE_ONCE(sk->sk_sndtimeo, secs * HZ);
817 	else
818 		WRITE_ONCE(sk->sk_sndtimeo, MAX_SCHEDULE_TIMEOUT);
819 	release_sock(sk);
820 }
821 EXPORT_SYMBOL(sock_set_sndtimeo);
822 
__sock_set_timestamps(struct sock * sk,bool val,bool new,bool ns)823 static void __sock_set_timestamps(struct sock *sk, bool val, bool new, bool ns)
824 {
825 	if (val)  {
826 		sock_valbool_flag(sk, SOCK_TSTAMP_NEW, new);
827 		sock_valbool_flag(sk, SOCK_RCVTSTAMPNS, ns);
828 		sock_set_flag(sk, SOCK_RCVTSTAMP);
829 		sock_enable_timestamp(sk, SOCK_TIMESTAMP);
830 	} else {
831 		sock_reset_flag(sk, SOCK_RCVTSTAMP);
832 		sock_reset_flag(sk, SOCK_RCVTSTAMPNS);
833 	}
834 }
835 
sock_enable_timestamps(struct sock * sk)836 void sock_enable_timestamps(struct sock *sk)
837 {
838 	lock_sock(sk);
839 	__sock_set_timestamps(sk, true, false, true);
840 	release_sock(sk);
841 }
842 EXPORT_SYMBOL(sock_enable_timestamps);
843 
sock_set_timestamp(struct sock * sk,int optname,bool valbool)844 void sock_set_timestamp(struct sock *sk, int optname, bool valbool)
845 {
846 	switch (optname) {
847 	case SO_TIMESTAMP_OLD:
848 		__sock_set_timestamps(sk, valbool, false, false);
849 		break;
850 	case SO_TIMESTAMP_NEW:
851 		__sock_set_timestamps(sk, valbool, true, false);
852 		break;
853 	case SO_TIMESTAMPNS_OLD:
854 		__sock_set_timestamps(sk, valbool, false, true);
855 		break;
856 	case SO_TIMESTAMPNS_NEW:
857 		__sock_set_timestamps(sk, valbool, true, true);
858 		break;
859 	}
860 }
861 
sock_timestamping_bind_phc(struct sock * sk,int phc_index)862 static int sock_timestamping_bind_phc(struct sock *sk, int phc_index)
863 {
864 	struct net *net = sock_net(sk);
865 	struct net_device *dev = NULL;
866 	bool match = false;
867 	int *vclock_index;
868 	int i, num;
869 
870 	if (sk->sk_bound_dev_if)
871 		dev = dev_get_by_index(net, sk->sk_bound_dev_if);
872 
873 	if (!dev) {
874 		pr_err("%s: sock not bind to device\n", __func__);
875 		return -EOPNOTSUPP;
876 	}
877 
878 	num = ethtool_get_phc_vclocks(dev, &vclock_index);
879 	dev_put(dev);
880 
881 	for (i = 0; i < num; i++) {
882 		if (*(vclock_index + i) == phc_index) {
883 			match = true;
884 			break;
885 		}
886 	}
887 
888 	if (num > 0)
889 		kfree(vclock_index);
890 
891 	if (!match)
892 		return -EINVAL;
893 
894 	WRITE_ONCE(sk->sk_bind_phc, phc_index);
895 
896 	return 0;
897 }
898 
sock_set_timestamping(struct sock * sk,int optname,struct so_timestamping timestamping)899 int sock_set_timestamping(struct sock *sk, int optname,
900 			  struct so_timestamping timestamping)
901 {
902 	int val = timestamping.flags;
903 	int ret;
904 
905 	if (val & ~SOF_TIMESTAMPING_MASK)
906 		return -EINVAL;
907 
908 	if (val & SOF_TIMESTAMPING_OPT_ID_TCP &&
909 	    !(val & SOF_TIMESTAMPING_OPT_ID))
910 		return -EINVAL;
911 
912 	if (val & SOF_TIMESTAMPING_OPT_ID &&
913 	    !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
914 		if (sk_is_tcp(sk)) {
915 			if ((1 << sk->sk_state) &
916 			    (TCPF_CLOSE | TCPF_LISTEN))
917 				return -EINVAL;
918 			if (val & SOF_TIMESTAMPING_OPT_ID_TCP)
919 				atomic_set(&sk->sk_tskey, tcp_sk(sk)->write_seq);
920 			else
921 				atomic_set(&sk->sk_tskey, tcp_sk(sk)->snd_una);
922 		} else {
923 			atomic_set(&sk->sk_tskey, 0);
924 		}
925 	}
926 
927 	if (val & SOF_TIMESTAMPING_OPT_STATS &&
928 	    !(val & SOF_TIMESTAMPING_OPT_TSONLY))
929 		return -EINVAL;
930 
931 	if (val & SOF_TIMESTAMPING_BIND_PHC) {
932 		ret = sock_timestamping_bind_phc(sk, timestamping.bind_phc);
933 		if (ret)
934 			return ret;
935 	}
936 
937 	WRITE_ONCE(sk->sk_tsflags, val);
938 	sock_valbool_flag(sk, SOCK_TSTAMP_NEW, optname == SO_TIMESTAMPING_NEW);
939 
940 	if (val & SOF_TIMESTAMPING_RX_SOFTWARE)
941 		sock_enable_timestamp(sk,
942 				      SOCK_TIMESTAMPING_RX_SOFTWARE);
943 	else
944 		sock_disable_timestamp(sk,
945 				       (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE));
946 	return 0;
947 }
948 
sock_set_keepalive(struct sock * sk)949 void sock_set_keepalive(struct sock *sk)
950 {
951 	lock_sock(sk);
952 	if (sk->sk_prot->keepalive)
953 		sk->sk_prot->keepalive(sk, true);
954 	sock_valbool_flag(sk, SOCK_KEEPOPEN, true);
955 	release_sock(sk);
956 }
957 EXPORT_SYMBOL(sock_set_keepalive);
958 
__sock_set_rcvbuf(struct sock * sk,int val)959 static void __sock_set_rcvbuf(struct sock *sk, int val)
960 {
961 	/* Ensure val * 2 fits into an int, to prevent max_t() from treating it
962 	 * as a negative value.
963 	 */
964 	val = min_t(int, val, INT_MAX / 2);
965 	sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
966 
967 	/* We double it on the way in to account for "struct sk_buff" etc.
968 	 * overhead.   Applications assume that the SO_RCVBUF setting they make
969 	 * will allow that much actual data to be received on that socket.
970 	 *
971 	 * Applications are unaware that "struct sk_buff" and other overheads
972 	 * allocate from the receive buffer during socket buffer allocation.
973 	 *
974 	 * And after considering the possible alternatives, returning the value
975 	 * we actually used in getsockopt is the most desirable behavior.
976 	 */
977 	WRITE_ONCE(sk->sk_rcvbuf, max_t(int, val * 2, SOCK_MIN_RCVBUF));
978 }
979 
sock_set_rcvbuf(struct sock * sk,int val)980 void sock_set_rcvbuf(struct sock *sk, int val)
981 {
982 	lock_sock(sk);
983 	__sock_set_rcvbuf(sk, val);
984 	release_sock(sk);
985 }
986 EXPORT_SYMBOL(sock_set_rcvbuf);
987 
__sock_set_mark(struct sock * sk,u32 val)988 static void __sock_set_mark(struct sock *sk, u32 val)
989 {
990 	if (val != sk->sk_mark) {
991 		WRITE_ONCE(sk->sk_mark, val);
992 		sk_dst_reset(sk);
993 	}
994 }
995 
sock_set_mark(struct sock * sk,u32 val)996 void sock_set_mark(struct sock *sk, u32 val)
997 {
998 	lock_sock(sk);
999 	__sock_set_mark(sk, val);
1000 	release_sock(sk);
1001 }
1002 EXPORT_SYMBOL(sock_set_mark);
1003 
sock_release_reserved_memory(struct sock * sk,int bytes)1004 static void sock_release_reserved_memory(struct sock *sk, int bytes)
1005 {
1006 	/* Round down bytes to multiple of pages */
1007 	bytes = round_down(bytes, PAGE_SIZE);
1008 
1009 	WARN_ON(bytes > sk->sk_reserved_mem);
1010 	WRITE_ONCE(sk->sk_reserved_mem, sk->sk_reserved_mem - bytes);
1011 	sk_mem_reclaim(sk);
1012 }
1013 
sock_reserve_memory(struct sock * sk,int bytes)1014 static int sock_reserve_memory(struct sock *sk, int bytes)
1015 {
1016 	long allocated;
1017 	bool charged;
1018 	int pages;
1019 
1020 	if (!mem_cgroup_sockets_enabled || !sk->sk_memcg || !sk_has_account(sk))
1021 		return -EOPNOTSUPP;
1022 
1023 	if (!bytes)
1024 		return 0;
1025 
1026 	pages = sk_mem_pages(bytes);
1027 
1028 	/* pre-charge to memcg */
1029 	charged = mem_cgroup_charge_skmem(sk->sk_memcg, pages,
1030 					  GFP_KERNEL | __GFP_RETRY_MAYFAIL);
1031 	if (!charged)
1032 		return -ENOMEM;
1033 
1034 	/* pre-charge to forward_alloc */
1035 	sk_memory_allocated_add(sk, pages);
1036 	allocated = sk_memory_allocated(sk);
1037 	/* If the system goes into memory pressure with this
1038 	 * precharge, give up and return error.
1039 	 */
1040 	if (allocated > sk_prot_mem_limits(sk, 1)) {
1041 		sk_memory_allocated_sub(sk, pages);
1042 		mem_cgroup_uncharge_skmem(sk->sk_memcg, pages);
1043 		return -ENOMEM;
1044 	}
1045 	sk_forward_alloc_add(sk, pages << PAGE_SHIFT);
1046 
1047 	WRITE_ONCE(sk->sk_reserved_mem,
1048 		   sk->sk_reserved_mem + (pages << PAGE_SHIFT));
1049 
1050 	return 0;
1051 }
1052 
1053 #ifdef CONFIG_PAGE_POOL
1054 
1055 /* This is the number of tokens that the user can SO_DEVMEM_DONTNEED in
1056  * 1 syscall. The limit exists to limit the amount of memory the kernel
1057  * allocates to copy these tokens.
1058  */
1059 #define MAX_DONTNEED_TOKENS 128
1060 
1061 static noinline_for_stack int
sock_devmem_dontneed(struct sock * sk,sockptr_t optval,unsigned int optlen)1062 sock_devmem_dontneed(struct sock *sk, sockptr_t optval, unsigned int optlen)
1063 {
1064 	unsigned int num_tokens, i, j, k, netmem_num = 0;
1065 	struct dmabuf_token *tokens;
1066 	netmem_ref netmems[16];
1067 	int ret = 0;
1068 
1069 	if (!sk_is_tcp(sk))
1070 		return -EBADF;
1071 
1072 	if (optlen % sizeof(struct dmabuf_token) ||
1073 	    optlen > sizeof(*tokens) * MAX_DONTNEED_TOKENS)
1074 		return -EINVAL;
1075 
1076 	tokens = kvmalloc_array(optlen, sizeof(*tokens), GFP_KERNEL);
1077 	if (!tokens)
1078 		return -ENOMEM;
1079 
1080 	num_tokens = optlen / sizeof(struct dmabuf_token);
1081 	if (copy_from_sockptr(tokens, optval, optlen)) {
1082 		kvfree(tokens);
1083 		return -EFAULT;
1084 	}
1085 
1086 	xa_lock_bh(&sk->sk_user_frags);
1087 	for (i = 0; i < num_tokens; i++) {
1088 		for (j = 0; j < tokens[i].token_count; j++) {
1089 			netmem_ref netmem = (__force netmem_ref)__xa_erase(
1090 				&sk->sk_user_frags, tokens[i].token_start + j);
1091 
1092 			if (netmem &&
1093 			    !WARN_ON_ONCE(!netmem_is_net_iov(netmem))) {
1094 				netmems[netmem_num++] = netmem;
1095 				if (netmem_num == ARRAY_SIZE(netmems)) {
1096 					xa_unlock_bh(&sk->sk_user_frags);
1097 					for (k = 0; k < netmem_num; k++)
1098 						WARN_ON_ONCE(!napi_pp_put_page(netmems[k]));
1099 					netmem_num = 0;
1100 					xa_lock_bh(&sk->sk_user_frags);
1101 				}
1102 				ret++;
1103 			}
1104 		}
1105 	}
1106 
1107 	xa_unlock_bh(&sk->sk_user_frags);
1108 	for (k = 0; k < netmem_num; k++)
1109 		WARN_ON_ONCE(!napi_pp_put_page(netmems[k]));
1110 
1111 	kvfree(tokens);
1112 	return ret;
1113 }
1114 #endif
1115 
sockopt_lock_sock(struct sock * sk)1116 void sockopt_lock_sock(struct sock *sk)
1117 {
1118 	/* When current->bpf_ctx is set, the setsockopt is called from
1119 	 * a bpf prog.  bpf has ensured the sk lock has been
1120 	 * acquired before calling setsockopt().
1121 	 */
1122 	if (has_current_bpf_ctx())
1123 		return;
1124 
1125 	lock_sock(sk);
1126 }
1127 EXPORT_SYMBOL(sockopt_lock_sock);
1128 
sockopt_release_sock(struct sock * sk)1129 void sockopt_release_sock(struct sock *sk)
1130 {
1131 	if (has_current_bpf_ctx())
1132 		return;
1133 
1134 	release_sock(sk);
1135 }
1136 EXPORT_SYMBOL(sockopt_release_sock);
1137 
sockopt_ns_capable(struct user_namespace * ns,int cap)1138 bool sockopt_ns_capable(struct user_namespace *ns, int cap)
1139 {
1140 	return has_current_bpf_ctx() || ns_capable(ns, cap);
1141 }
1142 EXPORT_SYMBOL(sockopt_ns_capable);
1143 
sockopt_capable(int cap)1144 bool sockopt_capable(int cap)
1145 {
1146 	return has_current_bpf_ctx() || capable(cap);
1147 }
1148 EXPORT_SYMBOL(sockopt_capable);
1149 
sockopt_validate_clockid(__kernel_clockid_t value)1150 static int sockopt_validate_clockid(__kernel_clockid_t value)
1151 {
1152 	switch (value) {
1153 	case CLOCK_REALTIME:
1154 	case CLOCK_MONOTONIC:
1155 	case CLOCK_TAI:
1156 		return 0;
1157 	}
1158 	return -EINVAL;
1159 }
1160 
1161 /*
1162  *	This is meant for all protocols to use and covers goings on
1163  *	at the socket level. Everything here is generic.
1164  */
1165 
sk_setsockopt(struct sock * sk,int level,int optname,sockptr_t optval,unsigned int optlen)1166 int sk_setsockopt(struct sock *sk, int level, int optname,
1167 		  sockptr_t optval, unsigned int optlen)
1168 {
1169 	struct so_timestamping timestamping;
1170 	struct socket *sock = sk->sk_socket;
1171 	struct sock_txtime sk_txtime;
1172 	int val;
1173 	int valbool;
1174 	struct linger ling;
1175 	int ret = 0;
1176 
1177 	/*
1178 	 *	Options without arguments
1179 	 */
1180 
1181 	if (optname == SO_BINDTODEVICE)
1182 		return sock_setbindtodevice(sk, optval, optlen);
1183 
1184 	if (optlen < sizeof(int))
1185 		return -EINVAL;
1186 
1187 	if (copy_from_sockptr(&val, optval, sizeof(val)))
1188 		return -EFAULT;
1189 
1190 	valbool = val ? 1 : 0;
1191 
1192 	/* handle options which do not require locking the socket. */
1193 	switch (optname) {
1194 	case SO_PRIORITY:
1195 		if ((val >= 0 && val <= 6) ||
1196 		    sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) ||
1197 		    sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
1198 			sock_set_priority(sk, val);
1199 			return 0;
1200 		}
1201 		return -EPERM;
1202 	case SO_PASSSEC:
1203 		assign_bit(SOCK_PASSSEC, &sock->flags, valbool);
1204 		return 0;
1205 	case SO_PASSCRED:
1206 		assign_bit(SOCK_PASSCRED, &sock->flags, valbool);
1207 		return 0;
1208 	case SO_PASSPIDFD:
1209 		assign_bit(SOCK_PASSPIDFD, &sock->flags, valbool);
1210 		return 0;
1211 	case SO_TYPE:
1212 	case SO_PROTOCOL:
1213 	case SO_DOMAIN:
1214 	case SO_ERROR:
1215 		return -ENOPROTOOPT;
1216 #ifdef CONFIG_NET_RX_BUSY_POLL
1217 	case SO_BUSY_POLL:
1218 		if (val < 0)
1219 			return -EINVAL;
1220 		WRITE_ONCE(sk->sk_ll_usec, val);
1221 		return 0;
1222 	case SO_PREFER_BUSY_POLL:
1223 		if (valbool && !sockopt_capable(CAP_NET_ADMIN))
1224 			return -EPERM;
1225 		WRITE_ONCE(sk->sk_prefer_busy_poll, valbool);
1226 		return 0;
1227 	case SO_BUSY_POLL_BUDGET:
1228 		if (val > READ_ONCE(sk->sk_busy_poll_budget) &&
1229 		    !sockopt_capable(CAP_NET_ADMIN))
1230 			return -EPERM;
1231 		if (val < 0 || val > U16_MAX)
1232 			return -EINVAL;
1233 		WRITE_ONCE(sk->sk_busy_poll_budget, val);
1234 		return 0;
1235 #endif
1236 	case SO_MAX_PACING_RATE:
1237 		{
1238 		unsigned long ulval = (val == ~0U) ? ~0UL : (unsigned int)val;
1239 		unsigned long pacing_rate;
1240 
1241 		if (sizeof(ulval) != sizeof(val) &&
1242 		    optlen >= sizeof(ulval) &&
1243 		    copy_from_sockptr(&ulval, optval, sizeof(ulval))) {
1244 			return -EFAULT;
1245 		}
1246 		if (ulval != ~0UL)
1247 			cmpxchg(&sk->sk_pacing_status,
1248 				SK_PACING_NONE,
1249 				SK_PACING_NEEDED);
1250 		/* Pairs with READ_ONCE() from sk_getsockopt() */
1251 		WRITE_ONCE(sk->sk_max_pacing_rate, ulval);
1252 		pacing_rate = READ_ONCE(sk->sk_pacing_rate);
1253 		if (ulval < pacing_rate)
1254 			WRITE_ONCE(sk->sk_pacing_rate, ulval);
1255 		return 0;
1256 		}
1257 	case SO_TXREHASH:
1258 		if (val < -1 || val > 1)
1259 			return -EINVAL;
1260 		if ((u8)val == SOCK_TXREHASH_DEFAULT)
1261 			val = READ_ONCE(sock_net(sk)->core.sysctl_txrehash);
1262 		/* Paired with READ_ONCE() in tcp_rtx_synack()
1263 		 * and sk_getsockopt().
1264 		 */
1265 		WRITE_ONCE(sk->sk_txrehash, (u8)val);
1266 		return 0;
1267 	case SO_PEEK_OFF:
1268 		{
1269 		int (*set_peek_off)(struct sock *sk, int val);
1270 
1271 		set_peek_off = READ_ONCE(sock->ops)->set_peek_off;
1272 		if (set_peek_off)
1273 			ret = set_peek_off(sk, val);
1274 		else
1275 			ret = -EOPNOTSUPP;
1276 		return ret;
1277 		}
1278 #ifdef CONFIG_PAGE_POOL
1279 	case SO_DEVMEM_DONTNEED:
1280 		return sock_devmem_dontneed(sk, optval, optlen);
1281 #endif
1282 	}
1283 
1284 	sockopt_lock_sock(sk);
1285 
1286 	switch (optname) {
1287 	case SO_DEBUG:
1288 		if (val && !sockopt_capable(CAP_NET_ADMIN))
1289 			ret = -EACCES;
1290 		else
1291 			sock_valbool_flag(sk, SOCK_DBG, valbool);
1292 		break;
1293 	case SO_REUSEADDR:
1294 		sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
1295 		break;
1296 	case SO_REUSEPORT:
1297 		sk->sk_reuseport = valbool;
1298 		break;
1299 	case SO_DONTROUTE:
1300 		sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);
1301 		sk_dst_reset(sk);
1302 		break;
1303 	case SO_BROADCAST:
1304 		sock_valbool_flag(sk, SOCK_BROADCAST, valbool);
1305 		break;
1306 	case SO_SNDBUF:
1307 		/* Don't error on this BSD doesn't and if you think
1308 		 * about it this is right. Otherwise apps have to
1309 		 * play 'guess the biggest size' games. RCVBUF/SNDBUF
1310 		 * are treated in BSD as hints
1311 		 */
1312 		val = min_t(u32, val, READ_ONCE(sysctl_wmem_max));
1313 set_sndbuf:
1314 		/* Ensure val * 2 fits into an int, to prevent max_t()
1315 		 * from treating it as a negative value.
1316 		 */
1317 		val = min_t(int, val, INT_MAX / 2);
1318 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
1319 		WRITE_ONCE(sk->sk_sndbuf,
1320 			   max_t(int, val * 2, SOCK_MIN_SNDBUF));
1321 		/* Wake up sending tasks if we upped the value. */
1322 		sk->sk_write_space(sk);
1323 		break;
1324 
1325 	case SO_SNDBUFFORCE:
1326 		if (!sockopt_capable(CAP_NET_ADMIN)) {
1327 			ret = -EPERM;
1328 			break;
1329 		}
1330 
1331 		/* No negative values (to prevent underflow, as val will be
1332 		 * multiplied by 2).
1333 		 */
1334 		if (val < 0)
1335 			val = 0;
1336 		goto set_sndbuf;
1337 
1338 	case SO_RCVBUF:
1339 		/* Don't error on this BSD doesn't and if you think
1340 		 * about it this is right. Otherwise apps have to
1341 		 * play 'guess the biggest size' games. RCVBUF/SNDBUF
1342 		 * are treated in BSD as hints
1343 		 */
1344 		__sock_set_rcvbuf(sk, min_t(u32, val, READ_ONCE(sysctl_rmem_max)));
1345 		break;
1346 
1347 	case SO_RCVBUFFORCE:
1348 		if (!sockopt_capable(CAP_NET_ADMIN)) {
1349 			ret = -EPERM;
1350 			break;
1351 		}
1352 
1353 		/* No negative values (to prevent underflow, as val will be
1354 		 * multiplied by 2).
1355 		 */
1356 		__sock_set_rcvbuf(sk, max(val, 0));
1357 		break;
1358 
1359 	case SO_KEEPALIVE:
1360 		if (sk->sk_prot->keepalive)
1361 			sk->sk_prot->keepalive(sk, valbool);
1362 		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
1363 		break;
1364 
1365 	case SO_OOBINLINE:
1366 		sock_valbool_flag(sk, SOCK_URGINLINE, valbool);
1367 		break;
1368 
1369 	case SO_NO_CHECK:
1370 		sk->sk_no_check_tx = valbool;
1371 		break;
1372 
1373 	case SO_LINGER:
1374 		if (optlen < sizeof(ling)) {
1375 			ret = -EINVAL;	/* 1003.1g */
1376 			break;
1377 		}
1378 		if (copy_from_sockptr(&ling, optval, sizeof(ling))) {
1379 			ret = -EFAULT;
1380 			break;
1381 		}
1382 		if (!ling.l_onoff) {
1383 			sock_reset_flag(sk, SOCK_LINGER);
1384 		} else {
1385 			unsigned long t_sec = ling.l_linger;
1386 
1387 			if (t_sec >= MAX_SCHEDULE_TIMEOUT / HZ)
1388 				WRITE_ONCE(sk->sk_lingertime, MAX_SCHEDULE_TIMEOUT);
1389 			else
1390 				WRITE_ONCE(sk->sk_lingertime, t_sec * HZ);
1391 			sock_set_flag(sk, SOCK_LINGER);
1392 		}
1393 		break;
1394 
1395 	case SO_BSDCOMPAT:
1396 		break;
1397 
1398 	case SO_TIMESTAMP_OLD:
1399 	case SO_TIMESTAMP_NEW:
1400 	case SO_TIMESTAMPNS_OLD:
1401 	case SO_TIMESTAMPNS_NEW:
1402 		sock_set_timestamp(sk, optname, valbool);
1403 		break;
1404 
1405 	case SO_TIMESTAMPING_NEW:
1406 	case SO_TIMESTAMPING_OLD:
1407 		if (optlen == sizeof(timestamping)) {
1408 			if (copy_from_sockptr(&timestamping, optval,
1409 					      sizeof(timestamping))) {
1410 				ret = -EFAULT;
1411 				break;
1412 			}
1413 		} else {
1414 			memset(&timestamping, 0, sizeof(timestamping));
1415 			timestamping.flags = val;
1416 		}
1417 		ret = sock_set_timestamping(sk, optname, timestamping);
1418 		break;
1419 
1420 	case SO_RCVLOWAT:
1421 		{
1422 		int (*set_rcvlowat)(struct sock *sk, int val) = NULL;
1423 
1424 		if (val < 0)
1425 			val = INT_MAX;
1426 		if (sock)
1427 			set_rcvlowat = READ_ONCE(sock->ops)->set_rcvlowat;
1428 		if (set_rcvlowat)
1429 			ret = set_rcvlowat(sk, val);
1430 		else
1431 			WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
1432 		break;
1433 		}
1434 	case SO_RCVTIMEO_OLD:
1435 	case SO_RCVTIMEO_NEW:
1436 		ret = sock_set_timeout(&sk->sk_rcvtimeo, optval,
1437 				       optlen, optname == SO_RCVTIMEO_OLD);
1438 		break;
1439 
1440 	case SO_SNDTIMEO_OLD:
1441 	case SO_SNDTIMEO_NEW:
1442 		ret = sock_set_timeout(&sk->sk_sndtimeo, optval,
1443 				       optlen, optname == SO_SNDTIMEO_OLD);
1444 		break;
1445 
1446 	case SO_ATTACH_FILTER: {
1447 		struct sock_fprog fprog;
1448 
1449 		ret = copy_bpf_fprog_from_user(&fprog, optval, optlen);
1450 		if (!ret)
1451 			ret = sk_attach_filter(&fprog, sk);
1452 		break;
1453 	}
1454 	case SO_ATTACH_BPF:
1455 		ret = -EINVAL;
1456 		if (optlen == sizeof(u32)) {
1457 			u32 ufd;
1458 
1459 			ret = -EFAULT;
1460 			if (copy_from_sockptr(&ufd, optval, sizeof(ufd)))
1461 				break;
1462 
1463 			ret = sk_attach_bpf(ufd, sk);
1464 		}
1465 		break;
1466 
1467 	case SO_ATTACH_REUSEPORT_CBPF: {
1468 		struct sock_fprog fprog;
1469 
1470 		ret = copy_bpf_fprog_from_user(&fprog, optval, optlen);
1471 		if (!ret)
1472 			ret = sk_reuseport_attach_filter(&fprog, sk);
1473 		break;
1474 	}
1475 	case SO_ATTACH_REUSEPORT_EBPF:
1476 		ret = -EINVAL;
1477 		if (optlen == sizeof(u32)) {
1478 			u32 ufd;
1479 
1480 			ret = -EFAULT;
1481 			if (copy_from_sockptr(&ufd, optval, sizeof(ufd)))
1482 				break;
1483 
1484 			ret = sk_reuseport_attach_bpf(ufd, sk);
1485 		}
1486 		break;
1487 
1488 	case SO_DETACH_REUSEPORT_BPF:
1489 		ret = reuseport_detach_prog(sk);
1490 		break;
1491 
1492 	case SO_DETACH_FILTER:
1493 		ret = sk_detach_filter(sk);
1494 		break;
1495 
1496 	case SO_LOCK_FILTER:
1497 		if (sock_flag(sk, SOCK_FILTER_LOCKED) && !valbool)
1498 			ret = -EPERM;
1499 		else
1500 			sock_valbool_flag(sk, SOCK_FILTER_LOCKED, valbool);
1501 		break;
1502 
1503 	case SO_MARK:
1504 		if (!sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
1505 		    !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
1506 			ret = -EPERM;
1507 			break;
1508 		}
1509 
1510 		__sock_set_mark(sk, val);
1511 		break;
1512 	case SO_RCVMARK:
1513 		sock_valbool_flag(sk, SOCK_RCVMARK, valbool);
1514 		break;
1515 
1516 	case SO_RXQ_OVFL:
1517 		sock_valbool_flag(sk, SOCK_RXQ_OVFL, valbool);
1518 		break;
1519 
1520 	case SO_WIFI_STATUS:
1521 		sock_valbool_flag(sk, SOCK_WIFI_STATUS, valbool);
1522 		break;
1523 
1524 	case SO_NOFCS:
1525 		sock_valbool_flag(sk, SOCK_NOFCS, valbool);
1526 		break;
1527 
1528 	case SO_SELECT_ERR_QUEUE:
1529 		sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
1530 		break;
1531 
1532 
1533 	case SO_INCOMING_CPU:
1534 		reuseport_update_incoming_cpu(sk, val);
1535 		break;
1536 
1537 	case SO_CNX_ADVICE:
1538 		if (val == 1)
1539 			dst_negative_advice(sk);
1540 		break;
1541 
1542 	case SO_ZEROCOPY:
1543 		if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6) {
1544 			if (!(sk_is_tcp(sk) ||
1545 			      (sk->sk_type == SOCK_DGRAM &&
1546 			       sk->sk_protocol == IPPROTO_UDP)))
1547 				ret = -EOPNOTSUPP;
1548 		} else if (sk->sk_family != PF_RDS) {
1549 			ret = -EOPNOTSUPP;
1550 		}
1551 		if (!ret) {
1552 			if (val < 0 || val > 1)
1553 				ret = -EINVAL;
1554 			else
1555 				sock_valbool_flag(sk, SOCK_ZEROCOPY, valbool);
1556 		}
1557 		break;
1558 
1559 	case SO_TXTIME:
1560 		if (optlen != sizeof(struct sock_txtime)) {
1561 			ret = -EINVAL;
1562 			break;
1563 		} else if (copy_from_sockptr(&sk_txtime, optval,
1564 			   sizeof(struct sock_txtime))) {
1565 			ret = -EFAULT;
1566 			break;
1567 		} else if (sk_txtime.flags & ~SOF_TXTIME_FLAGS_MASK) {
1568 			ret = -EINVAL;
1569 			break;
1570 		}
1571 		/* CLOCK_MONOTONIC is only used by sch_fq, and this packet
1572 		 * scheduler has enough safe guards.
1573 		 */
1574 		if (sk_txtime.clockid != CLOCK_MONOTONIC &&
1575 		    !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
1576 			ret = -EPERM;
1577 			break;
1578 		}
1579 
1580 		ret = sockopt_validate_clockid(sk_txtime.clockid);
1581 		if (ret)
1582 			break;
1583 
1584 		sock_valbool_flag(sk, SOCK_TXTIME, true);
1585 		sk->sk_clockid = sk_txtime.clockid;
1586 		sk->sk_txtime_deadline_mode =
1587 			!!(sk_txtime.flags & SOF_TXTIME_DEADLINE_MODE);
1588 		sk->sk_txtime_report_errors =
1589 			!!(sk_txtime.flags & SOF_TXTIME_REPORT_ERRORS);
1590 		break;
1591 
1592 	case SO_BINDTOIFINDEX:
1593 		ret = sock_bindtoindex_locked(sk, val);
1594 		break;
1595 
1596 	case SO_BUF_LOCK:
1597 		if (val & ~SOCK_BUF_LOCK_MASK) {
1598 			ret = -EINVAL;
1599 			break;
1600 		}
1601 		sk->sk_userlocks = val | (sk->sk_userlocks &
1602 					  ~SOCK_BUF_LOCK_MASK);
1603 		break;
1604 
1605 	case SO_RESERVE_MEM:
1606 	{
1607 		int delta;
1608 
1609 		if (val < 0) {
1610 			ret = -EINVAL;
1611 			break;
1612 		}
1613 
1614 		delta = val - sk->sk_reserved_mem;
1615 		if (delta < 0)
1616 			sock_release_reserved_memory(sk, -delta);
1617 		else
1618 			ret = sock_reserve_memory(sk, delta);
1619 		break;
1620 	}
1621 
1622 	default:
1623 		ret = -ENOPROTOOPT;
1624 		break;
1625 	}
1626 	sockopt_release_sock(sk);
1627 	return ret;
1628 }
1629 
sock_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)1630 int sock_setsockopt(struct socket *sock, int level, int optname,
1631 		    sockptr_t optval, unsigned int optlen)
1632 {
1633 	return sk_setsockopt(sock->sk, level, optname,
1634 			     optval, optlen);
1635 }
1636 EXPORT_SYMBOL(sock_setsockopt);
1637 
sk_get_peer_cred(struct sock * sk)1638 static const struct cred *sk_get_peer_cred(struct sock *sk)
1639 {
1640 	const struct cred *cred;
1641 
1642 	spin_lock(&sk->sk_peer_lock);
1643 	cred = get_cred(sk->sk_peer_cred);
1644 	spin_unlock(&sk->sk_peer_lock);
1645 
1646 	return cred;
1647 }
1648 
cred_to_ucred(struct pid * pid,const struct cred * cred,struct ucred * ucred)1649 static void cred_to_ucred(struct pid *pid, const struct cred *cred,
1650 			  struct ucred *ucred)
1651 {
1652 	ucred->pid = pid_vnr(pid);
1653 	ucred->uid = ucred->gid = -1;
1654 	if (cred) {
1655 		struct user_namespace *current_ns = current_user_ns();
1656 
1657 		ucred->uid = from_kuid_munged(current_ns, cred->euid);
1658 		ucred->gid = from_kgid_munged(current_ns, cred->egid);
1659 	}
1660 }
1661 
groups_to_user(sockptr_t dst,const struct group_info * src)1662 static int groups_to_user(sockptr_t dst, const struct group_info *src)
1663 {
1664 	struct user_namespace *user_ns = current_user_ns();
1665 	int i;
1666 
1667 	for (i = 0; i < src->ngroups; i++) {
1668 		gid_t gid = from_kgid_munged(user_ns, src->gid[i]);
1669 
1670 		if (copy_to_sockptr_offset(dst, i * sizeof(gid), &gid, sizeof(gid)))
1671 			return -EFAULT;
1672 	}
1673 
1674 	return 0;
1675 }
1676 
sk_getsockopt(struct sock * sk,int level,int optname,sockptr_t optval,sockptr_t optlen)1677 int sk_getsockopt(struct sock *sk, int level, int optname,
1678 		  sockptr_t optval, sockptr_t optlen)
1679 {
1680 	struct socket *sock = sk->sk_socket;
1681 
1682 	union {
1683 		int val;
1684 		u64 val64;
1685 		unsigned long ulval;
1686 		struct linger ling;
1687 		struct old_timeval32 tm32;
1688 		struct __kernel_old_timeval tm;
1689 		struct  __kernel_sock_timeval stm;
1690 		struct sock_txtime txtime;
1691 		struct so_timestamping timestamping;
1692 	} v;
1693 
1694 	int lv = sizeof(int);
1695 	int len;
1696 
1697 	if (copy_from_sockptr(&len, optlen, sizeof(int)))
1698 		return -EFAULT;
1699 	if (len < 0)
1700 		return -EINVAL;
1701 
1702 	memset(&v, 0, sizeof(v));
1703 
1704 	switch (optname) {
1705 	case SO_DEBUG:
1706 		v.val = sock_flag(sk, SOCK_DBG);
1707 		break;
1708 
1709 	case SO_DONTROUTE:
1710 		v.val = sock_flag(sk, SOCK_LOCALROUTE);
1711 		break;
1712 
1713 	case SO_BROADCAST:
1714 		v.val = sock_flag(sk, SOCK_BROADCAST);
1715 		break;
1716 
1717 	case SO_SNDBUF:
1718 		v.val = READ_ONCE(sk->sk_sndbuf);
1719 		break;
1720 
1721 	case SO_RCVBUF:
1722 		v.val = READ_ONCE(sk->sk_rcvbuf);
1723 		break;
1724 
1725 	case SO_REUSEADDR:
1726 		v.val = sk->sk_reuse;
1727 		break;
1728 
1729 	case SO_REUSEPORT:
1730 		v.val = sk->sk_reuseport;
1731 		break;
1732 
1733 	case SO_KEEPALIVE:
1734 		v.val = sock_flag(sk, SOCK_KEEPOPEN);
1735 		break;
1736 
1737 	case SO_TYPE:
1738 		v.val = sk->sk_type;
1739 		break;
1740 
1741 	case SO_PROTOCOL:
1742 		v.val = sk->sk_protocol;
1743 		break;
1744 
1745 	case SO_DOMAIN:
1746 		v.val = sk->sk_family;
1747 		break;
1748 
1749 	case SO_ERROR:
1750 		v.val = -sock_error(sk);
1751 		if (v.val == 0)
1752 			v.val = xchg(&sk->sk_err_soft, 0);
1753 		break;
1754 
1755 	case SO_OOBINLINE:
1756 		v.val = sock_flag(sk, SOCK_URGINLINE);
1757 		break;
1758 
1759 	case SO_NO_CHECK:
1760 		v.val = sk->sk_no_check_tx;
1761 		break;
1762 
1763 	case SO_PRIORITY:
1764 		v.val = READ_ONCE(sk->sk_priority);
1765 		break;
1766 
1767 	case SO_LINGER:
1768 		lv		= sizeof(v.ling);
1769 		v.ling.l_onoff	= sock_flag(sk, SOCK_LINGER);
1770 		v.ling.l_linger	= READ_ONCE(sk->sk_lingertime) / HZ;
1771 		break;
1772 
1773 	case SO_BSDCOMPAT:
1774 		break;
1775 
1776 	case SO_TIMESTAMP_OLD:
1777 		v.val = sock_flag(sk, SOCK_RCVTSTAMP) &&
1778 				!sock_flag(sk, SOCK_TSTAMP_NEW) &&
1779 				!sock_flag(sk, SOCK_RCVTSTAMPNS);
1780 		break;
1781 
1782 	case SO_TIMESTAMPNS_OLD:
1783 		v.val = sock_flag(sk, SOCK_RCVTSTAMPNS) && !sock_flag(sk, SOCK_TSTAMP_NEW);
1784 		break;
1785 
1786 	case SO_TIMESTAMP_NEW:
1787 		v.val = sock_flag(sk, SOCK_RCVTSTAMP) && sock_flag(sk, SOCK_TSTAMP_NEW);
1788 		break;
1789 
1790 	case SO_TIMESTAMPNS_NEW:
1791 		v.val = sock_flag(sk, SOCK_RCVTSTAMPNS) && sock_flag(sk, SOCK_TSTAMP_NEW);
1792 		break;
1793 
1794 	case SO_TIMESTAMPING_OLD:
1795 	case SO_TIMESTAMPING_NEW:
1796 		lv = sizeof(v.timestamping);
1797 		/* For the later-added case SO_TIMESTAMPING_NEW: Be strict about only
1798 		 * returning the flags when they were set through the same option.
1799 		 * Don't change the beviour for the old case SO_TIMESTAMPING_OLD.
1800 		 */
1801 		if (optname == SO_TIMESTAMPING_OLD || sock_flag(sk, SOCK_TSTAMP_NEW)) {
1802 			v.timestamping.flags = READ_ONCE(sk->sk_tsflags);
1803 			v.timestamping.bind_phc = READ_ONCE(sk->sk_bind_phc);
1804 		}
1805 		break;
1806 
1807 	case SO_RCVTIMEO_OLD:
1808 	case SO_RCVTIMEO_NEW:
1809 		lv = sock_get_timeout(READ_ONCE(sk->sk_rcvtimeo), &v,
1810 				      SO_RCVTIMEO_OLD == optname);
1811 		break;
1812 
1813 	case SO_SNDTIMEO_OLD:
1814 	case SO_SNDTIMEO_NEW:
1815 		lv = sock_get_timeout(READ_ONCE(sk->sk_sndtimeo), &v,
1816 				      SO_SNDTIMEO_OLD == optname);
1817 		break;
1818 
1819 	case SO_RCVLOWAT:
1820 		v.val = READ_ONCE(sk->sk_rcvlowat);
1821 		break;
1822 
1823 	case SO_SNDLOWAT:
1824 		v.val = 1;
1825 		break;
1826 
1827 	case SO_PASSCRED:
1828 		v.val = !!test_bit(SOCK_PASSCRED, &sock->flags);
1829 		break;
1830 
1831 	case SO_PASSPIDFD:
1832 		v.val = !!test_bit(SOCK_PASSPIDFD, &sock->flags);
1833 		break;
1834 
1835 	case SO_PEERCRED:
1836 	{
1837 		struct ucred peercred;
1838 		if (len > sizeof(peercred))
1839 			len = sizeof(peercred);
1840 
1841 		spin_lock(&sk->sk_peer_lock);
1842 		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
1843 		spin_unlock(&sk->sk_peer_lock);
1844 
1845 		if (copy_to_sockptr(optval, &peercred, len))
1846 			return -EFAULT;
1847 		goto lenout;
1848 	}
1849 
1850 	case SO_PEERPIDFD:
1851 	{
1852 		struct pid *peer_pid;
1853 		struct file *pidfd_file = NULL;
1854 		int pidfd;
1855 
1856 		if (len > sizeof(pidfd))
1857 			len = sizeof(pidfd);
1858 
1859 		spin_lock(&sk->sk_peer_lock);
1860 		peer_pid = get_pid(sk->sk_peer_pid);
1861 		spin_unlock(&sk->sk_peer_lock);
1862 
1863 		if (!peer_pid)
1864 			return -ENODATA;
1865 
1866 		pidfd = pidfd_prepare(peer_pid, 0, &pidfd_file);
1867 		put_pid(peer_pid);
1868 		if (pidfd < 0)
1869 			return pidfd;
1870 
1871 		if (copy_to_sockptr(optval, &pidfd, len) ||
1872 		    copy_to_sockptr(optlen, &len, sizeof(int))) {
1873 			put_unused_fd(pidfd);
1874 			fput(pidfd_file);
1875 
1876 			return -EFAULT;
1877 		}
1878 
1879 		fd_install(pidfd, pidfd_file);
1880 		return 0;
1881 	}
1882 
1883 	case SO_PEERGROUPS:
1884 	{
1885 		const struct cred *cred;
1886 		int ret, n;
1887 
1888 		cred = sk_get_peer_cred(sk);
1889 		if (!cred)
1890 			return -ENODATA;
1891 
1892 		n = cred->group_info->ngroups;
1893 		if (len < n * sizeof(gid_t)) {
1894 			len = n * sizeof(gid_t);
1895 			put_cred(cred);
1896 			return copy_to_sockptr(optlen, &len, sizeof(int)) ? -EFAULT : -ERANGE;
1897 		}
1898 		len = n * sizeof(gid_t);
1899 
1900 		ret = groups_to_user(optval, cred->group_info);
1901 		put_cred(cred);
1902 		if (ret)
1903 			return ret;
1904 		goto lenout;
1905 	}
1906 
1907 	case SO_PEERNAME:
1908 	{
1909 		struct sockaddr_storage address;
1910 
1911 		lv = READ_ONCE(sock->ops)->getname(sock, (struct sockaddr *)&address, 2);
1912 		if (lv < 0)
1913 			return -ENOTCONN;
1914 		if (lv < len)
1915 			return -EINVAL;
1916 		if (copy_to_sockptr(optval, &address, len))
1917 			return -EFAULT;
1918 		goto lenout;
1919 	}
1920 
1921 	/* Dubious BSD thing... Probably nobody even uses it, but
1922 	 * the UNIX standard wants it for whatever reason... -DaveM
1923 	 */
1924 	case SO_ACCEPTCONN:
1925 		v.val = sk->sk_state == TCP_LISTEN;
1926 		break;
1927 
1928 	case SO_PASSSEC:
1929 		v.val = !!test_bit(SOCK_PASSSEC, &sock->flags);
1930 		break;
1931 
1932 	case SO_PEERSEC:
1933 		return security_socket_getpeersec_stream(sock,
1934 							 optval, optlen, len);
1935 
1936 	case SO_MARK:
1937 		v.val = READ_ONCE(sk->sk_mark);
1938 		break;
1939 
1940 	case SO_RCVMARK:
1941 		v.val = sock_flag(sk, SOCK_RCVMARK);
1942 		break;
1943 
1944 	case SO_RXQ_OVFL:
1945 		v.val = sock_flag(sk, SOCK_RXQ_OVFL);
1946 		break;
1947 
1948 	case SO_WIFI_STATUS:
1949 		v.val = sock_flag(sk, SOCK_WIFI_STATUS);
1950 		break;
1951 
1952 	case SO_PEEK_OFF:
1953 		if (!READ_ONCE(sock->ops)->set_peek_off)
1954 			return -EOPNOTSUPP;
1955 
1956 		v.val = READ_ONCE(sk->sk_peek_off);
1957 		break;
1958 	case SO_NOFCS:
1959 		v.val = sock_flag(sk, SOCK_NOFCS);
1960 		break;
1961 
1962 	case SO_BINDTODEVICE:
1963 		return sock_getbindtodevice(sk, optval, optlen, len);
1964 
1965 	case SO_GET_FILTER:
1966 		len = sk_get_filter(sk, optval, len);
1967 		if (len < 0)
1968 			return len;
1969 
1970 		goto lenout;
1971 
1972 	case SO_LOCK_FILTER:
1973 		v.val = sock_flag(sk, SOCK_FILTER_LOCKED);
1974 		break;
1975 
1976 	case SO_BPF_EXTENSIONS:
1977 		v.val = bpf_tell_extensions();
1978 		break;
1979 
1980 	case SO_SELECT_ERR_QUEUE:
1981 		v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
1982 		break;
1983 
1984 #ifdef CONFIG_NET_RX_BUSY_POLL
1985 	case SO_BUSY_POLL:
1986 		v.val = READ_ONCE(sk->sk_ll_usec);
1987 		break;
1988 	case SO_PREFER_BUSY_POLL:
1989 		v.val = READ_ONCE(sk->sk_prefer_busy_poll);
1990 		break;
1991 #endif
1992 
1993 	case SO_MAX_PACING_RATE:
1994 		/* The READ_ONCE() pair with the WRITE_ONCE() in sk_setsockopt() */
1995 		if (sizeof(v.ulval) != sizeof(v.val) && len >= sizeof(v.ulval)) {
1996 			lv = sizeof(v.ulval);
1997 			v.ulval = READ_ONCE(sk->sk_max_pacing_rate);
1998 		} else {
1999 			/* 32bit version */
2000 			v.val = min_t(unsigned long, ~0U,
2001 				      READ_ONCE(sk->sk_max_pacing_rate));
2002 		}
2003 		break;
2004 
2005 	case SO_INCOMING_CPU:
2006 		v.val = READ_ONCE(sk->sk_incoming_cpu);
2007 		break;
2008 
2009 	case SO_MEMINFO:
2010 	{
2011 		u32 meminfo[SK_MEMINFO_VARS];
2012 
2013 		sk_get_meminfo(sk, meminfo);
2014 
2015 		len = min_t(unsigned int, len, sizeof(meminfo));
2016 		if (copy_to_sockptr(optval, &meminfo, len))
2017 			return -EFAULT;
2018 
2019 		goto lenout;
2020 	}
2021 
2022 #ifdef CONFIG_NET_RX_BUSY_POLL
2023 	case SO_INCOMING_NAPI_ID:
2024 		v.val = READ_ONCE(sk->sk_napi_id);
2025 
2026 		/* aggregate non-NAPI IDs down to 0 */
2027 		if (v.val < MIN_NAPI_ID)
2028 			v.val = 0;
2029 
2030 		break;
2031 #endif
2032 
2033 	case SO_COOKIE:
2034 		lv = sizeof(u64);
2035 		if (len < lv)
2036 			return -EINVAL;
2037 		v.val64 = sock_gen_cookie(sk);
2038 		break;
2039 
2040 	case SO_ZEROCOPY:
2041 		v.val = sock_flag(sk, SOCK_ZEROCOPY);
2042 		break;
2043 
2044 	case SO_TXTIME:
2045 		lv = sizeof(v.txtime);
2046 		v.txtime.clockid = sk->sk_clockid;
2047 		v.txtime.flags |= sk->sk_txtime_deadline_mode ?
2048 				  SOF_TXTIME_DEADLINE_MODE : 0;
2049 		v.txtime.flags |= sk->sk_txtime_report_errors ?
2050 				  SOF_TXTIME_REPORT_ERRORS : 0;
2051 		break;
2052 
2053 	case SO_BINDTOIFINDEX:
2054 		v.val = READ_ONCE(sk->sk_bound_dev_if);
2055 		break;
2056 
2057 	case SO_NETNS_COOKIE:
2058 		lv = sizeof(u64);
2059 		if (len != lv)
2060 			return -EINVAL;
2061 		v.val64 = sock_net(sk)->net_cookie;
2062 		break;
2063 
2064 	case SO_BUF_LOCK:
2065 		v.val = sk->sk_userlocks & SOCK_BUF_LOCK_MASK;
2066 		break;
2067 
2068 	case SO_RESERVE_MEM:
2069 		v.val = READ_ONCE(sk->sk_reserved_mem);
2070 		break;
2071 
2072 	case SO_TXREHASH:
2073 		/* Paired with WRITE_ONCE() in sk_setsockopt() */
2074 		v.val = READ_ONCE(sk->sk_txrehash);
2075 		break;
2076 
2077 	default:
2078 		/* We implement the SO_SNDLOWAT etc to not be settable
2079 		 * (1003.1g 7).
2080 		 */
2081 		return -ENOPROTOOPT;
2082 	}
2083 
2084 	if (len > lv)
2085 		len = lv;
2086 	if (copy_to_sockptr(optval, &v, len))
2087 		return -EFAULT;
2088 lenout:
2089 	if (copy_to_sockptr(optlen, &len, sizeof(int)))
2090 		return -EFAULT;
2091 	return 0;
2092 }
2093 
2094 /*
2095  * Initialize an sk_lock.
2096  *
2097  * (We also register the sk_lock with the lock validator.)
2098  */
sock_lock_init(struct sock * sk)2099 static inline void sock_lock_init(struct sock *sk)
2100 {
2101 	if (sk->sk_kern_sock)
2102 		sock_lock_init_class_and_name(
2103 			sk,
2104 			af_family_kern_slock_key_strings[sk->sk_family],
2105 			af_family_kern_slock_keys + sk->sk_family,
2106 			af_family_kern_key_strings[sk->sk_family],
2107 			af_family_kern_keys + sk->sk_family);
2108 	else
2109 		sock_lock_init_class_and_name(
2110 			sk,
2111 			af_family_slock_key_strings[sk->sk_family],
2112 			af_family_slock_keys + sk->sk_family,
2113 			af_family_key_strings[sk->sk_family],
2114 			af_family_keys + sk->sk_family);
2115 }
2116 
2117 /*
2118  * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
2119  * even temporarily, because of RCU lookups. sk_node should also be left as is.
2120  * We must not copy fields between sk_dontcopy_begin and sk_dontcopy_end
2121  */
sock_copy(struct sock * nsk,const struct sock * osk)2122 static void sock_copy(struct sock *nsk, const struct sock *osk)
2123 {
2124 	const struct proto *prot = READ_ONCE(osk->sk_prot);
2125 #ifdef CONFIG_SECURITY_NETWORK
2126 	void *sptr = nsk->sk_security;
2127 #endif
2128 
2129 	/* If we move sk_tx_queue_mapping out of the private section,
2130 	 * we must check if sk_tx_queue_clear() is called after
2131 	 * sock_copy() in sk_clone_lock().
2132 	 */
2133 	BUILD_BUG_ON(offsetof(struct sock, sk_tx_queue_mapping) <
2134 		     offsetof(struct sock, sk_dontcopy_begin) ||
2135 		     offsetof(struct sock, sk_tx_queue_mapping) >=
2136 		     offsetof(struct sock, sk_dontcopy_end));
2137 
2138 	memcpy(nsk, osk, offsetof(struct sock, sk_dontcopy_begin));
2139 
2140 	unsafe_memcpy(&nsk->sk_dontcopy_end, &osk->sk_dontcopy_end,
2141 		      prot->obj_size - offsetof(struct sock, sk_dontcopy_end),
2142 		      /* alloc is larger than struct, see sk_prot_alloc() */);
2143 
2144 #ifdef CONFIG_SECURITY_NETWORK
2145 	nsk->sk_security = sptr;
2146 	security_sk_clone(osk, nsk);
2147 #endif
2148 }
2149 
sk_prot_alloc(struct proto * prot,gfp_t priority,int family)2150 static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
2151 		int family)
2152 {
2153 	struct sock *sk;
2154 	struct kmem_cache *slab;
2155 
2156 	slab = prot->slab;
2157 	if (slab != NULL) {
2158 		sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
2159 		if (!sk)
2160 			return sk;
2161 		if (want_init_on_alloc(priority))
2162 			sk_prot_clear_nulls(sk, prot->obj_size);
2163 	} else
2164 		sk = kmalloc(prot->obj_size, priority);
2165 
2166 	if (sk != NULL) {
2167 		if (security_sk_alloc(sk, family, priority))
2168 			goto out_free;
2169 
2170 		if (!try_module_get(prot->owner))
2171 			goto out_free_sec;
2172 	}
2173 
2174 	return sk;
2175 
2176 out_free_sec:
2177 	security_sk_free(sk);
2178 out_free:
2179 	if (slab != NULL)
2180 		kmem_cache_free(slab, sk);
2181 	else
2182 		kfree(sk);
2183 	return NULL;
2184 }
2185 
sk_prot_free(struct proto * prot,struct sock * sk)2186 static void sk_prot_free(struct proto *prot, struct sock *sk)
2187 {
2188 	struct kmem_cache *slab;
2189 	struct module *owner;
2190 
2191 	owner = prot->owner;
2192 	slab = prot->slab;
2193 
2194 	cgroup_sk_free(&sk->sk_cgrp_data);
2195 	mem_cgroup_sk_free(sk);
2196 	security_sk_free(sk);
2197 	if (slab != NULL)
2198 		kmem_cache_free(slab, sk);
2199 	else
2200 		kfree(sk);
2201 	module_put(owner);
2202 }
2203 
2204 /**
2205  *	sk_alloc - All socket objects are allocated here
2206  *	@net: the applicable net namespace
2207  *	@family: protocol family
2208  *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
2209  *	@prot: struct proto associated with this new sock instance
2210  *	@kern: is this to be a kernel socket?
2211  */
sk_alloc(struct net * net,int family,gfp_t priority,struct proto * prot,int kern)2212 struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
2213 		      struct proto *prot, int kern)
2214 {
2215 	struct sock *sk;
2216 
2217 	sk = sk_prot_alloc(prot, priority | __GFP_ZERO, family);
2218 	if (sk) {
2219 		sk->sk_family = family;
2220 		/*
2221 		 * See comment in struct sock definition to understand
2222 		 * why we need sk_prot_creator -acme
2223 		 */
2224 		sk->sk_prot = sk->sk_prot_creator = prot;
2225 		sk->sk_kern_sock = kern;
2226 		sock_lock_init(sk);
2227 		sk->sk_net_refcnt = kern ? 0 : 1;
2228 		if (likely(sk->sk_net_refcnt)) {
2229 			get_net_track(net, &sk->ns_tracker, priority);
2230 			sock_inuse_add(net, 1);
2231 		} else {
2232 			__netns_tracker_alloc(net, &sk->ns_tracker,
2233 					      false, priority);
2234 		}
2235 
2236 		sock_net_set(sk, net);
2237 		refcount_set(&sk->sk_wmem_alloc, 1);
2238 
2239 		mem_cgroup_sk_alloc(sk);
2240 		cgroup_sk_alloc(&sk->sk_cgrp_data);
2241 		sock_update_classid(&sk->sk_cgrp_data);
2242 		sock_update_netprioidx(&sk->sk_cgrp_data);
2243 		sk_tx_queue_clear(sk);
2244 	}
2245 
2246 	return sk;
2247 }
2248 EXPORT_SYMBOL(sk_alloc);
2249 
2250 /* Sockets having SOCK_RCU_FREE will call this function after one RCU
2251  * grace period. This is the case for UDP sockets and TCP listeners.
2252  */
__sk_destruct(struct rcu_head * head)2253 static void __sk_destruct(struct rcu_head *head)
2254 {
2255 	struct sock *sk = container_of(head, struct sock, sk_rcu);
2256 	struct sk_filter *filter;
2257 
2258 	if (sk->sk_destruct)
2259 		sk->sk_destruct(sk);
2260 
2261 	filter = rcu_dereference_check(sk->sk_filter,
2262 				       refcount_read(&sk->sk_wmem_alloc) == 0);
2263 	if (filter) {
2264 		sk_filter_uncharge(sk, filter);
2265 		RCU_INIT_POINTER(sk->sk_filter, NULL);
2266 	}
2267 
2268 	sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
2269 
2270 #ifdef CONFIG_BPF_SYSCALL
2271 	bpf_sk_storage_free(sk);
2272 #endif
2273 
2274 	if (atomic_read(&sk->sk_omem_alloc))
2275 		pr_debug("%s: optmem leakage (%d bytes) detected\n",
2276 			 __func__, atomic_read(&sk->sk_omem_alloc));
2277 
2278 	if (sk->sk_frag.page) {
2279 		put_page(sk->sk_frag.page);
2280 		sk->sk_frag.page = NULL;
2281 	}
2282 
2283 	/* We do not need to acquire sk->sk_peer_lock, we are the last user. */
2284 	put_cred(sk->sk_peer_cred);
2285 	put_pid(sk->sk_peer_pid);
2286 
2287 	if (likely(sk->sk_net_refcnt))
2288 		put_net_track(sock_net(sk), &sk->ns_tracker);
2289 	else
2290 		__netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);
2291 
2292 	sk_prot_free(sk->sk_prot_creator, sk);
2293 }
2294 
sk_destruct(struct sock * sk)2295 void sk_destruct(struct sock *sk)
2296 {
2297 	bool use_call_rcu = sock_flag(sk, SOCK_RCU_FREE);
2298 
2299 	if (rcu_access_pointer(sk->sk_reuseport_cb)) {
2300 		reuseport_detach_sock(sk);
2301 		use_call_rcu = true;
2302 	}
2303 
2304 	if (use_call_rcu)
2305 		call_rcu(&sk->sk_rcu, __sk_destruct);
2306 	else
2307 		__sk_destruct(&sk->sk_rcu);
2308 }
2309 
__sk_free(struct sock * sk)2310 static void __sk_free(struct sock *sk)
2311 {
2312 	if (likely(sk->sk_net_refcnt))
2313 		sock_inuse_add(sock_net(sk), -1);
2314 
2315 	if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk)))
2316 		sock_diag_broadcast_destroy(sk);
2317 	else
2318 		sk_destruct(sk);
2319 }
2320 
sk_free(struct sock * sk)2321 void sk_free(struct sock *sk)
2322 {
2323 	/*
2324 	 * We subtract one from sk_wmem_alloc and can know if
2325 	 * some packets are still in some tx queue.
2326 	 * If not null, sock_wfree() will call __sk_free(sk) later
2327 	 */
2328 	if (refcount_dec_and_test(&sk->sk_wmem_alloc))
2329 		__sk_free(sk);
2330 }
2331 EXPORT_SYMBOL(sk_free);
2332 
sk_init_common(struct sock * sk)2333 static void sk_init_common(struct sock *sk)
2334 {
2335 	skb_queue_head_init(&sk->sk_receive_queue);
2336 	skb_queue_head_init(&sk->sk_write_queue);
2337 	skb_queue_head_init(&sk->sk_error_queue);
2338 
2339 	rwlock_init(&sk->sk_callback_lock);
2340 	lockdep_set_class_and_name(&sk->sk_receive_queue.lock,
2341 			af_rlock_keys + sk->sk_family,
2342 			af_family_rlock_key_strings[sk->sk_family]);
2343 	lockdep_set_class_and_name(&sk->sk_write_queue.lock,
2344 			af_wlock_keys + sk->sk_family,
2345 			af_family_wlock_key_strings[sk->sk_family]);
2346 	lockdep_set_class_and_name(&sk->sk_error_queue.lock,
2347 			af_elock_keys + sk->sk_family,
2348 			af_family_elock_key_strings[sk->sk_family]);
2349 	if (sk->sk_kern_sock)
2350 		lockdep_set_class_and_name(&sk->sk_callback_lock,
2351 			af_kern_callback_keys + sk->sk_family,
2352 			af_family_kern_clock_key_strings[sk->sk_family]);
2353 	else
2354 		lockdep_set_class_and_name(&sk->sk_callback_lock,
2355 			af_callback_keys + sk->sk_family,
2356 			af_family_clock_key_strings[sk->sk_family]);
2357 }
2358 
2359 /**
2360  *	sk_clone_lock - clone a socket, and lock its clone
2361  *	@sk: the socket to clone
2362  *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
2363  *
2364  *	Caller must unlock socket even in error path (bh_unlock_sock(newsk))
2365  */
sk_clone_lock(const struct sock * sk,const gfp_t priority)2366 struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
2367 {
2368 	struct proto *prot = READ_ONCE(sk->sk_prot);
2369 	struct sk_filter *filter;
2370 	bool is_charged = true;
2371 	struct sock *newsk;
2372 
2373 	newsk = sk_prot_alloc(prot, priority, sk->sk_family);
2374 	if (!newsk)
2375 		goto out;
2376 
2377 	sock_copy(newsk, sk);
2378 
2379 	newsk->sk_prot_creator = prot;
2380 
2381 	/* SANITY */
2382 	if (likely(newsk->sk_net_refcnt)) {
2383 		get_net_track(sock_net(newsk), &newsk->ns_tracker, priority);
2384 		sock_inuse_add(sock_net(newsk), 1);
2385 	} else {
2386 		/* Kernel sockets are not elevating the struct net refcount.
2387 		 * Instead, use a tracker to more easily detect if a layer
2388 		 * is not properly dismantling its kernel sockets at netns
2389 		 * destroy time.
2390 		 */
2391 		__netns_tracker_alloc(sock_net(newsk), &newsk->ns_tracker,
2392 				      false, priority);
2393 	}
2394 	sk_node_init(&newsk->sk_node);
2395 	sock_lock_init(newsk);
2396 	bh_lock_sock(newsk);
2397 	newsk->sk_backlog.head	= newsk->sk_backlog.tail = NULL;
2398 	newsk->sk_backlog.len = 0;
2399 
2400 	atomic_set(&newsk->sk_rmem_alloc, 0);
2401 
2402 	/* sk_wmem_alloc set to one (see sk_free() and sock_wfree()) */
2403 	refcount_set(&newsk->sk_wmem_alloc, 1);
2404 
2405 	atomic_set(&newsk->sk_omem_alloc, 0);
2406 	sk_init_common(newsk);
2407 
2408 	newsk->sk_dst_cache	= NULL;
2409 	newsk->sk_dst_pending_confirm = 0;
2410 	newsk->sk_wmem_queued	= 0;
2411 	newsk->sk_forward_alloc = 0;
2412 	newsk->sk_reserved_mem  = 0;
2413 	atomic_set(&newsk->sk_drops, 0);
2414 	newsk->sk_send_head	= NULL;
2415 	newsk->sk_userlocks	= sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;
2416 	atomic_set(&newsk->sk_zckey, 0);
2417 
2418 	sock_reset_flag(newsk, SOCK_DONE);
2419 
2420 	/* sk->sk_memcg will be populated at accept() time */
2421 	newsk->sk_memcg = NULL;
2422 
2423 	cgroup_sk_clone(&newsk->sk_cgrp_data);
2424 
2425 	rcu_read_lock();
2426 	filter = rcu_dereference(sk->sk_filter);
2427 	if (filter != NULL)
2428 		/* though it's an empty new sock, the charging may fail
2429 		 * if sysctl_optmem_max was changed between creation of
2430 		 * original socket and cloning
2431 		 */
2432 		is_charged = sk_filter_charge(newsk, filter);
2433 	RCU_INIT_POINTER(newsk->sk_filter, filter);
2434 	rcu_read_unlock();
2435 
2436 	if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
2437 		/* We need to make sure that we don't uncharge the new
2438 		 * socket if we couldn't charge it in the first place
2439 		 * as otherwise we uncharge the parent's filter.
2440 		 */
2441 		if (!is_charged)
2442 			RCU_INIT_POINTER(newsk->sk_filter, NULL);
2443 		sk_free_unlock_clone(newsk);
2444 		newsk = NULL;
2445 		goto out;
2446 	}
2447 	RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
2448 
2449 	if (bpf_sk_storage_clone(sk, newsk)) {
2450 		sk_free_unlock_clone(newsk);
2451 		newsk = NULL;
2452 		goto out;
2453 	}
2454 
2455 	/* Clear sk_user_data if parent had the pointer tagged
2456 	 * as not suitable for copying when cloning.
2457 	 */
2458 	if (sk_user_data_is_nocopy(newsk))
2459 		newsk->sk_user_data = NULL;
2460 
2461 	newsk->sk_err	   = 0;
2462 	newsk->sk_err_soft = 0;
2463 	newsk->sk_priority = 0;
2464 	newsk->sk_incoming_cpu = raw_smp_processor_id();
2465 
2466 	/* Before updating sk_refcnt, we must commit prior changes to memory
2467 	 * (Documentation/RCU/rculist_nulls.rst for details)
2468 	 */
2469 	smp_wmb();
2470 	refcount_set(&newsk->sk_refcnt, 2);
2471 
2472 	sk_set_socket(newsk, NULL);
2473 	sk_tx_queue_clear(newsk);
2474 	RCU_INIT_POINTER(newsk->sk_wq, NULL);
2475 
2476 	if (newsk->sk_prot->sockets_allocated)
2477 		sk_sockets_allocated_inc(newsk);
2478 
2479 	if (sock_needs_netstamp(sk) && newsk->sk_flags & SK_FLAGS_TIMESTAMP)
2480 		net_enable_timestamp();
2481 out:
2482 	return newsk;
2483 }
2484 EXPORT_SYMBOL_GPL(sk_clone_lock);
2485 
sk_free_unlock_clone(struct sock * sk)2486 void sk_free_unlock_clone(struct sock *sk)
2487 {
2488 	/* It is still raw copy of parent, so invalidate
2489 	 * destructor and make plain sk_free() */
2490 	sk->sk_destruct = NULL;
2491 	bh_unlock_sock(sk);
2492 	sk_free(sk);
2493 }
2494 EXPORT_SYMBOL_GPL(sk_free_unlock_clone);
2495 
sk_dst_gso_max_size(struct sock * sk,struct dst_entry * dst)2496 static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
2497 {
2498 	bool is_ipv6 = false;
2499 	u32 max_size;
2500 
2501 #if IS_ENABLED(CONFIG_IPV6)
2502 	is_ipv6 = (sk->sk_family == AF_INET6 &&
2503 		   !ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr));
2504 #endif
2505 	/* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */
2506 	max_size = is_ipv6 ? READ_ONCE(dst->dev->gso_max_size) :
2507 			READ_ONCE(dst->dev->gso_ipv4_max_size);
2508 	if (max_size > GSO_LEGACY_MAX_SIZE && !sk_is_tcp(sk))
2509 		max_size = GSO_LEGACY_MAX_SIZE;
2510 
2511 	return max_size - (MAX_TCP_HEADER + 1);
2512 }
2513 
sk_setup_caps(struct sock * sk,struct dst_entry * dst)2514 void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
2515 {
2516 	u32 max_segs = 1;
2517 
2518 	sk->sk_route_caps = dst->dev->features;
2519 	if (sk_is_tcp(sk))
2520 		sk->sk_route_caps |= NETIF_F_GSO;
2521 	if (sk->sk_route_caps & NETIF_F_GSO)
2522 		sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
2523 	if (unlikely(sk->sk_gso_disabled))
2524 		sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
2525 	if (sk_can_gso(sk)) {
2526 		if (dst->header_len && !xfrm_dst_offload_ok(dst)) {
2527 			sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
2528 		} else {
2529 			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
2530 			sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dst);
2531 			/* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */
2532 			max_segs = max_t(u32, READ_ONCE(dst->dev->gso_max_segs), 1);
2533 		}
2534 	}
2535 	sk->sk_gso_max_segs = max_segs;
2536 	sk_dst_set(sk, dst);
2537 }
2538 EXPORT_SYMBOL_GPL(sk_setup_caps);
2539 
2540 /*
2541  *	Simple resource managers for sockets.
2542  */
2543 
2544 
2545 /*
2546  * Write buffer destructor automatically called from kfree_skb.
2547  */
sock_wfree(struct sk_buff * skb)2548 void sock_wfree(struct sk_buff *skb)
2549 {
2550 	struct sock *sk = skb->sk;
2551 	unsigned int len = skb->truesize;
2552 	bool free;
2553 
2554 	if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) {
2555 		if (sock_flag(sk, SOCK_RCU_FREE) &&
2556 		    sk->sk_write_space == sock_def_write_space) {
2557 			rcu_read_lock();
2558 			free = refcount_sub_and_test(len, &sk->sk_wmem_alloc);
2559 			sock_def_write_space_wfree(sk);
2560 			rcu_read_unlock();
2561 			if (unlikely(free))
2562 				__sk_free(sk);
2563 			return;
2564 		}
2565 
2566 		/*
2567 		 * Keep a reference on sk_wmem_alloc, this will be released
2568 		 * after sk_write_space() call
2569 		 */
2570 		WARN_ON(refcount_sub_and_test(len - 1, &sk->sk_wmem_alloc));
2571 		sk->sk_write_space(sk);
2572 		len = 1;
2573 	}
2574 	/*
2575 	 * if sk_wmem_alloc reaches 0, we must finish what sk_free()
2576 	 * could not do because of in-flight packets
2577 	 */
2578 	if (refcount_sub_and_test(len, &sk->sk_wmem_alloc))
2579 		__sk_free(sk);
2580 }
2581 EXPORT_SYMBOL(sock_wfree);
2582 
2583 /* This variant of sock_wfree() is used by TCP,
2584  * since it sets SOCK_USE_WRITE_QUEUE.
2585  */
__sock_wfree(struct sk_buff * skb)2586 void __sock_wfree(struct sk_buff *skb)
2587 {
2588 	struct sock *sk = skb->sk;
2589 
2590 	if (refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc))
2591 		__sk_free(sk);
2592 }
2593 
skb_set_owner_w(struct sk_buff * skb,struct sock * sk)2594 void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
2595 {
2596 	skb_orphan(skb);
2597 	skb->sk = sk;
2598 #ifdef CONFIG_INET
2599 	if (unlikely(!sk_fullsock(sk))) {
2600 		skb->destructor = sock_edemux;
2601 		sock_hold(sk);
2602 		return;
2603 	}
2604 #endif
2605 	skb->destructor = sock_wfree;
2606 	skb_set_hash_from_sk(skb, sk);
2607 	/*
2608 	 * We used to take a refcount on sk, but following operation
2609 	 * is enough to guarantee sk_free() won't free this sock until
2610 	 * all in-flight packets are completed
2611 	 */
2612 	refcount_add(skb->truesize, &sk->sk_wmem_alloc);
2613 }
2614 EXPORT_SYMBOL(skb_set_owner_w);
2615 
can_skb_orphan_partial(const struct sk_buff * skb)2616 static bool can_skb_orphan_partial(const struct sk_buff *skb)
2617 {
2618 	/* Drivers depend on in-order delivery for crypto offload,
2619 	 * partial orphan breaks out-of-order-OK logic.
2620 	 */
2621 	if (skb_is_decrypted(skb))
2622 		return false;
2623 
2624 	return (skb->destructor == sock_wfree ||
2625 		(IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree));
2626 }
2627 
2628 /* This helper is used by netem, as it can hold packets in its
2629  * delay queue. We want to allow the owner socket to send more
2630  * packets, as if they were already TX completed by a typical driver.
2631  * But we also want to keep skb->sk set because some packet schedulers
2632  * rely on it (sch_fq for example).
2633  */
skb_orphan_partial(struct sk_buff * skb)2634 void skb_orphan_partial(struct sk_buff *skb)
2635 {
2636 	if (skb_is_tcp_pure_ack(skb))
2637 		return;
2638 
2639 	if (can_skb_orphan_partial(skb) && skb_set_owner_sk_safe(skb, skb->sk))
2640 		return;
2641 
2642 	skb_orphan(skb);
2643 }
2644 EXPORT_SYMBOL(skb_orphan_partial);
2645 
2646 /*
2647  * Read buffer destructor automatically called from kfree_skb.
2648  */
sock_rfree(struct sk_buff * skb)2649 void sock_rfree(struct sk_buff *skb)
2650 {
2651 	struct sock *sk = skb->sk;
2652 	unsigned int len = skb->truesize;
2653 
2654 	atomic_sub(len, &sk->sk_rmem_alloc);
2655 	sk_mem_uncharge(sk, len);
2656 }
2657 EXPORT_SYMBOL(sock_rfree);
2658 
2659 /*
2660  * Buffer destructor for skbs that are not used directly in read or write
2661  * path, e.g. for error handler skbs. Automatically called from kfree_skb.
2662  */
sock_efree(struct sk_buff * skb)2663 void sock_efree(struct sk_buff *skb)
2664 {
2665 	sock_put(skb->sk);
2666 }
2667 EXPORT_SYMBOL(sock_efree);
2668 
2669 /* Buffer destructor for prefetch/receive path where reference count may
2670  * not be held, e.g. for listen sockets.
2671  */
2672 #ifdef CONFIG_INET
sock_pfree(struct sk_buff * skb)2673 void sock_pfree(struct sk_buff *skb)
2674 {
2675 	struct sock *sk = skb->sk;
2676 
2677 	if (!sk_is_refcounted(sk))
2678 		return;
2679 
2680 	if (sk->sk_state == TCP_NEW_SYN_RECV && inet_reqsk(sk)->syncookie) {
2681 		inet_reqsk(sk)->rsk_listener = NULL;
2682 		reqsk_free(inet_reqsk(sk));
2683 		return;
2684 	}
2685 
2686 	sock_gen_put(sk);
2687 }
2688 EXPORT_SYMBOL(sock_pfree);
2689 #endif /* CONFIG_INET */
2690 
sock_i_uid(struct sock * sk)2691 kuid_t sock_i_uid(struct sock *sk)
2692 {
2693 	kuid_t uid;
2694 
2695 	read_lock_bh(&sk->sk_callback_lock);
2696 	uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : GLOBAL_ROOT_UID;
2697 	read_unlock_bh(&sk->sk_callback_lock);
2698 	return uid;
2699 }
2700 EXPORT_SYMBOL(sock_i_uid);
2701 
__sock_i_ino(struct sock * sk)2702 unsigned long __sock_i_ino(struct sock *sk)
2703 {
2704 	unsigned long ino;
2705 
2706 	read_lock(&sk->sk_callback_lock);
2707 	ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
2708 	read_unlock(&sk->sk_callback_lock);
2709 	return ino;
2710 }
2711 EXPORT_SYMBOL(__sock_i_ino);
2712 
sock_i_ino(struct sock * sk)2713 unsigned long sock_i_ino(struct sock *sk)
2714 {
2715 	unsigned long ino;
2716 
2717 	local_bh_disable();
2718 	ino = __sock_i_ino(sk);
2719 	local_bh_enable();
2720 	return ino;
2721 }
2722 EXPORT_SYMBOL(sock_i_ino);
2723 
2724 /*
2725  * Allocate a skb from the socket's send buffer.
2726  */
sock_wmalloc(struct sock * sk,unsigned long size,int force,gfp_t priority)2727 struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
2728 			     gfp_t priority)
2729 {
2730 	if (force ||
2731 	    refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf)) {
2732 		struct sk_buff *skb = alloc_skb(size, priority);
2733 
2734 		if (skb) {
2735 			skb_set_owner_w(skb, sk);
2736 			return skb;
2737 		}
2738 	}
2739 	return NULL;
2740 }
2741 EXPORT_SYMBOL(sock_wmalloc);
2742 
sock_ofree(struct sk_buff * skb)2743 static void sock_ofree(struct sk_buff *skb)
2744 {
2745 	struct sock *sk = skb->sk;
2746 
2747 	atomic_sub(skb->truesize, &sk->sk_omem_alloc);
2748 }
2749 
sock_omalloc(struct sock * sk,unsigned long size,gfp_t priority)2750 struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size,
2751 			     gfp_t priority)
2752 {
2753 	struct sk_buff *skb;
2754 
2755 	/* small safe race: SKB_TRUESIZE may differ from final skb->truesize */
2756 	if (atomic_read(&sk->sk_omem_alloc) + SKB_TRUESIZE(size) >
2757 	    READ_ONCE(sock_net(sk)->core.sysctl_optmem_max))
2758 		return NULL;
2759 
2760 	skb = alloc_skb(size, priority);
2761 	if (!skb)
2762 		return NULL;
2763 
2764 	atomic_add(skb->truesize, &sk->sk_omem_alloc);
2765 	skb->sk = sk;
2766 	skb->destructor = sock_ofree;
2767 	return skb;
2768 }
2769 
2770 /*
2771  * Allocate a memory block from the socket's option memory buffer.
2772  */
sock_kmalloc(struct sock * sk,int size,gfp_t priority)2773 void *sock_kmalloc(struct sock *sk, int size, gfp_t priority)
2774 {
2775 	int optmem_max = READ_ONCE(sock_net(sk)->core.sysctl_optmem_max);
2776 
2777 	if ((unsigned int)size <= optmem_max &&
2778 	    atomic_read(&sk->sk_omem_alloc) + size < optmem_max) {
2779 		void *mem;
2780 		/* First do the add, to avoid the race if kmalloc
2781 		 * might sleep.
2782 		 */
2783 		atomic_add(size, &sk->sk_omem_alloc);
2784 		mem = kmalloc(size, priority);
2785 		if (mem)
2786 			return mem;
2787 		atomic_sub(size, &sk->sk_omem_alloc);
2788 	}
2789 	return NULL;
2790 }
2791 EXPORT_SYMBOL(sock_kmalloc);
2792 
2793 /* Free an option memory block. Note, we actually want the inline
2794  * here as this allows gcc to detect the nullify and fold away the
2795  * condition entirely.
2796  */
__sock_kfree_s(struct sock * sk,void * mem,int size,const bool nullify)2797 static inline void __sock_kfree_s(struct sock *sk, void *mem, int size,
2798 				  const bool nullify)
2799 {
2800 	if (WARN_ON_ONCE(!mem))
2801 		return;
2802 	if (nullify)
2803 		kfree_sensitive(mem);
2804 	else
2805 		kfree(mem);
2806 	atomic_sub(size, &sk->sk_omem_alloc);
2807 }
2808 
sock_kfree_s(struct sock * sk,void * mem,int size)2809 void sock_kfree_s(struct sock *sk, void *mem, int size)
2810 {
2811 	__sock_kfree_s(sk, mem, size, false);
2812 }
2813 EXPORT_SYMBOL(sock_kfree_s);
2814 
sock_kzfree_s(struct sock * sk,void * mem,int size)2815 void sock_kzfree_s(struct sock *sk, void *mem, int size)
2816 {
2817 	__sock_kfree_s(sk, mem, size, true);
2818 }
2819 EXPORT_SYMBOL(sock_kzfree_s);
2820 
2821 /* It is almost wait_for_tcp_memory minus release_sock/lock_sock.
2822    I think, these locks should be removed for datagram sockets.
2823  */
sock_wait_for_wmem(struct sock * sk,long timeo)2824 static long sock_wait_for_wmem(struct sock *sk, long timeo)
2825 {
2826 	DEFINE_WAIT(wait);
2827 
2828 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
2829 	for (;;) {
2830 		if (!timeo)
2831 			break;
2832 		if (signal_pending(current))
2833 			break;
2834 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
2835 		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
2836 		if (refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf))
2837 			break;
2838 		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
2839 			break;
2840 		if (READ_ONCE(sk->sk_err))
2841 			break;
2842 		timeo = schedule_timeout(timeo);
2843 	}
2844 	finish_wait(sk_sleep(sk), &wait);
2845 	return timeo;
2846 }
2847 
2848 
2849 /*
2850  *	Generic send/receive buffer handlers
2851  */
2852 
sock_alloc_send_pskb(struct sock * sk,unsigned long header_len,unsigned long data_len,int noblock,int * errcode,int max_page_order)2853 struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
2854 				     unsigned long data_len, int noblock,
2855 				     int *errcode, int max_page_order)
2856 {
2857 	struct sk_buff *skb;
2858 	long timeo;
2859 	int err;
2860 
2861 	timeo = sock_sndtimeo(sk, noblock);
2862 	for (;;) {
2863 		err = sock_error(sk);
2864 		if (err != 0)
2865 			goto failure;
2866 
2867 		err = -EPIPE;
2868 		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
2869 			goto failure;
2870 
2871 		if (sk_wmem_alloc_get(sk) < READ_ONCE(sk->sk_sndbuf))
2872 			break;
2873 
2874 		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
2875 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
2876 		err = -EAGAIN;
2877 		if (!timeo)
2878 			goto failure;
2879 		if (signal_pending(current))
2880 			goto interrupted;
2881 		timeo = sock_wait_for_wmem(sk, timeo);
2882 	}
2883 	skb = alloc_skb_with_frags(header_len, data_len, max_page_order,
2884 				   errcode, sk->sk_allocation);
2885 	if (skb)
2886 		skb_set_owner_w(skb, sk);
2887 	return skb;
2888 
2889 interrupted:
2890 	err = sock_intr_errno(timeo);
2891 failure:
2892 	*errcode = err;
2893 	return NULL;
2894 }
2895 EXPORT_SYMBOL(sock_alloc_send_pskb);
2896 
__sock_cmsg_send(struct sock * sk,struct cmsghdr * cmsg,struct sockcm_cookie * sockc)2897 int __sock_cmsg_send(struct sock *sk, struct cmsghdr *cmsg,
2898 		     struct sockcm_cookie *sockc)
2899 {
2900 	u32 tsflags;
2901 
2902 	switch (cmsg->cmsg_type) {
2903 	case SO_MARK:
2904 		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
2905 		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2906 			return -EPERM;
2907 		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
2908 			return -EINVAL;
2909 		sockc->mark = *(u32 *)CMSG_DATA(cmsg);
2910 		break;
2911 	case SO_TIMESTAMPING_OLD:
2912 	case SO_TIMESTAMPING_NEW:
2913 		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
2914 			return -EINVAL;
2915 
2916 		tsflags = *(u32 *)CMSG_DATA(cmsg);
2917 		if (tsflags & ~SOF_TIMESTAMPING_TX_RECORD_MASK)
2918 			return -EINVAL;
2919 
2920 		sockc->tsflags &= ~SOF_TIMESTAMPING_TX_RECORD_MASK;
2921 		sockc->tsflags |= tsflags;
2922 		break;
2923 	case SCM_TXTIME:
2924 		if (!sock_flag(sk, SOCK_TXTIME))
2925 			return -EINVAL;
2926 		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u64)))
2927 			return -EINVAL;
2928 		sockc->transmit_time = get_unaligned((u64 *)CMSG_DATA(cmsg));
2929 		break;
2930 	/* SCM_RIGHTS and SCM_CREDENTIALS are semantically in SOL_UNIX. */
2931 	case SCM_RIGHTS:
2932 	case SCM_CREDENTIALS:
2933 		break;
2934 	default:
2935 		return -EINVAL;
2936 	}
2937 	return 0;
2938 }
2939 EXPORT_SYMBOL(__sock_cmsg_send);
2940 
sock_cmsg_send(struct sock * sk,struct msghdr * msg,struct sockcm_cookie * sockc)2941 int sock_cmsg_send(struct sock *sk, struct msghdr *msg,
2942 		   struct sockcm_cookie *sockc)
2943 {
2944 	struct cmsghdr *cmsg;
2945 	int ret;
2946 
2947 	for_each_cmsghdr(cmsg, msg) {
2948 		if (!CMSG_OK(msg, cmsg))
2949 			return -EINVAL;
2950 		if (cmsg->cmsg_level != SOL_SOCKET)
2951 			continue;
2952 		ret = __sock_cmsg_send(sk, cmsg, sockc);
2953 		if (ret)
2954 			return ret;
2955 	}
2956 	return 0;
2957 }
2958 EXPORT_SYMBOL(sock_cmsg_send);
2959 
sk_enter_memory_pressure(struct sock * sk)2960 static void sk_enter_memory_pressure(struct sock *sk)
2961 {
2962 	if (!sk->sk_prot->enter_memory_pressure)
2963 		return;
2964 
2965 	sk->sk_prot->enter_memory_pressure(sk);
2966 }
2967 
sk_leave_memory_pressure(struct sock * sk)2968 static void sk_leave_memory_pressure(struct sock *sk)
2969 {
2970 	if (sk->sk_prot->leave_memory_pressure) {
2971 		INDIRECT_CALL_INET_1(sk->sk_prot->leave_memory_pressure,
2972 				     tcp_leave_memory_pressure, sk);
2973 	} else {
2974 		unsigned long *memory_pressure = sk->sk_prot->memory_pressure;
2975 
2976 		if (memory_pressure && READ_ONCE(*memory_pressure))
2977 			WRITE_ONCE(*memory_pressure, 0);
2978 	}
2979 }
2980 
2981 DEFINE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key);
2982 
2983 /**
2984  * skb_page_frag_refill - check that a page_frag contains enough room
2985  * @sz: minimum size of the fragment we want to get
2986  * @pfrag: pointer to page_frag
2987  * @gfp: priority for memory allocation
2988  *
2989  * Note: While this allocator tries to use high order pages, there is
2990  * no guarantee that allocations succeed. Therefore, @sz MUST be
2991  * less or equal than PAGE_SIZE.
2992  */
skb_page_frag_refill(unsigned int sz,struct page_frag * pfrag,gfp_t gfp)2993 bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t gfp)
2994 {
2995 	if (pfrag->page) {
2996 		if (page_ref_count(pfrag->page) == 1) {
2997 			pfrag->offset = 0;
2998 			return true;
2999 		}
3000 		if (pfrag->offset + sz <= pfrag->size)
3001 			return true;
3002 		put_page(pfrag->page);
3003 	}
3004 
3005 	pfrag->offset = 0;
3006 	if (SKB_FRAG_PAGE_ORDER &&
3007 	    !static_branch_unlikely(&net_high_order_alloc_disable_key)) {
3008 		/* Avoid direct reclaim but allow kswapd to wake */
3009 		pfrag->page = alloc_pages((gfp & ~__GFP_DIRECT_RECLAIM) |
3010 					  __GFP_COMP | __GFP_NOWARN |
3011 					  __GFP_NORETRY,
3012 					  SKB_FRAG_PAGE_ORDER);
3013 		if (likely(pfrag->page)) {
3014 			pfrag->size = PAGE_SIZE << SKB_FRAG_PAGE_ORDER;
3015 			return true;
3016 		}
3017 	}
3018 	pfrag->page = alloc_page(gfp);
3019 	if (likely(pfrag->page)) {
3020 		pfrag->size = PAGE_SIZE;
3021 		return true;
3022 	}
3023 	return false;
3024 }
3025 EXPORT_SYMBOL(skb_page_frag_refill);
3026 
sk_page_frag_refill(struct sock * sk,struct page_frag * pfrag)3027 bool sk_page_frag_refill(struct sock *sk, struct page_frag *pfrag)
3028 {
3029 	if (likely(skb_page_frag_refill(32U, pfrag, sk->sk_allocation)))
3030 		return true;
3031 
3032 	sk_enter_memory_pressure(sk);
3033 	sk_stream_moderate_sndbuf(sk);
3034 	return false;
3035 }
3036 EXPORT_SYMBOL(sk_page_frag_refill);
3037 
__lock_sock(struct sock * sk)3038 void __lock_sock(struct sock *sk)
3039 	__releases(&sk->sk_lock.slock)
3040 	__acquires(&sk->sk_lock.slock)
3041 {
3042 	DEFINE_WAIT(wait);
3043 
3044 	for (;;) {
3045 		prepare_to_wait_exclusive(&sk->sk_lock.wq, &wait,
3046 					TASK_UNINTERRUPTIBLE);
3047 		spin_unlock_bh(&sk->sk_lock.slock);
3048 		schedule();
3049 		spin_lock_bh(&sk->sk_lock.slock);
3050 		if (!sock_owned_by_user(sk))
3051 			break;
3052 	}
3053 	finish_wait(&sk->sk_lock.wq, &wait);
3054 }
3055 
__release_sock(struct sock * sk)3056 void __release_sock(struct sock *sk)
3057 	__releases(&sk->sk_lock.slock)
3058 	__acquires(&sk->sk_lock.slock)
3059 {
3060 	struct sk_buff *skb, *next;
3061 
3062 	while ((skb = sk->sk_backlog.head) != NULL) {
3063 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
3064 
3065 		spin_unlock_bh(&sk->sk_lock.slock);
3066 
3067 		do {
3068 			next = skb->next;
3069 			prefetch(next);
3070 			DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb));
3071 			skb_mark_not_on_list(skb);
3072 			sk_backlog_rcv(sk, skb);
3073 
3074 			cond_resched();
3075 
3076 			skb = next;
3077 		} while (skb != NULL);
3078 
3079 		spin_lock_bh(&sk->sk_lock.slock);
3080 	}
3081 
3082 	/*
3083 	 * Doing the zeroing here guarantee we can not loop forever
3084 	 * while a wild producer attempts to flood us.
3085 	 */
3086 	sk->sk_backlog.len = 0;
3087 }
3088 
__sk_flush_backlog(struct sock * sk)3089 void __sk_flush_backlog(struct sock *sk)
3090 {
3091 	spin_lock_bh(&sk->sk_lock.slock);
3092 	__release_sock(sk);
3093 
3094 	if (sk->sk_prot->release_cb)
3095 		INDIRECT_CALL_INET_1(sk->sk_prot->release_cb,
3096 				     tcp_release_cb, sk);
3097 
3098 	spin_unlock_bh(&sk->sk_lock.slock);
3099 }
3100 EXPORT_SYMBOL_GPL(__sk_flush_backlog);
3101 
3102 /**
3103  * sk_wait_data - wait for data to arrive at sk_receive_queue
3104  * @sk:    sock to wait on
3105  * @timeo: for how long
3106  * @skb:   last skb seen on sk_receive_queue
3107  *
3108  * Now socket state including sk->sk_err is changed only under lock,
3109  * hence we may omit checks after joining wait queue.
3110  * We check receive queue before schedule() only as optimization;
3111  * it is very likely that release_sock() added new data.
3112  */
sk_wait_data(struct sock * sk,long * timeo,const struct sk_buff * skb)3113 int sk_wait_data(struct sock *sk, long *timeo, const struct sk_buff *skb)
3114 {
3115 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
3116 	int rc;
3117 
3118 	add_wait_queue(sk_sleep(sk), &wait);
3119 	sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
3120 	rc = sk_wait_event(sk, timeo, skb_peek_tail(&sk->sk_receive_queue) != skb, &wait);
3121 	sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
3122 	remove_wait_queue(sk_sleep(sk), &wait);
3123 	return rc;
3124 }
3125 EXPORT_SYMBOL(sk_wait_data);
3126 
3127 /**
3128  *	__sk_mem_raise_allocated - increase memory_allocated
3129  *	@sk: socket
3130  *	@size: memory size to allocate
3131  *	@amt: pages to allocate
3132  *	@kind: allocation type
3133  *
3134  *	Similar to __sk_mem_schedule(), but does not update sk_forward_alloc.
3135  *
3136  *	Unlike the globally shared limits among the sockets under same protocol,
3137  *	consuming the budget of a memcg won't have direct effect on other ones.
3138  *	So be optimistic about memcg's tolerance, and leave the callers to decide
3139  *	whether or not to raise allocated through sk_under_memory_pressure() or
3140  *	its variants.
3141  */
__sk_mem_raise_allocated(struct sock * sk,int size,int amt,int kind)3142 int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
3143 {
3144 	struct mem_cgroup *memcg = mem_cgroup_sockets_enabled ? sk->sk_memcg : NULL;
3145 	struct proto *prot = sk->sk_prot;
3146 	bool charged = false;
3147 	long allocated;
3148 
3149 	sk_memory_allocated_add(sk, amt);
3150 	allocated = sk_memory_allocated(sk);
3151 
3152 	if (memcg) {
3153 		if (!mem_cgroup_charge_skmem(memcg, amt, gfp_memcg_charge()))
3154 			goto suppress_allocation;
3155 		charged = true;
3156 	}
3157 
3158 	/* Under limit. */
3159 	if (allocated <= sk_prot_mem_limits(sk, 0)) {
3160 		sk_leave_memory_pressure(sk);
3161 		return 1;
3162 	}
3163 
3164 	/* Under pressure. */
3165 	if (allocated > sk_prot_mem_limits(sk, 1))
3166 		sk_enter_memory_pressure(sk);
3167 
3168 	/* Over hard limit. */
3169 	if (allocated > sk_prot_mem_limits(sk, 2))
3170 		goto suppress_allocation;
3171 
3172 	/* Guarantee minimum buffer size under pressure (either global
3173 	 * or memcg) to make sure features described in RFC 7323 (TCP
3174 	 * Extensions for High Performance) work properly.
3175 	 *
3176 	 * This rule does NOT stand when exceeds global or memcg's hard
3177 	 * limit, or else a DoS attack can be taken place by spawning
3178 	 * lots of sockets whose usage are under minimum buffer size.
3179 	 */
3180 	if (kind == SK_MEM_RECV) {
3181 		if (atomic_read(&sk->sk_rmem_alloc) < sk_get_rmem0(sk, prot))
3182 			return 1;
3183 
3184 	} else { /* SK_MEM_SEND */
3185 		int wmem0 = sk_get_wmem0(sk, prot);
3186 
3187 		if (sk->sk_type == SOCK_STREAM) {
3188 			if (sk->sk_wmem_queued < wmem0)
3189 				return 1;
3190 		} else if (refcount_read(&sk->sk_wmem_alloc) < wmem0) {
3191 				return 1;
3192 		}
3193 	}
3194 
3195 	if (sk_has_memory_pressure(sk)) {
3196 		u64 alloc;
3197 
3198 		/* The following 'average' heuristic is within the
3199 		 * scope of global accounting, so it only makes
3200 		 * sense for global memory pressure.
3201 		 */
3202 		if (!sk_under_global_memory_pressure(sk))
3203 			return 1;
3204 
3205 		/* Try to be fair among all the sockets under global
3206 		 * pressure by allowing the ones that below average
3207 		 * usage to raise.
3208 		 */
3209 		alloc = sk_sockets_allocated_read_positive(sk);
3210 		if (sk_prot_mem_limits(sk, 2) > alloc *
3211 		    sk_mem_pages(sk->sk_wmem_queued +
3212 				 atomic_read(&sk->sk_rmem_alloc) +
3213 				 sk->sk_forward_alloc))
3214 			return 1;
3215 	}
3216 
3217 suppress_allocation:
3218 
3219 	if (kind == SK_MEM_SEND && sk->sk_type == SOCK_STREAM) {
3220 		sk_stream_moderate_sndbuf(sk);
3221 
3222 		/* Fail only if socket is _under_ its sndbuf.
3223 		 * In this case we cannot block, so that we have to fail.
3224 		 */
3225 		if (sk->sk_wmem_queued + size >= sk->sk_sndbuf) {
3226 			/* Force charge with __GFP_NOFAIL */
3227 			if (memcg && !charged) {
3228 				mem_cgroup_charge_skmem(memcg, amt,
3229 					gfp_memcg_charge() | __GFP_NOFAIL);
3230 			}
3231 			return 1;
3232 		}
3233 	}
3234 
3235 	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
3236 		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
3237 
3238 	sk_memory_allocated_sub(sk, amt);
3239 
3240 	if (charged)
3241 		mem_cgroup_uncharge_skmem(memcg, amt);
3242 
3243 	return 0;
3244 }
3245 
3246 /**
3247  *	__sk_mem_schedule - increase sk_forward_alloc and memory_allocated
3248  *	@sk: socket
3249  *	@size: memory size to allocate
3250  *	@kind: allocation type
3251  *
3252  *	If kind is SK_MEM_SEND, it means wmem allocation. Otherwise it means
3253  *	rmem allocation. This function assumes that protocols which have
3254  *	memory_pressure use sk_wmem_queued as write buffer accounting.
3255  */
__sk_mem_schedule(struct sock * sk,int size,int kind)3256 int __sk_mem_schedule(struct sock *sk, int size, int kind)
3257 {
3258 	int ret, amt = sk_mem_pages(size);
3259 
3260 	sk_forward_alloc_add(sk, amt << PAGE_SHIFT);
3261 	ret = __sk_mem_raise_allocated(sk, size, amt, kind);
3262 	if (!ret)
3263 		sk_forward_alloc_add(sk, -(amt << PAGE_SHIFT));
3264 	return ret;
3265 }
3266 EXPORT_SYMBOL(__sk_mem_schedule);
3267 
3268 /**
3269  *	__sk_mem_reduce_allocated - reclaim memory_allocated
3270  *	@sk: socket
3271  *	@amount: number of quanta
3272  *
3273  *	Similar to __sk_mem_reclaim(), but does not update sk_forward_alloc
3274  */
__sk_mem_reduce_allocated(struct sock * sk,int amount)3275 void __sk_mem_reduce_allocated(struct sock *sk, int amount)
3276 {
3277 	sk_memory_allocated_sub(sk, amount);
3278 
3279 	if (mem_cgroup_sockets_enabled && sk->sk_memcg)
3280 		mem_cgroup_uncharge_skmem(sk->sk_memcg, amount);
3281 
3282 	if (sk_under_global_memory_pressure(sk) &&
3283 	    (sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
3284 		sk_leave_memory_pressure(sk);
3285 }
3286 
3287 /**
3288  *	__sk_mem_reclaim - reclaim sk_forward_alloc and memory_allocated
3289  *	@sk: socket
3290  *	@amount: number of bytes (rounded down to a PAGE_SIZE multiple)
3291  */
__sk_mem_reclaim(struct sock * sk,int amount)3292 void __sk_mem_reclaim(struct sock *sk, int amount)
3293 {
3294 	amount >>= PAGE_SHIFT;
3295 	sk_forward_alloc_add(sk, -(amount << PAGE_SHIFT));
3296 	__sk_mem_reduce_allocated(sk, amount);
3297 }
3298 EXPORT_SYMBOL(__sk_mem_reclaim);
3299 
sk_set_peek_off(struct sock * sk,int val)3300 int sk_set_peek_off(struct sock *sk, int val)
3301 {
3302 	WRITE_ONCE(sk->sk_peek_off, val);
3303 	return 0;
3304 }
3305 EXPORT_SYMBOL_GPL(sk_set_peek_off);
3306 
3307 /*
3308  * Set of default routines for initialising struct proto_ops when
3309  * the protocol does not support a particular function. In certain
3310  * cases where it makes no sense for a protocol to have a "do nothing"
3311  * function, some default processing is provided.
3312  */
3313 
sock_no_bind(struct socket * sock,struct sockaddr * saddr,int len)3314 int sock_no_bind(struct socket *sock, struct sockaddr *saddr, int len)
3315 {
3316 	return -EOPNOTSUPP;
3317 }
3318 EXPORT_SYMBOL(sock_no_bind);
3319 
sock_no_connect(struct socket * sock,struct sockaddr * saddr,int len,int flags)3320 int sock_no_connect(struct socket *sock, struct sockaddr *saddr,
3321 		    int len, int flags)
3322 {
3323 	return -EOPNOTSUPP;
3324 }
3325 EXPORT_SYMBOL(sock_no_connect);
3326 
sock_no_socketpair(struct socket * sock1,struct socket * sock2)3327 int sock_no_socketpair(struct socket *sock1, struct socket *sock2)
3328 {
3329 	return -EOPNOTSUPP;
3330 }
3331 EXPORT_SYMBOL(sock_no_socketpair);
3332 
sock_no_accept(struct socket * sock,struct socket * newsock,struct proto_accept_arg * arg)3333 int sock_no_accept(struct socket *sock, struct socket *newsock,
3334 		   struct proto_accept_arg *arg)
3335 {
3336 	return -EOPNOTSUPP;
3337 }
3338 EXPORT_SYMBOL(sock_no_accept);
3339 
sock_no_getname(struct socket * sock,struct sockaddr * saddr,int peer)3340 int sock_no_getname(struct socket *sock, struct sockaddr *saddr,
3341 		    int peer)
3342 {
3343 	return -EOPNOTSUPP;
3344 }
3345 EXPORT_SYMBOL(sock_no_getname);
3346 
sock_no_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)3347 int sock_no_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
3348 {
3349 	return -EOPNOTSUPP;
3350 }
3351 EXPORT_SYMBOL(sock_no_ioctl);
3352 
sock_no_listen(struct socket * sock,int backlog)3353 int sock_no_listen(struct socket *sock, int backlog)
3354 {
3355 	return -EOPNOTSUPP;
3356 }
3357 EXPORT_SYMBOL(sock_no_listen);
3358 
sock_no_shutdown(struct socket * sock,int how)3359 int sock_no_shutdown(struct socket *sock, int how)
3360 {
3361 	return -EOPNOTSUPP;
3362 }
3363 EXPORT_SYMBOL(sock_no_shutdown);
3364 
sock_no_sendmsg(struct socket * sock,struct msghdr * m,size_t len)3365 int sock_no_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
3366 {
3367 	return -EOPNOTSUPP;
3368 }
3369 EXPORT_SYMBOL(sock_no_sendmsg);
3370 
sock_no_sendmsg_locked(struct sock * sk,struct msghdr * m,size_t len)3371 int sock_no_sendmsg_locked(struct sock *sk, struct msghdr *m, size_t len)
3372 {
3373 	return -EOPNOTSUPP;
3374 }
3375 EXPORT_SYMBOL(sock_no_sendmsg_locked);
3376 
sock_no_recvmsg(struct socket * sock,struct msghdr * m,size_t len,int flags)3377 int sock_no_recvmsg(struct socket *sock, struct msghdr *m, size_t len,
3378 		    int flags)
3379 {
3380 	return -EOPNOTSUPP;
3381 }
3382 EXPORT_SYMBOL(sock_no_recvmsg);
3383 
sock_no_mmap(struct file * file,struct socket * sock,struct vm_area_struct * vma)3384 int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
3385 {
3386 	/* Mirror missing mmap method error code */
3387 	return -ENODEV;
3388 }
3389 EXPORT_SYMBOL(sock_no_mmap);
3390 
3391 /*
3392  * When a file is received (via SCM_RIGHTS, etc), we must bump the
3393  * various sock-based usage counts.
3394  */
__receive_sock(struct file * file)3395 void __receive_sock(struct file *file)
3396 {
3397 	struct socket *sock;
3398 
3399 	sock = sock_from_file(file);
3400 	if (sock) {
3401 		sock_update_netprioidx(&sock->sk->sk_cgrp_data);
3402 		sock_update_classid(&sock->sk->sk_cgrp_data);
3403 	}
3404 }
3405 
3406 /*
3407  *	Default Socket Callbacks
3408  */
3409 
sock_def_wakeup(struct sock * sk)3410 static void sock_def_wakeup(struct sock *sk)
3411 {
3412 	struct socket_wq *wq;
3413 
3414 	rcu_read_lock();
3415 	wq = rcu_dereference(sk->sk_wq);
3416 	if (skwq_has_sleeper(wq))
3417 		wake_up_interruptible_all(&wq->wait);
3418 	rcu_read_unlock();
3419 }
3420 
sock_def_error_report(struct sock * sk)3421 static void sock_def_error_report(struct sock *sk)
3422 {
3423 	struct socket_wq *wq;
3424 
3425 	rcu_read_lock();
3426 	wq = rcu_dereference(sk->sk_wq);
3427 	if (skwq_has_sleeper(wq))
3428 		wake_up_interruptible_poll(&wq->wait, EPOLLERR);
3429 	sk_wake_async_rcu(sk, SOCK_WAKE_IO, POLL_ERR);
3430 	rcu_read_unlock();
3431 }
3432 
sock_def_readable(struct sock * sk)3433 void sock_def_readable(struct sock *sk)
3434 {
3435 	struct socket_wq *wq;
3436 
3437 	trace_sk_data_ready(sk);
3438 
3439 	rcu_read_lock();
3440 	wq = rcu_dereference(sk->sk_wq);
3441 	if (skwq_has_sleeper(wq))
3442 		wake_up_interruptible_sync_poll(&wq->wait, EPOLLIN | EPOLLPRI |
3443 						EPOLLRDNORM | EPOLLRDBAND);
3444 	sk_wake_async_rcu(sk, SOCK_WAKE_WAITD, POLL_IN);
3445 	rcu_read_unlock();
3446 }
3447 
sock_def_write_space(struct sock * sk)3448 static void sock_def_write_space(struct sock *sk)
3449 {
3450 	struct socket_wq *wq;
3451 
3452 	rcu_read_lock();
3453 
3454 	/* Do not wake up a writer until he can make "significant"
3455 	 * progress.  --DaveM
3456 	 */
3457 	if (sock_writeable(sk)) {
3458 		wq = rcu_dereference(sk->sk_wq);
3459 		if (skwq_has_sleeper(wq))
3460 			wake_up_interruptible_sync_poll(&wq->wait, EPOLLOUT |
3461 						EPOLLWRNORM | EPOLLWRBAND);
3462 
3463 		/* Should agree with poll, otherwise some programs break */
3464 		sk_wake_async_rcu(sk, SOCK_WAKE_SPACE, POLL_OUT);
3465 	}
3466 
3467 	rcu_read_unlock();
3468 }
3469 
3470 /* An optimised version of sock_def_write_space(), should only be called
3471  * for SOCK_RCU_FREE sockets under RCU read section and after putting
3472  * ->sk_wmem_alloc.
3473  */
sock_def_write_space_wfree(struct sock * sk)3474 static void sock_def_write_space_wfree(struct sock *sk)
3475 {
3476 	/* Do not wake up a writer until he can make "significant"
3477 	 * progress.  --DaveM
3478 	 */
3479 	if (sock_writeable(sk)) {
3480 		struct socket_wq *wq = rcu_dereference(sk->sk_wq);
3481 
3482 		/* rely on refcount_sub from sock_wfree() */
3483 		smp_mb__after_atomic();
3484 		if (wq && waitqueue_active(&wq->wait))
3485 			wake_up_interruptible_sync_poll(&wq->wait, EPOLLOUT |
3486 						EPOLLWRNORM | EPOLLWRBAND);
3487 
3488 		/* Should agree with poll, otherwise some programs break */
3489 		sk_wake_async_rcu(sk, SOCK_WAKE_SPACE, POLL_OUT);
3490 	}
3491 }
3492 
sock_def_destruct(struct sock * sk)3493 static void sock_def_destruct(struct sock *sk)
3494 {
3495 }
3496 
sk_send_sigurg(struct sock * sk)3497 void sk_send_sigurg(struct sock *sk)
3498 {
3499 	if (sk->sk_socket && sk->sk_socket->file)
3500 		if (send_sigurg(sk->sk_socket->file))
3501 			sk_wake_async(sk, SOCK_WAKE_URG, POLL_PRI);
3502 }
3503 EXPORT_SYMBOL(sk_send_sigurg);
3504 
sk_reset_timer(struct sock * sk,struct timer_list * timer,unsigned long expires)3505 void sk_reset_timer(struct sock *sk, struct timer_list* timer,
3506 		    unsigned long expires)
3507 {
3508 	if (!mod_timer(timer, expires))
3509 		sock_hold(sk);
3510 }
3511 EXPORT_SYMBOL(sk_reset_timer);
3512 
sk_stop_timer(struct sock * sk,struct timer_list * timer)3513 void sk_stop_timer(struct sock *sk, struct timer_list* timer)
3514 {
3515 	if (del_timer(timer))
3516 		__sock_put(sk);
3517 }
3518 EXPORT_SYMBOL(sk_stop_timer);
3519 
sk_stop_timer_sync(struct sock * sk,struct timer_list * timer)3520 void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer)
3521 {
3522 	if (del_timer_sync(timer))
3523 		__sock_put(sk);
3524 }
3525 EXPORT_SYMBOL(sk_stop_timer_sync);
3526 
sock_init_data_uid(struct socket * sock,struct sock * sk,kuid_t uid)3527 void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid)
3528 {
3529 	sk_init_common(sk);
3530 	sk->sk_send_head	=	NULL;
3531 
3532 	timer_setup(&sk->sk_timer, NULL, 0);
3533 
3534 	sk->sk_allocation	=	GFP_KERNEL;
3535 	sk->sk_rcvbuf		=	READ_ONCE(sysctl_rmem_default);
3536 	sk->sk_sndbuf		=	READ_ONCE(sysctl_wmem_default);
3537 	sk->sk_state		=	TCP_CLOSE;
3538 	sk->sk_use_task_frag	=	true;
3539 	sk_set_socket(sk, sock);
3540 
3541 	sock_set_flag(sk, SOCK_ZAPPED);
3542 
3543 	if (sock) {
3544 		sk->sk_type	=	sock->type;
3545 		RCU_INIT_POINTER(sk->sk_wq, &sock->wq);
3546 		sock->sk	=	sk;
3547 	} else {
3548 		RCU_INIT_POINTER(sk->sk_wq, NULL);
3549 	}
3550 	sk->sk_uid	=	uid;
3551 
3552 	sk->sk_state_change	=	sock_def_wakeup;
3553 	sk->sk_data_ready	=	sock_def_readable;
3554 	sk->sk_write_space	=	sock_def_write_space;
3555 	sk->sk_error_report	=	sock_def_error_report;
3556 	sk->sk_destruct		=	sock_def_destruct;
3557 
3558 	sk->sk_frag.page	=	NULL;
3559 	sk->sk_frag.offset	=	0;
3560 	sk->sk_peek_off		=	-1;
3561 
3562 	sk->sk_peer_pid 	=	NULL;
3563 	sk->sk_peer_cred	=	NULL;
3564 	spin_lock_init(&sk->sk_peer_lock);
3565 
3566 	sk->sk_write_pending	=	0;
3567 	sk->sk_rcvlowat		=	1;
3568 	sk->sk_rcvtimeo		=	MAX_SCHEDULE_TIMEOUT;
3569 	sk->sk_sndtimeo		=	MAX_SCHEDULE_TIMEOUT;
3570 
3571 	sk->sk_stamp = SK_DEFAULT_STAMP;
3572 #if BITS_PER_LONG==32
3573 	seqlock_init(&sk->sk_stamp_seq);
3574 #endif
3575 	atomic_set(&sk->sk_zckey, 0);
3576 
3577 #ifdef CONFIG_NET_RX_BUSY_POLL
3578 	sk->sk_napi_id		=	0;
3579 	sk->sk_ll_usec		=	READ_ONCE(sysctl_net_busy_read);
3580 #endif
3581 
3582 	sk->sk_max_pacing_rate = ~0UL;
3583 	sk->sk_pacing_rate = ~0UL;
3584 	WRITE_ONCE(sk->sk_pacing_shift, 10);
3585 	sk->sk_incoming_cpu = -1;
3586 
3587 	sk_rx_queue_clear(sk);
3588 	/*
3589 	 * Before updating sk_refcnt, we must commit prior changes to memory
3590 	 * (Documentation/RCU/rculist_nulls.rst for details)
3591 	 */
3592 	smp_wmb();
3593 	refcount_set(&sk->sk_refcnt, 1);
3594 	atomic_set(&sk->sk_drops, 0);
3595 }
3596 EXPORT_SYMBOL(sock_init_data_uid);
3597 
sock_init_data(struct socket * sock,struct sock * sk)3598 void sock_init_data(struct socket *sock, struct sock *sk)
3599 {
3600 	kuid_t uid = sock ?
3601 		SOCK_INODE(sock)->i_uid :
3602 		make_kuid(sock_net(sk)->user_ns, 0);
3603 
3604 	sock_init_data_uid(sock, sk, uid);
3605 }
3606 EXPORT_SYMBOL(sock_init_data);
3607 
lock_sock_nested(struct sock * sk,int subclass)3608 void lock_sock_nested(struct sock *sk, int subclass)
3609 {
3610 	/* The sk_lock has mutex_lock() semantics here. */
3611 	mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_);
3612 
3613 	might_sleep();
3614 	spin_lock_bh(&sk->sk_lock.slock);
3615 	if (sock_owned_by_user_nocheck(sk))
3616 		__lock_sock(sk);
3617 	sk->sk_lock.owned = 1;
3618 	spin_unlock_bh(&sk->sk_lock.slock);
3619 }
3620 EXPORT_SYMBOL(lock_sock_nested);
3621 
release_sock(struct sock * sk)3622 void release_sock(struct sock *sk)
3623 {
3624 	spin_lock_bh(&sk->sk_lock.slock);
3625 	if (sk->sk_backlog.tail)
3626 		__release_sock(sk);
3627 
3628 	if (sk->sk_prot->release_cb)
3629 		INDIRECT_CALL_INET_1(sk->sk_prot->release_cb,
3630 				     tcp_release_cb, sk);
3631 
3632 	sock_release_ownership(sk);
3633 	if (waitqueue_active(&sk->sk_lock.wq))
3634 		wake_up(&sk->sk_lock.wq);
3635 	spin_unlock_bh(&sk->sk_lock.slock);
3636 }
3637 EXPORT_SYMBOL(release_sock);
3638 
__lock_sock_fast(struct sock * sk)3639 bool __lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock)
3640 {
3641 	might_sleep();
3642 	spin_lock_bh(&sk->sk_lock.slock);
3643 
3644 	if (!sock_owned_by_user_nocheck(sk)) {
3645 		/*
3646 		 * Fast path return with bottom halves disabled and
3647 		 * sock::sk_lock.slock held.
3648 		 *
3649 		 * The 'mutex' is not contended and holding
3650 		 * sock::sk_lock.slock prevents all other lockers to
3651 		 * proceed so the corresponding unlock_sock_fast() can
3652 		 * avoid the slow path of release_sock() completely and
3653 		 * just release slock.
3654 		 *
3655 		 * From a semantical POV this is equivalent to 'acquiring'
3656 		 * the 'mutex', hence the corresponding lockdep
3657 		 * mutex_release() has to happen in the fast path of
3658 		 * unlock_sock_fast().
3659 		 */
3660 		return false;
3661 	}
3662 
3663 	__lock_sock(sk);
3664 	sk->sk_lock.owned = 1;
3665 	__acquire(&sk->sk_lock.slock);
3666 	spin_unlock_bh(&sk->sk_lock.slock);
3667 	return true;
3668 }
3669 EXPORT_SYMBOL(__lock_sock_fast);
3670 
sock_gettstamp(struct socket * sock,void __user * userstamp,bool timeval,bool time32)3671 int sock_gettstamp(struct socket *sock, void __user *userstamp,
3672 		   bool timeval, bool time32)
3673 {
3674 	struct sock *sk = sock->sk;
3675 	struct timespec64 ts;
3676 
3677 	sock_enable_timestamp(sk, SOCK_TIMESTAMP);
3678 	ts = ktime_to_timespec64(sock_read_timestamp(sk));
3679 	if (ts.tv_sec == -1)
3680 		return -ENOENT;
3681 	if (ts.tv_sec == 0) {
3682 		ktime_t kt = ktime_get_real();
3683 		sock_write_timestamp(sk, kt);
3684 		ts = ktime_to_timespec64(kt);
3685 	}
3686 
3687 	if (timeval)
3688 		ts.tv_nsec /= 1000;
3689 
3690 #ifdef CONFIG_COMPAT_32BIT_TIME
3691 	if (time32)
3692 		return put_old_timespec32(&ts, userstamp);
3693 #endif
3694 #ifdef CONFIG_SPARC64
3695 	/* beware of padding in sparc64 timeval */
3696 	if (timeval && !in_compat_syscall()) {
3697 		struct __kernel_old_timeval __user tv = {
3698 			.tv_sec = ts.tv_sec,
3699 			.tv_usec = ts.tv_nsec,
3700 		};
3701 		if (copy_to_user(userstamp, &tv, sizeof(tv)))
3702 			return -EFAULT;
3703 		return 0;
3704 	}
3705 #endif
3706 	return put_timespec64(&ts, userstamp);
3707 }
3708 EXPORT_SYMBOL(sock_gettstamp);
3709 
sock_enable_timestamp(struct sock * sk,enum sock_flags flag)3710 void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
3711 {
3712 	if (!sock_flag(sk, flag)) {
3713 		unsigned long previous_flags = sk->sk_flags;
3714 
3715 		sock_set_flag(sk, flag);
3716 		/*
3717 		 * we just set one of the two flags which require net
3718 		 * time stamping, but time stamping might have been on
3719 		 * already because of the other one
3720 		 */
3721 		if (sock_needs_netstamp(sk) &&
3722 		    !(previous_flags & SK_FLAGS_TIMESTAMP))
3723 			net_enable_timestamp();
3724 	}
3725 }
3726 
sock_recv_errqueue(struct sock * sk,struct msghdr * msg,int len,int level,int type)3727 int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
3728 		       int level, int type)
3729 {
3730 	struct sock_exterr_skb *serr;
3731 	struct sk_buff *skb;
3732 	int copied, err;
3733 
3734 	err = -EAGAIN;
3735 	skb = sock_dequeue_err_skb(sk);
3736 	if (skb == NULL)
3737 		goto out;
3738 
3739 	copied = skb->len;
3740 	if (copied > len) {
3741 		msg->msg_flags |= MSG_TRUNC;
3742 		copied = len;
3743 	}
3744 	err = skb_copy_datagram_msg(skb, 0, msg, copied);
3745 	if (err)
3746 		goto out_free_skb;
3747 
3748 	sock_recv_timestamp(msg, sk, skb);
3749 
3750 	serr = SKB_EXT_ERR(skb);
3751 	put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
3752 
3753 	msg->msg_flags |= MSG_ERRQUEUE;
3754 	err = copied;
3755 
3756 out_free_skb:
3757 	kfree_skb(skb);
3758 out:
3759 	return err;
3760 }
3761 EXPORT_SYMBOL(sock_recv_errqueue);
3762 
3763 /*
3764  *	Get a socket option on an socket.
3765  *
3766  *	FIX: POSIX 1003.1g is very ambiguous here. It states that
3767  *	asynchronous errors should be reported by getsockopt. We assume
3768  *	this means if you specify SO_ERROR (otherwise what is the point of it).
3769  */
sock_common_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)3770 int sock_common_getsockopt(struct socket *sock, int level, int optname,
3771 			   char __user *optval, int __user *optlen)
3772 {
3773 	struct sock *sk = sock->sk;
3774 
3775 	/* IPV6_ADDRFORM can change sk->sk_prot under us. */
3776 	return READ_ONCE(sk->sk_prot)->getsockopt(sk, level, optname, optval, optlen);
3777 }
3778 EXPORT_SYMBOL(sock_common_getsockopt);
3779 
sock_common_recvmsg(struct socket * sock,struct msghdr * msg,size_t size,int flags)3780 int sock_common_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
3781 			int flags)
3782 {
3783 	struct sock *sk = sock->sk;
3784 	int addr_len = 0;
3785 	int err;
3786 
3787 	err = sk->sk_prot->recvmsg(sk, msg, size, flags, &addr_len);
3788 	if (err >= 0)
3789 		msg->msg_namelen = addr_len;
3790 	return err;
3791 }
3792 EXPORT_SYMBOL(sock_common_recvmsg);
3793 
3794 /*
3795  *	Set socket options on an inet socket.
3796  */
sock_common_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)3797 int sock_common_setsockopt(struct socket *sock, int level, int optname,
3798 			   sockptr_t optval, unsigned int optlen)
3799 {
3800 	struct sock *sk = sock->sk;
3801 
3802 	/* IPV6_ADDRFORM can change sk->sk_prot under us. */
3803 	return READ_ONCE(sk->sk_prot)->setsockopt(sk, level, optname, optval, optlen);
3804 }
3805 EXPORT_SYMBOL(sock_common_setsockopt);
3806 
sk_common_release(struct sock * sk)3807 void sk_common_release(struct sock *sk)
3808 {
3809 	if (sk->sk_prot->destroy)
3810 		sk->sk_prot->destroy(sk);
3811 
3812 	/*
3813 	 * Observation: when sk_common_release is called, processes have
3814 	 * no access to socket. But net still has.
3815 	 * Step one, detach it from networking:
3816 	 *
3817 	 * A. Remove from hash tables.
3818 	 */
3819 
3820 	sk->sk_prot->unhash(sk);
3821 
3822 	if (sk->sk_socket)
3823 		sk->sk_socket->sk = NULL;
3824 
3825 	/*
3826 	 * In this point socket cannot receive new packets, but it is possible
3827 	 * that some packets are in flight because some CPU runs receiver and
3828 	 * did hash table lookup before we unhashed socket. They will achieve
3829 	 * receive queue and will be purged by socket destructor.
3830 	 *
3831 	 * Also we still have packets pending on receive queue and probably,
3832 	 * our own packets waiting in device queues. sock_destroy will drain
3833 	 * receive queue, but transmitted packets will delay socket destruction
3834 	 * until the last reference will be released.
3835 	 */
3836 
3837 	sock_orphan(sk);
3838 
3839 	xfrm_sk_free_policy(sk);
3840 
3841 	sock_put(sk);
3842 }
3843 EXPORT_SYMBOL(sk_common_release);
3844 
sk_get_meminfo(const struct sock * sk,u32 * mem)3845 void sk_get_meminfo(const struct sock *sk, u32 *mem)
3846 {
3847 	memset(mem, 0, sizeof(*mem) * SK_MEMINFO_VARS);
3848 
3849 	mem[SK_MEMINFO_RMEM_ALLOC] = sk_rmem_alloc_get(sk);
3850 	mem[SK_MEMINFO_RCVBUF] = READ_ONCE(sk->sk_rcvbuf);
3851 	mem[SK_MEMINFO_WMEM_ALLOC] = sk_wmem_alloc_get(sk);
3852 	mem[SK_MEMINFO_SNDBUF] = READ_ONCE(sk->sk_sndbuf);
3853 	mem[SK_MEMINFO_FWD_ALLOC] = sk_forward_alloc_get(sk);
3854 	mem[SK_MEMINFO_WMEM_QUEUED] = READ_ONCE(sk->sk_wmem_queued);
3855 	mem[SK_MEMINFO_OPTMEM] = atomic_read(&sk->sk_omem_alloc);
3856 	mem[SK_MEMINFO_BACKLOG] = READ_ONCE(sk->sk_backlog.len);
3857 	mem[SK_MEMINFO_DROPS] = atomic_read(&sk->sk_drops);
3858 }
3859 
3860 #ifdef CONFIG_PROC_FS
3861 static DECLARE_BITMAP(proto_inuse_idx, PROTO_INUSE_NR);
3862 
sock_prot_inuse_get(struct net * net,struct proto * prot)3863 int sock_prot_inuse_get(struct net *net, struct proto *prot)
3864 {
3865 	int cpu, idx = prot->inuse_idx;
3866 	int res = 0;
3867 
3868 	for_each_possible_cpu(cpu)
3869 		res += per_cpu_ptr(net->core.prot_inuse, cpu)->val[idx];
3870 
3871 	return res >= 0 ? res : 0;
3872 }
3873 EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
3874 
sock_inuse_get(struct net * net)3875 int sock_inuse_get(struct net *net)
3876 {
3877 	int cpu, res = 0;
3878 
3879 	for_each_possible_cpu(cpu)
3880 		res += per_cpu_ptr(net->core.prot_inuse, cpu)->all;
3881 
3882 	return res;
3883 }
3884 
3885 EXPORT_SYMBOL_GPL(sock_inuse_get);
3886 
sock_inuse_init_net(struct net * net)3887 static int __net_init sock_inuse_init_net(struct net *net)
3888 {
3889 	net->core.prot_inuse = alloc_percpu(struct prot_inuse);
3890 	if (net->core.prot_inuse == NULL)
3891 		return -ENOMEM;
3892 	return 0;
3893 }
3894 
sock_inuse_exit_net(struct net * net)3895 static void __net_exit sock_inuse_exit_net(struct net *net)
3896 {
3897 	free_percpu(net->core.prot_inuse);
3898 }
3899 
3900 static struct pernet_operations net_inuse_ops = {
3901 	.init = sock_inuse_init_net,
3902 	.exit = sock_inuse_exit_net,
3903 };
3904 
net_inuse_init(void)3905 static __init int net_inuse_init(void)
3906 {
3907 	if (register_pernet_subsys(&net_inuse_ops))
3908 		panic("Cannot initialize net inuse counters");
3909 
3910 	return 0;
3911 }
3912 
3913 core_initcall(net_inuse_init);
3914 
assign_proto_idx(struct proto * prot)3915 static int assign_proto_idx(struct proto *prot)
3916 {
3917 	prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
3918 
3919 	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
3920 		pr_err("PROTO_INUSE_NR exhausted\n");
3921 		return -ENOSPC;
3922 	}
3923 
3924 	set_bit(prot->inuse_idx, proto_inuse_idx);
3925 	return 0;
3926 }
3927 
release_proto_idx(struct proto * prot)3928 static void release_proto_idx(struct proto *prot)
3929 {
3930 	if (prot->inuse_idx != PROTO_INUSE_NR - 1)
3931 		clear_bit(prot->inuse_idx, proto_inuse_idx);
3932 }
3933 #else
assign_proto_idx(struct proto * prot)3934 static inline int assign_proto_idx(struct proto *prot)
3935 {
3936 	return 0;
3937 }
3938 
release_proto_idx(struct proto * prot)3939 static inline void release_proto_idx(struct proto *prot)
3940 {
3941 }
3942 
3943 #endif
3944 
tw_prot_cleanup(struct timewait_sock_ops * twsk_prot)3945 static void tw_prot_cleanup(struct timewait_sock_ops *twsk_prot)
3946 {
3947 	if (!twsk_prot)
3948 		return;
3949 	kfree(twsk_prot->twsk_slab_name);
3950 	twsk_prot->twsk_slab_name = NULL;
3951 	kmem_cache_destroy(twsk_prot->twsk_slab);
3952 	twsk_prot->twsk_slab = NULL;
3953 }
3954 
tw_prot_init(const struct proto * prot)3955 static int tw_prot_init(const struct proto *prot)
3956 {
3957 	struct timewait_sock_ops *twsk_prot = prot->twsk_prot;
3958 
3959 	if (!twsk_prot)
3960 		return 0;
3961 
3962 	twsk_prot->twsk_slab_name = kasprintf(GFP_KERNEL, "tw_sock_%s",
3963 					      prot->name);
3964 	if (!twsk_prot->twsk_slab_name)
3965 		return -ENOMEM;
3966 
3967 	twsk_prot->twsk_slab =
3968 		kmem_cache_create(twsk_prot->twsk_slab_name,
3969 				  twsk_prot->twsk_obj_size, 0,
3970 				  SLAB_ACCOUNT | prot->slab_flags,
3971 				  NULL);
3972 	if (!twsk_prot->twsk_slab) {
3973 		pr_crit("%s: Can't create timewait sock SLAB cache!\n",
3974 			prot->name);
3975 		return -ENOMEM;
3976 	}
3977 
3978 	return 0;
3979 }
3980 
req_prot_cleanup(struct request_sock_ops * rsk_prot)3981 static void req_prot_cleanup(struct request_sock_ops *rsk_prot)
3982 {
3983 	if (!rsk_prot)
3984 		return;
3985 	kfree(rsk_prot->slab_name);
3986 	rsk_prot->slab_name = NULL;
3987 	kmem_cache_destroy(rsk_prot->slab);
3988 	rsk_prot->slab = NULL;
3989 }
3990 
req_prot_init(const struct proto * prot)3991 static int req_prot_init(const struct proto *prot)
3992 {
3993 	struct request_sock_ops *rsk_prot = prot->rsk_prot;
3994 
3995 	if (!rsk_prot)
3996 		return 0;
3997 
3998 	rsk_prot->slab_name = kasprintf(GFP_KERNEL, "request_sock_%s",
3999 					prot->name);
4000 	if (!rsk_prot->slab_name)
4001 		return -ENOMEM;
4002 
4003 	rsk_prot->slab = kmem_cache_create(rsk_prot->slab_name,
4004 					   rsk_prot->obj_size, 0,
4005 					   SLAB_ACCOUNT | prot->slab_flags,
4006 					   NULL);
4007 
4008 	if (!rsk_prot->slab) {
4009 		pr_crit("%s: Can't create request sock SLAB cache!\n",
4010 			prot->name);
4011 		return -ENOMEM;
4012 	}
4013 	return 0;
4014 }
4015 
proto_register(struct proto * prot,int alloc_slab)4016 int proto_register(struct proto *prot, int alloc_slab)
4017 {
4018 	int ret = -ENOBUFS;
4019 
4020 	if (prot->memory_allocated && !prot->sysctl_mem) {
4021 		pr_err("%s: missing sysctl_mem\n", prot->name);
4022 		return -EINVAL;
4023 	}
4024 	if (prot->memory_allocated && !prot->per_cpu_fw_alloc) {
4025 		pr_err("%s: missing per_cpu_fw_alloc\n", prot->name);
4026 		return -EINVAL;
4027 	}
4028 	if (alloc_slab) {
4029 		prot->slab = kmem_cache_create_usercopy(prot->name,
4030 					prot->obj_size, 0,
4031 					SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT |
4032 					prot->slab_flags,
4033 					prot->useroffset, prot->usersize,
4034 					NULL);
4035 
4036 		if (prot->slab == NULL) {
4037 			pr_crit("%s: Can't create sock SLAB cache!\n",
4038 				prot->name);
4039 			goto out;
4040 		}
4041 
4042 		if (req_prot_init(prot))
4043 			goto out_free_request_sock_slab;
4044 
4045 		if (tw_prot_init(prot))
4046 			goto out_free_timewait_sock_slab;
4047 	}
4048 
4049 	mutex_lock(&proto_list_mutex);
4050 	ret = assign_proto_idx(prot);
4051 	if (ret) {
4052 		mutex_unlock(&proto_list_mutex);
4053 		goto out_free_timewait_sock_slab;
4054 	}
4055 	list_add(&prot->node, &proto_list);
4056 	mutex_unlock(&proto_list_mutex);
4057 	return ret;
4058 
4059 out_free_timewait_sock_slab:
4060 	if (alloc_slab)
4061 		tw_prot_cleanup(prot->twsk_prot);
4062 out_free_request_sock_slab:
4063 	if (alloc_slab) {
4064 		req_prot_cleanup(prot->rsk_prot);
4065 
4066 		kmem_cache_destroy(prot->slab);
4067 		prot->slab = NULL;
4068 	}
4069 out:
4070 	return ret;
4071 }
4072 EXPORT_SYMBOL(proto_register);
4073 
proto_unregister(struct proto * prot)4074 void proto_unregister(struct proto *prot)
4075 {
4076 	mutex_lock(&proto_list_mutex);
4077 	release_proto_idx(prot);
4078 	list_del(&prot->node);
4079 	mutex_unlock(&proto_list_mutex);
4080 
4081 	kmem_cache_destroy(prot->slab);
4082 	prot->slab = NULL;
4083 
4084 	req_prot_cleanup(prot->rsk_prot);
4085 	tw_prot_cleanup(prot->twsk_prot);
4086 }
4087 EXPORT_SYMBOL(proto_unregister);
4088 
sock_load_diag_module(int family,int protocol)4089 int sock_load_diag_module(int family, int protocol)
4090 {
4091 	if (!protocol) {
4092 		if (!sock_is_registered(family))
4093 			return -ENOENT;
4094 
4095 		return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
4096 				      NETLINK_SOCK_DIAG, family);
4097 	}
4098 
4099 #ifdef CONFIG_INET
4100 	if (family == AF_INET &&
4101 	    protocol != IPPROTO_RAW &&
4102 	    protocol < MAX_INET_PROTOS &&
4103 	    !rcu_access_pointer(inet_protos[protocol]))
4104 		return -ENOENT;
4105 #endif
4106 
4107 	return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
4108 			      NETLINK_SOCK_DIAG, family, protocol);
4109 }
4110 EXPORT_SYMBOL(sock_load_diag_module);
4111 
4112 #ifdef CONFIG_PROC_FS
proto_seq_start(struct seq_file * seq,loff_t * pos)4113 static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
4114 	__acquires(proto_list_mutex)
4115 {
4116 	mutex_lock(&proto_list_mutex);
4117 	return seq_list_start_head(&proto_list, *pos);
4118 }
4119 
proto_seq_next(struct seq_file * seq,void * v,loff_t * pos)4120 static void *proto_seq_next(struct seq_file *seq, void *v, loff_t *pos)
4121 {
4122 	return seq_list_next(v, &proto_list, pos);
4123 }
4124 
proto_seq_stop(struct seq_file * seq,void * v)4125 static void proto_seq_stop(struct seq_file *seq, void *v)
4126 	__releases(proto_list_mutex)
4127 {
4128 	mutex_unlock(&proto_list_mutex);
4129 }
4130 
proto_method_implemented(const void * method)4131 static char proto_method_implemented(const void *method)
4132 {
4133 	return method == NULL ? 'n' : 'y';
4134 }
sock_prot_memory_allocated(struct proto * proto)4135 static long sock_prot_memory_allocated(struct proto *proto)
4136 {
4137 	return proto->memory_allocated != NULL ? proto_memory_allocated(proto) : -1L;
4138 }
4139 
sock_prot_memory_pressure(struct proto * proto)4140 static const char *sock_prot_memory_pressure(struct proto *proto)
4141 {
4142 	return proto->memory_pressure != NULL ?
4143 	proto_memory_pressure(proto) ? "yes" : "no" : "NI";
4144 }
4145 
proto_seq_printf(struct seq_file * seq,struct proto * proto)4146 static void proto_seq_printf(struct seq_file *seq, struct proto *proto)
4147 {
4148 
4149 	seq_printf(seq, "%-9s %4u %6d  %6ld   %-3s %6u   %-3s  %-10s "
4150 			"%2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c\n",
4151 		   proto->name,
4152 		   proto->obj_size,
4153 		   sock_prot_inuse_get(seq_file_net(seq), proto),
4154 		   sock_prot_memory_allocated(proto),
4155 		   sock_prot_memory_pressure(proto),
4156 		   proto->max_header,
4157 		   proto->slab == NULL ? "no" : "yes",
4158 		   module_name(proto->owner),
4159 		   proto_method_implemented(proto->close),
4160 		   proto_method_implemented(proto->connect),
4161 		   proto_method_implemented(proto->disconnect),
4162 		   proto_method_implemented(proto->accept),
4163 		   proto_method_implemented(proto->ioctl),
4164 		   proto_method_implemented(proto->init),
4165 		   proto_method_implemented(proto->destroy),
4166 		   proto_method_implemented(proto->shutdown),
4167 		   proto_method_implemented(proto->setsockopt),
4168 		   proto_method_implemented(proto->getsockopt),
4169 		   proto_method_implemented(proto->sendmsg),
4170 		   proto_method_implemented(proto->recvmsg),
4171 		   proto_method_implemented(proto->bind),
4172 		   proto_method_implemented(proto->backlog_rcv),
4173 		   proto_method_implemented(proto->hash),
4174 		   proto_method_implemented(proto->unhash),
4175 		   proto_method_implemented(proto->get_port),
4176 		   proto_method_implemented(proto->enter_memory_pressure));
4177 }
4178 
proto_seq_show(struct seq_file * seq,void * v)4179 static int proto_seq_show(struct seq_file *seq, void *v)
4180 {
4181 	if (v == &proto_list)
4182 		seq_printf(seq, "%-9s %-4s %-8s %-6s %-5s %-7s %-4s %-10s %s",
4183 			   "protocol",
4184 			   "size",
4185 			   "sockets",
4186 			   "memory",
4187 			   "press",
4188 			   "maxhdr",
4189 			   "slab",
4190 			   "module",
4191 			   "cl co di ac io in de sh ss gs se re bi br ha uh gp em\n");
4192 	else
4193 		proto_seq_printf(seq, list_entry(v, struct proto, node));
4194 	return 0;
4195 }
4196 
4197 static const struct seq_operations proto_seq_ops = {
4198 	.start  = proto_seq_start,
4199 	.next   = proto_seq_next,
4200 	.stop   = proto_seq_stop,
4201 	.show   = proto_seq_show,
4202 };
4203 
proto_init_net(struct net * net)4204 static __net_init int proto_init_net(struct net *net)
4205 {
4206 	if (!proc_create_net("protocols", 0444, net->proc_net, &proto_seq_ops,
4207 			sizeof(struct seq_net_private)))
4208 		return -ENOMEM;
4209 
4210 	return 0;
4211 }
4212 
proto_exit_net(struct net * net)4213 static __net_exit void proto_exit_net(struct net *net)
4214 {
4215 	remove_proc_entry("protocols", net->proc_net);
4216 }
4217 
4218 
4219 static __net_initdata struct pernet_operations proto_net_ops = {
4220 	.init = proto_init_net,
4221 	.exit = proto_exit_net,
4222 };
4223 
proto_init(void)4224 static int __init proto_init(void)
4225 {
4226 	return register_pernet_subsys(&proto_net_ops);
4227 }
4228 
4229 subsys_initcall(proto_init);
4230 
4231 #endif /* PROC_FS */
4232 
4233 #ifdef CONFIG_NET_RX_BUSY_POLL
sk_busy_loop_end(void * p,unsigned long start_time)4234 bool sk_busy_loop_end(void *p, unsigned long start_time)
4235 {
4236 	struct sock *sk = p;
4237 
4238 	if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
4239 		return true;
4240 
4241 	if (sk_is_udp(sk) &&
4242 	    !skb_queue_empty_lockless(&udp_sk(sk)->reader_queue))
4243 		return true;
4244 
4245 	return sk_busy_loop_timeout(sk, start_time);
4246 }
4247 EXPORT_SYMBOL(sk_busy_loop_end);
4248 #endif /* CONFIG_NET_RX_BUSY_POLL */
4249 
sock_bind_add(struct sock * sk,struct sockaddr * addr,int addr_len)4250 int sock_bind_add(struct sock *sk, struct sockaddr *addr, int addr_len)
4251 {
4252 	if (!sk->sk_prot->bind_add)
4253 		return -EOPNOTSUPP;
4254 	return sk->sk_prot->bind_add(sk, addr, addr_len);
4255 }
4256 EXPORT_SYMBOL(sock_bind_add);
4257 
4258 /* Copy 'size' bytes from userspace and return `size` back to userspace */
sock_ioctl_inout(struct sock * sk,unsigned int cmd,void __user * arg,void * karg,size_t size)4259 int sock_ioctl_inout(struct sock *sk, unsigned int cmd,
4260 		     void __user *arg, void *karg, size_t size)
4261 {
4262 	int ret;
4263 
4264 	if (copy_from_user(karg, arg, size))
4265 		return -EFAULT;
4266 
4267 	ret = READ_ONCE(sk->sk_prot)->ioctl(sk, cmd, karg);
4268 	if (ret)
4269 		return ret;
4270 
4271 	if (copy_to_user(arg, karg, size))
4272 		return -EFAULT;
4273 
4274 	return 0;
4275 }
4276 EXPORT_SYMBOL(sock_ioctl_inout);
4277 
4278 /* This is the most common ioctl prep function, where the result (4 bytes) is
4279  * copied back to userspace if the ioctl() returns successfully. No input is
4280  * copied from userspace as input argument.
4281  */
sock_ioctl_out(struct sock * sk,unsigned int cmd,void __user * arg)4282 static int sock_ioctl_out(struct sock *sk, unsigned int cmd, void __user *arg)
4283 {
4284 	int ret, karg = 0;
4285 
4286 	ret = READ_ONCE(sk->sk_prot)->ioctl(sk, cmd, &karg);
4287 	if (ret)
4288 		return ret;
4289 
4290 	return put_user(karg, (int __user *)arg);
4291 }
4292 
4293 /* A wrapper around sock ioctls, which copies the data from userspace
4294  * (depending on the protocol/ioctl), and copies back the result to userspace.
4295  * The main motivation for this function is to pass kernel memory to the
4296  * protocol ioctl callbacks, instead of userspace memory.
4297  */
sk_ioctl(struct sock * sk,unsigned int cmd,void __user * arg)4298 int sk_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
4299 {
4300 	int rc = 1;
4301 
4302 	if (sk->sk_type == SOCK_RAW && sk->sk_family == AF_INET)
4303 		rc = ipmr_sk_ioctl(sk, cmd, arg);
4304 	else if (sk->sk_type == SOCK_RAW && sk->sk_family == AF_INET6)
4305 		rc = ip6mr_sk_ioctl(sk, cmd, arg);
4306 	else if (sk_is_phonet(sk))
4307 		rc = phonet_sk_ioctl(sk, cmd, arg);
4308 
4309 	/* If ioctl was processed, returns its value */
4310 	if (rc <= 0)
4311 		return rc;
4312 
4313 	/* Otherwise call the default handler */
4314 	return sock_ioctl_out(sk, cmd, arg);
4315 }
4316 EXPORT_SYMBOL(sk_ioctl);
4317 
sock_struct_check(void)4318 static int __init sock_struct_check(void)
4319 {
4320 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rx, sk_drops);
4321 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rx, sk_peek_off);
4322 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rx, sk_error_queue);
4323 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rx, sk_receive_queue);
4324 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rx, sk_backlog);
4325 
4326 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_rx_dst);
4327 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_rx_dst_ifindex);
4328 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_rx_dst_cookie);
4329 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_rcvbuf);
4330 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_filter);
4331 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_wq);
4332 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_data_ready);
4333 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_rcvtimeo);
4334 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rx, sk_rcvlowat);
4335 
4336 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rxtx, sk_err);
4337 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rxtx, sk_socket);
4338 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_rxtx, sk_memcg);
4339 
4340 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rxtx, sk_lock);
4341 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rxtx, sk_reserved_mem);
4342 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rxtx, sk_forward_alloc);
4343 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_rxtx, sk_tsflags);
4344 
4345 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_omem_alloc);
4346 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_omem_alloc);
4347 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_sndbuf);
4348 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_wmem_queued);
4349 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_wmem_alloc);
4350 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_tsq_flags);
4351 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_send_head);
4352 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_write_queue);
4353 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_write_pending);
4354 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_dst_pending_confirm);
4355 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_pacing_status);
4356 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_frag);
4357 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_timer);
4358 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_pacing_rate);
4359 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_zckey);
4360 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_write_tx, sk_tskey);
4361 
4362 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_max_pacing_rate);
4363 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_sndtimeo);
4364 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_priority);
4365 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_mark);
4366 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_dst_cache);
4367 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_route_caps);
4368 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_gso_type);
4369 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_gso_max_size);
4370 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_allocation);
4371 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_txhash);
4372 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_gso_max_segs);
4373 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_pacing_shift);
4374 	CACHELINE_ASSERT_GROUP_MEMBER(struct sock, sock_read_tx, sk_use_task_frag);
4375 	return 0;
4376 }
4377 
4378 core_initcall(sock_struct_check);
4379