xref: /linux/net/sctp/socket.c (revision 140eb5227767c6754742020a16d2691222b9c19b)
1 /* SCTP kernel implementation
2  * (C) Copyright IBM Corp. 2001, 2004
3  * Copyright (c) 1999-2000 Cisco, Inc.
4  * Copyright (c) 1999-2001 Motorola, Inc.
5  * Copyright (c) 2001-2003 Intel Corp.
6  * Copyright (c) 2001-2002 Nokia, Inc.
7  * Copyright (c) 2001 La Monte H.P. Yarroll
8  *
9  * This file is part of the SCTP kernel implementation
10  *
11  * These functions interface with the sockets layer to implement the
12  * SCTP Extensions for the Sockets API.
13  *
14  * Note that the descriptions from the specification are USER level
15  * functions--this file is the functions which populate the struct proto
16  * for SCTP which is the BOTTOM of the sockets interface.
17  *
18  * This SCTP implementation is free software;
19  * you can redistribute it and/or modify it under the terms of
20  * the GNU General Public License as published by
21  * the Free Software Foundation; either version 2, or (at your option)
22  * any later version.
23  *
24  * This SCTP implementation is distributed in the hope that it
25  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
26  *                 ************************
27  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28  * See the GNU General Public License for more details.
29  *
30  * You should have received a copy of the GNU General Public License
31  * along with GNU CC; see the file COPYING.  If not, see
32  * <http://www.gnu.org/licenses/>.
33  *
34  * Please send any bug reports or fixes you make to the
35  * email address(es):
36  *    lksctp developers <linux-sctp@vger.kernel.org>
37  *
38  * Written or modified by:
39  *    La Monte H.P. Yarroll <piggy@acm.org>
40  *    Narasimha Budihal     <narsi@refcode.org>
41  *    Karl Knutson          <karl@athena.chicago.il.us>
42  *    Jon Grimm             <jgrimm@us.ibm.com>
43  *    Xingang Guo           <xingang.guo@intel.com>
44  *    Daisy Chang           <daisyc@us.ibm.com>
45  *    Sridhar Samudrala     <samudrala@us.ibm.com>
46  *    Inaky Perez-Gonzalez  <inaky.gonzalez@intel.com>
47  *    Ardelle Fan	    <ardelle.fan@intel.com>
48  *    Ryan Layer	    <rmlayer@us.ibm.com>
49  *    Anup Pemmaiah         <pemmaiah@cc.usu.edu>
50  *    Kevin Gao             <kevin.gao@intel.com>
51  */
52 
53 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
54 
55 #include <crypto/hash.h>
56 #include <linux/types.h>
57 #include <linux/kernel.h>
58 #include <linux/wait.h>
59 #include <linux/time.h>
60 #include <linux/sched/signal.h>
61 #include <linux/ip.h>
62 #include <linux/capability.h>
63 #include <linux/fcntl.h>
64 #include <linux/poll.h>
65 #include <linux/init.h>
66 #include <linux/slab.h>
67 #include <linux/file.h>
68 #include <linux/compat.h>
69 
70 #include <net/ip.h>
71 #include <net/icmp.h>
72 #include <net/route.h>
73 #include <net/ipv6.h>
74 #include <net/inet_common.h>
75 #include <net/busy_poll.h>
76 
77 #include <linux/socket.h> /* for sa_family_t */
78 #include <linux/export.h>
79 #include <net/sock.h>
80 #include <net/sctp/sctp.h>
81 #include <net/sctp/sm.h>
82 #include <net/sctp/stream_sched.h>
83 
84 /* Forward declarations for internal helper functions. */
85 static int sctp_writeable(struct sock *sk);
86 static void sctp_wfree(struct sk_buff *skb);
87 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
88 				size_t msg_len);
89 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
90 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
91 static int sctp_wait_for_accept(struct sock *sk, long timeo);
92 static void sctp_wait_for_close(struct sock *sk, long timeo);
93 static void sctp_destruct_sock(struct sock *sk);
94 static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
95 					union sctp_addr *addr, int len);
96 static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
97 static int sctp_bindx_rem(struct sock *, struct sockaddr *, int);
98 static int sctp_send_asconf_add_ip(struct sock *, struct sockaddr *, int);
99 static int sctp_send_asconf_del_ip(struct sock *, struct sockaddr *, int);
100 static int sctp_send_asconf(struct sctp_association *asoc,
101 			    struct sctp_chunk *chunk);
102 static int sctp_do_bind(struct sock *, union sctp_addr *, int);
103 static int sctp_autobind(struct sock *sk);
104 static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
105 			      struct sctp_association *assoc,
106 			      enum sctp_socket_type type);
107 
108 static unsigned long sctp_memory_pressure;
109 static atomic_long_t sctp_memory_allocated;
110 struct percpu_counter sctp_sockets_allocated;
111 
112 static void sctp_enter_memory_pressure(struct sock *sk)
113 {
114 	sctp_memory_pressure = 1;
115 }
116 
117 
118 /* Get the sndbuf space available at the time on the association.  */
119 static inline int sctp_wspace(struct sctp_association *asoc)
120 {
121 	int amt;
122 
123 	if (asoc->ep->sndbuf_policy)
124 		amt = asoc->sndbuf_used;
125 	else
126 		amt = sk_wmem_alloc_get(asoc->base.sk);
127 
128 	if (amt >= asoc->base.sk->sk_sndbuf) {
129 		if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
130 			amt = 0;
131 		else {
132 			amt = sk_stream_wspace(asoc->base.sk);
133 			if (amt < 0)
134 				amt = 0;
135 		}
136 	} else {
137 		amt = asoc->base.sk->sk_sndbuf - amt;
138 	}
139 	return amt;
140 }
141 
142 /* Increment the used sndbuf space count of the corresponding association by
143  * the size of the outgoing data chunk.
144  * Also, set the skb destructor for sndbuf accounting later.
145  *
146  * Since it is always 1-1 between chunk and skb, and also a new skb is always
147  * allocated for chunk bundling in sctp_packet_transmit(), we can use the
148  * destructor in the data chunk skb for the purpose of the sndbuf space
149  * tracking.
150  */
151 static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
152 {
153 	struct sctp_association *asoc = chunk->asoc;
154 	struct sock *sk = asoc->base.sk;
155 
156 	/* The sndbuf space is tracked per association.  */
157 	sctp_association_hold(asoc);
158 
159 	skb_set_owner_w(chunk->skb, sk);
160 
161 	chunk->skb->destructor = sctp_wfree;
162 	/* Save the chunk pointer in skb for sctp_wfree to use later.  */
163 	skb_shinfo(chunk->skb)->destructor_arg = chunk;
164 
165 	asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
166 				sizeof(struct sk_buff) +
167 				sizeof(struct sctp_chunk);
168 
169 	refcount_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
170 	sk->sk_wmem_queued += chunk->skb->truesize;
171 	sk_mem_charge(sk, chunk->skb->truesize);
172 }
173 
174 static void sctp_clear_owner_w(struct sctp_chunk *chunk)
175 {
176 	skb_orphan(chunk->skb);
177 }
178 
179 static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
180 				       void (*cb)(struct sctp_chunk *))
181 
182 {
183 	struct sctp_outq *q = &asoc->outqueue;
184 	struct sctp_transport *t;
185 	struct sctp_chunk *chunk;
186 
187 	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
188 		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
189 			cb(chunk);
190 
191 	list_for_each_entry(chunk, &q->retransmit, transmitted_list)
192 		cb(chunk);
193 
194 	list_for_each_entry(chunk, &q->sacked, transmitted_list)
195 		cb(chunk);
196 
197 	list_for_each_entry(chunk, &q->abandoned, transmitted_list)
198 		cb(chunk);
199 
200 	list_for_each_entry(chunk, &q->out_chunk_list, list)
201 		cb(chunk);
202 }
203 
204 /* Verify that this is a valid address. */
205 static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
206 				   int len)
207 {
208 	struct sctp_af *af;
209 
210 	/* Verify basic sockaddr. */
211 	af = sctp_sockaddr_af(sctp_sk(sk), addr, len);
212 	if (!af)
213 		return -EINVAL;
214 
215 	/* Is this a valid SCTP address?  */
216 	if (!af->addr_valid(addr, sctp_sk(sk), NULL))
217 		return -EINVAL;
218 
219 	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
220 		return -EINVAL;
221 
222 	return 0;
223 }
224 
225 /* Look up the association by its id.  If this is not a UDP-style
226  * socket, the ID field is always ignored.
227  */
228 struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id)
229 {
230 	struct sctp_association *asoc = NULL;
231 
232 	/* If this is not a UDP-style socket, assoc id should be ignored. */
233 	if (!sctp_style(sk, UDP)) {
234 		/* Return NULL if the socket state is not ESTABLISHED. It
235 		 * could be a TCP-style listening socket or a socket which
236 		 * hasn't yet called connect() to establish an association.
237 		 */
238 		if (!sctp_sstate(sk, ESTABLISHED) && !sctp_sstate(sk, CLOSING))
239 			return NULL;
240 
241 		/* Get the first and the only association from the list. */
242 		if (!list_empty(&sctp_sk(sk)->ep->asocs))
243 			asoc = list_entry(sctp_sk(sk)->ep->asocs.next,
244 					  struct sctp_association, asocs);
245 		return asoc;
246 	}
247 
248 	/* Otherwise this is a UDP-style socket. */
249 	if (!id || (id == (sctp_assoc_t)-1))
250 		return NULL;
251 
252 	spin_lock_bh(&sctp_assocs_id_lock);
253 	asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id);
254 	spin_unlock_bh(&sctp_assocs_id_lock);
255 
256 	if (!asoc || (asoc->base.sk != sk) || asoc->base.dead)
257 		return NULL;
258 
259 	return asoc;
260 }
261 
262 /* Look up the transport from an address and an assoc id. If both address and
263  * id are specified, the associations matching the address and the id should be
264  * the same.
265  */
266 static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
267 					      struct sockaddr_storage *addr,
268 					      sctp_assoc_t id)
269 {
270 	struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
271 	struct sctp_af *af = sctp_get_af_specific(addr->ss_family);
272 	union sctp_addr *laddr = (union sctp_addr *)addr;
273 	struct sctp_transport *transport;
274 
275 	if (!af || sctp_verify_addr(sk, laddr, af->sockaddr_len))
276 		return NULL;
277 
278 	addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
279 					       laddr,
280 					       &transport);
281 
282 	if (!addr_asoc)
283 		return NULL;
284 
285 	id_asoc = sctp_id2assoc(sk, id);
286 	if (id_asoc && (id_asoc != addr_asoc))
287 		return NULL;
288 
289 	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
290 						(union sctp_addr *)addr);
291 
292 	return transport;
293 }
294 
295 /* API 3.1.2 bind() - UDP Style Syntax
296  * The syntax of bind() is,
297  *
298  *   ret = bind(int sd, struct sockaddr *addr, int addrlen);
299  *
300  *   sd      - the socket descriptor returned by socket().
301  *   addr    - the address structure (struct sockaddr_in or struct
302  *             sockaddr_in6 [RFC 2553]),
303  *   addr_len - the size of the address structure.
304  */
305 static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
306 {
307 	int retval = 0;
308 
309 	lock_sock(sk);
310 
311 	pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
312 		 addr, addr_len);
313 
314 	/* Disallow binding twice. */
315 	if (!sctp_sk(sk)->ep->base.bind_addr.port)
316 		retval = sctp_do_bind(sk, (union sctp_addr *)addr,
317 				      addr_len);
318 	else
319 		retval = -EINVAL;
320 
321 	release_sock(sk);
322 
323 	return retval;
324 }
325 
326 static long sctp_get_port_local(struct sock *, union sctp_addr *);
327 
328 /* Verify this is a valid sockaddr. */
329 static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
330 					union sctp_addr *addr, int len)
331 {
332 	struct sctp_af *af;
333 
334 	/* Check minimum size.  */
335 	if (len < sizeof (struct sockaddr))
336 		return NULL;
337 
338 	if (!opt->pf->af_supported(addr->sa.sa_family, opt))
339 		return NULL;
340 
341 	/* V4 mapped address are really of AF_INET family */
342 	if (addr->sa.sa_family == AF_INET6 &&
343 	    ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
344 	    !opt->pf->af_supported(AF_INET, opt))
345 		return NULL;
346 
347 	/* If we get this far, af is valid. */
348 	af = sctp_get_af_specific(addr->sa.sa_family);
349 
350 	if (len < af->sockaddr_len)
351 		return NULL;
352 
353 	return af;
354 }
355 
356 /* Bind a local address either to an endpoint or to an association.  */
357 static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
358 {
359 	struct net *net = sock_net(sk);
360 	struct sctp_sock *sp = sctp_sk(sk);
361 	struct sctp_endpoint *ep = sp->ep;
362 	struct sctp_bind_addr *bp = &ep->base.bind_addr;
363 	struct sctp_af *af;
364 	unsigned short snum;
365 	int ret = 0;
366 
367 	/* Common sockaddr verification. */
368 	af = sctp_sockaddr_af(sp, addr, len);
369 	if (!af) {
370 		pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
371 			 __func__, sk, addr, len);
372 		return -EINVAL;
373 	}
374 
375 	snum = ntohs(addr->v4.sin_port);
376 
377 	pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
378 		 __func__, sk, &addr->sa, bp->port, snum, len);
379 
380 	/* PF specific bind() address verification. */
381 	if (!sp->pf->bind_verify(sp, addr))
382 		return -EADDRNOTAVAIL;
383 
384 	/* We must either be unbound, or bind to the same port.
385 	 * It's OK to allow 0 ports if we are already bound.
386 	 * We'll just inhert an already bound port in this case
387 	 */
388 	if (bp->port) {
389 		if (!snum)
390 			snum = bp->port;
391 		else if (snum != bp->port) {
392 			pr_debug("%s: new port %d doesn't match existing port "
393 				 "%d\n", __func__, snum, bp->port);
394 			return -EINVAL;
395 		}
396 	}
397 
398 	if (snum && snum < inet_prot_sock(net) &&
399 	    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
400 		return -EACCES;
401 
402 	/* See if the address matches any of the addresses we may have
403 	 * already bound before checking against other endpoints.
404 	 */
405 	if (sctp_bind_addr_match(bp, addr, sp))
406 		return -EINVAL;
407 
408 	/* Make sure we are allowed to bind here.
409 	 * The function sctp_get_port_local() does duplicate address
410 	 * detection.
411 	 */
412 	addr->v4.sin_port = htons(snum);
413 	if ((ret = sctp_get_port_local(sk, addr))) {
414 		return -EADDRINUSE;
415 	}
416 
417 	/* Refresh ephemeral port.  */
418 	if (!bp->port)
419 		bp->port = inet_sk(sk)->inet_num;
420 
421 	/* Add the address to the bind address list.
422 	 * Use GFP_ATOMIC since BHs will be disabled.
423 	 */
424 	ret = sctp_add_bind_addr(bp, addr, af->sockaddr_len,
425 				 SCTP_ADDR_SRC, GFP_ATOMIC);
426 
427 	/* Copy back into socket for getsockname() use. */
428 	if (!ret) {
429 		inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
430 		sp->pf->to_sk_saddr(addr, sk);
431 	}
432 
433 	return ret;
434 }
435 
436  /* ADDIP Section 4.1.1 Congestion Control of ASCONF Chunks
437  *
438  * R1) One and only one ASCONF Chunk MAY be in transit and unacknowledged
439  * at any one time.  If a sender, after sending an ASCONF chunk, decides
440  * it needs to transfer another ASCONF Chunk, it MUST wait until the
441  * ASCONF-ACK Chunk returns from the previous ASCONF Chunk before sending a
442  * subsequent ASCONF. Note this restriction binds each side, so at any
443  * time two ASCONF may be in-transit on any given association (one sent
444  * from each endpoint).
445  */
446 static int sctp_send_asconf(struct sctp_association *asoc,
447 			    struct sctp_chunk *chunk)
448 {
449 	struct net 	*net = sock_net(asoc->base.sk);
450 	int		retval = 0;
451 
452 	/* If there is an outstanding ASCONF chunk, queue it for later
453 	 * transmission.
454 	 */
455 	if (asoc->addip_last_asconf) {
456 		list_add_tail(&chunk->list, &asoc->addip_chunk_list);
457 		goto out;
458 	}
459 
460 	/* Hold the chunk until an ASCONF_ACK is received. */
461 	sctp_chunk_hold(chunk);
462 	retval = sctp_primitive_ASCONF(net, asoc, chunk);
463 	if (retval)
464 		sctp_chunk_free(chunk);
465 	else
466 		asoc->addip_last_asconf = chunk;
467 
468 out:
469 	return retval;
470 }
471 
472 /* Add a list of addresses as bind addresses to local endpoint or
473  * association.
474  *
475  * Basically run through each address specified in the addrs/addrcnt
476  * array/length pair, determine if it is IPv6 or IPv4 and call
477  * sctp_do_bind() on it.
478  *
479  * If any of them fails, then the operation will be reversed and the
480  * ones that were added will be removed.
481  *
482  * Only sctp_setsockopt_bindx() is supposed to call this function.
483  */
484 static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
485 {
486 	int cnt;
487 	int retval = 0;
488 	void *addr_buf;
489 	struct sockaddr *sa_addr;
490 	struct sctp_af *af;
491 
492 	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
493 		 addrs, addrcnt);
494 
495 	addr_buf = addrs;
496 	for (cnt = 0; cnt < addrcnt; cnt++) {
497 		/* The list may contain either IPv4 or IPv6 address;
498 		 * determine the address length for walking thru the list.
499 		 */
500 		sa_addr = addr_buf;
501 		af = sctp_get_af_specific(sa_addr->sa_family);
502 		if (!af) {
503 			retval = -EINVAL;
504 			goto err_bindx_add;
505 		}
506 
507 		retval = sctp_do_bind(sk, (union sctp_addr *)sa_addr,
508 				      af->sockaddr_len);
509 
510 		addr_buf += af->sockaddr_len;
511 
512 err_bindx_add:
513 		if (retval < 0) {
514 			/* Failed. Cleanup the ones that have been added */
515 			if (cnt > 0)
516 				sctp_bindx_rem(sk, addrs, cnt);
517 			return retval;
518 		}
519 	}
520 
521 	return retval;
522 }
523 
524 /* Send an ASCONF chunk with Add IP address parameters to all the peers of the
525  * associations that are part of the endpoint indicating that a list of local
526  * addresses are added to the endpoint.
527  *
528  * If any of the addresses is already in the bind address list of the
529  * association, we do not send the chunk for that association.  But it will not
530  * affect other associations.
531  *
532  * Only sctp_setsockopt_bindx() is supposed to call this function.
533  */
534 static int sctp_send_asconf_add_ip(struct sock		*sk,
535 				   struct sockaddr	*addrs,
536 				   int 			addrcnt)
537 {
538 	struct net *net = sock_net(sk);
539 	struct sctp_sock		*sp;
540 	struct sctp_endpoint		*ep;
541 	struct sctp_association		*asoc;
542 	struct sctp_bind_addr		*bp;
543 	struct sctp_chunk		*chunk;
544 	struct sctp_sockaddr_entry	*laddr;
545 	union sctp_addr			*addr;
546 	union sctp_addr			saveaddr;
547 	void				*addr_buf;
548 	struct sctp_af			*af;
549 	struct list_head		*p;
550 	int 				i;
551 	int 				retval = 0;
552 
553 	if (!net->sctp.addip_enable)
554 		return retval;
555 
556 	sp = sctp_sk(sk);
557 	ep = sp->ep;
558 
559 	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
560 		 __func__, sk, addrs, addrcnt);
561 
562 	list_for_each_entry(asoc, &ep->asocs, asocs) {
563 		if (!asoc->peer.asconf_capable)
564 			continue;
565 
566 		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_ADD_IP)
567 			continue;
568 
569 		if (!sctp_state(asoc, ESTABLISHED))
570 			continue;
571 
572 		/* Check if any address in the packed array of addresses is
573 		 * in the bind address list of the association. If so,
574 		 * do not send the asconf chunk to its peer, but continue with
575 		 * other associations.
576 		 */
577 		addr_buf = addrs;
578 		for (i = 0; i < addrcnt; i++) {
579 			addr = addr_buf;
580 			af = sctp_get_af_specific(addr->v4.sin_family);
581 			if (!af) {
582 				retval = -EINVAL;
583 				goto out;
584 			}
585 
586 			if (sctp_assoc_lookup_laddr(asoc, addr))
587 				break;
588 
589 			addr_buf += af->sockaddr_len;
590 		}
591 		if (i < addrcnt)
592 			continue;
593 
594 		/* Use the first valid address in bind addr list of
595 		 * association as Address Parameter of ASCONF CHUNK.
596 		 */
597 		bp = &asoc->base.bind_addr;
598 		p = bp->address_list.next;
599 		laddr = list_entry(p, struct sctp_sockaddr_entry, list);
600 		chunk = sctp_make_asconf_update_ip(asoc, &laddr->a, addrs,
601 						   addrcnt, SCTP_PARAM_ADD_IP);
602 		if (!chunk) {
603 			retval = -ENOMEM;
604 			goto out;
605 		}
606 
607 		/* Add the new addresses to the bind address list with
608 		 * use_as_src set to 0.
609 		 */
610 		addr_buf = addrs;
611 		for (i = 0; i < addrcnt; i++) {
612 			addr = addr_buf;
613 			af = sctp_get_af_specific(addr->v4.sin_family);
614 			memcpy(&saveaddr, addr, af->sockaddr_len);
615 			retval = sctp_add_bind_addr(bp, &saveaddr,
616 						    sizeof(saveaddr),
617 						    SCTP_ADDR_NEW, GFP_ATOMIC);
618 			addr_buf += af->sockaddr_len;
619 		}
620 		if (asoc->src_out_of_asoc_ok) {
621 			struct sctp_transport *trans;
622 
623 			list_for_each_entry(trans,
624 			    &asoc->peer.transport_addr_list, transports) {
625 				/* Clear the source and route cache */
626 				sctp_transport_dst_release(trans);
627 				trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
628 				    2*asoc->pathmtu, 4380));
629 				trans->ssthresh = asoc->peer.i.a_rwnd;
630 				trans->rto = asoc->rto_initial;
631 				sctp_max_rto(asoc, trans);
632 				trans->rtt = trans->srtt = trans->rttvar = 0;
633 				sctp_transport_route(trans, NULL,
634 				    sctp_sk(asoc->base.sk));
635 			}
636 		}
637 		retval = sctp_send_asconf(asoc, chunk);
638 	}
639 
640 out:
641 	return retval;
642 }
643 
644 /* Remove a list of addresses from bind addresses list.  Do not remove the
645  * last address.
646  *
647  * Basically run through each address specified in the addrs/addrcnt
648  * array/length pair, determine if it is IPv6 or IPv4 and call
649  * sctp_del_bind() on it.
650  *
651  * If any of them fails, then the operation will be reversed and the
652  * ones that were removed will be added back.
653  *
654  * At least one address has to be left; if only one address is
655  * available, the operation will return -EBUSY.
656  *
657  * Only sctp_setsockopt_bindx() is supposed to call this function.
658  */
659 static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
660 {
661 	struct sctp_sock *sp = sctp_sk(sk);
662 	struct sctp_endpoint *ep = sp->ep;
663 	int cnt;
664 	struct sctp_bind_addr *bp = &ep->base.bind_addr;
665 	int retval = 0;
666 	void *addr_buf;
667 	union sctp_addr *sa_addr;
668 	struct sctp_af *af;
669 
670 	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
671 		 __func__, sk, addrs, addrcnt);
672 
673 	addr_buf = addrs;
674 	for (cnt = 0; cnt < addrcnt; cnt++) {
675 		/* If the bind address list is empty or if there is only one
676 		 * bind address, there is nothing more to be removed (we need
677 		 * at least one address here).
678 		 */
679 		if (list_empty(&bp->address_list) ||
680 		    (sctp_list_single_entry(&bp->address_list))) {
681 			retval = -EBUSY;
682 			goto err_bindx_rem;
683 		}
684 
685 		sa_addr = addr_buf;
686 		af = sctp_get_af_specific(sa_addr->sa.sa_family);
687 		if (!af) {
688 			retval = -EINVAL;
689 			goto err_bindx_rem;
690 		}
691 
692 		if (!af->addr_valid(sa_addr, sp, NULL)) {
693 			retval = -EADDRNOTAVAIL;
694 			goto err_bindx_rem;
695 		}
696 
697 		if (sa_addr->v4.sin_port &&
698 		    sa_addr->v4.sin_port != htons(bp->port)) {
699 			retval = -EINVAL;
700 			goto err_bindx_rem;
701 		}
702 
703 		if (!sa_addr->v4.sin_port)
704 			sa_addr->v4.sin_port = htons(bp->port);
705 
706 		/* FIXME - There is probably a need to check if sk->sk_saddr and
707 		 * sk->sk_rcv_addr are currently set to one of the addresses to
708 		 * be removed. This is something which needs to be looked into
709 		 * when we are fixing the outstanding issues with multi-homing
710 		 * socket routing and failover schemes. Refer to comments in
711 		 * sctp_do_bind(). -daisy
712 		 */
713 		retval = sctp_del_bind_addr(bp, sa_addr);
714 
715 		addr_buf += af->sockaddr_len;
716 err_bindx_rem:
717 		if (retval < 0) {
718 			/* Failed. Add the ones that has been removed back */
719 			if (cnt > 0)
720 				sctp_bindx_add(sk, addrs, cnt);
721 			return retval;
722 		}
723 	}
724 
725 	return retval;
726 }
727 
728 /* Send an ASCONF chunk with Delete IP address parameters to all the peers of
729  * the associations that are part of the endpoint indicating that a list of
730  * local addresses are removed from the endpoint.
731  *
732  * If any of the addresses is already in the bind address list of the
733  * association, we do not send the chunk for that association.  But it will not
734  * affect other associations.
735  *
736  * Only sctp_setsockopt_bindx() is supposed to call this function.
737  */
738 static int sctp_send_asconf_del_ip(struct sock		*sk,
739 				   struct sockaddr	*addrs,
740 				   int			addrcnt)
741 {
742 	struct net *net = sock_net(sk);
743 	struct sctp_sock	*sp;
744 	struct sctp_endpoint	*ep;
745 	struct sctp_association	*asoc;
746 	struct sctp_transport	*transport;
747 	struct sctp_bind_addr	*bp;
748 	struct sctp_chunk	*chunk;
749 	union sctp_addr		*laddr;
750 	void			*addr_buf;
751 	struct sctp_af		*af;
752 	struct sctp_sockaddr_entry *saddr;
753 	int 			i;
754 	int 			retval = 0;
755 	int			stored = 0;
756 
757 	chunk = NULL;
758 	if (!net->sctp.addip_enable)
759 		return retval;
760 
761 	sp = sctp_sk(sk);
762 	ep = sp->ep;
763 
764 	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
765 		 __func__, sk, addrs, addrcnt);
766 
767 	list_for_each_entry(asoc, &ep->asocs, asocs) {
768 
769 		if (!asoc->peer.asconf_capable)
770 			continue;
771 
772 		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_DEL_IP)
773 			continue;
774 
775 		if (!sctp_state(asoc, ESTABLISHED))
776 			continue;
777 
778 		/* Check if any address in the packed array of addresses is
779 		 * not present in the bind address list of the association.
780 		 * If so, do not send the asconf chunk to its peer, but
781 		 * continue with other associations.
782 		 */
783 		addr_buf = addrs;
784 		for (i = 0; i < addrcnt; i++) {
785 			laddr = addr_buf;
786 			af = sctp_get_af_specific(laddr->v4.sin_family);
787 			if (!af) {
788 				retval = -EINVAL;
789 				goto out;
790 			}
791 
792 			if (!sctp_assoc_lookup_laddr(asoc, laddr))
793 				break;
794 
795 			addr_buf += af->sockaddr_len;
796 		}
797 		if (i < addrcnt)
798 			continue;
799 
800 		/* Find one address in the association's bind address list
801 		 * that is not in the packed array of addresses. This is to
802 		 * make sure that we do not delete all the addresses in the
803 		 * association.
804 		 */
805 		bp = &asoc->base.bind_addr;
806 		laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
807 					       addrcnt, sp);
808 		if ((laddr == NULL) && (addrcnt == 1)) {
809 			if (asoc->asconf_addr_del_pending)
810 				continue;
811 			asoc->asconf_addr_del_pending =
812 			    kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
813 			if (asoc->asconf_addr_del_pending == NULL) {
814 				retval = -ENOMEM;
815 				goto out;
816 			}
817 			asoc->asconf_addr_del_pending->sa.sa_family =
818 				    addrs->sa_family;
819 			asoc->asconf_addr_del_pending->v4.sin_port =
820 				    htons(bp->port);
821 			if (addrs->sa_family == AF_INET) {
822 				struct sockaddr_in *sin;
823 
824 				sin = (struct sockaddr_in *)addrs;
825 				asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
826 			} else if (addrs->sa_family == AF_INET6) {
827 				struct sockaddr_in6 *sin6;
828 
829 				sin6 = (struct sockaddr_in6 *)addrs;
830 				asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
831 			}
832 
833 			pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
834 				 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
835 				 asoc->asconf_addr_del_pending);
836 
837 			asoc->src_out_of_asoc_ok = 1;
838 			stored = 1;
839 			goto skip_mkasconf;
840 		}
841 
842 		if (laddr == NULL)
843 			return -EINVAL;
844 
845 		/* We do not need RCU protection throughout this loop
846 		 * because this is done under a socket lock from the
847 		 * setsockopt call.
848 		 */
849 		chunk = sctp_make_asconf_update_ip(asoc, laddr, addrs, addrcnt,
850 						   SCTP_PARAM_DEL_IP);
851 		if (!chunk) {
852 			retval = -ENOMEM;
853 			goto out;
854 		}
855 
856 skip_mkasconf:
857 		/* Reset use_as_src flag for the addresses in the bind address
858 		 * list that are to be deleted.
859 		 */
860 		addr_buf = addrs;
861 		for (i = 0; i < addrcnt; i++) {
862 			laddr = addr_buf;
863 			af = sctp_get_af_specific(laddr->v4.sin_family);
864 			list_for_each_entry(saddr, &bp->address_list, list) {
865 				if (sctp_cmp_addr_exact(&saddr->a, laddr))
866 					saddr->state = SCTP_ADDR_DEL;
867 			}
868 			addr_buf += af->sockaddr_len;
869 		}
870 
871 		/* Update the route and saddr entries for all the transports
872 		 * as some of the addresses in the bind address list are
873 		 * about to be deleted and cannot be used as source addresses.
874 		 */
875 		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
876 					transports) {
877 			sctp_transport_dst_release(transport);
878 			sctp_transport_route(transport, NULL,
879 					     sctp_sk(asoc->base.sk));
880 		}
881 
882 		if (stored)
883 			/* We don't need to transmit ASCONF */
884 			continue;
885 		retval = sctp_send_asconf(asoc, chunk);
886 	}
887 out:
888 	return retval;
889 }
890 
891 /* set addr events to assocs in the endpoint.  ep and addr_wq must be locked */
892 int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
893 {
894 	struct sock *sk = sctp_opt2sk(sp);
895 	union sctp_addr *addr;
896 	struct sctp_af *af;
897 
898 	/* It is safe to write port space in caller. */
899 	addr = &addrw->a;
900 	addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
901 	af = sctp_get_af_specific(addr->sa.sa_family);
902 	if (!af)
903 		return -EINVAL;
904 	if (sctp_verify_addr(sk, addr, af->sockaddr_len))
905 		return -EINVAL;
906 
907 	if (addrw->state == SCTP_ADDR_NEW)
908 		return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
909 	else
910 		return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
911 }
912 
913 /* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
914  *
915  * API 8.1
916  * int sctp_bindx(int sd, struct sockaddr *addrs, int addrcnt,
917  *                int flags);
918  *
919  * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
920  * If the sd is an IPv6 socket, the addresses passed can either be IPv4
921  * or IPv6 addresses.
922  *
923  * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
924  * Section 3.1.2 for this usage.
925  *
926  * addrs is a pointer to an array of one or more socket addresses. Each
927  * address is contained in its appropriate structure (i.e. struct
928  * sockaddr_in or struct sockaddr_in6) the family of the address type
929  * must be used to distinguish the address length (note that this
930  * representation is termed a "packed array" of addresses). The caller
931  * specifies the number of addresses in the array with addrcnt.
932  *
933  * On success, sctp_bindx() returns 0. On failure, sctp_bindx() returns
934  * -1, and sets errno to the appropriate error code.
935  *
936  * For SCTP, the port given in each socket address must be the same, or
937  * sctp_bindx() will fail, setting errno to EINVAL.
938  *
939  * The flags parameter is formed from the bitwise OR of zero or more of
940  * the following currently defined flags:
941  *
942  * SCTP_BINDX_ADD_ADDR
943  *
944  * SCTP_BINDX_REM_ADDR
945  *
946  * SCTP_BINDX_ADD_ADDR directs SCTP to add the given addresses to the
947  * association, and SCTP_BINDX_REM_ADDR directs SCTP to remove the given
948  * addresses from the association. The two flags are mutually exclusive;
949  * if both are given, sctp_bindx() will fail with EINVAL. A caller may
950  * not remove all addresses from an association; sctp_bindx() will
951  * reject such an attempt with EINVAL.
952  *
953  * An application can use sctp_bindx(SCTP_BINDX_ADD_ADDR) to associate
954  * additional addresses with an endpoint after calling bind().  Or use
955  * sctp_bindx(SCTP_BINDX_REM_ADDR) to remove some addresses a listening
956  * socket is associated with so that no new association accepted will be
957  * associated with those addresses. If the endpoint supports dynamic
958  * address a SCTP_BINDX_REM_ADDR or SCTP_BINDX_ADD_ADDR may cause a
959  * endpoint to send the appropriate message to the peer to change the
960  * peers address lists.
961  *
962  * Adding and removing addresses from a connected association is
963  * optional functionality. Implementations that do not support this
964  * functionality should return EOPNOTSUPP.
965  *
966  * Basically do nothing but copying the addresses from user to kernel
967  * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
968  * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
969  * from userspace.
970  *
971  * We don't use copy_from_user() for optimization: we first do the
972  * sanity checks (buffer size -fast- and access check-healthy
973  * pointer); if all of those succeed, then we can alloc the memory
974  * (expensive operation) needed to copy the data to kernel. Then we do
975  * the copying without checking the user space area
976  * (__copy_from_user()).
977  *
978  * On exit there is no need to do sockfd_put(), sys_setsockopt() does
979  * it.
980  *
981  * sk        The sk of the socket
982  * addrs     The pointer to the addresses in user land
983  * addrssize Size of the addrs buffer
984  * op        Operation to perform (add or remove, see the flags of
985  *           sctp_bindx)
986  *
987  * Returns 0 if ok, <0 errno code on error.
988  */
989 static int sctp_setsockopt_bindx(struct sock *sk,
990 				 struct sockaddr __user *addrs,
991 				 int addrs_size, int op)
992 {
993 	struct sockaddr *kaddrs;
994 	int err;
995 	int addrcnt = 0;
996 	int walk_size = 0;
997 	struct sockaddr *sa_addr;
998 	void *addr_buf;
999 	struct sctp_af *af;
1000 
1001 	pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
1002 		 __func__, sk, addrs, addrs_size, op);
1003 
1004 	if (unlikely(addrs_size <= 0))
1005 		return -EINVAL;
1006 
1007 	/* Check the user passed a healthy pointer.  */
1008 	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
1009 		return -EFAULT;
1010 
1011 	/* Alloc space for the address array in kernel memory.  */
1012 	kaddrs = kmalloc(addrs_size, GFP_USER | __GFP_NOWARN);
1013 	if (unlikely(!kaddrs))
1014 		return -ENOMEM;
1015 
1016 	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
1017 		kfree(kaddrs);
1018 		return -EFAULT;
1019 	}
1020 
1021 	/* Walk through the addrs buffer and count the number of addresses. */
1022 	addr_buf = kaddrs;
1023 	while (walk_size < addrs_size) {
1024 		if (walk_size + sizeof(sa_family_t) > addrs_size) {
1025 			kfree(kaddrs);
1026 			return -EINVAL;
1027 		}
1028 
1029 		sa_addr = addr_buf;
1030 		af = sctp_get_af_specific(sa_addr->sa_family);
1031 
1032 		/* If the address family is not supported or if this address
1033 		 * causes the address buffer to overflow return EINVAL.
1034 		 */
1035 		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
1036 			kfree(kaddrs);
1037 			return -EINVAL;
1038 		}
1039 		addrcnt++;
1040 		addr_buf += af->sockaddr_len;
1041 		walk_size += af->sockaddr_len;
1042 	}
1043 
1044 	/* Do the work. */
1045 	switch (op) {
1046 	case SCTP_BINDX_ADD_ADDR:
1047 		err = sctp_bindx_add(sk, kaddrs, addrcnt);
1048 		if (err)
1049 			goto out;
1050 		err = sctp_send_asconf_add_ip(sk, kaddrs, addrcnt);
1051 		break;
1052 
1053 	case SCTP_BINDX_REM_ADDR:
1054 		err = sctp_bindx_rem(sk, kaddrs, addrcnt);
1055 		if (err)
1056 			goto out;
1057 		err = sctp_send_asconf_del_ip(sk, kaddrs, addrcnt);
1058 		break;
1059 
1060 	default:
1061 		err = -EINVAL;
1062 		break;
1063 	}
1064 
1065 out:
1066 	kfree(kaddrs);
1067 
1068 	return err;
1069 }
1070 
1071 /* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
1072  *
1073  * Common routine for handling connect() and sctp_connectx().
1074  * Connect will come in with just a single address.
1075  */
1076 static int __sctp_connect(struct sock *sk,
1077 			  struct sockaddr *kaddrs,
1078 			  int addrs_size,
1079 			  sctp_assoc_t *assoc_id)
1080 {
1081 	struct net *net = sock_net(sk);
1082 	struct sctp_sock *sp;
1083 	struct sctp_endpoint *ep;
1084 	struct sctp_association *asoc = NULL;
1085 	struct sctp_association *asoc2;
1086 	struct sctp_transport *transport;
1087 	union sctp_addr to;
1088 	enum sctp_scope scope;
1089 	long timeo;
1090 	int err = 0;
1091 	int addrcnt = 0;
1092 	int walk_size = 0;
1093 	union sctp_addr *sa_addr = NULL;
1094 	void *addr_buf;
1095 	unsigned short port;
1096 	unsigned int f_flags = 0;
1097 
1098 	sp = sctp_sk(sk);
1099 	ep = sp->ep;
1100 
1101 	/* connect() cannot be done on a socket that is already in ESTABLISHED
1102 	 * state - UDP-style peeled off socket or a TCP-style socket that
1103 	 * is already connected.
1104 	 * It cannot be done even on a TCP-style listening socket.
1105 	 */
1106 	if (sctp_sstate(sk, ESTABLISHED) || sctp_sstate(sk, CLOSING) ||
1107 	    (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
1108 		err = -EISCONN;
1109 		goto out_free;
1110 	}
1111 
1112 	/* Walk through the addrs buffer and count the number of addresses. */
1113 	addr_buf = kaddrs;
1114 	while (walk_size < addrs_size) {
1115 		struct sctp_af *af;
1116 
1117 		if (walk_size + sizeof(sa_family_t) > addrs_size) {
1118 			err = -EINVAL;
1119 			goto out_free;
1120 		}
1121 
1122 		sa_addr = addr_buf;
1123 		af = sctp_get_af_specific(sa_addr->sa.sa_family);
1124 
1125 		/* If the address family is not supported or if this address
1126 		 * causes the address buffer to overflow return EINVAL.
1127 		 */
1128 		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
1129 			err = -EINVAL;
1130 			goto out_free;
1131 		}
1132 
1133 		port = ntohs(sa_addr->v4.sin_port);
1134 
1135 		/* Save current address so we can work with it */
1136 		memcpy(&to, sa_addr, af->sockaddr_len);
1137 
1138 		err = sctp_verify_addr(sk, &to, af->sockaddr_len);
1139 		if (err)
1140 			goto out_free;
1141 
1142 		/* Make sure the destination port is correctly set
1143 		 * in all addresses.
1144 		 */
1145 		if (asoc && asoc->peer.port && asoc->peer.port != port) {
1146 			err = -EINVAL;
1147 			goto out_free;
1148 		}
1149 
1150 		/* Check if there already is a matching association on the
1151 		 * endpoint (other than the one created here).
1152 		 */
1153 		asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1154 		if (asoc2 && asoc2 != asoc) {
1155 			if (asoc2->state >= SCTP_STATE_ESTABLISHED)
1156 				err = -EISCONN;
1157 			else
1158 				err = -EALREADY;
1159 			goto out_free;
1160 		}
1161 
1162 		/* If we could not find a matching association on the endpoint,
1163 		 * make sure that there is no peeled-off association matching
1164 		 * the peer address even on another socket.
1165 		 */
1166 		if (sctp_endpoint_is_peeled_off(ep, &to)) {
1167 			err = -EADDRNOTAVAIL;
1168 			goto out_free;
1169 		}
1170 
1171 		if (!asoc) {
1172 			/* If a bind() or sctp_bindx() is not called prior to
1173 			 * an sctp_connectx() call, the system picks an
1174 			 * ephemeral port and will choose an address set
1175 			 * equivalent to binding with a wildcard address.
1176 			 */
1177 			if (!ep->base.bind_addr.port) {
1178 				if (sctp_autobind(sk)) {
1179 					err = -EAGAIN;
1180 					goto out_free;
1181 				}
1182 			} else {
1183 				/*
1184 				 * If an unprivileged user inherits a 1-many
1185 				 * style socket with open associations on a
1186 				 * privileged port, it MAY be permitted to
1187 				 * accept new associations, but it SHOULD NOT
1188 				 * be permitted to open new associations.
1189 				 */
1190 				if (ep->base.bind_addr.port <
1191 				    inet_prot_sock(net) &&
1192 				    !ns_capable(net->user_ns,
1193 				    CAP_NET_BIND_SERVICE)) {
1194 					err = -EACCES;
1195 					goto out_free;
1196 				}
1197 			}
1198 
1199 			scope = sctp_scope(&to);
1200 			asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1201 			if (!asoc) {
1202 				err = -ENOMEM;
1203 				goto out_free;
1204 			}
1205 
1206 			err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
1207 							      GFP_KERNEL);
1208 			if (err < 0) {
1209 				goto out_free;
1210 			}
1211 
1212 		}
1213 
1214 		/* Prime the peer's transport structures.  */
1215 		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
1216 						SCTP_UNKNOWN);
1217 		if (!transport) {
1218 			err = -ENOMEM;
1219 			goto out_free;
1220 		}
1221 
1222 		addrcnt++;
1223 		addr_buf += af->sockaddr_len;
1224 		walk_size += af->sockaddr_len;
1225 	}
1226 
1227 	/* In case the user of sctp_connectx() wants an association
1228 	 * id back, assign one now.
1229 	 */
1230 	if (assoc_id) {
1231 		err = sctp_assoc_set_id(asoc, GFP_KERNEL);
1232 		if (err < 0)
1233 			goto out_free;
1234 	}
1235 
1236 	err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1237 	if (err < 0) {
1238 		goto out_free;
1239 	}
1240 
1241 	/* Initialize sk's dport and daddr for getpeername() */
1242 	inet_sk(sk)->inet_dport = htons(asoc->peer.port);
1243 	sp->pf->to_sk_daddr(sa_addr, sk);
1244 	sk->sk_err = 0;
1245 
1246 	/* in-kernel sockets don't generally have a file allocated to them
1247 	 * if all they do is call sock_create_kern().
1248 	 */
1249 	if (sk->sk_socket->file)
1250 		f_flags = sk->sk_socket->file->f_flags;
1251 
1252 	timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
1253 
1254 	if (assoc_id)
1255 		*assoc_id = asoc->assoc_id;
1256 	err = sctp_wait_for_connect(asoc, &timeo);
1257 	/* Note: the asoc may be freed after the return of
1258 	 * sctp_wait_for_connect.
1259 	 */
1260 
1261 	/* Don't free association on exit. */
1262 	asoc = NULL;
1263 
1264 out_free:
1265 	pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
1266 		 __func__, asoc, kaddrs, err);
1267 
1268 	if (asoc) {
1269 		/* sctp_primitive_ASSOCIATE may have added this association
1270 		 * To the hash table, try to unhash it, just in case, its a noop
1271 		 * if it wasn't hashed so we're safe
1272 		 */
1273 		sctp_association_free(asoc);
1274 	}
1275 	return err;
1276 }
1277 
1278 /* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
1279  *
1280  * API 8.9
1281  * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt,
1282  * 			sctp_assoc_t *asoc);
1283  *
1284  * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
1285  * If the sd is an IPv6 socket, the addresses passed can either be IPv4
1286  * or IPv6 addresses.
1287  *
1288  * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
1289  * Section 3.1.2 for this usage.
1290  *
1291  * addrs is a pointer to an array of one or more socket addresses. Each
1292  * address is contained in its appropriate structure (i.e. struct
1293  * sockaddr_in or struct sockaddr_in6) the family of the address type
1294  * must be used to distengish the address length (note that this
1295  * representation is termed a "packed array" of addresses). The caller
1296  * specifies the number of addresses in the array with addrcnt.
1297  *
1298  * On success, sctp_connectx() returns 0. It also sets the assoc_id to
1299  * the association id of the new association.  On failure, sctp_connectx()
1300  * returns -1, and sets errno to the appropriate error code.  The assoc_id
1301  * is not touched by the kernel.
1302  *
1303  * For SCTP, the port given in each socket address must be the same, or
1304  * sctp_connectx() will fail, setting errno to EINVAL.
1305  *
1306  * An application can use sctp_connectx to initiate an association with
1307  * an endpoint that is multi-homed.  Much like sctp_bindx() this call
1308  * allows a caller to specify multiple addresses at which a peer can be
1309  * reached.  The way the SCTP stack uses the list of addresses to set up
1310  * the association is implementation dependent.  This function only
1311  * specifies that the stack will try to make use of all the addresses in
1312  * the list when needed.
1313  *
1314  * Note that the list of addresses passed in is only used for setting up
1315  * the association.  It does not necessarily equal the set of addresses
1316  * the peer uses for the resulting association.  If the caller wants to
1317  * find out the set of peer addresses, it must use sctp_getpaddrs() to
1318  * retrieve them after the association has been set up.
1319  *
1320  * Basically do nothing but copying the addresses from user to kernel
1321  * land and invoking either sctp_connectx(). This is used for tunneling
1322  * the sctp_connectx() request through sctp_setsockopt() from userspace.
1323  *
1324  * We don't use copy_from_user() for optimization: we first do the
1325  * sanity checks (buffer size -fast- and access check-healthy
1326  * pointer); if all of those succeed, then we can alloc the memory
1327  * (expensive operation) needed to copy the data to kernel. Then we do
1328  * the copying without checking the user space area
1329  * (__copy_from_user()).
1330  *
1331  * On exit there is no need to do sockfd_put(), sys_setsockopt() does
1332  * it.
1333  *
1334  * sk        The sk of the socket
1335  * addrs     The pointer to the addresses in user land
1336  * addrssize Size of the addrs buffer
1337  *
1338  * Returns >=0 if ok, <0 errno code on error.
1339  */
1340 static int __sctp_setsockopt_connectx(struct sock *sk,
1341 				      struct sockaddr __user *addrs,
1342 				      int addrs_size,
1343 				      sctp_assoc_t *assoc_id)
1344 {
1345 	struct sockaddr *kaddrs;
1346 	gfp_t gfp = GFP_KERNEL;
1347 	int err = 0;
1348 
1349 	pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
1350 		 __func__, sk, addrs, addrs_size);
1351 
1352 	if (unlikely(addrs_size <= 0))
1353 		return -EINVAL;
1354 
1355 	/* Check the user passed a healthy pointer.  */
1356 	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
1357 		return -EFAULT;
1358 
1359 	/* Alloc space for the address array in kernel memory.  */
1360 	if (sk->sk_socket->file)
1361 		gfp = GFP_USER | __GFP_NOWARN;
1362 	kaddrs = kmalloc(addrs_size, gfp);
1363 	if (unlikely(!kaddrs))
1364 		return -ENOMEM;
1365 
1366 	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
1367 		err = -EFAULT;
1368 	} else {
1369 		err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1370 	}
1371 
1372 	kfree(kaddrs);
1373 
1374 	return err;
1375 }
1376 
1377 /*
1378  * This is an older interface.  It's kept for backward compatibility
1379  * to the option that doesn't provide association id.
1380  */
1381 static int sctp_setsockopt_connectx_old(struct sock *sk,
1382 					struct sockaddr __user *addrs,
1383 					int addrs_size)
1384 {
1385 	return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
1386 }
1387 
1388 /*
1389  * New interface for the API.  The since the API is done with a socket
1390  * option, to make it simple we feed back the association id is as a return
1391  * indication to the call.  Error is always negative and association id is
1392  * always positive.
1393  */
1394 static int sctp_setsockopt_connectx(struct sock *sk,
1395 				    struct sockaddr __user *addrs,
1396 				    int addrs_size)
1397 {
1398 	sctp_assoc_t assoc_id = 0;
1399 	int err = 0;
1400 
1401 	err = __sctp_setsockopt_connectx(sk, addrs, addrs_size, &assoc_id);
1402 
1403 	if (err)
1404 		return err;
1405 	else
1406 		return assoc_id;
1407 }
1408 
1409 /*
1410  * New (hopefully final) interface for the API.
1411  * We use the sctp_getaddrs_old structure so that use-space library
1412  * can avoid any unnecessary allocations. The only different part
1413  * is that we store the actual length of the address buffer into the
1414  * addrs_num structure member. That way we can re-use the existing
1415  * code.
1416  */
1417 #ifdef CONFIG_COMPAT
1418 struct compat_sctp_getaddrs_old {
1419 	sctp_assoc_t	assoc_id;
1420 	s32		addr_num;
1421 	compat_uptr_t	addrs;		/* struct sockaddr * */
1422 };
1423 #endif
1424 
1425 static int sctp_getsockopt_connectx3(struct sock *sk, int len,
1426 				     char __user *optval,
1427 				     int __user *optlen)
1428 {
1429 	struct sctp_getaddrs_old param;
1430 	sctp_assoc_t assoc_id = 0;
1431 	int err = 0;
1432 
1433 #ifdef CONFIG_COMPAT
1434 	if (in_compat_syscall()) {
1435 		struct compat_sctp_getaddrs_old param32;
1436 
1437 		if (len < sizeof(param32))
1438 			return -EINVAL;
1439 		if (copy_from_user(&param32, optval, sizeof(param32)))
1440 			return -EFAULT;
1441 
1442 		param.assoc_id = param32.assoc_id;
1443 		param.addr_num = param32.addr_num;
1444 		param.addrs = compat_ptr(param32.addrs);
1445 	} else
1446 #endif
1447 	{
1448 		if (len < sizeof(param))
1449 			return -EINVAL;
1450 		if (copy_from_user(&param, optval, sizeof(param)))
1451 			return -EFAULT;
1452 	}
1453 
1454 	err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
1455 					 param.addrs, param.addr_num,
1456 					 &assoc_id);
1457 	if (err == 0 || err == -EINPROGRESS) {
1458 		if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
1459 			return -EFAULT;
1460 		if (put_user(sizeof(assoc_id), optlen))
1461 			return -EFAULT;
1462 	}
1463 
1464 	return err;
1465 }
1466 
1467 /* API 3.1.4 close() - UDP Style Syntax
1468  * Applications use close() to perform graceful shutdown (as described in
1469  * Section 10.1 of [SCTP]) on ALL the associations currently represented
1470  * by a UDP-style socket.
1471  *
1472  * The syntax is
1473  *
1474  *   ret = close(int sd);
1475  *
1476  *   sd      - the socket descriptor of the associations to be closed.
1477  *
1478  * To gracefully shutdown a specific association represented by the
1479  * UDP-style socket, an application should use the sendmsg() call,
1480  * passing no user data, but including the appropriate flag in the
1481  * ancillary data (see Section xxxx).
1482  *
1483  * If sd in the close() call is a branched-off socket representing only
1484  * one association, the shutdown is performed on that association only.
1485  *
1486  * 4.1.6 close() - TCP Style Syntax
1487  *
1488  * Applications use close() to gracefully close down an association.
1489  *
1490  * The syntax is:
1491  *
1492  *    int close(int sd);
1493  *
1494  *      sd      - the socket descriptor of the association to be closed.
1495  *
1496  * After an application calls close() on a socket descriptor, no further
1497  * socket operations will succeed on that descriptor.
1498  *
1499  * API 7.1.4 SO_LINGER
1500  *
1501  * An application using the TCP-style socket can use this option to
1502  * perform the SCTP ABORT primitive.  The linger option structure is:
1503  *
1504  *  struct  linger {
1505  *     int     l_onoff;                // option on/off
1506  *     int     l_linger;               // linger time
1507  * };
1508  *
1509  * To enable the option, set l_onoff to 1.  If the l_linger value is set
1510  * to 0, calling close() is the same as the ABORT primitive.  If the
1511  * value is set to a negative value, the setsockopt() call will return
1512  * an error.  If the value is set to a positive value linger_time, the
1513  * close() can be blocked for at most linger_time ms.  If the graceful
1514  * shutdown phase does not finish during this period, close() will
1515  * return but the graceful shutdown phase continues in the system.
1516  */
1517 static void sctp_close(struct sock *sk, long timeout)
1518 {
1519 	struct net *net = sock_net(sk);
1520 	struct sctp_endpoint *ep;
1521 	struct sctp_association *asoc;
1522 	struct list_head *pos, *temp;
1523 	unsigned int data_was_unread;
1524 
1525 	pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
1526 
1527 	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1528 	sk->sk_shutdown = SHUTDOWN_MASK;
1529 	sk->sk_state = SCTP_SS_CLOSING;
1530 
1531 	ep = sctp_sk(sk)->ep;
1532 
1533 	/* Clean up any skbs sitting on the receive queue.  */
1534 	data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
1535 	data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
1536 
1537 	/* Walk all associations on an endpoint.  */
1538 	list_for_each_safe(pos, temp, &ep->asocs) {
1539 		asoc = list_entry(pos, struct sctp_association, asocs);
1540 
1541 		if (sctp_style(sk, TCP)) {
1542 			/* A closed association can still be in the list if
1543 			 * it belongs to a TCP-style listening socket that is
1544 			 * not yet accepted. If so, free it. If not, send an
1545 			 * ABORT or SHUTDOWN based on the linger options.
1546 			 */
1547 			if (sctp_state(asoc, CLOSED)) {
1548 				sctp_association_free(asoc);
1549 				continue;
1550 			}
1551 		}
1552 
1553 		if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
1554 		    !skb_queue_empty(&asoc->ulpq.reasm) ||
1555 		    (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
1556 			struct sctp_chunk *chunk;
1557 
1558 			chunk = sctp_make_abort_user(asoc, NULL, 0);
1559 			sctp_primitive_ABORT(net, asoc, chunk);
1560 		} else
1561 			sctp_primitive_SHUTDOWN(net, asoc, NULL);
1562 	}
1563 
1564 	/* On a TCP-style socket, block for at most linger_time if set. */
1565 	if (sctp_style(sk, TCP) && timeout)
1566 		sctp_wait_for_close(sk, timeout);
1567 
1568 	/* This will run the backlog queue.  */
1569 	release_sock(sk);
1570 
1571 	/* Supposedly, no process has access to the socket, but
1572 	 * the net layers still may.
1573 	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
1574 	 * held and that should be grabbed before socket lock.
1575 	 */
1576 	spin_lock_bh(&net->sctp.addr_wq_lock);
1577 	bh_lock_sock_nested(sk);
1578 
1579 	/* Hold the sock, since sk_common_release() will put sock_put()
1580 	 * and we have just a little more cleanup.
1581 	 */
1582 	sock_hold(sk);
1583 	sk_common_release(sk);
1584 
1585 	bh_unlock_sock(sk);
1586 	spin_unlock_bh(&net->sctp.addr_wq_lock);
1587 
1588 	sock_put(sk);
1589 
1590 	SCTP_DBG_OBJCNT_DEC(sock);
1591 }
1592 
1593 /* Handle EPIPE error. */
1594 static int sctp_error(struct sock *sk, int flags, int err)
1595 {
1596 	if (err == -EPIPE)
1597 		err = sock_error(sk) ? : -EPIPE;
1598 	if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
1599 		send_sig(SIGPIPE, current, 0);
1600 	return err;
1601 }
1602 
1603 /* API 3.1.3 sendmsg() - UDP Style Syntax
1604  *
1605  * An application uses sendmsg() and recvmsg() calls to transmit data to
1606  * and receive data from its peer.
1607  *
1608  *  ssize_t sendmsg(int socket, const struct msghdr *message,
1609  *                  int flags);
1610  *
1611  *  socket  - the socket descriptor of the endpoint.
1612  *  message - pointer to the msghdr structure which contains a single
1613  *            user message and possibly some ancillary data.
1614  *
1615  *            See Section 5 for complete description of the data
1616  *            structures.
1617  *
1618  *  flags   - flags sent or received with the user message, see Section
1619  *            5 for complete description of the flags.
1620  *
1621  * Note:  This function could use a rewrite especially when explicit
1622  * connect support comes in.
1623  */
1624 /* BUG:  We do not implement the equivalent of sk_stream_wait_memory(). */
1625 
1626 static int sctp_msghdr_parse(const struct msghdr *msg,
1627 			     struct sctp_cmsgs *cmsgs);
1628 
1629 static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
1630 {
1631 	struct net *net = sock_net(sk);
1632 	struct sctp_sock *sp;
1633 	struct sctp_endpoint *ep;
1634 	struct sctp_association *new_asoc = NULL, *asoc = NULL;
1635 	struct sctp_transport *transport, *chunk_tp;
1636 	struct sctp_chunk *chunk;
1637 	union sctp_addr to;
1638 	struct sockaddr *msg_name = NULL;
1639 	struct sctp_sndrcvinfo default_sinfo;
1640 	struct sctp_sndrcvinfo *sinfo;
1641 	struct sctp_initmsg *sinit;
1642 	sctp_assoc_t associd = 0;
1643 	struct sctp_cmsgs cmsgs = { NULL };
1644 	enum sctp_scope scope;
1645 	bool fill_sinfo_ttl = false, wait_connect = false;
1646 	struct sctp_datamsg *datamsg;
1647 	int msg_flags = msg->msg_flags;
1648 	__u16 sinfo_flags = 0;
1649 	long timeo;
1650 	int err;
1651 
1652 	err = 0;
1653 	sp = sctp_sk(sk);
1654 	ep = sp->ep;
1655 
1656 	pr_debug("%s: sk:%p, msg:%p, msg_len:%zu ep:%p\n", __func__, sk,
1657 		 msg, msg_len, ep);
1658 
1659 	/* We cannot send a message over a TCP-style listening socket. */
1660 	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING)) {
1661 		err = -EPIPE;
1662 		goto out_nounlock;
1663 	}
1664 
1665 	/* Parse out the SCTP CMSGs.  */
1666 	err = sctp_msghdr_parse(msg, &cmsgs);
1667 	if (err) {
1668 		pr_debug("%s: msghdr parse err:%x\n", __func__, err);
1669 		goto out_nounlock;
1670 	}
1671 
1672 	/* Fetch the destination address for this packet.  This
1673 	 * address only selects the association--it is not necessarily
1674 	 * the address we will send to.
1675 	 * For a peeled-off socket, msg_name is ignored.
1676 	 */
1677 	if (!sctp_style(sk, UDP_HIGH_BANDWIDTH) && msg->msg_name) {
1678 		int msg_namelen = msg->msg_namelen;
1679 
1680 		err = sctp_verify_addr(sk, (union sctp_addr *)msg->msg_name,
1681 				       msg_namelen);
1682 		if (err)
1683 			return err;
1684 
1685 		if (msg_namelen > sizeof(to))
1686 			msg_namelen = sizeof(to);
1687 		memcpy(&to, msg->msg_name, msg_namelen);
1688 		msg_name = msg->msg_name;
1689 	}
1690 
1691 	sinit = cmsgs.init;
1692 	if (cmsgs.sinfo != NULL) {
1693 		memset(&default_sinfo, 0, sizeof(default_sinfo));
1694 		default_sinfo.sinfo_stream = cmsgs.sinfo->snd_sid;
1695 		default_sinfo.sinfo_flags = cmsgs.sinfo->snd_flags;
1696 		default_sinfo.sinfo_ppid = cmsgs.sinfo->snd_ppid;
1697 		default_sinfo.sinfo_context = cmsgs.sinfo->snd_context;
1698 		default_sinfo.sinfo_assoc_id = cmsgs.sinfo->snd_assoc_id;
1699 
1700 		sinfo = &default_sinfo;
1701 		fill_sinfo_ttl = true;
1702 	} else {
1703 		sinfo = cmsgs.srinfo;
1704 	}
1705 	/* Did the user specify SNDINFO/SNDRCVINFO? */
1706 	if (sinfo) {
1707 		sinfo_flags = sinfo->sinfo_flags;
1708 		associd = sinfo->sinfo_assoc_id;
1709 	}
1710 
1711 	pr_debug("%s: msg_len:%zu, sinfo_flags:0x%x\n", __func__,
1712 		 msg_len, sinfo_flags);
1713 
1714 	/* SCTP_EOF or SCTP_ABORT cannot be set on a TCP-style socket. */
1715 	if (sctp_style(sk, TCP) && (sinfo_flags & (SCTP_EOF | SCTP_ABORT))) {
1716 		err = -EINVAL;
1717 		goto out_nounlock;
1718 	}
1719 
1720 	/* If SCTP_EOF is set, no data can be sent. Disallow sending zero
1721 	 * length messages when SCTP_EOF|SCTP_ABORT is not set.
1722 	 * If SCTP_ABORT is set, the message length could be non zero with
1723 	 * the msg_iov set to the user abort reason.
1724 	 */
1725 	if (((sinfo_flags & SCTP_EOF) && (msg_len > 0)) ||
1726 	    (!(sinfo_flags & (SCTP_EOF|SCTP_ABORT)) && (msg_len == 0))) {
1727 		err = -EINVAL;
1728 		goto out_nounlock;
1729 	}
1730 
1731 	/* If SCTP_ADDR_OVER is set, there must be an address
1732 	 * specified in msg_name.
1733 	 */
1734 	if ((sinfo_flags & SCTP_ADDR_OVER) && (!msg->msg_name)) {
1735 		err = -EINVAL;
1736 		goto out_nounlock;
1737 	}
1738 
1739 	transport = NULL;
1740 
1741 	pr_debug("%s: about to look up association\n", __func__);
1742 
1743 	lock_sock(sk);
1744 
1745 	/* If a msg_name has been specified, assume this is to be used.  */
1746 	if (msg_name) {
1747 		/* Look for a matching association on the endpoint. */
1748 		asoc = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1749 
1750 		/* If we could not find a matching association on the
1751 		 * endpoint, make sure that it is not a TCP-style
1752 		 * socket that already has an association or there is
1753 		 * no peeled-off association on another socket.
1754 		 */
1755 		if (!asoc &&
1756 		    ((sctp_style(sk, TCP) &&
1757 		      (sctp_sstate(sk, ESTABLISHED) ||
1758 		       sctp_sstate(sk, CLOSING))) ||
1759 		     sctp_endpoint_is_peeled_off(ep, &to))) {
1760 			err = -EADDRNOTAVAIL;
1761 			goto out_unlock;
1762 		}
1763 	} else {
1764 		asoc = sctp_id2assoc(sk, associd);
1765 		if (!asoc) {
1766 			err = -EPIPE;
1767 			goto out_unlock;
1768 		}
1769 	}
1770 
1771 	if (asoc) {
1772 		pr_debug("%s: just looked up association:%p\n", __func__, asoc);
1773 
1774 		/* We cannot send a message on a TCP-style SCTP_SS_ESTABLISHED
1775 		 * socket that has an association in CLOSED state. This can
1776 		 * happen when an accepted socket has an association that is
1777 		 * already CLOSED.
1778 		 */
1779 		if (sctp_state(asoc, CLOSED) && sctp_style(sk, TCP)) {
1780 			err = -EPIPE;
1781 			goto out_unlock;
1782 		}
1783 
1784 		if (sinfo_flags & SCTP_EOF) {
1785 			pr_debug("%s: shutting down association:%p\n",
1786 				 __func__, asoc);
1787 
1788 			sctp_primitive_SHUTDOWN(net, asoc, NULL);
1789 			err = 0;
1790 			goto out_unlock;
1791 		}
1792 		if (sinfo_flags & SCTP_ABORT) {
1793 
1794 			chunk = sctp_make_abort_user(asoc, msg, msg_len);
1795 			if (!chunk) {
1796 				err = -ENOMEM;
1797 				goto out_unlock;
1798 			}
1799 
1800 			pr_debug("%s: aborting association:%p\n",
1801 				 __func__, asoc);
1802 
1803 			sctp_primitive_ABORT(net, asoc, chunk);
1804 			err = 0;
1805 			goto out_unlock;
1806 		}
1807 	}
1808 
1809 	/* Do we need to create the association?  */
1810 	if (!asoc) {
1811 		pr_debug("%s: there is no association yet\n", __func__);
1812 
1813 		if (sinfo_flags & (SCTP_EOF | SCTP_ABORT)) {
1814 			err = -EINVAL;
1815 			goto out_unlock;
1816 		}
1817 
1818 		/* Check for invalid stream against the stream counts,
1819 		 * either the default or the user specified stream counts.
1820 		 */
1821 		if (sinfo) {
1822 			if (!sinit || !sinit->sinit_num_ostreams) {
1823 				/* Check against the defaults. */
1824 				if (sinfo->sinfo_stream >=
1825 				    sp->initmsg.sinit_num_ostreams) {
1826 					err = -EINVAL;
1827 					goto out_unlock;
1828 				}
1829 			} else {
1830 				/* Check against the requested.  */
1831 				if (sinfo->sinfo_stream >=
1832 				    sinit->sinit_num_ostreams) {
1833 					err = -EINVAL;
1834 					goto out_unlock;
1835 				}
1836 			}
1837 		}
1838 
1839 		/*
1840 		 * API 3.1.2 bind() - UDP Style Syntax
1841 		 * If a bind() or sctp_bindx() is not called prior to a
1842 		 * sendmsg() call that initiates a new association, the
1843 		 * system picks an ephemeral port and will choose an address
1844 		 * set equivalent to binding with a wildcard address.
1845 		 */
1846 		if (!ep->base.bind_addr.port) {
1847 			if (sctp_autobind(sk)) {
1848 				err = -EAGAIN;
1849 				goto out_unlock;
1850 			}
1851 		} else {
1852 			/*
1853 			 * If an unprivileged user inherits a one-to-many
1854 			 * style socket with open associations on a privileged
1855 			 * port, it MAY be permitted to accept new associations,
1856 			 * but it SHOULD NOT be permitted to open new
1857 			 * associations.
1858 			 */
1859 			if (ep->base.bind_addr.port < inet_prot_sock(net) &&
1860 			    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1861 				err = -EACCES;
1862 				goto out_unlock;
1863 			}
1864 		}
1865 
1866 		scope = sctp_scope(&to);
1867 		new_asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1868 		if (!new_asoc) {
1869 			err = -ENOMEM;
1870 			goto out_unlock;
1871 		}
1872 		asoc = new_asoc;
1873 		err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
1874 		if (err < 0) {
1875 			err = -ENOMEM;
1876 			goto out_free;
1877 		}
1878 
1879 		/* If the SCTP_INIT ancillary data is specified, set all
1880 		 * the association init values accordingly.
1881 		 */
1882 		if (sinit) {
1883 			if (sinit->sinit_num_ostreams) {
1884 				__u16 outcnt = sinit->sinit_num_ostreams;
1885 
1886 				asoc->c.sinit_num_ostreams = outcnt;
1887 				/* outcnt has been changed, so re-init stream */
1888 				err = sctp_stream_init(&asoc->stream, outcnt, 0,
1889 						       GFP_KERNEL);
1890 				if (err)
1891 					goto out_free;
1892 			}
1893 			if (sinit->sinit_max_instreams) {
1894 				asoc->c.sinit_max_instreams =
1895 					sinit->sinit_max_instreams;
1896 			}
1897 			if (sinit->sinit_max_attempts) {
1898 				asoc->max_init_attempts
1899 					= sinit->sinit_max_attempts;
1900 			}
1901 			if (sinit->sinit_max_init_timeo) {
1902 				asoc->max_init_timeo =
1903 				 msecs_to_jiffies(sinit->sinit_max_init_timeo);
1904 			}
1905 		}
1906 
1907 		/* Prime the peer's transport structures.  */
1908 		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL, SCTP_UNKNOWN);
1909 		if (!transport) {
1910 			err = -ENOMEM;
1911 			goto out_free;
1912 		}
1913 	}
1914 
1915 	/* ASSERT: we have a valid association at this point.  */
1916 	pr_debug("%s: we have a valid association\n", __func__);
1917 
1918 	if (!sinfo) {
1919 		/* If the user didn't specify SNDINFO/SNDRCVINFO, make up
1920 		 * one with some defaults.
1921 		 */
1922 		memset(&default_sinfo, 0, sizeof(default_sinfo));
1923 		default_sinfo.sinfo_stream = asoc->default_stream;
1924 		default_sinfo.sinfo_flags = asoc->default_flags;
1925 		default_sinfo.sinfo_ppid = asoc->default_ppid;
1926 		default_sinfo.sinfo_context = asoc->default_context;
1927 		default_sinfo.sinfo_timetolive = asoc->default_timetolive;
1928 		default_sinfo.sinfo_assoc_id = sctp_assoc2id(asoc);
1929 
1930 		sinfo = &default_sinfo;
1931 	} else if (fill_sinfo_ttl) {
1932 		/* In case SNDINFO was specified, we still need to fill
1933 		 * it with a default ttl from the assoc here.
1934 		 */
1935 		sinfo->sinfo_timetolive = asoc->default_timetolive;
1936 	}
1937 
1938 	/* API 7.1.7, the sndbuf size per association bounds the
1939 	 * maximum size of data that can be sent in a single send call.
1940 	 */
1941 	if (msg_len > sk->sk_sndbuf) {
1942 		err = -EMSGSIZE;
1943 		goto out_free;
1944 	}
1945 
1946 	if (asoc->pmtu_pending)
1947 		sctp_assoc_pending_pmtu(asoc);
1948 
1949 	/* If fragmentation is disabled and the message length exceeds the
1950 	 * association fragmentation point, return EMSGSIZE.  The I-D
1951 	 * does not specify what this error is, but this looks like
1952 	 * a great fit.
1953 	 */
1954 	if (sctp_sk(sk)->disable_fragments && (msg_len > asoc->frag_point)) {
1955 		err = -EMSGSIZE;
1956 		goto out_free;
1957 	}
1958 
1959 	/* Check for invalid stream. */
1960 	if (sinfo->sinfo_stream >= asoc->stream.outcnt) {
1961 		err = -EINVAL;
1962 		goto out_free;
1963 	}
1964 
1965 	/* Allocate sctp_stream_out_ext if not already done */
1966 	if (unlikely(!asoc->stream.out[sinfo->sinfo_stream].ext)) {
1967 		err = sctp_stream_init_ext(&asoc->stream, sinfo->sinfo_stream);
1968 		if (err)
1969 			goto out_free;
1970 	}
1971 
1972 	if (sctp_wspace(asoc) < msg_len)
1973 		sctp_prsctp_prune(asoc, sinfo, msg_len - sctp_wspace(asoc));
1974 
1975 	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1976 	if (!sctp_wspace(asoc)) {
1977 		/* sk can be changed by peel off when waiting for buf. */
1978 		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
1979 		if (err) {
1980 			if (err == -ESRCH) {
1981 				/* asoc is already dead. */
1982 				new_asoc = NULL;
1983 				err = -EPIPE;
1984 			}
1985 			goto out_free;
1986 		}
1987 	}
1988 
1989 	/* If an address is passed with the sendto/sendmsg call, it is used
1990 	 * to override the primary destination address in the TCP model, or
1991 	 * when SCTP_ADDR_OVER flag is set in the UDP model.
1992 	 */
1993 	if ((sctp_style(sk, TCP) && msg_name) ||
1994 	    (sinfo_flags & SCTP_ADDR_OVER)) {
1995 		chunk_tp = sctp_assoc_lookup_paddr(asoc, &to);
1996 		if (!chunk_tp) {
1997 			err = -EINVAL;
1998 			goto out_free;
1999 		}
2000 	} else
2001 		chunk_tp = NULL;
2002 
2003 	/* Auto-connect, if we aren't connected already. */
2004 	if (sctp_state(asoc, CLOSED)) {
2005 		err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
2006 		if (err < 0)
2007 			goto out_free;
2008 
2009 		wait_connect = true;
2010 		pr_debug("%s: we associated primitively\n", __func__);
2011 	}
2012 
2013 	/* Break the message into multiple chunks of maximum size. */
2014 	datamsg = sctp_datamsg_from_user(asoc, sinfo, &msg->msg_iter);
2015 	if (IS_ERR(datamsg)) {
2016 		err = PTR_ERR(datamsg);
2017 		goto out_free;
2018 	}
2019 	asoc->force_delay = !!(msg->msg_flags & MSG_MORE);
2020 
2021 	/* Now send the (possibly) fragmented message. */
2022 	list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
2023 		sctp_chunk_hold(chunk);
2024 
2025 		/* Do accounting for the write space.  */
2026 		sctp_set_owner_w(chunk);
2027 
2028 		chunk->transport = chunk_tp;
2029 	}
2030 
2031 	/* Send it to the lower layers.  Note:  all chunks
2032 	 * must either fail or succeed.   The lower layer
2033 	 * works that way today.  Keep it that way or this
2034 	 * breaks.
2035 	 */
2036 	err = sctp_primitive_SEND(net, asoc, datamsg);
2037 	/* Did the lower layer accept the chunk? */
2038 	if (err) {
2039 		sctp_datamsg_free(datamsg);
2040 		goto out_free;
2041 	}
2042 
2043 	pr_debug("%s: we sent primitively\n", __func__);
2044 
2045 	sctp_datamsg_put(datamsg);
2046 	err = msg_len;
2047 
2048 	if (unlikely(wait_connect)) {
2049 		timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
2050 		sctp_wait_for_connect(asoc, &timeo);
2051 	}
2052 
2053 	/* If we are already past ASSOCIATE, the lower
2054 	 * layers are responsible for association cleanup.
2055 	 */
2056 	goto out_unlock;
2057 
2058 out_free:
2059 	if (new_asoc)
2060 		sctp_association_free(asoc);
2061 out_unlock:
2062 	release_sock(sk);
2063 
2064 out_nounlock:
2065 	return sctp_error(sk, msg_flags, err);
2066 
2067 #if 0
2068 do_sock_err:
2069 	if (msg_len)
2070 		err = msg_len;
2071 	else
2072 		err = sock_error(sk);
2073 	goto out;
2074 
2075 do_interrupted:
2076 	if (msg_len)
2077 		err = msg_len;
2078 	goto out;
2079 #endif /* 0 */
2080 }
2081 
2082 /* This is an extended version of skb_pull() that removes the data from the
2083  * start of a skb even when data is spread across the list of skb's in the
2084  * frag_list. len specifies the total amount of data that needs to be removed.
2085  * when 'len' bytes could be removed from the skb, it returns 0.
2086  * If 'len' exceeds the total skb length,  it returns the no. of bytes that
2087  * could not be removed.
2088  */
2089 static int sctp_skb_pull(struct sk_buff *skb, int len)
2090 {
2091 	struct sk_buff *list;
2092 	int skb_len = skb_headlen(skb);
2093 	int rlen;
2094 
2095 	if (len <= skb_len) {
2096 		__skb_pull(skb, len);
2097 		return 0;
2098 	}
2099 	len -= skb_len;
2100 	__skb_pull(skb, skb_len);
2101 
2102 	skb_walk_frags(skb, list) {
2103 		rlen = sctp_skb_pull(list, len);
2104 		skb->len -= (len-rlen);
2105 		skb->data_len -= (len-rlen);
2106 
2107 		if (!rlen)
2108 			return 0;
2109 
2110 		len = rlen;
2111 	}
2112 
2113 	return len;
2114 }
2115 
2116 /* API 3.1.3  recvmsg() - UDP Style Syntax
2117  *
2118  *  ssize_t recvmsg(int socket, struct msghdr *message,
2119  *                    int flags);
2120  *
2121  *  socket  - the socket descriptor of the endpoint.
2122  *  message - pointer to the msghdr structure which contains a single
2123  *            user message and possibly some ancillary data.
2124  *
2125  *            See Section 5 for complete description of the data
2126  *            structures.
2127  *
2128  *  flags   - flags sent or received with the user message, see Section
2129  *            5 for complete description of the flags.
2130  */
2131 static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
2132 			int noblock, int flags, int *addr_len)
2133 {
2134 	struct sctp_ulpevent *event = NULL;
2135 	struct sctp_sock *sp = sctp_sk(sk);
2136 	struct sk_buff *skb, *head_skb;
2137 	int copied;
2138 	int err = 0;
2139 	int skb_len;
2140 
2141 	pr_debug("%s: sk:%p, msghdr:%p, len:%zd, noblock:%d, flags:0x%x, "
2142 		 "addr_len:%p)\n", __func__, sk, msg, len, noblock, flags,
2143 		 addr_len);
2144 
2145 	lock_sock(sk);
2146 
2147 	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) &&
2148 	    !sctp_sstate(sk, CLOSING) && !sctp_sstate(sk, CLOSED)) {
2149 		err = -ENOTCONN;
2150 		goto out;
2151 	}
2152 
2153 	skb = sctp_skb_recv_datagram(sk, flags, noblock, &err);
2154 	if (!skb)
2155 		goto out;
2156 
2157 	/* Get the total length of the skb including any skb's in the
2158 	 * frag_list.
2159 	 */
2160 	skb_len = skb->len;
2161 
2162 	copied = skb_len;
2163 	if (copied > len)
2164 		copied = len;
2165 
2166 	err = skb_copy_datagram_msg(skb, 0, msg, copied);
2167 
2168 	event = sctp_skb2event(skb);
2169 
2170 	if (err)
2171 		goto out_free;
2172 
2173 	if (event->chunk && event->chunk->head_skb)
2174 		head_skb = event->chunk->head_skb;
2175 	else
2176 		head_skb = skb;
2177 	sock_recv_ts_and_drops(msg, sk, head_skb);
2178 	if (sctp_ulpevent_is_notification(event)) {
2179 		msg->msg_flags |= MSG_NOTIFICATION;
2180 		sp->pf->event_msgname(event, msg->msg_name, addr_len);
2181 	} else {
2182 		sp->pf->skb_msgname(head_skb, msg->msg_name, addr_len);
2183 	}
2184 
2185 	/* Check if we allow SCTP_NXTINFO. */
2186 	if (sp->recvnxtinfo)
2187 		sctp_ulpevent_read_nxtinfo(event, msg, sk);
2188 	/* Check if we allow SCTP_RCVINFO. */
2189 	if (sp->recvrcvinfo)
2190 		sctp_ulpevent_read_rcvinfo(event, msg);
2191 	/* Check if we allow SCTP_SNDRCVINFO. */
2192 	if (sp->subscribe.sctp_data_io_event)
2193 		sctp_ulpevent_read_sndrcvinfo(event, msg);
2194 
2195 	err = copied;
2196 
2197 	/* If skb's length exceeds the user's buffer, update the skb and
2198 	 * push it back to the receive_queue so that the next call to
2199 	 * recvmsg() will return the remaining data. Don't set MSG_EOR.
2200 	 */
2201 	if (skb_len > copied) {
2202 		msg->msg_flags &= ~MSG_EOR;
2203 		if (flags & MSG_PEEK)
2204 			goto out_free;
2205 		sctp_skb_pull(skb, copied);
2206 		skb_queue_head(&sk->sk_receive_queue, skb);
2207 
2208 		/* When only partial message is copied to the user, increase
2209 		 * rwnd by that amount. If all the data in the skb is read,
2210 		 * rwnd is updated when the event is freed.
2211 		 */
2212 		if (!sctp_ulpevent_is_notification(event))
2213 			sctp_assoc_rwnd_increase(event->asoc, copied);
2214 		goto out;
2215 	} else if ((event->msg_flags & MSG_NOTIFICATION) ||
2216 		   (event->msg_flags & MSG_EOR))
2217 		msg->msg_flags |= MSG_EOR;
2218 	else
2219 		msg->msg_flags &= ~MSG_EOR;
2220 
2221 out_free:
2222 	if (flags & MSG_PEEK) {
2223 		/* Release the skb reference acquired after peeking the skb in
2224 		 * sctp_skb_recv_datagram().
2225 		 */
2226 		kfree_skb(skb);
2227 	} else {
2228 		/* Free the event which includes releasing the reference to
2229 		 * the owner of the skb, freeing the skb and updating the
2230 		 * rwnd.
2231 		 */
2232 		sctp_ulpevent_free(event);
2233 	}
2234 out:
2235 	release_sock(sk);
2236 	return err;
2237 }
2238 
2239 /* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
2240  *
2241  * This option is a on/off flag.  If enabled no SCTP message
2242  * fragmentation will be performed.  Instead if a message being sent
2243  * exceeds the current PMTU size, the message will NOT be sent and
2244  * instead a error will be indicated to the user.
2245  */
2246 static int sctp_setsockopt_disable_fragments(struct sock *sk,
2247 					     char __user *optval,
2248 					     unsigned int optlen)
2249 {
2250 	int val;
2251 
2252 	if (optlen < sizeof(int))
2253 		return -EINVAL;
2254 
2255 	if (get_user(val, (int __user *)optval))
2256 		return -EFAULT;
2257 
2258 	sctp_sk(sk)->disable_fragments = (val == 0) ? 0 : 1;
2259 
2260 	return 0;
2261 }
2262 
2263 static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
2264 				  unsigned int optlen)
2265 {
2266 	struct sctp_association *asoc;
2267 	struct sctp_ulpevent *event;
2268 
2269 	if (optlen > sizeof(struct sctp_event_subscribe))
2270 		return -EINVAL;
2271 	if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
2272 		return -EFAULT;
2273 
2274 	/* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
2275 	 * if there is no data to be sent or retransmit, the stack will
2276 	 * immediately send up this notification.
2277 	 */
2278 	if (sctp_ulpevent_type_enabled(SCTP_SENDER_DRY_EVENT,
2279 				       &sctp_sk(sk)->subscribe)) {
2280 		asoc = sctp_id2assoc(sk, 0);
2281 
2282 		if (asoc && sctp_outq_is_empty(&asoc->outqueue)) {
2283 			event = sctp_ulpevent_make_sender_dry_event(asoc,
2284 					GFP_USER | __GFP_NOWARN);
2285 			if (!event)
2286 				return -ENOMEM;
2287 
2288 			sctp_ulpq_tail_event(&asoc->ulpq, event);
2289 		}
2290 	}
2291 
2292 	return 0;
2293 }
2294 
2295 /* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
2296  *
2297  * This socket option is applicable to the UDP-style socket only.  When
2298  * set it will cause associations that are idle for more than the
2299  * specified number of seconds to automatically close.  An association
2300  * being idle is defined an association that has NOT sent or received
2301  * user data.  The special value of '0' indicates that no automatic
2302  * close of any associations should be performed.  The option expects an
2303  * integer defining the number of seconds of idle time before an
2304  * association is closed.
2305  */
2306 static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
2307 				     unsigned int optlen)
2308 {
2309 	struct sctp_sock *sp = sctp_sk(sk);
2310 	struct net *net = sock_net(sk);
2311 
2312 	/* Applicable to UDP-style socket only */
2313 	if (sctp_style(sk, TCP))
2314 		return -EOPNOTSUPP;
2315 	if (optlen != sizeof(int))
2316 		return -EINVAL;
2317 	if (copy_from_user(&sp->autoclose, optval, optlen))
2318 		return -EFAULT;
2319 
2320 	if (sp->autoclose > net->sctp.max_autoclose)
2321 		sp->autoclose = net->sctp.max_autoclose;
2322 
2323 	return 0;
2324 }
2325 
2326 /* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
2327  *
2328  * Applications can enable or disable heartbeats for any peer address of
2329  * an association, modify an address's heartbeat interval, force a
2330  * heartbeat to be sent immediately, and adjust the address's maximum
2331  * number of retransmissions sent before an address is considered
2332  * unreachable.  The following structure is used to access and modify an
2333  * address's parameters:
2334  *
2335  *  struct sctp_paddrparams {
2336  *     sctp_assoc_t            spp_assoc_id;
2337  *     struct sockaddr_storage spp_address;
2338  *     uint32_t                spp_hbinterval;
2339  *     uint16_t                spp_pathmaxrxt;
2340  *     uint32_t                spp_pathmtu;
2341  *     uint32_t                spp_sackdelay;
2342  *     uint32_t                spp_flags;
2343  * };
2344  *
2345  *   spp_assoc_id    - (one-to-many style socket) This is filled in the
2346  *                     application, and identifies the association for
2347  *                     this query.
2348  *   spp_address     - This specifies which address is of interest.
2349  *   spp_hbinterval  - This contains the value of the heartbeat interval,
2350  *                     in milliseconds.  If a  value of zero
2351  *                     is present in this field then no changes are to
2352  *                     be made to this parameter.
2353  *   spp_pathmaxrxt  - This contains the maximum number of
2354  *                     retransmissions before this address shall be
2355  *                     considered unreachable. If a  value of zero
2356  *                     is present in this field then no changes are to
2357  *                     be made to this parameter.
2358  *   spp_pathmtu     - When Path MTU discovery is disabled the value
2359  *                     specified here will be the "fixed" path mtu.
2360  *                     Note that if the spp_address field is empty
2361  *                     then all associations on this address will
2362  *                     have this fixed path mtu set upon them.
2363  *
2364  *   spp_sackdelay   - When delayed sack is enabled, this value specifies
2365  *                     the number of milliseconds that sacks will be delayed
2366  *                     for. This value will apply to all addresses of an
2367  *                     association if the spp_address field is empty. Note
2368  *                     also, that if delayed sack is enabled and this
2369  *                     value is set to 0, no change is made to the last
2370  *                     recorded delayed sack timer value.
2371  *
2372  *   spp_flags       - These flags are used to control various features
2373  *                     on an association. The flag field may contain
2374  *                     zero or more of the following options.
2375  *
2376  *                     SPP_HB_ENABLE  - Enable heartbeats on the
2377  *                     specified address. Note that if the address
2378  *                     field is empty all addresses for the association
2379  *                     have heartbeats enabled upon them.
2380  *
2381  *                     SPP_HB_DISABLE - Disable heartbeats on the
2382  *                     speicifed address. Note that if the address
2383  *                     field is empty all addresses for the association
2384  *                     will have their heartbeats disabled. Note also
2385  *                     that SPP_HB_ENABLE and SPP_HB_DISABLE are
2386  *                     mutually exclusive, only one of these two should
2387  *                     be specified. Enabling both fields will have
2388  *                     undetermined results.
2389  *
2390  *                     SPP_HB_DEMAND - Request a user initiated heartbeat
2391  *                     to be made immediately.
2392  *
2393  *                     SPP_HB_TIME_IS_ZERO - Specify's that the time for
2394  *                     heartbeat delayis to be set to the value of 0
2395  *                     milliseconds.
2396  *
2397  *                     SPP_PMTUD_ENABLE - This field will enable PMTU
2398  *                     discovery upon the specified address. Note that
2399  *                     if the address feild is empty then all addresses
2400  *                     on the association are effected.
2401  *
2402  *                     SPP_PMTUD_DISABLE - This field will disable PMTU
2403  *                     discovery upon the specified address. Note that
2404  *                     if the address feild is empty then all addresses
2405  *                     on the association are effected. Not also that
2406  *                     SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
2407  *                     exclusive. Enabling both will have undetermined
2408  *                     results.
2409  *
2410  *                     SPP_SACKDELAY_ENABLE - Setting this flag turns
2411  *                     on delayed sack. The time specified in spp_sackdelay
2412  *                     is used to specify the sack delay for this address. Note
2413  *                     that if spp_address is empty then all addresses will
2414  *                     enable delayed sack and take on the sack delay
2415  *                     value specified in spp_sackdelay.
2416  *                     SPP_SACKDELAY_DISABLE - Setting this flag turns
2417  *                     off delayed sack. If the spp_address field is blank then
2418  *                     delayed sack is disabled for the entire association. Note
2419  *                     also that this field is mutually exclusive to
2420  *                     SPP_SACKDELAY_ENABLE, setting both will have undefined
2421  *                     results.
2422  */
2423 static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
2424 				       struct sctp_transport   *trans,
2425 				       struct sctp_association *asoc,
2426 				       struct sctp_sock        *sp,
2427 				       int                      hb_change,
2428 				       int                      pmtud_change,
2429 				       int                      sackdelay_change)
2430 {
2431 	int error;
2432 
2433 	if (params->spp_flags & SPP_HB_DEMAND && trans) {
2434 		struct net *net = sock_net(trans->asoc->base.sk);
2435 
2436 		error = sctp_primitive_REQUESTHEARTBEAT(net, trans->asoc, trans);
2437 		if (error)
2438 			return error;
2439 	}
2440 
2441 	/* Note that unless the spp_flag is set to SPP_HB_ENABLE the value of
2442 	 * this field is ignored.  Note also that a value of zero indicates
2443 	 * the current setting should be left unchanged.
2444 	 */
2445 	if (params->spp_flags & SPP_HB_ENABLE) {
2446 
2447 		/* Re-zero the interval if the SPP_HB_TIME_IS_ZERO is
2448 		 * set.  This lets us use 0 value when this flag
2449 		 * is set.
2450 		 */
2451 		if (params->spp_flags & SPP_HB_TIME_IS_ZERO)
2452 			params->spp_hbinterval = 0;
2453 
2454 		if (params->spp_hbinterval ||
2455 		    (params->spp_flags & SPP_HB_TIME_IS_ZERO)) {
2456 			if (trans) {
2457 				trans->hbinterval =
2458 				    msecs_to_jiffies(params->spp_hbinterval);
2459 			} else if (asoc) {
2460 				asoc->hbinterval =
2461 				    msecs_to_jiffies(params->spp_hbinterval);
2462 			} else {
2463 				sp->hbinterval = params->spp_hbinterval;
2464 			}
2465 		}
2466 	}
2467 
2468 	if (hb_change) {
2469 		if (trans) {
2470 			trans->param_flags =
2471 				(trans->param_flags & ~SPP_HB) | hb_change;
2472 		} else if (asoc) {
2473 			asoc->param_flags =
2474 				(asoc->param_flags & ~SPP_HB) | hb_change;
2475 		} else {
2476 			sp->param_flags =
2477 				(sp->param_flags & ~SPP_HB) | hb_change;
2478 		}
2479 	}
2480 
2481 	/* When Path MTU discovery is disabled the value specified here will
2482 	 * be the "fixed" path mtu (i.e. the value of the spp_flags field must
2483 	 * include the flag SPP_PMTUD_DISABLE for this field to have any
2484 	 * effect).
2485 	 */
2486 	if ((params->spp_flags & SPP_PMTUD_DISABLE) && params->spp_pathmtu) {
2487 		if (trans) {
2488 			trans->pathmtu = params->spp_pathmtu;
2489 			sctp_assoc_sync_pmtu(asoc);
2490 		} else if (asoc) {
2491 			asoc->pathmtu = params->spp_pathmtu;
2492 		} else {
2493 			sp->pathmtu = params->spp_pathmtu;
2494 		}
2495 	}
2496 
2497 	if (pmtud_change) {
2498 		if (trans) {
2499 			int update = (trans->param_flags & SPP_PMTUD_DISABLE) &&
2500 				(params->spp_flags & SPP_PMTUD_ENABLE);
2501 			trans->param_flags =
2502 				(trans->param_flags & ~SPP_PMTUD) | pmtud_change;
2503 			if (update) {
2504 				sctp_transport_pmtu(trans, sctp_opt2sk(sp));
2505 				sctp_assoc_sync_pmtu(asoc);
2506 			}
2507 		} else if (asoc) {
2508 			asoc->param_flags =
2509 				(asoc->param_flags & ~SPP_PMTUD) | pmtud_change;
2510 		} else {
2511 			sp->param_flags =
2512 				(sp->param_flags & ~SPP_PMTUD) | pmtud_change;
2513 		}
2514 	}
2515 
2516 	/* Note that unless the spp_flag is set to SPP_SACKDELAY_ENABLE the
2517 	 * value of this field is ignored.  Note also that a value of zero
2518 	 * indicates the current setting should be left unchanged.
2519 	 */
2520 	if ((params->spp_flags & SPP_SACKDELAY_ENABLE) && params->spp_sackdelay) {
2521 		if (trans) {
2522 			trans->sackdelay =
2523 				msecs_to_jiffies(params->spp_sackdelay);
2524 		} else if (asoc) {
2525 			asoc->sackdelay =
2526 				msecs_to_jiffies(params->spp_sackdelay);
2527 		} else {
2528 			sp->sackdelay = params->spp_sackdelay;
2529 		}
2530 	}
2531 
2532 	if (sackdelay_change) {
2533 		if (trans) {
2534 			trans->param_flags =
2535 				(trans->param_flags & ~SPP_SACKDELAY) |
2536 				sackdelay_change;
2537 		} else if (asoc) {
2538 			asoc->param_flags =
2539 				(asoc->param_flags & ~SPP_SACKDELAY) |
2540 				sackdelay_change;
2541 		} else {
2542 			sp->param_flags =
2543 				(sp->param_flags & ~SPP_SACKDELAY) |
2544 				sackdelay_change;
2545 		}
2546 	}
2547 
2548 	/* Note that a value of zero indicates the current setting should be
2549 	   left unchanged.
2550 	 */
2551 	if (params->spp_pathmaxrxt) {
2552 		if (trans) {
2553 			trans->pathmaxrxt = params->spp_pathmaxrxt;
2554 		} else if (asoc) {
2555 			asoc->pathmaxrxt = params->spp_pathmaxrxt;
2556 		} else {
2557 			sp->pathmaxrxt = params->spp_pathmaxrxt;
2558 		}
2559 	}
2560 
2561 	return 0;
2562 }
2563 
2564 static int sctp_setsockopt_peer_addr_params(struct sock *sk,
2565 					    char __user *optval,
2566 					    unsigned int optlen)
2567 {
2568 	struct sctp_paddrparams  params;
2569 	struct sctp_transport   *trans = NULL;
2570 	struct sctp_association *asoc = NULL;
2571 	struct sctp_sock        *sp = sctp_sk(sk);
2572 	int error;
2573 	int hb_change, pmtud_change, sackdelay_change;
2574 
2575 	if (optlen != sizeof(struct sctp_paddrparams))
2576 		return -EINVAL;
2577 
2578 	if (copy_from_user(&params, optval, optlen))
2579 		return -EFAULT;
2580 
2581 	/* Validate flags and value parameters. */
2582 	hb_change        = params.spp_flags & SPP_HB;
2583 	pmtud_change     = params.spp_flags & SPP_PMTUD;
2584 	sackdelay_change = params.spp_flags & SPP_SACKDELAY;
2585 
2586 	if (hb_change        == SPP_HB ||
2587 	    pmtud_change     == SPP_PMTUD ||
2588 	    sackdelay_change == SPP_SACKDELAY ||
2589 	    params.spp_sackdelay > 500 ||
2590 	    (params.spp_pathmtu &&
2591 	     params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
2592 		return -EINVAL;
2593 
2594 	/* If an address other than INADDR_ANY is specified, and
2595 	 * no transport is found, then the request is invalid.
2596 	 */
2597 	if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
2598 		trans = sctp_addr_id2transport(sk, &params.spp_address,
2599 					       params.spp_assoc_id);
2600 		if (!trans)
2601 			return -EINVAL;
2602 	}
2603 
2604 	/* Get association, if assoc_id != 0 and the socket is a one
2605 	 * to many style socket, and an association was not found, then
2606 	 * the id was invalid.
2607 	 */
2608 	asoc = sctp_id2assoc(sk, params.spp_assoc_id);
2609 	if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP))
2610 		return -EINVAL;
2611 
2612 	/* Heartbeat demand can only be sent on a transport or
2613 	 * association, but not a socket.
2614 	 */
2615 	if (params.spp_flags & SPP_HB_DEMAND && !trans && !asoc)
2616 		return -EINVAL;
2617 
2618 	/* Process parameters. */
2619 	error = sctp_apply_peer_addr_params(&params, trans, asoc, sp,
2620 					    hb_change, pmtud_change,
2621 					    sackdelay_change);
2622 
2623 	if (error)
2624 		return error;
2625 
2626 	/* If changes are for association, also apply parameters to each
2627 	 * transport.
2628 	 */
2629 	if (!trans && asoc) {
2630 		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2631 				transports) {
2632 			sctp_apply_peer_addr_params(&params, trans, asoc, sp,
2633 						    hb_change, pmtud_change,
2634 						    sackdelay_change);
2635 		}
2636 	}
2637 
2638 	return 0;
2639 }
2640 
2641 static inline __u32 sctp_spp_sackdelay_enable(__u32 param_flags)
2642 {
2643 	return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_ENABLE;
2644 }
2645 
2646 static inline __u32 sctp_spp_sackdelay_disable(__u32 param_flags)
2647 {
2648 	return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_DISABLE;
2649 }
2650 
2651 /*
2652  * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
2653  *
2654  * This option will effect the way delayed acks are performed.  This
2655  * option allows you to get or set the delayed ack time, in
2656  * milliseconds.  It also allows changing the delayed ack frequency.
2657  * Changing the frequency to 1 disables the delayed sack algorithm.  If
2658  * the assoc_id is 0, then this sets or gets the endpoints default
2659  * values.  If the assoc_id field is non-zero, then the set or get
2660  * effects the specified association for the one to many model (the
2661  * assoc_id field is ignored by the one to one model).  Note that if
2662  * sack_delay or sack_freq are 0 when setting this option, then the
2663  * current values will remain unchanged.
2664  *
2665  * struct sctp_sack_info {
2666  *     sctp_assoc_t            sack_assoc_id;
2667  *     uint32_t                sack_delay;
2668  *     uint32_t                sack_freq;
2669  * };
2670  *
2671  * sack_assoc_id -  This parameter, indicates which association the user
2672  *    is performing an action upon.  Note that if this field's value is
2673  *    zero then the endpoints default value is changed (effecting future
2674  *    associations only).
2675  *
2676  * sack_delay -  This parameter contains the number of milliseconds that
2677  *    the user is requesting the delayed ACK timer be set to.  Note that
2678  *    this value is defined in the standard to be between 200 and 500
2679  *    milliseconds.
2680  *
2681  * sack_freq -  This parameter contains the number of packets that must
2682  *    be received before a sack is sent without waiting for the delay
2683  *    timer to expire.  The default value for this is 2, setting this
2684  *    value to 1 will disable the delayed sack algorithm.
2685  */
2686 
2687 static int sctp_setsockopt_delayed_ack(struct sock *sk,
2688 				       char __user *optval, unsigned int optlen)
2689 {
2690 	struct sctp_sack_info    params;
2691 	struct sctp_transport   *trans = NULL;
2692 	struct sctp_association *asoc = NULL;
2693 	struct sctp_sock        *sp = sctp_sk(sk);
2694 
2695 	if (optlen == sizeof(struct sctp_sack_info)) {
2696 		if (copy_from_user(&params, optval, optlen))
2697 			return -EFAULT;
2698 
2699 		if (params.sack_delay == 0 && params.sack_freq == 0)
2700 			return 0;
2701 	} else if (optlen == sizeof(struct sctp_assoc_value)) {
2702 		pr_warn_ratelimited(DEPRECATED
2703 				    "%s (pid %d) "
2704 				    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
2705 				    "Use struct sctp_sack_info instead\n",
2706 				    current->comm, task_pid_nr(current));
2707 		if (copy_from_user(&params, optval, optlen))
2708 			return -EFAULT;
2709 
2710 		if (params.sack_delay == 0)
2711 			params.sack_freq = 1;
2712 		else
2713 			params.sack_freq = 0;
2714 	} else
2715 		return -EINVAL;
2716 
2717 	/* Validate value parameter. */
2718 	if (params.sack_delay > 500)
2719 		return -EINVAL;
2720 
2721 	/* Get association, if sack_assoc_id != 0 and the socket is a one
2722 	 * to many style socket, and an association was not found, then
2723 	 * the id was invalid.
2724 	 */
2725 	asoc = sctp_id2assoc(sk, params.sack_assoc_id);
2726 	if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
2727 		return -EINVAL;
2728 
2729 	if (params.sack_delay) {
2730 		if (asoc) {
2731 			asoc->sackdelay =
2732 				msecs_to_jiffies(params.sack_delay);
2733 			asoc->param_flags =
2734 				sctp_spp_sackdelay_enable(asoc->param_flags);
2735 		} else {
2736 			sp->sackdelay = params.sack_delay;
2737 			sp->param_flags =
2738 				sctp_spp_sackdelay_enable(sp->param_flags);
2739 		}
2740 	}
2741 
2742 	if (params.sack_freq == 1) {
2743 		if (asoc) {
2744 			asoc->param_flags =
2745 				sctp_spp_sackdelay_disable(asoc->param_flags);
2746 		} else {
2747 			sp->param_flags =
2748 				sctp_spp_sackdelay_disable(sp->param_flags);
2749 		}
2750 	} else if (params.sack_freq > 1) {
2751 		if (asoc) {
2752 			asoc->sackfreq = params.sack_freq;
2753 			asoc->param_flags =
2754 				sctp_spp_sackdelay_enable(asoc->param_flags);
2755 		} else {
2756 			sp->sackfreq = params.sack_freq;
2757 			sp->param_flags =
2758 				sctp_spp_sackdelay_enable(sp->param_flags);
2759 		}
2760 	}
2761 
2762 	/* If change is for association, also apply to each transport. */
2763 	if (asoc) {
2764 		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2765 				transports) {
2766 			if (params.sack_delay) {
2767 				trans->sackdelay =
2768 					msecs_to_jiffies(params.sack_delay);
2769 				trans->param_flags =
2770 					sctp_spp_sackdelay_enable(trans->param_flags);
2771 			}
2772 			if (params.sack_freq == 1) {
2773 				trans->param_flags =
2774 					sctp_spp_sackdelay_disable(trans->param_flags);
2775 			} else if (params.sack_freq > 1) {
2776 				trans->sackfreq = params.sack_freq;
2777 				trans->param_flags =
2778 					sctp_spp_sackdelay_enable(trans->param_flags);
2779 			}
2780 		}
2781 	}
2782 
2783 	return 0;
2784 }
2785 
2786 /* 7.1.3 Initialization Parameters (SCTP_INITMSG)
2787  *
2788  * Applications can specify protocol parameters for the default association
2789  * initialization.  The option name argument to setsockopt() and getsockopt()
2790  * is SCTP_INITMSG.
2791  *
2792  * Setting initialization parameters is effective only on an unconnected
2793  * socket (for UDP-style sockets only future associations are effected
2794  * by the change).  With TCP-style sockets, this option is inherited by
2795  * sockets derived from a listener socket.
2796  */
2797 static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, unsigned int optlen)
2798 {
2799 	struct sctp_initmsg sinit;
2800 	struct sctp_sock *sp = sctp_sk(sk);
2801 
2802 	if (optlen != sizeof(struct sctp_initmsg))
2803 		return -EINVAL;
2804 	if (copy_from_user(&sinit, optval, optlen))
2805 		return -EFAULT;
2806 
2807 	if (sinit.sinit_num_ostreams)
2808 		sp->initmsg.sinit_num_ostreams = sinit.sinit_num_ostreams;
2809 	if (sinit.sinit_max_instreams)
2810 		sp->initmsg.sinit_max_instreams = sinit.sinit_max_instreams;
2811 	if (sinit.sinit_max_attempts)
2812 		sp->initmsg.sinit_max_attempts = sinit.sinit_max_attempts;
2813 	if (sinit.sinit_max_init_timeo)
2814 		sp->initmsg.sinit_max_init_timeo = sinit.sinit_max_init_timeo;
2815 
2816 	return 0;
2817 }
2818 
2819 /*
2820  * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
2821  *
2822  *   Applications that wish to use the sendto() system call may wish to
2823  *   specify a default set of parameters that would normally be supplied
2824  *   through the inclusion of ancillary data.  This socket option allows
2825  *   such an application to set the default sctp_sndrcvinfo structure.
2826  *   The application that wishes to use this socket option simply passes
2827  *   in to this call the sctp_sndrcvinfo structure defined in Section
2828  *   5.2.2) The input parameters accepted by this call include
2829  *   sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
2830  *   sinfo_timetolive.  The user must provide the sinfo_assoc_id field in
2831  *   to this call if the caller is using the UDP model.
2832  */
2833 static int sctp_setsockopt_default_send_param(struct sock *sk,
2834 					      char __user *optval,
2835 					      unsigned int optlen)
2836 {
2837 	struct sctp_sock *sp = sctp_sk(sk);
2838 	struct sctp_association *asoc;
2839 	struct sctp_sndrcvinfo info;
2840 
2841 	if (optlen != sizeof(info))
2842 		return -EINVAL;
2843 	if (copy_from_user(&info, optval, optlen))
2844 		return -EFAULT;
2845 	if (info.sinfo_flags &
2846 	    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2847 	      SCTP_ABORT | SCTP_EOF))
2848 		return -EINVAL;
2849 
2850 	asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
2851 	if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
2852 		return -EINVAL;
2853 	if (asoc) {
2854 		asoc->default_stream = info.sinfo_stream;
2855 		asoc->default_flags = info.sinfo_flags;
2856 		asoc->default_ppid = info.sinfo_ppid;
2857 		asoc->default_context = info.sinfo_context;
2858 		asoc->default_timetolive = info.sinfo_timetolive;
2859 	} else {
2860 		sp->default_stream = info.sinfo_stream;
2861 		sp->default_flags = info.sinfo_flags;
2862 		sp->default_ppid = info.sinfo_ppid;
2863 		sp->default_context = info.sinfo_context;
2864 		sp->default_timetolive = info.sinfo_timetolive;
2865 	}
2866 
2867 	return 0;
2868 }
2869 
2870 /* RFC6458, Section 8.1.31. Set/get Default Send Parameters
2871  * (SCTP_DEFAULT_SNDINFO)
2872  */
2873 static int sctp_setsockopt_default_sndinfo(struct sock *sk,
2874 					   char __user *optval,
2875 					   unsigned int optlen)
2876 {
2877 	struct sctp_sock *sp = sctp_sk(sk);
2878 	struct sctp_association *asoc;
2879 	struct sctp_sndinfo info;
2880 
2881 	if (optlen != sizeof(info))
2882 		return -EINVAL;
2883 	if (copy_from_user(&info, optval, optlen))
2884 		return -EFAULT;
2885 	if (info.snd_flags &
2886 	    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2887 	      SCTP_ABORT | SCTP_EOF))
2888 		return -EINVAL;
2889 
2890 	asoc = sctp_id2assoc(sk, info.snd_assoc_id);
2891 	if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
2892 		return -EINVAL;
2893 	if (asoc) {
2894 		asoc->default_stream = info.snd_sid;
2895 		asoc->default_flags = info.snd_flags;
2896 		asoc->default_ppid = info.snd_ppid;
2897 		asoc->default_context = info.snd_context;
2898 	} else {
2899 		sp->default_stream = info.snd_sid;
2900 		sp->default_flags = info.snd_flags;
2901 		sp->default_ppid = info.snd_ppid;
2902 		sp->default_context = info.snd_context;
2903 	}
2904 
2905 	return 0;
2906 }
2907 
2908 /* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
2909  *
2910  * Requests that the local SCTP stack use the enclosed peer address as
2911  * the association primary.  The enclosed address must be one of the
2912  * association peer's addresses.
2913  */
2914 static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
2915 					unsigned int optlen)
2916 {
2917 	struct sctp_prim prim;
2918 	struct sctp_transport *trans;
2919 
2920 	if (optlen != sizeof(struct sctp_prim))
2921 		return -EINVAL;
2922 
2923 	if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
2924 		return -EFAULT;
2925 
2926 	trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
2927 	if (!trans)
2928 		return -EINVAL;
2929 
2930 	sctp_assoc_set_primary(trans->asoc, trans);
2931 
2932 	return 0;
2933 }
2934 
2935 /*
2936  * 7.1.5 SCTP_NODELAY
2937  *
2938  * Turn on/off any Nagle-like algorithm.  This means that packets are
2939  * generally sent as soon as possible and no unnecessary delays are
2940  * introduced, at the cost of more packets in the network.  Expects an
2941  *  integer boolean flag.
2942  */
2943 static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval,
2944 				   unsigned int optlen)
2945 {
2946 	int val;
2947 
2948 	if (optlen < sizeof(int))
2949 		return -EINVAL;
2950 	if (get_user(val, (int __user *)optval))
2951 		return -EFAULT;
2952 
2953 	sctp_sk(sk)->nodelay = (val == 0) ? 0 : 1;
2954 	return 0;
2955 }
2956 
2957 /*
2958  *
2959  * 7.1.1 SCTP_RTOINFO
2960  *
2961  * The protocol parameters used to initialize and bound retransmission
2962  * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
2963  * and modify these parameters.
2964  * All parameters are time values, in milliseconds.  A value of 0, when
2965  * modifying the parameters, indicates that the current value should not
2966  * be changed.
2967  *
2968  */
2969 static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigned int optlen)
2970 {
2971 	struct sctp_rtoinfo rtoinfo;
2972 	struct sctp_association *asoc;
2973 	unsigned long rto_min, rto_max;
2974 	struct sctp_sock *sp = sctp_sk(sk);
2975 
2976 	if (optlen != sizeof (struct sctp_rtoinfo))
2977 		return -EINVAL;
2978 
2979 	if (copy_from_user(&rtoinfo, optval, optlen))
2980 		return -EFAULT;
2981 
2982 	asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
2983 
2984 	/* Set the values to the specific association */
2985 	if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
2986 		return -EINVAL;
2987 
2988 	rto_max = rtoinfo.srto_max;
2989 	rto_min = rtoinfo.srto_min;
2990 
2991 	if (rto_max)
2992 		rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
2993 	else
2994 		rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
2995 
2996 	if (rto_min)
2997 		rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
2998 	else
2999 		rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
3000 
3001 	if (rto_min > rto_max)
3002 		return -EINVAL;
3003 
3004 	if (asoc) {
3005 		if (rtoinfo.srto_initial != 0)
3006 			asoc->rto_initial =
3007 				msecs_to_jiffies(rtoinfo.srto_initial);
3008 		asoc->rto_max = rto_max;
3009 		asoc->rto_min = rto_min;
3010 	} else {
3011 		/* If there is no association or the association-id = 0
3012 		 * set the values to the endpoint.
3013 		 */
3014 		if (rtoinfo.srto_initial != 0)
3015 			sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
3016 		sp->rtoinfo.srto_max = rto_max;
3017 		sp->rtoinfo.srto_min = rto_min;
3018 	}
3019 
3020 	return 0;
3021 }
3022 
3023 /*
3024  *
3025  * 7.1.2 SCTP_ASSOCINFO
3026  *
3027  * This option is used to tune the maximum retransmission attempts
3028  * of the association.
3029  * Returns an error if the new association retransmission value is
3030  * greater than the sum of the retransmission value  of the peer.
3031  * See [SCTP] for more information.
3032  *
3033  */
3034 static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, unsigned int optlen)
3035 {
3036 
3037 	struct sctp_assocparams assocparams;
3038 	struct sctp_association *asoc;
3039 
3040 	if (optlen != sizeof(struct sctp_assocparams))
3041 		return -EINVAL;
3042 	if (copy_from_user(&assocparams, optval, optlen))
3043 		return -EFAULT;
3044 
3045 	asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
3046 
3047 	if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
3048 		return -EINVAL;
3049 
3050 	/* Set the values to the specific association */
3051 	if (asoc) {
3052 		if (assocparams.sasoc_asocmaxrxt != 0) {
3053 			__u32 path_sum = 0;
3054 			int   paths = 0;
3055 			struct sctp_transport *peer_addr;
3056 
3057 			list_for_each_entry(peer_addr, &asoc->peer.transport_addr_list,
3058 					transports) {
3059 				path_sum += peer_addr->pathmaxrxt;
3060 				paths++;
3061 			}
3062 
3063 			/* Only validate asocmaxrxt if we have more than
3064 			 * one path/transport.  We do this because path
3065 			 * retransmissions are only counted when we have more
3066 			 * then one path.
3067 			 */
3068 			if (paths > 1 &&
3069 			    assocparams.sasoc_asocmaxrxt > path_sum)
3070 				return -EINVAL;
3071 
3072 			asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
3073 		}
3074 
3075 		if (assocparams.sasoc_cookie_life != 0)
3076 			asoc->cookie_life = ms_to_ktime(assocparams.sasoc_cookie_life);
3077 	} else {
3078 		/* Set the values to the endpoint */
3079 		struct sctp_sock *sp = sctp_sk(sk);
3080 
3081 		if (assocparams.sasoc_asocmaxrxt != 0)
3082 			sp->assocparams.sasoc_asocmaxrxt =
3083 						assocparams.sasoc_asocmaxrxt;
3084 		if (assocparams.sasoc_cookie_life != 0)
3085 			sp->assocparams.sasoc_cookie_life =
3086 						assocparams.sasoc_cookie_life;
3087 	}
3088 	return 0;
3089 }
3090 
3091 /*
3092  * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
3093  *
3094  * This socket option is a boolean flag which turns on or off mapped V4
3095  * addresses.  If this option is turned on and the socket is type
3096  * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
3097  * If this option is turned off, then no mapping will be done of V4
3098  * addresses and a user will receive both PF_INET6 and PF_INET type
3099  * addresses on the socket.
3100  */
3101 static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsigned int optlen)
3102 {
3103 	int val;
3104 	struct sctp_sock *sp = sctp_sk(sk);
3105 
3106 	if (optlen < sizeof(int))
3107 		return -EINVAL;
3108 	if (get_user(val, (int __user *)optval))
3109 		return -EFAULT;
3110 	if (val)
3111 		sp->v4mapped = 1;
3112 	else
3113 		sp->v4mapped = 0;
3114 
3115 	return 0;
3116 }
3117 
3118 /*
3119  * 8.1.16.  Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
3120  * This option will get or set the maximum size to put in any outgoing
3121  * SCTP DATA chunk.  If a message is larger than this size it will be
3122  * fragmented by SCTP into the specified size.  Note that the underlying
3123  * SCTP implementation may fragment into smaller sized chunks when the
3124  * PMTU of the underlying association is smaller than the value set by
3125  * the user.  The default value for this option is '0' which indicates
3126  * the user is NOT limiting fragmentation and only the PMTU will effect
3127  * SCTP's choice of DATA chunk size.  Note also that values set larger
3128  * than the maximum size of an IP datagram will effectively let SCTP
3129  * control fragmentation (i.e. the same as setting this option to 0).
3130  *
3131  * The following structure is used to access and modify this parameter:
3132  *
3133  * struct sctp_assoc_value {
3134  *   sctp_assoc_t assoc_id;
3135  *   uint32_t assoc_value;
3136  * };
3137  *
3138  * assoc_id:  This parameter is ignored for one-to-one style sockets.
3139  *    For one-to-many style sockets this parameter indicates which
3140  *    association the user is performing an action upon.  Note that if
3141  *    this field's value is zero then the endpoints default value is
3142  *    changed (effecting future associations only).
3143  * assoc_value:  This parameter specifies the maximum size in bytes.
3144  */
3145 static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
3146 {
3147 	struct sctp_sock *sp = sctp_sk(sk);
3148 	struct sctp_assoc_value params;
3149 	struct sctp_association *asoc;
3150 	int val;
3151 
3152 	if (optlen == sizeof(int)) {
3153 		pr_warn_ratelimited(DEPRECATED
3154 				    "%s (pid %d) "
3155 				    "Use of int in maxseg socket option.\n"
3156 				    "Use struct sctp_assoc_value instead\n",
3157 				    current->comm, task_pid_nr(current));
3158 		if (copy_from_user(&val, optval, optlen))
3159 			return -EFAULT;
3160 		params.assoc_id = 0;
3161 	} else if (optlen == sizeof(struct sctp_assoc_value)) {
3162 		if (copy_from_user(&params, optval, optlen))
3163 			return -EFAULT;
3164 		val = params.assoc_value;
3165 	} else {
3166 		return -EINVAL;
3167 	}
3168 
3169 	if (val) {
3170 		int min_len, max_len;
3171 
3172 		min_len = SCTP_DEFAULT_MINSEGMENT - sp->pf->af->net_header_len;
3173 		min_len -= sizeof(struct sctphdr) +
3174 			   sizeof(struct sctp_data_chunk);
3175 
3176 		max_len = SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_data_chunk);
3177 
3178 		if (val < min_len || val > max_len)
3179 			return -EINVAL;
3180 	}
3181 
3182 	asoc = sctp_id2assoc(sk, params.assoc_id);
3183 	if (asoc) {
3184 		if (val == 0) {
3185 			val = asoc->pathmtu - sp->pf->af->net_header_len;
3186 			val -= sizeof(struct sctphdr) +
3187 			       sizeof(struct sctp_data_chunk);
3188 		}
3189 		asoc->user_frag = val;
3190 		asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
3191 	} else {
3192 		if (params.assoc_id && sctp_style(sk, UDP))
3193 			return -EINVAL;
3194 		sp->user_frag = val;
3195 	}
3196 
3197 	return 0;
3198 }
3199 
3200 
3201 /*
3202  *  7.1.9 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
3203  *
3204  *   Requests that the peer mark the enclosed address as the association
3205  *   primary. The enclosed address must be one of the association's
3206  *   locally bound addresses. The following structure is used to make a
3207  *   set primary request:
3208  */
3209 static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optval,
3210 					     unsigned int optlen)
3211 {
3212 	struct net *net = sock_net(sk);
3213 	struct sctp_sock	*sp;
3214 	struct sctp_association	*asoc = NULL;
3215 	struct sctp_setpeerprim	prim;
3216 	struct sctp_chunk	*chunk;
3217 	struct sctp_af		*af;
3218 	int 			err;
3219 
3220 	sp = sctp_sk(sk);
3221 
3222 	if (!net->sctp.addip_enable)
3223 		return -EPERM;
3224 
3225 	if (optlen != sizeof(struct sctp_setpeerprim))
3226 		return -EINVAL;
3227 
3228 	if (copy_from_user(&prim, optval, optlen))
3229 		return -EFAULT;
3230 
3231 	asoc = sctp_id2assoc(sk, prim.sspp_assoc_id);
3232 	if (!asoc)
3233 		return -EINVAL;
3234 
3235 	if (!asoc->peer.asconf_capable)
3236 		return -EPERM;
3237 
3238 	if (asoc->peer.addip_disabled_mask & SCTP_PARAM_SET_PRIMARY)
3239 		return -EPERM;
3240 
3241 	if (!sctp_state(asoc, ESTABLISHED))
3242 		return -ENOTCONN;
3243 
3244 	af = sctp_get_af_specific(prim.sspp_addr.ss_family);
3245 	if (!af)
3246 		return -EINVAL;
3247 
3248 	if (!af->addr_valid((union sctp_addr *)&prim.sspp_addr, sp, NULL))
3249 		return -EADDRNOTAVAIL;
3250 
3251 	if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
3252 		return -EADDRNOTAVAIL;
3253 
3254 	/* Create an ASCONF chunk with SET_PRIMARY parameter	*/
3255 	chunk = sctp_make_asconf_set_prim(asoc,
3256 					  (union sctp_addr *)&prim.sspp_addr);
3257 	if (!chunk)
3258 		return -ENOMEM;
3259 
3260 	err = sctp_send_asconf(asoc, chunk);
3261 
3262 	pr_debug("%s: we set peer primary addr primitively\n", __func__);
3263 
3264 	return err;
3265 }
3266 
3267 static int sctp_setsockopt_adaptation_layer(struct sock *sk, char __user *optval,
3268 					    unsigned int optlen)
3269 {
3270 	struct sctp_setadaptation adaptation;
3271 
3272 	if (optlen != sizeof(struct sctp_setadaptation))
3273 		return -EINVAL;
3274 	if (copy_from_user(&adaptation, optval, optlen))
3275 		return -EFAULT;
3276 
3277 	sctp_sk(sk)->adaptation_ind = adaptation.ssb_adaptation_ind;
3278 
3279 	return 0;
3280 }
3281 
3282 /*
3283  * 7.1.29.  Set or Get the default context (SCTP_CONTEXT)
3284  *
3285  * The context field in the sctp_sndrcvinfo structure is normally only
3286  * used when a failed message is retrieved holding the value that was
3287  * sent down on the actual send call.  This option allows the setting of
3288  * a default context on an association basis that will be received on
3289  * reading messages from the peer.  This is especially helpful in the
3290  * one-2-many model for an application to keep some reference to an
3291  * internal state machine that is processing messages on the
3292  * association.  Note that the setting of this value only effects
3293  * received messages from the peer and does not effect the value that is
3294  * saved with outbound messages.
3295  */
3296 static int sctp_setsockopt_context(struct sock *sk, char __user *optval,
3297 				   unsigned int optlen)
3298 {
3299 	struct sctp_assoc_value params;
3300 	struct sctp_sock *sp;
3301 	struct sctp_association *asoc;
3302 
3303 	if (optlen != sizeof(struct sctp_assoc_value))
3304 		return -EINVAL;
3305 	if (copy_from_user(&params, optval, optlen))
3306 		return -EFAULT;
3307 
3308 	sp = sctp_sk(sk);
3309 
3310 	if (params.assoc_id != 0) {
3311 		asoc = sctp_id2assoc(sk, params.assoc_id);
3312 		if (!asoc)
3313 			return -EINVAL;
3314 		asoc->default_rcv_context = params.assoc_value;
3315 	} else {
3316 		sp->default_rcv_context = params.assoc_value;
3317 	}
3318 
3319 	return 0;
3320 }
3321 
3322 /*
3323  * 7.1.24.  Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
3324  *
3325  * This options will at a minimum specify if the implementation is doing
3326  * fragmented interleave.  Fragmented interleave, for a one to many
3327  * socket, is when subsequent calls to receive a message may return
3328  * parts of messages from different associations.  Some implementations
3329  * may allow you to turn this value on or off.  If so, when turned off,
3330  * no fragment interleave will occur (which will cause a head of line
3331  * blocking amongst multiple associations sharing the same one to many
3332  * socket).  When this option is turned on, then each receive call may
3333  * come from a different association (thus the user must receive data
3334  * with the extended calls (e.g. sctp_recvmsg) to keep track of which
3335  * association each receive belongs to.
3336  *
3337  * This option takes a boolean value.  A non-zero value indicates that
3338  * fragmented interleave is on.  A value of zero indicates that
3339  * fragmented interleave is off.
3340  *
3341  * Note that it is important that an implementation that allows this
3342  * option to be turned on, have it off by default.  Otherwise an unaware
3343  * application using the one to many model may become confused and act
3344  * incorrectly.
3345  */
3346 static int sctp_setsockopt_fragment_interleave(struct sock *sk,
3347 					       char __user *optval,
3348 					       unsigned int optlen)
3349 {
3350 	int val;
3351 
3352 	if (optlen != sizeof(int))
3353 		return -EINVAL;
3354 	if (get_user(val, (int __user *)optval))
3355 		return -EFAULT;
3356 
3357 	sctp_sk(sk)->frag_interleave = (val == 0) ? 0 : 1;
3358 
3359 	return 0;
3360 }
3361 
3362 /*
3363  * 8.1.21.  Set or Get the SCTP Partial Delivery Point
3364  *       (SCTP_PARTIAL_DELIVERY_POINT)
3365  *
3366  * This option will set or get the SCTP partial delivery point.  This
3367  * point is the size of a message where the partial delivery API will be
3368  * invoked to help free up rwnd space for the peer.  Setting this to a
3369  * lower value will cause partial deliveries to happen more often.  The
3370  * calls argument is an integer that sets or gets the partial delivery
3371  * point.  Note also that the call will fail if the user attempts to set
3372  * this value larger than the socket receive buffer size.
3373  *
3374  * Note that any single message having a length smaller than or equal to
3375  * the SCTP partial delivery point will be delivered in one single read
3376  * call as long as the user provided buffer is large enough to hold the
3377  * message.
3378  */
3379 static int sctp_setsockopt_partial_delivery_point(struct sock *sk,
3380 						  char __user *optval,
3381 						  unsigned int optlen)
3382 {
3383 	u32 val;
3384 
3385 	if (optlen != sizeof(u32))
3386 		return -EINVAL;
3387 	if (get_user(val, (int __user *)optval))
3388 		return -EFAULT;
3389 
3390 	/* Note: We double the receive buffer from what the user sets
3391 	 * it to be, also initial rwnd is based on rcvbuf/2.
3392 	 */
3393 	if (val > (sk->sk_rcvbuf >> 1))
3394 		return -EINVAL;
3395 
3396 	sctp_sk(sk)->pd_point = val;
3397 
3398 	return 0; /* is this the right error code? */
3399 }
3400 
3401 /*
3402  * 7.1.28.  Set or Get the maximum burst (SCTP_MAX_BURST)
3403  *
3404  * This option will allow a user to change the maximum burst of packets
3405  * that can be emitted by this association.  Note that the default value
3406  * is 4, and some implementations may restrict this setting so that it
3407  * can only be lowered.
3408  *
3409  * NOTE: This text doesn't seem right.  Do this on a socket basis with
3410  * future associations inheriting the socket value.
3411  */
3412 static int sctp_setsockopt_maxburst(struct sock *sk,
3413 				    char __user *optval,
3414 				    unsigned int optlen)
3415 {
3416 	struct sctp_assoc_value params;
3417 	struct sctp_sock *sp;
3418 	struct sctp_association *asoc;
3419 	int val;
3420 	int assoc_id = 0;
3421 
3422 	if (optlen == sizeof(int)) {
3423 		pr_warn_ratelimited(DEPRECATED
3424 				    "%s (pid %d) "
3425 				    "Use of int in max_burst socket option deprecated.\n"
3426 				    "Use struct sctp_assoc_value instead\n",
3427 				    current->comm, task_pid_nr(current));
3428 		if (copy_from_user(&val, optval, optlen))
3429 			return -EFAULT;
3430 	} else if (optlen == sizeof(struct sctp_assoc_value)) {
3431 		if (copy_from_user(&params, optval, optlen))
3432 			return -EFAULT;
3433 		val = params.assoc_value;
3434 		assoc_id = params.assoc_id;
3435 	} else
3436 		return -EINVAL;
3437 
3438 	sp = sctp_sk(sk);
3439 
3440 	if (assoc_id != 0) {
3441 		asoc = sctp_id2assoc(sk, assoc_id);
3442 		if (!asoc)
3443 			return -EINVAL;
3444 		asoc->max_burst = val;
3445 	} else
3446 		sp->max_burst = val;
3447 
3448 	return 0;
3449 }
3450 
3451 /*
3452  * 7.1.18.  Add a chunk that must be authenticated (SCTP_AUTH_CHUNK)
3453  *
3454  * This set option adds a chunk type that the user is requesting to be
3455  * received only in an authenticated way.  Changes to the list of chunks
3456  * will only effect future associations on the socket.
3457  */
3458 static int sctp_setsockopt_auth_chunk(struct sock *sk,
3459 				      char __user *optval,
3460 				      unsigned int optlen)
3461 {
3462 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3463 	struct sctp_authchunk val;
3464 
3465 	if (!ep->auth_enable)
3466 		return -EACCES;
3467 
3468 	if (optlen != sizeof(struct sctp_authchunk))
3469 		return -EINVAL;
3470 	if (copy_from_user(&val, optval, optlen))
3471 		return -EFAULT;
3472 
3473 	switch (val.sauth_chunk) {
3474 	case SCTP_CID_INIT:
3475 	case SCTP_CID_INIT_ACK:
3476 	case SCTP_CID_SHUTDOWN_COMPLETE:
3477 	case SCTP_CID_AUTH:
3478 		return -EINVAL;
3479 	}
3480 
3481 	/* add this chunk id to the endpoint */
3482 	return sctp_auth_ep_add_chunkid(ep, val.sauth_chunk);
3483 }
3484 
3485 /*
3486  * 7.1.19.  Get or set the list of supported HMAC Identifiers (SCTP_HMAC_IDENT)
3487  *
3488  * This option gets or sets the list of HMAC algorithms that the local
3489  * endpoint requires the peer to use.
3490  */
3491 static int sctp_setsockopt_hmac_ident(struct sock *sk,
3492 				      char __user *optval,
3493 				      unsigned int optlen)
3494 {
3495 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3496 	struct sctp_hmacalgo *hmacs;
3497 	u32 idents;
3498 	int err;
3499 
3500 	if (!ep->auth_enable)
3501 		return -EACCES;
3502 
3503 	if (optlen < sizeof(struct sctp_hmacalgo))
3504 		return -EINVAL;
3505 	optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) +
3506 					     SCTP_AUTH_NUM_HMACS * sizeof(u16));
3507 
3508 	hmacs = memdup_user(optval, optlen);
3509 	if (IS_ERR(hmacs))
3510 		return PTR_ERR(hmacs);
3511 
3512 	idents = hmacs->shmac_num_idents;
3513 	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
3514 	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
3515 		err = -EINVAL;
3516 		goto out;
3517 	}
3518 
3519 	err = sctp_auth_ep_set_hmacs(ep, hmacs);
3520 out:
3521 	kfree(hmacs);
3522 	return err;
3523 }
3524 
3525 /*
3526  * 7.1.20.  Set a shared key (SCTP_AUTH_KEY)
3527  *
3528  * This option will set a shared secret key which is used to build an
3529  * association shared key.
3530  */
3531 static int sctp_setsockopt_auth_key(struct sock *sk,
3532 				    char __user *optval,
3533 				    unsigned int optlen)
3534 {
3535 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3536 	struct sctp_authkey *authkey;
3537 	struct sctp_association *asoc;
3538 	int ret;
3539 
3540 	if (!ep->auth_enable)
3541 		return -EACCES;
3542 
3543 	if (optlen <= sizeof(struct sctp_authkey))
3544 		return -EINVAL;
3545 	/* authkey->sca_keylength is u16, so optlen can't be bigger than
3546 	 * this.
3547 	 */
3548 	optlen = min_t(unsigned int, optlen, USHRT_MAX +
3549 					     sizeof(struct sctp_authkey));
3550 
3551 	authkey = memdup_user(optval, optlen);
3552 	if (IS_ERR(authkey))
3553 		return PTR_ERR(authkey);
3554 
3555 	if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
3556 		ret = -EINVAL;
3557 		goto out;
3558 	}
3559 
3560 	asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
3561 	if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
3562 		ret = -EINVAL;
3563 		goto out;
3564 	}
3565 
3566 	ret = sctp_auth_set_key(ep, asoc, authkey);
3567 out:
3568 	kzfree(authkey);
3569 	return ret;
3570 }
3571 
3572 /*
3573  * 7.1.21.  Get or set the active shared key (SCTP_AUTH_ACTIVE_KEY)
3574  *
3575  * This option will get or set the active shared key to be used to build
3576  * the association shared key.
3577  */
3578 static int sctp_setsockopt_active_key(struct sock *sk,
3579 				      char __user *optval,
3580 				      unsigned int optlen)
3581 {
3582 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3583 	struct sctp_authkeyid val;
3584 	struct sctp_association *asoc;
3585 
3586 	if (!ep->auth_enable)
3587 		return -EACCES;
3588 
3589 	if (optlen != sizeof(struct sctp_authkeyid))
3590 		return -EINVAL;
3591 	if (copy_from_user(&val, optval, optlen))
3592 		return -EFAULT;
3593 
3594 	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3595 	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3596 		return -EINVAL;
3597 
3598 	return sctp_auth_set_active_key(ep, asoc, val.scact_keynumber);
3599 }
3600 
3601 /*
3602  * 7.1.22.  Delete a shared key (SCTP_AUTH_DELETE_KEY)
3603  *
3604  * This set option will delete a shared secret key from use.
3605  */
3606 static int sctp_setsockopt_del_key(struct sock *sk,
3607 				   char __user *optval,
3608 				   unsigned int optlen)
3609 {
3610 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3611 	struct sctp_authkeyid val;
3612 	struct sctp_association *asoc;
3613 
3614 	if (!ep->auth_enable)
3615 		return -EACCES;
3616 
3617 	if (optlen != sizeof(struct sctp_authkeyid))
3618 		return -EINVAL;
3619 	if (copy_from_user(&val, optval, optlen))
3620 		return -EFAULT;
3621 
3622 	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3623 	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3624 		return -EINVAL;
3625 
3626 	return sctp_auth_del_key_id(ep, asoc, val.scact_keynumber);
3627 
3628 }
3629 
3630 /*
3631  * 8.1.23 SCTP_AUTO_ASCONF
3632  *
3633  * This option will enable or disable the use of the automatic generation of
3634  * ASCONF chunks to add and delete addresses to an existing association.  Note
3635  * that this option has two caveats namely: a) it only affects sockets that
3636  * are bound to all addresses available to the SCTP stack, and b) the system
3637  * administrator may have an overriding control that turns the ASCONF feature
3638  * off no matter what setting the socket option may have.
3639  * This option expects an integer boolean flag, where a non-zero value turns on
3640  * the option, and a zero value turns off the option.
3641  * Note. In this implementation, socket operation overrides default parameter
3642  * being set by sysctl as well as FreeBSD implementation
3643  */
3644 static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
3645 					unsigned int optlen)
3646 {
3647 	int val;
3648 	struct sctp_sock *sp = sctp_sk(sk);
3649 
3650 	if (optlen < sizeof(int))
3651 		return -EINVAL;
3652 	if (get_user(val, (int __user *)optval))
3653 		return -EFAULT;
3654 	if (!sctp_is_ep_boundall(sk) && val)
3655 		return -EINVAL;
3656 	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
3657 		return 0;
3658 
3659 	spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
3660 	if (val == 0 && sp->do_auto_asconf) {
3661 		list_del(&sp->auto_asconf_list);
3662 		sp->do_auto_asconf = 0;
3663 	} else if (val && !sp->do_auto_asconf) {
3664 		list_add_tail(&sp->auto_asconf_list,
3665 		    &sock_net(sk)->sctp.auto_asconf_splist);
3666 		sp->do_auto_asconf = 1;
3667 	}
3668 	spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
3669 	return 0;
3670 }
3671 
3672 /*
3673  * SCTP_PEER_ADDR_THLDS
3674  *
3675  * This option allows us to alter the partially failed threshold for one or all
3676  * transports in an association.  See Section 6.1 of:
3677  * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
3678  */
3679 static int sctp_setsockopt_paddr_thresholds(struct sock *sk,
3680 					    char __user *optval,
3681 					    unsigned int optlen)
3682 {
3683 	struct sctp_paddrthlds val;
3684 	struct sctp_transport *trans;
3685 	struct sctp_association *asoc;
3686 
3687 	if (optlen < sizeof(struct sctp_paddrthlds))
3688 		return -EINVAL;
3689 	if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval,
3690 			   sizeof(struct sctp_paddrthlds)))
3691 		return -EFAULT;
3692 
3693 
3694 	if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
3695 		asoc = sctp_id2assoc(sk, val.spt_assoc_id);
3696 		if (!asoc)
3697 			return -ENOENT;
3698 		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
3699 				    transports) {
3700 			if (val.spt_pathmaxrxt)
3701 				trans->pathmaxrxt = val.spt_pathmaxrxt;
3702 			trans->pf_retrans = val.spt_pathpfthld;
3703 		}
3704 
3705 		if (val.spt_pathmaxrxt)
3706 			asoc->pathmaxrxt = val.spt_pathmaxrxt;
3707 		asoc->pf_retrans = val.spt_pathpfthld;
3708 	} else {
3709 		trans = sctp_addr_id2transport(sk, &val.spt_address,
3710 					       val.spt_assoc_id);
3711 		if (!trans)
3712 			return -ENOENT;
3713 
3714 		if (val.spt_pathmaxrxt)
3715 			trans->pathmaxrxt = val.spt_pathmaxrxt;
3716 		trans->pf_retrans = val.spt_pathpfthld;
3717 	}
3718 
3719 	return 0;
3720 }
3721 
3722 static int sctp_setsockopt_recvrcvinfo(struct sock *sk,
3723 				       char __user *optval,
3724 				       unsigned int optlen)
3725 {
3726 	int val;
3727 
3728 	if (optlen < sizeof(int))
3729 		return -EINVAL;
3730 	if (get_user(val, (int __user *) optval))
3731 		return -EFAULT;
3732 
3733 	sctp_sk(sk)->recvrcvinfo = (val == 0) ? 0 : 1;
3734 
3735 	return 0;
3736 }
3737 
3738 static int sctp_setsockopt_recvnxtinfo(struct sock *sk,
3739 				       char __user *optval,
3740 				       unsigned int optlen)
3741 {
3742 	int val;
3743 
3744 	if (optlen < sizeof(int))
3745 		return -EINVAL;
3746 	if (get_user(val, (int __user *) optval))
3747 		return -EFAULT;
3748 
3749 	sctp_sk(sk)->recvnxtinfo = (val == 0) ? 0 : 1;
3750 
3751 	return 0;
3752 }
3753 
3754 static int sctp_setsockopt_pr_supported(struct sock *sk,
3755 					char __user *optval,
3756 					unsigned int optlen)
3757 {
3758 	struct sctp_assoc_value params;
3759 	struct sctp_association *asoc;
3760 	int retval = -EINVAL;
3761 
3762 	if (optlen != sizeof(params))
3763 		goto out;
3764 
3765 	if (copy_from_user(&params, optval, optlen)) {
3766 		retval = -EFAULT;
3767 		goto out;
3768 	}
3769 
3770 	asoc = sctp_id2assoc(sk, params.assoc_id);
3771 	if (asoc) {
3772 		asoc->prsctp_enable = !!params.assoc_value;
3773 	} else if (!params.assoc_id) {
3774 		struct sctp_sock *sp = sctp_sk(sk);
3775 
3776 		sp->ep->prsctp_enable = !!params.assoc_value;
3777 	} else {
3778 		goto out;
3779 	}
3780 
3781 	retval = 0;
3782 
3783 out:
3784 	return retval;
3785 }
3786 
3787 static int sctp_setsockopt_default_prinfo(struct sock *sk,
3788 					  char __user *optval,
3789 					  unsigned int optlen)
3790 {
3791 	struct sctp_default_prinfo info;
3792 	struct sctp_association *asoc;
3793 	int retval = -EINVAL;
3794 
3795 	if (optlen != sizeof(info))
3796 		goto out;
3797 
3798 	if (copy_from_user(&info, optval, sizeof(info))) {
3799 		retval = -EFAULT;
3800 		goto out;
3801 	}
3802 
3803 	if (info.pr_policy & ~SCTP_PR_SCTP_MASK)
3804 		goto out;
3805 
3806 	if (info.pr_policy == SCTP_PR_SCTP_NONE)
3807 		info.pr_value = 0;
3808 
3809 	asoc = sctp_id2assoc(sk, info.pr_assoc_id);
3810 	if (asoc) {
3811 		SCTP_PR_SET_POLICY(asoc->default_flags, info.pr_policy);
3812 		asoc->default_timetolive = info.pr_value;
3813 	} else if (!info.pr_assoc_id) {
3814 		struct sctp_sock *sp = sctp_sk(sk);
3815 
3816 		SCTP_PR_SET_POLICY(sp->default_flags, info.pr_policy);
3817 		sp->default_timetolive = info.pr_value;
3818 	} else {
3819 		goto out;
3820 	}
3821 
3822 	retval = 0;
3823 
3824 out:
3825 	return retval;
3826 }
3827 
3828 static int sctp_setsockopt_reconfig_supported(struct sock *sk,
3829 					      char __user *optval,
3830 					      unsigned int optlen)
3831 {
3832 	struct sctp_assoc_value params;
3833 	struct sctp_association *asoc;
3834 	int retval = -EINVAL;
3835 
3836 	if (optlen != sizeof(params))
3837 		goto out;
3838 
3839 	if (copy_from_user(&params, optval, optlen)) {
3840 		retval = -EFAULT;
3841 		goto out;
3842 	}
3843 
3844 	asoc = sctp_id2assoc(sk, params.assoc_id);
3845 	if (asoc) {
3846 		asoc->reconf_enable = !!params.assoc_value;
3847 	} else if (!params.assoc_id) {
3848 		struct sctp_sock *sp = sctp_sk(sk);
3849 
3850 		sp->ep->reconf_enable = !!params.assoc_value;
3851 	} else {
3852 		goto out;
3853 	}
3854 
3855 	retval = 0;
3856 
3857 out:
3858 	return retval;
3859 }
3860 
3861 static int sctp_setsockopt_enable_strreset(struct sock *sk,
3862 					   char __user *optval,
3863 					   unsigned int optlen)
3864 {
3865 	struct sctp_assoc_value params;
3866 	struct sctp_association *asoc;
3867 	int retval = -EINVAL;
3868 
3869 	if (optlen != sizeof(params))
3870 		goto out;
3871 
3872 	if (copy_from_user(&params, optval, optlen)) {
3873 		retval = -EFAULT;
3874 		goto out;
3875 	}
3876 
3877 	if (params.assoc_value & (~SCTP_ENABLE_STRRESET_MASK))
3878 		goto out;
3879 
3880 	asoc = sctp_id2assoc(sk, params.assoc_id);
3881 	if (asoc) {
3882 		asoc->strreset_enable = params.assoc_value;
3883 	} else if (!params.assoc_id) {
3884 		struct sctp_sock *sp = sctp_sk(sk);
3885 
3886 		sp->ep->strreset_enable = params.assoc_value;
3887 	} else {
3888 		goto out;
3889 	}
3890 
3891 	retval = 0;
3892 
3893 out:
3894 	return retval;
3895 }
3896 
3897 static int sctp_setsockopt_reset_streams(struct sock *sk,
3898 					 char __user *optval,
3899 					 unsigned int optlen)
3900 {
3901 	struct sctp_reset_streams *params;
3902 	struct sctp_association *asoc;
3903 	int retval = -EINVAL;
3904 
3905 	if (optlen < sizeof(*params))
3906 		return -EINVAL;
3907 	/* srs_number_streams is u16, so optlen can't be bigger than this. */
3908 	optlen = min_t(unsigned int, optlen, USHRT_MAX +
3909 					     sizeof(__u16) * sizeof(*params));
3910 
3911 	params = memdup_user(optval, optlen);
3912 	if (IS_ERR(params))
3913 		return PTR_ERR(params);
3914 
3915 	if (params->srs_number_streams * sizeof(__u16) >
3916 	    optlen - sizeof(*params))
3917 		goto out;
3918 
3919 	asoc = sctp_id2assoc(sk, params->srs_assoc_id);
3920 	if (!asoc)
3921 		goto out;
3922 
3923 	retval = sctp_send_reset_streams(asoc, params);
3924 
3925 out:
3926 	kfree(params);
3927 	return retval;
3928 }
3929 
3930 static int sctp_setsockopt_reset_assoc(struct sock *sk,
3931 				       char __user *optval,
3932 				       unsigned int optlen)
3933 {
3934 	struct sctp_association *asoc;
3935 	sctp_assoc_t associd;
3936 	int retval = -EINVAL;
3937 
3938 	if (optlen != sizeof(associd))
3939 		goto out;
3940 
3941 	if (copy_from_user(&associd, optval, optlen)) {
3942 		retval = -EFAULT;
3943 		goto out;
3944 	}
3945 
3946 	asoc = sctp_id2assoc(sk, associd);
3947 	if (!asoc)
3948 		goto out;
3949 
3950 	retval = sctp_send_reset_assoc(asoc);
3951 
3952 out:
3953 	return retval;
3954 }
3955 
3956 static int sctp_setsockopt_add_streams(struct sock *sk,
3957 				       char __user *optval,
3958 				       unsigned int optlen)
3959 {
3960 	struct sctp_association *asoc;
3961 	struct sctp_add_streams params;
3962 	int retval = -EINVAL;
3963 
3964 	if (optlen != sizeof(params))
3965 		goto out;
3966 
3967 	if (copy_from_user(&params, optval, optlen)) {
3968 		retval = -EFAULT;
3969 		goto out;
3970 	}
3971 
3972 	asoc = sctp_id2assoc(sk, params.sas_assoc_id);
3973 	if (!asoc)
3974 		goto out;
3975 
3976 	retval = sctp_send_add_streams(asoc, &params);
3977 
3978 out:
3979 	return retval;
3980 }
3981 
3982 static int sctp_setsockopt_scheduler(struct sock *sk,
3983 				     char __user *optval,
3984 				     unsigned int optlen)
3985 {
3986 	struct sctp_association *asoc;
3987 	struct sctp_assoc_value params;
3988 	int retval = -EINVAL;
3989 
3990 	if (optlen < sizeof(params))
3991 		goto out;
3992 
3993 	optlen = sizeof(params);
3994 	if (copy_from_user(&params, optval, optlen)) {
3995 		retval = -EFAULT;
3996 		goto out;
3997 	}
3998 
3999 	if (params.assoc_value > SCTP_SS_MAX)
4000 		goto out;
4001 
4002 	asoc = sctp_id2assoc(sk, params.assoc_id);
4003 	if (!asoc)
4004 		goto out;
4005 
4006 	retval = sctp_sched_set_sched(asoc, params.assoc_value);
4007 
4008 out:
4009 	return retval;
4010 }
4011 
4012 static int sctp_setsockopt_scheduler_value(struct sock *sk,
4013 					   char __user *optval,
4014 					   unsigned int optlen)
4015 {
4016 	struct sctp_association *asoc;
4017 	struct sctp_stream_value params;
4018 	int retval = -EINVAL;
4019 
4020 	if (optlen < sizeof(params))
4021 		goto out;
4022 
4023 	optlen = sizeof(params);
4024 	if (copy_from_user(&params, optval, optlen)) {
4025 		retval = -EFAULT;
4026 		goto out;
4027 	}
4028 
4029 	asoc = sctp_id2assoc(sk, params.assoc_id);
4030 	if (!asoc)
4031 		goto out;
4032 
4033 	retval = sctp_sched_set_value(asoc, params.stream_id,
4034 				      params.stream_value, GFP_KERNEL);
4035 
4036 out:
4037 	return retval;
4038 }
4039 
4040 /* API 6.2 setsockopt(), getsockopt()
4041  *
4042  * Applications use setsockopt() and getsockopt() to set or retrieve
4043  * socket options.  Socket options are used to change the default
4044  * behavior of sockets calls.  They are described in Section 7.
4045  *
4046  * The syntax is:
4047  *
4048  *   ret = getsockopt(int sd, int level, int optname, void __user *optval,
4049  *                    int __user *optlen);
4050  *   ret = setsockopt(int sd, int level, int optname, const void __user *optval,
4051  *                    int optlen);
4052  *
4053  *   sd      - the socket descript.
4054  *   level   - set to IPPROTO_SCTP for all SCTP options.
4055  *   optname - the option name.
4056  *   optval  - the buffer to store the value of the option.
4057  *   optlen  - the size of the buffer.
4058  */
4059 static int sctp_setsockopt(struct sock *sk, int level, int optname,
4060 			   char __user *optval, unsigned int optlen)
4061 {
4062 	int retval = 0;
4063 
4064 	pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
4065 
4066 	/* I can hardly begin to describe how wrong this is.  This is
4067 	 * so broken as to be worse than useless.  The API draft
4068 	 * REALLY is NOT helpful here...  I am not convinced that the
4069 	 * semantics of setsockopt() with a level OTHER THAN SOL_SCTP
4070 	 * are at all well-founded.
4071 	 */
4072 	if (level != SOL_SCTP) {
4073 		struct sctp_af *af = sctp_sk(sk)->pf->af;
4074 		retval = af->setsockopt(sk, level, optname, optval, optlen);
4075 		goto out_nounlock;
4076 	}
4077 
4078 	lock_sock(sk);
4079 
4080 	switch (optname) {
4081 	case SCTP_SOCKOPT_BINDX_ADD:
4082 		/* 'optlen' is the size of the addresses buffer. */
4083 		retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
4084 					       optlen, SCTP_BINDX_ADD_ADDR);
4085 		break;
4086 
4087 	case SCTP_SOCKOPT_BINDX_REM:
4088 		/* 'optlen' is the size of the addresses buffer. */
4089 		retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
4090 					       optlen, SCTP_BINDX_REM_ADDR);
4091 		break;
4092 
4093 	case SCTP_SOCKOPT_CONNECTX_OLD:
4094 		/* 'optlen' is the size of the addresses buffer. */
4095 		retval = sctp_setsockopt_connectx_old(sk,
4096 					    (struct sockaddr __user *)optval,
4097 					    optlen);
4098 		break;
4099 
4100 	case SCTP_SOCKOPT_CONNECTX:
4101 		/* 'optlen' is the size of the addresses buffer. */
4102 		retval = sctp_setsockopt_connectx(sk,
4103 					    (struct sockaddr __user *)optval,
4104 					    optlen);
4105 		break;
4106 
4107 	case SCTP_DISABLE_FRAGMENTS:
4108 		retval = sctp_setsockopt_disable_fragments(sk, optval, optlen);
4109 		break;
4110 
4111 	case SCTP_EVENTS:
4112 		retval = sctp_setsockopt_events(sk, optval, optlen);
4113 		break;
4114 
4115 	case SCTP_AUTOCLOSE:
4116 		retval = sctp_setsockopt_autoclose(sk, optval, optlen);
4117 		break;
4118 
4119 	case SCTP_PEER_ADDR_PARAMS:
4120 		retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
4121 		break;
4122 
4123 	case SCTP_DELAYED_SACK:
4124 		retval = sctp_setsockopt_delayed_ack(sk, optval, optlen);
4125 		break;
4126 	case SCTP_PARTIAL_DELIVERY_POINT:
4127 		retval = sctp_setsockopt_partial_delivery_point(sk, optval, optlen);
4128 		break;
4129 
4130 	case SCTP_INITMSG:
4131 		retval = sctp_setsockopt_initmsg(sk, optval, optlen);
4132 		break;
4133 	case SCTP_DEFAULT_SEND_PARAM:
4134 		retval = sctp_setsockopt_default_send_param(sk, optval,
4135 							    optlen);
4136 		break;
4137 	case SCTP_DEFAULT_SNDINFO:
4138 		retval = sctp_setsockopt_default_sndinfo(sk, optval, optlen);
4139 		break;
4140 	case SCTP_PRIMARY_ADDR:
4141 		retval = sctp_setsockopt_primary_addr(sk, optval, optlen);
4142 		break;
4143 	case SCTP_SET_PEER_PRIMARY_ADDR:
4144 		retval = sctp_setsockopt_peer_primary_addr(sk, optval, optlen);
4145 		break;
4146 	case SCTP_NODELAY:
4147 		retval = sctp_setsockopt_nodelay(sk, optval, optlen);
4148 		break;
4149 	case SCTP_RTOINFO:
4150 		retval = sctp_setsockopt_rtoinfo(sk, optval, optlen);
4151 		break;
4152 	case SCTP_ASSOCINFO:
4153 		retval = sctp_setsockopt_associnfo(sk, optval, optlen);
4154 		break;
4155 	case SCTP_I_WANT_MAPPED_V4_ADDR:
4156 		retval = sctp_setsockopt_mappedv4(sk, optval, optlen);
4157 		break;
4158 	case SCTP_MAXSEG:
4159 		retval = sctp_setsockopt_maxseg(sk, optval, optlen);
4160 		break;
4161 	case SCTP_ADAPTATION_LAYER:
4162 		retval = sctp_setsockopt_adaptation_layer(sk, optval, optlen);
4163 		break;
4164 	case SCTP_CONTEXT:
4165 		retval = sctp_setsockopt_context(sk, optval, optlen);
4166 		break;
4167 	case SCTP_FRAGMENT_INTERLEAVE:
4168 		retval = sctp_setsockopt_fragment_interleave(sk, optval, optlen);
4169 		break;
4170 	case SCTP_MAX_BURST:
4171 		retval = sctp_setsockopt_maxburst(sk, optval, optlen);
4172 		break;
4173 	case SCTP_AUTH_CHUNK:
4174 		retval = sctp_setsockopt_auth_chunk(sk, optval, optlen);
4175 		break;
4176 	case SCTP_HMAC_IDENT:
4177 		retval = sctp_setsockopt_hmac_ident(sk, optval, optlen);
4178 		break;
4179 	case SCTP_AUTH_KEY:
4180 		retval = sctp_setsockopt_auth_key(sk, optval, optlen);
4181 		break;
4182 	case SCTP_AUTH_ACTIVE_KEY:
4183 		retval = sctp_setsockopt_active_key(sk, optval, optlen);
4184 		break;
4185 	case SCTP_AUTH_DELETE_KEY:
4186 		retval = sctp_setsockopt_del_key(sk, optval, optlen);
4187 		break;
4188 	case SCTP_AUTO_ASCONF:
4189 		retval = sctp_setsockopt_auto_asconf(sk, optval, optlen);
4190 		break;
4191 	case SCTP_PEER_ADDR_THLDS:
4192 		retval = sctp_setsockopt_paddr_thresholds(sk, optval, optlen);
4193 		break;
4194 	case SCTP_RECVRCVINFO:
4195 		retval = sctp_setsockopt_recvrcvinfo(sk, optval, optlen);
4196 		break;
4197 	case SCTP_RECVNXTINFO:
4198 		retval = sctp_setsockopt_recvnxtinfo(sk, optval, optlen);
4199 		break;
4200 	case SCTP_PR_SUPPORTED:
4201 		retval = sctp_setsockopt_pr_supported(sk, optval, optlen);
4202 		break;
4203 	case SCTP_DEFAULT_PRINFO:
4204 		retval = sctp_setsockopt_default_prinfo(sk, optval, optlen);
4205 		break;
4206 	case SCTP_RECONFIG_SUPPORTED:
4207 		retval = sctp_setsockopt_reconfig_supported(sk, optval, optlen);
4208 		break;
4209 	case SCTP_ENABLE_STREAM_RESET:
4210 		retval = sctp_setsockopt_enable_strreset(sk, optval, optlen);
4211 		break;
4212 	case SCTP_RESET_STREAMS:
4213 		retval = sctp_setsockopt_reset_streams(sk, optval, optlen);
4214 		break;
4215 	case SCTP_RESET_ASSOC:
4216 		retval = sctp_setsockopt_reset_assoc(sk, optval, optlen);
4217 		break;
4218 	case SCTP_ADD_STREAMS:
4219 		retval = sctp_setsockopt_add_streams(sk, optval, optlen);
4220 		break;
4221 	case SCTP_STREAM_SCHEDULER:
4222 		retval = sctp_setsockopt_scheduler(sk, optval, optlen);
4223 		break;
4224 	case SCTP_STREAM_SCHEDULER_VALUE:
4225 		retval = sctp_setsockopt_scheduler_value(sk, optval, optlen);
4226 		break;
4227 	default:
4228 		retval = -ENOPROTOOPT;
4229 		break;
4230 	}
4231 
4232 	release_sock(sk);
4233 
4234 out_nounlock:
4235 	return retval;
4236 }
4237 
4238 /* API 3.1.6 connect() - UDP Style Syntax
4239  *
4240  * An application may use the connect() call in the UDP model to initiate an
4241  * association without sending data.
4242  *
4243  * The syntax is:
4244  *
4245  * ret = connect(int sd, const struct sockaddr *nam, socklen_t len);
4246  *
4247  * sd: the socket descriptor to have a new association added to.
4248  *
4249  * nam: the address structure (either struct sockaddr_in or struct
4250  *    sockaddr_in6 defined in RFC2553 [7]).
4251  *
4252  * len: the size of the address.
4253  */
4254 static int sctp_connect(struct sock *sk, struct sockaddr *addr,
4255 			int addr_len)
4256 {
4257 	int err = 0;
4258 	struct sctp_af *af;
4259 
4260 	lock_sock(sk);
4261 
4262 	pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
4263 		 addr, addr_len);
4264 
4265 	/* Validate addr_len before calling common connect/connectx routine. */
4266 	af = sctp_get_af_specific(addr->sa_family);
4267 	if (!af || addr_len < af->sockaddr_len) {
4268 		err = -EINVAL;
4269 	} else {
4270 		/* Pass correct addr len to common routine (so it knows there
4271 		 * is only one address being passed.
4272 		 */
4273 		err = __sctp_connect(sk, addr, af->sockaddr_len, NULL);
4274 	}
4275 
4276 	release_sock(sk);
4277 	return err;
4278 }
4279 
4280 /* FIXME: Write comments. */
4281 static int sctp_disconnect(struct sock *sk, int flags)
4282 {
4283 	return -EOPNOTSUPP; /* STUB */
4284 }
4285 
4286 /* 4.1.4 accept() - TCP Style Syntax
4287  *
4288  * Applications use accept() call to remove an established SCTP
4289  * association from the accept queue of the endpoint.  A new socket
4290  * descriptor will be returned from accept() to represent the newly
4291  * formed association.
4292  */
4293 static struct sock *sctp_accept(struct sock *sk, int flags, int *err, bool kern)
4294 {
4295 	struct sctp_sock *sp;
4296 	struct sctp_endpoint *ep;
4297 	struct sock *newsk = NULL;
4298 	struct sctp_association *asoc;
4299 	long timeo;
4300 	int error = 0;
4301 
4302 	lock_sock(sk);
4303 
4304 	sp = sctp_sk(sk);
4305 	ep = sp->ep;
4306 
4307 	if (!sctp_style(sk, TCP)) {
4308 		error = -EOPNOTSUPP;
4309 		goto out;
4310 	}
4311 
4312 	if (!sctp_sstate(sk, LISTENING)) {
4313 		error = -EINVAL;
4314 		goto out;
4315 	}
4316 
4317 	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
4318 
4319 	error = sctp_wait_for_accept(sk, timeo);
4320 	if (error)
4321 		goto out;
4322 
4323 	/* We treat the list of associations on the endpoint as the accept
4324 	 * queue and pick the first association on the list.
4325 	 */
4326 	asoc = list_entry(ep->asocs.next, struct sctp_association, asocs);
4327 
4328 	newsk = sp->pf->create_accept_sk(sk, asoc, kern);
4329 	if (!newsk) {
4330 		error = -ENOMEM;
4331 		goto out;
4332 	}
4333 
4334 	/* Populate the fields of the newsk from the oldsk and migrate the
4335 	 * asoc to the newsk.
4336 	 */
4337 	sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
4338 
4339 out:
4340 	release_sock(sk);
4341 	*err = error;
4342 	return newsk;
4343 }
4344 
4345 /* The SCTP ioctl handler. */
4346 static int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
4347 {
4348 	int rc = -ENOTCONN;
4349 
4350 	lock_sock(sk);
4351 
4352 	/*
4353 	 * SEQPACKET-style sockets in LISTENING state are valid, for
4354 	 * SCTP, so only discard TCP-style sockets in LISTENING state.
4355 	 */
4356 	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
4357 		goto out;
4358 
4359 	switch (cmd) {
4360 	case SIOCINQ: {
4361 		struct sk_buff *skb;
4362 		unsigned int amount = 0;
4363 
4364 		skb = skb_peek(&sk->sk_receive_queue);
4365 		if (skb != NULL) {
4366 			/*
4367 			 * We will only return the amount of this packet since
4368 			 * that is all that will be read.
4369 			 */
4370 			amount = skb->len;
4371 		}
4372 		rc = put_user(amount, (int __user *)arg);
4373 		break;
4374 	}
4375 	default:
4376 		rc = -ENOIOCTLCMD;
4377 		break;
4378 	}
4379 out:
4380 	release_sock(sk);
4381 	return rc;
4382 }
4383 
4384 /* This is the function which gets called during socket creation to
4385  * initialized the SCTP-specific portion of the sock.
4386  * The sock structure should already be zero-filled memory.
4387  */
4388 static int sctp_init_sock(struct sock *sk)
4389 {
4390 	struct net *net = sock_net(sk);
4391 	struct sctp_sock *sp;
4392 
4393 	pr_debug("%s: sk:%p\n", __func__, sk);
4394 
4395 	sp = sctp_sk(sk);
4396 
4397 	/* Initialize the SCTP per socket area.  */
4398 	switch (sk->sk_type) {
4399 	case SOCK_SEQPACKET:
4400 		sp->type = SCTP_SOCKET_UDP;
4401 		break;
4402 	case SOCK_STREAM:
4403 		sp->type = SCTP_SOCKET_TCP;
4404 		break;
4405 	default:
4406 		return -ESOCKTNOSUPPORT;
4407 	}
4408 
4409 	sk->sk_gso_type = SKB_GSO_SCTP;
4410 
4411 	/* Initialize default send parameters. These parameters can be
4412 	 * modified with the SCTP_DEFAULT_SEND_PARAM socket option.
4413 	 */
4414 	sp->default_stream = 0;
4415 	sp->default_ppid = 0;
4416 	sp->default_flags = 0;
4417 	sp->default_context = 0;
4418 	sp->default_timetolive = 0;
4419 
4420 	sp->default_rcv_context = 0;
4421 	sp->max_burst = net->sctp.max_burst;
4422 
4423 	sp->sctp_hmac_alg = net->sctp.sctp_hmac_alg;
4424 
4425 	/* Initialize default setup parameters. These parameters
4426 	 * can be modified with the SCTP_INITMSG socket option or
4427 	 * overridden by the SCTP_INIT CMSG.
4428 	 */
4429 	sp->initmsg.sinit_num_ostreams   = sctp_max_outstreams;
4430 	sp->initmsg.sinit_max_instreams  = sctp_max_instreams;
4431 	sp->initmsg.sinit_max_attempts   = net->sctp.max_retrans_init;
4432 	sp->initmsg.sinit_max_init_timeo = net->sctp.rto_max;
4433 
4434 	/* Initialize default RTO related parameters.  These parameters can
4435 	 * be modified for with the SCTP_RTOINFO socket option.
4436 	 */
4437 	sp->rtoinfo.srto_initial = net->sctp.rto_initial;
4438 	sp->rtoinfo.srto_max     = net->sctp.rto_max;
4439 	sp->rtoinfo.srto_min     = net->sctp.rto_min;
4440 
4441 	/* Initialize default association related parameters. These parameters
4442 	 * can be modified with the SCTP_ASSOCINFO socket option.
4443 	 */
4444 	sp->assocparams.sasoc_asocmaxrxt = net->sctp.max_retrans_association;
4445 	sp->assocparams.sasoc_number_peer_destinations = 0;
4446 	sp->assocparams.sasoc_peer_rwnd = 0;
4447 	sp->assocparams.sasoc_local_rwnd = 0;
4448 	sp->assocparams.sasoc_cookie_life = net->sctp.valid_cookie_life;
4449 
4450 	/* Initialize default event subscriptions. By default, all the
4451 	 * options are off.
4452 	 */
4453 	memset(&sp->subscribe, 0, sizeof(struct sctp_event_subscribe));
4454 
4455 	/* Default Peer Address Parameters.  These defaults can
4456 	 * be modified via SCTP_PEER_ADDR_PARAMS
4457 	 */
4458 	sp->hbinterval  = net->sctp.hb_interval;
4459 	sp->pathmaxrxt  = net->sctp.max_retrans_path;
4460 	sp->pathmtu     = 0; /* allow default discovery */
4461 	sp->sackdelay   = net->sctp.sack_timeout;
4462 	sp->sackfreq	= 2;
4463 	sp->param_flags = SPP_HB_ENABLE |
4464 			  SPP_PMTUD_ENABLE |
4465 			  SPP_SACKDELAY_ENABLE;
4466 
4467 	/* If enabled no SCTP message fragmentation will be performed.
4468 	 * Configure through SCTP_DISABLE_FRAGMENTS socket option.
4469 	 */
4470 	sp->disable_fragments = 0;
4471 
4472 	/* Enable Nagle algorithm by default.  */
4473 	sp->nodelay           = 0;
4474 
4475 	sp->recvrcvinfo = 0;
4476 	sp->recvnxtinfo = 0;
4477 
4478 	/* Enable by default. */
4479 	sp->v4mapped          = 1;
4480 
4481 	/* Auto-close idle associations after the configured
4482 	 * number of seconds.  A value of 0 disables this
4483 	 * feature.  Configure through the SCTP_AUTOCLOSE socket option,
4484 	 * for UDP-style sockets only.
4485 	 */
4486 	sp->autoclose         = 0;
4487 
4488 	/* User specified fragmentation limit. */
4489 	sp->user_frag         = 0;
4490 
4491 	sp->adaptation_ind = 0;
4492 
4493 	sp->pf = sctp_get_pf_specific(sk->sk_family);
4494 
4495 	/* Control variables for partial data delivery. */
4496 	atomic_set(&sp->pd_mode, 0);
4497 	skb_queue_head_init(&sp->pd_lobby);
4498 	sp->frag_interleave = 0;
4499 
4500 	/* Create a per socket endpoint structure.  Even if we
4501 	 * change the data structure relationships, this may still
4502 	 * be useful for storing pre-connect address information.
4503 	 */
4504 	sp->ep = sctp_endpoint_new(sk, GFP_KERNEL);
4505 	if (!sp->ep)
4506 		return -ENOMEM;
4507 
4508 	sp->hmac = NULL;
4509 
4510 	sk->sk_destruct = sctp_destruct_sock;
4511 
4512 	SCTP_DBG_OBJCNT_INC(sock);
4513 
4514 	local_bh_disable();
4515 	sk_sockets_allocated_inc(sk);
4516 	sock_prot_inuse_add(net, sk->sk_prot, 1);
4517 
4518 	/* Nothing can fail after this block, otherwise
4519 	 * sctp_destroy_sock() will be called without addr_wq_lock held
4520 	 */
4521 	if (net->sctp.default_auto_asconf) {
4522 		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
4523 		list_add_tail(&sp->auto_asconf_list,
4524 		    &net->sctp.auto_asconf_splist);
4525 		sp->do_auto_asconf = 1;
4526 		spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
4527 	} else {
4528 		sp->do_auto_asconf = 0;
4529 	}
4530 
4531 	local_bh_enable();
4532 
4533 	return 0;
4534 }
4535 
4536 /* Cleanup any SCTP per socket resources. Must be called with
4537  * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
4538  */
4539 static void sctp_destroy_sock(struct sock *sk)
4540 {
4541 	struct sctp_sock *sp;
4542 
4543 	pr_debug("%s: sk:%p\n", __func__, sk);
4544 
4545 	/* Release our hold on the endpoint. */
4546 	sp = sctp_sk(sk);
4547 	/* This could happen during socket init, thus we bail out
4548 	 * early, since the rest of the below is not setup either.
4549 	 */
4550 	if (sp->ep == NULL)
4551 		return;
4552 
4553 	if (sp->do_auto_asconf) {
4554 		sp->do_auto_asconf = 0;
4555 		list_del(&sp->auto_asconf_list);
4556 	}
4557 	sctp_endpoint_free(sp->ep);
4558 	local_bh_disable();
4559 	sk_sockets_allocated_dec(sk);
4560 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
4561 	local_bh_enable();
4562 }
4563 
4564 /* Triggered when there are no references on the socket anymore */
4565 static void sctp_destruct_sock(struct sock *sk)
4566 {
4567 	struct sctp_sock *sp = sctp_sk(sk);
4568 
4569 	/* Free up the HMAC transform. */
4570 	crypto_free_shash(sp->hmac);
4571 
4572 	inet_sock_destruct(sk);
4573 }
4574 
4575 /* API 4.1.7 shutdown() - TCP Style Syntax
4576  *     int shutdown(int socket, int how);
4577  *
4578  *     sd      - the socket descriptor of the association to be closed.
4579  *     how     - Specifies the type of shutdown.  The  values  are
4580  *               as follows:
4581  *               SHUT_RD
4582  *                     Disables further receive operations. No SCTP
4583  *                     protocol action is taken.
4584  *               SHUT_WR
4585  *                     Disables further send operations, and initiates
4586  *                     the SCTP shutdown sequence.
4587  *               SHUT_RDWR
4588  *                     Disables further send  and  receive  operations
4589  *                     and initiates the SCTP shutdown sequence.
4590  */
4591 static void sctp_shutdown(struct sock *sk, int how)
4592 {
4593 	struct net *net = sock_net(sk);
4594 	struct sctp_endpoint *ep;
4595 
4596 	if (!sctp_style(sk, TCP))
4597 		return;
4598 
4599 	ep = sctp_sk(sk)->ep;
4600 	if (how & SEND_SHUTDOWN && !list_empty(&ep->asocs)) {
4601 		struct sctp_association *asoc;
4602 
4603 		sk->sk_state = SCTP_SS_CLOSING;
4604 		asoc = list_entry(ep->asocs.next,
4605 				  struct sctp_association, asocs);
4606 		sctp_primitive_SHUTDOWN(net, asoc, NULL);
4607 	}
4608 }
4609 
4610 int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
4611 		       struct sctp_info *info)
4612 {
4613 	struct sctp_transport *prim;
4614 	struct list_head *pos;
4615 	int mask;
4616 
4617 	memset(info, 0, sizeof(*info));
4618 	if (!asoc) {
4619 		struct sctp_sock *sp = sctp_sk(sk);
4620 
4621 		info->sctpi_s_autoclose = sp->autoclose;
4622 		info->sctpi_s_adaptation_ind = sp->adaptation_ind;
4623 		info->sctpi_s_pd_point = sp->pd_point;
4624 		info->sctpi_s_nodelay = sp->nodelay;
4625 		info->sctpi_s_disable_fragments = sp->disable_fragments;
4626 		info->sctpi_s_v4mapped = sp->v4mapped;
4627 		info->sctpi_s_frag_interleave = sp->frag_interleave;
4628 		info->sctpi_s_type = sp->type;
4629 
4630 		return 0;
4631 	}
4632 
4633 	info->sctpi_tag = asoc->c.my_vtag;
4634 	info->sctpi_state = asoc->state;
4635 	info->sctpi_rwnd = asoc->a_rwnd;
4636 	info->sctpi_unackdata = asoc->unack_data;
4637 	info->sctpi_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
4638 	info->sctpi_instrms = asoc->stream.incnt;
4639 	info->sctpi_outstrms = asoc->stream.outcnt;
4640 	list_for_each(pos, &asoc->base.inqueue.in_chunk_list)
4641 		info->sctpi_inqueue++;
4642 	list_for_each(pos, &asoc->outqueue.out_chunk_list)
4643 		info->sctpi_outqueue++;
4644 	info->sctpi_overall_error = asoc->overall_error_count;
4645 	info->sctpi_max_burst = asoc->max_burst;
4646 	info->sctpi_maxseg = asoc->frag_point;
4647 	info->sctpi_peer_rwnd = asoc->peer.rwnd;
4648 	info->sctpi_peer_tag = asoc->c.peer_vtag;
4649 
4650 	mask = asoc->peer.ecn_capable << 1;
4651 	mask = (mask | asoc->peer.ipv4_address) << 1;
4652 	mask = (mask | asoc->peer.ipv6_address) << 1;
4653 	mask = (mask | asoc->peer.hostname_address) << 1;
4654 	mask = (mask | asoc->peer.asconf_capable) << 1;
4655 	mask = (mask | asoc->peer.prsctp_capable) << 1;
4656 	mask = (mask | asoc->peer.auth_capable);
4657 	info->sctpi_peer_capable = mask;
4658 	mask = asoc->peer.sack_needed << 1;
4659 	mask = (mask | asoc->peer.sack_generation) << 1;
4660 	mask = (mask | asoc->peer.zero_window_announced);
4661 	info->sctpi_peer_sack = mask;
4662 
4663 	info->sctpi_isacks = asoc->stats.isacks;
4664 	info->sctpi_osacks = asoc->stats.osacks;
4665 	info->sctpi_opackets = asoc->stats.opackets;
4666 	info->sctpi_ipackets = asoc->stats.ipackets;
4667 	info->sctpi_rtxchunks = asoc->stats.rtxchunks;
4668 	info->sctpi_outofseqtsns = asoc->stats.outofseqtsns;
4669 	info->sctpi_idupchunks = asoc->stats.idupchunks;
4670 	info->sctpi_gapcnt = asoc->stats.gapcnt;
4671 	info->sctpi_ouodchunks = asoc->stats.ouodchunks;
4672 	info->sctpi_iuodchunks = asoc->stats.iuodchunks;
4673 	info->sctpi_oodchunks = asoc->stats.oodchunks;
4674 	info->sctpi_iodchunks = asoc->stats.iodchunks;
4675 	info->sctpi_octrlchunks = asoc->stats.octrlchunks;
4676 	info->sctpi_ictrlchunks = asoc->stats.ictrlchunks;
4677 
4678 	prim = asoc->peer.primary_path;
4679 	memcpy(&info->sctpi_p_address, &prim->ipaddr, sizeof(prim->ipaddr));
4680 	info->sctpi_p_state = prim->state;
4681 	info->sctpi_p_cwnd = prim->cwnd;
4682 	info->sctpi_p_srtt = prim->srtt;
4683 	info->sctpi_p_rto = jiffies_to_msecs(prim->rto);
4684 	info->sctpi_p_hbinterval = prim->hbinterval;
4685 	info->sctpi_p_pathmaxrxt = prim->pathmaxrxt;
4686 	info->sctpi_p_sackdelay = jiffies_to_msecs(prim->sackdelay);
4687 	info->sctpi_p_ssthresh = prim->ssthresh;
4688 	info->sctpi_p_partial_bytes_acked = prim->partial_bytes_acked;
4689 	info->sctpi_p_flight_size = prim->flight_size;
4690 	info->sctpi_p_error = prim->error_count;
4691 
4692 	return 0;
4693 }
4694 EXPORT_SYMBOL_GPL(sctp_get_sctp_info);
4695 
4696 /* use callback to avoid exporting the core structure */
4697 int sctp_transport_walk_start(struct rhashtable_iter *iter)
4698 {
4699 	int err;
4700 
4701 	rhltable_walk_enter(&sctp_transport_hashtable, iter);
4702 
4703 	err = rhashtable_walk_start(iter);
4704 	if (err && err != -EAGAIN) {
4705 		rhashtable_walk_stop(iter);
4706 		rhashtable_walk_exit(iter);
4707 		return err;
4708 	}
4709 
4710 	return 0;
4711 }
4712 
4713 void sctp_transport_walk_stop(struct rhashtable_iter *iter)
4714 {
4715 	rhashtable_walk_stop(iter);
4716 	rhashtable_walk_exit(iter);
4717 }
4718 
4719 struct sctp_transport *sctp_transport_get_next(struct net *net,
4720 					       struct rhashtable_iter *iter)
4721 {
4722 	struct sctp_transport *t;
4723 
4724 	t = rhashtable_walk_next(iter);
4725 	for (; t; t = rhashtable_walk_next(iter)) {
4726 		if (IS_ERR(t)) {
4727 			if (PTR_ERR(t) == -EAGAIN)
4728 				continue;
4729 			break;
4730 		}
4731 
4732 		if (net_eq(sock_net(t->asoc->base.sk), net) &&
4733 		    t->asoc->peer.primary_path == t)
4734 			break;
4735 	}
4736 
4737 	return t;
4738 }
4739 
4740 struct sctp_transport *sctp_transport_get_idx(struct net *net,
4741 					      struct rhashtable_iter *iter,
4742 					      int pos)
4743 {
4744 	void *obj = SEQ_START_TOKEN;
4745 
4746 	while (pos && (obj = sctp_transport_get_next(net, iter)) &&
4747 	       !IS_ERR(obj))
4748 		pos--;
4749 
4750 	return obj;
4751 }
4752 
4753 int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
4754 			   void *p) {
4755 	int err = 0;
4756 	int hash = 0;
4757 	struct sctp_ep_common *epb;
4758 	struct sctp_hashbucket *head;
4759 
4760 	for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
4761 	     hash++, head++) {
4762 		read_lock_bh(&head->lock);
4763 		sctp_for_each_hentry(epb, &head->chain) {
4764 			err = cb(sctp_ep(epb), p);
4765 			if (err)
4766 				break;
4767 		}
4768 		read_unlock_bh(&head->lock);
4769 	}
4770 
4771 	return err;
4772 }
4773 EXPORT_SYMBOL_GPL(sctp_for_each_endpoint);
4774 
4775 int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
4776 				  struct net *net,
4777 				  const union sctp_addr *laddr,
4778 				  const union sctp_addr *paddr, void *p)
4779 {
4780 	struct sctp_transport *transport;
4781 	int err;
4782 
4783 	rcu_read_lock();
4784 	transport = sctp_addrs_lookup_transport(net, laddr, paddr);
4785 	rcu_read_unlock();
4786 	if (!transport)
4787 		return -ENOENT;
4788 
4789 	err = cb(transport, p);
4790 	sctp_transport_put(transport);
4791 
4792 	return err;
4793 }
4794 EXPORT_SYMBOL_GPL(sctp_transport_lookup_process);
4795 
4796 int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *),
4797 			    int (*cb_done)(struct sctp_transport *, void *),
4798 			    struct net *net, int *pos, void *p) {
4799 	struct rhashtable_iter hti;
4800 	struct sctp_transport *tsp;
4801 	int ret;
4802 
4803 again:
4804 	ret = sctp_transport_walk_start(&hti);
4805 	if (ret)
4806 		return ret;
4807 
4808 	tsp = sctp_transport_get_idx(net, &hti, *pos + 1);
4809 	for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) {
4810 		if (!sctp_transport_hold(tsp))
4811 			continue;
4812 		ret = cb(tsp, p);
4813 		if (ret)
4814 			break;
4815 		(*pos)++;
4816 		sctp_transport_put(tsp);
4817 	}
4818 	sctp_transport_walk_stop(&hti);
4819 
4820 	if (ret) {
4821 		if (cb_done && !cb_done(tsp, p)) {
4822 			(*pos)++;
4823 			sctp_transport_put(tsp);
4824 			goto again;
4825 		}
4826 		sctp_transport_put(tsp);
4827 	}
4828 
4829 	return ret;
4830 }
4831 EXPORT_SYMBOL_GPL(sctp_for_each_transport);
4832 
4833 /* 7.2.1 Association Status (SCTP_STATUS)
4834 
4835  * Applications can retrieve current status information about an
4836  * association, including association state, peer receiver window size,
4837  * number of unacked data chunks, and number of data chunks pending
4838  * receipt.  This information is read-only.
4839  */
4840 static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
4841 				       char __user *optval,
4842 				       int __user *optlen)
4843 {
4844 	struct sctp_status status;
4845 	struct sctp_association *asoc = NULL;
4846 	struct sctp_transport *transport;
4847 	sctp_assoc_t associd;
4848 	int retval = 0;
4849 
4850 	if (len < sizeof(status)) {
4851 		retval = -EINVAL;
4852 		goto out;
4853 	}
4854 
4855 	len = sizeof(status);
4856 	if (copy_from_user(&status, optval, len)) {
4857 		retval = -EFAULT;
4858 		goto out;
4859 	}
4860 
4861 	associd = status.sstat_assoc_id;
4862 	asoc = sctp_id2assoc(sk, associd);
4863 	if (!asoc) {
4864 		retval = -EINVAL;
4865 		goto out;
4866 	}
4867 
4868 	transport = asoc->peer.primary_path;
4869 
4870 	status.sstat_assoc_id = sctp_assoc2id(asoc);
4871 	status.sstat_state = sctp_assoc_to_state(asoc);
4872 	status.sstat_rwnd =  asoc->peer.rwnd;
4873 	status.sstat_unackdata = asoc->unack_data;
4874 
4875 	status.sstat_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
4876 	status.sstat_instrms = asoc->stream.incnt;
4877 	status.sstat_outstrms = asoc->stream.outcnt;
4878 	status.sstat_fragmentation_point = asoc->frag_point;
4879 	status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4880 	memcpy(&status.sstat_primary.spinfo_address, &transport->ipaddr,
4881 			transport->af_specific->sockaddr_len);
4882 	/* Map ipv4 address into v4-mapped-on-v6 address.  */
4883 	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
4884 		(union sctp_addr *)&status.sstat_primary.spinfo_address);
4885 	status.sstat_primary.spinfo_state = transport->state;
4886 	status.sstat_primary.spinfo_cwnd = transport->cwnd;
4887 	status.sstat_primary.spinfo_srtt = transport->srtt;
4888 	status.sstat_primary.spinfo_rto = jiffies_to_msecs(transport->rto);
4889 	status.sstat_primary.spinfo_mtu = transport->pathmtu;
4890 
4891 	if (status.sstat_primary.spinfo_state == SCTP_UNKNOWN)
4892 		status.sstat_primary.spinfo_state = SCTP_ACTIVE;
4893 
4894 	if (put_user(len, optlen)) {
4895 		retval = -EFAULT;
4896 		goto out;
4897 	}
4898 
4899 	pr_debug("%s: len:%d, state:%d, rwnd:%d, assoc_id:%d\n",
4900 		 __func__, len, status.sstat_state, status.sstat_rwnd,
4901 		 status.sstat_assoc_id);
4902 
4903 	if (copy_to_user(optval, &status, len)) {
4904 		retval = -EFAULT;
4905 		goto out;
4906 	}
4907 
4908 out:
4909 	return retval;
4910 }
4911 
4912 
4913 /* 7.2.2 Peer Address Information (SCTP_GET_PEER_ADDR_INFO)
4914  *
4915  * Applications can retrieve information about a specific peer address
4916  * of an association, including its reachability state, congestion
4917  * window, and retransmission timer values.  This information is
4918  * read-only.
4919  */
4920 static int sctp_getsockopt_peer_addr_info(struct sock *sk, int len,
4921 					  char __user *optval,
4922 					  int __user *optlen)
4923 {
4924 	struct sctp_paddrinfo pinfo;
4925 	struct sctp_transport *transport;
4926 	int retval = 0;
4927 
4928 	if (len < sizeof(pinfo)) {
4929 		retval = -EINVAL;
4930 		goto out;
4931 	}
4932 
4933 	len = sizeof(pinfo);
4934 	if (copy_from_user(&pinfo, optval, len)) {
4935 		retval = -EFAULT;
4936 		goto out;
4937 	}
4938 
4939 	transport = sctp_addr_id2transport(sk, &pinfo.spinfo_address,
4940 					   pinfo.spinfo_assoc_id);
4941 	if (!transport)
4942 		return -EINVAL;
4943 
4944 	pinfo.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4945 	pinfo.spinfo_state = transport->state;
4946 	pinfo.spinfo_cwnd = transport->cwnd;
4947 	pinfo.spinfo_srtt = transport->srtt;
4948 	pinfo.spinfo_rto = jiffies_to_msecs(transport->rto);
4949 	pinfo.spinfo_mtu = transport->pathmtu;
4950 
4951 	if (pinfo.spinfo_state == SCTP_UNKNOWN)
4952 		pinfo.spinfo_state = SCTP_ACTIVE;
4953 
4954 	if (put_user(len, optlen)) {
4955 		retval = -EFAULT;
4956 		goto out;
4957 	}
4958 
4959 	if (copy_to_user(optval, &pinfo, len)) {
4960 		retval = -EFAULT;
4961 		goto out;
4962 	}
4963 
4964 out:
4965 	return retval;
4966 }
4967 
4968 /* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
4969  *
4970  * This option is a on/off flag.  If enabled no SCTP message
4971  * fragmentation will be performed.  Instead if a message being sent
4972  * exceeds the current PMTU size, the message will NOT be sent and
4973  * instead a error will be indicated to the user.
4974  */
4975 static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
4976 					char __user *optval, int __user *optlen)
4977 {
4978 	int val;
4979 
4980 	if (len < sizeof(int))
4981 		return -EINVAL;
4982 
4983 	len = sizeof(int);
4984 	val = (sctp_sk(sk)->disable_fragments == 1);
4985 	if (put_user(len, optlen))
4986 		return -EFAULT;
4987 	if (copy_to_user(optval, &val, len))
4988 		return -EFAULT;
4989 	return 0;
4990 }
4991 
4992 /* 7.1.15 Set notification and ancillary events (SCTP_EVENTS)
4993  *
4994  * This socket option is used to specify various notifications and
4995  * ancillary data the user wishes to receive.
4996  */
4997 static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
4998 				  int __user *optlen)
4999 {
5000 	if (len == 0)
5001 		return -EINVAL;
5002 	if (len > sizeof(struct sctp_event_subscribe))
5003 		len = sizeof(struct sctp_event_subscribe);
5004 	if (put_user(len, optlen))
5005 		return -EFAULT;
5006 	if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
5007 		return -EFAULT;
5008 	return 0;
5009 }
5010 
5011 /* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
5012  *
5013  * This socket option is applicable to the UDP-style socket only.  When
5014  * set it will cause associations that are idle for more than the
5015  * specified number of seconds to automatically close.  An association
5016  * being idle is defined an association that has NOT sent or received
5017  * user data.  The special value of '0' indicates that no automatic
5018  * close of any associations should be performed.  The option expects an
5019  * integer defining the number of seconds of idle time before an
5020  * association is closed.
5021  */
5022 static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
5023 {
5024 	/* Applicable to UDP-style socket only */
5025 	if (sctp_style(sk, TCP))
5026 		return -EOPNOTSUPP;
5027 	if (len < sizeof(int))
5028 		return -EINVAL;
5029 	len = sizeof(int);
5030 	if (put_user(len, optlen))
5031 		return -EFAULT;
5032 	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
5033 		return -EFAULT;
5034 	return 0;
5035 }
5036 
5037 /* Helper routine to branch off an association to a new socket.  */
5038 int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
5039 {
5040 	struct sctp_association *asoc = sctp_id2assoc(sk, id);
5041 	struct sctp_sock *sp = sctp_sk(sk);
5042 	struct socket *sock;
5043 	int err = 0;
5044 
5045 	/* Do not peel off from one netns to another one. */
5046 	if (!net_eq(current->nsproxy->net_ns, sock_net(sk)))
5047 		return -EINVAL;
5048 
5049 	if (!asoc)
5050 		return -EINVAL;
5051 
5052 	/* An association cannot be branched off from an already peeled-off
5053 	 * socket, nor is this supported for tcp style sockets.
5054 	 */
5055 	if (!sctp_style(sk, UDP))
5056 		return -EINVAL;
5057 
5058 	/* Create a new socket.  */
5059 	err = sock_create(sk->sk_family, SOCK_SEQPACKET, IPPROTO_SCTP, &sock);
5060 	if (err < 0)
5061 		return err;
5062 
5063 	sctp_copy_sock(sock->sk, sk, asoc);
5064 
5065 	/* Make peeled-off sockets more like 1-1 accepted sockets.
5066 	 * Set the daddr and initialize id to something more random
5067 	 */
5068 	sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk);
5069 
5070 	/* Populate the fields of the newsk from the oldsk and migrate the
5071 	 * asoc to the newsk.
5072 	 */
5073 	sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
5074 
5075 	*sockp = sock;
5076 
5077 	return err;
5078 }
5079 EXPORT_SYMBOL(sctp_do_peeloff);
5080 
5081 static int sctp_getsockopt_peeloff_common(struct sock *sk, sctp_peeloff_arg_t *peeloff,
5082 					  struct file **newfile, unsigned flags)
5083 {
5084 	struct socket *newsock;
5085 	int retval;
5086 
5087 	retval = sctp_do_peeloff(sk, peeloff->associd, &newsock);
5088 	if (retval < 0)
5089 		goto out;
5090 
5091 	/* Map the socket to an unused fd that can be returned to the user.  */
5092 	retval = get_unused_fd_flags(flags & SOCK_CLOEXEC);
5093 	if (retval < 0) {
5094 		sock_release(newsock);
5095 		goto out;
5096 	}
5097 
5098 	*newfile = sock_alloc_file(newsock, 0, NULL);
5099 	if (IS_ERR(*newfile)) {
5100 		put_unused_fd(retval);
5101 		retval = PTR_ERR(*newfile);
5102 		*newfile = NULL;
5103 		return retval;
5104 	}
5105 
5106 	pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
5107 		 retval);
5108 
5109 	peeloff->sd = retval;
5110 
5111 	if (flags & SOCK_NONBLOCK)
5112 		(*newfile)->f_flags |= O_NONBLOCK;
5113 out:
5114 	return retval;
5115 }
5116 
5117 static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen)
5118 {
5119 	sctp_peeloff_arg_t peeloff;
5120 	struct file *newfile = NULL;
5121 	int retval = 0;
5122 
5123 	if (len < sizeof(sctp_peeloff_arg_t))
5124 		return -EINVAL;
5125 	len = sizeof(sctp_peeloff_arg_t);
5126 	if (copy_from_user(&peeloff, optval, len))
5127 		return -EFAULT;
5128 
5129 	retval = sctp_getsockopt_peeloff_common(sk, &peeloff, &newfile, 0);
5130 	if (retval < 0)
5131 		goto out;
5132 
5133 	/* Return the fd mapped to the new socket.  */
5134 	if (put_user(len, optlen)) {
5135 		fput(newfile);
5136 		put_unused_fd(retval);
5137 		return -EFAULT;
5138 	}
5139 
5140 	if (copy_to_user(optval, &peeloff, len)) {
5141 		fput(newfile);
5142 		put_unused_fd(retval);
5143 		return -EFAULT;
5144 	}
5145 	fd_install(retval, newfile);
5146 out:
5147 	return retval;
5148 }
5149 
5150 static int sctp_getsockopt_peeloff_flags(struct sock *sk, int len,
5151 					 char __user *optval, int __user *optlen)
5152 {
5153 	sctp_peeloff_flags_arg_t peeloff;
5154 	struct file *newfile = NULL;
5155 	int retval = 0;
5156 
5157 	if (len < sizeof(sctp_peeloff_flags_arg_t))
5158 		return -EINVAL;
5159 	len = sizeof(sctp_peeloff_flags_arg_t);
5160 	if (copy_from_user(&peeloff, optval, len))
5161 		return -EFAULT;
5162 
5163 	retval = sctp_getsockopt_peeloff_common(sk, &peeloff.p_arg,
5164 						&newfile, peeloff.flags);
5165 	if (retval < 0)
5166 		goto out;
5167 
5168 	/* Return the fd mapped to the new socket.  */
5169 	if (put_user(len, optlen)) {
5170 		fput(newfile);
5171 		put_unused_fd(retval);
5172 		return -EFAULT;
5173 	}
5174 
5175 	if (copy_to_user(optval, &peeloff, len)) {
5176 		fput(newfile);
5177 		put_unused_fd(retval);
5178 		return -EFAULT;
5179 	}
5180 	fd_install(retval, newfile);
5181 out:
5182 	return retval;
5183 }
5184 
5185 /* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
5186  *
5187  * Applications can enable or disable heartbeats for any peer address of
5188  * an association, modify an address's heartbeat interval, force a
5189  * heartbeat to be sent immediately, and adjust the address's maximum
5190  * number of retransmissions sent before an address is considered
5191  * unreachable.  The following structure is used to access and modify an
5192  * address's parameters:
5193  *
5194  *  struct sctp_paddrparams {
5195  *     sctp_assoc_t            spp_assoc_id;
5196  *     struct sockaddr_storage spp_address;
5197  *     uint32_t                spp_hbinterval;
5198  *     uint16_t                spp_pathmaxrxt;
5199  *     uint32_t                spp_pathmtu;
5200  *     uint32_t                spp_sackdelay;
5201  *     uint32_t                spp_flags;
5202  * };
5203  *
5204  *   spp_assoc_id    - (one-to-many style socket) This is filled in the
5205  *                     application, and identifies the association for
5206  *                     this query.
5207  *   spp_address     - This specifies which address is of interest.
5208  *   spp_hbinterval  - This contains the value of the heartbeat interval,
5209  *                     in milliseconds.  If a  value of zero
5210  *                     is present in this field then no changes are to
5211  *                     be made to this parameter.
5212  *   spp_pathmaxrxt  - This contains the maximum number of
5213  *                     retransmissions before this address shall be
5214  *                     considered unreachable. If a  value of zero
5215  *                     is present in this field then no changes are to
5216  *                     be made to this parameter.
5217  *   spp_pathmtu     - When Path MTU discovery is disabled the value
5218  *                     specified here will be the "fixed" path mtu.
5219  *                     Note that if the spp_address field is empty
5220  *                     then all associations on this address will
5221  *                     have this fixed path mtu set upon them.
5222  *
5223  *   spp_sackdelay   - When delayed sack is enabled, this value specifies
5224  *                     the number of milliseconds that sacks will be delayed
5225  *                     for. This value will apply to all addresses of an
5226  *                     association if the spp_address field is empty. Note
5227  *                     also, that if delayed sack is enabled and this
5228  *                     value is set to 0, no change is made to the last
5229  *                     recorded delayed sack timer value.
5230  *
5231  *   spp_flags       - These flags are used to control various features
5232  *                     on an association. The flag field may contain
5233  *                     zero or more of the following options.
5234  *
5235  *                     SPP_HB_ENABLE  - Enable heartbeats on the
5236  *                     specified address. Note that if the address
5237  *                     field is empty all addresses for the association
5238  *                     have heartbeats enabled upon them.
5239  *
5240  *                     SPP_HB_DISABLE - Disable heartbeats on the
5241  *                     speicifed address. Note that if the address
5242  *                     field is empty all addresses for the association
5243  *                     will have their heartbeats disabled. Note also
5244  *                     that SPP_HB_ENABLE and SPP_HB_DISABLE are
5245  *                     mutually exclusive, only one of these two should
5246  *                     be specified. Enabling both fields will have
5247  *                     undetermined results.
5248  *
5249  *                     SPP_HB_DEMAND - Request a user initiated heartbeat
5250  *                     to be made immediately.
5251  *
5252  *                     SPP_PMTUD_ENABLE - This field will enable PMTU
5253  *                     discovery upon the specified address. Note that
5254  *                     if the address feild is empty then all addresses
5255  *                     on the association are effected.
5256  *
5257  *                     SPP_PMTUD_DISABLE - This field will disable PMTU
5258  *                     discovery upon the specified address. Note that
5259  *                     if the address feild is empty then all addresses
5260  *                     on the association are effected. Not also that
5261  *                     SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
5262  *                     exclusive. Enabling both will have undetermined
5263  *                     results.
5264  *
5265  *                     SPP_SACKDELAY_ENABLE - Setting this flag turns
5266  *                     on delayed sack. The time specified in spp_sackdelay
5267  *                     is used to specify the sack delay for this address. Note
5268  *                     that if spp_address is empty then all addresses will
5269  *                     enable delayed sack and take on the sack delay
5270  *                     value specified in spp_sackdelay.
5271  *                     SPP_SACKDELAY_DISABLE - Setting this flag turns
5272  *                     off delayed sack. If the spp_address field is blank then
5273  *                     delayed sack is disabled for the entire association. Note
5274  *                     also that this field is mutually exclusive to
5275  *                     SPP_SACKDELAY_ENABLE, setting both will have undefined
5276  *                     results.
5277  */
5278 static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
5279 					    char __user *optval, int __user *optlen)
5280 {
5281 	struct sctp_paddrparams  params;
5282 	struct sctp_transport   *trans = NULL;
5283 	struct sctp_association *asoc = NULL;
5284 	struct sctp_sock        *sp = sctp_sk(sk);
5285 
5286 	if (len < sizeof(struct sctp_paddrparams))
5287 		return -EINVAL;
5288 	len = sizeof(struct sctp_paddrparams);
5289 	if (copy_from_user(&params, optval, len))
5290 		return -EFAULT;
5291 
5292 	/* If an address other than INADDR_ANY is specified, and
5293 	 * no transport is found, then the request is invalid.
5294 	 */
5295 	if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
5296 		trans = sctp_addr_id2transport(sk, &params.spp_address,
5297 					       params.spp_assoc_id);
5298 		if (!trans) {
5299 			pr_debug("%s: failed no transport\n", __func__);
5300 			return -EINVAL;
5301 		}
5302 	}
5303 
5304 	/* Get association, if assoc_id != 0 and the socket is a one
5305 	 * to many style socket, and an association was not found, then
5306 	 * the id was invalid.
5307 	 */
5308 	asoc = sctp_id2assoc(sk, params.spp_assoc_id);
5309 	if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP)) {
5310 		pr_debug("%s: failed no association\n", __func__);
5311 		return -EINVAL;
5312 	}
5313 
5314 	if (trans) {
5315 		/* Fetch transport values. */
5316 		params.spp_hbinterval = jiffies_to_msecs(trans->hbinterval);
5317 		params.spp_pathmtu    = trans->pathmtu;
5318 		params.spp_pathmaxrxt = trans->pathmaxrxt;
5319 		params.spp_sackdelay  = jiffies_to_msecs(trans->sackdelay);
5320 
5321 		/*draft-11 doesn't say what to return in spp_flags*/
5322 		params.spp_flags      = trans->param_flags;
5323 	} else if (asoc) {
5324 		/* Fetch association values. */
5325 		params.spp_hbinterval = jiffies_to_msecs(asoc->hbinterval);
5326 		params.spp_pathmtu    = asoc->pathmtu;
5327 		params.spp_pathmaxrxt = asoc->pathmaxrxt;
5328 		params.spp_sackdelay  = jiffies_to_msecs(asoc->sackdelay);
5329 
5330 		/*draft-11 doesn't say what to return in spp_flags*/
5331 		params.spp_flags      = asoc->param_flags;
5332 	} else {
5333 		/* Fetch socket values. */
5334 		params.spp_hbinterval = sp->hbinterval;
5335 		params.spp_pathmtu    = sp->pathmtu;
5336 		params.spp_sackdelay  = sp->sackdelay;
5337 		params.spp_pathmaxrxt = sp->pathmaxrxt;
5338 
5339 		/*draft-11 doesn't say what to return in spp_flags*/
5340 		params.spp_flags      = sp->param_flags;
5341 	}
5342 
5343 	if (copy_to_user(optval, &params, len))
5344 		return -EFAULT;
5345 
5346 	if (put_user(len, optlen))
5347 		return -EFAULT;
5348 
5349 	return 0;
5350 }
5351 
5352 /*
5353  * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
5354  *
5355  * This option will effect the way delayed acks are performed.  This
5356  * option allows you to get or set the delayed ack time, in
5357  * milliseconds.  It also allows changing the delayed ack frequency.
5358  * Changing the frequency to 1 disables the delayed sack algorithm.  If
5359  * the assoc_id is 0, then this sets or gets the endpoints default
5360  * values.  If the assoc_id field is non-zero, then the set or get
5361  * effects the specified association for the one to many model (the
5362  * assoc_id field is ignored by the one to one model).  Note that if
5363  * sack_delay or sack_freq are 0 when setting this option, then the
5364  * current values will remain unchanged.
5365  *
5366  * struct sctp_sack_info {
5367  *     sctp_assoc_t            sack_assoc_id;
5368  *     uint32_t                sack_delay;
5369  *     uint32_t                sack_freq;
5370  * };
5371  *
5372  * sack_assoc_id -  This parameter, indicates which association the user
5373  *    is performing an action upon.  Note that if this field's value is
5374  *    zero then the endpoints default value is changed (effecting future
5375  *    associations only).
5376  *
5377  * sack_delay -  This parameter contains the number of milliseconds that
5378  *    the user is requesting the delayed ACK timer be set to.  Note that
5379  *    this value is defined in the standard to be between 200 and 500
5380  *    milliseconds.
5381  *
5382  * sack_freq -  This parameter contains the number of packets that must
5383  *    be received before a sack is sent without waiting for the delay
5384  *    timer to expire.  The default value for this is 2, setting this
5385  *    value to 1 will disable the delayed sack algorithm.
5386  */
5387 static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
5388 					    char __user *optval,
5389 					    int __user *optlen)
5390 {
5391 	struct sctp_sack_info    params;
5392 	struct sctp_association *asoc = NULL;
5393 	struct sctp_sock        *sp = sctp_sk(sk);
5394 
5395 	if (len >= sizeof(struct sctp_sack_info)) {
5396 		len = sizeof(struct sctp_sack_info);
5397 
5398 		if (copy_from_user(&params, optval, len))
5399 			return -EFAULT;
5400 	} else if (len == sizeof(struct sctp_assoc_value)) {
5401 		pr_warn_ratelimited(DEPRECATED
5402 				    "%s (pid %d) "
5403 				    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
5404 				    "Use struct sctp_sack_info instead\n",
5405 				    current->comm, task_pid_nr(current));
5406 		if (copy_from_user(&params, optval, len))
5407 			return -EFAULT;
5408 	} else
5409 		return -EINVAL;
5410 
5411 	/* Get association, if sack_assoc_id != 0 and the socket is a one
5412 	 * to many style socket, and an association was not found, then
5413 	 * the id was invalid.
5414 	 */
5415 	asoc = sctp_id2assoc(sk, params.sack_assoc_id);
5416 	if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
5417 		return -EINVAL;
5418 
5419 	if (asoc) {
5420 		/* Fetch association values. */
5421 		if (asoc->param_flags & SPP_SACKDELAY_ENABLE) {
5422 			params.sack_delay = jiffies_to_msecs(
5423 				asoc->sackdelay);
5424 			params.sack_freq = asoc->sackfreq;
5425 
5426 		} else {
5427 			params.sack_delay = 0;
5428 			params.sack_freq = 1;
5429 		}
5430 	} else {
5431 		/* Fetch socket values. */
5432 		if (sp->param_flags & SPP_SACKDELAY_ENABLE) {
5433 			params.sack_delay  = sp->sackdelay;
5434 			params.sack_freq = sp->sackfreq;
5435 		} else {
5436 			params.sack_delay  = 0;
5437 			params.sack_freq = 1;
5438 		}
5439 	}
5440 
5441 	if (copy_to_user(optval, &params, len))
5442 		return -EFAULT;
5443 
5444 	if (put_user(len, optlen))
5445 		return -EFAULT;
5446 
5447 	return 0;
5448 }
5449 
5450 /* 7.1.3 Initialization Parameters (SCTP_INITMSG)
5451  *
5452  * Applications can specify protocol parameters for the default association
5453  * initialization.  The option name argument to setsockopt() and getsockopt()
5454  * is SCTP_INITMSG.
5455  *
5456  * Setting initialization parameters is effective only on an unconnected
5457  * socket (for UDP-style sockets only future associations are effected
5458  * by the change).  With TCP-style sockets, this option is inherited by
5459  * sockets derived from a listener socket.
5460  */
5461 static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
5462 {
5463 	if (len < sizeof(struct sctp_initmsg))
5464 		return -EINVAL;
5465 	len = sizeof(struct sctp_initmsg);
5466 	if (put_user(len, optlen))
5467 		return -EFAULT;
5468 	if (copy_to_user(optval, &sctp_sk(sk)->initmsg, len))
5469 		return -EFAULT;
5470 	return 0;
5471 }
5472 
5473 
5474 static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
5475 				      char __user *optval, int __user *optlen)
5476 {
5477 	struct sctp_association *asoc;
5478 	int cnt = 0;
5479 	struct sctp_getaddrs getaddrs;
5480 	struct sctp_transport *from;
5481 	void __user *to;
5482 	union sctp_addr temp;
5483 	struct sctp_sock *sp = sctp_sk(sk);
5484 	int addrlen;
5485 	size_t space_left;
5486 	int bytes_copied;
5487 
5488 	if (len < sizeof(struct sctp_getaddrs))
5489 		return -EINVAL;
5490 
5491 	if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
5492 		return -EFAULT;
5493 
5494 	/* For UDP-style sockets, id specifies the association to query.  */
5495 	asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
5496 	if (!asoc)
5497 		return -EINVAL;
5498 
5499 	to = optval + offsetof(struct sctp_getaddrs, addrs);
5500 	space_left = len - offsetof(struct sctp_getaddrs, addrs);
5501 
5502 	list_for_each_entry(from, &asoc->peer.transport_addr_list,
5503 				transports) {
5504 		memcpy(&temp, &from->ipaddr, sizeof(temp));
5505 		addrlen = sctp_get_pf_specific(sk->sk_family)
5506 			      ->addr_to_user(sp, &temp);
5507 		if (space_left < addrlen)
5508 			return -ENOMEM;
5509 		if (copy_to_user(to, &temp, addrlen))
5510 			return -EFAULT;
5511 		to += addrlen;
5512 		cnt++;
5513 		space_left -= addrlen;
5514 	}
5515 
5516 	if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num))
5517 		return -EFAULT;
5518 	bytes_copied = ((char __user *)to) - optval;
5519 	if (put_user(bytes_copied, optlen))
5520 		return -EFAULT;
5521 
5522 	return 0;
5523 }
5524 
5525 static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
5526 			    size_t space_left, int *bytes_copied)
5527 {
5528 	struct sctp_sockaddr_entry *addr;
5529 	union sctp_addr temp;
5530 	int cnt = 0;
5531 	int addrlen;
5532 	struct net *net = sock_net(sk);
5533 
5534 	rcu_read_lock();
5535 	list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
5536 		if (!addr->valid)
5537 			continue;
5538 
5539 		if ((PF_INET == sk->sk_family) &&
5540 		    (AF_INET6 == addr->a.sa.sa_family))
5541 			continue;
5542 		if ((PF_INET6 == sk->sk_family) &&
5543 		    inet_v6_ipv6only(sk) &&
5544 		    (AF_INET == addr->a.sa.sa_family))
5545 			continue;
5546 		memcpy(&temp, &addr->a, sizeof(temp));
5547 		if (!temp.v4.sin_port)
5548 			temp.v4.sin_port = htons(port);
5549 
5550 		addrlen = sctp_get_pf_specific(sk->sk_family)
5551 			      ->addr_to_user(sctp_sk(sk), &temp);
5552 
5553 		if (space_left < addrlen) {
5554 			cnt =  -ENOMEM;
5555 			break;
5556 		}
5557 		memcpy(to, &temp, addrlen);
5558 
5559 		to += addrlen;
5560 		cnt++;
5561 		space_left -= addrlen;
5562 		*bytes_copied += addrlen;
5563 	}
5564 	rcu_read_unlock();
5565 
5566 	return cnt;
5567 }
5568 
5569 
5570 static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
5571 				       char __user *optval, int __user *optlen)
5572 {
5573 	struct sctp_bind_addr *bp;
5574 	struct sctp_association *asoc;
5575 	int cnt = 0;
5576 	struct sctp_getaddrs getaddrs;
5577 	struct sctp_sockaddr_entry *addr;
5578 	void __user *to;
5579 	union sctp_addr temp;
5580 	struct sctp_sock *sp = sctp_sk(sk);
5581 	int addrlen;
5582 	int err = 0;
5583 	size_t space_left;
5584 	int bytes_copied = 0;
5585 	void *addrs;
5586 	void *buf;
5587 
5588 	if (len < sizeof(struct sctp_getaddrs))
5589 		return -EINVAL;
5590 
5591 	if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
5592 		return -EFAULT;
5593 
5594 	/*
5595 	 *  For UDP-style sockets, id specifies the association to query.
5596 	 *  If the id field is set to the value '0' then the locally bound
5597 	 *  addresses are returned without regard to any particular
5598 	 *  association.
5599 	 */
5600 	if (0 == getaddrs.assoc_id) {
5601 		bp = &sctp_sk(sk)->ep->base.bind_addr;
5602 	} else {
5603 		asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
5604 		if (!asoc)
5605 			return -EINVAL;
5606 		bp = &asoc->base.bind_addr;
5607 	}
5608 
5609 	to = optval + offsetof(struct sctp_getaddrs, addrs);
5610 	space_left = len - offsetof(struct sctp_getaddrs, addrs);
5611 
5612 	addrs = kmalloc(space_left, GFP_USER | __GFP_NOWARN);
5613 	if (!addrs)
5614 		return -ENOMEM;
5615 
5616 	/* If the endpoint is bound to 0.0.0.0 or ::0, get the valid
5617 	 * addresses from the global local address list.
5618 	 */
5619 	if (sctp_list_single_entry(&bp->address_list)) {
5620 		addr = list_entry(bp->address_list.next,
5621 				  struct sctp_sockaddr_entry, list);
5622 		if (sctp_is_any(sk, &addr->a)) {
5623 			cnt = sctp_copy_laddrs(sk, bp->port, addrs,
5624 						space_left, &bytes_copied);
5625 			if (cnt < 0) {
5626 				err = cnt;
5627 				goto out;
5628 			}
5629 			goto copy_getaddrs;
5630 		}
5631 	}
5632 
5633 	buf = addrs;
5634 	/* Protection on the bound address list is not needed since
5635 	 * in the socket option context we hold a socket lock and
5636 	 * thus the bound address list can't change.
5637 	 */
5638 	list_for_each_entry(addr, &bp->address_list, list) {
5639 		memcpy(&temp, &addr->a, sizeof(temp));
5640 		addrlen = sctp_get_pf_specific(sk->sk_family)
5641 			      ->addr_to_user(sp, &temp);
5642 		if (space_left < addrlen) {
5643 			err =  -ENOMEM; /*fixme: right error?*/
5644 			goto out;
5645 		}
5646 		memcpy(buf, &temp, addrlen);
5647 		buf += addrlen;
5648 		bytes_copied += addrlen;
5649 		cnt++;
5650 		space_left -= addrlen;
5651 	}
5652 
5653 copy_getaddrs:
5654 	if (copy_to_user(to, addrs, bytes_copied)) {
5655 		err = -EFAULT;
5656 		goto out;
5657 	}
5658 	if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num)) {
5659 		err = -EFAULT;
5660 		goto out;
5661 	}
5662 	/* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
5663 	 * but we can't change it anymore.
5664 	 */
5665 	if (put_user(bytes_copied, optlen))
5666 		err = -EFAULT;
5667 out:
5668 	kfree(addrs);
5669 	return err;
5670 }
5671 
5672 /* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
5673  *
5674  * Requests that the local SCTP stack use the enclosed peer address as
5675  * the association primary.  The enclosed address must be one of the
5676  * association peer's addresses.
5677  */
5678 static int sctp_getsockopt_primary_addr(struct sock *sk, int len,
5679 					char __user *optval, int __user *optlen)
5680 {
5681 	struct sctp_prim prim;
5682 	struct sctp_association *asoc;
5683 	struct sctp_sock *sp = sctp_sk(sk);
5684 
5685 	if (len < sizeof(struct sctp_prim))
5686 		return -EINVAL;
5687 
5688 	len = sizeof(struct sctp_prim);
5689 
5690 	if (copy_from_user(&prim, optval, len))
5691 		return -EFAULT;
5692 
5693 	asoc = sctp_id2assoc(sk, prim.ssp_assoc_id);
5694 	if (!asoc)
5695 		return -EINVAL;
5696 
5697 	if (!asoc->peer.primary_path)
5698 		return -ENOTCONN;
5699 
5700 	memcpy(&prim.ssp_addr, &asoc->peer.primary_path->ipaddr,
5701 		asoc->peer.primary_path->af_specific->sockaddr_len);
5702 
5703 	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sp,
5704 			(union sctp_addr *)&prim.ssp_addr);
5705 
5706 	if (put_user(len, optlen))
5707 		return -EFAULT;
5708 	if (copy_to_user(optval, &prim, len))
5709 		return -EFAULT;
5710 
5711 	return 0;
5712 }
5713 
5714 /*
5715  * 7.1.11  Set Adaptation Layer Indicator (SCTP_ADAPTATION_LAYER)
5716  *
5717  * Requests that the local endpoint set the specified Adaptation Layer
5718  * Indication parameter for all future INIT and INIT-ACK exchanges.
5719  */
5720 static int sctp_getsockopt_adaptation_layer(struct sock *sk, int len,
5721 				  char __user *optval, int __user *optlen)
5722 {
5723 	struct sctp_setadaptation adaptation;
5724 
5725 	if (len < sizeof(struct sctp_setadaptation))
5726 		return -EINVAL;
5727 
5728 	len = sizeof(struct sctp_setadaptation);
5729 
5730 	adaptation.ssb_adaptation_ind = sctp_sk(sk)->adaptation_ind;
5731 
5732 	if (put_user(len, optlen))
5733 		return -EFAULT;
5734 	if (copy_to_user(optval, &adaptation, len))
5735 		return -EFAULT;
5736 
5737 	return 0;
5738 }
5739 
5740 /*
5741  *
5742  * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
5743  *
5744  *   Applications that wish to use the sendto() system call may wish to
5745  *   specify a default set of parameters that would normally be supplied
5746  *   through the inclusion of ancillary data.  This socket option allows
5747  *   such an application to set the default sctp_sndrcvinfo structure.
5748 
5749 
5750  *   The application that wishes to use this socket option simply passes
5751  *   in to this call the sctp_sndrcvinfo structure defined in Section
5752  *   5.2.2) The input parameters accepted by this call include
5753  *   sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
5754  *   sinfo_timetolive.  The user must provide the sinfo_assoc_id field in
5755  *   to this call if the caller is using the UDP model.
5756  *
5757  *   For getsockopt, it get the default sctp_sndrcvinfo structure.
5758  */
5759 static int sctp_getsockopt_default_send_param(struct sock *sk,
5760 					int len, char __user *optval,
5761 					int __user *optlen)
5762 {
5763 	struct sctp_sock *sp = sctp_sk(sk);
5764 	struct sctp_association *asoc;
5765 	struct sctp_sndrcvinfo info;
5766 
5767 	if (len < sizeof(info))
5768 		return -EINVAL;
5769 
5770 	len = sizeof(info);
5771 
5772 	if (copy_from_user(&info, optval, len))
5773 		return -EFAULT;
5774 
5775 	asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
5776 	if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
5777 		return -EINVAL;
5778 	if (asoc) {
5779 		info.sinfo_stream = asoc->default_stream;
5780 		info.sinfo_flags = asoc->default_flags;
5781 		info.sinfo_ppid = asoc->default_ppid;
5782 		info.sinfo_context = asoc->default_context;
5783 		info.sinfo_timetolive = asoc->default_timetolive;
5784 	} else {
5785 		info.sinfo_stream = sp->default_stream;
5786 		info.sinfo_flags = sp->default_flags;
5787 		info.sinfo_ppid = sp->default_ppid;
5788 		info.sinfo_context = sp->default_context;
5789 		info.sinfo_timetolive = sp->default_timetolive;
5790 	}
5791 
5792 	if (put_user(len, optlen))
5793 		return -EFAULT;
5794 	if (copy_to_user(optval, &info, len))
5795 		return -EFAULT;
5796 
5797 	return 0;
5798 }
5799 
5800 /* RFC6458, Section 8.1.31. Set/get Default Send Parameters
5801  * (SCTP_DEFAULT_SNDINFO)
5802  */
5803 static int sctp_getsockopt_default_sndinfo(struct sock *sk, int len,
5804 					   char __user *optval,
5805 					   int __user *optlen)
5806 {
5807 	struct sctp_sock *sp = sctp_sk(sk);
5808 	struct sctp_association *asoc;
5809 	struct sctp_sndinfo info;
5810 
5811 	if (len < sizeof(info))
5812 		return -EINVAL;
5813 
5814 	len = sizeof(info);
5815 
5816 	if (copy_from_user(&info, optval, len))
5817 		return -EFAULT;
5818 
5819 	asoc = sctp_id2assoc(sk, info.snd_assoc_id);
5820 	if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
5821 		return -EINVAL;
5822 	if (asoc) {
5823 		info.snd_sid = asoc->default_stream;
5824 		info.snd_flags = asoc->default_flags;
5825 		info.snd_ppid = asoc->default_ppid;
5826 		info.snd_context = asoc->default_context;
5827 	} else {
5828 		info.snd_sid = sp->default_stream;
5829 		info.snd_flags = sp->default_flags;
5830 		info.snd_ppid = sp->default_ppid;
5831 		info.snd_context = sp->default_context;
5832 	}
5833 
5834 	if (put_user(len, optlen))
5835 		return -EFAULT;
5836 	if (copy_to_user(optval, &info, len))
5837 		return -EFAULT;
5838 
5839 	return 0;
5840 }
5841 
5842 /*
5843  *
5844  * 7.1.5 SCTP_NODELAY
5845  *
5846  * Turn on/off any Nagle-like algorithm.  This means that packets are
5847  * generally sent as soon as possible and no unnecessary delays are
5848  * introduced, at the cost of more packets in the network.  Expects an
5849  * integer boolean flag.
5850  */
5851 
5852 static int sctp_getsockopt_nodelay(struct sock *sk, int len,
5853 				   char __user *optval, int __user *optlen)
5854 {
5855 	int val;
5856 
5857 	if (len < sizeof(int))
5858 		return -EINVAL;
5859 
5860 	len = sizeof(int);
5861 	val = (sctp_sk(sk)->nodelay == 1);
5862 	if (put_user(len, optlen))
5863 		return -EFAULT;
5864 	if (copy_to_user(optval, &val, len))
5865 		return -EFAULT;
5866 	return 0;
5867 }
5868 
5869 /*
5870  *
5871  * 7.1.1 SCTP_RTOINFO
5872  *
5873  * The protocol parameters used to initialize and bound retransmission
5874  * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
5875  * and modify these parameters.
5876  * All parameters are time values, in milliseconds.  A value of 0, when
5877  * modifying the parameters, indicates that the current value should not
5878  * be changed.
5879  *
5880  */
5881 static int sctp_getsockopt_rtoinfo(struct sock *sk, int len,
5882 				char __user *optval,
5883 				int __user *optlen) {
5884 	struct sctp_rtoinfo rtoinfo;
5885 	struct sctp_association *asoc;
5886 
5887 	if (len < sizeof (struct sctp_rtoinfo))
5888 		return -EINVAL;
5889 
5890 	len = sizeof(struct sctp_rtoinfo);
5891 
5892 	if (copy_from_user(&rtoinfo, optval, len))
5893 		return -EFAULT;
5894 
5895 	asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
5896 
5897 	if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
5898 		return -EINVAL;
5899 
5900 	/* Values corresponding to the specific association. */
5901 	if (asoc) {
5902 		rtoinfo.srto_initial = jiffies_to_msecs(asoc->rto_initial);
5903 		rtoinfo.srto_max = jiffies_to_msecs(asoc->rto_max);
5904 		rtoinfo.srto_min = jiffies_to_msecs(asoc->rto_min);
5905 	} else {
5906 		/* Values corresponding to the endpoint. */
5907 		struct sctp_sock *sp = sctp_sk(sk);
5908 
5909 		rtoinfo.srto_initial = sp->rtoinfo.srto_initial;
5910 		rtoinfo.srto_max = sp->rtoinfo.srto_max;
5911 		rtoinfo.srto_min = sp->rtoinfo.srto_min;
5912 	}
5913 
5914 	if (put_user(len, optlen))
5915 		return -EFAULT;
5916 
5917 	if (copy_to_user(optval, &rtoinfo, len))
5918 		return -EFAULT;
5919 
5920 	return 0;
5921 }
5922 
5923 /*
5924  *
5925  * 7.1.2 SCTP_ASSOCINFO
5926  *
5927  * This option is used to tune the maximum retransmission attempts
5928  * of the association.
5929  * Returns an error if the new association retransmission value is
5930  * greater than the sum of the retransmission value  of the peer.
5931  * See [SCTP] for more information.
5932  *
5933  */
5934 static int sctp_getsockopt_associnfo(struct sock *sk, int len,
5935 				     char __user *optval,
5936 				     int __user *optlen)
5937 {
5938 
5939 	struct sctp_assocparams assocparams;
5940 	struct sctp_association *asoc;
5941 	struct list_head *pos;
5942 	int cnt = 0;
5943 
5944 	if (len < sizeof (struct sctp_assocparams))
5945 		return -EINVAL;
5946 
5947 	len = sizeof(struct sctp_assocparams);
5948 
5949 	if (copy_from_user(&assocparams, optval, len))
5950 		return -EFAULT;
5951 
5952 	asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
5953 
5954 	if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
5955 		return -EINVAL;
5956 
5957 	/* Values correspoinding to the specific association */
5958 	if (asoc) {
5959 		assocparams.sasoc_asocmaxrxt = asoc->max_retrans;
5960 		assocparams.sasoc_peer_rwnd = asoc->peer.rwnd;
5961 		assocparams.sasoc_local_rwnd = asoc->a_rwnd;
5962 		assocparams.sasoc_cookie_life = ktime_to_ms(asoc->cookie_life);
5963 
5964 		list_for_each(pos, &asoc->peer.transport_addr_list) {
5965 			cnt++;
5966 		}
5967 
5968 		assocparams.sasoc_number_peer_destinations = cnt;
5969 	} else {
5970 		/* Values corresponding to the endpoint */
5971 		struct sctp_sock *sp = sctp_sk(sk);
5972 
5973 		assocparams.sasoc_asocmaxrxt = sp->assocparams.sasoc_asocmaxrxt;
5974 		assocparams.sasoc_peer_rwnd = sp->assocparams.sasoc_peer_rwnd;
5975 		assocparams.sasoc_local_rwnd = sp->assocparams.sasoc_local_rwnd;
5976 		assocparams.sasoc_cookie_life =
5977 					sp->assocparams.sasoc_cookie_life;
5978 		assocparams.sasoc_number_peer_destinations =
5979 					sp->assocparams.
5980 					sasoc_number_peer_destinations;
5981 	}
5982 
5983 	if (put_user(len, optlen))
5984 		return -EFAULT;
5985 
5986 	if (copy_to_user(optval, &assocparams, len))
5987 		return -EFAULT;
5988 
5989 	return 0;
5990 }
5991 
5992 /*
5993  * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
5994  *
5995  * This socket option is a boolean flag which turns on or off mapped V4
5996  * addresses.  If this option is turned on and the socket is type
5997  * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
5998  * If this option is turned off, then no mapping will be done of V4
5999  * addresses and a user will receive both PF_INET6 and PF_INET type
6000  * addresses on the socket.
6001  */
6002 static int sctp_getsockopt_mappedv4(struct sock *sk, int len,
6003 				    char __user *optval, int __user *optlen)
6004 {
6005 	int val;
6006 	struct sctp_sock *sp = sctp_sk(sk);
6007 
6008 	if (len < sizeof(int))
6009 		return -EINVAL;
6010 
6011 	len = sizeof(int);
6012 	val = sp->v4mapped;
6013 	if (put_user(len, optlen))
6014 		return -EFAULT;
6015 	if (copy_to_user(optval, &val, len))
6016 		return -EFAULT;
6017 
6018 	return 0;
6019 }
6020 
6021 /*
6022  * 7.1.29.  Set or Get the default context (SCTP_CONTEXT)
6023  * (chapter and verse is quoted at sctp_setsockopt_context())
6024  */
6025 static int sctp_getsockopt_context(struct sock *sk, int len,
6026 				   char __user *optval, int __user *optlen)
6027 {
6028 	struct sctp_assoc_value params;
6029 	struct sctp_sock *sp;
6030 	struct sctp_association *asoc;
6031 
6032 	if (len < sizeof(struct sctp_assoc_value))
6033 		return -EINVAL;
6034 
6035 	len = sizeof(struct sctp_assoc_value);
6036 
6037 	if (copy_from_user(&params, optval, len))
6038 		return -EFAULT;
6039 
6040 	sp = sctp_sk(sk);
6041 
6042 	if (params.assoc_id != 0) {
6043 		asoc = sctp_id2assoc(sk, params.assoc_id);
6044 		if (!asoc)
6045 			return -EINVAL;
6046 		params.assoc_value = asoc->default_rcv_context;
6047 	} else {
6048 		params.assoc_value = sp->default_rcv_context;
6049 	}
6050 
6051 	if (put_user(len, optlen))
6052 		return -EFAULT;
6053 	if (copy_to_user(optval, &params, len))
6054 		return -EFAULT;
6055 
6056 	return 0;
6057 }
6058 
6059 /*
6060  * 8.1.16.  Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
6061  * This option will get or set the maximum size to put in any outgoing
6062  * SCTP DATA chunk.  If a message is larger than this size it will be
6063  * fragmented by SCTP into the specified size.  Note that the underlying
6064  * SCTP implementation may fragment into smaller sized chunks when the
6065  * PMTU of the underlying association is smaller than the value set by
6066  * the user.  The default value for this option is '0' which indicates
6067  * the user is NOT limiting fragmentation and only the PMTU will effect
6068  * SCTP's choice of DATA chunk size.  Note also that values set larger
6069  * than the maximum size of an IP datagram will effectively let SCTP
6070  * control fragmentation (i.e. the same as setting this option to 0).
6071  *
6072  * The following structure is used to access and modify this parameter:
6073  *
6074  * struct sctp_assoc_value {
6075  *   sctp_assoc_t assoc_id;
6076  *   uint32_t assoc_value;
6077  * };
6078  *
6079  * assoc_id:  This parameter is ignored for one-to-one style sockets.
6080  *    For one-to-many style sockets this parameter indicates which
6081  *    association the user is performing an action upon.  Note that if
6082  *    this field's value is zero then the endpoints default value is
6083  *    changed (effecting future associations only).
6084  * assoc_value:  This parameter specifies the maximum size in bytes.
6085  */
6086 static int sctp_getsockopt_maxseg(struct sock *sk, int len,
6087 				  char __user *optval, int __user *optlen)
6088 {
6089 	struct sctp_assoc_value params;
6090 	struct sctp_association *asoc;
6091 
6092 	if (len == sizeof(int)) {
6093 		pr_warn_ratelimited(DEPRECATED
6094 				    "%s (pid %d) "
6095 				    "Use of int in maxseg socket option.\n"
6096 				    "Use struct sctp_assoc_value instead\n",
6097 				    current->comm, task_pid_nr(current));
6098 		params.assoc_id = 0;
6099 	} else if (len >= sizeof(struct sctp_assoc_value)) {
6100 		len = sizeof(struct sctp_assoc_value);
6101 		if (copy_from_user(&params, optval, len))
6102 			return -EFAULT;
6103 	} else
6104 		return -EINVAL;
6105 
6106 	asoc = sctp_id2assoc(sk, params.assoc_id);
6107 	if (!asoc && params.assoc_id && sctp_style(sk, UDP))
6108 		return -EINVAL;
6109 
6110 	if (asoc)
6111 		params.assoc_value = asoc->frag_point;
6112 	else
6113 		params.assoc_value = sctp_sk(sk)->user_frag;
6114 
6115 	if (put_user(len, optlen))
6116 		return -EFAULT;
6117 	if (len == sizeof(int)) {
6118 		if (copy_to_user(optval, &params.assoc_value, len))
6119 			return -EFAULT;
6120 	} else {
6121 		if (copy_to_user(optval, &params, len))
6122 			return -EFAULT;
6123 	}
6124 
6125 	return 0;
6126 }
6127 
6128 /*
6129  * 7.1.24.  Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
6130  * (chapter and verse is quoted at sctp_setsockopt_fragment_interleave())
6131  */
6132 static int sctp_getsockopt_fragment_interleave(struct sock *sk, int len,
6133 					       char __user *optval, int __user *optlen)
6134 {
6135 	int val;
6136 
6137 	if (len < sizeof(int))
6138 		return -EINVAL;
6139 
6140 	len = sizeof(int);
6141 
6142 	val = sctp_sk(sk)->frag_interleave;
6143 	if (put_user(len, optlen))
6144 		return -EFAULT;
6145 	if (copy_to_user(optval, &val, len))
6146 		return -EFAULT;
6147 
6148 	return 0;
6149 }
6150 
6151 /*
6152  * 7.1.25.  Set or Get the sctp partial delivery point
6153  * (chapter and verse is quoted at sctp_setsockopt_partial_delivery_point())
6154  */
6155 static int sctp_getsockopt_partial_delivery_point(struct sock *sk, int len,
6156 						  char __user *optval,
6157 						  int __user *optlen)
6158 {
6159 	u32 val;
6160 
6161 	if (len < sizeof(u32))
6162 		return -EINVAL;
6163 
6164 	len = sizeof(u32);
6165 
6166 	val = sctp_sk(sk)->pd_point;
6167 	if (put_user(len, optlen))
6168 		return -EFAULT;
6169 	if (copy_to_user(optval, &val, len))
6170 		return -EFAULT;
6171 
6172 	return 0;
6173 }
6174 
6175 /*
6176  * 7.1.28.  Set or Get the maximum burst (SCTP_MAX_BURST)
6177  * (chapter and verse is quoted at sctp_setsockopt_maxburst())
6178  */
6179 static int sctp_getsockopt_maxburst(struct sock *sk, int len,
6180 				    char __user *optval,
6181 				    int __user *optlen)
6182 {
6183 	struct sctp_assoc_value params;
6184 	struct sctp_sock *sp;
6185 	struct sctp_association *asoc;
6186 
6187 	if (len == sizeof(int)) {
6188 		pr_warn_ratelimited(DEPRECATED
6189 				    "%s (pid %d) "
6190 				    "Use of int in max_burst socket option.\n"
6191 				    "Use struct sctp_assoc_value instead\n",
6192 				    current->comm, task_pid_nr(current));
6193 		params.assoc_id = 0;
6194 	} else if (len >= sizeof(struct sctp_assoc_value)) {
6195 		len = sizeof(struct sctp_assoc_value);
6196 		if (copy_from_user(&params, optval, len))
6197 			return -EFAULT;
6198 	} else
6199 		return -EINVAL;
6200 
6201 	sp = sctp_sk(sk);
6202 
6203 	if (params.assoc_id != 0) {
6204 		asoc = sctp_id2assoc(sk, params.assoc_id);
6205 		if (!asoc)
6206 			return -EINVAL;
6207 		params.assoc_value = asoc->max_burst;
6208 	} else
6209 		params.assoc_value = sp->max_burst;
6210 
6211 	if (len == sizeof(int)) {
6212 		if (copy_to_user(optval, &params.assoc_value, len))
6213 			return -EFAULT;
6214 	} else {
6215 		if (copy_to_user(optval, &params, len))
6216 			return -EFAULT;
6217 	}
6218 
6219 	return 0;
6220 
6221 }
6222 
6223 static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
6224 				    char __user *optval, int __user *optlen)
6225 {
6226 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6227 	struct sctp_hmacalgo  __user *p = (void __user *)optval;
6228 	struct sctp_hmac_algo_param *hmacs;
6229 	__u16 data_len = 0;
6230 	u32 num_idents;
6231 	int i;
6232 
6233 	if (!ep->auth_enable)
6234 		return -EACCES;
6235 
6236 	hmacs = ep->auth_hmacs_list;
6237 	data_len = ntohs(hmacs->param_hdr.length) -
6238 		   sizeof(struct sctp_paramhdr);
6239 
6240 	if (len < sizeof(struct sctp_hmacalgo) + data_len)
6241 		return -EINVAL;
6242 
6243 	len = sizeof(struct sctp_hmacalgo) + data_len;
6244 	num_idents = data_len / sizeof(u16);
6245 
6246 	if (put_user(len, optlen))
6247 		return -EFAULT;
6248 	if (put_user(num_idents, &p->shmac_num_idents))
6249 		return -EFAULT;
6250 	for (i = 0; i < num_idents; i++) {
6251 		__u16 hmacid = ntohs(hmacs->hmac_ids[i]);
6252 
6253 		if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
6254 			return -EFAULT;
6255 	}
6256 	return 0;
6257 }
6258 
6259 static int sctp_getsockopt_active_key(struct sock *sk, int len,
6260 				    char __user *optval, int __user *optlen)
6261 {
6262 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6263 	struct sctp_authkeyid val;
6264 	struct sctp_association *asoc;
6265 
6266 	if (!ep->auth_enable)
6267 		return -EACCES;
6268 
6269 	if (len < sizeof(struct sctp_authkeyid))
6270 		return -EINVAL;
6271 
6272 	len = sizeof(struct sctp_authkeyid);
6273 	if (copy_from_user(&val, optval, len))
6274 		return -EFAULT;
6275 
6276 	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
6277 	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
6278 		return -EINVAL;
6279 
6280 	if (asoc)
6281 		val.scact_keynumber = asoc->active_key_id;
6282 	else
6283 		val.scact_keynumber = ep->active_key_id;
6284 
6285 	if (put_user(len, optlen))
6286 		return -EFAULT;
6287 	if (copy_to_user(optval, &val, len))
6288 		return -EFAULT;
6289 
6290 	return 0;
6291 }
6292 
6293 static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
6294 				    char __user *optval, int __user *optlen)
6295 {
6296 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6297 	struct sctp_authchunks __user *p = (void __user *)optval;
6298 	struct sctp_authchunks val;
6299 	struct sctp_association *asoc;
6300 	struct sctp_chunks_param *ch;
6301 	u32    num_chunks = 0;
6302 	char __user *to;
6303 
6304 	if (!ep->auth_enable)
6305 		return -EACCES;
6306 
6307 	if (len < sizeof(struct sctp_authchunks))
6308 		return -EINVAL;
6309 
6310 	if (copy_from_user(&val, optval, sizeof(val)))
6311 		return -EFAULT;
6312 
6313 	to = p->gauth_chunks;
6314 	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
6315 	if (!asoc)
6316 		return -EINVAL;
6317 
6318 	ch = asoc->peer.peer_chunks;
6319 	if (!ch)
6320 		goto num;
6321 
6322 	/* See if the user provided enough room for all the data */
6323 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
6324 	if (len < num_chunks)
6325 		return -EINVAL;
6326 
6327 	if (copy_to_user(to, ch->chunks, num_chunks))
6328 		return -EFAULT;
6329 num:
6330 	len = sizeof(struct sctp_authchunks) + num_chunks;
6331 	if (put_user(len, optlen))
6332 		return -EFAULT;
6333 	if (put_user(num_chunks, &p->gauth_number_of_chunks))
6334 		return -EFAULT;
6335 	return 0;
6336 }
6337 
6338 static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
6339 				    char __user *optval, int __user *optlen)
6340 {
6341 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6342 	struct sctp_authchunks __user *p = (void __user *)optval;
6343 	struct sctp_authchunks val;
6344 	struct sctp_association *asoc;
6345 	struct sctp_chunks_param *ch;
6346 	u32    num_chunks = 0;
6347 	char __user *to;
6348 
6349 	if (!ep->auth_enable)
6350 		return -EACCES;
6351 
6352 	if (len < sizeof(struct sctp_authchunks))
6353 		return -EINVAL;
6354 
6355 	if (copy_from_user(&val, optval, sizeof(val)))
6356 		return -EFAULT;
6357 
6358 	to = p->gauth_chunks;
6359 	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
6360 	if (!asoc && val.gauth_assoc_id && sctp_style(sk, UDP))
6361 		return -EINVAL;
6362 
6363 	if (asoc)
6364 		ch = (struct sctp_chunks_param *)asoc->c.auth_chunks;
6365 	else
6366 		ch = ep->auth_chunk_list;
6367 
6368 	if (!ch)
6369 		goto num;
6370 
6371 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr);
6372 	if (len < sizeof(struct sctp_authchunks) + num_chunks)
6373 		return -EINVAL;
6374 
6375 	if (copy_to_user(to, ch->chunks, num_chunks))
6376 		return -EFAULT;
6377 num:
6378 	len = sizeof(struct sctp_authchunks) + num_chunks;
6379 	if (put_user(len, optlen))
6380 		return -EFAULT;
6381 	if (put_user(num_chunks, &p->gauth_number_of_chunks))
6382 		return -EFAULT;
6383 
6384 	return 0;
6385 }
6386 
6387 /*
6388  * 8.2.5.  Get the Current Number of Associations (SCTP_GET_ASSOC_NUMBER)
6389  * This option gets the current number of associations that are attached
6390  * to a one-to-many style socket.  The option value is an uint32_t.
6391  */
6392 static int sctp_getsockopt_assoc_number(struct sock *sk, int len,
6393 				    char __user *optval, int __user *optlen)
6394 {
6395 	struct sctp_sock *sp = sctp_sk(sk);
6396 	struct sctp_association *asoc;
6397 	u32 val = 0;
6398 
6399 	if (sctp_style(sk, TCP))
6400 		return -EOPNOTSUPP;
6401 
6402 	if (len < sizeof(u32))
6403 		return -EINVAL;
6404 
6405 	len = sizeof(u32);
6406 
6407 	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
6408 		val++;
6409 	}
6410 
6411 	if (put_user(len, optlen))
6412 		return -EFAULT;
6413 	if (copy_to_user(optval, &val, len))
6414 		return -EFAULT;
6415 
6416 	return 0;
6417 }
6418 
6419 /*
6420  * 8.1.23 SCTP_AUTO_ASCONF
6421  * See the corresponding setsockopt entry as description
6422  */
6423 static int sctp_getsockopt_auto_asconf(struct sock *sk, int len,
6424 				   char __user *optval, int __user *optlen)
6425 {
6426 	int val = 0;
6427 
6428 	if (len < sizeof(int))
6429 		return -EINVAL;
6430 
6431 	len = sizeof(int);
6432 	if (sctp_sk(sk)->do_auto_asconf && sctp_is_ep_boundall(sk))
6433 		val = 1;
6434 	if (put_user(len, optlen))
6435 		return -EFAULT;
6436 	if (copy_to_user(optval, &val, len))
6437 		return -EFAULT;
6438 	return 0;
6439 }
6440 
6441 /*
6442  * 8.2.6. Get the Current Identifiers of Associations
6443  *        (SCTP_GET_ASSOC_ID_LIST)
6444  *
6445  * This option gets the current list of SCTP association identifiers of
6446  * the SCTP associations handled by a one-to-many style socket.
6447  */
6448 static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
6449 				    char __user *optval, int __user *optlen)
6450 {
6451 	struct sctp_sock *sp = sctp_sk(sk);
6452 	struct sctp_association *asoc;
6453 	struct sctp_assoc_ids *ids;
6454 	u32 num = 0;
6455 
6456 	if (sctp_style(sk, TCP))
6457 		return -EOPNOTSUPP;
6458 
6459 	if (len < sizeof(struct sctp_assoc_ids))
6460 		return -EINVAL;
6461 
6462 	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
6463 		num++;
6464 	}
6465 
6466 	if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
6467 		return -EINVAL;
6468 
6469 	len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
6470 
6471 	ids = kmalloc(len, GFP_USER | __GFP_NOWARN);
6472 	if (unlikely(!ids))
6473 		return -ENOMEM;
6474 
6475 	ids->gaids_number_of_ids = num;
6476 	num = 0;
6477 	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
6478 		ids->gaids_assoc_id[num++] = asoc->assoc_id;
6479 	}
6480 
6481 	if (put_user(len, optlen) || copy_to_user(optval, ids, len)) {
6482 		kfree(ids);
6483 		return -EFAULT;
6484 	}
6485 
6486 	kfree(ids);
6487 	return 0;
6488 }
6489 
6490 /*
6491  * SCTP_PEER_ADDR_THLDS
6492  *
6493  * This option allows us to fetch the partially failed threshold for one or all
6494  * transports in an association.  See Section 6.1 of:
6495  * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
6496  */
6497 static int sctp_getsockopt_paddr_thresholds(struct sock *sk,
6498 					    char __user *optval,
6499 					    int len,
6500 					    int __user *optlen)
6501 {
6502 	struct sctp_paddrthlds val;
6503 	struct sctp_transport *trans;
6504 	struct sctp_association *asoc;
6505 
6506 	if (len < sizeof(struct sctp_paddrthlds))
6507 		return -EINVAL;
6508 	len = sizeof(struct sctp_paddrthlds);
6509 	if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval, len))
6510 		return -EFAULT;
6511 
6512 	if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
6513 		asoc = sctp_id2assoc(sk, val.spt_assoc_id);
6514 		if (!asoc)
6515 			return -ENOENT;
6516 
6517 		val.spt_pathpfthld = asoc->pf_retrans;
6518 		val.spt_pathmaxrxt = asoc->pathmaxrxt;
6519 	} else {
6520 		trans = sctp_addr_id2transport(sk, &val.spt_address,
6521 					       val.spt_assoc_id);
6522 		if (!trans)
6523 			return -ENOENT;
6524 
6525 		val.spt_pathmaxrxt = trans->pathmaxrxt;
6526 		val.spt_pathpfthld = trans->pf_retrans;
6527 	}
6528 
6529 	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
6530 		return -EFAULT;
6531 
6532 	return 0;
6533 }
6534 
6535 /*
6536  * SCTP_GET_ASSOC_STATS
6537  *
6538  * This option retrieves local per endpoint statistics. It is modeled
6539  * after OpenSolaris' implementation
6540  */
6541 static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
6542 				       char __user *optval,
6543 				       int __user *optlen)
6544 {
6545 	struct sctp_assoc_stats sas;
6546 	struct sctp_association *asoc = NULL;
6547 
6548 	/* User must provide at least the assoc id */
6549 	if (len < sizeof(sctp_assoc_t))
6550 		return -EINVAL;
6551 
6552 	/* Allow the struct to grow and fill in as much as possible */
6553 	len = min_t(size_t, len, sizeof(sas));
6554 
6555 	if (copy_from_user(&sas, optval, len))
6556 		return -EFAULT;
6557 
6558 	asoc = sctp_id2assoc(sk, sas.sas_assoc_id);
6559 	if (!asoc)
6560 		return -EINVAL;
6561 
6562 	sas.sas_rtxchunks = asoc->stats.rtxchunks;
6563 	sas.sas_gapcnt = asoc->stats.gapcnt;
6564 	sas.sas_outofseqtsns = asoc->stats.outofseqtsns;
6565 	sas.sas_osacks = asoc->stats.osacks;
6566 	sas.sas_isacks = asoc->stats.isacks;
6567 	sas.sas_octrlchunks = asoc->stats.octrlchunks;
6568 	sas.sas_ictrlchunks = asoc->stats.ictrlchunks;
6569 	sas.sas_oodchunks = asoc->stats.oodchunks;
6570 	sas.sas_iodchunks = asoc->stats.iodchunks;
6571 	sas.sas_ouodchunks = asoc->stats.ouodchunks;
6572 	sas.sas_iuodchunks = asoc->stats.iuodchunks;
6573 	sas.sas_idupchunks = asoc->stats.idupchunks;
6574 	sas.sas_opackets = asoc->stats.opackets;
6575 	sas.sas_ipackets = asoc->stats.ipackets;
6576 
6577 	/* New high max rto observed, will return 0 if not a single
6578 	 * RTO update took place. obs_rto_ipaddr will be bogus
6579 	 * in such a case
6580 	 */
6581 	sas.sas_maxrto = asoc->stats.max_obs_rto;
6582 	memcpy(&sas.sas_obs_rto_ipaddr, &asoc->stats.obs_rto_ipaddr,
6583 		sizeof(struct sockaddr_storage));
6584 
6585 	/* Mark beginning of a new observation period */
6586 	asoc->stats.max_obs_rto = asoc->rto_min;
6587 
6588 	if (put_user(len, optlen))
6589 		return -EFAULT;
6590 
6591 	pr_debug("%s: len:%d, assoc_id:%d\n", __func__, len, sas.sas_assoc_id);
6592 
6593 	if (copy_to_user(optval, &sas, len))
6594 		return -EFAULT;
6595 
6596 	return 0;
6597 }
6598 
6599 static int sctp_getsockopt_recvrcvinfo(struct sock *sk,	int len,
6600 				       char __user *optval,
6601 				       int __user *optlen)
6602 {
6603 	int val = 0;
6604 
6605 	if (len < sizeof(int))
6606 		return -EINVAL;
6607 
6608 	len = sizeof(int);
6609 	if (sctp_sk(sk)->recvrcvinfo)
6610 		val = 1;
6611 	if (put_user(len, optlen))
6612 		return -EFAULT;
6613 	if (copy_to_user(optval, &val, len))
6614 		return -EFAULT;
6615 
6616 	return 0;
6617 }
6618 
6619 static int sctp_getsockopt_recvnxtinfo(struct sock *sk,	int len,
6620 				       char __user *optval,
6621 				       int __user *optlen)
6622 {
6623 	int val = 0;
6624 
6625 	if (len < sizeof(int))
6626 		return -EINVAL;
6627 
6628 	len = sizeof(int);
6629 	if (sctp_sk(sk)->recvnxtinfo)
6630 		val = 1;
6631 	if (put_user(len, optlen))
6632 		return -EFAULT;
6633 	if (copy_to_user(optval, &val, len))
6634 		return -EFAULT;
6635 
6636 	return 0;
6637 }
6638 
6639 static int sctp_getsockopt_pr_supported(struct sock *sk, int len,
6640 					char __user *optval,
6641 					int __user *optlen)
6642 {
6643 	struct sctp_assoc_value params;
6644 	struct sctp_association *asoc;
6645 	int retval = -EFAULT;
6646 
6647 	if (len < sizeof(params)) {
6648 		retval = -EINVAL;
6649 		goto out;
6650 	}
6651 
6652 	len = sizeof(params);
6653 	if (copy_from_user(&params, optval, len))
6654 		goto out;
6655 
6656 	asoc = sctp_id2assoc(sk, params.assoc_id);
6657 	if (asoc) {
6658 		params.assoc_value = asoc->prsctp_enable;
6659 	} else if (!params.assoc_id) {
6660 		struct sctp_sock *sp = sctp_sk(sk);
6661 
6662 		params.assoc_value = sp->ep->prsctp_enable;
6663 	} else {
6664 		retval = -EINVAL;
6665 		goto out;
6666 	}
6667 
6668 	if (put_user(len, optlen))
6669 		goto out;
6670 
6671 	if (copy_to_user(optval, &params, len))
6672 		goto out;
6673 
6674 	retval = 0;
6675 
6676 out:
6677 	return retval;
6678 }
6679 
6680 static int sctp_getsockopt_default_prinfo(struct sock *sk, int len,
6681 					  char __user *optval,
6682 					  int __user *optlen)
6683 {
6684 	struct sctp_default_prinfo info;
6685 	struct sctp_association *asoc;
6686 	int retval = -EFAULT;
6687 
6688 	if (len < sizeof(info)) {
6689 		retval = -EINVAL;
6690 		goto out;
6691 	}
6692 
6693 	len = sizeof(info);
6694 	if (copy_from_user(&info, optval, len))
6695 		goto out;
6696 
6697 	asoc = sctp_id2assoc(sk, info.pr_assoc_id);
6698 	if (asoc) {
6699 		info.pr_policy = SCTP_PR_POLICY(asoc->default_flags);
6700 		info.pr_value = asoc->default_timetolive;
6701 	} else if (!info.pr_assoc_id) {
6702 		struct sctp_sock *sp = sctp_sk(sk);
6703 
6704 		info.pr_policy = SCTP_PR_POLICY(sp->default_flags);
6705 		info.pr_value = sp->default_timetolive;
6706 	} else {
6707 		retval = -EINVAL;
6708 		goto out;
6709 	}
6710 
6711 	if (put_user(len, optlen))
6712 		goto out;
6713 
6714 	if (copy_to_user(optval, &info, len))
6715 		goto out;
6716 
6717 	retval = 0;
6718 
6719 out:
6720 	return retval;
6721 }
6722 
6723 static int sctp_getsockopt_pr_assocstatus(struct sock *sk, int len,
6724 					  char __user *optval,
6725 					  int __user *optlen)
6726 {
6727 	struct sctp_prstatus params;
6728 	struct sctp_association *asoc;
6729 	int policy;
6730 	int retval = -EINVAL;
6731 
6732 	if (len < sizeof(params))
6733 		goto out;
6734 
6735 	len = sizeof(params);
6736 	if (copy_from_user(&params, optval, len)) {
6737 		retval = -EFAULT;
6738 		goto out;
6739 	}
6740 
6741 	policy = params.sprstat_policy;
6742 	if (policy & ~SCTP_PR_SCTP_MASK)
6743 		goto out;
6744 
6745 	asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);
6746 	if (!asoc)
6747 		goto out;
6748 
6749 	if (policy == SCTP_PR_SCTP_NONE) {
6750 		params.sprstat_abandoned_unsent = 0;
6751 		params.sprstat_abandoned_sent = 0;
6752 		for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
6753 			params.sprstat_abandoned_unsent +=
6754 				asoc->abandoned_unsent[policy];
6755 			params.sprstat_abandoned_sent +=
6756 				asoc->abandoned_sent[policy];
6757 		}
6758 	} else {
6759 		params.sprstat_abandoned_unsent =
6760 			asoc->abandoned_unsent[__SCTP_PR_INDEX(policy)];
6761 		params.sprstat_abandoned_sent =
6762 			asoc->abandoned_sent[__SCTP_PR_INDEX(policy)];
6763 	}
6764 
6765 	if (put_user(len, optlen)) {
6766 		retval = -EFAULT;
6767 		goto out;
6768 	}
6769 
6770 	if (copy_to_user(optval, &params, len)) {
6771 		retval = -EFAULT;
6772 		goto out;
6773 	}
6774 
6775 	retval = 0;
6776 
6777 out:
6778 	return retval;
6779 }
6780 
6781 static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
6782 					   char __user *optval,
6783 					   int __user *optlen)
6784 {
6785 	struct sctp_stream_out_ext *streamoute;
6786 	struct sctp_association *asoc;
6787 	struct sctp_prstatus params;
6788 	int retval = -EINVAL;
6789 	int policy;
6790 
6791 	if (len < sizeof(params))
6792 		goto out;
6793 
6794 	len = sizeof(params);
6795 	if (copy_from_user(&params, optval, len)) {
6796 		retval = -EFAULT;
6797 		goto out;
6798 	}
6799 
6800 	policy = params.sprstat_policy;
6801 	if (policy & ~SCTP_PR_SCTP_MASK)
6802 		goto out;
6803 
6804 	asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);
6805 	if (!asoc || params.sprstat_sid >= asoc->stream.outcnt)
6806 		goto out;
6807 
6808 	streamoute = asoc->stream.out[params.sprstat_sid].ext;
6809 	if (!streamoute) {
6810 		/* Not allocated yet, means all stats are 0 */
6811 		params.sprstat_abandoned_unsent = 0;
6812 		params.sprstat_abandoned_sent = 0;
6813 		retval = 0;
6814 		goto out;
6815 	}
6816 
6817 	if (policy == SCTP_PR_SCTP_NONE) {
6818 		params.sprstat_abandoned_unsent = 0;
6819 		params.sprstat_abandoned_sent = 0;
6820 		for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
6821 			params.sprstat_abandoned_unsent +=
6822 				streamoute->abandoned_unsent[policy];
6823 			params.sprstat_abandoned_sent +=
6824 				streamoute->abandoned_sent[policy];
6825 		}
6826 	} else {
6827 		params.sprstat_abandoned_unsent =
6828 			streamoute->abandoned_unsent[__SCTP_PR_INDEX(policy)];
6829 		params.sprstat_abandoned_sent =
6830 			streamoute->abandoned_sent[__SCTP_PR_INDEX(policy)];
6831 	}
6832 
6833 	if (put_user(len, optlen) || copy_to_user(optval, &params, len)) {
6834 		retval = -EFAULT;
6835 		goto out;
6836 	}
6837 
6838 	retval = 0;
6839 
6840 out:
6841 	return retval;
6842 }
6843 
6844 static int sctp_getsockopt_reconfig_supported(struct sock *sk, int len,
6845 					      char __user *optval,
6846 					      int __user *optlen)
6847 {
6848 	struct sctp_assoc_value params;
6849 	struct sctp_association *asoc;
6850 	int retval = -EFAULT;
6851 
6852 	if (len < sizeof(params)) {
6853 		retval = -EINVAL;
6854 		goto out;
6855 	}
6856 
6857 	len = sizeof(params);
6858 	if (copy_from_user(&params, optval, len))
6859 		goto out;
6860 
6861 	asoc = sctp_id2assoc(sk, params.assoc_id);
6862 	if (asoc) {
6863 		params.assoc_value = asoc->reconf_enable;
6864 	} else if (!params.assoc_id) {
6865 		struct sctp_sock *sp = sctp_sk(sk);
6866 
6867 		params.assoc_value = sp->ep->reconf_enable;
6868 	} else {
6869 		retval = -EINVAL;
6870 		goto out;
6871 	}
6872 
6873 	if (put_user(len, optlen))
6874 		goto out;
6875 
6876 	if (copy_to_user(optval, &params, len))
6877 		goto out;
6878 
6879 	retval = 0;
6880 
6881 out:
6882 	return retval;
6883 }
6884 
6885 static int sctp_getsockopt_enable_strreset(struct sock *sk, int len,
6886 					   char __user *optval,
6887 					   int __user *optlen)
6888 {
6889 	struct sctp_assoc_value params;
6890 	struct sctp_association *asoc;
6891 	int retval = -EFAULT;
6892 
6893 	if (len < sizeof(params)) {
6894 		retval = -EINVAL;
6895 		goto out;
6896 	}
6897 
6898 	len = sizeof(params);
6899 	if (copy_from_user(&params, optval, len))
6900 		goto out;
6901 
6902 	asoc = sctp_id2assoc(sk, params.assoc_id);
6903 	if (asoc) {
6904 		params.assoc_value = asoc->strreset_enable;
6905 	} else if (!params.assoc_id) {
6906 		struct sctp_sock *sp = sctp_sk(sk);
6907 
6908 		params.assoc_value = sp->ep->strreset_enable;
6909 	} else {
6910 		retval = -EINVAL;
6911 		goto out;
6912 	}
6913 
6914 	if (put_user(len, optlen))
6915 		goto out;
6916 
6917 	if (copy_to_user(optval, &params, len))
6918 		goto out;
6919 
6920 	retval = 0;
6921 
6922 out:
6923 	return retval;
6924 }
6925 
6926 static int sctp_getsockopt_scheduler(struct sock *sk, int len,
6927 				     char __user *optval,
6928 				     int __user *optlen)
6929 {
6930 	struct sctp_assoc_value params;
6931 	struct sctp_association *asoc;
6932 	int retval = -EFAULT;
6933 
6934 	if (len < sizeof(params)) {
6935 		retval = -EINVAL;
6936 		goto out;
6937 	}
6938 
6939 	len = sizeof(params);
6940 	if (copy_from_user(&params, optval, len))
6941 		goto out;
6942 
6943 	asoc = sctp_id2assoc(sk, params.assoc_id);
6944 	if (!asoc) {
6945 		retval = -EINVAL;
6946 		goto out;
6947 	}
6948 
6949 	params.assoc_value = sctp_sched_get_sched(asoc);
6950 
6951 	if (put_user(len, optlen))
6952 		goto out;
6953 
6954 	if (copy_to_user(optval, &params, len))
6955 		goto out;
6956 
6957 	retval = 0;
6958 
6959 out:
6960 	return retval;
6961 }
6962 
6963 static int sctp_getsockopt_scheduler_value(struct sock *sk, int len,
6964 					   char __user *optval,
6965 					   int __user *optlen)
6966 {
6967 	struct sctp_stream_value params;
6968 	struct sctp_association *asoc;
6969 	int retval = -EFAULT;
6970 
6971 	if (len < sizeof(params)) {
6972 		retval = -EINVAL;
6973 		goto out;
6974 	}
6975 
6976 	len = sizeof(params);
6977 	if (copy_from_user(&params, optval, len))
6978 		goto out;
6979 
6980 	asoc = sctp_id2assoc(sk, params.assoc_id);
6981 	if (!asoc) {
6982 		retval = -EINVAL;
6983 		goto out;
6984 	}
6985 
6986 	retval = sctp_sched_get_value(asoc, params.stream_id,
6987 				      &params.stream_value);
6988 	if (retval)
6989 		goto out;
6990 
6991 	if (put_user(len, optlen)) {
6992 		retval = -EFAULT;
6993 		goto out;
6994 	}
6995 
6996 	if (copy_to_user(optval, &params, len)) {
6997 		retval = -EFAULT;
6998 		goto out;
6999 	}
7000 
7001 out:
7002 	return retval;
7003 }
7004 
7005 static int sctp_getsockopt(struct sock *sk, int level, int optname,
7006 			   char __user *optval, int __user *optlen)
7007 {
7008 	int retval = 0;
7009 	int len;
7010 
7011 	pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
7012 
7013 	/* I can hardly begin to describe how wrong this is.  This is
7014 	 * so broken as to be worse than useless.  The API draft
7015 	 * REALLY is NOT helpful here...  I am not convinced that the
7016 	 * semantics of getsockopt() with a level OTHER THAN SOL_SCTP
7017 	 * are at all well-founded.
7018 	 */
7019 	if (level != SOL_SCTP) {
7020 		struct sctp_af *af = sctp_sk(sk)->pf->af;
7021 
7022 		retval = af->getsockopt(sk, level, optname, optval, optlen);
7023 		return retval;
7024 	}
7025 
7026 	if (get_user(len, optlen))
7027 		return -EFAULT;
7028 
7029 	if (len < 0)
7030 		return -EINVAL;
7031 
7032 	lock_sock(sk);
7033 
7034 	switch (optname) {
7035 	case SCTP_STATUS:
7036 		retval = sctp_getsockopt_sctp_status(sk, len, optval, optlen);
7037 		break;
7038 	case SCTP_DISABLE_FRAGMENTS:
7039 		retval = sctp_getsockopt_disable_fragments(sk, len, optval,
7040 							   optlen);
7041 		break;
7042 	case SCTP_EVENTS:
7043 		retval = sctp_getsockopt_events(sk, len, optval, optlen);
7044 		break;
7045 	case SCTP_AUTOCLOSE:
7046 		retval = sctp_getsockopt_autoclose(sk, len, optval, optlen);
7047 		break;
7048 	case SCTP_SOCKOPT_PEELOFF:
7049 		retval = sctp_getsockopt_peeloff(sk, len, optval, optlen);
7050 		break;
7051 	case SCTP_SOCKOPT_PEELOFF_FLAGS:
7052 		retval = sctp_getsockopt_peeloff_flags(sk, len, optval, optlen);
7053 		break;
7054 	case SCTP_PEER_ADDR_PARAMS:
7055 		retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
7056 							  optlen);
7057 		break;
7058 	case SCTP_DELAYED_SACK:
7059 		retval = sctp_getsockopt_delayed_ack(sk, len, optval,
7060 							  optlen);
7061 		break;
7062 	case SCTP_INITMSG:
7063 		retval = sctp_getsockopt_initmsg(sk, len, optval, optlen);
7064 		break;
7065 	case SCTP_GET_PEER_ADDRS:
7066 		retval = sctp_getsockopt_peer_addrs(sk, len, optval,
7067 						    optlen);
7068 		break;
7069 	case SCTP_GET_LOCAL_ADDRS:
7070 		retval = sctp_getsockopt_local_addrs(sk, len, optval,
7071 						     optlen);
7072 		break;
7073 	case SCTP_SOCKOPT_CONNECTX3:
7074 		retval = sctp_getsockopt_connectx3(sk, len, optval, optlen);
7075 		break;
7076 	case SCTP_DEFAULT_SEND_PARAM:
7077 		retval = sctp_getsockopt_default_send_param(sk, len,
7078 							    optval, optlen);
7079 		break;
7080 	case SCTP_DEFAULT_SNDINFO:
7081 		retval = sctp_getsockopt_default_sndinfo(sk, len,
7082 							 optval, optlen);
7083 		break;
7084 	case SCTP_PRIMARY_ADDR:
7085 		retval = sctp_getsockopt_primary_addr(sk, len, optval, optlen);
7086 		break;
7087 	case SCTP_NODELAY:
7088 		retval = sctp_getsockopt_nodelay(sk, len, optval, optlen);
7089 		break;
7090 	case SCTP_RTOINFO:
7091 		retval = sctp_getsockopt_rtoinfo(sk, len, optval, optlen);
7092 		break;
7093 	case SCTP_ASSOCINFO:
7094 		retval = sctp_getsockopt_associnfo(sk, len, optval, optlen);
7095 		break;
7096 	case SCTP_I_WANT_MAPPED_V4_ADDR:
7097 		retval = sctp_getsockopt_mappedv4(sk, len, optval, optlen);
7098 		break;
7099 	case SCTP_MAXSEG:
7100 		retval = sctp_getsockopt_maxseg(sk, len, optval, optlen);
7101 		break;
7102 	case SCTP_GET_PEER_ADDR_INFO:
7103 		retval = sctp_getsockopt_peer_addr_info(sk, len, optval,
7104 							optlen);
7105 		break;
7106 	case SCTP_ADAPTATION_LAYER:
7107 		retval = sctp_getsockopt_adaptation_layer(sk, len, optval,
7108 							optlen);
7109 		break;
7110 	case SCTP_CONTEXT:
7111 		retval = sctp_getsockopt_context(sk, len, optval, optlen);
7112 		break;
7113 	case SCTP_FRAGMENT_INTERLEAVE:
7114 		retval = sctp_getsockopt_fragment_interleave(sk, len, optval,
7115 							     optlen);
7116 		break;
7117 	case SCTP_PARTIAL_DELIVERY_POINT:
7118 		retval = sctp_getsockopt_partial_delivery_point(sk, len, optval,
7119 								optlen);
7120 		break;
7121 	case SCTP_MAX_BURST:
7122 		retval = sctp_getsockopt_maxburst(sk, len, optval, optlen);
7123 		break;
7124 	case SCTP_AUTH_KEY:
7125 	case SCTP_AUTH_CHUNK:
7126 	case SCTP_AUTH_DELETE_KEY:
7127 		retval = -EOPNOTSUPP;
7128 		break;
7129 	case SCTP_HMAC_IDENT:
7130 		retval = sctp_getsockopt_hmac_ident(sk, len, optval, optlen);
7131 		break;
7132 	case SCTP_AUTH_ACTIVE_KEY:
7133 		retval = sctp_getsockopt_active_key(sk, len, optval, optlen);
7134 		break;
7135 	case SCTP_PEER_AUTH_CHUNKS:
7136 		retval = sctp_getsockopt_peer_auth_chunks(sk, len, optval,
7137 							optlen);
7138 		break;
7139 	case SCTP_LOCAL_AUTH_CHUNKS:
7140 		retval = sctp_getsockopt_local_auth_chunks(sk, len, optval,
7141 							optlen);
7142 		break;
7143 	case SCTP_GET_ASSOC_NUMBER:
7144 		retval = sctp_getsockopt_assoc_number(sk, len, optval, optlen);
7145 		break;
7146 	case SCTP_GET_ASSOC_ID_LIST:
7147 		retval = sctp_getsockopt_assoc_ids(sk, len, optval, optlen);
7148 		break;
7149 	case SCTP_AUTO_ASCONF:
7150 		retval = sctp_getsockopt_auto_asconf(sk, len, optval, optlen);
7151 		break;
7152 	case SCTP_PEER_ADDR_THLDS:
7153 		retval = sctp_getsockopt_paddr_thresholds(sk, optval, len, optlen);
7154 		break;
7155 	case SCTP_GET_ASSOC_STATS:
7156 		retval = sctp_getsockopt_assoc_stats(sk, len, optval, optlen);
7157 		break;
7158 	case SCTP_RECVRCVINFO:
7159 		retval = sctp_getsockopt_recvrcvinfo(sk, len, optval, optlen);
7160 		break;
7161 	case SCTP_RECVNXTINFO:
7162 		retval = sctp_getsockopt_recvnxtinfo(sk, len, optval, optlen);
7163 		break;
7164 	case SCTP_PR_SUPPORTED:
7165 		retval = sctp_getsockopt_pr_supported(sk, len, optval, optlen);
7166 		break;
7167 	case SCTP_DEFAULT_PRINFO:
7168 		retval = sctp_getsockopt_default_prinfo(sk, len, optval,
7169 							optlen);
7170 		break;
7171 	case SCTP_PR_ASSOC_STATUS:
7172 		retval = sctp_getsockopt_pr_assocstatus(sk, len, optval,
7173 							optlen);
7174 		break;
7175 	case SCTP_PR_STREAM_STATUS:
7176 		retval = sctp_getsockopt_pr_streamstatus(sk, len, optval,
7177 							 optlen);
7178 		break;
7179 	case SCTP_RECONFIG_SUPPORTED:
7180 		retval = sctp_getsockopt_reconfig_supported(sk, len, optval,
7181 							    optlen);
7182 		break;
7183 	case SCTP_ENABLE_STREAM_RESET:
7184 		retval = sctp_getsockopt_enable_strreset(sk, len, optval,
7185 							 optlen);
7186 		break;
7187 	case SCTP_STREAM_SCHEDULER:
7188 		retval = sctp_getsockopt_scheduler(sk, len, optval,
7189 						   optlen);
7190 		break;
7191 	case SCTP_STREAM_SCHEDULER_VALUE:
7192 		retval = sctp_getsockopt_scheduler_value(sk, len, optval,
7193 							 optlen);
7194 		break;
7195 	default:
7196 		retval = -ENOPROTOOPT;
7197 		break;
7198 	}
7199 
7200 	release_sock(sk);
7201 	return retval;
7202 }
7203 
7204 static int sctp_hash(struct sock *sk)
7205 {
7206 	/* STUB */
7207 	return 0;
7208 }
7209 
7210 static void sctp_unhash(struct sock *sk)
7211 {
7212 	/* STUB */
7213 }
7214 
7215 /* Check if port is acceptable.  Possibly find first available port.
7216  *
7217  * The port hash table (contained in the 'global' SCTP protocol storage
7218  * returned by struct sctp_protocol *sctp_get_protocol()). The hash
7219  * table is an array of 4096 lists (sctp_bind_hashbucket). Each
7220  * list (the list number is the port number hashed out, so as you
7221  * would expect from a hash function, all the ports in a given list have
7222  * such a number that hashes out to the same list number; you were
7223  * expecting that, right?); so each list has a set of ports, with a
7224  * link to the socket (struct sock) that uses it, the port number and
7225  * a fastreuse flag (FIXME: NPI ipg).
7226  */
7227 static struct sctp_bind_bucket *sctp_bucket_create(
7228 	struct sctp_bind_hashbucket *head, struct net *, unsigned short snum);
7229 
7230 static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
7231 {
7232 	struct sctp_bind_hashbucket *head; /* hash list */
7233 	struct sctp_bind_bucket *pp;
7234 	unsigned short snum;
7235 	int ret;
7236 
7237 	snum = ntohs(addr->v4.sin_port);
7238 
7239 	pr_debug("%s: begins, snum:%d\n", __func__, snum);
7240 
7241 	local_bh_disable();
7242 
7243 	if (snum == 0) {
7244 		/* Search for an available port. */
7245 		int low, high, remaining, index;
7246 		unsigned int rover;
7247 		struct net *net = sock_net(sk);
7248 
7249 		inet_get_local_port_range(net, &low, &high);
7250 		remaining = (high - low) + 1;
7251 		rover = prandom_u32() % remaining + low;
7252 
7253 		do {
7254 			rover++;
7255 			if ((rover < low) || (rover > high))
7256 				rover = low;
7257 			if (inet_is_local_reserved_port(net, rover))
7258 				continue;
7259 			index = sctp_phashfn(sock_net(sk), rover);
7260 			head = &sctp_port_hashtable[index];
7261 			spin_lock(&head->lock);
7262 			sctp_for_each_hentry(pp, &head->chain)
7263 				if ((pp->port == rover) &&
7264 				    net_eq(sock_net(sk), pp->net))
7265 					goto next;
7266 			break;
7267 		next:
7268 			spin_unlock(&head->lock);
7269 		} while (--remaining > 0);
7270 
7271 		/* Exhausted local port range during search? */
7272 		ret = 1;
7273 		if (remaining <= 0)
7274 			goto fail;
7275 
7276 		/* OK, here is the one we will use.  HEAD (the port
7277 		 * hash table list entry) is non-NULL and we hold it's
7278 		 * mutex.
7279 		 */
7280 		snum = rover;
7281 	} else {
7282 		/* We are given an specific port number; we verify
7283 		 * that it is not being used. If it is used, we will
7284 		 * exahust the search in the hash list corresponding
7285 		 * to the port number (snum) - we detect that with the
7286 		 * port iterator, pp being NULL.
7287 		 */
7288 		head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
7289 		spin_lock(&head->lock);
7290 		sctp_for_each_hentry(pp, &head->chain) {
7291 			if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
7292 				goto pp_found;
7293 		}
7294 	}
7295 	pp = NULL;
7296 	goto pp_not_found;
7297 pp_found:
7298 	if (!hlist_empty(&pp->owner)) {
7299 		/* We had a port hash table hit - there is an
7300 		 * available port (pp != NULL) and it is being
7301 		 * used by other socket (pp->owner not empty); that other
7302 		 * socket is going to be sk2.
7303 		 */
7304 		int reuse = sk->sk_reuse;
7305 		struct sock *sk2;
7306 
7307 		pr_debug("%s: found a possible match\n", __func__);
7308 
7309 		if (pp->fastreuse && sk->sk_reuse &&
7310 			sk->sk_state != SCTP_SS_LISTENING)
7311 			goto success;
7312 
7313 		/* Run through the list of sockets bound to the port
7314 		 * (pp->port) [via the pointers bind_next and
7315 		 * bind_pprev in the struct sock *sk2 (pp->sk)]. On each one,
7316 		 * we get the endpoint they describe and run through
7317 		 * the endpoint's list of IP (v4 or v6) addresses,
7318 		 * comparing each of the addresses with the address of
7319 		 * the socket sk. If we find a match, then that means
7320 		 * that this port/socket (sk) combination are already
7321 		 * in an endpoint.
7322 		 */
7323 		sk_for_each_bound(sk2, &pp->owner) {
7324 			struct sctp_endpoint *ep2;
7325 			ep2 = sctp_sk(sk2)->ep;
7326 
7327 			if (sk == sk2 ||
7328 			    (reuse && sk2->sk_reuse &&
7329 			     sk2->sk_state != SCTP_SS_LISTENING))
7330 				continue;
7331 
7332 			if (sctp_bind_addr_conflict(&ep2->base.bind_addr, addr,
7333 						 sctp_sk(sk2), sctp_sk(sk))) {
7334 				ret = (long)sk2;
7335 				goto fail_unlock;
7336 			}
7337 		}
7338 
7339 		pr_debug("%s: found a match\n", __func__);
7340 	}
7341 pp_not_found:
7342 	/* If there was a hash table miss, create a new port.  */
7343 	ret = 1;
7344 	if (!pp && !(pp = sctp_bucket_create(head, sock_net(sk), snum)))
7345 		goto fail_unlock;
7346 
7347 	/* In either case (hit or miss), make sure fastreuse is 1 only
7348 	 * if sk->sk_reuse is too (that is, if the caller requested
7349 	 * SO_REUSEADDR on this socket -sk-).
7350 	 */
7351 	if (hlist_empty(&pp->owner)) {
7352 		if (sk->sk_reuse && sk->sk_state != SCTP_SS_LISTENING)
7353 			pp->fastreuse = 1;
7354 		else
7355 			pp->fastreuse = 0;
7356 	} else if (pp->fastreuse &&
7357 		(!sk->sk_reuse || sk->sk_state == SCTP_SS_LISTENING))
7358 		pp->fastreuse = 0;
7359 
7360 	/* We are set, so fill up all the data in the hash table
7361 	 * entry, tie the socket list information with the rest of the
7362 	 * sockets FIXME: Blurry, NPI (ipg).
7363 	 */
7364 success:
7365 	if (!sctp_sk(sk)->bind_hash) {
7366 		inet_sk(sk)->inet_num = snum;
7367 		sk_add_bind_node(sk, &pp->owner);
7368 		sctp_sk(sk)->bind_hash = pp;
7369 	}
7370 	ret = 0;
7371 
7372 fail_unlock:
7373 	spin_unlock(&head->lock);
7374 
7375 fail:
7376 	local_bh_enable();
7377 	return ret;
7378 }
7379 
7380 /* Assign a 'snum' port to the socket.  If snum == 0, an ephemeral
7381  * port is requested.
7382  */
7383 static int sctp_get_port(struct sock *sk, unsigned short snum)
7384 {
7385 	union sctp_addr addr;
7386 	struct sctp_af *af = sctp_sk(sk)->pf->af;
7387 
7388 	/* Set up a dummy address struct from the sk. */
7389 	af->from_sk(&addr, sk);
7390 	addr.v4.sin_port = htons(snum);
7391 
7392 	/* Note: sk->sk_num gets filled in if ephemeral port request. */
7393 	return !!sctp_get_port_local(sk, &addr);
7394 }
7395 
7396 /*
7397  *  Move a socket to LISTENING state.
7398  */
7399 static int sctp_listen_start(struct sock *sk, int backlog)
7400 {
7401 	struct sctp_sock *sp = sctp_sk(sk);
7402 	struct sctp_endpoint *ep = sp->ep;
7403 	struct crypto_shash *tfm = NULL;
7404 	char alg[32];
7405 
7406 	/* Allocate HMAC for generating cookie. */
7407 	if (!sp->hmac && sp->sctp_hmac_alg) {
7408 		sprintf(alg, "hmac(%s)", sp->sctp_hmac_alg);
7409 		tfm = crypto_alloc_shash(alg, 0, 0);
7410 		if (IS_ERR(tfm)) {
7411 			net_info_ratelimited("failed to load transform for %s: %ld\n",
7412 					     sp->sctp_hmac_alg, PTR_ERR(tfm));
7413 			return -ENOSYS;
7414 		}
7415 		sctp_sk(sk)->hmac = tfm;
7416 	}
7417 
7418 	/*
7419 	 * If a bind() or sctp_bindx() is not called prior to a listen()
7420 	 * call that allows new associations to be accepted, the system
7421 	 * picks an ephemeral port and will choose an address set equivalent
7422 	 * to binding with a wildcard address.
7423 	 *
7424 	 * This is not currently spelled out in the SCTP sockets
7425 	 * extensions draft, but follows the practice as seen in TCP
7426 	 * sockets.
7427 	 *
7428 	 */
7429 	sk->sk_state = SCTP_SS_LISTENING;
7430 	if (!ep->base.bind_addr.port) {
7431 		if (sctp_autobind(sk))
7432 			return -EAGAIN;
7433 	} else {
7434 		if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
7435 			sk->sk_state = SCTP_SS_CLOSED;
7436 			return -EADDRINUSE;
7437 		}
7438 	}
7439 
7440 	sk->sk_max_ack_backlog = backlog;
7441 	sctp_hash_endpoint(ep);
7442 	return 0;
7443 }
7444 
7445 /*
7446  * 4.1.3 / 5.1.3 listen()
7447  *
7448  *   By default, new associations are not accepted for UDP style sockets.
7449  *   An application uses listen() to mark a socket as being able to
7450  *   accept new associations.
7451  *
7452  *   On TCP style sockets, applications use listen() to ready the SCTP
7453  *   endpoint for accepting inbound associations.
7454  *
7455  *   On both types of endpoints a backlog of '0' disables listening.
7456  *
7457  *  Move a socket to LISTENING state.
7458  */
7459 int sctp_inet_listen(struct socket *sock, int backlog)
7460 {
7461 	struct sock *sk = sock->sk;
7462 	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
7463 	int err = -EINVAL;
7464 
7465 	if (unlikely(backlog < 0))
7466 		return err;
7467 
7468 	lock_sock(sk);
7469 
7470 	/* Peeled-off sockets are not allowed to listen().  */
7471 	if (sctp_style(sk, UDP_HIGH_BANDWIDTH))
7472 		goto out;
7473 
7474 	if (sock->state != SS_UNCONNECTED)
7475 		goto out;
7476 
7477 	if (!sctp_sstate(sk, LISTENING) && !sctp_sstate(sk, CLOSED))
7478 		goto out;
7479 
7480 	/* If backlog is zero, disable listening. */
7481 	if (!backlog) {
7482 		if (sctp_sstate(sk, CLOSED))
7483 			goto out;
7484 
7485 		err = 0;
7486 		sctp_unhash_endpoint(ep);
7487 		sk->sk_state = SCTP_SS_CLOSED;
7488 		if (sk->sk_reuse)
7489 			sctp_sk(sk)->bind_hash->fastreuse = 1;
7490 		goto out;
7491 	}
7492 
7493 	/* If we are already listening, just update the backlog */
7494 	if (sctp_sstate(sk, LISTENING))
7495 		sk->sk_max_ack_backlog = backlog;
7496 	else {
7497 		err = sctp_listen_start(sk, backlog);
7498 		if (err)
7499 			goto out;
7500 	}
7501 
7502 	err = 0;
7503 out:
7504 	release_sock(sk);
7505 	return err;
7506 }
7507 
7508 /*
7509  * This function is done by modeling the current datagram_poll() and the
7510  * tcp_poll().  Note that, based on these implementations, we don't
7511  * lock the socket in this function, even though it seems that,
7512  * ideally, locking or some other mechanisms can be used to ensure
7513  * the integrity of the counters (sndbuf and wmem_alloc) used
7514  * in this place.  We assume that we don't need locks either until proven
7515  * otherwise.
7516  *
7517  * Another thing to note is that we include the Async I/O support
7518  * here, again, by modeling the current TCP/UDP code.  We don't have
7519  * a good way to test with it yet.
7520  */
7521 unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
7522 {
7523 	struct sock *sk = sock->sk;
7524 	struct sctp_sock *sp = sctp_sk(sk);
7525 	unsigned int mask;
7526 
7527 	poll_wait(file, sk_sleep(sk), wait);
7528 
7529 	sock_rps_record_flow(sk);
7530 
7531 	/* A TCP-style listening socket becomes readable when the accept queue
7532 	 * is not empty.
7533 	 */
7534 	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
7535 		return (!list_empty(&sp->ep->asocs)) ?
7536 			(POLLIN | POLLRDNORM) : 0;
7537 
7538 	mask = 0;
7539 
7540 	/* Is there any exceptional events?  */
7541 	if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
7542 		mask |= POLLERR |
7543 			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
7544 	if (sk->sk_shutdown & RCV_SHUTDOWN)
7545 		mask |= POLLRDHUP | POLLIN | POLLRDNORM;
7546 	if (sk->sk_shutdown == SHUTDOWN_MASK)
7547 		mask |= POLLHUP;
7548 
7549 	/* Is it readable?  Reconsider this code with TCP-style support.  */
7550 	if (!skb_queue_empty(&sk->sk_receive_queue))
7551 		mask |= POLLIN | POLLRDNORM;
7552 
7553 	/* The association is either gone or not ready.  */
7554 	if (!sctp_style(sk, UDP) && sctp_sstate(sk, CLOSED))
7555 		return mask;
7556 
7557 	/* Is it writable?  */
7558 	if (sctp_writeable(sk)) {
7559 		mask |= POLLOUT | POLLWRNORM;
7560 	} else {
7561 		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
7562 		/*
7563 		 * Since the socket is not locked, the buffer
7564 		 * might be made available after the writeable check and
7565 		 * before the bit is set.  This could cause a lost I/O
7566 		 * signal.  tcp_poll() has a race breaker for this race
7567 		 * condition.  Based on their implementation, we put
7568 		 * in the following code to cover it as well.
7569 		 */
7570 		if (sctp_writeable(sk))
7571 			mask |= POLLOUT | POLLWRNORM;
7572 	}
7573 	return mask;
7574 }
7575 
7576 /********************************************************************
7577  * 2nd Level Abstractions
7578  ********************************************************************/
7579 
7580 static struct sctp_bind_bucket *sctp_bucket_create(
7581 	struct sctp_bind_hashbucket *head, struct net *net, unsigned short snum)
7582 {
7583 	struct sctp_bind_bucket *pp;
7584 
7585 	pp = kmem_cache_alloc(sctp_bucket_cachep, GFP_ATOMIC);
7586 	if (pp) {
7587 		SCTP_DBG_OBJCNT_INC(bind_bucket);
7588 		pp->port = snum;
7589 		pp->fastreuse = 0;
7590 		INIT_HLIST_HEAD(&pp->owner);
7591 		pp->net = net;
7592 		hlist_add_head(&pp->node, &head->chain);
7593 	}
7594 	return pp;
7595 }
7596 
7597 /* Caller must hold hashbucket lock for this tb with local BH disabled */
7598 static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
7599 {
7600 	if (pp && hlist_empty(&pp->owner)) {
7601 		__hlist_del(&pp->node);
7602 		kmem_cache_free(sctp_bucket_cachep, pp);
7603 		SCTP_DBG_OBJCNT_DEC(bind_bucket);
7604 	}
7605 }
7606 
7607 /* Release this socket's reference to a local port.  */
7608 static inline void __sctp_put_port(struct sock *sk)
7609 {
7610 	struct sctp_bind_hashbucket *head =
7611 		&sctp_port_hashtable[sctp_phashfn(sock_net(sk),
7612 						  inet_sk(sk)->inet_num)];
7613 	struct sctp_bind_bucket *pp;
7614 
7615 	spin_lock(&head->lock);
7616 	pp = sctp_sk(sk)->bind_hash;
7617 	__sk_del_bind_node(sk);
7618 	sctp_sk(sk)->bind_hash = NULL;
7619 	inet_sk(sk)->inet_num = 0;
7620 	sctp_bucket_destroy(pp);
7621 	spin_unlock(&head->lock);
7622 }
7623 
7624 void sctp_put_port(struct sock *sk)
7625 {
7626 	local_bh_disable();
7627 	__sctp_put_port(sk);
7628 	local_bh_enable();
7629 }
7630 
7631 /*
7632  * The system picks an ephemeral port and choose an address set equivalent
7633  * to binding with a wildcard address.
7634  * One of those addresses will be the primary address for the association.
7635  * This automatically enables the multihoming capability of SCTP.
7636  */
7637 static int sctp_autobind(struct sock *sk)
7638 {
7639 	union sctp_addr autoaddr;
7640 	struct sctp_af *af;
7641 	__be16 port;
7642 
7643 	/* Initialize a local sockaddr structure to INADDR_ANY. */
7644 	af = sctp_sk(sk)->pf->af;
7645 
7646 	port = htons(inet_sk(sk)->inet_num);
7647 	af->inaddr_any(&autoaddr, port);
7648 
7649 	return sctp_do_bind(sk, &autoaddr, af->sockaddr_len);
7650 }
7651 
7652 /* Parse out IPPROTO_SCTP CMSG headers.  Perform only minimal validation.
7653  *
7654  * From RFC 2292
7655  * 4.2 The cmsghdr Structure *
7656  *
7657  * When ancillary data is sent or received, any number of ancillary data
7658  * objects can be specified by the msg_control and msg_controllen members of
7659  * the msghdr structure, because each object is preceded by
7660  * a cmsghdr structure defining the object's length (the cmsg_len member).
7661  * Historically Berkeley-derived implementations have passed only one object
7662  * at a time, but this API allows multiple objects to be
7663  * passed in a single call to sendmsg() or recvmsg(). The following example
7664  * shows two ancillary data objects in a control buffer.
7665  *
7666  *   |<--------------------------- msg_controllen -------------------------->|
7667  *   |                                                                       |
7668  *
7669  *   |<----- ancillary data object ----->|<----- ancillary data object ----->|
7670  *
7671  *   |<---------- CMSG_SPACE() --------->|<---------- CMSG_SPACE() --------->|
7672  *   |                                   |                                   |
7673  *
7674  *   |<---------- cmsg_len ---------->|  |<--------- cmsg_len ----------->|  |
7675  *
7676  *   |<--------- CMSG_LEN() --------->|  |<-------- CMSG_LEN() ---------->|  |
7677  *   |                                |  |                                |  |
7678  *
7679  *   +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
7680  *   |cmsg_|cmsg_|cmsg_|XX|           |XX|cmsg_|cmsg_|cmsg_|XX|           |XX|
7681  *
7682  *   |len  |level|type |XX|cmsg_data[]|XX|len  |level|type |XX|cmsg_data[]|XX|
7683  *
7684  *   +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
7685  *    ^
7686  *    |
7687  *
7688  * msg_control
7689  * points here
7690  */
7691 static int sctp_msghdr_parse(const struct msghdr *msg, struct sctp_cmsgs *cmsgs)
7692 {
7693 	struct msghdr *my_msg = (struct msghdr *)msg;
7694 	struct cmsghdr *cmsg;
7695 
7696 	for_each_cmsghdr(cmsg, my_msg) {
7697 		if (!CMSG_OK(my_msg, cmsg))
7698 			return -EINVAL;
7699 
7700 		/* Should we parse this header or ignore?  */
7701 		if (cmsg->cmsg_level != IPPROTO_SCTP)
7702 			continue;
7703 
7704 		/* Strictly check lengths following example in SCM code.  */
7705 		switch (cmsg->cmsg_type) {
7706 		case SCTP_INIT:
7707 			/* SCTP Socket API Extension
7708 			 * 5.3.1 SCTP Initiation Structure (SCTP_INIT)
7709 			 *
7710 			 * This cmsghdr structure provides information for
7711 			 * initializing new SCTP associations with sendmsg().
7712 			 * The SCTP_INITMSG socket option uses this same data
7713 			 * structure.  This structure is not used for
7714 			 * recvmsg().
7715 			 *
7716 			 * cmsg_level    cmsg_type      cmsg_data[]
7717 			 * ------------  ------------   ----------------------
7718 			 * IPPROTO_SCTP  SCTP_INIT      struct sctp_initmsg
7719 			 */
7720 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_initmsg)))
7721 				return -EINVAL;
7722 
7723 			cmsgs->init = CMSG_DATA(cmsg);
7724 			break;
7725 
7726 		case SCTP_SNDRCV:
7727 			/* SCTP Socket API Extension
7728 			 * 5.3.2 SCTP Header Information Structure(SCTP_SNDRCV)
7729 			 *
7730 			 * This cmsghdr structure specifies SCTP options for
7731 			 * sendmsg() and describes SCTP header information
7732 			 * about a received message through recvmsg().
7733 			 *
7734 			 * cmsg_level    cmsg_type      cmsg_data[]
7735 			 * ------------  ------------   ----------------------
7736 			 * IPPROTO_SCTP  SCTP_SNDRCV    struct sctp_sndrcvinfo
7737 			 */
7738 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndrcvinfo)))
7739 				return -EINVAL;
7740 
7741 			cmsgs->srinfo = CMSG_DATA(cmsg);
7742 
7743 			if (cmsgs->srinfo->sinfo_flags &
7744 			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
7745 			      SCTP_SACK_IMMEDIATELY | SCTP_PR_SCTP_MASK |
7746 			      SCTP_ABORT | SCTP_EOF))
7747 				return -EINVAL;
7748 			break;
7749 
7750 		case SCTP_SNDINFO:
7751 			/* SCTP Socket API Extension
7752 			 * 5.3.4 SCTP Send Information Structure (SCTP_SNDINFO)
7753 			 *
7754 			 * This cmsghdr structure specifies SCTP options for
7755 			 * sendmsg(). This structure and SCTP_RCVINFO replaces
7756 			 * SCTP_SNDRCV which has been deprecated.
7757 			 *
7758 			 * cmsg_level    cmsg_type      cmsg_data[]
7759 			 * ------------  ------------   ---------------------
7760 			 * IPPROTO_SCTP  SCTP_SNDINFO    struct sctp_sndinfo
7761 			 */
7762 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndinfo)))
7763 				return -EINVAL;
7764 
7765 			cmsgs->sinfo = CMSG_DATA(cmsg);
7766 
7767 			if (cmsgs->sinfo->snd_flags &
7768 			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
7769 			      SCTP_SACK_IMMEDIATELY | SCTP_PR_SCTP_MASK |
7770 			      SCTP_ABORT | SCTP_EOF))
7771 				return -EINVAL;
7772 			break;
7773 		default:
7774 			return -EINVAL;
7775 		}
7776 	}
7777 
7778 	return 0;
7779 }
7780 
7781 /*
7782  * Wait for a packet..
7783  * Note: This function is the same function as in core/datagram.c
7784  * with a few modifications to make lksctp work.
7785  */
7786 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p)
7787 {
7788 	int error;
7789 	DEFINE_WAIT(wait);
7790 
7791 	prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
7792 
7793 	/* Socket errors? */
7794 	error = sock_error(sk);
7795 	if (error)
7796 		goto out;
7797 
7798 	if (!skb_queue_empty(&sk->sk_receive_queue))
7799 		goto ready;
7800 
7801 	/* Socket shut down?  */
7802 	if (sk->sk_shutdown & RCV_SHUTDOWN)
7803 		goto out;
7804 
7805 	/* Sequenced packets can come disconnected.  If so we report the
7806 	 * problem.
7807 	 */
7808 	error = -ENOTCONN;
7809 
7810 	/* Is there a good reason to think that we may receive some data?  */
7811 	if (list_empty(&sctp_sk(sk)->ep->asocs) && !sctp_sstate(sk, LISTENING))
7812 		goto out;
7813 
7814 	/* Handle signals.  */
7815 	if (signal_pending(current))
7816 		goto interrupted;
7817 
7818 	/* Let another process have a go.  Since we are going to sleep
7819 	 * anyway.  Note: This may cause odd behaviors if the message
7820 	 * does not fit in the user's buffer, but this seems to be the
7821 	 * only way to honor MSG_DONTWAIT realistically.
7822 	 */
7823 	release_sock(sk);
7824 	*timeo_p = schedule_timeout(*timeo_p);
7825 	lock_sock(sk);
7826 
7827 ready:
7828 	finish_wait(sk_sleep(sk), &wait);
7829 	return 0;
7830 
7831 interrupted:
7832 	error = sock_intr_errno(*timeo_p);
7833 
7834 out:
7835 	finish_wait(sk_sleep(sk), &wait);
7836 	*err = error;
7837 	return error;
7838 }
7839 
7840 /* Receive a datagram.
7841  * Note: This is pretty much the same routine as in core/datagram.c
7842  * with a few changes to make lksctp work.
7843  */
7844 struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
7845 				       int noblock, int *err)
7846 {
7847 	int error;
7848 	struct sk_buff *skb;
7849 	long timeo;
7850 
7851 	timeo = sock_rcvtimeo(sk, noblock);
7852 
7853 	pr_debug("%s: timeo:%ld, max:%ld\n", __func__, timeo,
7854 		 MAX_SCHEDULE_TIMEOUT);
7855 
7856 	do {
7857 		/* Again only user level code calls this function,
7858 		 * so nothing interrupt level
7859 		 * will suddenly eat the receive_queue.
7860 		 *
7861 		 *  Look at current nfs client by the way...
7862 		 *  However, this function was correct in any case. 8)
7863 		 */
7864 		if (flags & MSG_PEEK) {
7865 			skb = skb_peek(&sk->sk_receive_queue);
7866 			if (skb)
7867 				refcount_inc(&skb->users);
7868 		} else {
7869 			skb = __skb_dequeue(&sk->sk_receive_queue);
7870 		}
7871 
7872 		if (skb)
7873 			return skb;
7874 
7875 		/* Caller is allowed not to check sk->sk_err before calling. */
7876 		error = sock_error(sk);
7877 		if (error)
7878 			goto no_packet;
7879 
7880 		if (sk->sk_shutdown & RCV_SHUTDOWN)
7881 			break;
7882 
7883 		if (sk_can_busy_loop(sk)) {
7884 			sk_busy_loop(sk, noblock);
7885 
7886 			if (!skb_queue_empty(&sk->sk_receive_queue))
7887 				continue;
7888 		}
7889 
7890 		/* User doesn't want to wait.  */
7891 		error = -EAGAIN;
7892 		if (!timeo)
7893 			goto no_packet;
7894 	} while (sctp_wait_for_packet(sk, err, &timeo) == 0);
7895 
7896 	return NULL;
7897 
7898 no_packet:
7899 	*err = error;
7900 	return NULL;
7901 }
7902 
7903 /* If sndbuf has changed, wake up per association sndbuf waiters.  */
7904 static void __sctp_write_space(struct sctp_association *asoc)
7905 {
7906 	struct sock *sk = asoc->base.sk;
7907 
7908 	if (sctp_wspace(asoc) <= 0)
7909 		return;
7910 
7911 	if (waitqueue_active(&asoc->wait))
7912 		wake_up_interruptible(&asoc->wait);
7913 
7914 	if (sctp_writeable(sk)) {
7915 		struct socket_wq *wq;
7916 
7917 		rcu_read_lock();
7918 		wq = rcu_dereference(sk->sk_wq);
7919 		if (wq) {
7920 			if (waitqueue_active(&wq->wait))
7921 				wake_up_interruptible(&wq->wait);
7922 
7923 			/* Note that we try to include the Async I/O support
7924 			 * here by modeling from the current TCP/UDP code.
7925 			 * We have not tested with it yet.
7926 			 */
7927 			if (!(sk->sk_shutdown & SEND_SHUTDOWN))
7928 				sock_wake_async(wq, SOCK_WAKE_SPACE, POLL_OUT);
7929 		}
7930 		rcu_read_unlock();
7931 	}
7932 }
7933 
7934 static void sctp_wake_up_waiters(struct sock *sk,
7935 				 struct sctp_association *asoc)
7936 {
7937 	struct sctp_association *tmp = asoc;
7938 
7939 	/* We do accounting for the sndbuf space per association,
7940 	 * so we only need to wake our own association.
7941 	 */
7942 	if (asoc->ep->sndbuf_policy)
7943 		return __sctp_write_space(asoc);
7944 
7945 	/* If association goes down and is just flushing its
7946 	 * outq, then just normally notify others.
7947 	 */
7948 	if (asoc->base.dead)
7949 		return sctp_write_space(sk);
7950 
7951 	/* Accounting for the sndbuf space is per socket, so we
7952 	 * need to wake up others, try to be fair and in case of
7953 	 * other associations, let them have a go first instead
7954 	 * of just doing a sctp_write_space() call.
7955 	 *
7956 	 * Note that we reach sctp_wake_up_waiters() only when
7957 	 * associations free up queued chunks, thus we are under
7958 	 * lock and the list of associations on a socket is
7959 	 * guaranteed not to change.
7960 	 */
7961 	for (tmp = list_next_entry(tmp, asocs); 1;
7962 	     tmp = list_next_entry(tmp, asocs)) {
7963 		/* Manually skip the head element. */
7964 		if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
7965 			continue;
7966 		/* Wake up association. */
7967 		__sctp_write_space(tmp);
7968 		/* We've reached the end. */
7969 		if (tmp == asoc)
7970 			break;
7971 	}
7972 }
7973 
7974 /* Do accounting for the sndbuf space.
7975  * Decrement the used sndbuf space of the corresponding association by the
7976  * data size which was just transmitted(freed).
7977  */
7978 static void sctp_wfree(struct sk_buff *skb)
7979 {
7980 	struct sctp_chunk *chunk = skb_shinfo(skb)->destructor_arg;
7981 	struct sctp_association *asoc = chunk->asoc;
7982 	struct sock *sk = asoc->base.sk;
7983 
7984 	asoc->sndbuf_used -= SCTP_DATA_SNDSIZE(chunk) +
7985 				sizeof(struct sk_buff) +
7986 				sizeof(struct sctp_chunk);
7987 
7988 	WARN_ON(refcount_sub_and_test(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc));
7989 
7990 	/*
7991 	 * This undoes what is done via sctp_set_owner_w and sk_mem_charge
7992 	 */
7993 	sk->sk_wmem_queued   -= skb->truesize;
7994 	sk_mem_uncharge(sk, skb->truesize);
7995 
7996 	sock_wfree(skb);
7997 	sctp_wake_up_waiters(sk, asoc);
7998 
7999 	sctp_association_put(asoc);
8000 }
8001 
8002 /* Do accounting for the receive space on the socket.
8003  * Accounting for the association is done in ulpevent.c
8004  * We set this as a destructor for the cloned data skbs so that
8005  * accounting is done at the correct time.
8006  */
8007 void sctp_sock_rfree(struct sk_buff *skb)
8008 {
8009 	struct sock *sk = skb->sk;
8010 	struct sctp_ulpevent *event = sctp_skb2event(skb);
8011 
8012 	atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
8013 
8014 	/*
8015 	 * Mimic the behavior of sock_rfree
8016 	 */
8017 	sk_mem_uncharge(sk, event->rmem_len);
8018 }
8019 
8020 
8021 /* Helper function to wait for space in the sndbuf.  */
8022 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
8023 				size_t msg_len)
8024 {
8025 	struct sock *sk = asoc->base.sk;
8026 	long current_timeo = *timeo_p;
8027 	DEFINE_WAIT(wait);
8028 	int err = 0;
8029 
8030 	pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
8031 		 *timeo_p, msg_len);
8032 
8033 	/* Increment the association's refcnt.  */
8034 	sctp_association_hold(asoc);
8035 
8036 	/* Wait on the association specific sndbuf space. */
8037 	for (;;) {
8038 		prepare_to_wait_exclusive(&asoc->wait, &wait,
8039 					  TASK_INTERRUPTIBLE);
8040 		if (asoc->base.dead)
8041 			goto do_dead;
8042 		if (!*timeo_p)
8043 			goto do_nonblock;
8044 		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING)
8045 			goto do_error;
8046 		if (signal_pending(current))
8047 			goto do_interrupted;
8048 		if (msg_len <= sctp_wspace(asoc))
8049 			break;
8050 
8051 		/* Let another process have a go.  Since we are going
8052 		 * to sleep anyway.
8053 		 */
8054 		release_sock(sk);
8055 		current_timeo = schedule_timeout(current_timeo);
8056 		lock_sock(sk);
8057 		if (sk != asoc->base.sk)
8058 			goto do_error;
8059 
8060 		*timeo_p = current_timeo;
8061 	}
8062 
8063 out:
8064 	finish_wait(&asoc->wait, &wait);
8065 
8066 	/* Release the association's refcnt.  */
8067 	sctp_association_put(asoc);
8068 
8069 	return err;
8070 
8071 do_dead:
8072 	err = -ESRCH;
8073 	goto out;
8074 
8075 do_error:
8076 	err = -EPIPE;
8077 	goto out;
8078 
8079 do_interrupted:
8080 	err = sock_intr_errno(*timeo_p);
8081 	goto out;
8082 
8083 do_nonblock:
8084 	err = -EAGAIN;
8085 	goto out;
8086 }
8087 
8088 void sctp_data_ready(struct sock *sk)
8089 {
8090 	struct socket_wq *wq;
8091 
8092 	rcu_read_lock();
8093 	wq = rcu_dereference(sk->sk_wq);
8094 	if (skwq_has_sleeper(wq))
8095 		wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
8096 						POLLRDNORM | POLLRDBAND);
8097 	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
8098 	rcu_read_unlock();
8099 }
8100 
8101 /* If socket sndbuf has changed, wake up all per association waiters.  */
8102 void sctp_write_space(struct sock *sk)
8103 {
8104 	struct sctp_association *asoc;
8105 
8106 	/* Wake up the tasks in each wait queue.  */
8107 	list_for_each_entry(asoc, &((sctp_sk(sk))->ep->asocs), asocs) {
8108 		__sctp_write_space(asoc);
8109 	}
8110 }
8111 
8112 /* Is there any sndbuf space available on the socket?
8113  *
8114  * Note that sk_wmem_alloc is the sum of the send buffers on all of the
8115  * associations on the same socket.  For a UDP-style socket with
8116  * multiple associations, it is possible for it to be "unwriteable"
8117  * prematurely.  I assume that this is acceptable because
8118  * a premature "unwriteable" is better than an accidental "writeable" which
8119  * would cause an unwanted block under certain circumstances.  For the 1-1
8120  * UDP-style sockets or TCP-style sockets, this code should work.
8121  *  - Daisy
8122  */
8123 static int sctp_writeable(struct sock *sk)
8124 {
8125 	int amt = 0;
8126 
8127 	amt = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
8128 	if (amt < 0)
8129 		amt = 0;
8130 	return amt;
8131 }
8132 
8133 /* Wait for an association to go into ESTABLISHED state. If timeout is 0,
8134  * returns immediately with EINPROGRESS.
8135  */
8136 static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
8137 {
8138 	struct sock *sk = asoc->base.sk;
8139 	int err = 0;
8140 	long current_timeo = *timeo_p;
8141 	DEFINE_WAIT(wait);
8142 
8143 	pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
8144 
8145 	/* Increment the association's refcnt.  */
8146 	sctp_association_hold(asoc);
8147 
8148 	for (;;) {
8149 		prepare_to_wait_exclusive(&asoc->wait, &wait,
8150 					  TASK_INTERRUPTIBLE);
8151 		if (!*timeo_p)
8152 			goto do_nonblock;
8153 		if (sk->sk_shutdown & RCV_SHUTDOWN)
8154 			break;
8155 		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
8156 		    asoc->base.dead)
8157 			goto do_error;
8158 		if (signal_pending(current))
8159 			goto do_interrupted;
8160 
8161 		if (sctp_state(asoc, ESTABLISHED))
8162 			break;
8163 
8164 		/* Let another process have a go.  Since we are going
8165 		 * to sleep anyway.
8166 		 */
8167 		release_sock(sk);
8168 		current_timeo = schedule_timeout(current_timeo);
8169 		lock_sock(sk);
8170 
8171 		*timeo_p = current_timeo;
8172 	}
8173 
8174 out:
8175 	finish_wait(&asoc->wait, &wait);
8176 
8177 	/* Release the association's refcnt.  */
8178 	sctp_association_put(asoc);
8179 
8180 	return err;
8181 
8182 do_error:
8183 	if (asoc->init_err_counter + 1 > asoc->max_init_attempts)
8184 		err = -ETIMEDOUT;
8185 	else
8186 		err = -ECONNREFUSED;
8187 	goto out;
8188 
8189 do_interrupted:
8190 	err = sock_intr_errno(*timeo_p);
8191 	goto out;
8192 
8193 do_nonblock:
8194 	err = -EINPROGRESS;
8195 	goto out;
8196 }
8197 
8198 static int sctp_wait_for_accept(struct sock *sk, long timeo)
8199 {
8200 	struct sctp_endpoint *ep;
8201 	int err = 0;
8202 	DEFINE_WAIT(wait);
8203 
8204 	ep = sctp_sk(sk)->ep;
8205 
8206 
8207 	for (;;) {
8208 		prepare_to_wait_exclusive(sk_sleep(sk), &wait,
8209 					  TASK_INTERRUPTIBLE);
8210 
8211 		if (list_empty(&ep->asocs)) {
8212 			release_sock(sk);
8213 			timeo = schedule_timeout(timeo);
8214 			lock_sock(sk);
8215 		}
8216 
8217 		err = -EINVAL;
8218 		if (!sctp_sstate(sk, LISTENING))
8219 			break;
8220 
8221 		err = 0;
8222 		if (!list_empty(&ep->asocs))
8223 			break;
8224 
8225 		err = sock_intr_errno(timeo);
8226 		if (signal_pending(current))
8227 			break;
8228 
8229 		err = -EAGAIN;
8230 		if (!timeo)
8231 			break;
8232 	}
8233 
8234 	finish_wait(sk_sleep(sk), &wait);
8235 
8236 	return err;
8237 }
8238 
8239 static void sctp_wait_for_close(struct sock *sk, long timeout)
8240 {
8241 	DEFINE_WAIT(wait);
8242 
8243 	do {
8244 		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
8245 		if (list_empty(&sctp_sk(sk)->ep->asocs))
8246 			break;
8247 		release_sock(sk);
8248 		timeout = schedule_timeout(timeout);
8249 		lock_sock(sk);
8250 	} while (!signal_pending(current) && timeout);
8251 
8252 	finish_wait(sk_sleep(sk), &wait);
8253 }
8254 
8255 static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
8256 {
8257 	struct sk_buff *frag;
8258 
8259 	if (!skb->data_len)
8260 		goto done;
8261 
8262 	/* Don't forget the fragments. */
8263 	skb_walk_frags(skb, frag)
8264 		sctp_skb_set_owner_r_frag(frag, sk);
8265 
8266 done:
8267 	sctp_skb_set_owner_r(skb, sk);
8268 }
8269 
8270 void sctp_copy_sock(struct sock *newsk, struct sock *sk,
8271 		    struct sctp_association *asoc)
8272 {
8273 	struct inet_sock *inet = inet_sk(sk);
8274 	struct inet_sock *newinet;
8275 
8276 	newsk->sk_type = sk->sk_type;
8277 	newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
8278 	newsk->sk_flags = sk->sk_flags;
8279 	newsk->sk_tsflags = sk->sk_tsflags;
8280 	newsk->sk_no_check_tx = sk->sk_no_check_tx;
8281 	newsk->sk_no_check_rx = sk->sk_no_check_rx;
8282 	newsk->sk_reuse = sk->sk_reuse;
8283 
8284 	newsk->sk_shutdown = sk->sk_shutdown;
8285 	newsk->sk_destruct = sctp_destruct_sock;
8286 	newsk->sk_family = sk->sk_family;
8287 	newsk->sk_protocol = IPPROTO_SCTP;
8288 	newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
8289 	newsk->sk_sndbuf = sk->sk_sndbuf;
8290 	newsk->sk_rcvbuf = sk->sk_rcvbuf;
8291 	newsk->sk_lingertime = sk->sk_lingertime;
8292 	newsk->sk_rcvtimeo = sk->sk_rcvtimeo;
8293 	newsk->sk_sndtimeo = sk->sk_sndtimeo;
8294 	newsk->sk_rxhash = sk->sk_rxhash;
8295 
8296 	newinet = inet_sk(newsk);
8297 
8298 	/* Initialize sk's sport, dport, rcv_saddr and daddr for
8299 	 * getsockname() and getpeername()
8300 	 */
8301 	newinet->inet_sport = inet->inet_sport;
8302 	newinet->inet_saddr = inet->inet_saddr;
8303 	newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
8304 	newinet->inet_dport = htons(asoc->peer.port);
8305 	newinet->pmtudisc = inet->pmtudisc;
8306 	newinet->inet_id = asoc->next_tsn ^ jiffies;
8307 
8308 	newinet->uc_ttl = inet->uc_ttl;
8309 	newinet->mc_loop = 1;
8310 	newinet->mc_ttl = 1;
8311 	newinet->mc_index = 0;
8312 	newinet->mc_list = NULL;
8313 
8314 	if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
8315 		net_enable_timestamp();
8316 
8317 	security_sk_clone(sk, newsk);
8318 }
8319 
8320 static inline void sctp_copy_descendant(struct sock *sk_to,
8321 					const struct sock *sk_from)
8322 {
8323 	int ancestor_size = sizeof(struct inet_sock) +
8324 			    sizeof(struct sctp_sock) -
8325 			    offsetof(struct sctp_sock, auto_asconf_list);
8326 
8327 	if (sk_from->sk_family == PF_INET6)
8328 		ancestor_size += sizeof(struct ipv6_pinfo);
8329 
8330 	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
8331 }
8332 
8333 /* Populate the fields of the newsk from the oldsk and migrate the assoc
8334  * and its messages to the newsk.
8335  */
8336 static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
8337 			      struct sctp_association *assoc,
8338 			      enum sctp_socket_type type)
8339 {
8340 	struct sctp_sock *oldsp = sctp_sk(oldsk);
8341 	struct sctp_sock *newsp = sctp_sk(newsk);
8342 	struct sctp_bind_bucket *pp; /* hash list port iterator */
8343 	struct sctp_endpoint *newep = newsp->ep;
8344 	struct sk_buff *skb, *tmp;
8345 	struct sctp_ulpevent *event;
8346 	struct sctp_bind_hashbucket *head;
8347 
8348 	/* Migrate socket buffer sizes and all the socket level options to the
8349 	 * new socket.
8350 	 */
8351 	newsk->sk_sndbuf = oldsk->sk_sndbuf;
8352 	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
8353 	/* Brute force copy old sctp opt. */
8354 	sctp_copy_descendant(newsk, oldsk);
8355 
8356 	/* Restore the ep value that was overwritten with the above structure
8357 	 * copy.
8358 	 */
8359 	newsp->ep = newep;
8360 	newsp->hmac = NULL;
8361 
8362 	/* Hook this new socket in to the bind_hash list. */
8363 	head = &sctp_port_hashtable[sctp_phashfn(sock_net(oldsk),
8364 						 inet_sk(oldsk)->inet_num)];
8365 	spin_lock_bh(&head->lock);
8366 	pp = sctp_sk(oldsk)->bind_hash;
8367 	sk_add_bind_node(newsk, &pp->owner);
8368 	sctp_sk(newsk)->bind_hash = pp;
8369 	inet_sk(newsk)->inet_num = inet_sk(oldsk)->inet_num;
8370 	spin_unlock_bh(&head->lock);
8371 
8372 	/* Copy the bind_addr list from the original endpoint to the new
8373 	 * endpoint so that we can handle restarts properly
8374 	 */
8375 	sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
8376 				&oldsp->ep->base.bind_addr, GFP_KERNEL);
8377 
8378 	/* Move any messages in the old socket's receive queue that are for the
8379 	 * peeled off association to the new socket's receive queue.
8380 	 */
8381 	sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
8382 		event = sctp_skb2event(skb);
8383 		if (event->asoc == assoc) {
8384 			__skb_unlink(skb, &oldsk->sk_receive_queue);
8385 			__skb_queue_tail(&newsk->sk_receive_queue, skb);
8386 			sctp_skb_set_owner_r_frag(skb, newsk);
8387 		}
8388 	}
8389 
8390 	/* Clean up any messages pending delivery due to partial
8391 	 * delivery.   Three cases:
8392 	 * 1) No partial deliver;  no work.
8393 	 * 2) Peeling off partial delivery; keep pd_lobby in new pd_lobby.
8394 	 * 3) Peeling off non-partial delivery; move pd_lobby to receive_queue.
8395 	 */
8396 	skb_queue_head_init(&newsp->pd_lobby);
8397 	atomic_set(&sctp_sk(newsk)->pd_mode, assoc->ulpq.pd_mode);
8398 
8399 	if (atomic_read(&sctp_sk(oldsk)->pd_mode)) {
8400 		struct sk_buff_head *queue;
8401 
8402 		/* Decide which queue to move pd_lobby skbs to. */
8403 		if (assoc->ulpq.pd_mode) {
8404 			queue = &newsp->pd_lobby;
8405 		} else
8406 			queue = &newsk->sk_receive_queue;
8407 
8408 		/* Walk through the pd_lobby, looking for skbs that
8409 		 * need moved to the new socket.
8410 		 */
8411 		sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
8412 			event = sctp_skb2event(skb);
8413 			if (event->asoc == assoc) {
8414 				__skb_unlink(skb, &oldsp->pd_lobby);
8415 				__skb_queue_tail(queue, skb);
8416 				sctp_skb_set_owner_r_frag(skb, newsk);
8417 			}
8418 		}
8419 
8420 		/* Clear up any skbs waiting for the partial
8421 		 * delivery to finish.
8422 		 */
8423 		if (assoc->ulpq.pd_mode)
8424 			sctp_clear_pd(oldsk, NULL);
8425 
8426 	}
8427 
8428 	sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
8429 		sctp_skb_set_owner_r_frag(skb, newsk);
8430 
8431 	sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
8432 		sctp_skb_set_owner_r_frag(skb, newsk);
8433 
8434 	/* Set the type of socket to indicate that it is peeled off from the
8435 	 * original UDP-style socket or created with the accept() call on a
8436 	 * TCP-style socket..
8437 	 */
8438 	newsp->type = type;
8439 
8440 	/* Mark the new socket "in-use" by the user so that any packets
8441 	 * that may arrive on the association after we've moved it are
8442 	 * queued to the backlog.  This prevents a potential race between
8443 	 * backlog processing on the old socket and new-packet processing
8444 	 * on the new socket.
8445 	 *
8446 	 * The caller has just allocated newsk so we can guarantee that other
8447 	 * paths won't try to lock it and then oldsk.
8448 	 */
8449 	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
8450 	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
8451 	sctp_assoc_migrate(assoc, newsk);
8452 	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
8453 
8454 	/* If the association on the newsk is already closed before accept()
8455 	 * is called, set RCV_SHUTDOWN flag.
8456 	 */
8457 	if (sctp_state(assoc, CLOSED) && sctp_style(newsk, TCP)) {
8458 		newsk->sk_state = SCTP_SS_CLOSED;
8459 		newsk->sk_shutdown |= RCV_SHUTDOWN;
8460 	} else {
8461 		newsk->sk_state = SCTP_SS_ESTABLISHED;
8462 	}
8463 
8464 	release_sock(newsk);
8465 }
8466 
8467 
8468 /* This proto struct describes the ULP interface for SCTP.  */
8469 struct proto sctp_prot = {
8470 	.name        =	"SCTP",
8471 	.owner       =	THIS_MODULE,
8472 	.close       =	sctp_close,
8473 	.connect     =	sctp_connect,
8474 	.disconnect  =	sctp_disconnect,
8475 	.accept      =	sctp_accept,
8476 	.ioctl       =	sctp_ioctl,
8477 	.init        =	sctp_init_sock,
8478 	.destroy     =	sctp_destroy_sock,
8479 	.shutdown    =	sctp_shutdown,
8480 	.setsockopt  =	sctp_setsockopt,
8481 	.getsockopt  =	sctp_getsockopt,
8482 	.sendmsg     =	sctp_sendmsg,
8483 	.recvmsg     =	sctp_recvmsg,
8484 	.bind        =	sctp_bind,
8485 	.backlog_rcv =	sctp_backlog_rcv,
8486 	.hash        =	sctp_hash,
8487 	.unhash      =	sctp_unhash,
8488 	.get_port    =	sctp_get_port,
8489 	.obj_size    =  sizeof(struct sctp_sock),
8490 	.sysctl_mem  =  sysctl_sctp_mem,
8491 	.sysctl_rmem =  sysctl_sctp_rmem,
8492 	.sysctl_wmem =  sysctl_sctp_wmem,
8493 	.memory_pressure = &sctp_memory_pressure,
8494 	.enter_memory_pressure = sctp_enter_memory_pressure,
8495 	.memory_allocated = &sctp_memory_allocated,
8496 	.sockets_allocated = &sctp_sockets_allocated,
8497 };
8498 
8499 #if IS_ENABLED(CONFIG_IPV6)
8500 
8501 #include <net/transp_v6.h>
8502 static void sctp_v6_destroy_sock(struct sock *sk)
8503 {
8504 	sctp_destroy_sock(sk);
8505 	inet6_destroy_sock(sk);
8506 }
8507 
8508 struct proto sctpv6_prot = {
8509 	.name		= "SCTPv6",
8510 	.owner		= THIS_MODULE,
8511 	.close		= sctp_close,
8512 	.connect	= sctp_connect,
8513 	.disconnect	= sctp_disconnect,
8514 	.accept		= sctp_accept,
8515 	.ioctl		= sctp_ioctl,
8516 	.init		= sctp_init_sock,
8517 	.destroy	= sctp_v6_destroy_sock,
8518 	.shutdown	= sctp_shutdown,
8519 	.setsockopt	= sctp_setsockopt,
8520 	.getsockopt	= sctp_getsockopt,
8521 	.sendmsg	= sctp_sendmsg,
8522 	.recvmsg	= sctp_recvmsg,
8523 	.bind		= sctp_bind,
8524 	.backlog_rcv	= sctp_backlog_rcv,
8525 	.hash		= sctp_hash,
8526 	.unhash		= sctp_unhash,
8527 	.get_port	= sctp_get_port,
8528 	.obj_size	= sizeof(struct sctp6_sock),
8529 	.sysctl_mem	= sysctl_sctp_mem,
8530 	.sysctl_rmem	= sysctl_sctp_rmem,
8531 	.sysctl_wmem	= sysctl_sctp_wmem,
8532 	.memory_pressure = &sctp_memory_pressure,
8533 	.enter_memory_pressure = sctp_enter_memory_pressure,
8534 	.memory_allocated = &sctp_memory_allocated,
8535 	.sockets_allocated = &sctp_sockets_allocated,
8536 };
8537 #endif /* IS_ENABLED(CONFIG_IPV6) */
8538