1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * NET An implementation of the SOCKET network access protocol. 4 * 5 * Version: @(#)socket.c 1.1.93 18/02/95 6 * 7 * Authors: Orest Zborowski, <obz@Kodak.COM> 8 * Ross Biro 9 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG> 10 * 11 * Fixes: 12 * Anonymous : NOTSOCK/BADF cleanup. Error fix in 13 * shutdown() 14 * Alan Cox : verify_area() fixes 15 * Alan Cox : Removed DDI 16 * Jonathan Kamens : SOCK_DGRAM reconnect bug 17 * Alan Cox : Moved a load of checks to the very 18 * top level. 19 * Alan Cox : Move address structures to/from user 20 * mode above the protocol layers. 21 * Rob Janssen : Allow 0 length sends. 22 * Alan Cox : Asynchronous I/O support (cribbed from the 23 * tty drivers). 24 * Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style) 25 * Jeff Uphoff : Made max number of sockets command-line 26 * configurable. 27 * Matti Aarnio : Made the number of sockets dynamic, 28 * to be allocated when needed, and mr. 29 * Uphoff's max is used as max to be 30 * allowed to allocate. 31 * Linus : Argh. removed all the socket allocation 32 * altogether: it's in the inode now. 33 * Alan Cox : Made sock_alloc()/sock_release() public 34 * for NetROM and future kernel nfsd type 35 * stuff. 36 * Alan Cox : sendmsg/recvmsg basics. 37 * Tom Dyas : Export net symbols. 38 * Marcin Dalecki : Fixed problems with CONFIG_NET="n". 39 * Alan Cox : Added thread locking to sys_* calls 40 * for sockets. May have errors at the 41 * moment. 42 * Kevin Buhr : Fixed the dumb errors in the above. 43 * Andi Kleen : Some small cleanups, optimizations, 44 * and fixed a copy_from_user() bug. 45 * Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0) 46 * Tigran Aivazian : Made listen(2) backlog sanity checks 47 * protocol-independent 48 * 49 * This module is effectively the top level interface to the BSD socket 50 * paradigm. 51 * 52 * Based upon Swansea University Computer Society NET3.039 53 */ 54 55 #include <linux/bpf-cgroup.h> 56 #include <linux/ethtool.h> 57 #include <linux/mm.h> 58 #include <linux/socket.h> 59 #include <linux/file.h> 60 #include <linux/net.h> 61 #include <linux/interrupt.h> 62 #include <linux/thread_info.h> 63 #include <linux/rcupdate.h> 64 #include <linux/netdevice.h> 65 #include <linux/proc_fs.h> 66 #include <linux/seq_file.h> 67 #include <linux/mutex.h> 68 #include <linux/if_bridge.h> 69 #include <linux/if_vlan.h> 70 #include <linux/ptp_classify.h> 71 #include <linux/init.h> 72 #include <linux/poll.h> 73 #include <linux/cache.h> 74 #include <linux/module.h> 75 #include <linux/highmem.h> 76 #include <linux/mount.h> 77 #include <linux/pseudo_fs.h> 78 #include <linux/security.h> 79 #include <linux/syscalls.h> 80 #include <linux/compat.h> 81 #include <linux/kmod.h> 82 #include <linux/audit.h> 83 #include <linux/wireless.h> 84 #include <linux/nsproxy.h> 85 #include <linux/magic.h> 86 #include <linux/slab.h> 87 #include <linux/xattr.h> 88 #include <linux/nospec.h> 89 #include <linux/indirect_call_wrapper.h> 90 91 #include <linux/uaccess.h> 92 #include <asm/unistd.h> 93 94 #include <net/compat.h> 95 #include <net/wext.h> 96 #include <net/cls_cgroup.h> 97 98 #include <net/sock.h> 99 #include <linux/netfilter.h> 100 101 #include <linux/if_tun.h> 102 #include <linux/ipv6_route.h> 103 #include <linux/route.h> 104 #include <linux/termios.h> 105 #include <linux/sockios.h> 106 #include <net/busy_poll.h> 107 #include <linux/errqueue.h> 108 #include <linux/ptp_clock_kernel.h> 109 #include <trace/events/sock.h> 110 111 #ifdef CONFIG_NET_RX_BUSY_POLL 112 unsigned int sysctl_net_busy_read __read_mostly; 113 unsigned int sysctl_net_busy_poll __read_mostly; 114 #endif 115 116 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to); 117 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from); 118 static int sock_mmap(struct file *file, struct vm_area_struct *vma); 119 120 static int sock_close(struct inode *inode, struct file *file); 121 static __poll_t sock_poll(struct file *file, 122 struct poll_table_struct *wait); 123 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg); 124 #ifdef CONFIG_COMPAT 125 static long compat_sock_ioctl(struct file *file, 126 unsigned int cmd, unsigned long arg); 127 #endif 128 static int sock_fasync(int fd, struct file *filp, int on); 129 static ssize_t sock_sendpage(struct file *file, struct page *page, 130 int offset, size_t size, loff_t *ppos, int more); 131 static ssize_t sock_splice_read(struct file *file, loff_t *ppos, 132 struct pipe_inode_info *pipe, size_t len, 133 unsigned int flags); 134 135 #ifdef CONFIG_PROC_FS 136 static void sock_show_fdinfo(struct seq_file *m, struct file *f) 137 { 138 struct socket *sock = f->private_data; 139 140 if (sock->ops->show_fdinfo) 141 sock->ops->show_fdinfo(m, sock); 142 } 143 #else 144 #define sock_show_fdinfo NULL 145 #endif 146 147 /* 148 * Socket files have a set of 'special' operations as well as the generic file ones. These don't appear 149 * in the operation structures but are done directly via the socketcall() multiplexor. 150 */ 151 152 static const struct file_operations socket_file_ops = { 153 .owner = THIS_MODULE, 154 .llseek = no_llseek, 155 .read_iter = sock_read_iter, 156 .write_iter = sock_write_iter, 157 .poll = sock_poll, 158 .unlocked_ioctl = sock_ioctl, 159 #ifdef CONFIG_COMPAT 160 .compat_ioctl = compat_sock_ioctl, 161 #endif 162 .mmap = sock_mmap, 163 .release = sock_close, 164 .fasync = sock_fasync, 165 .sendpage = sock_sendpage, 166 .splice_write = generic_splice_sendpage, 167 .splice_read = sock_splice_read, 168 .show_fdinfo = sock_show_fdinfo, 169 }; 170 171 static const char * const pf_family_names[] = { 172 [PF_UNSPEC] = "PF_UNSPEC", 173 [PF_UNIX] = "PF_UNIX/PF_LOCAL", 174 [PF_INET] = "PF_INET", 175 [PF_AX25] = "PF_AX25", 176 [PF_IPX] = "PF_IPX", 177 [PF_APPLETALK] = "PF_APPLETALK", 178 [PF_NETROM] = "PF_NETROM", 179 [PF_BRIDGE] = "PF_BRIDGE", 180 [PF_ATMPVC] = "PF_ATMPVC", 181 [PF_X25] = "PF_X25", 182 [PF_INET6] = "PF_INET6", 183 [PF_ROSE] = "PF_ROSE", 184 [PF_DECnet] = "PF_DECnet", 185 [PF_NETBEUI] = "PF_NETBEUI", 186 [PF_SECURITY] = "PF_SECURITY", 187 [PF_KEY] = "PF_KEY", 188 [PF_NETLINK] = "PF_NETLINK/PF_ROUTE", 189 [PF_PACKET] = "PF_PACKET", 190 [PF_ASH] = "PF_ASH", 191 [PF_ECONET] = "PF_ECONET", 192 [PF_ATMSVC] = "PF_ATMSVC", 193 [PF_RDS] = "PF_RDS", 194 [PF_SNA] = "PF_SNA", 195 [PF_IRDA] = "PF_IRDA", 196 [PF_PPPOX] = "PF_PPPOX", 197 [PF_WANPIPE] = "PF_WANPIPE", 198 [PF_LLC] = "PF_LLC", 199 [PF_IB] = "PF_IB", 200 [PF_MPLS] = "PF_MPLS", 201 [PF_CAN] = "PF_CAN", 202 [PF_TIPC] = "PF_TIPC", 203 [PF_BLUETOOTH] = "PF_BLUETOOTH", 204 [PF_IUCV] = "PF_IUCV", 205 [PF_RXRPC] = "PF_RXRPC", 206 [PF_ISDN] = "PF_ISDN", 207 [PF_PHONET] = "PF_PHONET", 208 [PF_IEEE802154] = "PF_IEEE802154", 209 [PF_CAIF] = "PF_CAIF", 210 [PF_ALG] = "PF_ALG", 211 [PF_NFC] = "PF_NFC", 212 [PF_VSOCK] = "PF_VSOCK", 213 [PF_KCM] = "PF_KCM", 214 [PF_QIPCRTR] = "PF_QIPCRTR", 215 [PF_SMC] = "PF_SMC", 216 [PF_XDP] = "PF_XDP", 217 [PF_MCTP] = "PF_MCTP", 218 }; 219 220 /* 221 * The protocol list. Each protocol is registered in here. 222 */ 223 224 static DEFINE_SPINLOCK(net_family_lock); 225 static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly; 226 227 /* 228 * Support routines. 229 * Move socket addresses back and forth across the kernel/user 230 * divide and look after the messy bits. 231 */ 232 233 /** 234 * move_addr_to_kernel - copy a socket address into kernel space 235 * @uaddr: Address in user space 236 * @kaddr: Address in kernel space 237 * @ulen: Length in user space 238 * 239 * The address is copied into kernel space. If the provided address is 240 * too long an error code of -EINVAL is returned. If the copy gives 241 * invalid addresses -EFAULT is returned. On a success 0 is returned. 242 */ 243 244 int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr) 245 { 246 if (ulen < 0 || ulen > sizeof(struct sockaddr_storage)) 247 return -EINVAL; 248 if (ulen == 0) 249 return 0; 250 if (copy_from_user(kaddr, uaddr, ulen)) 251 return -EFAULT; 252 return audit_sockaddr(ulen, kaddr); 253 } 254 255 /** 256 * move_addr_to_user - copy an address to user space 257 * @kaddr: kernel space address 258 * @klen: length of address in kernel 259 * @uaddr: user space address 260 * @ulen: pointer to user length field 261 * 262 * The value pointed to by ulen on entry is the buffer length available. 263 * This is overwritten with the buffer space used. -EINVAL is returned 264 * if an overlong buffer is specified or a negative buffer size. -EFAULT 265 * is returned if either the buffer or the length field are not 266 * accessible. 267 * After copying the data up to the limit the user specifies, the true 268 * length of the data is written over the length limit the user 269 * specified. Zero is returned for a success. 270 */ 271 272 static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen, 273 void __user *uaddr, int __user *ulen) 274 { 275 int err; 276 int len; 277 278 BUG_ON(klen > sizeof(struct sockaddr_storage)); 279 err = get_user(len, ulen); 280 if (err) 281 return err; 282 if (len > klen) 283 len = klen; 284 if (len < 0) 285 return -EINVAL; 286 if (len) { 287 if (audit_sockaddr(klen, kaddr)) 288 return -ENOMEM; 289 if (copy_to_user(uaddr, kaddr, len)) 290 return -EFAULT; 291 } 292 /* 293 * "fromlen shall refer to the value before truncation.." 294 * 1003.1g 295 */ 296 return __put_user(klen, ulen); 297 } 298 299 static struct kmem_cache *sock_inode_cachep __ro_after_init; 300 301 static struct inode *sock_alloc_inode(struct super_block *sb) 302 { 303 struct socket_alloc *ei; 304 305 ei = alloc_inode_sb(sb, sock_inode_cachep, GFP_KERNEL); 306 if (!ei) 307 return NULL; 308 init_waitqueue_head(&ei->socket.wq.wait); 309 ei->socket.wq.fasync_list = NULL; 310 ei->socket.wq.flags = 0; 311 312 ei->socket.state = SS_UNCONNECTED; 313 ei->socket.flags = 0; 314 ei->socket.ops = NULL; 315 ei->socket.sk = NULL; 316 ei->socket.file = NULL; 317 318 return &ei->vfs_inode; 319 } 320 321 static void sock_free_inode(struct inode *inode) 322 { 323 struct socket_alloc *ei; 324 325 ei = container_of(inode, struct socket_alloc, vfs_inode); 326 kmem_cache_free(sock_inode_cachep, ei); 327 } 328 329 static void init_once(void *foo) 330 { 331 struct socket_alloc *ei = (struct socket_alloc *)foo; 332 333 inode_init_once(&ei->vfs_inode); 334 } 335 336 static void init_inodecache(void) 337 { 338 sock_inode_cachep = kmem_cache_create("sock_inode_cache", 339 sizeof(struct socket_alloc), 340 0, 341 (SLAB_HWCACHE_ALIGN | 342 SLAB_RECLAIM_ACCOUNT | 343 SLAB_MEM_SPREAD | SLAB_ACCOUNT), 344 init_once); 345 BUG_ON(sock_inode_cachep == NULL); 346 } 347 348 static const struct super_operations sockfs_ops = { 349 .alloc_inode = sock_alloc_inode, 350 .free_inode = sock_free_inode, 351 .statfs = simple_statfs, 352 }; 353 354 /* 355 * sockfs_dname() is called from d_path(). 356 */ 357 static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen) 358 { 359 return dynamic_dname(buffer, buflen, "socket:[%lu]", 360 d_inode(dentry)->i_ino); 361 } 362 363 static const struct dentry_operations sockfs_dentry_operations = { 364 .d_dname = sockfs_dname, 365 }; 366 367 static int sockfs_xattr_get(const struct xattr_handler *handler, 368 struct dentry *dentry, struct inode *inode, 369 const char *suffix, void *value, size_t size) 370 { 371 if (value) { 372 if (dentry->d_name.len + 1 > size) 373 return -ERANGE; 374 memcpy(value, dentry->d_name.name, dentry->d_name.len + 1); 375 } 376 return dentry->d_name.len + 1; 377 } 378 379 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname" 380 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX) 381 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1) 382 383 static const struct xattr_handler sockfs_xattr_handler = { 384 .name = XATTR_NAME_SOCKPROTONAME, 385 .get = sockfs_xattr_get, 386 }; 387 388 static int sockfs_security_xattr_set(const struct xattr_handler *handler, 389 struct mnt_idmap *idmap, 390 struct dentry *dentry, struct inode *inode, 391 const char *suffix, const void *value, 392 size_t size, int flags) 393 { 394 /* Handled by LSM. */ 395 return -EAGAIN; 396 } 397 398 static const struct xattr_handler sockfs_security_xattr_handler = { 399 .prefix = XATTR_SECURITY_PREFIX, 400 .set = sockfs_security_xattr_set, 401 }; 402 403 static const struct xattr_handler *sockfs_xattr_handlers[] = { 404 &sockfs_xattr_handler, 405 &sockfs_security_xattr_handler, 406 NULL 407 }; 408 409 static int sockfs_init_fs_context(struct fs_context *fc) 410 { 411 struct pseudo_fs_context *ctx = init_pseudo(fc, SOCKFS_MAGIC); 412 if (!ctx) 413 return -ENOMEM; 414 ctx->ops = &sockfs_ops; 415 ctx->dops = &sockfs_dentry_operations; 416 ctx->xattr = sockfs_xattr_handlers; 417 return 0; 418 } 419 420 static struct vfsmount *sock_mnt __read_mostly; 421 422 static struct file_system_type sock_fs_type = { 423 .name = "sockfs", 424 .init_fs_context = sockfs_init_fs_context, 425 .kill_sb = kill_anon_super, 426 }; 427 428 /* 429 * Obtains the first available file descriptor and sets it up for use. 430 * 431 * These functions create file structures and maps them to fd space 432 * of the current process. On success it returns file descriptor 433 * and file struct implicitly stored in sock->file. 434 * Note that another thread may close file descriptor before we return 435 * from this function. We use the fact that now we do not refer 436 * to socket after mapping. If one day we will need it, this 437 * function will increment ref. count on file by 1. 438 * 439 * In any case returned fd MAY BE not valid! 440 * This race condition is unavoidable 441 * with shared fd spaces, we cannot solve it inside kernel, 442 * but we take care of internal coherence yet. 443 */ 444 445 /** 446 * sock_alloc_file - Bind a &socket to a &file 447 * @sock: socket 448 * @flags: file status flags 449 * @dname: protocol name 450 * 451 * Returns the &file bound with @sock, implicitly storing it 452 * in sock->file. If dname is %NULL, sets to "". 453 * On failure the return is a ERR pointer (see linux/err.h). 454 * This function uses GFP_KERNEL internally. 455 */ 456 457 struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname) 458 { 459 struct file *file; 460 461 if (!dname) 462 dname = sock->sk ? sock->sk->sk_prot_creator->name : ""; 463 464 file = alloc_file_pseudo(SOCK_INODE(sock), sock_mnt, dname, 465 O_RDWR | (flags & O_NONBLOCK), 466 &socket_file_ops); 467 if (IS_ERR(file)) { 468 sock_release(sock); 469 return file; 470 } 471 472 sock->file = file; 473 file->private_data = sock; 474 stream_open(SOCK_INODE(sock), file); 475 return file; 476 } 477 EXPORT_SYMBOL(sock_alloc_file); 478 479 static int sock_map_fd(struct socket *sock, int flags) 480 { 481 struct file *newfile; 482 int fd = get_unused_fd_flags(flags); 483 if (unlikely(fd < 0)) { 484 sock_release(sock); 485 return fd; 486 } 487 488 newfile = sock_alloc_file(sock, flags, NULL); 489 if (!IS_ERR(newfile)) { 490 fd_install(fd, newfile); 491 return fd; 492 } 493 494 put_unused_fd(fd); 495 return PTR_ERR(newfile); 496 } 497 498 /** 499 * sock_from_file - Return the &socket bounded to @file. 500 * @file: file 501 * 502 * On failure returns %NULL. 503 */ 504 505 struct socket *sock_from_file(struct file *file) 506 { 507 if (file->f_op == &socket_file_ops) 508 return file->private_data; /* set in sock_alloc_file */ 509 510 return NULL; 511 } 512 EXPORT_SYMBOL(sock_from_file); 513 514 /** 515 * sockfd_lookup - Go from a file number to its socket slot 516 * @fd: file handle 517 * @err: pointer to an error code return 518 * 519 * The file handle passed in is locked and the socket it is bound 520 * to is returned. If an error occurs the err pointer is overwritten 521 * with a negative errno code and NULL is returned. The function checks 522 * for both invalid handles and passing a handle which is not a socket. 523 * 524 * On a success the socket object pointer is returned. 525 */ 526 527 struct socket *sockfd_lookup(int fd, int *err) 528 { 529 struct file *file; 530 struct socket *sock; 531 532 file = fget(fd); 533 if (!file) { 534 *err = -EBADF; 535 return NULL; 536 } 537 538 sock = sock_from_file(file); 539 if (!sock) { 540 *err = -ENOTSOCK; 541 fput(file); 542 } 543 return sock; 544 } 545 EXPORT_SYMBOL(sockfd_lookup); 546 547 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed) 548 { 549 struct fd f = fdget(fd); 550 struct socket *sock; 551 552 *err = -EBADF; 553 if (f.file) { 554 sock = sock_from_file(f.file); 555 if (likely(sock)) { 556 *fput_needed = f.flags & FDPUT_FPUT; 557 return sock; 558 } 559 *err = -ENOTSOCK; 560 fdput(f); 561 } 562 return NULL; 563 } 564 565 static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer, 566 size_t size) 567 { 568 ssize_t len; 569 ssize_t used = 0; 570 571 len = security_inode_listsecurity(d_inode(dentry), buffer, size); 572 if (len < 0) 573 return len; 574 used += len; 575 if (buffer) { 576 if (size < used) 577 return -ERANGE; 578 buffer += len; 579 } 580 581 len = (XATTR_NAME_SOCKPROTONAME_LEN + 1); 582 used += len; 583 if (buffer) { 584 if (size < used) 585 return -ERANGE; 586 memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len); 587 buffer += len; 588 } 589 590 return used; 591 } 592 593 static int sockfs_setattr(struct mnt_idmap *idmap, 594 struct dentry *dentry, struct iattr *iattr) 595 { 596 int err = simple_setattr(&nop_mnt_idmap, dentry, iattr); 597 598 if (!err && (iattr->ia_valid & ATTR_UID)) { 599 struct socket *sock = SOCKET_I(d_inode(dentry)); 600 601 if (sock->sk) 602 sock->sk->sk_uid = iattr->ia_uid; 603 else 604 err = -ENOENT; 605 } 606 607 return err; 608 } 609 610 static const struct inode_operations sockfs_inode_ops = { 611 .listxattr = sockfs_listxattr, 612 .setattr = sockfs_setattr, 613 }; 614 615 /** 616 * sock_alloc - allocate a socket 617 * 618 * Allocate a new inode and socket object. The two are bound together 619 * and initialised. The socket is then returned. If we are out of inodes 620 * NULL is returned. This functions uses GFP_KERNEL internally. 621 */ 622 623 struct socket *sock_alloc(void) 624 { 625 struct inode *inode; 626 struct socket *sock; 627 628 inode = new_inode_pseudo(sock_mnt->mnt_sb); 629 if (!inode) 630 return NULL; 631 632 sock = SOCKET_I(inode); 633 634 inode->i_ino = get_next_ino(); 635 inode->i_mode = S_IFSOCK | S_IRWXUGO; 636 inode->i_uid = current_fsuid(); 637 inode->i_gid = current_fsgid(); 638 inode->i_op = &sockfs_inode_ops; 639 640 return sock; 641 } 642 EXPORT_SYMBOL(sock_alloc); 643 644 static void __sock_release(struct socket *sock, struct inode *inode) 645 { 646 if (sock->ops) { 647 struct module *owner = sock->ops->owner; 648 649 if (inode) 650 inode_lock(inode); 651 sock->ops->release(sock); 652 sock->sk = NULL; 653 if (inode) 654 inode_unlock(inode); 655 sock->ops = NULL; 656 module_put(owner); 657 } 658 659 if (sock->wq.fasync_list) 660 pr_err("%s: fasync list not empty!\n", __func__); 661 662 if (!sock->file) { 663 iput(SOCK_INODE(sock)); 664 return; 665 } 666 sock->file = NULL; 667 } 668 669 /** 670 * sock_release - close a socket 671 * @sock: socket to close 672 * 673 * The socket is released from the protocol stack if it has a release 674 * callback, and the inode is then released if the socket is bound to 675 * an inode not a file. 676 */ 677 void sock_release(struct socket *sock) 678 { 679 __sock_release(sock, NULL); 680 } 681 EXPORT_SYMBOL(sock_release); 682 683 void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags) 684 { 685 u8 flags = *tx_flags; 686 687 if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE) { 688 flags |= SKBTX_HW_TSTAMP; 689 690 /* PTP hardware clocks can provide a free running cycle counter 691 * as a time base for virtual clocks. Tell driver to use the 692 * free running cycle counter for timestamp if socket is bound 693 * to virtual clock. 694 */ 695 if (tsflags & SOF_TIMESTAMPING_BIND_PHC) 696 flags |= SKBTX_HW_TSTAMP_USE_CYCLES; 697 } 698 699 if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE) 700 flags |= SKBTX_SW_TSTAMP; 701 702 if (tsflags & SOF_TIMESTAMPING_TX_SCHED) 703 flags |= SKBTX_SCHED_TSTAMP; 704 705 *tx_flags = flags; 706 } 707 EXPORT_SYMBOL(__sock_tx_timestamp); 708 709 INDIRECT_CALLABLE_DECLARE(int inet_sendmsg(struct socket *, struct msghdr *, 710 size_t)); 711 INDIRECT_CALLABLE_DECLARE(int inet6_sendmsg(struct socket *, struct msghdr *, 712 size_t)); 713 714 static noinline void call_trace_sock_send_length(struct sock *sk, int ret, 715 int flags) 716 { 717 trace_sock_send_length(sk, ret, 0); 718 } 719 720 static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg) 721 { 722 int ret = INDIRECT_CALL_INET(sock->ops->sendmsg, inet6_sendmsg, 723 inet_sendmsg, sock, msg, 724 msg_data_left(msg)); 725 BUG_ON(ret == -EIOCBQUEUED); 726 727 if (trace_sock_send_length_enabled()) 728 call_trace_sock_send_length(sock->sk, ret, 0); 729 return ret; 730 } 731 732 /** 733 * sock_sendmsg - send a message through @sock 734 * @sock: socket 735 * @msg: message to send 736 * 737 * Sends @msg through @sock, passing through LSM. 738 * Returns the number of bytes sent, or an error code. 739 */ 740 int sock_sendmsg(struct socket *sock, struct msghdr *msg) 741 { 742 int err = security_socket_sendmsg(sock, msg, 743 msg_data_left(msg)); 744 745 return err ?: sock_sendmsg_nosec(sock, msg); 746 } 747 EXPORT_SYMBOL(sock_sendmsg); 748 749 /** 750 * kernel_sendmsg - send a message through @sock (kernel-space) 751 * @sock: socket 752 * @msg: message header 753 * @vec: kernel vec 754 * @num: vec array length 755 * @size: total message data size 756 * 757 * Builds the message data with @vec and sends it through @sock. 758 * Returns the number of bytes sent, or an error code. 759 */ 760 761 int kernel_sendmsg(struct socket *sock, struct msghdr *msg, 762 struct kvec *vec, size_t num, size_t size) 763 { 764 iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size); 765 return sock_sendmsg(sock, msg); 766 } 767 EXPORT_SYMBOL(kernel_sendmsg); 768 769 /** 770 * kernel_sendmsg_locked - send a message through @sock (kernel-space) 771 * @sk: sock 772 * @msg: message header 773 * @vec: output s/g array 774 * @num: output s/g array length 775 * @size: total message data size 776 * 777 * Builds the message data with @vec and sends it through @sock. 778 * Returns the number of bytes sent, or an error code. 779 * Caller must hold @sk. 780 */ 781 782 int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg, 783 struct kvec *vec, size_t num, size_t size) 784 { 785 struct socket *sock = sk->sk_socket; 786 787 if (!sock->ops->sendmsg_locked) 788 return sock_no_sendmsg_locked(sk, msg, size); 789 790 iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size); 791 792 return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg)); 793 } 794 EXPORT_SYMBOL(kernel_sendmsg_locked); 795 796 static bool skb_is_err_queue(const struct sk_buff *skb) 797 { 798 /* pkt_type of skbs enqueued on the error queue are set to 799 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do 800 * in recvmsg, since skbs received on a local socket will never 801 * have a pkt_type of PACKET_OUTGOING. 802 */ 803 return skb->pkt_type == PACKET_OUTGOING; 804 } 805 806 /* On transmit, software and hardware timestamps are returned independently. 807 * As the two skb clones share the hardware timestamp, which may be updated 808 * before the software timestamp is received, a hardware TX timestamp may be 809 * returned only if there is no software TX timestamp. Ignore false software 810 * timestamps, which may be made in the __sock_recv_timestamp() call when the 811 * option SO_TIMESTAMP_OLD(NS) is enabled on the socket, even when the skb has a 812 * hardware timestamp. 813 */ 814 static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp) 815 { 816 return skb->tstamp && !false_tstamp && skb_is_err_queue(skb); 817 } 818 819 static ktime_t get_timestamp(struct sock *sk, struct sk_buff *skb, int *if_index) 820 { 821 bool cycles = sk->sk_tsflags & SOF_TIMESTAMPING_BIND_PHC; 822 struct skb_shared_hwtstamps *shhwtstamps = skb_hwtstamps(skb); 823 struct net_device *orig_dev; 824 ktime_t hwtstamp; 825 826 rcu_read_lock(); 827 orig_dev = dev_get_by_napi_id(skb_napi_id(skb)); 828 if (orig_dev) { 829 *if_index = orig_dev->ifindex; 830 hwtstamp = netdev_get_tstamp(orig_dev, shhwtstamps, cycles); 831 } else { 832 hwtstamp = shhwtstamps->hwtstamp; 833 } 834 rcu_read_unlock(); 835 836 return hwtstamp; 837 } 838 839 static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb, 840 int if_index) 841 { 842 struct scm_ts_pktinfo ts_pktinfo; 843 struct net_device *orig_dev; 844 845 if (!skb_mac_header_was_set(skb)) 846 return; 847 848 memset(&ts_pktinfo, 0, sizeof(ts_pktinfo)); 849 850 if (!if_index) { 851 rcu_read_lock(); 852 orig_dev = dev_get_by_napi_id(skb_napi_id(skb)); 853 if (orig_dev) 854 if_index = orig_dev->ifindex; 855 rcu_read_unlock(); 856 } 857 ts_pktinfo.if_index = if_index; 858 859 ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb); 860 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO, 861 sizeof(ts_pktinfo), &ts_pktinfo); 862 } 863 864 /* 865 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP) 866 */ 867 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, 868 struct sk_buff *skb) 869 { 870 int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP); 871 int new_tstamp = sock_flag(sk, SOCK_TSTAMP_NEW); 872 struct scm_timestamping_internal tss; 873 874 int empty = 1, false_tstamp = 0; 875 struct skb_shared_hwtstamps *shhwtstamps = 876 skb_hwtstamps(skb); 877 int if_index; 878 ktime_t hwtstamp; 879 880 /* Race occurred between timestamp enabling and packet 881 receiving. Fill in the current time for now. */ 882 if (need_software_tstamp && skb->tstamp == 0) { 883 __net_timestamp(skb); 884 false_tstamp = 1; 885 } 886 887 if (need_software_tstamp) { 888 if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) { 889 if (new_tstamp) { 890 struct __kernel_sock_timeval tv; 891 892 skb_get_new_timestamp(skb, &tv); 893 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_NEW, 894 sizeof(tv), &tv); 895 } else { 896 struct __kernel_old_timeval tv; 897 898 skb_get_timestamp(skb, &tv); 899 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_OLD, 900 sizeof(tv), &tv); 901 } 902 } else { 903 if (new_tstamp) { 904 struct __kernel_timespec ts; 905 906 skb_get_new_timestampns(skb, &ts); 907 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_NEW, 908 sizeof(ts), &ts); 909 } else { 910 struct __kernel_old_timespec ts; 911 912 skb_get_timestampns(skb, &ts); 913 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_OLD, 914 sizeof(ts), &ts); 915 } 916 } 917 } 918 919 memset(&tss, 0, sizeof(tss)); 920 if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) && 921 ktime_to_timespec64_cond(skb->tstamp, tss.ts + 0)) 922 empty = 0; 923 if (shhwtstamps && 924 (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) && 925 !skb_is_swtx_tstamp(skb, false_tstamp)) { 926 if_index = 0; 927 if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP_NETDEV) 928 hwtstamp = get_timestamp(sk, skb, &if_index); 929 else 930 hwtstamp = shhwtstamps->hwtstamp; 931 932 if (sk->sk_tsflags & SOF_TIMESTAMPING_BIND_PHC) 933 hwtstamp = ptp_convert_timestamp(&hwtstamp, 934 sk->sk_bind_phc); 935 936 if (ktime_to_timespec64_cond(hwtstamp, tss.ts + 2)) { 937 empty = 0; 938 939 if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) && 940 !skb_is_err_queue(skb)) 941 put_ts_pktinfo(msg, skb, if_index); 942 } 943 } 944 if (!empty) { 945 if (sock_flag(sk, SOCK_TSTAMP_NEW)) 946 put_cmsg_scm_timestamping64(msg, &tss); 947 else 948 put_cmsg_scm_timestamping(msg, &tss); 949 950 if (skb_is_err_queue(skb) && skb->len && 951 SKB_EXT_ERR(skb)->opt_stats) 952 put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS, 953 skb->len, skb->data); 954 } 955 } 956 EXPORT_SYMBOL_GPL(__sock_recv_timestamp); 957 958 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk, 959 struct sk_buff *skb) 960 { 961 int ack; 962 963 if (!sock_flag(sk, SOCK_WIFI_STATUS)) 964 return; 965 if (!skb->wifi_acked_valid) 966 return; 967 968 ack = skb->wifi_acked; 969 970 put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack); 971 } 972 EXPORT_SYMBOL_GPL(__sock_recv_wifi_status); 973 974 static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk, 975 struct sk_buff *skb) 976 { 977 if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount) 978 put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL, 979 sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount); 980 } 981 982 static void sock_recv_mark(struct msghdr *msg, struct sock *sk, 983 struct sk_buff *skb) 984 { 985 if (sock_flag(sk, SOCK_RCVMARK) && skb) { 986 /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */ 987 __u32 mark = skb->mark; 988 989 put_cmsg(msg, SOL_SOCKET, SO_MARK, sizeof(__u32), &mark); 990 } 991 } 992 993 void __sock_recv_cmsgs(struct msghdr *msg, struct sock *sk, 994 struct sk_buff *skb) 995 { 996 sock_recv_timestamp(msg, sk, skb); 997 sock_recv_drops(msg, sk, skb); 998 sock_recv_mark(msg, sk, skb); 999 } 1000 EXPORT_SYMBOL_GPL(__sock_recv_cmsgs); 1001 1002 INDIRECT_CALLABLE_DECLARE(int inet_recvmsg(struct socket *, struct msghdr *, 1003 size_t, int)); 1004 INDIRECT_CALLABLE_DECLARE(int inet6_recvmsg(struct socket *, struct msghdr *, 1005 size_t, int)); 1006 1007 static noinline void call_trace_sock_recv_length(struct sock *sk, int ret, int flags) 1008 { 1009 trace_sock_recv_length(sk, ret, flags); 1010 } 1011 1012 static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg, 1013 int flags) 1014 { 1015 int ret = INDIRECT_CALL_INET(sock->ops->recvmsg, inet6_recvmsg, 1016 inet_recvmsg, sock, msg, 1017 msg_data_left(msg), flags); 1018 if (trace_sock_recv_length_enabled()) 1019 call_trace_sock_recv_length(sock->sk, ret, flags); 1020 return ret; 1021 } 1022 1023 /** 1024 * sock_recvmsg - receive a message from @sock 1025 * @sock: socket 1026 * @msg: message to receive 1027 * @flags: message flags 1028 * 1029 * Receives @msg from @sock, passing through LSM. Returns the total number 1030 * of bytes received, or an error. 1031 */ 1032 int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags) 1033 { 1034 int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags); 1035 1036 return err ?: sock_recvmsg_nosec(sock, msg, flags); 1037 } 1038 EXPORT_SYMBOL(sock_recvmsg); 1039 1040 /** 1041 * kernel_recvmsg - Receive a message from a socket (kernel space) 1042 * @sock: The socket to receive the message from 1043 * @msg: Received message 1044 * @vec: Input s/g array for message data 1045 * @num: Size of input s/g array 1046 * @size: Number of bytes to read 1047 * @flags: Message flags (MSG_DONTWAIT, etc...) 1048 * 1049 * On return the msg structure contains the scatter/gather array passed in the 1050 * vec argument. The array is modified so that it consists of the unfilled 1051 * portion of the original array. 1052 * 1053 * The returned value is the total number of bytes received, or an error. 1054 */ 1055 1056 int kernel_recvmsg(struct socket *sock, struct msghdr *msg, 1057 struct kvec *vec, size_t num, size_t size, int flags) 1058 { 1059 msg->msg_control_is_user = false; 1060 iov_iter_kvec(&msg->msg_iter, ITER_DEST, vec, num, size); 1061 return sock_recvmsg(sock, msg, flags); 1062 } 1063 EXPORT_SYMBOL(kernel_recvmsg); 1064 1065 static ssize_t sock_sendpage(struct file *file, struct page *page, 1066 int offset, size_t size, loff_t *ppos, int more) 1067 { 1068 struct socket *sock; 1069 int flags; 1070 int ret; 1071 1072 sock = file->private_data; 1073 1074 flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0; 1075 /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */ 1076 flags |= more; 1077 1078 ret = kernel_sendpage(sock, page, offset, size, flags); 1079 1080 if (trace_sock_send_length_enabled()) 1081 call_trace_sock_send_length(sock->sk, ret, 0); 1082 return ret; 1083 } 1084 1085 static ssize_t sock_splice_read(struct file *file, loff_t *ppos, 1086 struct pipe_inode_info *pipe, size_t len, 1087 unsigned int flags) 1088 { 1089 struct socket *sock = file->private_data; 1090 1091 if (unlikely(!sock->ops->splice_read)) 1092 return generic_file_splice_read(file, ppos, pipe, len, flags); 1093 1094 return sock->ops->splice_read(sock, ppos, pipe, len, flags); 1095 } 1096 1097 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to) 1098 { 1099 struct file *file = iocb->ki_filp; 1100 struct socket *sock = file->private_data; 1101 struct msghdr msg = {.msg_iter = *to, 1102 .msg_iocb = iocb}; 1103 ssize_t res; 1104 1105 if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) 1106 msg.msg_flags = MSG_DONTWAIT; 1107 1108 if (iocb->ki_pos != 0) 1109 return -ESPIPE; 1110 1111 if (!iov_iter_count(to)) /* Match SYS5 behaviour */ 1112 return 0; 1113 1114 res = sock_recvmsg(sock, &msg, msg.msg_flags); 1115 *to = msg.msg_iter; 1116 return res; 1117 } 1118 1119 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) 1120 { 1121 struct file *file = iocb->ki_filp; 1122 struct socket *sock = file->private_data; 1123 struct msghdr msg = {.msg_iter = *from, 1124 .msg_iocb = iocb}; 1125 ssize_t res; 1126 1127 if (iocb->ki_pos != 0) 1128 return -ESPIPE; 1129 1130 if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) 1131 msg.msg_flags = MSG_DONTWAIT; 1132 1133 if (sock->type == SOCK_SEQPACKET) 1134 msg.msg_flags |= MSG_EOR; 1135 1136 res = sock_sendmsg(sock, &msg); 1137 *from = msg.msg_iter; 1138 return res; 1139 } 1140 1141 /* 1142 * Atomic setting of ioctl hooks to avoid race 1143 * with module unload. 1144 */ 1145 1146 static DEFINE_MUTEX(br_ioctl_mutex); 1147 static int (*br_ioctl_hook)(struct net *net, struct net_bridge *br, 1148 unsigned int cmd, struct ifreq *ifr, 1149 void __user *uarg); 1150 1151 void brioctl_set(int (*hook)(struct net *net, struct net_bridge *br, 1152 unsigned int cmd, struct ifreq *ifr, 1153 void __user *uarg)) 1154 { 1155 mutex_lock(&br_ioctl_mutex); 1156 br_ioctl_hook = hook; 1157 mutex_unlock(&br_ioctl_mutex); 1158 } 1159 EXPORT_SYMBOL(brioctl_set); 1160 1161 int br_ioctl_call(struct net *net, struct net_bridge *br, unsigned int cmd, 1162 struct ifreq *ifr, void __user *uarg) 1163 { 1164 int err = -ENOPKG; 1165 1166 if (!br_ioctl_hook) 1167 request_module("bridge"); 1168 1169 mutex_lock(&br_ioctl_mutex); 1170 if (br_ioctl_hook) 1171 err = br_ioctl_hook(net, br, cmd, ifr, uarg); 1172 mutex_unlock(&br_ioctl_mutex); 1173 1174 return err; 1175 } 1176 1177 static DEFINE_MUTEX(vlan_ioctl_mutex); 1178 static int (*vlan_ioctl_hook) (struct net *, void __user *arg); 1179 1180 void vlan_ioctl_set(int (*hook) (struct net *, void __user *)) 1181 { 1182 mutex_lock(&vlan_ioctl_mutex); 1183 vlan_ioctl_hook = hook; 1184 mutex_unlock(&vlan_ioctl_mutex); 1185 } 1186 EXPORT_SYMBOL(vlan_ioctl_set); 1187 1188 static long sock_do_ioctl(struct net *net, struct socket *sock, 1189 unsigned int cmd, unsigned long arg) 1190 { 1191 struct ifreq ifr; 1192 bool need_copyout; 1193 int err; 1194 void __user *argp = (void __user *)arg; 1195 void __user *data; 1196 1197 err = sock->ops->ioctl(sock, cmd, arg); 1198 1199 /* 1200 * If this ioctl is unknown try to hand it down 1201 * to the NIC driver. 1202 */ 1203 if (err != -ENOIOCTLCMD) 1204 return err; 1205 1206 if (!is_socket_ioctl_cmd(cmd)) 1207 return -ENOTTY; 1208 1209 if (get_user_ifreq(&ifr, &data, argp)) 1210 return -EFAULT; 1211 err = dev_ioctl(net, cmd, &ifr, data, &need_copyout); 1212 if (!err && need_copyout) 1213 if (put_user_ifreq(&ifr, argp)) 1214 return -EFAULT; 1215 1216 return err; 1217 } 1218 1219 /* 1220 * With an ioctl, arg may well be a user mode pointer, but we don't know 1221 * what to do with it - that's up to the protocol still. 1222 */ 1223 1224 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg) 1225 { 1226 struct socket *sock; 1227 struct sock *sk; 1228 void __user *argp = (void __user *)arg; 1229 int pid, err; 1230 struct net *net; 1231 1232 sock = file->private_data; 1233 sk = sock->sk; 1234 net = sock_net(sk); 1235 if (unlikely(cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))) { 1236 struct ifreq ifr; 1237 void __user *data; 1238 bool need_copyout; 1239 if (get_user_ifreq(&ifr, &data, argp)) 1240 return -EFAULT; 1241 err = dev_ioctl(net, cmd, &ifr, data, &need_copyout); 1242 if (!err && need_copyout) 1243 if (put_user_ifreq(&ifr, argp)) 1244 return -EFAULT; 1245 } else 1246 #ifdef CONFIG_WEXT_CORE 1247 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) { 1248 err = wext_handle_ioctl(net, cmd, argp); 1249 } else 1250 #endif 1251 switch (cmd) { 1252 case FIOSETOWN: 1253 case SIOCSPGRP: 1254 err = -EFAULT; 1255 if (get_user(pid, (int __user *)argp)) 1256 break; 1257 err = f_setown(sock->file, pid, 1); 1258 break; 1259 case FIOGETOWN: 1260 case SIOCGPGRP: 1261 err = put_user(f_getown(sock->file), 1262 (int __user *)argp); 1263 break; 1264 case SIOCGIFBR: 1265 case SIOCSIFBR: 1266 case SIOCBRADDBR: 1267 case SIOCBRDELBR: 1268 err = br_ioctl_call(net, NULL, cmd, NULL, argp); 1269 break; 1270 case SIOCGIFVLAN: 1271 case SIOCSIFVLAN: 1272 err = -ENOPKG; 1273 if (!vlan_ioctl_hook) 1274 request_module("8021q"); 1275 1276 mutex_lock(&vlan_ioctl_mutex); 1277 if (vlan_ioctl_hook) 1278 err = vlan_ioctl_hook(net, argp); 1279 mutex_unlock(&vlan_ioctl_mutex); 1280 break; 1281 case SIOCGSKNS: 1282 err = -EPERM; 1283 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 1284 break; 1285 1286 err = open_related_ns(&net->ns, get_net_ns); 1287 break; 1288 case SIOCGSTAMP_OLD: 1289 case SIOCGSTAMPNS_OLD: 1290 if (!sock->ops->gettstamp) { 1291 err = -ENOIOCTLCMD; 1292 break; 1293 } 1294 err = sock->ops->gettstamp(sock, argp, 1295 cmd == SIOCGSTAMP_OLD, 1296 !IS_ENABLED(CONFIG_64BIT)); 1297 break; 1298 case SIOCGSTAMP_NEW: 1299 case SIOCGSTAMPNS_NEW: 1300 if (!sock->ops->gettstamp) { 1301 err = -ENOIOCTLCMD; 1302 break; 1303 } 1304 err = sock->ops->gettstamp(sock, argp, 1305 cmd == SIOCGSTAMP_NEW, 1306 false); 1307 break; 1308 1309 case SIOCGIFCONF: 1310 err = dev_ifconf(net, argp); 1311 break; 1312 1313 default: 1314 err = sock_do_ioctl(net, sock, cmd, arg); 1315 break; 1316 } 1317 return err; 1318 } 1319 1320 /** 1321 * sock_create_lite - creates a socket 1322 * @family: protocol family (AF_INET, ...) 1323 * @type: communication type (SOCK_STREAM, ...) 1324 * @protocol: protocol (0, ...) 1325 * @res: new socket 1326 * 1327 * Creates a new socket and assigns it to @res, passing through LSM. 1328 * The new socket initialization is not complete, see kernel_accept(). 1329 * Returns 0 or an error. On failure @res is set to %NULL. 1330 * This function internally uses GFP_KERNEL. 1331 */ 1332 1333 int sock_create_lite(int family, int type, int protocol, struct socket **res) 1334 { 1335 int err; 1336 struct socket *sock = NULL; 1337 1338 err = security_socket_create(family, type, protocol, 1); 1339 if (err) 1340 goto out; 1341 1342 sock = sock_alloc(); 1343 if (!sock) { 1344 err = -ENOMEM; 1345 goto out; 1346 } 1347 1348 sock->type = type; 1349 err = security_socket_post_create(sock, family, type, protocol, 1); 1350 if (err) 1351 goto out_release; 1352 1353 out: 1354 *res = sock; 1355 return err; 1356 out_release: 1357 sock_release(sock); 1358 sock = NULL; 1359 goto out; 1360 } 1361 EXPORT_SYMBOL(sock_create_lite); 1362 1363 /* No kernel lock held - perfect */ 1364 static __poll_t sock_poll(struct file *file, poll_table *wait) 1365 { 1366 struct socket *sock = file->private_data; 1367 __poll_t events = poll_requested_events(wait), flag = 0; 1368 1369 if (!sock->ops->poll) 1370 return 0; 1371 1372 if (sk_can_busy_loop(sock->sk)) { 1373 /* poll once if requested by the syscall */ 1374 if (events & POLL_BUSY_LOOP) 1375 sk_busy_loop(sock->sk, 1); 1376 1377 /* if this socket can poll_ll, tell the system call */ 1378 flag = POLL_BUSY_LOOP; 1379 } 1380 1381 return sock->ops->poll(file, sock, wait) | flag; 1382 } 1383 1384 static int sock_mmap(struct file *file, struct vm_area_struct *vma) 1385 { 1386 struct socket *sock = file->private_data; 1387 1388 return sock->ops->mmap(file, sock, vma); 1389 } 1390 1391 static int sock_close(struct inode *inode, struct file *filp) 1392 { 1393 __sock_release(SOCKET_I(inode), inode); 1394 return 0; 1395 } 1396 1397 /* 1398 * Update the socket async list 1399 * 1400 * Fasync_list locking strategy. 1401 * 1402 * 1. fasync_list is modified only under process context socket lock 1403 * i.e. under semaphore. 1404 * 2. fasync_list is used under read_lock(&sk->sk_callback_lock) 1405 * or under socket lock 1406 */ 1407 1408 static int sock_fasync(int fd, struct file *filp, int on) 1409 { 1410 struct socket *sock = filp->private_data; 1411 struct sock *sk = sock->sk; 1412 struct socket_wq *wq = &sock->wq; 1413 1414 if (sk == NULL) 1415 return -EINVAL; 1416 1417 lock_sock(sk); 1418 fasync_helper(fd, filp, on, &wq->fasync_list); 1419 1420 if (!wq->fasync_list) 1421 sock_reset_flag(sk, SOCK_FASYNC); 1422 else 1423 sock_set_flag(sk, SOCK_FASYNC); 1424 1425 release_sock(sk); 1426 return 0; 1427 } 1428 1429 /* This function may be called only under rcu_lock */ 1430 1431 int sock_wake_async(struct socket_wq *wq, int how, int band) 1432 { 1433 if (!wq || !wq->fasync_list) 1434 return -1; 1435 1436 switch (how) { 1437 case SOCK_WAKE_WAITD: 1438 if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags)) 1439 break; 1440 goto call_kill; 1441 case SOCK_WAKE_SPACE: 1442 if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags)) 1443 break; 1444 fallthrough; 1445 case SOCK_WAKE_IO: 1446 call_kill: 1447 kill_fasync(&wq->fasync_list, SIGIO, band); 1448 break; 1449 case SOCK_WAKE_URG: 1450 kill_fasync(&wq->fasync_list, SIGURG, band); 1451 } 1452 1453 return 0; 1454 } 1455 EXPORT_SYMBOL(sock_wake_async); 1456 1457 /** 1458 * __sock_create - creates a socket 1459 * @net: net namespace 1460 * @family: protocol family (AF_INET, ...) 1461 * @type: communication type (SOCK_STREAM, ...) 1462 * @protocol: protocol (0, ...) 1463 * @res: new socket 1464 * @kern: boolean for kernel space sockets 1465 * 1466 * Creates a new socket and assigns it to @res, passing through LSM. 1467 * Returns 0 or an error. On failure @res is set to %NULL. @kern must 1468 * be set to true if the socket resides in kernel space. 1469 * This function internally uses GFP_KERNEL. 1470 */ 1471 1472 int __sock_create(struct net *net, int family, int type, int protocol, 1473 struct socket **res, int kern) 1474 { 1475 int err; 1476 struct socket *sock; 1477 const struct net_proto_family *pf; 1478 1479 /* 1480 * Check protocol is in range 1481 */ 1482 if (family < 0 || family >= NPROTO) 1483 return -EAFNOSUPPORT; 1484 if (type < 0 || type >= SOCK_MAX) 1485 return -EINVAL; 1486 1487 /* Compatibility. 1488 1489 This uglymoron is moved from INET layer to here to avoid 1490 deadlock in module load. 1491 */ 1492 if (family == PF_INET && type == SOCK_PACKET) { 1493 pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n", 1494 current->comm); 1495 family = PF_PACKET; 1496 } 1497 1498 err = security_socket_create(family, type, protocol, kern); 1499 if (err) 1500 return err; 1501 1502 /* 1503 * Allocate the socket and allow the family to set things up. if 1504 * the protocol is 0, the family is instructed to select an appropriate 1505 * default. 1506 */ 1507 sock = sock_alloc(); 1508 if (!sock) { 1509 net_warn_ratelimited("socket: no more sockets\n"); 1510 return -ENFILE; /* Not exactly a match, but its the 1511 closest posix thing */ 1512 } 1513 1514 sock->type = type; 1515 1516 #ifdef CONFIG_MODULES 1517 /* Attempt to load a protocol module if the find failed. 1518 * 1519 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user 1520 * requested real, full-featured networking support upon configuration. 1521 * Otherwise module support will break! 1522 */ 1523 if (rcu_access_pointer(net_families[family]) == NULL) 1524 request_module("net-pf-%d", family); 1525 #endif 1526 1527 rcu_read_lock(); 1528 pf = rcu_dereference(net_families[family]); 1529 err = -EAFNOSUPPORT; 1530 if (!pf) 1531 goto out_release; 1532 1533 /* 1534 * We will call the ->create function, that possibly is in a loadable 1535 * module, so we have to bump that loadable module refcnt first. 1536 */ 1537 if (!try_module_get(pf->owner)) 1538 goto out_release; 1539 1540 /* Now protected by module ref count */ 1541 rcu_read_unlock(); 1542 1543 err = pf->create(net, sock, protocol, kern); 1544 if (err < 0) 1545 goto out_module_put; 1546 1547 /* 1548 * Now to bump the refcnt of the [loadable] module that owns this 1549 * socket at sock_release time we decrement its refcnt. 1550 */ 1551 if (!try_module_get(sock->ops->owner)) 1552 goto out_module_busy; 1553 1554 /* 1555 * Now that we're done with the ->create function, the [loadable] 1556 * module can have its refcnt decremented 1557 */ 1558 module_put(pf->owner); 1559 err = security_socket_post_create(sock, family, type, protocol, kern); 1560 if (err) 1561 goto out_sock_release; 1562 *res = sock; 1563 1564 return 0; 1565 1566 out_module_busy: 1567 err = -EAFNOSUPPORT; 1568 out_module_put: 1569 sock->ops = NULL; 1570 module_put(pf->owner); 1571 out_sock_release: 1572 sock_release(sock); 1573 return err; 1574 1575 out_release: 1576 rcu_read_unlock(); 1577 goto out_sock_release; 1578 } 1579 EXPORT_SYMBOL(__sock_create); 1580 1581 /** 1582 * sock_create - creates a socket 1583 * @family: protocol family (AF_INET, ...) 1584 * @type: communication type (SOCK_STREAM, ...) 1585 * @protocol: protocol (0, ...) 1586 * @res: new socket 1587 * 1588 * A wrapper around __sock_create(). 1589 * Returns 0 or an error. This function internally uses GFP_KERNEL. 1590 */ 1591 1592 int sock_create(int family, int type, int protocol, struct socket **res) 1593 { 1594 return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0); 1595 } 1596 EXPORT_SYMBOL(sock_create); 1597 1598 /** 1599 * sock_create_kern - creates a socket (kernel space) 1600 * @net: net namespace 1601 * @family: protocol family (AF_INET, ...) 1602 * @type: communication type (SOCK_STREAM, ...) 1603 * @protocol: protocol (0, ...) 1604 * @res: new socket 1605 * 1606 * A wrapper around __sock_create(). 1607 * Returns 0 or an error. This function internally uses GFP_KERNEL. 1608 */ 1609 1610 int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res) 1611 { 1612 return __sock_create(net, family, type, protocol, res, 1); 1613 } 1614 EXPORT_SYMBOL(sock_create_kern); 1615 1616 static struct socket *__sys_socket_create(int family, int type, int protocol) 1617 { 1618 struct socket *sock; 1619 int retval; 1620 1621 /* Check the SOCK_* constants for consistency. */ 1622 BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC); 1623 BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK); 1624 BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK); 1625 BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK); 1626 1627 if ((type & ~SOCK_TYPE_MASK) & ~(SOCK_CLOEXEC | SOCK_NONBLOCK)) 1628 return ERR_PTR(-EINVAL); 1629 type &= SOCK_TYPE_MASK; 1630 1631 retval = sock_create(family, type, protocol, &sock); 1632 if (retval < 0) 1633 return ERR_PTR(retval); 1634 1635 return sock; 1636 } 1637 1638 struct file *__sys_socket_file(int family, int type, int protocol) 1639 { 1640 struct socket *sock; 1641 struct file *file; 1642 int flags; 1643 1644 sock = __sys_socket_create(family, type, protocol); 1645 if (IS_ERR(sock)) 1646 return ERR_CAST(sock); 1647 1648 flags = type & ~SOCK_TYPE_MASK; 1649 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK)) 1650 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK; 1651 1652 file = sock_alloc_file(sock, flags, NULL); 1653 if (IS_ERR(file)) 1654 sock_release(sock); 1655 1656 return file; 1657 } 1658 1659 int __sys_socket(int family, int type, int protocol) 1660 { 1661 struct socket *sock; 1662 int flags; 1663 1664 sock = __sys_socket_create(family, type, protocol); 1665 if (IS_ERR(sock)) 1666 return PTR_ERR(sock); 1667 1668 flags = type & ~SOCK_TYPE_MASK; 1669 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK)) 1670 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK; 1671 1672 return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); 1673 } 1674 1675 SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol) 1676 { 1677 return __sys_socket(family, type, protocol); 1678 } 1679 1680 /* 1681 * Create a pair of connected sockets. 1682 */ 1683 1684 int __sys_socketpair(int family, int type, int protocol, int __user *usockvec) 1685 { 1686 struct socket *sock1, *sock2; 1687 int fd1, fd2, err; 1688 struct file *newfile1, *newfile2; 1689 int flags; 1690 1691 flags = type & ~SOCK_TYPE_MASK; 1692 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK)) 1693 return -EINVAL; 1694 type &= SOCK_TYPE_MASK; 1695 1696 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK)) 1697 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK; 1698 1699 /* 1700 * reserve descriptors and make sure we won't fail 1701 * to return them to userland. 1702 */ 1703 fd1 = get_unused_fd_flags(flags); 1704 if (unlikely(fd1 < 0)) 1705 return fd1; 1706 1707 fd2 = get_unused_fd_flags(flags); 1708 if (unlikely(fd2 < 0)) { 1709 put_unused_fd(fd1); 1710 return fd2; 1711 } 1712 1713 err = put_user(fd1, &usockvec[0]); 1714 if (err) 1715 goto out; 1716 1717 err = put_user(fd2, &usockvec[1]); 1718 if (err) 1719 goto out; 1720 1721 /* 1722 * Obtain the first socket and check if the underlying protocol 1723 * supports the socketpair call. 1724 */ 1725 1726 err = sock_create(family, type, protocol, &sock1); 1727 if (unlikely(err < 0)) 1728 goto out; 1729 1730 err = sock_create(family, type, protocol, &sock2); 1731 if (unlikely(err < 0)) { 1732 sock_release(sock1); 1733 goto out; 1734 } 1735 1736 err = security_socket_socketpair(sock1, sock2); 1737 if (unlikely(err)) { 1738 sock_release(sock2); 1739 sock_release(sock1); 1740 goto out; 1741 } 1742 1743 err = sock1->ops->socketpair(sock1, sock2); 1744 if (unlikely(err < 0)) { 1745 sock_release(sock2); 1746 sock_release(sock1); 1747 goto out; 1748 } 1749 1750 newfile1 = sock_alloc_file(sock1, flags, NULL); 1751 if (IS_ERR(newfile1)) { 1752 err = PTR_ERR(newfile1); 1753 sock_release(sock2); 1754 goto out; 1755 } 1756 1757 newfile2 = sock_alloc_file(sock2, flags, NULL); 1758 if (IS_ERR(newfile2)) { 1759 err = PTR_ERR(newfile2); 1760 fput(newfile1); 1761 goto out; 1762 } 1763 1764 audit_fd_pair(fd1, fd2); 1765 1766 fd_install(fd1, newfile1); 1767 fd_install(fd2, newfile2); 1768 return 0; 1769 1770 out: 1771 put_unused_fd(fd2); 1772 put_unused_fd(fd1); 1773 return err; 1774 } 1775 1776 SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol, 1777 int __user *, usockvec) 1778 { 1779 return __sys_socketpair(family, type, protocol, usockvec); 1780 } 1781 1782 /* 1783 * Bind a name to a socket. Nothing much to do here since it's 1784 * the protocol's responsibility to handle the local address. 1785 * 1786 * We move the socket address to kernel space before we call 1787 * the protocol layer (having also checked the address is ok). 1788 */ 1789 1790 int __sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen) 1791 { 1792 struct socket *sock; 1793 struct sockaddr_storage address; 1794 int err, fput_needed; 1795 1796 sock = sockfd_lookup_light(fd, &err, &fput_needed); 1797 if (sock) { 1798 err = move_addr_to_kernel(umyaddr, addrlen, &address); 1799 if (!err) { 1800 err = security_socket_bind(sock, 1801 (struct sockaddr *)&address, 1802 addrlen); 1803 if (!err) 1804 err = sock->ops->bind(sock, 1805 (struct sockaddr *) 1806 &address, addrlen); 1807 } 1808 fput_light(sock->file, fput_needed); 1809 } 1810 return err; 1811 } 1812 1813 SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen) 1814 { 1815 return __sys_bind(fd, umyaddr, addrlen); 1816 } 1817 1818 /* 1819 * Perform a listen. Basically, we allow the protocol to do anything 1820 * necessary for a listen, and if that works, we mark the socket as 1821 * ready for listening. 1822 */ 1823 1824 int __sys_listen(int fd, int backlog) 1825 { 1826 struct socket *sock; 1827 int err, fput_needed; 1828 int somaxconn; 1829 1830 sock = sockfd_lookup_light(fd, &err, &fput_needed); 1831 if (sock) { 1832 somaxconn = READ_ONCE(sock_net(sock->sk)->core.sysctl_somaxconn); 1833 if ((unsigned int)backlog > somaxconn) 1834 backlog = somaxconn; 1835 1836 err = security_socket_listen(sock, backlog); 1837 if (!err) 1838 err = sock->ops->listen(sock, backlog); 1839 1840 fput_light(sock->file, fput_needed); 1841 } 1842 return err; 1843 } 1844 1845 SYSCALL_DEFINE2(listen, int, fd, int, backlog) 1846 { 1847 return __sys_listen(fd, backlog); 1848 } 1849 1850 struct file *do_accept(struct file *file, unsigned file_flags, 1851 struct sockaddr __user *upeer_sockaddr, 1852 int __user *upeer_addrlen, int flags) 1853 { 1854 struct socket *sock, *newsock; 1855 struct file *newfile; 1856 int err, len; 1857 struct sockaddr_storage address; 1858 1859 sock = sock_from_file(file); 1860 if (!sock) 1861 return ERR_PTR(-ENOTSOCK); 1862 1863 newsock = sock_alloc(); 1864 if (!newsock) 1865 return ERR_PTR(-ENFILE); 1866 1867 newsock->type = sock->type; 1868 newsock->ops = sock->ops; 1869 1870 /* 1871 * We don't need try_module_get here, as the listening socket (sock) 1872 * has the protocol module (sock->ops->owner) held. 1873 */ 1874 __module_get(newsock->ops->owner); 1875 1876 newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name); 1877 if (IS_ERR(newfile)) 1878 return newfile; 1879 1880 err = security_socket_accept(sock, newsock); 1881 if (err) 1882 goto out_fd; 1883 1884 err = sock->ops->accept(sock, newsock, sock->file->f_flags | file_flags, 1885 false); 1886 if (err < 0) 1887 goto out_fd; 1888 1889 if (upeer_sockaddr) { 1890 len = newsock->ops->getname(newsock, 1891 (struct sockaddr *)&address, 2); 1892 if (len < 0) { 1893 err = -ECONNABORTED; 1894 goto out_fd; 1895 } 1896 err = move_addr_to_user(&address, 1897 len, upeer_sockaddr, upeer_addrlen); 1898 if (err < 0) 1899 goto out_fd; 1900 } 1901 1902 /* File flags are not inherited via accept() unlike another OSes. */ 1903 return newfile; 1904 out_fd: 1905 fput(newfile); 1906 return ERR_PTR(err); 1907 } 1908 1909 static int __sys_accept4_file(struct file *file, struct sockaddr __user *upeer_sockaddr, 1910 int __user *upeer_addrlen, int flags) 1911 { 1912 struct file *newfile; 1913 int newfd; 1914 1915 if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK)) 1916 return -EINVAL; 1917 1918 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK)) 1919 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK; 1920 1921 newfd = get_unused_fd_flags(flags); 1922 if (unlikely(newfd < 0)) 1923 return newfd; 1924 1925 newfile = do_accept(file, 0, upeer_sockaddr, upeer_addrlen, 1926 flags); 1927 if (IS_ERR(newfile)) { 1928 put_unused_fd(newfd); 1929 return PTR_ERR(newfile); 1930 } 1931 fd_install(newfd, newfile); 1932 return newfd; 1933 } 1934 1935 /* 1936 * For accept, we attempt to create a new socket, set up the link 1937 * with the client, wake up the client, then return the new 1938 * connected fd. We collect the address of the connector in kernel 1939 * space and move it to user at the very end. This is unclean because 1940 * we open the socket then return an error. 1941 * 1942 * 1003.1g adds the ability to recvmsg() to query connection pending 1943 * status to recvmsg. We need to add that support in a way thats 1944 * clean when we restructure accept also. 1945 */ 1946 1947 int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr, 1948 int __user *upeer_addrlen, int flags) 1949 { 1950 int ret = -EBADF; 1951 struct fd f; 1952 1953 f = fdget(fd); 1954 if (f.file) { 1955 ret = __sys_accept4_file(f.file, upeer_sockaddr, 1956 upeer_addrlen, flags); 1957 fdput(f); 1958 } 1959 1960 return ret; 1961 } 1962 1963 SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, 1964 int __user *, upeer_addrlen, int, flags) 1965 { 1966 return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags); 1967 } 1968 1969 SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr, 1970 int __user *, upeer_addrlen) 1971 { 1972 return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0); 1973 } 1974 1975 /* 1976 * Attempt to connect to a socket with the server address. The address 1977 * is in user space so we verify it is OK and move it to kernel space. 1978 * 1979 * For 1003.1g we need to add clean support for a bind to AF_UNSPEC to 1980 * break bindings 1981 * 1982 * NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and 1983 * other SEQPACKET protocols that take time to connect() as it doesn't 1984 * include the -EINPROGRESS status for such sockets. 1985 */ 1986 1987 int __sys_connect_file(struct file *file, struct sockaddr_storage *address, 1988 int addrlen, int file_flags) 1989 { 1990 struct socket *sock; 1991 int err; 1992 1993 sock = sock_from_file(file); 1994 if (!sock) { 1995 err = -ENOTSOCK; 1996 goto out; 1997 } 1998 1999 err = 2000 security_socket_connect(sock, (struct sockaddr *)address, addrlen); 2001 if (err) 2002 goto out; 2003 2004 err = sock->ops->connect(sock, (struct sockaddr *)address, addrlen, 2005 sock->file->f_flags | file_flags); 2006 out: 2007 return err; 2008 } 2009 2010 int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen) 2011 { 2012 int ret = -EBADF; 2013 struct fd f; 2014 2015 f = fdget(fd); 2016 if (f.file) { 2017 struct sockaddr_storage address; 2018 2019 ret = move_addr_to_kernel(uservaddr, addrlen, &address); 2020 if (!ret) 2021 ret = __sys_connect_file(f.file, &address, addrlen, 0); 2022 fdput(f); 2023 } 2024 2025 return ret; 2026 } 2027 2028 SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, 2029 int, addrlen) 2030 { 2031 return __sys_connect(fd, uservaddr, addrlen); 2032 } 2033 2034 /* 2035 * Get the local address ('name') of a socket object. Move the obtained 2036 * name to user space. 2037 */ 2038 2039 int __sys_getsockname(int fd, struct sockaddr __user *usockaddr, 2040 int __user *usockaddr_len) 2041 { 2042 struct socket *sock; 2043 struct sockaddr_storage address; 2044 int err, fput_needed; 2045 2046 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2047 if (!sock) 2048 goto out; 2049 2050 err = security_socket_getsockname(sock); 2051 if (err) 2052 goto out_put; 2053 2054 err = sock->ops->getname(sock, (struct sockaddr *)&address, 0); 2055 if (err < 0) 2056 goto out_put; 2057 /* "err" is actually length in this case */ 2058 err = move_addr_to_user(&address, err, usockaddr, usockaddr_len); 2059 2060 out_put: 2061 fput_light(sock->file, fput_needed); 2062 out: 2063 return err; 2064 } 2065 2066 SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr, 2067 int __user *, usockaddr_len) 2068 { 2069 return __sys_getsockname(fd, usockaddr, usockaddr_len); 2070 } 2071 2072 /* 2073 * Get the remote address ('name') of a socket object. Move the obtained 2074 * name to user space. 2075 */ 2076 2077 int __sys_getpeername(int fd, struct sockaddr __user *usockaddr, 2078 int __user *usockaddr_len) 2079 { 2080 struct socket *sock; 2081 struct sockaddr_storage address; 2082 int err, fput_needed; 2083 2084 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2085 if (sock != NULL) { 2086 err = security_socket_getpeername(sock); 2087 if (err) { 2088 fput_light(sock->file, fput_needed); 2089 return err; 2090 } 2091 2092 err = sock->ops->getname(sock, (struct sockaddr *)&address, 1); 2093 if (err >= 0) 2094 /* "err" is actually length in this case */ 2095 err = move_addr_to_user(&address, err, usockaddr, 2096 usockaddr_len); 2097 fput_light(sock->file, fput_needed); 2098 } 2099 return err; 2100 } 2101 2102 SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr, 2103 int __user *, usockaddr_len) 2104 { 2105 return __sys_getpeername(fd, usockaddr, usockaddr_len); 2106 } 2107 2108 /* 2109 * Send a datagram to a given address. We move the address into kernel 2110 * space and check the user space data area is readable before invoking 2111 * the protocol. 2112 */ 2113 int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, 2114 struct sockaddr __user *addr, int addr_len) 2115 { 2116 struct socket *sock; 2117 struct sockaddr_storage address; 2118 int err; 2119 struct msghdr msg; 2120 struct iovec iov; 2121 int fput_needed; 2122 2123 err = import_single_range(ITER_SOURCE, buff, len, &iov, &msg.msg_iter); 2124 if (unlikely(err)) 2125 return err; 2126 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2127 if (!sock) 2128 goto out; 2129 2130 msg.msg_name = NULL; 2131 msg.msg_control = NULL; 2132 msg.msg_controllen = 0; 2133 msg.msg_namelen = 0; 2134 msg.msg_ubuf = NULL; 2135 if (addr) { 2136 err = move_addr_to_kernel(addr, addr_len, &address); 2137 if (err < 0) 2138 goto out_put; 2139 msg.msg_name = (struct sockaddr *)&address; 2140 msg.msg_namelen = addr_len; 2141 } 2142 if (sock->file->f_flags & O_NONBLOCK) 2143 flags |= MSG_DONTWAIT; 2144 msg.msg_flags = flags; 2145 err = sock_sendmsg(sock, &msg); 2146 2147 out_put: 2148 fput_light(sock->file, fput_needed); 2149 out: 2150 return err; 2151 } 2152 2153 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len, 2154 unsigned int, flags, struct sockaddr __user *, addr, 2155 int, addr_len) 2156 { 2157 return __sys_sendto(fd, buff, len, flags, addr, addr_len); 2158 } 2159 2160 /* 2161 * Send a datagram down a socket. 2162 */ 2163 2164 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len, 2165 unsigned int, flags) 2166 { 2167 return __sys_sendto(fd, buff, len, flags, NULL, 0); 2168 } 2169 2170 /* 2171 * Receive a frame from the socket and optionally record the address of the 2172 * sender. We verify the buffers are writable and if needed move the 2173 * sender address from kernel to user space. 2174 */ 2175 int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags, 2176 struct sockaddr __user *addr, int __user *addr_len) 2177 { 2178 struct sockaddr_storage address; 2179 struct msghdr msg = { 2180 /* Save some cycles and don't copy the address if not needed */ 2181 .msg_name = addr ? (struct sockaddr *)&address : NULL, 2182 }; 2183 struct socket *sock; 2184 struct iovec iov; 2185 int err, err2; 2186 int fput_needed; 2187 2188 err = import_single_range(ITER_DEST, ubuf, size, &iov, &msg.msg_iter); 2189 if (unlikely(err)) 2190 return err; 2191 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2192 if (!sock) 2193 goto out; 2194 2195 if (sock->file->f_flags & O_NONBLOCK) 2196 flags |= MSG_DONTWAIT; 2197 err = sock_recvmsg(sock, &msg, flags); 2198 2199 if (err >= 0 && addr != NULL) { 2200 err2 = move_addr_to_user(&address, 2201 msg.msg_namelen, addr, addr_len); 2202 if (err2 < 0) 2203 err = err2; 2204 } 2205 2206 fput_light(sock->file, fput_needed); 2207 out: 2208 return err; 2209 } 2210 2211 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, 2212 unsigned int, flags, struct sockaddr __user *, addr, 2213 int __user *, addr_len) 2214 { 2215 return __sys_recvfrom(fd, ubuf, size, flags, addr, addr_len); 2216 } 2217 2218 /* 2219 * Receive a datagram from a socket. 2220 */ 2221 2222 SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size, 2223 unsigned int, flags) 2224 { 2225 return __sys_recvfrom(fd, ubuf, size, flags, NULL, NULL); 2226 } 2227 2228 static bool sock_use_custom_sol_socket(const struct socket *sock) 2229 { 2230 return test_bit(SOCK_CUSTOM_SOCKOPT, &sock->flags); 2231 } 2232 2233 /* 2234 * Set a socket option. Because we don't know the option lengths we have 2235 * to pass the user mode parameter for the protocols to sort out. 2236 */ 2237 int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval, 2238 int optlen) 2239 { 2240 sockptr_t optval = USER_SOCKPTR(user_optval); 2241 char *kernel_optval = NULL; 2242 int err, fput_needed; 2243 struct socket *sock; 2244 2245 if (optlen < 0) 2246 return -EINVAL; 2247 2248 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2249 if (!sock) 2250 return err; 2251 2252 err = security_socket_setsockopt(sock, level, optname); 2253 if (err) 2254 goto out_put; 2255 2256 if (!in_compat_syscall()) 2257 err = BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock->sk, &level, &optname, 2258 user_optval, &optlen, 2259 &kernel_optval); 2260 if (err < 0) 2261 goto out_put; 2262 if (err > 0) { 2263 err = 0; 2264 goto out_put; 2265 } 2266 2267 if (kernel_optval) 2268 optval = KERNEL_SOCKPTR(kernel_optval); 2269 if (level == SOL_SOCKET && !sock_use_custom_sol_socket(sock)) 2270 err = sock_setsockopt(sock, level, optname, optval, optlen); 2271 else if (unlikely(!sock->ops->setsockopt)) 2272 err = -EOPNOTSUPP; 2273 else 2274 err = sock->ops->setsockopt(sock, level, optname, optval, 2275 optlen); 2276 kfree(kernel_optval); 2277 out_put: 2278 fput_light(sock->file, fput_needed); 2279 return err; 2280 } 2281 2282 SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname, 2283 char __user *, optval, int, optlen) 2284 { 2285 return __sys_setsockopt(fd, level, optname, optval, optlen); 2286 } 2287 2288 INDIRECT_CALLABLE_DECLARE(bool tcp_bpf_bypass_getsockopt(int level, 2289 int optname)); 2290 2291 /* 2292 * Get a socket option. Because we don't know the option lengths we have 2293 * to pass a user mode parameter for the protocols to sort out. 2294 */ 2295 int __sys_getsockopt(int fd, int level, int optname, char __user *optval, 2296 int __user *optlen) 2297 { 2298 int err, fput_needed; 2299 struct socket *sock; 2300 int max_optlen; 2301 2302 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2303 if (!sock) 2304 return err; 2305 2306 err = security_socket_getsockopt(sock, level, optname); 2307 if (err) 2308 goto out_put; 2309 2310 if (!in_compat_syscall()) 2311 max_optlen = BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen); 2312 2313 if (level == SOL_SOCKET) 2314 err = sock_getsockopt(sock, level, optname, optval, optlen); 2315 else if (unlikely(!sock->ops->getsockopt)) 2316 err = -EOPNOTSUPP; 2317 else 2318 err = sock->ops->getsockopt(sock, level, optname, optval, 2319 optlen); 2320 2321 if (!in_compat_syscall()) 2322 err = BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock->sk, level, optname, 2323 optval, optlen, max_optlen, 2324 err); 2325 out_put: 2326 fput_light(sock->file, fput_needed); 2327 return err; 2328 } 2329 2330 SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname, 2331 char __user *, optval, int __user *, optlen) 2332 { 2333 return __sys_getsockopt(fd, level, optname, optval, optlen); 2334 } 2335 2336 /* 2337 * Shutdown a socket. 2338 */ 2339 2340 int __sys_shutdown_sock(struct socket *sock, int how) 2341 { 2342 int err; 2343 2344 err = security_socket_shutdown(sock, how); 2345 if (!err) 2346 err = sock->ops->shutdown(sock, how); 2347 2348 return err; 2349 } 2350 2351 int __sys_shutdown(int fd, int how) 2352 { 2353 int err, fput_needed; 2354 struct socket *sock; 2355 2356 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2357 if (sock != NULL) { 2358 err = __sys_shutdown_sock(sock, how); 2359 fput_light(sock->file, fput_needed); 2360 } 2361 return err; 2362 } 2363 2364 SYSCALL_DEFINE2(shutdown, int, fd, int, how) 2365 { 2366 return __sys_shutdown(fd, how); 2367 } 2368 2369 /* A couple of helpful macros for getting the address of the 32/64 bit 2370 * fields which are the same type (int / unsigned) on our platforms. 2371 */ 2372 #define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member) 2373 #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen) 2374 #define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags) 2375 2376 struct used_address { 2377 struct sockaddr_storage name; 2378 unsigned int name_len; 2379 }; 2380 2381 int __copy_msghdr(struct msghdr *kmsg, 2382 struct user_msghdr *msg, 2383 struct sockaddr __user **save_addr) 2384 { 2385 ssize_t err; 2386 2387 kmsg->msg_control_is_user = true; 2388 kmsg->msg_get_inq = 0; 2389 kmsg->msg_control_user = msg->msg_control; 2390 kmsg->msg_controllen = msg->msg_controllen; 2391 kmsg->msg_flags = msg->msg_flags; 2392 2393 kmsg->msg_namelen = msg->msg_namelen; 2394 if (!msg->msg_name) 2395 kmsg->msg_namelen = 0; 2396 2397 if (kmsg->msg_namelen < 0) 2398 return -EINVAL; 2399 2400 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) 2401 kmsg->msg_namelen = sizeof(struct sockaddr_storage); 2402 2403 if (save_addr) 2404 *save_addr = msg->msg_name; 2405 2406 if (msg->msg_name && kmsg->msg_namelen) { 2407 if (!save_addr) { 2408 err = move_addr_to_kernel(msg->msg_name, 2409 kmsg->msg_namelen, 2410 kmsg->msg_name); 2411 if (err < 0) 2412 return err; 2413 } 2414 } else { 2415 kmsg->msg_name = NULL; 2416 kmsg->msg_namelen = 0; 2417 } 2418 2419 if (msg->msg_iovlen > UIO_MAXIOV) 2420 return -EMSGSIZE; 2421 2422 kmsg->msg_iocb = NULL; 2423 kmsg->msg_ubuf = NULL; 2424 return 0; 2425 } 2426 2427 static int copy_msghdr_from_user(struct msghdr *kmsg, 2428 struct user_msghdr __user *umsg, 2429 struct sockaddr __user **save_addr, 2430 struct iovec **iov) 2431 { 2432 struct user_msghdr msg; 2433 ssize_t err; 2434 2435 if (copy_from_user(&msg, umsg, sizeof(*umsg))) 2436 return -EFAULT; 2437 2438 err = __copy_msghdr(kmsg, &msg, save_addr); 2439 if (err) 2440 return err; 2441 2442 err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE, 2443 msg.msg_iov, msg.msg_iovlen, 2444 UIO_FASTIOV, iov, &kmsg->msg_iter); 2445 return err < 0 ? err : 0; 2446 } 2447 2448 static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, 2449 unsigned int flags, struct used_address *used_address, 2450 unsigned int allowed_msghdr_flags) 2451 { 2452 unsigned char ctl[sizeof(struct cmsghdr) + 20] 2453 __aligned(sizeof(__kernel_size_t)); 2454 /* 20 is size of ipv6_pktinfo */ 2455 unsigned char *ctl_buf = ctl; 2456 int ctl_len; 2457 ssize_t err; 2458 2459 err = -ENOBUFS; 2460 2461 if (msg_sys->msg_controllen > INT_MAX) 2462 goto out; 2463 flags |= (msg_sys->msg_flags & allowed_msghdr_flags); 2464 ctl_len = msg_sys->msg_controllen; 2465 if ((MSG_CMSG_COMPAT & flags) && ctl_len) { 2466 err = 2467 cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl, 2468 sizeof(ctl)); 2469 if (err) 2470 goto out; 2471 ctl_buf = msg_sys->msg_control; 2472 ctl_len = msg_sys->msg_controllen; 2473 } else if (ctl_len) { 2474 BUILD_BUG_ON(sizeof(struct cmsghdr) != 2475 CMSG_ALIGN(sizeof(struct cmsghdr))); 2476 if (ctl_len > sizeof(ctl)) { 2477 ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL); 2478 if (ctl_buf == NULL) 2479 goto out; 2480 } 2481 err = -EFAULT; 2482 if (copy_from_user(ctl_buf, msg_sys->msg_control_user, ctl_len)) 2483 goto out_freectl; 2484 msg_sys->msg_control = ctl_buf; 2485 msg_sys->msg_control_is_user = false; 2486 } 2487 msg_sys->msg_flags = flags; 2488 2489 if (sock->file->f_flags & O_NONBLOCK) 2490 msg_sys->msg_flags |= MSG_DONTWAIT; 2491 /* 2492 * If this is sendmmsg() and current destination address is same as 2493 * previously succeeded address, omit asking LSM's decision. 2494 * used_address->name_len is initialized to UINT_MAX so that the first 2495 * destination address never matches. 2496 */ 2497 if (used_address && msg_sys->msg_name && 2498 used_address->name_len == msg_sys->msg_namelen && 2499 !memcmp(&used_address->name, msg_sys->msg_name, 2500 used_address->name_len)) { 2501 err = sock_sendmsg_nosec(sock, msg_sys); 2502 goto out_freectl; 2503 } 2504 err = sock_sendmsg(sock, msg_sys); 2505 /* 2506 * If this is sendmmsg() and sending to current destination address was 2507 * successful, remember it. 2508 */ 2509 if (used_address && err >= 0) { 2510 used_address->name_len = msg_sys->msg_namelen; 2511 if (msg_sys->msg_name) 2512 memcpy(&used_address->name, msg_sys->msg_name, 2513 used_address->name_len); 2514 } 2515 2516 out_freectl: 2517 if (ctl_buf != ctl) 2518 sock_kfree_s(sock->sk, ctl_buf, ctl_len); 2519 out: 2520 return err; 2521 } 2522 2523 int sendmsg_copy_msghdr(struct msghdr *msg, 2524 struct user_msghdr __user *umsg, unsigned flags, 2525 struct iovec **iov) 2526 { 2527 int err; 2528 2529 if (flags & MSG_CMSG_COMPAT) { 2530 struct compat_msghdr __user *msg_compat; 2531 2532 msg_compat = (struct compat_msghdr __user *) umsg; 2533 err = get_compat_msghdr(msg, msg_compat, NULL, iov); 2534 } else { 2535 err = copy_msghdr_from_user(msg, umsg, NULL, iov); 2536 } 2537 if (err < 0) 2538 return err; 2539 2540 return 0; 2541 } 2542 2543 static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg, 2544 struct msghdr *msg_sys, unsigned int flags, 2545 struct used_address *used_address, 2546 unsigned int allowed_msghdr_flags) 2547 { 2548 struct sockaddr_storage address; 2549 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack; 2550 ssize_t err; 2551 2552 msg_sys->msg_name = &address; 2553 2554 err = sendmsg_copy_msghdr(msg_sys, msg, flags, &iov); 2555 if (err < 0) 2556 return err; 2557 2558 err = ____sys_sendmsg(sock, msg_sys, flags, used_address, 2559 allowed_msghdr_flags); 2560 kfree(iov); 2561 return err; 2562 } 2563 2564 /* 2565 * BSD sendmsg interface 2566 */ 2567 long __sys_sendmsg_sock(struct socket *sock, struct msghdr *msg, 2568 unsigned int flags) 2569 { 2570 return ____sys_sendmsg(sock, msg, flags, NULL, 0); 2571 } 2572 2573 long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags, 2574 bool forbid_cmsg_compat) 2575 { 2576 int fput_needed, err; 2577 struct msghdr msg_sys; 2578 struct socket *sock; 2579 2580 if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT)) 2581 return -EINVAL; 2582 2583 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2584 if (!sock) 2585 goto out; 2586 2587 err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0); 2588 2589 fput_light(sock->file, fput_needed); 2590 out: 2591 return err; 2592 } 2593 2594 SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags) 2595 { 2596 return __sys_sendmsg(fd, msg, flags, true); 2597 } 2598 2599 /* 2600 * Linux sendmmsg interface 2601 */ 2602 2603 int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, 2604 unsigned int flags, bool forbid_cmsg_compat) 2605 { 2606 int fput_needed, err, datagrams; 2607 struct socket *sock; 2608 struct mmsghdr __user *entry; 2609 struct compat_mmsghdr __user *compat_entry; 2610 struct msghdr msg_sys; 2611 struct used_address used_address; 2612 unsigned int oflags = flags; 2613 2614 if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT)) 2615 return -EINVAL; 2616 2617 if (vlen > UIO_MAXIOV) 2618 vlen = UIO_MAXIOV; 2619 2620 datagrams = 0; 2621 2622 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2623 if (!sock) 2624 return err; 2625 2626 used_address.name_len = UINT_MAX; 2627 entry = mmsg; 2628 compat_entry = (struct compat_mmsghdr __user *)mmsg; 2629 err = 0; 2630 flags |= MSG_BATCH; 2631 2632 while (datagrams < vlen) { 2633 if (datagrams == vlen - 1) 2634 flags = oflags; 2635 2636 if (MSG_CMSG_COMPAT & flags) { 2637 err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry, 2638 &msg_sys, flags, &used_address, MSG_EOR); 2639 if (err < 0) 2640 break; 2641 err = __put_user(err, &compat_entry->msg_len); 2642 ++compat_entry; 2643 } else { 2644 err = ___sys_sendmsg(sock, 2645 (struct user_msghdr __user *)entry, 2646 &msg_sys, flags, &used_address, MSG_EOR); 2647 if (err < 0) 2648 break; 2649 err = put_user(err, &entry->msg_len); 2650 ++entry; 2651 } 2652 2653 if (err) 2654 break; 2655 ++datagrams; 2656 if (msg_data_left(&msg_sys)) 2657 break; 2658 cond_resched(); 2659 } 2660 2661 fput_light(sock->file, fput_needed); 2662 2663 /* We only return an error if no datagrams were able to be sent */ 2664 if (datagrams != 0) 2665 return datagrams; 2666 2667 return err; 2668 } 2669 2670 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg, 2671 unsigned int, vlen, unsigned int, flags) 2672 { 2673 return __sys_sendmmsg(fd, mmsg, vlen, flags, true); 2674 } 2675 2676 int recvmsg_copy_msghdr(struct msghdr *msg, 2677 struct user_msghdr __user *umsg, unsigned flags, 2678 struct sockaddr __user **uaddr, 2679 struct iovec **iov) 2680 { 2681 ssize_t err; 2682 2683 if (MSG_CMSG_COMPAT & flags) { 2684 struct compat_msghdr __user *msg_compat; 2685 2686 msg_compat = (struct compat_msghdr __user *) umsg; 2687 err = get_compat_msghdr(msg, msg_compat, uaddr, iov); 2688 } else { 2689 err = copy_msghdr_from_user(msg, umsg, uaddr, iov); 2690 } 2691 if (err < 0) 2692 return err; 2693 2694 return 0; 2695 } 2696 2697 static int ____sys_recvmsg(struct socket *sock, struct msghdr *msg_sys, 2698 struct user_msghdr __user *msg, 2699 struct sockaddr __user *uaddr, 2700 unsigned int flags, int nosec) 2701 { 2702 struct compat_msghdr __user *msg_compat = 2703 (struct compat_msghdr __user *) msg; 2704 int __user *uaddr_len = COMPAT_NAMELEN(msg); 2705 struct sockaddr_storage addr; 2706 unsigned long cmsg_ptr; 2707 int len; 2708 ssize_t err; 2709 2710 msg_sys->msg_name = &addr; 2711 cmsg_ptr = (unsigned long)msg_sys->msg_control; 2712 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT); 2713 2714 /* We assume all kernel code knows the size of sockaddr_storage */ 2715 msg_sys->msg_namelen = 0; 2716 2717 if (sock->file->f_flags & O_NONBLOCK) 2718 flags |= MSG_DONTWAIT; 2719 2720 if (unlikely(nosec)) 2721 err = sock_recvmsg_nosec(sock, msg_sys, flags); 2722 else 2723 err = sock_recvmsg(sock, msg_sys, flags); 2724 2725 if (err < 0) 2726 goto out; 2727 len = err; 2728 2729 if (uaddr != NULL) { 2730 err = move_addr_to_user(&addr, 2731 msg_sys->msg_namelen, uaddr, 2732 uaddr_len); 2733 if (err < 0) 2734 goto out; 2735 } 2736 err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT), 2737 COMPAT_FLAGS(msg)); 2738 if (err) 2739 goto out; 2740 if (MSG_CMSG_COMPAT & flags) 2741 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr, 2742 &msg_compat->msg_controllen); 2743 else 2744 err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr, 2745 &msg->msg_controllen); 2746 if (err) 2747 goto out; 2748 err = len; 2749 out: 2750 return err; 2751 } 2752 2753 static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg, 2754 struct msghdr *msg_sys, unsigned int flags, int nosec) 2755 { 2756 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack; 2757 /* user mode address pointers */ 2758 struct sockaddr __user *uaddr; 2759 ssize_t err; 2760 2761 err = recvmsg_copy_msghdr(msg_sys, msg, flags, &uaddr, &iov); 2762 if (err < 0) 2763 return err; 2764 2765 err = ____sys_recvmsg(sock, msg_sys, msg, uaddr, flags, nosec); 2766 kfree(iov); 2767 return err; 2768 } 2769 2770 /* 2771 * BSD recvmsg interface 2772 */ 2773 2774 long __sys_recvmsg_sock(struct socket *sock, struct msghdr *msg, 2775 struct user_msghdr __user *umsg, 2776 struct sockaddr __user *uaddr, unsigned int flags) 2777 { 2778 return ____sys_recvmsg(sock, msg, umsg, uaddr, flags, 0); 2779 } 2780 2781 long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags, 2782 bool forbid_cmsg_compat) 2783 { 2784 int fput_needed, err; 2785 struct msghdr msg_sys; 2786 struct socket *sock; 2787 2788 if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT)) 2789 return -EINVAL; 2790 2791 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2792 if (!sock) 2793 goto out; 2794 2795 err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0); 2796 2797 fput_light(sock->file, fput_needed); 2798 out: 2799 return err; 2800 } 2801 2802 SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg, 2803 unsigned int, flags) 2804 { 2805 return __sys_recvmsg(fd, msg, flags, true); 2806 } 2807 2808 /* 2809 * Linux recvmmsg interface 2810 */ 2811 2812 static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg, 2813 unsigned int vlen, unsigned int flags, 2814 struct timespec64 *timeout) 2815 { 2816 int fput_needed, err, datagrams; 2817 struct socket *sock; 2818 struct mmsghdr __user *entry; 2819 struct compat_mmsghdr __user *compat_entry; 2820 struct msghdr msg_sys; 2821 struct timespec64 end_time; 2822 struct timespec64 timeout64; 2823 2824 if (timeout && 2825 poll_select_set_timeout(&end_time, timeout->tv_sec, 2826 timeout->tv_nsec)) 2827 return -EINVAL; 2828 2829 datagrams = 0; 2830 2831 sock = sockfd_lookup_light(fd, &err, &fput_needed); 2832 if (!sock) 2833 return err; 2834 2835 if (likely(!(flags & MSG_ERRQUEUE))) { 2836 err = sock_error(sock->sk); 2837 if (err) { 2838 datagrams = err; 2839 goto out_put; 2840 } 2841 } 2842 2843 entry = mmsg; 2844 compat_entry = (struct compat_mmsghdr __user *)mmsg; 2845 2846 while (datagrams < vlen) { 2847 /* 2848 * No need to ask LSM for more than the first datagram. 2849 */ 2850 if (MSG_CMSG_COMPAT & flags) { 2851 err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry, 2852 &msg_sys, flags & ~MSG_WAITFORONE, 2853 datagrams); 2854 if (err < 0) 2855 break; 2856 err = __put_user(err, &compat_entry->msg_len); 2857 ++compat_entry; 2858 } else { 2859 err = ___sys_recvmsg(sock, 2860 (struct user_msghdr __user *)entry, 2861 &msg_sys, flags & ~MSG_WAITFORONE, 2862 datagrams); 2863 if (err < 0) 2864 break; 2865 err = put_user(err, &entry->msg_len); 2866 ++entry; 2867 } 2868 2869 if (err) 2870 break; 2871 ++datagrams; 2872 2873 /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */ 2874 if (flags & MSG_WAITFORONE) 2875 flags |= MSG_DONTWAIT; 2876 2877 if (timeout) { 2878 ktime_get_ts64(&timeout64); 2879 *timeout = timespec64_sub(end_time, timeout64); 2880 if (timeout->tv_sec < 0) { 2881 timeout->tv_sec = timeout->tv_nsec = 0; 2882 break; 2883 } 2884 2885 /* Timeout, return less than vlen datagrams */ 2886 if (timeout->tv_nsec == 0 && timeout->tv_sec == 0) 2887 break; 2888 } 2889 2890 /* Out of band data, return right away */ 2891 if (msg_sys.msg_flags & MSG_OOB) 2892 break; 2893 cond_resched(); 2894 } 2895 2896 if (err == 0) 2897 goto out_put; 2898 2899 if (datagrams == 0) { 2900 datagrams = err; 2901 goto out_put; 2902 } 2903 2904 /* 2905 * We may return less entries than requested (vlen) if the 2906 * sock is non block and there aren't enough datagrams... 2907 */ 2908 if (err != -EAGAIN) { 2909 /* 2910 * ... or if recvmsg returns an error after we 2911 * received some datagrams, where we record the 2912 * error to return on the next call or if the 2913 * app asks about it using getsockopt(SO_ERROR). 2914 */ 2915 sock->sk->sk_err = -err; 2916 } 2917 out_put: 2918 fput_light(sock->file, fput_needed); 2919 2920 return datagrams; 2921 } 2922 2923 int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, 2924 unsigned int vlen, unsigned int flags, 2925 struct __kernel_timespec __user *timeout, 2926 struct old_timespec32 __user *timeout32) 2927 { 2928 int datagrams; 2929 struct timespec64 timeout_sys; 2930 2931 if (timeout && get_timespec64(&timeout_sys, timeout)) 2932 return -EFAULT; 2933 2934 if (timeout32 && get_old_timespec32(&timeout_sys, timeout32)) 2935 return -EFAULT; 2936 2937 if (!timeout && !timeout32) 2938 return do_recvmmsg(fd, mmsg, vlen, flags, NULL); 2939 2940 datagrams = do_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys); 2941 2942 if (datagrams <= 0) 2943 return datagrams; 2944 2945 if (timeout && put_timespec64(&timeout_sys, timeout)) 2946 datagrams = -EFAULT; 2947 2948 if (timeout32 && put_old_timespec32(&timeout_sys, timeout32)) 2949 datagrams = -EFAULT; 2950 2951 return datagrams; 2952 } 2953 2954 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, 2955 unsigned int, vlen, unsigned int, flags, 2956 struct __kernel_timespec __user *, timeout) 2957 { 2958 if (flags & MSG_CMSG_COMPAT) 2959 return -EINVAL; 2960 2961 return __sys_recvmmsg(fd, mmsg, vlen, flags, timeout, NULL); 2962 } 2963 2964 #ifdef CONFIG_COMPAT_32BIT_TIME 2965 SYSCALL_DEFINE5(recvmmsg_time32, int, fd, struct mmsghdr __user *, mmsg, 2966 unsigned int, vlen, unsigned int, flags, 2967 struct old_timespec32 __user *, timeout) 2968 { 2969 if (flags & MSG_CMSG_COMPAT) 2970 return -EINVAL; 2971 2972 return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL, timeout); 2973 } 2974 #endif 2975 2976 #ifdef __ARCH_WANT_SYS_SOCKETCALL 2977 /* Argument list sizes for sys_socketcall */ 2978 #define AL(x) ((x) * sizeof(unsigned long)) 2979 static const unsigned char nargs[21] = { 2980 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3), 2981 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6), 2982 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3), 2983 AL(4), AL(5), AL(4) 2984 }; 2985 2986 #undef AL 2987 2988 /* 2989 * System call vectors. 2990 * 2991 * Argument checking cleaned up. Saved 20% in size. 2992 * This function doesn't need to set the kernel lock because 2993 * it is set by the callees. 2994 */ 2995 2996 SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) 2997 { 2998 unsigned long a[AUDITSC_ARGS]; 2999 unsigned long a0, a1; 3000 int err; 3001 unsigned int len; 3002 3003 if (call < 1 || call > SYS_SENDMMSG) 3004 return -EINVAL; 3005 call = array_index_nospec(call, SYS_SENDMMSG + 1); 3006 3007 len = nargs[call]; 3008 if (len > sizeof(a)) 3009 return -EINVAL; 3010 3011 /* copy_from_user should be SMP safe. */ 3012 if (copy_from_user(a, args, len)) 3013 return -EFAULT; 3014 3015 err = audit_socketcall(nargs[call] / sizeof(unsigned long), a); 3016 if (err) 3017 return err; 3018 3019 a0 = a[0]; 3020 a1 = a[1]; 3021 3022 switch (call) { 3023 case SYS_SOCKET: 3024 err = __sys_socket(a0, a1, a[2]); 3025 break; 3026 case SYS_BIND: 3027 err = __sys_bind(a0, (struct sockaddr __user *)a1, a[2]); 3028 break; 3029 case SYS_CONNECT: 3030 err = __sys_connect(a0, (struct sockaddr __user *)a1, a[2]); 3031 break; 3032 case SYS_LISTEN: 3033 err = __sys_listen(a0, a1); 3034 break; 3035 case SYS_ACCEPT: 3036 err = __sys_accept4(a0, (struct sockaddr __user *)a1, 3037 (int __user *)a[2], 0); 3038 break; 3039 case SYS_GETSOCKNAME: 3040 err = 3041 __sys_getsockname(a0, (struct sockaddr __user *)a1, 3042 (int __user *)a[2]); 3043 break; 3044 case SYS_GETPEERNAME: 3045 err = 3046 __sys_getpeername(a0, (struct sockaddr __user *)a1, 3047 (int __user *)a[2]); 3048 break; 3049 case SYS_SOCKETPAIR: 3050 err = __sys_socketpair(a0, a1, a[2], (int __user *)a[3]); 3051 break; 3052 case SYS_SEND: 3053 err = __sys_sendto(a0, (void __user *)a1, a[2], a[3], 3054 NULL, 0); 3055 break; 3056 case SYS_SENDTO: 3057 err = __sys_sendto(a0, (void __user *)a1, a[2], a[3], 3058 (struct sockaddr __user *)a[4], a[5]); 3059 break; 3060 case SYS_RECV: 3061 err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3], 3062 NULL, NULL); 3063 break; 3064 case SYS_RECVFROM: 3065 err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3], 3066 (struct sockaddr __user *)a[4], 3067 (int __user *)a[5]); 3068 break; 3069 case SYS_SHUTDOWN: 3070 err = __sys_shutdown(a0, a1); 3071 break; 3072 case SYS_SETSOCKOPT: 3073 err = __sys_setsockopt(a0, a1, a[2], (char __user *)a[3], 3074 a[4]); 3075 break; 3076 case SYS_GETSOCKOPT: 3077 err = 3078 __sys_getsockopt(a0, a1, a[2], (char __user *)a[3], 3079 (int __user *)a[4]); 3080 break; 3081 case SYS_SENDMSG: 3082 err = __sys_sendmsg(a0, (struct user_msghdr __user *)a1, 3083 a[2], true); 3084 break; 3085 case SYS_SENDMMSG: 3086 err = __sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], 3087 a[3], true); 3088 break; 3089 case SYS_RECVMSG: 3090 err = __sys_recvmsg(a0, (struct user_msghdr __user *)a1, 3091 a[2], true); 3092 break; 3093 case SYS_RECVMMSG: 3094 if (IS_ENABLED(CONFIG_64BIT)) 3095 err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1, 3096 a[2], a[3], 3097 (struct __kernel_timespec __user *)a[4], 3098 NULL); 3099 else 3100 err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1, 3101 a[2], a[3], NULL, 3102 (struct old_timespec32 __user *)a[4]); 3103 break; 3104 case SYS_ACCEPT4: 3105 err = __sys_accept4(a0, (struct sockaddr __user *)a1, 3106 (int __user *)a[2], a[3]); 3107 break; 3108 default: 3109 err = -EINVAL; 3110 break; 3111 } 3112 return err; 3113 } 3114 3115 #endif /* __ARCH_WANT_SYS_SOCKETCALL */ 3116 3117 /** 3118 * sock_register - add a socket protocol handler 3119 * @ops: description of protocol 3120 * 3121 * This function is called by a protocol handler that wants to 3122 * advertise its address family, and have it linked into the 3123 * socket interface. The value ops->family corresponds to the 3124 * socket system call protocol family. 3125 */ 3126 int sock_register(const struct net_proto_family *ops) 3127 { 3128 int err; 3129 3130 if (ops->family >= NPROTO) { 3131 pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO); 3132 return -ENOBUFS; 3133 } 3134 3135 spin_lock(&net_family_lock); 3136 if (rcu_dereference_protected(net_families[ops->family], 3137 lockdep_is_held(&net_family_lock))) 3138 err = -EEXIST; 3139 else { 3140 rcu_assign_pointer(net_families[ops->family], ops); 3141 err = 0; 3142 } 3143 spin_unlock(&net_family_lock); 3144 3145 pr_info("NET: Registered %s protocol family\n", pf_family_names[ops->family]); 3146 return err; 3147 } 3148 EXPORT_SYMBOL(sock_register); 3149 3150 /** 3151 * sock_unregister - remove a protocol handler 3152 * @family: protocol family to remove 3153 * 3154 * This function is called by a protocol handler that wants to 3155 * remove its address family, and have it unlinked from the 3156 * new socket creation. 3157 * 3158 * If protocol handler is a module, then it can use module reference 3159 * counts to protect against new references. If protocol handler is not 3160 * a module then it needs to provide its own protection in 3161 * the ops->create routine. 3162 */ 3163 void sock_unregister(int family) 3164 { 3165 BUG_ON(family < 0 || family >= NPROTO); 3166 3167 spin_lock(&net_family_lock); 3168 RCU_INIT_POINTER(net_families[family], NULL); 3169 spin_unlock(&net_family_lock); 3170 3171 synchronize_rcu(); 3172 3173 pr_info("NET: Unregistered %s protocol family\n", pf_family_names[family]); 3174 } 3175 EXPORT_SYMBOL(sock_unregister); 3176 3177 bool sock_is_registered(int family) 3178 { 3179 return family < NPROTO && rcu_access_pointer(net_families[family]); 3180 } 3181 3182 static int __init sock_init(void) 3183 { 3184 int err; 3185 /* 3186 * Initialize the network sysctl infrastructure. 3187 */ 3188 err = net_sysctl_init(); 3189 if (err) 3190 goto out; 3191 3192 /* 3193 * Initialize skbuff SLAB cache 3194 */ 3195 skb_init(); 3196 3197 /* 3198 * Initialize the protocols module. 3199 */ 3200 3201 init_inodecache(); 3202 3203 err = register_filesystem(&sock_fs_type); 3204 if (err) 3205 goto out; 3206 sock_mnt = kern_mount(&sock_fs_type); 3207 if (IS_ERR(sock_mnt)) { 3208 err = PTR_ERR(sock_mnt); 3209 goto out_mount; 3210 } 3211 3212 /* The real protocol initialization is performed in later initcalls. 3213 */ 3214 3215 #ifdef CONFIG_NETFILTER 3216 err = netfilter_init(); 3217 if (err) 3218 goto out; 3219 #endif 3220 3221 ptp_classifier_init(); 3222 3223 out: 3224 return err; 3225 3226 out_mount: 3227 unregister_filesystem(&sock_fs_type); 3228 goto out; 3229 } 3230 3231 core_initcall(sock_init); /* early initcall */ 3232 3233 #ifdef CONFIG_PROC_FS 3234 void socket_seq_show(struct seq_file *seq) 3235 { 3236 seq_printf(seq, "sockets: used %d\n", 3237 sock_inuse_get(seq->private)); 3238 } 3239 #endif /* CONFIG_PROC_FS */ 3240 3241 /* Handle the fact that while struct ifreq has the same *layout* on 3242 * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data, 3243 * which are handled elsewhere, it still has different *size* due to 3244 * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit, 3245 * resulting in struct ifreq being 32 and 40 bytes respectively). 3246 * As a result, if the struct happens to be at the end of a page and 3247 * the next page isn't readable/writable, we get a fault. To prevent 3248 * that, copy back and forth to the full size. 3249 */ 3250 int get_user_ifreq(struct ifreq *ifr, void __user **ifrdata, void __user *arg) 3251 { 3252 if (in_compat_syscall()) { 3253 struct compat_ifreq *ifr32 = (struct compat_ifreq *)ifr; 3254 3255 memset(ifr, 0, sizeof(*ifr)); 3256 if (copy_from_user(ifr32, arg, sizeof(*ifr32))) 3257 return -EFAULT; 3258 3259 if (ifrdata) 3260 *ifrdata = compat_ptr(ifr32->ifr_data); 3261 3262 return 0; 3263 } 3264 3265 if (copy_from_user(ifr, arg, sizeof(*ifr))) 3266 return -EFAULT; 3267 3268 if (ifrdata) 3269 *ifrdata = ifr->ifr_data; 3270 3271 return 0; 3272 } 3273 EXPORT_SYMBOL(get_user_ifreq); 3274 3275 int put_user_ifreq(struct ifreq *ifr, void __user *arg) 3276 { 3277 size_t size = sizeof(*ifr); 3278 3279 if (in_compat_syscall()) 3280 size = sizeof(struct compat_ifreq); 3281 3282 if (copy_to_user(arg, ifr, size)) 3283 return -EFAULT; 3284 3285 return 0; 3286 } 3287 EXPORT_SYMBOL(put_user_ifreq); 3288 3289 #ifdef CONFIG_COMPAT 3290 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32) 3291 { 3292 compat_uptr_t uptr32; 3293 struct ifreq ifr; 3294 void __user *saved; 3295 int err; 3296 3297 if (get_user_ifreq(&ifr, NULL, uifr32)) 3298 return -EFAULT; 3299 3300 if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu)) 3301 return -EFAULT; 3302 3303 saved = ifr.ifr_settings.ifs_ifsu.raw_hdlc; 3304 ifr.ifr_settings.ifs_ifsu.raw_hdlc = compat_ptr(uptr32); 3305 3306 err = dev_ioctl(net, SIOCWANDEV, &ifr, NULL, NULL); 3307 if (!err) { 3308 ifr.ifr_settings.ifs_ifsu.raw_hdlc = saved; 3309 if (put_user_ifreq(&ifr, uifr32)) 3310 err = -EFAULT; 3311 } 3312 return err; 3313 } 3314 3315 /* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */ 3316 static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd, 3317 struct compat_ifreq __user *u_ifreq32) 3318 { 3319 struct ifreq ifreq; 3320 void __user *data; 3321 3322 if (!is_socket_ioctl_cmd(cmd)) 3323 return -ENOTTY; 3324 if (get_user_ifreq(&ifreq, &data, u_ifreq32)) 3325 return -EFAULT; 3326 ifreq.ifr_data = data; 3327 3328 return dev_ioctl(net, cmd, &ifreq, data, NULL); 3329 } 3330 3331 static int compat_sock_ioctl_trans(struct file *file, struct socket *sock, 3332 unsigned int cmd, unsigned long arg) 3333 { 3334 void __user *argp = compat_ptr(arg); 3335 struct sock *sk = sock->sk; 3336 struct net *net = sock_net(sk); 3337 3338 if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) 3339 return sock_ioctl(file, cmd, (unsigned long)argp); 3340 3341 switch (cmd) { 3342 case SIOCWANDEV: 3343 return compat_siocwandev(net, argp); 3344 case SIOCGSTAMP_OLD: 3345 case SIOCGSTAMPNS_OLD: 3346 if (!sock->ops->gettstamp) 3347 return -ENOIOCTLCMD; 3348 return sock->ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD, 3349 !COMPAT_USE_64BIT_TIME); 3350 3351 case SIOCETHTOOL: 3352 case SIOCBONDSLAVEINFOQUERY: 3353 case SIOCBONDINFOQUERY: 3354 case SIOCSHWTSTAMP: 3355 case SIOCGHWTSTAMP: 3356 return compat_ifr_data_ioctl(net, cmd, argp); 3357 3358 case FIOSETOWN: 3359 case SIOCSPGRP: 3360 case FIOGETOWN: 3361 case SIOCGPGRP: 3362 case SIOCBRADDBR: 3363 case SIOCBRDELBR: 3364 case SIOCGIFVLAN: 3365 case SIOCSIFVLAN: 3366 case SIOCGSKNS: 3367 case SIOCGSTAMP_NEW: 3368 case SIOCGSTAMPNS_NEW: 3369 case SIOCGIFCONF: 3370 case SIOCSIFBR: 3371 case SIOCGIFBR: 3372 return sock_ioctl(file, cmd, arg); 3373 3374 case SIOCGIFFLAGS: 3375 case SIOCSIFFLAGS: 3376 case SIOCGIFMAP: 3377 case SIOCSIFMAP: 3378 case SIOCGIFMETRIC: 3379 case SIOCSIFMETRIC: 3380 case SIOCGIFMTU: 3381 case SIOCSIFMTU: 3382 case SIOCGIFMEM: 3383 case SIOCSIFMEM: 3384 case SIOCGIFHWADDR: 3385 case SIOCSIFHWADDR: 3386 case SIOCADDMULTI: 3387 case SIOCDELMULTI: 3388 case SIOCGIFINDEX: 3389 case SIOCGIFADDR: 3390 case SIOCSIFADDR: 3391 case SIOCSIFHWBROADCAST: 3392 case SIOCDIFADDR: 3393 case SIOCGIFBRDADDR: 3394 case SIOCSIFBRDADDR: 3395 case SIOCGIFDSTADDR: 3396 case SIOCSIFDSTADDR: 3397 case SIOCGIFNETMASK: 3398 case SIOCSIFNETMASK: 3399 case SIOCSIFPFLAGS: 3400 case SIOCGIFPFLAGS: 3401 case SIOCGIFTXQLEN: 3402 case SIOCSIFTXQLEN: 3403 case SIOCBRADDIF: 3404 case SIOCBRDELIF: 3405 case SIOCGIFNAME: 3406 case SIOCSIFNAME: 3407 case SIOCGMIIPHY: 3408 case SIOCGMIIREG: 3409 case SIOCSMIIREG: 3410 case SIOCBONDENSLAVE: 3411 case SIOCBONDRELEASE: 3412 case SIOCBONDSETHWADDR: 3413 case SIOCBONDCHANGEACTIVE: 3414 case SIOCSARP: 3415 case SIOCGARP: 3416 case SIOCDARP: 3417 case SIOCOUTQ: 3418 case SIOCOUTQNSD: 3419 case SIOCATMARK: 3420 return sock_do_ioctl(net, sock, cmd, arg); 3421 } 3422 3423 return -ENOIOCTLCMD; 3424 } 3425 3426 static long compat_sock_ioctl(struct file *file, unsigned int cmd, 3427 unsigned long arg) 3428 { 3429 struct socket *sock = file->private_data; 3430 int ret = -ENOIOCTLCMD; 3431 struct sock *sk; 3432 struct net *net; 3433 3434 sk = sock->sk; 3435 net = sock_net(sk); 3436 3437 if (sock->ops->compat_ioctl) 3438 ret = sock->ops->compat_ioctl(sock, cmd, arg); 3439 3440 if (ret == -ENOIOCTLCMD && 3441 (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)) 3442 ret = compat_wext_handle_ioctl(net, cmd, arg); 3443 3444 if (ret == -ENOIOCTLCMD) 3445 ret = compat_sock_ioctl_trans(file, sock, cmd, arg); 3446 3447 return ret; 3448 } 3449 #endif 3450 3451 /** 3452 * kernel_bind - bind an address to a socket (kernel space) 3453 * @sock: socket 3454 * @addr: address 3455 * @addrlen: length of address 3456 * 3457 * Returns 0 or an error. 3458 */ 3459 3460 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen) 3461 { 3462 return sock->ops->bind(sock, addr, addrlen); 3463 } 3464 EXPORT_SYMBOL(kernel_bind); 3465 3466 /** 3467 * kernel_listen - move socket to listening state (kernel space) 3468 * @sock: socket 3469 * @backlog: pending connections queue size 3470 * 3471 * Returns 0 or an error. 3472 */ 3473 3474 int kernel_listen(struct socket *sock, int backlog) 3475 { 3476 return sock->ops->listen(sock, backlog); 3477 } 3478 EXPORT_SYMBOL(kernel_listen); 3479 3480 /** 3481 * kernel_accept - accept a connection (kernel space) 3482 * @sock: listening socket 3483 * @newsock: new connected socket 3484 * @flags: flags 3485 * 3486 * @flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0. 3487 * If it fails, @newsock is guaranteed to be %NULL. 3488 * Returns 0 or an error. 3489 */ 3490 3491 int kernel_accept(struct socket *sock, struct socket **newsock, int flags) 3492 { 3493 struct sock *sk = sock->sk; 3494 int err; 3495 3496 err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol, 3497 newsock); 3498 if (err < 0) 3499 goto done; 3500 3501 err = sock->ops->accept(sock, *newsock, flags, true); 3502 if (err < 0) { 3503 sock_release(*newsock); 3504 *newsock = NULL; 3505 goto done; 3506 } 3507 3508 (*newsock)->ops = sock->ops; 3509 __module_get((*newsock)->ops->owner); 3510 3511 done: 3512 return err; 3513 } 3514 EXPORT_SYMBOL(kernel_accept); 3515 3516 /** 3517 * kernel_connect - connect a socket (kernel space) 3518 * @sock: socket 3519 * @addr: address 3520 * @addrlen: address length 3521 * @flags: flags (O_NONBLOCK, ...) 3522 * 3523 * For datagram sockets, @addr is the address to which datagrams are sent 3524 * by default, and the only address from which datagrams are received. 3525 * For stream sockets, attempts to connect to @addr. 3526 * Returns 0 or an error code. 3527 */ 3528 3529 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen, 3530 int flags) 3531 { 3532 return sock->ops->connect(sock, addr, addrlen, flags); 3533 } 3534 EXPORT_SYMBOL(kernel_connect); 3535 3536 /** 3537 * kernel_getsockname - get the address which the socket is bound (kernel space) 3538 * @sock: socket 3539 * @addr: address holder 3540 * 3541 * Fills the @addr pointer with the address which the socket is bound. 3542 * Returns the length of the address in bytes or an error code. 3543 */ 3544 3545 int kernel_getsockname(struct socket *sock, struct sockaddr *addr) 3546 { 3547 return sock->ops->getname(sock, addr, 0); 3548 } 3549 EXPORT_SYMBOL(kernel_getsockname); 3550 3551 /** 3552 * kernel_getpeername - get the address which the socket is connected (kernel space) 3553 * @sock: socket 3554 * @addr: address holder 3555 * 3556 * Fills the @addr pointer with the address which the socket is connected. 3557 * Returns the length of the address in bytes or an error code. 3558 */ 3559 3560 int kernel_getpeername(struct socket *sock, struct sockaddr *addr) 3561 { 3562 return sock->ops->getname(sock, addr, 1); 3563 } 3564 EXPORT_SYMBOL(kernel_getpeername); 3565 3566 /** 3567 * kernel_sendpage - send a &page through a socket (kernel space) 3568 * @sock: socket 3569 * @page: page 3570 * @offset: page offset 3571 * @size: total size in bytes 3572 * @flags: flags (MSG_DONTWAIT, ...) 3573 * 3574 * Returns the total amount sent in bytes or an error. 3575 */ 3576 3577 int kernel_sendpage(struct socket *sock, struct page *page, int offset, 3578 size_t size, int flags) 3579 { 3580 if (sock->ops->sendpage) { 3581 /* Warn in case the improper page to zero-copy send */ 3582 WARN_ONCE(!sendpage_ok(page), "improper page for zero-copy send"); 3583 return sock->ops->sendpage(sock, page, offset, size, flags); 3584 } 3585 return sock_no_sendpage(sock, page, offset, size, flags); 3586 } 3587 EXPORT_SYMBOL(kernel_sendpage); 3588 3589 /** 3590 * kernel_sendpage_locked - send a &page through the locked sock (kernel space) 3591 * @sk: sock 3592 * @page: page 3593 * @offset: page offset 3594 * @size: total size in bytes 3595 * @flags: flags (MSG_DONTWAIT, ...) 3596 * 3597 * Returns the total amount sent in bytes or an error. 3598 * Caller must hold @sk. 3599 */ 3600 3601 int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset, 3602 size_t size, int flags) 3603 { 3604 struct socket *sock = sk->sk_socket; 3605 3606 if (sock->ops->sendpage_locked) 3607 return sock->ops->sendpage_locked(sk, page, offset, size, 3608 flags); 3609 3610 return sock_no_sendpage_locked(sk, page, offset, size, flags); 3611 } 3612 EXPORT_SYMBOL(kernel_sendpage_locked); 3613 3614 /** 3615 * kernel_sock_shutdown - shut down part of a full-duplex connection (kernel space) 3616 * @sock: socket 3617 * @how: connection part 3618 * 3619 * Returns 0 or an error. 3620 */ 3621 3622 int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how) 3623 { 3624 return sock->ops->shutdown(sock, how); 3625 } 3626 EXPORT_SYMBOL(kernel_sock_shutdown); 3627 3628 /** 3629 * kernel_sock_ip_overhead - returns the IP overhead imposed by a socket 3630 * @sk: socket 3631 * 3632 * This routine returns the IP overhead imposed by a socket i.e. 3633 * the length of the underlying IP header, depending on whether 3634 * this is an IPv4 or IPv6 socket and the length from IP options turned 3635 * on at the socket. Assumes that the caller has a lock on the socket. 3636 */ 3637 3638 u32 kernel_sock_ip_overhead(struct sock *sk) 3639 { 3640 struct inet_sock *inet; 3641 struct ip_options_rcu *opt; 3642 u32 overhead = 0; 3643 #if IS_ENABLED(CONFIG_IPV6) 3644 struct ipv6_pinfo *np; 3645 struct ipv6_txoptions *optv6 = NULL; 3646 #endif /* IS_ENABLED(CONFIG_IPV6) */ 3647 3648 if (!sk) 3649 return overhead; 3650 3651 switch (sk->sk_family) { 3652 case AF_INET: 3653 inet = inet_sk(sk); 3654 overhead += sizeof(struct iphdr); 3655 opt = rcu_dereference_protected(inet->inet_opt, 3656 sock_owned_by_user(sk)); 3657 if (opt) 3658 overhead += opt->opt.optlen; 3659 return overhead; 3660 #if IS_ENABLED(CONFIG_IPV6) 3661 case AF_INET6: 3662 np = inet6_sk(sk); 3663 overhead += sizeof(struct ipv6hdr); 3664 if (np) 3665 optv6 = rcu_dereference_protected(np->opt, 3666 sock_owned_by_user(sk)); 3667 if (optv6) 3668 overhead += (optv6->opt_flen + optv6->opt_nflen); 3669 return overhead; 3670 #endif /* IS_ENABLED(CONFIG_IPV6) */ 3671 default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */ 3672 return overhead; 3673 } 3674 } 3675 EXPORT_SYMBOL(kernel_sock_ip_overhead); 3676