Back to home page

LXR

 
 

    


0001 /*
0002  * NET      An implementation of the SOCKET network access protocol.
0003  *
0004  * Version: @(#)socket.c    1.1.93  18/02/95
0005  *
0006  * Authors: Orest Zborowski, <obz@Kodak.COM>
0007  *      Ross Biro
0008  *      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
0009  *
0010  * Fixes:
0011  *      Anonymous   :   NOTSOCK/BADF cleanup. Error fix in
0012  *                  shutdown()
0013  *      Alan Cox    :   verify_area() fixes
0014  *      Alan Cox    :   Removed DDI
0015  *      Jonathan Kamens :   SOCK_DGRAM reconnect bug
0016  *      Alan Cox    :   Moved a load of checks to the very
0017  *                  top level.
0018  *      Alan Cox    :   Move address structures to/from user
0019  *                  mode above the protocol layers.
0020  *      Rob Janssen :   Allow 0 length sends.
0021  *      Alan Cox    :   Asynchronous I/O support (cribbed from the
0022  *                  tty drivers).
0023  *      Niibe Yutaka    :   Asynchronous I/O for writes (4.4BSD style)
0024  *      Jeff Uphoff :   Made max number of sockets command-line
0025  *                  configurable.
0026  *      Matti Aarnio    :   Made the number of sockets dynamic,
0027  *                  to be allocated when needed, and mr.
0028  *                  Uphoff's max is used as max to be
0029  *                  allowed to allocate.
0030  *      Linus       :   Argh. removed all the socket allocation
0031  *                  altogether: it's in the inode now.
0032  *      Alan Cox    :   Made sock_alloc()/sock_release() public
0033  *                  for NetROM and future kernel nfsd type
0034  *                  stuff.
0035  *      Alan Cox    :   sendmsg/recvmsg basics.
0036  *      Tom Dyas    :   Export net symbols.
0037  *      Marcin Dalecki  :   Fixed problems with CONFIG_NET="n".
0038  *      Alan Cox    :   Added thread locking to sys_* calls
0039  *                  for sockets. May have errors at the
0040  *                  moment.
0041  *      Kevin Buhr  :   Fixed the dumb errors in the above.
0042  *      Andi Kleen  :   Some small cleanups, optimizations,
0043  *                  and fixed a copy_from_user() bug.
0044  *      Tigran Aivazian :   sys_send(args) calls sys_sendto(args, NULL, 0)
0045  *      Tigran Aivazian :   Made listen(2) backlog sanity checks
0046  *                  protocol-independent
0047  *
0048  *
0049  *      This program is free software; you can redistribute it and/or
0050  *      modify it under the terms of the GNU General Public License
0051  *      as published by the Free Software Foundation; either version
0052  *      2 of the License, or (at your option) any later version.
0053  *
0054  *
0055  *  This module is effectively the top level interface to the BSD socket
0056  *  paradigm.
0057  *
0058  *  Based upon Swansea University Computer Society NET3.039
0059  */
0060 
0061 #include <linux/mm.h>
0062 #include <linux/socket.h>
0063 #include <linux/file.h>
0064 #include <linux/net.h>
0065 #include <linux/interrupt.h>
0066 #include <linux/thread_info.h>
0067 #include <linux/rcupdate.h>
0068 #include <linux/netdevice.h>
0069 #include <linux/proc_fs.h>
0070 #include <linux/seq_file.h>
0071 #include <linux/mutex.h>
0072 #include <linux/if_bridge.h>
0073 #include <linux/if_frad.h>
0074 #include <linux/if_vlan.h>
0075 #include <linux/ptp_classify.h>
0076 #include <linux/init.h>
0077 #include <linux/poll.h>
0078 #include <linux/cache.h>
0079 #include <linux/module.h>
0080 #include <linux/highmem.h>
0081 #include <linux/mount.h>
0082 #include <linux/security.h>
0083 #include <linux/syscalls.h>
0084 #include <linux/compat.h>
0085 #include <linux/kmod.h>
0086 #include <linux/audit.h>
0087 #include <linux/wireless.h>
0088 #include <linux/nsproxy.h>
0089 #include <linux/magic.h>
0090 #include <linux/slab.h>
0091 #include <linux/xattr.h>
0092 
0093 #include <linux/uaccess.h>
0094 #include <asm/unistd.h>
0095 
0096 #include <net/compat.h>
0097 #include <net/wext.h>
0098 #include <net/cls_cgroup.h>
0099 
0100 #include <net/sock.h>
0101 #include <linux/netfilter.h>
0102 
0103 #include <linux/if_tun.h>
0104 #include <linux/ipv6_route.h>
0105 #include <linux/route.h>
0106 #include <linux/sockios.h>
0107 #include <linux/atalk.h>
0108 #include <net/busy_poll.h>
0109 #include <linux/errqueue.h>
0110 
0111 #ifdef CONFIG_NET_RX_BUSY_POLL
0112 unsigned int sysctl_net_busy_read __read_mostly;
0113 unsigned int sysctl_net_busy_poll __read_mostly;
0114 #endif
0115 
0116 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
0117 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
0118 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
0119 
0120 static int sock_close(struct inode *inode, struct file *file);
0121 static unsigned int sock_poll(struct file *file,
0122                   struct poll_table_struct *wait);
0123 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
0124 #ifdef CONFIG_COMPAT
0125 static long compat_sock_ioctl(struct file *file,
0126                   unsigned int cmd, unsigned long arg);
0127 #endif
0128 static int sock_fasync(int fd, struct file *filp, int on);
0129 static ssize_t sock_sendpage(struct file *file, struct page *page,
0130                  int offset, size_t size, loff_t *ppos, int more);
0131 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
0132                 struct pipe_inode_info *pipe, size_t len,
0133                 unsigned int flags);
0134 
0135 /*
0136  *  Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
0137  *  in the operation structures but are done directly via the socketcall() multiplexor.
0138  */
0139 
0140 static const struct file_operations socket_file_ops = {
0141     .owner =    THIS_MODULE,
0142     .llseek =   no_llseek,
0143     .read_iter =    sock_read_iter,
0144     .write_iter =   sock_write_iter,
0145     .poll =     sock_poll,
0146     .unlocked_ioctl = sock_ioctl,
0147 #ifdef CONFIG_COMPAT
0148     .compat_ioctl = compat_sock_ioctl,
0149 #endif
0150     .mmap =     sock_mmap,
0151     .release =  sock_close,
0152     .fasync =   sock_fasync,
0153     .sendpage = sock_sendpage,
0154     .splice_write = generic_splice_sendpage,
0155     .splice_read =  sock_splice_read,
0156 };
0157 
0158 /*
0159  *  The protocol list. Each protocol is registered in here.
0160  */
0161 
0162 static DEFINE_SPINLOCK(net_family_lock);
0163 static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
0164 
0165 /*
0166  *  Statistics counters of the socket lists
0167  */
0168 
0169 static DEFINE_PER_CPU(int, sockets_in_use);
0170 
0171 /*
0172  * Support routines.
0173  * Move socket addresses back and forth across the kernel/user
0174  * divide and look after the messy bits.
0175  */
0176 
0177 /**
0178  *  move_addr_to_kernel -   copy a socket address into kernel space
0179  *  @uaddr: Address in user space
0180  *  @kaddr: Address in kernel space
0181  *  @ulen: Length in user space
0182  *
0183  *  The address is copied into kernel space. If the provided address is
0184  *  too long an error code of -EINVAL is returned. If the copy gives
0185  *  invalid addresses -EFAULT is returned. On a success 0 is returned.
0186  */
0187 
0188 int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
0189 {
0190     if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
0191         return -EINVAL;
0192     if (ulen == 0)
0193         return 0;
0194     if (copy_from_user(kaddr, uaddr, ulen))
0195         return -EFAULT;
0196     return audit_sockaddr(ulen, kaddr);
0197 }
0198 
0199 /**
0200  *  move_addr_to_user   -   copy an address to user space
0201  *  @kaddr: kernel space address
0202  *  @klen: length of address in kernel
0203  *  @uaddr: user space address
0204  *  @ulen: pointer to user length field
0205  *
0206  *  The value pointed to by ulen on entry is the buffer length available.
0207  *  This is overwritten with the buffer space used. -EINVAL is returned
0208  *  if an overlong buffer is specified or a negative buffer size. -EFAULT
0209  *  is returned if either the buffer or the length field are not
0210  *  accessible.
0211  *  After copying the data up to the limit the user specifies, the true
0212  *  length of the data is written over the length limit the user
0213  *  specified. Zero is returned for a success.
0214  */
0215 
0216 static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
0217                  void __user *uaddr, int __user *ulen)
0218 {
0219     int err;
0220     int len;
0221 
0222     BUG_ON(klen > sizeof(struct sockaddr_storage));
0223     err = get_user(len, ulen);
0224     if (err)
0225         return err;
0226     if (len > klen)
0227         len = klen;
0228     if (len < 0)
0229         return -EINVAL;
0230     if (len) {
0231         if (audit_sockaddr(klen, kaddr))
0232             return -ENOMEM;
0233         if (copy_to_user(uaddr, kaddr, len))
0234             return -EFAULT;
0235     }
0236     /*
0237      *      "fromlen shall refer to the value before truncation.."
0238      *                      1003.1g
0239      */
0240     return __put_user(klen, ulen);
0241 }
0242 
0243 static struct kmem_cache *sock_inode_cachep __read_mostly;
0244 
0245 static struct inode *sock_alloc_inode(struct super_block *sb)
0246 {
0247     struct socket_alloc *ei;
0248     struct socket_wq *wq;
0249 
0250     ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
0251     if (!ei)
0252         return NULL;
0253     wq = kmalloc(sizeof(*wq), GFP_KERNEL);
0254     if (!wq) {
0255         kmem_cache_free(sock_inode_cachep, ei);
0256         return NULL;
0257     }
0258     init_waitqueue_head(&wq->wait);
0259     wq->fasync_list = NULL;
0260     wq->flags = 0;
0261     RCU_INIT_POINTER(ei->socket.wq, wq);
0262 
0263     ei->socket.state = SS_UNCONNECTED;
0264     ei->socket.flags = 0;
0265     ei->socket.ops = NULL;
0266     ei->socket.sk = NULL;
0267     ei->socket.file = NULL;
0268 
0269     return &ei->vfs_inode;
0270 }
0271 
0272 static void sock_destroy_inode(struct inode *inode)
0273 {
0274     struct socket_alloc *ei;
0275     struct socket_wq *wq;
0276 
0277     ei = container_of(inode, struct socket_alloc, vfs_inode);
0278     wq = rcu_dereference_protected(ei->socket.wq, 1);
0279     kfree_rcu(wq, rcu);
0280     kmem_cache_free(sock_inode_cachep, ei);
0281 }
0282 
0283 static void init_once(void *foo)
0284 {
0285     struct socket_alloc *ei = (struct socket_alloc *)foo;
0286 
0287     inode_init_once(&ei->vfs_inode);
0288 }
0289 
0290 static int init_inodecache(void)
0291 {
0292     sock_inode_cachep = kmem_cache_create("sock_inode_cache",
0293                           sizeof(struct socket_alloc),
0294                           0,
0295                           (SLAB_HWCACHE_ALIGN |
0296                            SLAB_RECLAIM_ACCOUNT |
0297                            SLAB_MEM_SPREAD | SLAB_ACCOUNT),
0298                           init_once);
0299     if (sock_inode_cachep == NULL)
0300         return -ENOMEM;
0301     return 0;
0302 }
0303 
0304 static const struct super_operations sockfs_ops = {
0305     .alloc_inode    = sock_alloc_inode,
0306     .destroy_inode  = sock_destroy_inode,
0307     .statfs     = simple_statfs,
0308 };
0309 
0310 /*
0311  * sockfs_dname() is called from d_path().
0312  */
0313 static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
0314 {
0315     return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
0316                 d_inode(dentry)->i_ino);
0317 }
0318 
0319 static const struct dentry_operations sockfs_dentry_operations = {
0320     .d_dname  = sockfs_dname,
0321 };
0322 
0323 static int sockfs_xattr_get(const struct xattr_handler *handler,
0324                 struct dentry *dentry, struct inode *inode,
0325                 const char *suffix, void *value, size_t size)
0326 {
0327     if (value) {
0328         if (dentry->d_name.len + 1 > size)
0329             return -ERANGE;
0330         memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
0331     }
0332     return dentry->d_name.len + 1;
0333 }
0334 
0335 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
0336 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
0337 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
0338 
0339 static const struct xattr_handler sockfs_xattr_handler = {
0340     .name = XATTR_NAME_SOCKPROTONAME,
0341     .get = sockfs_xattr_get,
0342 };
0343 
0344 static int sockfs_security_xattr_set(const struct xattr_handler *handler,
0345                      struct dentry *dentry, struct inode *inode,
0346                      const char *suffix, const void *value,
0347                      size_t size, int flags)
0348 {
0349     /* Handled by LSM. */
0350     return -EAGAIN;
0351 }
0352 
0353 static const struct xattr_handler sockfs_security_xattr_handler = {
0354     .prefix = XATTR_SECURITY_PREFIX,
0355     .set = sockfs_security_xattr_set,
0356 };
0357 
0358 static const struct xattr_handler *sockfs_xattr_handlers[] = {
0359     &sockfs_xattr_handler,
0360     &sockfs_security_xattr_handler,
0361     NULL
0362 };
0363 
0364 static struct dentry *sockfs_mount(struct file_system_type *fs_type,
0365              int flags, const char *dev_name, void *data)
0366 {
0367     return mount_pseudo_xattr(fs_type, "socket:", &sockfs_ops,
0368                   sockfs_xattr_handlers,
0369                   &sockfs_dentry_operations, SOCKFS_MAGIC);
0370 }
0371 
0372 static struct vfsmount *sock_mnt __read_mostly;
0373 
0374 static struct file_system_type sock_fs_type = {
0375     .name =     "sockfs",
0376     .mount =    sockfs_mount,
0377     .kill_sb =  kill_anon_super,
0378 };
0379 
0380 /*
0381  *  Obtains the first available file descriptor and sets it up for use.
0382  *
0383  *  These functions create file structures and maps them to fd space
0384  *  of the current process. On success it returns file descriptor
0385  *  and file struct implicitly stored in sock->file.
0386  *  Note that another thread may close file descriptor before we return
0387  *  from this function. We use the fact that now we do not refer
0388  *  to socket after mapping. If one day we will need it, this
0389  *  function will increment ref. count on file by 1.
0390  *
0391  *  In any case returned fd MAY BE not valid!
0392  *  This race condition is unavoidable
0393  *  with shared fd spaces, we cannot solve it inside kernel,
0394  *  but we take care of internal coherence yet.
0395  */
0396 
0397 struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
0398 {
0399     struct qstr name = { .name = "" };
0400     struct path path;
0401     struct file *file;
0402 
0403     if (dname) {
0404         name.name = dname;
0405         name.len = strlen(name.name);
0406     } else if (sock->sk) {
0407         name.name = sock->sk->sk_prot_creator->name;
0408         name.len = strlen(name.name);
0409     }
0410     path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
0411     if (unlikely(!path.dentry))
0412         return ERR_PTR(-ENOMEM);
0413     path.mnt = mntget(sock_mnt);
0414 
0415     d_instantiate(path.dentry, SOCK_INODE(sock));
0416 
0417     file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
0418           &socket_file_ops);
0419     if (IS_ERR(file)) {
0420         /* drop dentry, keep inode */
0421         ihold(d_inode(path.dentry));
0422         path_put(&path);
0423         return file;
0424     }
0425 
0426     sock->file = file;
0427     file->f_flags = O_RDWR | (flags & O_NONBLOCK);
0428     file->private_data = sock;
0429     return file;
0430 }
0431 EXPORT_SYMBOL(sock_alloc_file);
0432 
0433 static int sock_map_fd(struct socket *sock, int flags)
0434 {
0435     struct file *newfile;
0436     int fd = get_unused_fd_flags(flags);
0437     if (unlikely(fd < 0))
0438         return fd;
0439 
0440     newfile = sock_alloc_file(sock, flags, NULL);
0441     if (likely(!IS_ERR(newfile))) {
0442         fd_install(fd, newfile);
0443         return fd;
0444     }
0445 
0446     put_unused_fd(fd);
0447     return PTR_ERR(newfile);
0448 }
0449 
0450 struct socket *sock_from_file(struct file *file, int *err)
0451 {
0452     if (file->f_op == &socket_file_ops)
0453         return file->private_data;  /* set in sock_map_fd */
0454 
0455     *err = -ENOTSOCK;
0456     return NULL;
0457 }
0458 EXPORT_SYMBOL(sock_from_file);
0459 
0460 /**
0461  *  sockfd_lookup - Go from a file number to its socket slot
0462  *  @fd: file handle
0463  *  @err: pointer to an error code return
0464  *
0465  *  The file handle passed in is locked and the socket it is bound
0466  *  too is returned. If an error occurs the err pointer is overwritten
0467  *  with a negative errno code and NULL is returned. The function checks
0468  *  for both invalid handles and passing a handle which is not a socket.
0469  *
0470  *  On a success the socket object pointer is returned.
0471  */
0472 
0473 struct socket *sockfd_lookup(int fd, int *err)
0474 {
0475     struct file *file;
0476     struct socket *sock;
0477 
0478     file = fget(fd);
0479     if (!file) {
0480         *err = -EBADF;
0481         return NULL;
0482     }
0483 
0484     sock = sock_from_file(file, err);
0485     if (!sock)
0486         fput(file);
0487     return sock;
0488 }
0489 EXPORT_SYMBOL(sockfd_lookup);
0490 
0491 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
0492 {
0493     struct fd f = fdget(fd);
0494     struct socket *sock;
0495 
0496     *err = -EBADF;
0497     if (f.file) {
0498         sock = sock_from_file(f.file, err);
0499         if (likely(sock)) {
0500             *fput_needed = f.flags;
0501             return sock;
0502         }
0503         fdput(f);
0504     }
0505     return NULL;
0506 }
0507 
0508 static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
0509                 size_t size)
0510 {
0511     ssize_t len;
0512     ssize_t used = 0;
0513 
0514     len = security_inode_listsecurity(d_inode(dentry), buffer, size);
0515     if (len < 0)
0516         return len;
0517     used += len;
0518     if (buffer) {
0519         if (size < used)
0520             return -ERANGE;
0521         buffer += len;
0522     }
0523 
0524     len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
0525     used += len;
0526     if (buffer) {
0527         if (size < used)
0528             return -ERANGE;
0529         memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
0530         buffer += len;
0531     }
0532 
0533     return used;
0534 }
0535 
0536 static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
0537 {
0538     int err = simple_setattr(dentry, iattr);
0539 
0540     if (!err && (iattr->ia_valid & ATTR_UID)) {
0541         struct socket *sock = SOCKET_I(d_inode(dentry));
0542 
0543         sock->sk->sk_uid = iattr->ia_uid;
0544     }
0545 
0546     return err;
0547 }
0548 
0549 static const struct inode_operations sockfs_inode_ops = {
0550     .listxattr = sockfs_listxattr,
0551     .setattr = sockfs_setattr,
0552 };
0553 
0554 /**
0555  *  sock_alloc  -   allocate a socket
0556  *
0557  *  Allocate a new inode and socket object. The two are bound together
0558  *  and initialised. The socket is then returned. If we are out of inodes
0559  *  NULL is returned.
0560  */
0561 
0562 struct socket *sock_alloc(void)
0563 {
0564     struct inode *inode;
0565     struct socket *sock;
0566 
0567     inode = new_inode_pseudo(sock_mnt->mnt_sb);
0568     if (!inode)
0569         return NULL;
0570 
0571     sock = SOCKET_I(inode);
0572 
0573     kmemcheck_annotate_bitfield(sock, type);
0574     inode->i_ino = get_next_ino();
0575     inode->i_mode = S_IFSOCK | S_IRWXUGO;
0576     inode->i_uid = current_fsuid();
0577     inode->i_gid = current_fsgid();
0578     inode->i_op = &sockfs_inode_ops;
0579 
0580     this_cpu_add(sockets_in_use, 1);
0581     return sock;
0582 }
0583 EXPORT_SYMBOL(sock_alloc);
0584 
0585 /**
0586  *  sock_release    -   close a socket
0587  *  @sock: socket to close
0588  *
0589  *  The socket is released from the protocol stack if it has a release
0590  *  callback, and the inode is then released if the socket is bound to
0591  *  an inode not a file.
0592  */
0593 
0594 void sock_release(struct socket *sock)
0595 {
0596     if (sock->ops) {
0597         struct module *owner = sock->ops->owner;
0598 
0599         sock->ops->release(sock);
0600         sock->ops = NULL;
0601         module_put(owner);
0602     }
0603 
0604     if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
0605         pr_err("%s: fasync list not empty!\n", __func__);
0606 
0607     this_cpu_sub(sockets_in_use, 1);
0608     if (!sock->file) {
0609         iput(SOCK_INODE(sock));
0610         return;
0611     }
0612     sock->file = NULL;
0613 }
0614 EXPORT_SYMBOL(sock_release);
0615 
0616 void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
0617 {
0618     u8 flags = *tx_flags;
0619 
0620     if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
0621         flags |= SKBTX_HW_TSTAMP;
0622 
0623     if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
0624         flags |= SKBTX_SW_TSTAMP;
0625 
0626     if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
0627         flags |= SKBTX_SCHED_TSTAMP;
0628 
0629     *tx_flags = flags;
0630 }
0631 EXPORT_SYMBOL(__sock_tx_timestamp);
0632 
0633 static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
0634 {
0635     int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
0636     BUG_ON(ret == -EIOCBQUEUED);
0637     return ret;
0638 }
0639 
0640 int sock_sendmsg(struct socket *sock, struct msghdr *msg)
0641 {
0642     int err = security_socket_sendmsg(sock, msg,
0643                       msg_data_left(msg));
0644 
0645     return err ?: sock_sendmsg_nosec(sock, msg);
0646 }
0647 EXPORT_SYMBOL(sock_sendmsg);
0648 
0649 int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
0650            struct kvec *vec, size_t num, size_t size)
0651 {
0652     iov_iter_kvec(&msg->msg_iter, WRITE | ITER_KVEC, vec, num, size);
0653     return sock_sendmsg(sock, msg);
0654 }
0655 EXPORT_SYMBOL(kernel_sendmsg);
0656 
0657 /*
0658  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
0659  */
0660 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
0661     struct sk_buff *skb)
0662 {
0663     int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
0664     struct scm_timestamping tss;
0665     int empty = 1;
0666     struct skb_shared_hwtstamps *shhwtstamps =
0667         skb_hwtstamps(skb);
0668 
0669     /* Race occurred between timestamp enabling and packet
0670        receiving.  Fill in the current time for now. */
0671     if (need_software_tstamp && skb->tstamp == 0)
0672         __net_timestamp(skb);
0673 
0674     if (need_software_tstamp) {
0675         if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
0676             struct timeval tv;
0677             skb_get_timestamp(skb, &tv);
0678             put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
0679                  sizeof(tv), &tv);
0680         } else {
0681             struct timespec ts;
0682             skb_get_timestampns(skb, &ts);
0683             put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
0684                  sizeof(ts), &ts);
0685         }
0686     }
0687 
0688     memset(&tss, 0, sizeof(tss));
0689     if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
0690         ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
0691         empty = 0;
0692     if (shhwtstamps &&
0693         (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
0694         ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
0695         empty = 0;
0696     if (!empty) {
0697         put_cmsg(msg, SOL_SOCKET,
0698              SCM_TIMESTAMPING, sizeof(tss), &tss);
0699 
0700         if (skb->len && (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS))
0701             put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
0702                  skb->len, skb->data);
0703     }
0704 }
0705 EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
0706 
0707 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
0708     struct sk_buff *skb)
0709 {
0710     int ack;
0711 
0712     if (!sock_flag(sk, SOCK_WIFI_STATUS))
0713         return;
0714     if (!skb->wifi_acked_valid)
0715         return;
0716 
0717     ack = skb->wifi_acked;
0718 
0719     put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
0720 }
0721 EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
0722 
0723 static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
0724                    struct sk_buff *skb)
0725 {
0726     if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
0727         put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
0728             sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
0729 }
0730 
0731 void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
0732     struct sk_buff *skb)
0733 {
0734     sock_recv_timestamp(msg, sk, skb);
0735     sock_recv_drops(msg, sk, skb);
0736 }
0737 EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
0738 
0739 static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
0740                      int flags)
0741 {
0742     return sock->ops->recvmsg(sock, msg, msg_data_left(msg), flags);
0743 }
0744 
0745 int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
0746 {
0747     int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
0748 
0749     return err ?: sock_recvmsg_nosec(sock, msg, flags);
0750 }
0751 EXPORT_SYMBOL(sock_recvmsg);
0752 
0753 /**
0754  * kernel_recvmsg - Receive a message from a socket (kernel space)
0755  * @sock:       The socket to receive the message from
0756  * @msg:        Received message
0757  * @vec:        Input s/g array for message data
0758  * @num:        Size of input s/g array
0759  * @size:       Number of bytes to read
0760  * @flags:      Message flags (MSG_DONTWAIT, etc...)
0761  *
0762  * On return the msg structure contains the scatter/gather array passed in the
0763  * vec argument. The array is modified so that it consists of the unfilled
0764  * portion of the original array.
0765  *
0766  * The returned value is the total number of bytes received, or an error.
0767  */
0768 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
0769            struct kvec *vec, size_t num, size_t size, int flags)
0770 {
0771     mm_segment_t oldfs = get_fs();
0772     int result;
0773 
0774     iov_iter_kvec(&msg->msg_iter, READ | ITER_KVEC, vec, num, size);
0775     set_fs(KERNEL_DS);
0776     result = sock_recvmsg(sock, msg, flags);
0777     set_fs(oldfs);
0778     return result;
0779 }
0780 EXPORT_SYMBOL(kernel_recvmsg);
0781 
0782 static ssize_t sock_sendpage(struct file *file, struct page *page,
0783                  int offset, size_t size, loff_t *ppos, int more)
0784 {
0785     struct socket *sock;
0786     int flags;
0787 
0788     sock = file->private_data;
0789 
0790     flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
0791     /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
0792     flags |= more;
0793 
0794     return kernel_sendpage(sock, page, offset, size, flags);
0795 }
0796 
0797 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
0798                 struct pipe_inode_info *pipe, size_t len,
0799                 unsigned int flags)
0800 {
0801     struct socket *sock = file->private_data;
0802 
0803     if (unlikely(!sock->ops->splice_read))
0804         return -EINVAL;
0805 
0806     return sock->ops->splice_read(sock, ppos, pipe, len, flags);
0807 }
0808 
0809 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
0810 {
0811     struct file *file = iocb->ki_filp;
0812     struct socket *sock = file->private_data;
0813     struct msghdr msg = {.msg_iter = *to,
0814                  .msg_iocb = iocb};
0815     ssize_t res;
0816 
0817     if (file->f_flags & O_NONBLOCK)
0818         msg.msg_flags = MSG_DONTWAIT;
0819 
0820     if (iocb->ki_pos != 0)
0821         return -ESPIPE;
0822 
0823     if (!iov_iter_count(to))    /* Match SYS5 behaviour */
0824         return 0;
0825 
0826     res = sock_recvmsg(sock, &msg, msg.msg_flags);
0827     *to = msg.msg_iter;
0828     return res;
0829 }
0830 
0831 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
0832 {
0833     struct file *file = iocb->ki_filp;
0834     struct socket *sock = file->private_data;
0835     struct msghdr msg = {.msg_iter = *from,
0836                  .msg_iocb = iocb};
0837     ssize_t res;
0838 
0839     if (iocb->ki_pos != 0)
0840         return -ESPIPE;
0841 
0842     if (file->f_flags & O_NONBLOCK)
0843         msg.msg_flags = MSG_DONTWAIT;
0844 
0845     if (sock->type == SOCK_SEQPACKET)
0846         msg.msg_flags |= MSG_EOR;
0847 
0848     res = sock_sendmsg(sock, &msg);
0849     *from = msg.msg_iter;
0850     return res;
0851 }
0852 
0853 /*
0854  * Atomic setting of ioctl hooks to avoid race
0855  * with module unload.
0856  */
0857 
0858 static DEFINE_MUTEX(br_ioctl_mutex);
0859 static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
0860 
0861 void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
0862 {
0863     mutex_lock(&br_ioctl_mutex);
0864     br_ioctl_hook = hook;
0865     mutex_unlock(&br_ioctl_mutex);
0866 }
0867 EXPORT_SYMBOL(brioctl_set);
0868 
0869 static DEFINE_MUTEX(vlan_ioctl_mutex);
0870 static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
0871 
0872 void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
0873 {
0874     mutex_lock(&vlan_ioctl_mutex);
0875     vlan_ioctl_hook = hook;
0876     mutex_unlock(&vlan_ioctl_mutex);
0877 }
0878 EXPORT_SYMBOL(vlan_ioctl_set);
0879 
0880 static DEFINE_MUTEX(dlci_ioctl_mutex);
0881 static int (*dlci_ioctl_hook) (unsigned int, void __user *);
0882 
0883 void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
0884 {
0885     mutex_lock(&dlci_ioctl_mutex);
0886     dlci_ioctl_hook = hook;
0887     mutex_unlock(&dlci_ioctl_mutex);
0888 }
0889 EXPORT_SYMBOL(dlci_ioctl_set);
0890 
0891 static long sock_do_ioctl(struct net *net, struct socket *sock,
0892                  unsigned int cmd, unsigned long arg)
0893 {
0894     int err;
0895     void __user *argp = (void __user *)arg;
0896 
0897     err = sock->ops->ioctl(sock, cmd, arg);
0898 
0899     /*
0900      * If this ioctl is unknown try to hand it down
0901      * to the NIC driver.
0902      */
0903     if (err == -ENOIOCTLCMD)
0904         err = dev_ioctl(net, cmd, argp);
0905 
0906     return err;
0907 }
0908 
0909 /*
0910  *  With an ioctl, arg may well be a user mode pointer, but we don't know
0911  *  what to do with it - that's up to the protocol still.
0912  */
0913 
0914 static struct ns_common *get_net_ns(struct ns_common *ns)
0915 {
0916     return &get_net(container_of(ns, struct net, ns))->ns;
0917 }
0918 
0919 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
0920 {
0921     struct socket *sock;
0922     struct sock *sk;
0923     void __user *argp = (void __user *)arg;
0924     int pid, err;
0925     struct net *net;
0926 
0927     sock = file->private_data;
0928     sk = sock->sk;
0929     net = sock_net(sk);
0930     if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
0931         err = dev_ioctl(net, cmd, argp);
0932     } else
0933 #ifdef CONFIG_WEXT_CORE
0934     if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
0935         err = dev_ioctl(net, cmd, argp);
0936     } else
0937 #endif
0938         switch (cmd) {
0939         case FIOSETOWN:
0940         case SIOCSPGRP:
0941             err = -EFAULT;
0942             if (get_user(pid, (int __user *)argp))
0943                 break;
0944             f_setown(sock->file, pid, 1);
0945             err = 0;
0946             break;
0947         case FIOGETOWN:
0948         case SIOCGPGRP:
0949             err = put_user(f_getown(sock->file),
0950                        (int __user *)argp);
0951             break;
0952         case SIOCGIFBR:
0953         case SIOCSIFBR:
0954         case SIOCBRADDBR:
0955         case SIOCBRDELBR:
0956             err = -ENOPKG;
0957             if (!br_ioctl_hook)
0958                 request_module("bridge");
0959 
0960             mutex_lock(&br_ioctl_mutex);
0961             if (br_ioctl_hook)
0962                 err = br_ioctl_hook(net, cmd, argp);
0963             mutex_unlock(&br_ioctl_mutex);
0964             break;
0965         case SIOCGIFVLAN:
0966         case SIOCSIFVLAN:
0967             err = -ENOPKG;
0968             if (!vlan_ioctl_hook)
0969                 request_module("8021q");
0970 
0971             mutex_lock(&vlan_ioctl_mutex);
0972             if (vlan_ioctl_hook)
0973                 err = vlan_ioctl_hook(net, argp);
0974             mutex_unlock(&vlan_ioctl_mutex);
0975             break;
0976         case SIOCADDDLCI:
0977         case SIOCDELDLCI:
0978             err = -ENOPKG;
0979             if (!dlci_ioctl_hook)
0980                 request_module("dlci");
0981 
0982             mutex_lock(&dlci_ioctl_mutex);
0983             if (dlci_ioctl_hook)
0984                 err = dlci_ioctl_hook(cmd, argp);
0985             mutex_unlock(&dlci_ioctl_mutex);
0986             break;
0987         case SIOCGSKNS:
0988             err = -EPERM;
0989             if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
0990                 break;
0991 
0992             err = open_related_ns(&net->ns, get_net_ns);
0993             break;
0994         default:
0995             err = sock_do_ioctl(net, sock, cmd, arg);
0996             break;
0997         }
0998     return err;
0999 }
1000 
1001 int sock_create_lite(int family, int type, int protocol, struct socket **res)
1002 {
1003     int err;
1004     struct socket *sock = NULL;
1005 
1006     err = security_socket_create(family, type, protocol, 1);
1007     if (err)
1008         goto out;
1009 
1010     sock = sock_alloc();
1011     if (!sock) {
1012         err = -ENOMEM;
1013         goto out;
1014     }
1015 
1016     sock->type = type;
1017     err = security_socket_post_create(sock, family, type, protocol, 1);
1018     if (err)
1019         goto out_release;
1020 
1021 out:
1022     *res = sock;
1023     return err;
1024 out_release:
1025     sock_release(sock);
1026     sock = NULL;
1027     goto out;
1028 }
1029 EXPORT_SYMBOL(sock_create_lite);
1030 
1031 /* No kernel lock held - perfect */
1032 static unsigned int sock_poll(struct file *file, poll_table *wait)
1033 {
1034     unsigned int busy_flag = 0;
1035     struct socket *sock;
1036 
1037     /*
1038      *      We can't return errors to poll, so it's either yes or no.
1039      */
1040     sock = file->private_data;
1041 
1042     if (sk_can_busy_loop(sock->sk)) {
1043         /* this socket can poll_ll so tell the system call */
1044         busy_flag = POLL_BUSY_LOOP;
1045 
1046         /* once, only if requested by syscall */
1047         if (wait && (wait->_key & POLL_BUSY_LOOP))
1048             sk_busy_loop(sock->sk, 1);
1049     }
1050 
1051     return busy_flag | sock->ops->poll(file, sock, wait);
1052 }
1053 
1054 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1055 {
1056     struct socket *sock = file->private_data;
1057 
1058     return sock->ops->mmap(file, sock, vma);
1059 }
1060 
1061 static int sock_close(struct inode *inode, struct file *filp)
1062 {
1063     sock_release(SOCKET_I(inode));
1064     return 0;
1065 }
1066 
1067 /*
1068  *  Update the socket async list
1069  *
1070  *  Fasync_list locking strategy.
1071  *
1072  *  1. fasync_list is modified only under process context socket lock
1073  *     i.e. under semaphore.
1074  *  2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1075  *     or under socket lock
1076  */
1077 
1078 static int sock_fasync(int fd, struct file *filp, int on)
1079 {
1080     struct socket *sock = filp->private_data;
1081     struct sock *sk = sock->sk;
1082     struct socket_wq *wq;
1083 
1084     if (sk == NULL)
1085         return -EINVAL;
1086 
1087     lock_sock(sk);
1088     wq = rcu_dereference_protected(sock->wq, lockdep_sock_is_held(sk));
1089     fasync_helper(fd, filp, on, &wq->fasync_list);
1090 
1091     if (!wq->fasync_list)
1092         sock_reset_flag(sk, SOCK_FASYNC);
1093     else
1094         sock_set_flag(sk, SOCK_FASYNC);
1095 
1096     release_sock(sk);
1097     return 0;
1098 }
1099 
1100 /* This function may be called only under rcu_lock */
1101 
1102 int sock_wake_async(struct socket_wq *wq, int how, int band)
1103 {
1104     if (!wq || !wq->fasync_list)
1105         return -1;
1106 
1107     switch (how) {
1108     case SOCK_WAKE_WAITD:
1109         if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1110             break;
1111         goto call_kill;
1112     case SOCK_WAKE_SPACE:
1113         if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1114             break;
1115         /* fall through */
1116     case SOCK_WAKE_IO:
1117 call_kill:
1118         kill_fasync(&wq->fasync_list, SIGIO, band);
1119         break;
1120     case SOCK_WAKE_URG:
1121         kill_fasync(&wq->fasync_list, SIGURG, band);
1122     }
1123 
1124     return 0;
1125 }
1126 EXPORT_SYMBOL(sock_wake_async);
1127 
1128 int __sock_create(struct net *net, int family, int type, int protocol,
1129              struct socket **res, int kern)
1130 {
1131     int err;
1132     struct socket *sock;
1133     const struct net_proto_family *pf;
1134 
1135     /*
1136      *      Check protocol is in range
1137      */
1138     if (family < 0 || family >= NPROTO)
1139         return -EAFNOSUPPORT;
1140     if (type < 0 || type >= SOCK_MAX)
1141         return -EINVAL;
1142 
1143     /* Compatibility.
1144 
1145        This uglymoron is moved from INET layer to here to avoid
1146        deadlock in module load.
1147      */
1148     if (family == PF_INET && type == SOCK_PACKET) {
1149         pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1150                  current->comm);
1151         family = PF_PACKET;
1152     }
1153 
1154     err = security_socket_create(family, type, protocol, kern);
1155     if (err)
1156         return err;
1157 
1158     /*
1159      *  Allocate the socket and allow the family to set things up. if
1160      *  the protocol is 0, the family is instructed to select an appropriate
1161      *  default.
1162      */
1163     sock = sock_alloc();
1164     if (!sock) {
1165         net_warn_ratelimited("socket: no more sockets\n");
1166         return -ENFILE; /* Not exactly a match, but its the
1167                    closest posix thing */
1168     }
1169 
1170     sock->type = type;
1171 
1172 #ifdef CONFIG_MODULES
1173     /* Attempt to load a protocol module if the find failed.
1174      *
1175      * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1176      * requested real, full-featured networking support upon configuration.
1177      * Otherwise module support will break!
1178      */
1179     if (rcu_access_pointer(net_families[family]) == NULL)
1180         request_module("net-pf-%d", family);
1181 #endif
1182 
1183     rcu_read_lock();
1184     pf = rcu_dereference(net_families[family]);
1185     err = -EAFNOSUPPORT;
1186     if (!pf)
1187         goto out_release;
1188 
1189     /*
1190      * We will call the ->create function, that possibly is in a loadable
1191      * module, so we have to bump that loadable module refcnt first.
1192      */
1193     if (!try_module_get(pf->owner))
1194         goto out_release;
1195 
1196     /* Now protected by module ref count */
1197     rcu_read_unlock();
1198 
1199     err = pf->create(net, sock, protocol, kern);
1200     if (err < 0)
1201         goto out_module_put;
1202 
1203     /*
1204      * Now to bump the refcnt of the [loadable] module that owns this
1205      * socket at sock_release time we decrement its refcnt.
1206      */
1207     if (!try_module_get(sock->ops->owner))
1208         goto out_module_busy;
1209 
1210     /*
1211      * Now that we're done with the ->create function, the [loadable]
1212      * module can have its refcnt decremented
1213      */
1214     module_put(pf->owner);
1215     err = security_socket_post_create(sock, family, type, protocol, kern);
1216     if (err)
1217         goto out_sock_release;
1218     *res = sock;
1219 
1220     return 0;
1221 
1222 out_module_busy:
1223     err = -EAFNOSUPPORT;
1224 out_module_put:
1225     sock->ops = NULL;
1226     module_put(pf->owner);
1227 out_sock_release:
1228     sock_release(sock);
1229     return err;
1230 
1231 out_release:
1232     rcu_read_unlock();
1233     goto out_sock_release;
1234 }
1235 EXPORT_SYMBOL(__sock_create);
1236 
1237 int sock_create(int family, int type, int protocol, struct socket **res)
1238 {
1239     return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1240 }
1241 EXPORT_SYMBOL(sock_create);
1242 
1243 int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1244 {
1245     return __sock_create(net, family, type, protocol, res, 1);
1246 }
1247 EXPORT_SYMBOL(sock_create_kern);
1248 
1249 SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1250 {
1251     int retval;
1252     struct socket *sock;
1253     int flags;
1254 
1255     /* Check the SOCK_* constants for consistency.  */
1256     BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1257     BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1258     BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1259     BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1260 
1261     flags = type & ~SOCK_TYPE_MASK;
1262     if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1263         return -EINVAL;
1264     type &= SOCK_TYPE_MASK;
1265 
1266     if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1267         flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1268 
1269     retval = sock_create(family, type, protocol, &sock);
1270     if (retval < 0)
1271         goto out;
1272 
1273     retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1274     if (retval < 0)
1275         goto out_release;
1276 
1277 out:
1278     /* It may be already another descriptor 8) Not kernel problem. */
1279     return retval;
1280 
1281 out_release:
1282     sock_release(sock);
1283     return retval;
1284 }
1285 
1286 /*
1287  *  Create a pair of connected sockets.
1288  */
1289 
1290 SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1291         int __user *, usockvec)
1292 {
1293     struct socket *sock1, *sock2;
1294     int fd1, fd2, err;
1295     struct file *newfile1, *newfile2;
1296     int flags;
1297 
1298     flags = type & ~SOCK_TYPE_MASK;
1299     if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1300         return -EINVAL;
1301     type &= SOCK_TYPE_MASK;
1302 
1303     if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1304         flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1305 
1306     /*
1307      * Obtain the first socket and check if the underlying protocol
1308      * supports the socketpair call.
1309      */
1310 
1311     err = sock_create(family, type, protocol, &sock1);
1312     if (err < 0)
1313         goto out;
1314 
1315     err = sock_create(family, type, protocol, &sock2);
1316     if (err < 0)
1317         goto out_release_1;
1318 
1319     err = sock1->ops->socketpair(sock1, sock2);
1320     if (err < 0)
1321         goto out_release_both;
1322 
1323     fd1 = get_unused_fd_flags(flags);
1324     if (unlikely(fd1 < 0)) {
1325         err = fd1;
1326         goto out_release_both;
1327     }
1328 
1329     fd2 = get_unused_fd_flags(flags);
1330     if (unlikely(fd2 < 0)) {
1331         err = fd2;
1332         goto out_put_unused_1;
1333     }
1334 
1335     newfile1 = sock_alloc_file(sock1, flags, NULL);
1336     if (IS_ERR(newfile1)) {
1337         err = PTR_ERR(newfile1);
1338         goto out_put_unused_both;
1339     }
1340 
1341     newfile2 = sock_alloc_file(sock2, flags, NULL);
1342     if (IS_ERR(newfile2)) {
1343         err = PTR_ERR(newfile2);
1344         goto out_fput_1;
1345     }
1346 
1347     err = put_user(fd1, &usockvec[0]);
1348     if (err)
1349         goto out_fput_both;
1350 
1351     err = put_user(fd2, &usockvec[1]);
1352     if (err)
1353         goto out_fput_both;
1354 
1355     audit_fd_pair(fd1, fd2);
1356 
1357     fd_install(fd1, newfile1);
1358     fd_install(fd2, newfile2);
1359     /* fd1 and fd2 may be already another descriptors.
1360      * Not kernel problem.
1361      */
1362 
1363     return 0;
1364 
1365 out_fput_both:
1366     fput(newfile2);
1367     fput(newfile1);
1368     put_unused_fd(fd2);
1369     put_unused_fd(fd1);
1370     goto out;
1371 
1372 out_fput_1:
1373     fput(newfile1);
1374     put_unused_fd(fd2);
1375     put_unused_fd(fd1);
1376     sock_release(sock2);
1377     goto out;
1378 
1379 out_put_unused_both:
1380     put_unused_fd(fd2);
1381 out_put_unused_1:
1382     put_unused_fd(fd1);
1383 out_release_both:
1384     sock_release(sock2);
1385 out_release_1:
1386     sock_release(sock1);
1387 out:
1388     return err;
1389 }
1390 
1391 /*
1392  *  Bind a name to a socket. Nothing much to do here since it's
1393  *  the protocol's responsibility to handle the local address.
1394  *
1395  *  We move the socket address to kernel space before we call
1396  *  the protocol layer (having also checked the address is ok).
1397  */
1398 
1399 SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1400 {
1401     struct socket *sock;
1402     struct sockaddr_storage address;
1403     int err, fput_needed;
1404 
1405     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1406     if (sock) {
1407         err = move_addr_to_kernel(umyaddr, addrlen, &address);
1408         if (err >= 0) {
1409             err = security_socket_bind(sock,
1410                            (struct sockaddr *)&address,
1411                            addrlen);
1412             if (!err)
1413                 err = sock->ops->bind(sock,
1414                               (struct sockaddr *)
1415                               &address, addrlen);
1416         }
1417         fput_light(sock->file, fput_needed);
1418     }
1419     return err;
1420 }
1421 
1422 /*
1423  *  Perform a listen. Basically, we allow the protocol to do anything
1424  *  necessary for a listen, and if that works, we mark the socket as
1425  *  ready for listening.
1426  */
1427 
1428 SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1429 {
1430     struct socket *sock;
1431     int err, fput_needed;
1432     int somaxconn;
1433 
1434     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1435     if (sock) {
1436         somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1437         if ((unsigned int)backlog > somaxconn)
1438             backlog = somaxconn;
1439 
1440         err = security_socket_listen(sock, backlog);
1441         if (!err)
1442             err = sock->ops->listen(sock, backlog);
1443 
1444         fput_light(sock->file, fput_needed);
1445     }
1446     return err;
1447 }
1448 
1449 /*
1450  *  For accept, we attempt to create a new socket, set up the link
1451  *  with the client, wake up the client, then return the new
1452  *  connected fd. We collect the address of the connector in kernel
1453  *  space and move it to user at the very end. This is unclean because
1454  *  we open the socket then return an error.
1455  *
1456  *  1003.1g adds the ability to recvmsg() to query connection pending
1457  *  status to recvmsg. We need to add that support in a way thats
1458  *  clean when we restucture accept also.
1459  */
1460 
1461 SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1462         int __user *, upeer_addrlen, int, flags)
1463 {
1464     struct socket *sock, *newsock;
1465     struct file *newfile;
1466     int err, len, newfd, fput_needed;
1467     struct sockaddr_storage address;
1468 
1469     if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1470         return -EINVAL;
1471 
1472     if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1473         flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1474 
1475     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1476     if (!sock)
1477         goto out;
1478 
1479     err = -ENFILE;
1480     newsock = sock_alloc();
1481     if (!newsock)
1482         goto out_put;
1483 
1484     newsock->type = sock->type;
1485     newsock->ops = sock->ops;
1486 
1487     /*
1488      * We don't need try_module_get here, as the listening socket (sock)
1489      * has the protocol module (sock->ops->owner) held.
1490      */
1491     __module_get(newsock->ops->owner);
1492 
1493     newfd = get_unused_fd_flags(flags);
1494     if (unlikely(newfd < 0)) {
1495         err = newfd;
1496         sock_release(newsock);
1497         goto out_put;
1498     }
1499     newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1500     if (IS_ERR(newfile)) {
1501         err = PTR_ERR(newfile);
1502         put_unused_fd(newfd);
1503         sock_release(newsock);
1504         goto out_put;
1505     }
1506 
1507     err = security_socket_accept(sock, newsock);
1508     if (err)
1509         goto out_fd;
1510 
1511     err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1512     if (err < 0)
1513         goto out_fd;
1514 
1515     if (upeer_sockaddr) {
1516         if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1517                       &len, 2) < 0) {
1518             err = -ECONNABORTED;
1519             goto out_fd;
1520         }
1521         err = move_addr_to_user(&address,
1522                     len, upeer_sockaddr, upeer_addrlen);
1523         if (err < 0)
1524             goto out_fd;
1525     }
1526 
1527     /* File flags are not inherited via accept() unlike another OSes. */
1528 
1529     fd_install(newfd, newfile);
1530     err = newfd;
1531 
1532 out_put:
1533     fput_light(sock->file, fput_needed);
1534 out:
1535     return err;
1536 out_fd:
1537     fput(newfile);
1538     put_unused_fd(newfd);
1539     goto out_put;
1540 }
1541 
1542 SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1543         int __user *, upeer_addrlen)
1544 {
1545     return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1546 }
1547 
1548 /*
1549  *  Attempt to connect to a socket with the server address.  The address
1550  *  is in user space so we verify it is OK and move it to kernel space.
1551  *
1552  *  For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1553  *  break bindings
1554  *
1555  *  NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1556  *  other SEQPACKET protocols that take time to connect() as it doesn't
1557  *  include the -EINPROGRESS status for such sockets.
1558  */
1559 
1560 SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1561         int, addrlen)
1562 {
1563     struct socket *sock;
1564     struct sockaddr_storage address;
1565     int err, fput_needed;
1566 
1567     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1568     if (!sock)
1569         goto out;
1570     err = move_addr_to_kernel(uservaddr, addrlen, &address);
1571     if (err < 0)
1572         goto out_put;
1573 
1574     err =
1575         security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1576     if (err)
1577         goto out_put;
1578 
1579     err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1580                  sock->file->f_flags);
1581 out_put:
1582     fput_light(sock->file, fput_needed);
1583 out:
1584     return err;
1585 }
1586 
1587 /*
1588  *  Get the local address ('name') of a socket object. Move the obtained
1589  *  name to user space.
1590  */
1591 
1592 SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1593         int __user *, usockaddr_len)
1594 {
1595     struct socket *sock;
1596     struct sockaddr_storage address;
1597     int len, err, fput_needed;
1598 
1599     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1600     if (!sock)
1601         goto out;
1602 
1603     err = security_socket_getsockname(sock);
1604     if (err)
1605         goto out_put;
1606 
1607     err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1608     if (err)
1609         goto out_put;
1610     err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1611 
1612 out_put:
1613     fput_light(sock->file, fput_needed);
1614 out:
1615     return err;
1616 }
1617 
1618 /*
1619  *  Get the remote address ('name') of a socket object. Move the obtained
1620  *  name to user space.
1621  */
1622 
1623 SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1624         int __user *, usockaddr_len)
1625 {
1626     struct socket *sock;
1627     struct sockaddr_storage address;
1628     int len, err, fput_needed;
1629 
1630     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1631     if (sock != NULL) {
1632         err = security_socket_getpeername(sock);
1633         if (err) {
1634             fput_light(sock->file, fput_needed);
1635             return err;
1636         }
1637 
1638         err =
1639             sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1640                        1);
1641         if (!err)
1642             err = move_addr_to_user(&address, len, usockaddr,
1643                         usockaddr_len);
1644         fput_light(sock->file, fput_needed);
1645     }
1646     return err;
1647 }
1648 
1649 /*
1650  *  Send a datagram to a given address. We move the address into kernel
1651  *  space and check the user space data area is readable before invoking
1652  *  the protocol.
1653  */
1654 
1655 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1656         unsigned int, flags, struct sockaddr __user *, addr,
1657         int, addr_len)
1658 {
1659     struct socket *sock;
1660     struct sockaddr_storage address;
1661     int err;
1662     struct msghdr msg;
1663     struct iovec iov;
1664     int fput_needed;
1665 
1666     err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1667     if (unlikely(err))
1668         return err;
1669     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1670     if (!sock)
1671         goto out;
1672 
1673     msg.msg_name = NULL;
1674     msg.msg_control = NULL;
1675     msg.msg_controllen = 0;
1676     msg.msg_namelen = 0;
1677     if (addr) {
1678         err = move_addr_to_kernel(addr, addr_len, &address);
1679         if (err < 0)
1680             goto out_put;
1681         msg.msg_name = (struct sockaddr *)&address;
1682         msg.msg_namelen = addr_len;
1683     }
1684     if (sock->file->f_flags & O_NONBLOCK)
1685         flags |= MSG_DONTWAIT;
1686     msg.msg_flags = flags;
1687     err = sock_sendmsg(sock, &msg);
1688 
1689 out_put:
1690     fput_light(sock->file, fput_needed);
1691 out:
1692     return err;
1693 }
1694 
1695 /*
1696  *  Send a datagram down a socket.
1697  */
1698 
1699 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1700         unsigned int, flags)
1701 {
1702     return sys_sendto(fd, buff, len, flags, NULL, 0);
1703 }
1704 
1705 /*
1706  *  Receive a frame from the socket and optionally record the address of the
1707  *  sender. We verify the buffers are writable and if needed move the
1708  *  sender address from kernel to user space.
1709  */
1710 
1711 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1712         unsigned int, flags, struct sockaddr __user *, addr,
1713         int __user *, addr_len)
1714 {
1715     struct socket *sock;
1716     struct iovec iov;
1717     struct msghdr msg;
1718     struct sockaddr_storage address;
1719     int err, err2;
1720     int fput_needed;
1721 
1722     err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
1723     if (unlikely(err))
1724         return err;
1725     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1726     if (!sock)
1727         goto out;
1728 
1729     msg.msg_control = NULL;
1730     msg.msg_controllen = 0;
1731     /* Save some cycles and don't copy the address if not needed */
1732     msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1733     /* We assume all kernel code knows the size of sockaddr_storage */
1734     msg.msg_namelen = 0;
1735     msg.msg_iocb = NULL;
1736     if (sock->file->f_flags & O_NONBLOCK)
1737         flags |= MSG_DONTWAIT;
1738     err = sock_recvmsg(sock, &msg, flags);
1739 
1740     if (err >= 0 && addr != NULL) {
1741         err2 = move_addr_to_user(&address,
1742                      msg.msg_namelen, addr, addr_len);
1743         if (err2 < 0)
1744             err = err2;
1745     }
1746 
1747     fput_light(sock->file, fput_needed);
1748 out:
1749     return err;
1750 }
1751 
1752 /*
1753  *  Receive a datagram from a socket.
1754  */
1755 
1756 SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1757         unsigned int, flags)
1758 {
1759     return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1760 }
1761 
1762 /*
1763  *  Set a socket option. Because we don't know the option lengths we have
1764  *  to pass the user mode parameter for the protocols to sort out.
1765  */
1766 
1767 SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1768         char __user *, optval, int, optlen)
1769 {
1770     int err, fput_needed;
1771     struct socket *sock;
1772 
1773     if (optlen < 0)
1774         return -EINVAL;
1775 
1776     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1777     if (sock != NULL) {
1778         err = security_socket_setsockopt(sock, level, optname);
1779         if (err)
1780             goto out_put;
1781 
1782         if (level == SOL_SOCKET)
1783             err =
1784                 sock_setsockopt(sock, level, optname, optval,
1785                         optlen);
1786         else
1787             err =
1788                 sock->ops->setsockopt(sock, level, optname, optval,
1789                           optlen);
1790 out_put:
1791         fput_light(sock->file, fput_needed);
1792     }
1793     return err;
1794 }
1795 
1796 /*
1797  *  Get a socket option. Because we don't know the option lengths we have
1798  *  to pass a user mode parameter for the protocols to sort out.
1799  */
1800 
1801 SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1802         char __user *, optval, int __user *, optlen)
1803 {
1804     int err, fput_needed;
1805     struct socket *sock;
1806 
1807     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1808     if (sock != NULL) {
1809         err = security_socket_getsockopt(sock, level, optname);
1810         if (err)
1811             goto out_put;
1812 
1813         if (level == SOL_SOCKET)
1814             err =
1815                 sock_getsockopt(sock, level, optname, optval,
1816                         optlen);
1817         else
1818             err =
1819                 sock->ops->getsockopt(sock, level, optname, optval,
1820                           optlen);
1821 out_put:
1822         fput_light(sock->file, fput_needed);
1823     }
1824     return err;
1825 }
1826 
1827 /*
1828  *  Shutdown a socket.
1829  */
1830 
1831 SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1832 {
1833     int err, fput_needed;
1834     struct socket *sock;
1835 
1836     sock = sockfd_lookup_light(fd, &err, &fput_needed);
1837     if (sock != NULL) {
1838         err = security_socket_shutdown(sock, how);
1839         if (!err)
1840             err = sock->ops->shutdown(sock, how);
1841         fput_light(sock->file, fput_needed);
1842     }
1843     return err;
1844 }
1845 
1846 /* A couple of helpful macros for getting the address of the 32/64 bit
1847  * fields which are the same type (int / unsigned) on our platforms.
1848  */
1849 #define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1850 #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1851 #define COMPAT_FLAGS(msg)   COMPAT_MSG(msg, msg_flags)
1852 
1853 struct used_address {
1854     struct sockaddr_storage name;
1855     unsigned int name_len;
1856 };
1857 
1858 static int copy_msghdr_from_user(struct msghdr *kmsg,
1859                  struct user_msghdr __user *umsg,
1860                  struct sockaddr __user **save_addr,
1861                  struct iovec **iov)
1862 {
1863     struct sockaddr __user *uaddr;
1864     struct iovec __user *uiov;
1865     size_t nr_segs;
1866     ssize_t err;
1867 
1868     if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) ||
1869         __get_user(uaddr, &umsg->msg_name) ||
1870         __get_user(kmsg->msg_namelen, &umsg->msg_namelen) ||
1871         __get_user(uiov, &umsg->msg_iov) ||
1872         __get_user(nr_segs, &umsg->msg_iovlen) ||
1873         __get_user(kmsg->msg_control, &umsg->msg_control) ||
1874         __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
1875         __get_user(kmsg->msg_flags, &umsg->msg_flags))
1876         return -EFAULT;
1877 
1878     if (!uaddr)
1879         kmsg->msg_namelen = 0;
1880 
1881     if (kmsg->msg_namelen < 0)
1882         return -EINVAL;
1883 
1884     if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
1885         kmsg->msg_namelen = sizeof(struct sockaddr_storage);
1886 
1887     if (save_addr)
1888         *save_addr = uaddr;
1889 
1890     if (uaddr && kmsg->msg_namelen) {
1891         if (!save_addr) {
1892             err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1893                           kmsg->msg_name);
1894             if (err < 0)
1895                 return err;
1896         }
1897     } else {
1898         kmsg->msg_name = NULL;
1899         kmsg->msg_namelen = 0;
1900     }
1901 
1902     if (nr_segs > UIO_MAXIOV)
1903         return -EMSGSIZE;
1904 
1905     kmsg->msg_iocb = NULL;
1906 
1907     return import_iovec(save_addr ? READ : WRITE, uiov, nr_segs,
1908                 UIO_FASTIOV, iov, &kmsg->msg_iter);
1909 }
1910 
1911 static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
1912              struct msghdr *msg_sys, unsigned int flags,
1913              struct used_address *used_address,
1914              unsigned int allowed_msghdr_flags)
1915 {
1916     struct compat_msghdr __user *msg_compat =
1917         (struct compat_msghdr __user *)msg;
1918     struct sockaddr_storage address;
1919     struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1920     unsigned char ctl[sizeof(struct cmsghdr) + 20]
1921                 __aligned(sizeof(__kernel_size_t));
1922     /* 20 is size of ipv6_pktinfo */
1923     unsigned char *ctl_buf = ctl;
1924     int ctl_len;
1925     ssize_t err;
1926 
1927     msg_sys->msg_name = &address;
1928 
1929     if (MSG_CMSG_COMPAT & flags)
1930         err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
1931     else
1932         err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
1933     if (err < 0)
1934         return err;
1935 
1936     err = -ENOBUFS;
1937 
1938     if (msg_sys->msg_controllen > INT_MAX)
1939         goto out_freeiov;
1940     flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
1941     ctl_len = msg_sys->msg_controllen;
1942     if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
1943         err =
1944             cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
1945                              sizeof(ctl));
1946         if (err)
1947             goto out_freeiov;
1948         ctl_buf = msg_sys->msg_control;
1949         ctl_len = msg_sys->msg_controllen;
1950     } else if (ctl_len) {
1951         if (ctl_len > sizeof(ctl)) {
1952             ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
1953             if (ctl_buf == NULL)
1954                 goto out_freeiov;
1955         }
1956         err = -EFAULT;
1957         /*
1958          * Careful! Before this, msg_sys->msg_control contains a user pointer.
1959          * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
1960          * checking falls down on this.
1961          */
1962         if (copy_from_user(ctl_buf,
1963                    (void __user __force *)msg_sys->msg_control,
1964                    ctl_len))
1965             goto out_freectl;
1966         msg_sys->msg_control = ctl_buf;
1967     }
1968     msg_sys->msg_flags = flags;
1969 
1970     if (sock->file->f_flags & O_NONBLOCK)
1971         msg_sys->msg_flags |= MSG_DONTWAIT;
1972     /*
1973      * If this is sendmmsg() and current destination address is same as
1974      * previously succeeded address, omit asking LSM's decision.
1975      * used_address->name_len is initialized to UINT_MAX so that the first
1976      * destination address never matches.
1977      */
1978     if (used_address && msg_sys->msg_name &&
1979         used_address->name_len == msg_sys->msg_namelen &&
1980         !memcmp(&used_address->name, msg_sys->msg_name,
1981             used_address->name_len)) {
1982         err = sock_sendmsg_nosec(sock, msg_sys);
1983         goto out_freectl;
1984     }
1985     err = sock_sendmsg(sock, msg_sys);
1986     /*
1987      * If this is sendmmsg() and sending to current destination address was
1988      * successful, remember it.
1989      */
1990     if (used_address && err >= 0) {
1991         used_address->name_len = msg_sys->msg_namelen;
1992         if (msg_sys->msg_name)
1993             memcpy(&used_address->name, msg_sys->msg_name,
1994                    used_address->name_len);
1995     }
1996 
1997 out_freectl:
1998     if (ctl_buf != ctl)
1999         sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2000 out_freeiov:
2001     kfree(iov);
2002     return err;
2003 }
2004 
2005 /*
2006  *  BSD sendmsg interface
2007  */
2008 
2009 long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2010 {
2011     int fput_needed, err;
2012     struct msghdr msg_sys;
2013     struct socket *sock;
2014 
2015     sock = sockfd_lookup_light(fd, &err, &fput_needed);
2016     if (!sock)
2017         goto out;
2018 
2019     err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
2020 
2021     fput_light(sock->file, fput_needed);
2022 out:
2023     return err;
2024 }
2025 
2026 SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2027 {
2028     if (flags & MSG_CMSG_COMPAT)
2029         return -EINVAL;
2030     return __sys_sendmsg(fd, msg, flags);
2031 }
2032 
2033 /*
2034  *  Linux sendmmsg interface
2035  */
2036 
2037 int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2038            unsigned int flags)
2039 {
2040     int fput_needed, err, datagrams;
2041     struct socket *sock;
2042     struct mmsghdr __user *entry;
2043     struct compat_mmsghdr __user *compat_entry;
2044     struct msghdr msg_sys;
2045     struct used_address used_address;
2046     unsigned int oflags = flags;
2047 
2048     if (vlen > UIO_MAXIOV)
2049         vlen = UIO_MAXIOV;
2050 
2051     datagrams = 0;
2052 
2053     sock = sockfd_lookup_light(fd, &err, &fput_needed);
2054     if (!sock)
2055         return err;
2056 
2057     used_address.name_len = UINT_MAX;
2058     entry = mmsg;
2059     compat_entry = (struct compat_mmsghdr __user *)mmsg;
2060     err = 0;
2061     flags |= MSG_BATCH;
2062 
2063     while (datagrams < vlen) {
2064         if (datagrams == vlen - 1)
2065             flags = oflags;
2066 
2067         if (MSG_CMSG_COMPAT & flags) {
2068             err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2069                          &msg_sys, flags, &used_address, MSG_EOR);
2070             if (err < 0)
2071                 break;
2072             err = __put_user(err, &compat_entry->msg_len);
2073             ++compat_entry;
2074         } else {
2075             err = ___sys_sendmsg(sock,
2076                          (struct user_msghdr __user *)entry,
2077                          &msg_sys, flags, &used_address, MSG_EOR);
2078             if (err < 0)
2079                 break;
2080             err = put_user(err, &entry->msg_len);
2081             ++entry;
2082         }
2083 
2084         if (err)
2085             break;
2086         ++datagrams;
2087         if (msg_data_left(&msg_sys))
2088             break;
2089         cond_resched();
2090     }
2091 
2092     fput_light(sock->file, fput_needed);
2093 
2094     /* We only return an error if no datagrams were able to be sent */
2095     if (datagrams != 0)
2096         return datagrams;
2097 
2098     return err;
2099 }
2100 
2101 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2102         unsigned int, vlen, unsigned int, flags)
2103 {
2104     if (flags & MSG_CMSG_COMPAT)
2105         return -EINVAL;
2106     return __sys_sendmmsg(fd, mmsg, vlen, flags);
2107 }
2108 
2109 static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
2110              struct msghdr *msg_sys, unsigned int flags, int nosec)
2111 {
2112     struct compat_msghdr __user *msg_compat =
2113         (struct compat_msghdr __user *)msg;
2114     struct iovec iovstack[UIO_FASTIOV];
2115     struct iovec *iov = iovstack;
2116     unsigned long cmsg_ptr;
2117     int len;
2118     ssize_t err;
2119 
2120     /* kernel mode address */
2121     struct sockaddr_storage addr;
2122 
2123     /* user mode address pointers */
2124     struct sockaddr __user *uaddr;
2125     int __user *uaddr_len = COMPAT_NAMELEN(msg);
2126 
2127     msg_sys->msg_name = &addr;
2128 
2129     if (MSG_CMSG_COMPAT & flags)
2130         err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
2131     else
2132         err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
2133     if (err < 0)
2134         return err;
2135 
2136     cmsg_ptr = (unsigned long)msg_sys->msg_control;
2137     msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2138 
2139     /* We assume all kernel code knows the size of sockaddr_storage */
2140     msg_sys->msg_namelen = 0;
2141 
2142     if (sock->file->f_flags & O_NONBLOCK)
2143         flags |= MSG_DONTWAIT;
2144     err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys, flags);
2145     if (err < 0)
2146         goto out_freeiov;
2147     len = err;
2148 
2149     if (uaddr != NULL) {
2150         err = move_addr_to_user(&addr,
2151                     msg_sys->msg_namelen, uaddr,
2152                     uaddr_len);
2153         if (err < 0)
2154             goto out_freeiov;
2155     }
2156     err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2157              COMPAT_FLAGS(msg));
2158     if (err)
2159         goto out_freeiov;
2160     if (MSG_CMSG_COMPAT & flags)
2161         err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2162                  &msg_compat->msg_controllen);
2163     else
2164         err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2165                  &msg->msg_controllen);
2166     if (err)
2167         goto out_freeiov;
2168     err = len;
2169 
2170 out_freeiov:
2171     kfree(iov);
2172     return err;
2173 }
2174 
2175 /*
2176  *  BSD recvmsg interface
2177  */
2178 
2179 long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2180 {
2181     int fput_needed, err;
2182     struct msghdr msg_sys;
2183     struct socket *sock;
2184 
2185     sock = sockfd_lookup_light(fd, &err, &fput_needed);
2186     if (!sock)
2187         goto out;
2188 
2189     err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2190 
2191     fput_light(sock->file, fput_needed);
2192 out:
2193     return err;
2194 }
2195 
2196 SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2197         unsigned int, flags)
2198 {
2199     if (flags & MSG_CMSG_COMPAT)
2200         return -EINVAL;
2201     return __sys_recvmsg(fd, msg, flags);
2202 }
2203 
2204 /*
2205  *     Linux recvmmsg interface
2206  */
2207 
2208 int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2209            unsigned int flags, struct timespec *timeout)
2210 {
2211     int fput_needed, err, datagrams;
2212     struct socket *sock;
2213     struct mmsghdr __user *entry;
2214     struct compat_mmsghdr __user *compat_entry;
2215     struct msghdr msg_sys;
2216     struct timespec64 end_time;
2217     struct timespec64 timeout64;
2218 
2219     if (timeout &&
2220         poll_select_set_timeout(&end_time, timeout->tv_sec,
2221                     timeout->tv_nsec))
2222         return -EINVAL;
2223 
2224     datagrams = 0;
2225 
2226     sock = sockfd_lookup_light(fd, &err, &fput_needed);
2227     if (!sock)
2228         return err;
2229 
2230     err = sock_error(sock->sk);
2231     if (err)
2232         goto out_put;
2233 
2234     entry = mmsg;
2235     compat_entry = (struct compat_mmsghdr __user *)mmsg;
2236 
2237     while (datagrams < vlen) {
2238         /*
2239          * No need to ask LSM for more than the first datagram.
2240          */
2241         if (MSG_CMSG_COMPAT & flags) {
2242             err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2243                          &msg_sys, flags & ~MSG_WAITFORONE,
2244                          datagrams);
2245             if (err < 0)
2246                 break;
2247             err = __put_user(err, &compat_entry->msg_len);
2248             ++compat_entry;
2249         } else {
2250             err = ___sys_recvmsg(sock,
2251                          (struct user_msghdr __user *)entry,
2252                          &msg_sys, flags & ~MSG_WAITFORONE,
2253                          datagrams);
2254             if (err < 0)
2255                 break;
2256             err = put_user(err, &entry->msg_len);
2257             ++entry;
2258         }
2259 
2260         if (err)
2261             break;
2262         ++datagrams;
2263 
2264         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2265         if (flags & MSG_WAITFORONE)
2266             flags |= MSG_DONTWAIT;
2267 
2268         if (timeout) {
2269             ktime_get_ts64(&timeout64);
2270             *timeout = timespec64_to_timespec(
2271                     timespec64_sub(end_time, timeout64));
2272             if (timeout->tv_sec < 0) {
2273                 timeout->tv_sec = timeout->tv_nsec = 0;
2274                 break;
2275             }
2276 
2277             /* Timeout, return less than vlen datagrams */
2278             if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2279                 break;
2280         }
2281 
2282         /* Out of band data, return right away */
2283         if (msg_sys.msg_flags & MSG_OOB)
2284             break;
2285         cond_resched();
2286     }
2287 
2288     if (err == 0)
2289         goto out_put;
2290 
2291     if (datagrams == 0) {
2292         datagrams = err;
2293         goto out_put;
2294     }
2295 
2296     /*
2297      * We may return less entries than requested (vlen) if the
2298      * sock is non block and there aren't enough datagrams...
2299      */
2300     if (err != -EAGAIN) {
2301         /*
2302          * ... or  if recvmsg returns an error after we
2303          * received some datagrams, where we record the
2304          * error to return on the next call or if the
2305          * app asks about it using getsockopt(SO_ERROR).
2306          */
2307         sock->sk->sk_err = -err;
2308     }
2309 out_put:
2310     fput_light(sock->file, fput_needed);
2311 
2312     return datagrams;
2313 }
2314 
2315 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2316         unsigned int, vlen, unsigned int, flags,
2317         struct timespec __user *, timeout)
2318 {
2319     int datagrams;
2320     struct timespec timeout_sys;
2321 
2322     if (flags & MSG_CMSG_COMPAT)
2323         return -EINVAL;
2324 
2325     if (!timeout)
2326         return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2327 
2328     if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2329         return -EFAULT;
2330 
2331     datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2332 
2333     if (datagrams > 0 &&
2334         copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2335         datagrams = -EFAULT;
2336 
2337     return datagrams;
2338 }
2339 
2340 #ifdef __ARCH_WANT_SYS_SOCKETCALL
2341 /* Argument list sizes for sys_socketcall */
2342 #define AL(x) ((x) * sizeof(unsigned long))
2343 static const unsigned char nargs[21] = {
2344     AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2345     AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2346     AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2347     AL(4), AL(5), AL(4)
2348 };
2349 
2350 #undef AL
2351 
2352 /*
2353  *  System call vectors.
2354  *
2355  *  Argument checking cleaned up. Saved 20% in size.
2356  *  This function doesn't need to set the kernel lock because
2357  *  it is set by the callees.
2358  */
2359 
2360 SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2361 {
2362     unsigned long a[AUDITSC_ARGS];
2363     unsigned long a0, a1;
2364     int err;
2365     unsigned int len;
2366 
2367     if (call < 1 || call > SYS_SENDMMSG)
2368         return -EINVAL;
2369 
2370     len = nargs[call];
2371     if (len > sizeof(a))
2372         return -EINVAL;
2373 
2374     /* copy_from_user should be SMP safe. */
2375     if (copy_from_user(a, args, len))
2376         return -EFAULT;
2377 
2378     err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2379     if (err)
2380         return err;
2381 
2382     a0 = a[0];
2383     a1 = a[1];
2384 
2385     switch (call) {
2386     case SYS_SOCKET:
2387         err = sys_socket(a0, a1, a[2]);
2388         break;
2389     case SYS_BIND:
2390         err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2391         break;
2392     case SYS_CONNECT:
2393         err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2394         break;
2395     case SYS_LISTEN:
2396         err = sys_listen(a0, a1);
2397         break;
2398     case SYS_ACCEPT:
2399         err = sys_accept4(a0, (struct sockaddr __user *)a1,
2400                   (int __user *)a[2], 0);
2401         break;
2402     case SYS_GETSOCKNAME:
2403         err =
2404             sys_getsockname(a0, (struct sockaddr __user *)a1,
2405                     (int __user *)a[2]);
2406         break;
2407     case SYS_GETPEERNAME:
2408         err =
2409             sys_getpeername(a0, (struct sockaddr __user *)a1,
2410                     (int __user *)a[2]);
2411         break;
2412     case SYS_SOCKETPAIR:
2413         err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2414         break;
2415     case SYS_SEND:
2416         err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2417         break;
2418     case SYS_SENDTO:
2419         err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2420                  (struct sockaddr __user *)a[4], a[5]);
2421         break;
2422     case SYS_RECV:
2423         err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2424         break;
2425     case SYS_RECVFROM:
2426         err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2427                    (struct sockaddr __user *)a[4],
2428                    (int __user *)a[5]);
2429         break;
2430     case SYS_SHUTDOWN:
2431         err = sys_shutdown(a0, a1);
2432         break;
2433     case SYS_SETSOCKOPT:
2434         err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2435         break;
2436     case SYS_GETSOCKOPT:
2437         err =
2438             sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2439                    (int __user *)a[4]);
2440         break;
2441     case SYS_SENDMSG:
2442         err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2443         break;
2444     case SYS_SENDMMSG:
2445         err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2446         break;
2447     case SYS_RECVMSG:
2448         err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2449         break;
2450     case SYS_RECVMMSG:
2451         err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2452                    (struct timespec __user *)a[4]);
2453         break;
2454     case SYS_ACCEPT4:
2455         err = sys_accept4(a0, (struct sockaddr __user *)a1,
2456                   (int __user *)a[2], a[3]);
2457         break;
2458     default:
2459         err = -EINVAL;
2460         break;
2461     }
2462     return err;
2463 }
2464 
2465 #endif              /* __ARCH_WANT_SYS_SOCKETCALL */
2466 
2467 /**
2468  *  sock_register - add a socket protocol handler
2469  *  @ops: description of protocol
2470  *
2471  *  This function is called by a protocol handler that wants to
2472  *  advertise its address family, and have it linked into the
2473  *  socket interface. The value ops->family corresponds to the
2474  *  socket system call protocol family.
2475  */
2476 int sock_register(const struct net_proto_family *ops)
2477 {
2478     int err;
2479 
2480     if (ops->family >= NPROTO) {
2481         pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
2482         return -ENOBUFS;
2483     }
2484 
2485     spin_lock(&net_family_lock);
2486     if (rcu_dereference_protected(net_families[ops->family],
2487                       lockdep_is_held(&net_family_lock)))
2488         err = -EEXIST;
2489     else {
2490         rcu_assign_pointer(net_families[ops->family], ops);
2491         err = 0;
2492     }
2493     spin_unlock(&net_family_lock);
2494 
2495     pr_info("NET: Registered protocol family %d\n", ops->family);
2496     return err;
2497 }
2498 EXPORT_SYMBOL(sock_register);
2499 
2500 /**
2501  *  sock_unregister - remove a protocol handler
2502  *  @family: protocol family to remove
2503  *
2504  *  This function is called by a protocol handler that wants to
2505  *  remove its address family, and have it unlinked from the
2506  *  new socket creation.
2507  *
2508  *  If protocol handler is a module, then it can use module reference
2509  *  counts to protect against new references. If protocol handler is not
2510  *  a module then it needs to provide its own protection in
2511  *  the ops->create routine.
2512  */
2513 void sock_unregister(int family)
2514 {
2515     BUG_ON(family < 0 || family >= NPROTO);
2516 
2517     spin_lock(&net_family_lock);
2518     RCU_INIT_POINTER(net_families[family], NULL);
2519     spin_unlock(&net_family_lock);
2520 
2521     synchronize_rcu();
2522 
2523     pr_info("NET: Unregistered protocol family %d\n", family);
2524 }
2525 EXPORT_SYMBOL(sock_unregister);
2526 
2527 static int __init sock_init(void)
2528 {
2529     int err;
2530     /*
2531      *      Initialize the network sysctl infrastructure.
2532      */
2533     err = net_sysctl_init();
2534     if (err)
2535         goto out;
2536 
2537     /*
2538      *      Initialize skbuff SLAB cache
2539      */
2540     skb_init();
2541 
2542     /*
2543      *      Initialize the protocols module.
2544      */
2545 
2546     init_inodecache();
2547 
2548     err = register_filesystem(&sock_fs_type);
2549     if (err)
2550         goto out_fs;
2551     sock_mnt = kern_mount(&sock_fs_type);
2552     if (IS_ERR(sock_mnt)) {
2553         err = PTR_ERR(sock_mnt);
2554         goto out_mount;
2555     }
2556 
2557     /* The real protocol initialization is performed in later initcalls.
2558      */
2559 
2560 #ifdef CONFIG_NETFILTER
2561     err = netfilter_init();
2562     if (err)
2563         goto out;
2564 #endif
2565 
2566     ptp_classifier_init();
2567 
2568 out:
2569     return err;
2570 
2571 out_mount:
2572     unregister_filesystem(&sock_fs_type);
2573 out_fs:
2574     goto out;
2575 }
2576 
2577 core_initcall(sock_init);   /* early initcall */
2578 
2579 #ifdef CONFIG_PROC_FS
2580 void socket_seq_show(struct seq_file *seq)
2581 {
2582     int cpu;
2583     int counter = 0;
2584 
2585     for_each_possible_cpu(cpu)
2586         counter += per_cpu(sockets_in_use, cpu);
2587 
2588     /* It can be negative, by the way. 8) */
2589     if (counter < 0)
2590         counter = 0;
2591 
2592     seq_printf(seq, "sockets: used %d\n", counter);
2593 }
2594 #endif              /* CONFIG_PROC_FS */
2595 
2596 #ifdef CONFIG_COMPAT
2597 static int do_siocgstamp(struct net *net, struct socket *sock,
2598              unsigned int cmd, void __user *up)
2599 {
2600     mm_segment_t old_fs = get_fs();
2601     struct timeval ktv;
2602     int err;
2603 
2604     set_fs(KERNEL_DS);
2605     err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2606     set_fs(old_fs);
2607     if (!err)
2608         err = compat_put_timeval(&ktv, up);
2609 
2610     return err;
2611 }
2612 
2613 static int do_siocgstampns(struct net *net, struct socket *sock,
2614                unsigned int cmd, void __user *up)
2615 {
2616     mm_segment_t old_fs = get_fs();
2617     struct timespec kts;
2618     int err;
2619 
2620     set_fs(KERNEL_DS);
2621     err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2622     set_fs(old_fs);
2623     if (!err)
2624         err = compat_put_timespec(&kts, up);
2625 
2626     return err;
2627 }
2628 
2629 static int dev_ifname32(struct net *net, struct compat_ifreq __user *uifr32)
2630 {
2631     struct ifreq __user *uifr;
2632     int err;
2633 
2634     uifr = compat_alloc_user_space(sizeof(struct ifreq));
2635     if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2636         return -EFAULT;
2637 
2638     err = dev_ioctl(net, SIOCGIFNAME, uifr);
2639     if (err)
2640         return err;
2641 
2642     if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2643         return -EFAULT;
2644 
2645     return 0;
2646 }
2647 
2648 static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
2649 {
2650     struct compat_ifconf ifc32;
2651     struct ifconf ifc;
2652     struct ifconf __user *uifc;
2653     struct compat_ifreq __user *ifr32;
2654     struct ifreq __user *ifr;
2655     unsigned int i, j;
2656     int err;
2657 
2658     if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2659         return -EFAULT;
2660 
2661     memset(&ifc, 0, sizeof(ifc));
2662     if (ifc32.ifcbuf == 0) {
2663         ifc32.ifc_len = 0;
2664         ifc.ifc_len = 0;
2665         ifc.ifc_req = NULL;
2666         uifc = compat_alloc_user_space(sizeof(struct ifconf));
2667     } else {
2668         size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2669             sizeof(struct ifreq);
2670         uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2671         ifc.ifc_len = len;
2672         ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2673         ifr32 = compat_ptr(ifc32.ifcbuf);
2674         for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2675             if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2676                 return -EFAULT;
2677             ifr++;
2678             ifr32++;
2679         }
2680     }
2681     if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2682         return -EFAULT;
2683 
2684     err = dev_ioctl(net, SIOCGIFCONF, uifc);
2685     if (err)
2686         return err;
2687 
2688     if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2689         return -EFAULT;
2690 
2691     ifr = ifc.ifc_req;
2692     ifr32 = compat_ptr(ifc32.ifcbuf);
2693     for (i = 0, j = 0;
2694          i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2695          i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2696         if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2697             return -EFAULT;
2698         ifr32++;
2699         ifr++;
2700     }
2701 
2702     if (ifc32.ifcbuf == 0) {
2703         /* Translate from 64-bit structure multiple to
2704          * a 32-bit one.
2705          */
2706         i = ifc.ifc_len;
2707         i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2708         ifc32.ifc_len = i;
2709     } else {
2710         ifc32.ifc_len = i;
2711     }
2712     if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2713         return -EFAULT;
2714 
2715     return 0;
2716 }
2717 
2718 static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
2719 {
2720     struct compat_ethtool_rxnfc __user *compat_rxnfc;
2721     bool convert_in = false, convert_out = false;
2722     size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2723     struct ethtool_rxnfc __user *rxnfc;
2724     struct ifreq __user *ifr;
2725     u32 rule_cnt = 0, actual_rule_cnt;
2726     u32 ethcmd;
2727     u32 data;
2728     int ret;
2729 
2730     if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2731         return -EFAULT;
2732 
2733     compat_rxnfc = compat_ptr(data);
2734 
2735     if (get_user(ethcmd, &compat_rxnfc->cmd))
2736         return -EFAULT;
2737 
2738     /* Most ethtool structures are defined without padding.
2739      * Unfortunately struct ethtool_rxnfc is an exception.
2740      */
2741     switch (ethcmd) {
2742     default:
2743         break;
2744     case ETHTOOL_GRXCLSRLALL:
2745         /* Buffer size is variable */
2746         if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2747             return -EFAULT;
2748         if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2749             return -ENOMEM;
2750         buf_size += rule_cnt * sizeof(u32);
2751         /* fall through */
2752     case ETHTOOL_GRXRINGS:
2753     case ETHTOOL_GRXCLSRLCNT:
2754     case ETHTOOL_GRXCLSRULE:
2755     case ETHTOOL_SRXCLSRLINS:
2756         convert_out = true;
2757         /* fall through */
2758     case ETHTOOL_SRXCLSRLDEL:
2759         buf_size += sizeof(struct ethtool_rxnfc);
2760         convert_in = true;
2761         break;
2762     }
2763 
2764     ifr = compat_alloc_user_space(buf_size);
2765     rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
2766 
2767     if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2768         return -EFAULT;
2769 
2770     if (put_user(convert_in ? rxnfc : compat_ptr(data),
2771              &ifr->ifr_ifru.ifru_data))
2772         return -EFAULT;
2773 
2774     if (convert_in) {
2775         /* We expect there to be holes between fs.m_ext and
2776          * fs.ring_cookie and at the end of fs, but nowhere else.
2777          */
2778         BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2779                  sizeof(compat_rxnfc->fs.m_ext) !=
2780                  offsetof(struct ethtool_rxnfc, fs.m_ext) +
2781                  sizeof(rxnfc->fs.m_ext));
2782         BUILD_BUG_ON(
2783             offsetof(struct compat_ethtool_rxnfc, fs.location) -
2784             offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2785             offsetof(struct ethtool_rxnfc, fs.location) -
2786             offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2787 
2788         if (copy_in_user(rxnfc, compat_rxnfc,
2789                  (void __user *)(&rxnfc->fs.m_ext + 1) -
2790                  (void __user *)rxnfc) ||
2791             copy_in_user(&rxnfc->fs.ring_cookie,
2792                  &compat_rxnfc->fs.ring_cookie,
2793                  (void __user *)(&rxnfc->fs.location + 1) -
2794                  (void __user *)&rxnfc->fs.ring_cookie) ||
2795             copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2796                  sizeof(rxnfc->rule_cnt)))
2797             return -EFAULT;
2798     }
2799 
2800     ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2801     if (ret)
2802         return ret;
2803 
2804     if (convert_out) {
2805         if (copy_in_user(compat_rxnfc, rxnfc,
2806                  (const void __user *)(&rxnfc->fs.m_ext + 1) -
2807                  (const void __user *)rxnfc) ||
2808             copy_in_user(&compat_rxnfc->fs.ring_cookie,
2809                  &rxnfc->fs.ring_cookie,
2810                  (const void __user *)(&rxnfc->fs.location + 1) -
2811                  (const void __user *)&rxnfc->fs.ring_cookie) ||
2812             copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2813                  sizeof(rxnfc->rule_cnt)))
2814             return -EFAULT;
2815 
2816         if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2817             /* As an optimisation, we only copy the actual
2818              * number of rules that the underlying
2819              * function returned.  Since Mallory might
2820              * change the rule count in user memory, we
2821              * check that it is less than the rule count
2822              * originally given (as the user buffer size),
2823              * which has been range-checked.
2824              */
2825             if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2826                 return -EFAULT;
2827             if (actual_rule_cnt < rule_cnt)
2828                 rule_cnt = actual_rule_cnt;
2829             if (copy_in_user(&compat_rxnfc->rule_locs[0],
2830                      &rxnfc->rule_locs[0],
2831                      rule_cnt * sizeof(u32)))
2832                 return -EFAULT;
2833         }
2834     }
2835 
2836     return 0;
2837 }
2838 
2839 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
2840 {
2841     void __user *uptr;
2842     compat_uptr_t uptr32;
2843     struct ifreq __user *uifr;
2844 
2845     uifr = compat_alloc_user_space(sizeof(*uifr));
2846     if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2847         return -EFAULT;
2848 
2849     if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2850         return -EFAULT;
2851 
2852     uptr = compat_ptr(uptr32);
2853 
2854     if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2855         return -EFAULT;
2856 
2857     return dev_ioctl(net, SIOCWANDEV, uifr);
2858 }
2859 
2860 static int bond_ioctl(struct net *net, unsigned int cmd,
2861              struct compat_ifreq __user *ifr32)
2862 {
2863     struct ifreq kifr;
2864     mm_segment_t old_fs;
2865     int err;
2866 
2867     switch (cmd) {
2868     case SIOCBONDENSLAVE:
2869     case SIOCBONDRELEASE:
2870     case SIOCBONDSETHWADDR:
2871     case SIOCBONDCHANGEACTIVE:
2872         if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2873             return -EFAULT;
2874 
2875         old_fs = get_fs();
2876         set_fs(KERNEL_DS);
2877         err = dev_ioctl(net, cmd,
2878                 (struct ifreq __user __force *) &kifr);
2879         set_fs(old_fs);
2880 
2881         return err;
2882     default:
2883         return -ENOIOCTLCMD;
2884     }
2885 }
2886 
2887 /* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2888 static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
2889                  struct compat_ifreq __user *u_ifreq32)
2890 {
2891     struct ifreq __user *u_ifreq64;
2892     char tmp_buf[IFNAMSIZ];
2893     void __user *data64;
2894     u32 data32;
2895 
2896     if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2897                IFNAMSIZ))
2898         return -EFAULT;
2899     if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2900         return -EFAULT;
2901     data64 = compat_ptr(data32);
2902 
2903     u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
2904 
2905     if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
2906              IFNAMSIZ))
2907         return -EFAULT;
2908     if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
2909         return -EFAULT;
2910 
2911     return dev_ioctl(net, cmd, u_ifreq64);
2912 }
2913 
2914 static int dev_ifsioc(struct net *net, struct socket *sock,
2915              unsigned int cmd, struct compat_ifreq __user *uifr32)
2916 {
2917     struct ifreq __user *uifr;
2918     int err;
2919 
2920     uifr = compat_alloc_user_space(sizeof(*uifr));
2921     if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
2922         return -EFAULT;
2923 
2924     err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
2925 
2926     if (!err) {
2927         switch (cmd) {
2928         case SIOCGIFFLAGS:
2929         case SIOCGIFMETRIC:
2930         case SIOCGIFMTU:
2931         case SIOCGIFMEM:
2932         case SIOCGIFHWADDR:
2933         case SIOCGIFINDEX:
2934         case SIOCGIFADDR:
2935         case SIOCGIFBRDADDR:
2936         case SIOCGIFDSTADDR:
2937         case SIOCGIFNETMASK:
2938         case SIOCGIFPFLAGS:
2939         case SIOCGIFTXQLEN:
2940         case SIOCGMIIPHY:
2941         case SIOCGMIIREG:
2942             if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
2943                 err = -EFAULT;
2944             break;
2945         }
2946     }
2947     return err;
2948 }
2949 
2950 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
2951             struct compat_ifreq __user *uifr32)
2952 {
2953     struct ifreq ifr;
2954     struct compat_ifmap __user *uifmap32;
2955     mm_segment_t old_fs;
2956     int err;
2957 
2958     uifmap32 = &uifr32->ifr_ifru.ifru_map;
2959     err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
2960     err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2961     err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2962     err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2963     err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
2964     err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
2965     err |= get_user(ifr.ifr_map.port, &uifmap32->port);
2966     if (err)
2967         return -EFAULT;
2968 
2969     old_fs = get_fs();
2970     set_fs(KERNEL_DS);
2971     err = dev_ioctl(net, cmd, (void  __user __force *)&ifr);
2972     set_fs(old_fs);
2973 
2974     if (cmd == SIOCGIFMAP && !err) {
2975         err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
2976         err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
2977         err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
2978         err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
2979         err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
2980         err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
2981         err |= put_user(ifr.ifr_map.port, &uifmap32->port);
2982         if (err)
2983             err = -EFAULT;
2984     }
2985     return err;
2986 }
2987 
2988 struct rtentry32 {
2989     u32     rt_pad1;
2990     struct sockaddr rt_dst;         /* target address               */
2991     struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
2992     struct sockaddr rt_genmask;     /* target network mask (IP)     */
2993     unsigned short  rt_flags;
2994     short       rt_pad2;
2995     u32     rt_pad3;
2996     unsigned char   rt_tos;
2997     unsigned char   rt_class;
2998     short       rt_pad4;
2999     short       rt_metric;      /* +1 for binary compatibility! */
3000     /* char * */ u32 rt_dev;        /* forcing the device at add    */
3001     u32     rt_mtu;         /* per route MTU/Window         */
3002     u32     rt_window;      /* Window clamping              */
3003     unsigned short  rt_irtt;        /* Initial RTT                  */
3004 };
3005 
3006 struct in6_rtmsg32 {
3007     struct in6_addr     rtmsg_dst;
3008     struct in6_addr     rtmsg_src;
3009     struct in6_addr     rtmsg_gateway;
3010     u32         rtmsg_type;
3011     u16         rtmsg_dst_len;
3012     u16         rtmsg_src_len;
3013     u32         rtmsg_metric;
3014     u32         rtmsg_info;
3015     u32         rtmsg_flags;
3016     s32         rtmsg_ifindex;
3017 };
3018 
3019 static int routing_ioctl(struct net *net, struct socket *sock,
3020              unsigned int cmd, void __user *argp)
3021 {
3022     int ret;
3023     void *r = NULL;
3024     struct in6_rtmsg r6;
3025     struct rtentry r4;
3026     char devname[16];
3027     u32 rtdev;
3028     mm_segment_t old_fs = get_fs();
3029 
3030     if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3031         struct in6_rtmsg32 __user *ur6 = argp;
3032         ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3033             3 * sizeof(struct in6_addr));
3034         ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3035         ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3036         ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3037         ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3038         ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3039         ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3040         ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3041 
3042         r = (void *) &r6;
3043     } else { /* ipv4 */
3044         struct rtentry32 __user *ur4 = argp;
3045         ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3046                     3 * sizeof(struct sockaddr));
3047         ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3048         ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3049         ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3050         ret |= get_user(r4.rt_window, &(ur4->rt_window));
3051         ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3052         ret |= get_user(rtdev, &(ur4->rt_dev));
3053         if (rtdev) {
3054             ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3055             r4.rt_dev = (char __user __force *)devname;
3056             devname[15] = 0;
3057         } else
3058             r4.rt_dev = NULL;
3059 
3060         r = (void *) &r4;
3061     }
3062 
3063     if (ret) {
3064         ret = -EFAULT;
3065         goto out;
3066     }
3067 
3068     set_fs(KERNEL_DS);
3069     ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3070     set_fs(old_fs);
3071 
3072 out:
3073     return ret;
3074 }
3075 
3076 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3077  * for some operations; this forces use of the newer bridge-utils that
3078  * use compatible ioctls
3079  */
3080 static int old_bridge_ioctl(compat_ulong_t __user *argp)
3081 {
3082     compat_ulong_t tmp;
3083 
3084     if (get_user(tmp, argp))
3085         return -EFAULT;
3086     if (tmp == BRCTL_GET_VERSION)
3087         return BRCTL_VERSION + 1;
3088     return -EINVAL;
3089 }
3090 
3091 static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3092              unsigned int cmd, unsigned long arg)
3093 {
3094     void __user *argp = compat_ptr(arg);
3095     struct sock *sk = sock->sk;
3096     struct net *net = sock_net(sk);
3097 
3098     if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3099         return compat_ifr_data_ioctl(net, cmd, argp);
3100 
3101     switch (cmd) {
3102     case SIOCSIFBR:
3103     case SIOCGIFBR:
3104         return old_bridge_ioctl(argp);
3105     case SIOCGIFNAME:
3106         return dev_ifname32(net, argp);
3107     case SIOCGIFCONF:
3108         return dev_ifconf(net, argp);
3109     case SIOCETHTOOL:
3110         return ethtool_ioctl(net, argp);
3111     case SIOCWANDEV:
3112         return compat_siocwandev(net, argp);
3113     case SIOCGIFMAP:
3114     case SIOCSIFMAP:
3115         return compat_sioc_ifmap(net, cmd, argp);
3116     case SIOCBONDENSLAVE:
3117     case SIOCBONDRELEASE:
3118     case SIOCBONDSETHWADDR:
3119     case SIOCBONDCHANGEACTIVE:
3120         return bond_ioctl(net, cmd, argp);
3121     case SIOCADDRT:
3122     case SIOCDELRT:
3123         return routing_ioctl(net, sock, cmd, argp);
3124     case SIOCGSTAMP:
3125         return do_siocgstamp(net, sock, cmd, argp);
3126     case SIOCGSTAMPNS:
3127         return do_siocgstampns(net, sock, cmd, argp);
3128     case SIOCBONDSLAVEINFOQUERY:
3129     case SIOCBONDINFOQUERY:
3130     case SIOCSHWTSTAMP:
3131     case SIOCGHWTSTAMP:
3132         return compat_ifr_data_ioctl(net, cmd, argp);
3133 
3134     case FIOSETOWN:
3135     case SIOCSPGRP:
3136     case FIOGETOWN:
3137     case SIOCGPGRP:
3138     case SIOCBRADDBR:
3139     case SIOCBRDELBR:
3140     case SIOCGIFVLAN:
3141     case SIOCSIFVLAN:
3142     case SIOCADDDLCI:
3143     case SIOCDELDLCI:
3144     case SIOCGSKNS:
3145         return sock_ioctl(file, cmd, arg);
3146 
3147     case SIOCGIFFLAGS:
3148     case SIOCSIFFLAGS:
3149     case SIOCGIFMETRIC:
3150     case SIOCSIFMETRIC:
3151     case SIOCGIFMTU:
3152     case SIOCSIFMTU:
3153     case SIOCGIFMEM:
3154     case SIOCSIFMEM:
3155     case SIOCGIFHWADDR:
3156     case SIOCSIFHWADDR:
3157     case SIOCADDMULTI:
3158     case SIOCDELMULTI:
3159     case SIOCGIFINDEX:
3160     case SIOCGIFADDR:
3161     case SIOCSIFADDR:
3162     case SIOCSIFHWBROADCAST:
3163     case SIOCDIFADDR:
3164     case SIOCGIFBRDADDR:
3165     case SIOCSIFBRDADDR:
3166     case SIOCGIFDSTADDR:
3167     case SIOCSIFDSTADDR:
3168     case SIOCGIFNETMASK:
3169     case SIOCSIFNETMASK:
3170     case SIOCSIFPFLAGS:
3171     case SIOCGIFPFLAGS:
3172     case SIOCGIFTXQLEN:
3173     case SIOCSIFTXQLEN:
3174     case SIOCBRADDIF:
3175     case SIOCBRDELIF:
3176     case SIOCSIFNAME:
3177     case SIOCGMIIPHY:
3178     case SIOCGMIIREG:
3179     case SIOCSMIIREG:
3180         return dev_ifsioc(net, sock, cmd, argp);
3181 
3182     case SIOCSARP:
3183     case SIOCGARP:
3184     case SIOCDARP:
3185     case SIOCATMARK:
3186         return sock_do_ioctl(net, sock, cmd, arg);
3187     }
3188 
3189     return -ENOIOCTLCMD;
3190 }
3191 
3192 static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3193                   unsigned long arg)
3194 {
3195     struct socket *sock = file->private_data;
3196     int ret = -ENOIOCTLCMD;
3197     struct sock *sk;
3198     struct net *net;
3199 
3200     sk = sock->sk;
3201     net = sock_net(sk);
3202 
3203     if (sock->ops->compat_ioctl)
3204         ret = sock->ops->compat_ioctl(sock, cmd, arg);
3205 
3206     if (ret == -ENOIOCTLCMD &&
3207         (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3208         ret = compat_wext_handle_ioctl(net, cmd, arg);
3209 
3210     if (ret == -ENOIOCTLCMD)
3211         ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3212 
3213     return ret;
3214 }
3215 #endif
3216 
3217 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3218 {
3219     return sock->ops->bind(sock, addr, addrlen);
3220 }
3221 EXPORT_SYMBOL(kernel_bind);
3222 
3223 int kernel_listen(struct socket *sock, int backlog)
3224 {
3225     return sock->ops->listen(sock, backlog);
3226 }
3227 EXPORT_SYMBOL(kernel_listen);
3228 
3229 int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3230 {
3231     struct sock *sk = sock->sk;
3232     int err;
3233 
3234     err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3235                    newsock);
3236     if (err < 0)
3237         goto done;
3238 
3239     err = sock->ops->accept(sock, *newsock, flags);
3240     if (err < 0) {
3241         sock_release(*newsock);
3242         *newsock = NULL;
3243         goto done;
3244     }
3245 
3246     (*newsock)->ops = sock->ops;
3247     __module_get((*newsock)->ops->owner);
3248 
3249 done:
3250     return err;
3251 }
3252 EXPORT_SYMBOL(kernel_accept);
3253 
3254 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3255            int flags)
3256 {
3257     return sock->ops->connect(sock, addr, addrlen, flags);
3258 }
3259 EXPORT_SYMBOL(kernel_connect);
3260 
3261 int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
3262              int *addrlen)
3263 {
3264     return sock->ops->getname(sock, addr, addrlen, 0);
3265 }
3266 EXPORT_SYMBOL(kernel_getsockname);
3267 
3268 int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
3269              int *addrlen)
3270 {
3271     return sock->ops->getname(sock, addr, addrlen, 1);
3272 }
3273 EXPORT_SYMBOL(kernel_getpeername);
3274 
3275 int kernel_getsockopt(struct socket *sock, int level, int optname,
3276             char *optval, int *optlen)
3277 {
3278     mm_segment_t oldfs = get_fs();
3279     char __user *uoptval;
3280     int __user *uoptlen;
3281     int err;
3282 
3283     uoptval = (char __user __force *) optval;
3284     uoptlen = (int __user __force *) optlen;
3285 
3286     set_fs(KERNEL_DS);
3287     if (level == SOL_SOCKET)
3288         err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3289     else
3290         err = sock->ops->getsockopt(sock, level, optname, uoptval,
3291                         uoptlen);
3292     set_fs(oldfs);
3293     return err;
3294 }
3295 EXPORT_SYMBOL(kernel_getsockopt);
3296 
3297 int kernel_setsockopt(struct socket *sock, int level, int optname,
3298             char *optval, unsigned int optlen)
3299 {
3300     mm_segment_t oldfs = get_fs();
3301     char __user *uoptval;
3302     int err;
3303 
3304     uoptval = (char __user __force *) optval;
3305 
3306     set_fs(KERNEL_DS);
3307     if (level == SOL_SOCKET)
3308         err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3309     else
3310         err = sock->ops->setsockopt(sock, level, optname, uoptval,
3311                         optlen);
3312     set_fs(oldfs);
3313     return err;
3314 }
3315 EXPORT_SYMBOL(kernel_setsockopt);
3316 
3317 int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3318             size_t size, int flags)
3319 {
3320     if (sock->ops->sendpage)
3321         return sock->ops->sendpage(sock, page, offset, size, flags);
3322 
3323     return sock_no_sendpage(sock, page, offset, size, flags);
3324 }
3325 EXPORT_SYMBOL(kernel_sendpage);
3326 
3327 int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3328 {
3329     mm_segment_t oldfs = get_fs();
3330     int err;
3331 
3332     set_fs(KERNEL_DS);
3333     err = sock->ops->ioctl(sock, cmd, arg);
3334     set_fs(oldfs);
3335 
3336     return err;
3337 }
3338 EXPORT_SYMBOL(kernel_sock_ioctl);
3339 
3340 int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3341 {
3342     return sock->ops->shutdown(sock, how);
3343 }
3344 EXPORT_SYMBOL(kernel_sock_shutdown);