socket.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * NET		An implementation of the SOCKET network access protocol.
   4 *
   5 * Version:	@(#)socket.c	1.1.93	18/02/95
   6 *
   7 * Authors:	Orest Zborowski, <obz@Kodak.COM>
   8 *		Ross Biro
   9 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  10 *
  11 * Fixes:
  12 *		Anonymous	:	NOTSOCK/BADF cleanup. Error fix in
  13 *					shutdown()
  14 *		Alan Cox	:	verify_area() fixes
  15 *		Alan Cox	:	Removed DDI
  16 *		Jonathan Kamens	:	SOCK_DGRAM reconnect bug
  17 *		Alan Cox	:	Moved a load of checks to the very
  18 *					top level.
  19 *		Alan Cox	:	Move address structures to/from user
  20 *					mode above the protocol layers.
  21 *		Rob Janssen	:	Allow 0 length sends.
  22 *		Alan Cox	:	Asynchronous I/O support (cribbed from the
  23 *					tty drivers).
  24 *		Niibe Yutaka	:	Asynchronous I/O for writes (4.4BSD style)
  25 *		Jeff Uphoff	:	Made max number of sockets command-line
  26 *					configurable.
  27 *		Matti Aarnio	:	Made the number of sockets dynamic,
  28 *					to be allocated when needed, and mr.
  29 *					Uphoff's max is used as max to be
  30 *					allowed to allocate.
  31 *		Linus		:	Argh. removed all the socket allocation
  32 *					altogether: it's in the inode now.
  33 *		Alan Cox	:	Made sock_alloc()/sock_release() public
  34 *					for NetROM and future kernel nfsd type
  35 *					stuff.
  36 *		Alan Cox	:	sendmsg/recvmsg basics.
  37 *		Tom Dyas	:	Export net symbols.
  38 *		Marcin Dalecki	:	Fixed problems with CONFIG_NET="n".
  39 *		Alan Cox	:	Added thread locking to sys_* calls
  40 *					for sockets. May have errors at the
  41 *					moment.
  42 *		Kevin Buhr	:	Fixed the dumb errors in the above.
  43 *		Andi Kleen	:	Some small cleanups, optimizations,
  44 *					and fixed a copy_from_user() bug.
  45 *		Tigran Aivazian	:	sys_send(args) calls sys_sendto(args, NULL, 0)
  46 *		Tigran Aivazian	:	Made listen(2) backlog sanity checks
  47 *					protocol-independent
  48 *
  49 *	This module is effectively the top level interface to the BSD socket
  50 *	paradigm.
  51 *
  52 *	Based upon Swansea University Computer Society NET3.039
  53 */
  54
  55#include <linux/bpf-cgroup.h>
  56#include <linux/ethtool.h>
  57#include <linux/mm.h>
  58#include <linux/socket.h>
  59#include <linux/file.h>
  60#include <linux/splice.h>
  61#include <linux/net.h>
  62#include <linux/interrupt.h>
  63#include <linux/thread_info.h>
  64#include <linux/rcupdate.h>
  65#include <linux/netdevice.h>
  66#include <linux/proc_fs.h>
  67#include <linux/seq_file.h>
  68#include <linux/mutex.h>
  69#include <linux/if_bridge.h>
  70#include <linux/if_vlan.h>
  71#include <linux/ptp_classify.h>
  72#include <linux/init.h>
  73#include <linux/poll.h>
  74#include <linux/cache.h>
  75#include <linux/module.h>
  76#include <linux/highmem.h>
  77#include <linux/mount.h>
  78#include <linux/pseudo_fs.h>
  79#include <linux/security.h>
  80#include <linux/syscalls.h>
  81#include <linux/compat.h>
  82#include <linux/kmod.h>
  83#include <linux/audit.h>
  84#include <linux/wireless.h>
  85#include <linux/nsproxy.h>
  86#include <linux/magic.h>
  87#include <linux/slab.h>
  88#include <linux/xattr.h>
  89#include <linux/nospec.h>
  90#include <linux/indirect_call_wrapper.h>
  91#include <linux/io_uring/net.h>
  92
  93#include <linux/uaccess.h>
  94#include <asm/unistd.h>
  95
  96#include <net/compat.h>
  97#include <net/wext.h>
  98#include <net/cls_cgroup.h>
  99
 100#include <net/sock.h>
 101#include <linux/netfilter.h>
 102
 103#include <linux/if_tun.h>
 104#include <linux/ipv6_route.h>
 105#include <linux/route.h>
 106#include <linux/termios.h>
 107#include <linux/sockios.h>
 108#include <net/busy_poll.h>
 109#include <linux/errqueue.h>
 110#include <linux/ptp_clock_kernel.h>
 111#include <trace/events/sock.h>
 112
 113#include "core/dev.h"
 114
 115#ifdef CONFIG_NET_RX_BUSY_POLL
 116unsigned int sysctl_net_busy_read __read_mostly;
 117unsigned int sysctl_net_busy_poll __read_mostly;
 118#endif
 119
 120static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
 121static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
 122static int sock_mmap(struct file *file, struct vm_area_struct *vma);
 123
 124static int sock_close(struct inode *inode, struct file *file);
 125static __poll_t sock_poll(struct file *file,
 126			      struct poll_table_struct *wait);
 127static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 128#ifdef CONFIG_COMPAT
 129static long compat_sock_ioctl(struct file *file,
 130			      unsigned int cmd, unsigned long arg);
 131#endif
 132static int sock_fasync(int fd, struct file *filp, int on);
 133static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
 134				struct pipe_inode_info *pipe, size_t len,
 135				unsigned int flags);
 136static void sock_splice_eof(struct file *file);
 137
 138#ifdef CONFIG_PROC_FS
 139static void sock_show_fdinfo(struct seq_file *m, struct file *f)
 140{
 141	struct socket *sock = f->private_data;
 142	const struct proto_ops *ops = READ_ONCE(sock->ops);
 143
 144	if (ops->show_fdinfo)
 145		ops->show_fdinfo(m, sock);
 146}
 147#else
 148#define sock_show_fdinfo NULL
 149#endif
 150
 151/*
 152 *	Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
 153 *	in the operation structures but are done directly via the socketcall() multiplexor.
 154 */
 155
 156static const struct file_operations socket_file_ops = {
 157	.owner =	THIS_MODULE,
 158	.read_iter =	sock_read_iter,
 159	.write_iter =	sock_write_iter,
 160	.poll =		sock_poll,
 161	.unlocked_ioctl = sock_ioctl,
 162#ifdef CONFIG_COMPAT
 163	.compat_ioctl = compat_sock_ioctl,
 164#endif
 165	.uring_cmd =    io_uring_cmd_sock,
 166	.mmap =		sock_mmap,
 167	.release =	sock_close,
 168	.fasync =	sock_fasync,
 169	.splice_write = splice_to_socket,
 170	.splice_read =	sock_splice_read,
 171	.splice_eof =	sock_splice_eof,
 172	.show_fdinfo =	sock_show_fdinfo,
 173};
 174
 175static const char * const pf_family_names[] = {
 176	[PF_UNSPEC]	= "PF_UNSPEC",
 177	[PF_UNIX]	= "PF_UNIX/PF_LOCAL",
 178	[PF_INET]	= "PF_INET",
 179	[PF_AX25]	= "PF_AX25",
 180	[PF_IPX]	= "PF_IPX",
 181	[PF_APPLETALK]	= "PF_APPLETALK",
 182	[PF_NETROM]	= "PF_NETROM",
 183	[PF_BRIDGE]	= "PF_BRIDGE",
 184	[PF_ATMPVC]	= "PF_ATMPVC",
 185	[PF_X25]	= "PF_X25",
 186	[PF_INET6]	= "PF_INET6",
 187	[PF_ROSE]	= "PF_ROSE",
 188	[PF_DECnet]	= "PF_DECnet",
 189	[PF_NETBEUI]	= "PF_NETBEUI",
 190	[PF_SECURITY]	= "PF_SECURITY",
 191	[PF_KEY]	= "PF_KEY",
 192	[PF_NETLINK]	= "PF_NETLINK/PF_ROUTE",
 193	[PF_PACKET]	= "PF_PACKET",
 194	[PF_ASH]	= "PF_ASH",
 195	[PF_ECONET]	= "PF_ECONET",
 196	[PF_ATMSVC]	= "PF_ATMSVC",
 197	[PF_RDS]	= "PF_RDS",
 198	[PF_SNA]	= "PF_SNA",
 199	[PF_IRDA]	= "PF_IRDA",
 200	[PF_PPPOX]	= "PF_PPPOX",
 201	[PF_WANPIPE]	= "PF_WANPIPE",
 202	[PF_LLC]	= "PF_LLC",
 203	[PF_IB]		= "PF_IB",
 204	[PF_MPLS]	= "PF_MPLS",
 205	[PF_CAN]	= "PF_CAN",
 206	[PF_TIPC]	= "PF_TIPC",
 207	[PF_BLUETOOTH]	= "PF_BLUETOOTH",
 208	[PF_IUCV]	= "PF_IUCV",
 209	[PF_RXRPC]	= "PF_RXRPC",
 210	[PF_ISDN]	= "PF_ISDN",
 211	[PF_PHONET]	= "PF_PHONET",
 212	[PF_IEEE802154]	= "PF_IEEE802154",
 213	[PF_CAIF]	= "PF_CAIF",
 214	[PF_ALG]	= "PF_ALG",
 215	[PF_NFC]	= "PF_NFC",
 216	[PF_VSOCK]	= "PF_VSOCK",
 217	[PF_KCM]	= "PF_KCM",
 218	[PF_QIPCRTR]	= "PF_QIPCRTR",
 219	[PF_SMC]	= "PF_SMC",
 220	[PF_XDP]	= "PF_XDP",
 221	[PF_MCTP]	= "PF_MCTP",
 222};
 223
 224/*
 225 *	The protocol list. Each protocol is registered in here.
 226 */
 227
 228static DEFINE_SPINLOCK(net_family_lock);
 229static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
 230
 231/*
 232 * Support routines.
 233 * Move socket addresses back and forth across the kernel/user
 234 * divide and look after the messy bits.
 235 */
 236
 237/**
 238 *	move_addr_to_kernel	-	copy a socket address into kernel space
 239 *	@uaddr: Address in user space
 240 *	@kaddr: Address in kernel space
 241 *	@ulen: Length in user space
 242 *
 243 *	The address is copied into kernel space. If the provided address is
 244 *	too long an error code of -EINVAL is returned. If the copy gives
 245 *	invalid addresses -EFAULT is returned. On a success 0 is returned.
 246 */
 247
 248int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
 249{
 250	if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
 251		return -EINVAL;
 252	if (ulen == 0)
 253		return 0;
 254	if (copy_from_user(kaddr, uaddr, ulen))
 255		return -EFAULT;
 256	return audit_sockaddr(ulen, kaddr);
 257}
 258
 259/**
 260 *	move_addr_to_user	-	copy an address to user space
 261 *	@kaddr: kernel space address
 262 *	@klen: length of address in kernel
 263 *	@uaddr: user space address
 264 *	@ulen: pointer to user length field
 265 *
 266 *	The value pointed to by ulen on entry is the buffer length available.
 267 *	This is overwritten with the buffer space used. -EINVAL is returned
 268 *	if an overlong buffer is specified or a negative buffer size. -EFAULT
 269 *	is returned if either the buffer or the length field are not
 270 *	accessible.
 271 *	After copying the data up to the limit the user specifies, the true
 272 *	length of the data is written over the length limit the user
 273 *	specified. Zero is returned for a success.
 274 */
 275
 276static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
 277			     void __user *uaddr, int __user *ulen)
 278{
 279	int len;
 280
 281	BUG_ON(klen > sizeof(struct sockaddr_storage));
 282
 283	if (can_do_masked_user_access())
 284		ulen = masked_user_access_begin(ulen);
 285	else if (!user_access_begin(ulen, 4))
 286		return -EFAULT;
 287
 288	unsafe_get_user(len, ulen, efault_end);
 289
 290	if (len > klen)
 291		len = klen;
 292	/*
 293	 *      "fromlen shall refer to the value before truncation.."
 294	 *                      1003.1g
 295	 */
 296	if (len >= 0)
 297		unsafe_put_user(klen, ulen, efault_end);
 298
 299	user_access_end();
 300
 301	if (len) {
 302		if (len < 0)
 303			return -EINVAL;
 304		if (audit_sockaddr(klen, kaddr))
 305			return -ENOMEM;
 306		if (copy_to_user(uaddr, kaddr, len))
 307			return -EFAULT;
 308	}
 309	return 0;
 310
 311efault_end:
 312	user_access_end();
 313	return -EFAULT;
 314}
 315
 316static struct kmem_cache *sock_inode_cachep __ro_after_init;
 317
 318static struct inode *sock_alloc_inode(struct super_block *sb)
 319{
 320	struct socket_alloc *ei;
 321
 322	ei = alloc_inode_sb(sb, sock_inode_cachep, GFP_KERNEL);
 323	if (!ei)
 324		return NULL;
 325	init_waitqueue_head(&ei->socket.wq.wait);
 326	ei->socket.wq.fasync_list = NULL;
 327	ei->socket.wq.flags = 0;
 328
 329	ei->socket.state = SS_UNCONNECTED;
 330	ei->socket.flags = 0;
 331	ei->socket.ops = NULL;
 332	ei->socket.sk = NULL;
 333	ei->socket.file = NULL;
 334
 335	return &ei->vfs_inode;
 336}
 337
 338static void sock_free_inode(struct inode *inode)
 339{
 340	struct socket_alloc *ei;
 341
 342	ei = container_of(inode, struct socket_alloc, vfs_inode);
 343	kmem_cache_free(sock_inode_cachep, ei);
 344}
 345
 346static void init_once(void *foo)
 347{
 348	struct socket_alloc *ei = (struct socket_alloc *)foo;
 349
 350	inode_init_once(&ei->vfs_inode);
 351}
 352
 353static void init_inodecache(void)
 354{
 355	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
 356					      sizeof(struct socket_alloc),
 357					      0,
 358					      (SLAB_HWCACHE_ALIGN |
 359					       SLAB_RECLAIM_ACCOUNT |
 360					       SLAB_ACCOUNT),
 361					      init_once);
 362	BUG_ON(sock_inode_cachep == NULL);
 363}
 364
 365static const struct super_operations sockfs_ops = {
 366	.alloc_inode	= sock_alloc_inode,
 367	.free_inode	= sock_free_inode,
 368	.statfs		= simple_statfs,
 369};
 370
 371/*
 372 * sockfs_dname() is called from d_path().
 373 */
 374static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
 375{
 376	return dynamic_dname(buffer, buflen, "socket:[%lu]",
 377				d_inode(dentry)->i_ino);
 378}
 379
 380static const struct dentry_operations sockfs_dentry_operations = {
 381	.d_dname  = sockfs_dname,
 382};
 383
 384static int sockfs_xattr_get(const struct xattr_handler *handler,
 385			    struct dentry *dentry, struct inode *inode,
 386			    const char *suffix, void *value, size_t size)
 387{
 388	if (value) {
 389		if (dentry->d_name.len + 1 > size)
 390			return -ERANGE;
 391		memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
 392	}
 393	return dentry->d_name.len + 1;
 394}
 395
 396#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
 397#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
 398#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
 399
 400static const struct xattr_handler sockfs_xattr_handler = {
 401	.name = XATTR_NAME_SOCKPROTONAME,
 402	.get = sockfs_xattr_get,
 403};
 404
 405static int sockfs_security_xattr_set(const struct xattr_handler *handler,
 406				     struct mnt_idmap *idmap,
 407				     struct dentry *dentry, struct inode *inode,
 408				     const char *suffix, const void *value,
 409				     size_t size, int flags)
 410{
 411	/* Handled by LSM. */
 412	return -EAGAIN;
 413}
 414
 415static const struct xattr_handler sockfs_security_xattr_handler = {
 416	.prefix = XATTR_SECURITY_PREFIX,
 417	.set = sockfs_security_xattr_set,
 418};
 419
 420static const struct xattr_handler * const sockfs_xattr_handlers[] = {
 421	&sockfs_xattr_handler,
 422	&sockfs_security_xattr_handler,
 423	NULL
 424};
 425
 426static int sockfs_init_fs_context(struct fs_context *fc)
 427{
 428	struct pseudo_fs_context *ctx = init_pseudo(fc, SOCKFS_MAGIC);
 429	if (!ctx)
 430		return -ENOMEM;
 431	ctx->ops = &sockfs_ops;
 432	ctx->dops = &sockfs_dentry_operations;
 433	ctx->xattr = sockfs_xattr_handlers;
 434	return 0;
 435}
 436
 437static struct vfsmount *sock_mnt __read_mostly;
 438
 439static struct file_system_type sock_fs_type = {
 440	.name =		"sockfs",
 441	.init_fs_context = sockfs_init_fs_context,
 442	.kill_sb =	kill_anon_super,
 443};
 444
 445/*
 446 *	Obtains the first available file descriptor and sets it up for use.
 447 *
 448 *	These functions create file structures and maps them to fd space
 449 *	of the current process. On success it returns file descriptor
 450 *	and file struct implicitly stored in sock->file.
 451 *	Note that another thread may close file descriptor before we return
 452 *	from this function. We use the fact that now we do not refer
 453 *	to socket after mapping. If one day we will need it, this
 454 *	function will increment ref. count on file by 1.
 455 *
 456 *	In any case returned fd MAY BE not valid!
 457 *	This race condition is unavoidable
 458 *	with shared fd spaces, we cannot solve it inside kernel,
 459 *	but we take care of internal coherence yet.
 460 */
 461
 462/**
 463 *	sock_alloc_file - Bind a &socket to a &file
 464 *	@sock: socket
 465 *	@flags: file status flags
 466 *	@dname: protocol name
 467 *
 468 *	Returns the &file bound with @sock, implicitly storing it
 469 *	in sock->file. If dname is %NULL, sets to "".
 470 *
 471 *	On failure @sock is released, and an ERR pointer is returned.
 472 *
 473 *	This function uses GFP_KERNEL internally.
 474 */
 475
 476struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
 477{
 478	struct file *file;
 479
 480	if (!dname)
 481		dname = sock->sk ? sock->sk->sk_prot_creator->name : "";
 482
 483	file = alloc_file_pseudo(SOCK_INODE(sock), sock_mnt, dname,
 484				O_RDWR | (flags & O_NONBLOCK),
 485				&socket_file_ops);
 486	if (IS_ERR(file)) {
 487		sock_release(sock);
 488		return file;
 489	}
 490
 491	file->f_mode |= FMODE_NOWAIT;
 492	sock->file = file;
 493	file->private_data = sock;
 494	stream_open(SOCK_INODE(sock), file);
 495	/*
 496	 * Disable permission and pre-content events, but enable legacy
 497	 * inotify events for legacy users.
 498	 */
 499	file_set_fsnotify_mode(file, FMODE_NONOTIFY_PERM);
 500	return file;
 501}
 502EXPORT_SYMBOL(sock_alloc_file);
 503
 504static int sock_map_fd(struct socket *sock, int flags)
 505{
 506	struct file *newfile;
 507	int fd = get_unused_fd_flags(flags);
 508	if (unlikely(fd < 0)) {
 509		sock_release(sock);
 510		return fd;
 511	}
 512
 513	newfile = sock_alloc_file(sock, flags, NULL);
 514	if (!IS_ERR(newfile)) {
 515		fd_install(fd, newfile);
 516		return fd;
 517	}
 518
 519	put_unused_fd(fd);
 520	return PTR_ERR(newfile);
 521}
 522
 523/**
 524 *	sock_from_file - Return the &socket bounded to @file.
 525 *	@file: file
 526 *
 527 *	On failure returns %NULL.
 528 */
 529
 530struct socket *sock_from_file(struct file *file)
 531{
 532	if (likely(file->f_op == &socket_file_ops))
 533		return file->private_data;	/* set in sock_alloc_file */
 534
 535	return NULL;
 536}
 537EXPORT_SYMBOL(sock_from_file);
 538
 539/**
 540 *	sockfd_lookup - Go from a file number to its socket slot
 541 *	@fd: file handle
 542 *	@err: pointer to an error code return
 543 *
 544 *	The file handle passed in is locked and the socket it is bound
 545 *	to is returned. If an error occurs the err pointer is overwritten
 546 *	with a negative errno code and NULL is returned. The function checks
 547 *	for both invalid handles and passing a handle which is not a socket.
 548 *
 549 *	On a success the socket object pointer is returned.
 550 */
 551
 552struct socket *sockfd_lookup(int fd, int *err)
 553{
 554	struct file *file;
 555	struct socket *sock;
 556
 557	file = fget(fd);
 558	if (!file) {
 559		*err = -EBADF;
 560		return NULL;
 561	}
 562
 563	sock = sock_from_file(file);
 564	if (!sock) {
 565		*err = -ENOTSOCK;
 566		fput(file);
 567	}
 568	return sock;
 569}
 570EXPORT_SYMBOL(sockfd_lookup);
 571
 572static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
 573				size_t size)
 574{
 575	ssize_t len;
 576	ssize_t used = 0;
 577
 578	len = security_inode_listsecurity(d_inode(dentry), buffer, size);
 579	if (len < 0)
 580		return len;
 581	used += len;
 582	if (buffer) {
 583		if (size < used)
 584			return -ERANGE;
 585		buffer += len;
 586	}
 587
 588	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
 589	used += len;
 590	if (buffer) {
 591		if (size < used)
 592			return -ERANGE;
 593		memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
 594		buffer += len;
 595	}
 596
 597	return used;
 598}
 599
 600static int sockfs_setattr(struct mnt_idmap *idmap,
 601			  struct dentry *dentry, struct iattr *iattr)
 602{
 603	int err = simple_setattr(&nop_mnt_idmap, dentry, iattr);
 604
 605	if (!err && (iattr->ia_valid & ATTR_UID)) {
 606		struct socket *sock = SOCKET_I(d_inode(dentry));
 607
 608		if (sock->sk) {
 609			/* Paired with READ_ONCE() in sk_uid() */
 610			WRITE_ONCE(sock->sk->sk_uid, iattr->ia_uid);
 611		} else {
 612			err = -ENOENT;
 613		}
 614	}
 615
 616	return err;
 617}
 618
 619static const struct inode_operations sockfs_inode_ops = {
 620	.listxattr = sockfs_listxattr,
 621	.setattr = sockfs_setattr,
 622};
 623
 624/**
 625 *	sock_alloc - allocate a socket
 626 *
 627 *	Allocate a new inode and socket object. The two are bound together
 628 *	and initialised. The socket is then returned. If we are out of inodes
 629 *	NULL is returned. This functions uses GFP_KERNEL internally.
 630 */
 631
 632struct socket *sock_alloc(void)
 633{
 634	struct inode *inode;
 635	struct socket *sock;
 636
 637	inode = new_inode_pseudo(sock_mnt->mnt_sb);
 638	if (!inode)
 639		return NULL;
 640
 641	sock = SOCKET_I(inode);
 642
 643	inode->i_ino = get_next_ino();
 644	inode->i_mode = S_IFSOCK | S_IRWXUGO;
 645	inode->i_uid = current_fsuid();
 646	inode->i_gid = current_fsgid();
 647	inode->i_op = &sockfs_inode_ops;
 648
 649	return sock;
 650}
 651EXPORT_SYMBOL(sock_alloc);
 652
 653static void __sock_release(struct socket *sock, struct inode *inode)
 654{
 655	const struct proto_ops *ops = READ_ONCE(sock->ops);
 656
 657	if (ops) {
 658		struct module *owner = ops->owner;
 659
 660		if (inode)
 661			inode_lock(inode);
 662		ops->release(sock);
 663		sock->sk = NULL;
 664		if (inode)
 665			inode_unlock(inode);
 666		sock->ops = NULL;
 667		module_put(owner);
 668	}
 669
 670	if (sock->wq.fasync_list)
 671		pr_err("%s: fasync list not empty!\n", __func__);
 672
 673	if (!sock->file) {
 674		iput(SOCK_INODE(sock));
 675		return;
 676	}
 677	WRITE_ONCE(sock->file, NULL);
 678}
 679
 680/**
 681 *	sock_release - close a socket
 682 *	@sock: socket to close
 683 *
 684 *	The socket is released from the protocol stack if it has a release
 685 *	callback, and the inode is then released if the socket is bound to
 686 *	an inode not a file.
 687 */
 688void sock_release(struct socket *sock)
 689{
 690	__sock_release(sock, NULL);
 691}
 692EXPORT_SYMBOL(sock_release);
 693
 694void __sock_tx_timestamp(__u32 tsflags, __u8 *tx_flags)
 695{
 696	u8 flags = *tx_flags;
 697
 698	if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
 699		flags |= SKBTX_HW_TSTAMP_NOBPF;
 700
 701	if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
 702		flags |= SKBTX_SW_TSTAMP;
 703
 704	if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
 705		flags |= SKBTX_SCHED_TSTAMP;
 706
 707	if (tsflags & SOF_TIMESTAMPING_TX_COMPLETION)
 708		flags |= SKBTX_COMPLETION_TSTAMP;
 709
 710	*tx_flags = flags;
 711}
 712EXPORT_SYMBOL(__sock_tx_timestamp);
 713
 714INDIRECT_CALLABLE_DECLARE(int inet_sendmsg(struct socket *, struct msghdr *,
 715					   size_t));
 716INDIRECT_CALLABLE_DECLARE(int inet6_sendmsg(struct socket *, struct msghdr *,
 717					    size_t));
 718
 719static noinline void call_trace_sock_send_length(struct sock *sk, int ret,
 720						 int flags)
 721{
 722	trace_sock_send_length(sk, ret, 0);
 723}
 724
 725static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
 726{
 727	int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->sendmsg, inet6_sendmsg,
 728				     inet_sendmsg, sock, msg,
 729				     msg_data_left(msg));
 730	BUG_ON(ret == -EIOCBQUEUED);
 731
 732	if (trace_sock_send_length_enabled())
 733		call_trace_sock_send_length(sock->sk, ret, 0);
 734	return ret;
 735}
 736
 737static int __sock_sendmsg(struct socket *sock, struct msghdr *msg)
 738{
 739	int err = security_socket_sendmsg(sock, msg,
 740					  msg_data_left(msg));
 741
 742	return err ?: sock_sendmsg_nosec(sock, msg);
 743}
 744
 745/**
 746 *	sock_sendmsg - send a message through @sock
 747 *	@sock: socket
 748 *	@msg: message to send
 749 *
 750 *	Sends @msg through @sock, passing through LSM.
 751 *	Returns the number of bytes sent, or an error code.
 752 */
 753int sock_sendmsg(struct socket *sock, struct msghdr *msg)
 754{
 755	struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name;
 756	struct sockaddr_storage address;
 757	int save_len = msg->msg_namelen;
 758	int ret;
 759
 760	if (msg->msg_name) {
 761		memcpy(&address, msg->msg_name, msg->msg_namelen);
 762		msg->msg_name = &address;
 763	}
 764
 765	ret = __sock_sendmsg(sock, msg);
 766	msg->msg_name = save_addr;
 767	msg->msg_namelen = save_len;
 768
 769	return ret;
 770}
 771EXPORT_SYMBOL(sock_sendmsg);
 772
 773/**
 774 *	kernel_sendmsg - send a message through @sock (kernel-space)
 775 *	@sock: socket
 776 *	@msg: message header
 777 *	@vec: kernel vec
 778 *	@num: vec array length
 779 *	@size: total message data size
 780 *
 781 *	Builds the message data with @vec and sends it through @sock.
 782 *	Returns the number of bytes sent, or an error code.
 783 */
 784
 785int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
 786		   struct kvec *vec, size_t num, size_t size)
 787{
 788	iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size);
 789	return sock_sendmsg(sock, msg);
 790}
 791EXPORT_SYMBOL(kernel_sendmsg);
 792
 793static bool skb_is_err_queue(const struct sk_buff *skb)
 794{
 795	/* pkt_type of skbs enqueued on the error queue are set to
 796	 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
 797	 * in recvmsg, since skbs received on a local socket will never
 798	 * have a pkt_type of PACKET_OUTGOING.
 799	 */
 800	return skb->pkt_type == PACKET_OUTGOING;
 801}
 802
 803/* On transmit, software and hardware timestamps are returned independently.
 804 * As the two skb clones share the hardware timestamp, which may be updated
 805 * before the software timestamp is received, a hardware TX timestamp may be
 806 * returned only if there is no software TX timestamp. Ignore false software
 807 * timestamps, which may be made in the __sock_recv_timestamp() call when the
 808 * option SO_TIMESTAMP_OLD(NS) is enabled on the socket, even when the skb has a
 809 * hardware timestamp.
 810 */
 811static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp)
 812{
 813	return skb->tstamp && !false_tstamp && skb_is_err_queue(skb);
 814}
 815
 816static ktime_t get_timestamp(struct sock *sk, struct sk_buff *skb, int *if_index)
 817{
 818	bool cycles = READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_BIND_PHC;
 819	struct skb_shared_hwtstamps *shhwtstamps = skb_hwtstamps(skb);
 820	struct net_device *orig_dev;
 821	ktime_t hwtstamp;
 822
 823	rcu_read_lock();
 824	orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
 825	if (orig_dev) {
 826		*if_index = orig_dev->ifindex;
 827		hwtstamp = netdev_get_tstamp(orig_dev, shhwtstamps, cycles);
 828	} else {
 829		hwtstamp = shhwtstamps->hwtstamp;
 830	}
 831	rcu_read_unlock();
 832
 833	return hwtstamp;
 834}
 835
 836static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb,
 837			   int if_index)
 838{
 839	struct scm_ts_pktinfo ts_pktinfo;
 840	struct net_device *orig_dev;
 841
 842	if (!skb_mac_header_was_set(skb))
 843		return;
 844
 845	memset(&ts_pktinfo, 0, sizeof(ts_pktinfo));
 846
 847	if (!if_index) {
 848		rcu_read_lock();
 849		orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
 850		if (orig_dev)
 851			if_index = orig_dev->ifindex;
 852		rcu_read_unlock();
 853	}
 854	ts_pktinfo.if_index = if_index;
 855
 856	ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb);
 857	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
 858		 sizeof(ts_pktinfo), &ts_pktinfo);
 859}
 860
 861bool skb_has_tx_timestamp(struct sk_buff *skb, const struct sock *sk)
 862{
 863	const struct sock_exterr_skb *serr = SKB_EXT_ERR(skb);
 864	u32 tsflags = READ_ONCE(sk->sk_tsflags);
 865
 866	if (serr->ee.ee_errno != ENOMSG ||
 867	   serr->ee.ee_origin != SO_EE_ORIGIN_TIMESTAMPING)
 868		return false;
 869
 870	/* software time stamp available and wanted */
 871	if ((tsflags & SOF_TIMESTAMPING_SOFTWARE) && skb->tstamp)
 872		return true;
 873	/* hardware time stamps available and wanted */
 874	return (tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
 875		skb_hwtstamps(skb)->hwtstamp;
 876}
 877
 878int skb_get_tx_timestamp(struct sk_buff *skb, struct sock *sk,
 879			  struct timespec64 *ts)
 880{
 881	u32 tsflags = READ_ONCE(sk->sk_tsflags);
 882	ktime_t hwtstamp;
 883	int if_index = 0;
 884
 885	if ((tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
 886	    ktime_to_timespec64_cond(skb->tstamp, ts))
 887		return SOF_TIMESTAMPING_TX_SOFTWARE;
 888
 889	if (!(tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) ||
 890	    skb_is_swtx_tstamp(skb, false))
 891		return -ENOENT;
 892
 893	if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP_NETDEV)
 894		hwtstamp = get_timestamp(sk, skb, &if_index);
 895	else
 896		hwtstamp = skb_hwtstamps(skb)->hwtstamp;
 897
 898	if (tsflags & SOF_TIMESTAMPING_BIND_PHC)
 899		hwtstamp = ptp_convert_timestamp(&hwtstamp,
 900						READ_ONCE(sk->sk_bind_phc));
 901	if (!ktime_to_timespec64_cond(hwtstamp, ts))
 902		return -ENOENT;
 903
 904	return SOF_TIMESTAMPING_TX_HARDWARE;
 905}
 906
 907/*
 908 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
 909 */
 910void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
 911	struct sk_buff *skb)
 912{
 913	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
 914	int new_tstamp = sock_flag(sk, SOCK_TSTAMP_NEW);
 915	struct scm_timestamping_internal tss;
 916	int empty = 1, false_tstamp = 0;
 917	struct skb_shared_hwtstamps *shhwtstamps =
 918		skb_hwtstamps(skb);
 919	int if_index;
 920	ktime_t hwtstamp;
 921	u32 tsflags;
 922
 923	/* Race occurred between timestamp enabling and packet
 924	   receiving.  Fill in the current time for now. */
 925	if (need_software_tstamp && skb->tstamp == 0) {
 926		__net_timestamp(skb);
 927		false_tstamp = 1;
 928	}
 929
 930	if (need_software_tstamp) {
 931		if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
 932			if (new_tstamp) {
 933				struct __kernel_sock_timeval tv;
 934
 935				skb_get_new_timestamp(skb, &tv);
 936				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_NEW,
 937					 sizeof(tv), &tv);
 938			} else {
 939				struct __kernel_old_timeval tv;
 940
 941				skb_get_timestamp(skb, &tv);
 942				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_OLD,
 943					 sizeof(tv), &tv);
 944			}
 945		} else {
 946			if (new_tstamp) {
 947				struct __kernel_timespec ts;
 948
 949				skb_get_new_timestampns(skb, &ts);
 950				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_NEW,
 951					 sizeof(ts), &ts);
 952			} else {
 953				struct __kernel_old_timespec ts;
 954
 955				skb_get_timestampns(skb, &ts);
 956				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_OLD,
 957					 sizeof(ts), &ts);
 958			}
 959		}
 960	}
 961
 962	memset(&tss, 0, sizeof(tss));
 963	tsflags = READ_ONCE(sk->sk_tsflags);
 964	if ((tsflags & SOF_TIMESTAMPING_SOFTWARE &&
 965	     (tsflags & SOF_TIMESTAMPING_RX_SOFTWARE ||
 966	      skb_is_err_queue(skb) ||
 967	      !(tsflags & SOF_TIMESTAMPING_OPT_RX_FILTER))) &&
 968	    ktime_to_timespec64_cond(skb->tstamp, tss.ts + 0))
 969		empty = 0;
 970	if (shhwtstamps &&
 971	    (tsflags & SOF_TIMESTAMPING_RAW_HARDWARE &&
 972	     (tsflags & SOF_TIMESTAMPING_RX_HARDWARE ||
 973	      skb_is_err_queue(skb) ||
 974	      !(tsflags & SOF_TIMESTAMPING_OPT_RX_FILTER))) &&
 975	    !skb_is_swtx_tstamp(skb, false_tstamp)) {
 976		if_index = 0;
 977		if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP_NETDEV)
 978			hwtstamp = get_timestamp(sk, skb, &if_index);
 979		else
 980			hwtstamp = shhwtstamps->hwtstamp;
 981
 982		if (tsflags & SOF_TIMESTAMPING_BIND_PHC)
 983			hwtstamp = ptp_convert_timestamp(&hwtstamp,
 984							 READ_ONCE(sk->sk_bind_phc));
 985
 986		if (ktime_to_timespec64_cond(hwtstamp, tss.ts + 2)) {
 987			empty = 0;
 988
 989			if ((tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) &&
 990			    !skb_is_err_queue(skb))
 991				put_ts_pktinfo(msg, skb, if_index);
 992		}
 993	}
 994	if (!empty) {
 995		if (sock_flag(sk, SOCK_TSTAMP_NEW))
 996			put_cmsg_scm_timestamping64(msg, &tss);
 997		else
 998			put_cmsg_scm_timestamping(msg, &tss);
 999
1000		if (skb_is_err_queue(skb) && skb->len &&
1001		    SKB_EXT_ERR(skb)->opt_stats)
1002			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
1003				 skb->len, skb->data);
1004	}
1005}
1006EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
1007
1008#ifdef CONFIG_WIRELESS
1009void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
1010	struct sk_buff *skb)
1011{
1012	int ack;
1013
1014	if (!sock_flag(sk, SOCK_WIFI_STATUS))
1015		return;
1016	if (!skb->wifi_acked_valid)
1017		return;
1018
1019	ack = skb->wifi_acked;
1020
1021	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
1022}
1023EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
1024#endif
1025
1026static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
1027				   struct sk_buff *skb)
1028{
1029	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
1030		put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
1031			sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
1032}
1033
1034static void sock_recv_mark(struct msghdr *msg, struct sock *sk,
1035			   struct sk_buff *skb)
1036{
1037	if (sock_flag(sk, SOCK_RCVMARK) && skb) {
1038		/* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
1039		__u32 mark = skb->mark;
1040
1041		put_cmsg(msg, SOL_SOCKET, SO_MARK, sizeof(__u32), &mark);
1042	}
1043}
1044
1045static void sock_recv_priority(struct msghdr *msg, struct sock *sk,
1046			       struct sk_buff *skb)
1047{
1048	if (sock_flag(sk, SOCK_RCVPRIORITY) && skb) {
1049		__u32 priority = skb->priority;
1050
1051		put_cmsg(msg, SOL_SOCKET, SO_PRIORITY, sizeof(__u32), &priority);
1052	}
1053}
1054
1055void __sock_recv_cmsgs(struct msghdr *msg, struct sock *sk,
1056		       struct sk_buff *skb)
1057{
1058	sock_recv_timestamp(msg, sk, skb);
1059	sock_recv_drops(msg, sk, skb);
1060	sock_recv_mark(msg, sk, skb);
1061	sock_recv_priority(msg, sk, skb);
1062}
1063EXPORT_SYMBOL_GPL(__sock_recv_cmsgs);
1064
1065INDIRECT_CALLABLE_DECLARE(int inet_recvmsg(struct socket *, struct msghdr *,
1066					   size_t, int));
1067INDIRECT_CALLABLE_DECLARE(int inet6_recvmsg(struct socket *, struct msghdr *,
1068					    size_t, int));
1069
1070static noinline void call_trace_sock_recv_length(struct sock *sk, int ret, int flags)
1071{
1072	trace_sock_recv_length(sk, ret, flags);
1073}
1074
1075static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
1076				     int flags)
1077{
1078	int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->recvmsg,
1079				     inet6_recvmsg,
1080				     inet_recvmsg, sock, msg,
1081				     msg_data_left(msg), flags);
1082	if (trace_sock_recv_length_enabled())
1083		call_trace_sock_recv_length(sock->sk, ret, flags);
1084	return ret;
1085}
1086
1087/**
1088 *	sock_recvmsg - receive a message from @sock
1089 *	@sock: socket
1090 *	@msg: message to receive
1091 *	@flags: message flags
1092 *
1093 *	Receives @msg from @sock, passing through LSM. Returns the total number
1094 *	of bytes received, or an error.
1095 */
1096int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
1097{
1098	int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
1099
1100	return err ?: sock_recvmsg_nosec(sock, msg, flags);
1101}
1102EXPORT_SYMBOL(sock_recvmsg);
1103
1104/**
1105 *	kernel_recvmsg - Receive a message from a socket (kernel space)
1106 *	@sock: The socket to receive the message from
1107 *	@msg: Received message
1108 *	@vec: Input s/g array for message data
1109 *	@num: Size of input s/g array
1110 *	@size: Number of bytes to read
1111 *	@flags: Message flags (MSG_DONTWAIT, etc...)
1112 *
1113 *	On return the msg structure contains the scatter/gather array passed in the
1114 *	vec argument. The array is modified so that it consists of the unfilled
1115 *	portion of the original array.
1116 *
1117 *	The returned value is the total number of bytes received, or an error.
1118 */
1119
1120int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
1121		   struct kvec *vec, size_t num, size_t size, int flags)
1122{
1123	msg->msg_control_is_user = false;
1124	iov_iter_kvec(&msg->msg_iter, ITER_DEST, vec, num, size);
1125	return sock_recvmsg(sock, msg, flags);
1126}
1127EXPORT_SYMBOL(kernel_recvmsg);
1128
1129static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
1130				struct pipe_inode_info *pipe, size_t len,
1131				unsigned int flags)
1132{
1133	struct socket *sock = file->private_data;
1134	const struct proto_ops *ops;
1135
1136	ops = READ_ONCE(sock->ops);
1137	if (unlikely(!ops->splice_read))
1138		return copy_splice_read(file, ppos, pipe, len, flags);
1139
1140	return ops->splice_read(sock, ppos, pipe, len, flags);
1141}
1142
1143static void sock_splice_eof(struct file *file)
1144{
1145	struct socket *sock = file->private_data;
1146	const struct proto_ops *ops;
1147
1148	ops = READ_ONCE(sock->ops);
1149	if (ops->splice_eof)
1150		ops->splice_eof(sock);
1151}
1152
1153static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
1154{
1155	struct file *file = iocb->ki_filp;
1156	struct socket *sock = file->private_data;
1157	struct msghdr msg = {.msg_iter = *to,
1158			     .msg_iocb = iocb};
1159	ssize_t res;
1160
1161	if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
1162		msg.msg_flags = MSG_DONTWAIT;
1163
1164	if (iocb->ki_pos != 0)
1165		return -ESPIPE;
1166
1167	if (!iov_iter_count(to))	/* Match SYS5 behaviour */
1168		return 0;
1169
1170	res = sock_recvmsg(sock, &msg, msg.msg_flags);
1171	*to = msg.msg_iter;
1172	return res;
1173}
1174
1175static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
1176{
1177	struct file *file = iocb->ki_filp;
1178	struct socket *sock = file->private_data;
1179	struct msghdr msg = {.msg_iter = *from,
1180			     .msg_iocb = iocb};
1181	ssize_t res;
1182
1183	if (iocb->ki_pos != 0)
1184		return -ESPIPE;
1185
1186	if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
1187		msg.msg_flags = MSG_DONTWAIT;
1188
1189	if (sock->type == SOCK_SEQPACKET)
1190		msg.msg_flags |= MSG_EOR;
1191
1192	if (iocb->ki_flags & IOCB_NOSIGNAL)
1193		msg.msg_flags |= MSG_NOSIGNAL;
1194
1195	res = __sock_sendmsg(sock, &msg);
1196	*from = msg.msg_iter;
1197	return res;
1198}
1199
1200/*
1201 * Atomic setting of ioctl hooks to avoid race
1202 * with module unload.
1203 */
1204
1205static DEFINE_MUTEX(br_ioctl_mutex);
1206static int (*br_ioctl_hook)(struct net *net, unsigned int cmd,
1207			    void __user *uarg);
1208
1209void brioctl_set(int (*hook)(struct net *net, unsigned int cmd,
1210			     void __user *uarg))
1211{
1212	mutex_lock(&br_ioctl_mutex);
1213	br_ioctl_hook = hook;
1214	mutex_unlock(&br_ioctl_mutex);
1215}
1216EXPORT_SYMBOL(brioctl_set);
1217
1218int br_ioctl_call(struct net *net, unsigned int cmd, void __user *uarg)
1219{
1220	int err = -ENOPKG;
1221
1222	if (!br_ioctl_hook)
1223		request_module("bridge");
1224
1225	mutex_lock(&br_ioctl_mutex);
1226	if (br_ioctl_hook)
1227		err = br_ioctl_hook(net, cmd, uarg);
1228	mutex_unlock(&br_ioctl_mutex);
1229
1230	return err;
1231}
1232
1233static DEFINE_MUTEX(vlan_ioctl_mutex);
1234static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1235
1236void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1237{
1238	mutex_lock(&vlan_ioctl_mutex);
1239	vlan_ioctl_hook = hook;
1240	mutex_unlock(&vlan_ioctl_mutex);
1241}
1242EXPORT_SYMBOL(vlan_ioctl_set);
1243
1244static long sock_do_ioctl(struct net *net, struct socket *sock,
1245			  unsigned int cmd, unsigned long arg)
1246{
1247	const struct proto_ops *ops = READ_ONCE(sock->ops);
1248	struct ifreq ifr;
1249	bool need_copyout;
1250	int err;
1251	void __user *argp = (void __user *)arg;
1252	void __user *data;
1253
1254	err = ops->ioctl(sock, cmd, arg);
1255
1256	/*
1257	 * If this ioctl is unknown try to hand it down
1258	 * to the NIC driver.
1259	 */
1260	if (err != -ENOIOCTLCMD)
1261		return err;
1262
1263	if (!is_socket_ioctl_cmd(cmd))
1264		return -ENOTTY;
1265
1266	if (get_user_ifreq(&ifr, &data, argp))
1267		return -EFAULT;
1268	err = dev_ioctl(net, cmd, &ifr, data, &need_copyout);
1269	if (!err && need_copyout)
1270		if (put_user_ifreq(&ifr, argp))
1271			return -EFAULT;
1272
1273	return err;
1274}
1275
1276/*
1277 *	With an ioctl, arg may well be a user mode pointer, but we don't know
1278 *	what to do with it - that's up to the protocol still.
1279 */
1280
1281static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1282{
1283	const struct proto_ops  *ops;
1284	struct socket *sock;
1285	struct sock *sk;
1286	void __user *argp = (void __user *)arg;
1287	int pid, err;
1288	struct net *net;
1289
1290	sock = file->private_data;
1291	ops = READ_ONCE(sock->ops);
1292	sk = sock->sk;
1293	net = sock_net(sk);
1294	if (unlikely(cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))) {
1295		struct ifreq ifr;
1296		void __user *data;
1297		bool need_copyout;
1298		if (get_user_ifreq(&ifr, &data, argp))
1299			return -EFAULT;
1300		err = dev_ioctl(net, cmd, &ifr, data, &need_copyout);
1301		if (!err && need_copyout)
1302			if (put_user_ifreq(&ifr, argp))
1303				return -EFAULT;
1304	} else
1305#ifdef CONFIG_WEXT_CORE
1306	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
1307		err = wext_handle_ioctl(net, cmd, argp);
1308	} else
1309#endif
1310		switch (cmd) {
1311		case FIOSETOWN:
1312		case SIOCSPGRP:
1313			err = -EFAULT;
1314			if (get_user(pid, (int __user *)argp))
1315				break;
1316			err = f_setown(sock->file, pid, 1);
1317			break;
1318		case FIOGETOWN:
1319		case SIOCGPGRP:
1320			err = put_user(f_getown(sock->file),
1321				       (int __user *)argp);
1322			break;
1323		case SIOCGIFBR:
1324		case SIOCSIFBR:
1325		case SIOCBRADDBR:
1326		case SIOCBRDELBR:
1327		case SIOCBRADDIF:
1328		case SIOCBRDELIF:
1329			err = br_ioctl_call(net, cmd, argp);
1330			break;
1331		case SIOCGIFVLAN:
1332		case SIOCSIFVLAN:
1333			err = -ENOPKG;
1334			if (!vlan_ioctl_hook)
1335				request_module("8021q");
1336
1337			mutex_lock(&vlan_ioctl_mutex);
1338			if (vlan_ioctl_hook)
1339				err = vlan_ioctl_hook(net, argp);
1340			mutex_unlock(&vlan_ioctl_mutex);
1341			break;
1342		case SIOCGSKNS:
1343			err = -EPERM;
1344			if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1345				break;
1346
1347			err = open_related_ns(&net->ns, get_net_ns);
1348			break;
1349		case SIOCGSTAMP_OLD:
1350		case SIOCGSTAMPNS_OLD:
1351			if (!ops->gettstamp) {
1352				err = -ENOIOCTLCMD;
1353				break;
1354			}
1355			err = ops->gettstamp(sock, argp,
1356					     cmd == SIOCGSTAMP_OLD,
1357					     !IS_ENABLED(CONFIG_64BIT));
1358			break;
1359		case SIOCGSTAMP_NEW:
1360		case SIOCGSTAMPNS_NEW:
1361			if (!ops->gettstamp) {
1362				err = -ENOIOCTLCMD;
1363				break;
1364			}
1365			err = ops->gettstamp(sock, argp,
1366					     cmd == SIOCGSTAMP_NEW,
1367					     false);
1368			break;
1369
1370		case SIOCGIFCONF:
1371			err = dev_ifconf(net, argp);
1372			break;
1373
1374		default:
1375			err = sock_do_ioctl(net, sock, cmd, arg);
1376			break;
1377		}
1378	return err;
1379}
1380
1381/**
1382 *	sock_create_lite - creates a socket
1383 *	@family: protocol family (AF_INET, ...)
1384 *	@type: communication type (SOCK_STREAM, ...)
1385 *	@protocol: protocol (0, ...)
1386 *	@res: new socket
1387 *
1388 *	Creates a new socket and assigns it to @res, passing through LSM.
1389 *	The new socket initialization is not complete, see kernel_accept().
1390 *	Returns 0 or an error. On failure @res is set to %NULL.
1391 *	This function internally uses GFP_KERNEL.
1392 */
1393
1394int sock_create_lite(int family, int type, int protocol, struct socket **res)
1395{
1396	int err;
1397	struct socket *sock = NULL;
1398
1399	err = security_socket_create(family, type, protocol, 1);
1400	if (err)
1401		goto out;
1402
1403	sock = sock_alloc();
1404	if (!sock) {
1405		err = -ENOMEM;
1406		goto out;
1407	}
1408
1409	sock->type = type;
1410	err = security_socket_post_create(sock, family, type, protocol, 1);
1411	if (err)
1412		goto out_release;
1413
1414out:
1415	*res = sock;
1416	return err;
1417out_release:
1418	sock_release(sock);
1419	sock = NULL;
1420	goto out;
1421}
1422EXPORT_SYMBOL(sock_create_lite);
1423
1424/* No kernel lock held - perfect */
1425static __poll_t sock_poll(struct file *file, poll_table *wait)
1426{
1427	struct socket *sock = file->private_data;
1428	const struct proto_ops *ops = READ_ONCE(sock->ops);
1429	__poll_t events = poll_requested_events(wait), flag = 0;
1430
1431	if (!ops->poll)
1432		return 0;
1433
1434	if (sk_can_busy_loop(sock->sk)) {
1435		/* poll once if requested by the syscall */
1436		if (events & POLL_BUSY_LOOP)
1437			sk_busy_loop(sock->sk, 1);
1438
1439		/* if this socket can poll_ll, tell the system call */
1440		flag = POLL_BUSY_LOOP;
1441	}
1442
1443	return ops->poll(file, sock, wait) | flag;
1444}
1445
1446static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1447{
1448	struct socket *sock = file->private_data;
1449
1450	return READ_ONCE(sock->ops)->mmap(file, sock, vma);
1451}
1452
1453static int sock_close(struct inode *inode, struct file *filp)
1454{
1455	__sock_release(SOCKET_I(inode), inode);
1456	return 0;
1457}
1458
1459/*
1460 *	Update the socket async list
1461 *
1462 *	Fasync_list locking strategy.
1463 *
1464 *	1. fasync_list is modified only under process context socket lock
1465 *	   i.e. under semaphore.
1466 *	2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1467 *	   or under socket lock
1468 */
1469
1470static int sock_fasync(int fd, struct file *filp, int on)
1471{
1472	struct socket *sock = filp->private_data;
1473	struct sock *sk = sock->sk;
1474	struct socket_wq *wq = &sock->wq;
1475
1476	if (sk == NULL)
1477		return -EINVAL;
1478
1479	lock_sock(sk);
1480	fasync_helper(fd, filp, on, &wq->fasync_list);
1481
1482	if (!wq->fasync_list)
1483		sock_reset_flag(sk, SOCK_FASYNC);
1484	else
1485		sock_set_flag(sk, SOCK_FASYNC);
1486
1487	release_sock(sk);
1488	return 0;
1489}
1490
1491/* This function may be called only under rcu_lock */
1492
1493int sock_wake_async(struct socket_wq *wq, int how, int band)
1494{
1495	if (!wq || !wq->fasync_list)
1496		return -1;
1497
1498	switch (how) {
1499	case SOCK_WAKE_WAITD:
1500		if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1501			break;
1502		goto call_kill;
1503	case SOCK_WAKE_SPACE:
1504		if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1505			break;
1506		fallthrough;
1507	case SOCK_WAKE_IO:
1508call_kill:
1509		kill_fasync(&wq->fasync_list, SIGIO, band);
1510		break;
1511	case SOCK_WAKE_URG:
1512		kill_fasync(&wq->fasync_list, SIGURG, band);
1513	}
1514
1515	return 0;
1516}
1517EXPORT_SYMBOL(sock_wake_async);
1518
1519/**
1520 *	__sock_create - creates a socket
1521 *	@net: net namespace
1522 *	@family: protocol family (AF_INET, ...)
1523 *	@type: communication type (SOCK_STREAM, ...)
1524 *	@protocol: protocol (0, ...)
1525 *	@res: new socket
1526 *	@kern: boolean for kernel space sockets
1527 *
1528 *	Creates a new socket and assigns it to @res, passing through LSM.
1529 *	Returns 0 or an error. On failure @res is set to %NULL. @kern must
1530 *	be set to true if the socket resides in kernel space.
1531 *	This function internally uses GFP_KERNEL.
1532 */
1533
1534int __sock_create(struct net *net, int family, int type, int protocol,
1535			 struct socket **res, int kern)
1536{
1537	int err;
1538	struct socket *sock;
1539	const struct net_proto_family *pf;
1540
1541	/*
1542	 *      Check protocol is in range
1543	 */
1544	if (family < 0 || family >= NPROTO)
1545		return -EAFNOSUPPORT;
1546	if (type < 0 || type >= SOCK_MAX)
1547		return -EINVAL;
1548
1549	/* Compatibility.
1550
1551	   This uglymoron is moved from INET layer to here to avoid
1552	   deadlock in module load.
1553	 */
1554	if (family == PF_INET && type == SOCK_PACKET) {
1555		pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1556			     current->comm);
1557		family = PF_PACKET;
1558	}
1559
1560	err = security_socket_create(family, type, protocol, kern);
1561	if (err)
1562		return err;
1563
1564	/*
1565	 *	Allocate the socket and allow the family to set things up. if
1566	 *	the protocol is 0, the family is instructed to select an appropriate
1567	 *	default.
1568	 */
1569	sock = sock_alloc();
1570	if (!sock) {
1571		net_warn_ratelimited("socket: no more sockets\n");
1572		return -ENFILE;	/* Not exactly a match, but its the
1573				   closest posix thing */
1574	}
1575
1576	sock->type = type;
1577
1578#ifdef CONFIG_MODULES
1579	/* Attempt to load a protocol module if the find failed.
1580	 *
1581	 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1582	 * requested real, full-featured networking support upon configuration.
1583	 * Otherwise module support will break!
1584	 */
1585	if (rcu_access_pointer(net_families[family]) == NULL)
1586		request_module("net-pf-%d", family);
1587#endif
1588
1589	rcu_read_lock();
1590	pf = rcu_dereference(net_families[family]);
1591	err = -EAFNOSUPPORT;
1592	if (!pf)
1593		goto out_release;
1594
1595	/*
1596	 * We will call the ->create function, that possibly is in a loadable
1597	 * module, so we have to bump that loadable module refcnt first.
1598	 */
1599	if (!try_module_get(pf->owner))
1600		goto out_release;
1601
1602	/* Now protected by module ref count */
1603	rcu_read_unlock();
1604
1605	err = pf->create(net, sock, protocol, kern);
1606	if (err < 0) {
1607		/* ->create should release the allocated sock->sk object on error
1608		 * and make sure sock->sk is set to NULL to avoid use-after-free
1609		 */
1610		DEBUG_NET_WARN_ONCE(sock->sk,
1611				    "%ps must clear sock->sk on failure, family: %d, type: %d, protocol: %d\n",
1612				    pf->create, family, type, protocol);
1613		goto out_module_put;
1614	}
1615
1616	/*
1617	 * Now to bump the refcnt of the [loadable] module that owns this
1618	 * socket at sock_release time we decrement its refcnt.
1619	 */
1620	if (!try_module_get(sock->ops->owner))
1621		goto out_module_busy;
1622
1623	/*
1624	 * Now that we're done with the ->create function, the [loadable]
1625	 * module can have its refcnt decremented
1626	 */
1627	module_put(pf->owner);
1628	err = security_socket_post_create(sock, family, type, protocol, kern);
1629	if (err)
1630		goto out_sock_release;
1631	*res = sock;
1632
1633	return 0;
1634
1635out_module_busy:
1636	err = -EAFNOSUPPORT;
1637out_module_put:
1638	sock->ops = NULL;
1639	module_put(pf->owner);
1640out_sock_release:
1641	sock_release(sock);
1642	return err;
1643
1644out_release:
1645	rcu_read_unlock();
1646	goto out_sock_release;
1647}
1648EXPORT_SYMBOL(__sock_create);
1649
1650/**
1651 *	sock_create - creates a socket
1652 *	@family: protocol family (AF_INET, ...)
1653 *	@type: communication type (SOCK_STREAM, ...)
1654 *	@protocol: protocol (0, ...)
1655 *	@res: new socket
1656 *
1657 *	A wrapper around __sock_create().
1658 *	Returns 0 or an error. This function internally uses GFP_KERNEL.
1659 */
1660
1661int sock_create(int family, int type, int protocol, struct socket **res)
1662{
1663	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1664}
1665EXPORT_SYMBOL(sock_create);
1666
1667/**
1668 *	sock_create_kern - creates a socket (kernel space)
1669 *	@net: net namespace
1670 *	@family: protocol family (AF_INET, ...)
1671 *	@type: communication type (SOCK_STREAM, ...)
1672 *	@protocol: protocol (0, ...)
1673 *	@res: new socket
1674 *
1675 *	A wrapper around __sock_create().
1676 *	Returns 0 or an error. This function internally uses GFP_KERNEL.
1677 */
1678
1679int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1680{
1681	return __sock_create(net, family, type, protocol, res, 1);
1682}
1683EXPORT_SYMBOL(sock_create_kern);
1684
1685static struct socket *__sys_socket_create(int family, int type, int protocol)
1686{
1687	struct socket *sock;
1688	int retval;
1689
1690	/* Check the SOCK_* constants for consistency.  */
1691	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1692	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1693	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1694	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1695
1696	if ((type & ~SOCK_TYPE_MASK) & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1697		return ERR_PTR(-EINVAL);
1698	type &= SOCK_TYPE_MASK;
1699
1700	retval = sock_create(family, type, protocol, &sock);
1701	if (retval < 0)
1702		return ERR_PTR(retval);
1703
1704	return sock;
1705}
1706
1707struct file *__sys_socket_file(int family, int type, int protocol)
1708{
1709	struct socket *sock;
1710	int flags;
1711
1712	sock = __sys_socket_create(family, type, protocol);
1713	if (IS_ERR(sock))
1714		return ERR_CAST(sock);
1715
1716	flags = type & ~SOCK_TYPE_MASK;
1717	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1718		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1719
1720	return sock_alloc_file(sock, flags, NULL);
1721}
1722
1723/*	A hook for bpf progs to attach to and update socket protocol.
1724 *
1725 *	A static noinline declaration here could cause the compiler to
1726 *	optimize away the function. A global noinline declaration will
1727 *	keep the definition, but may optimize away the callsite.
1728 *	Therefore, __weak is needed to ensure that the call is still
1729 *	emitted, by telling the compiler that we don't know what the
1730 *	function might eventually be.
1731 */
1732
1733__bpf_hook_start();
1734
1735__weak noinline int update_socket_protocol(int family, int type, int protocol)
1736{
1737	return protocol;
1738}
1739
1740__bpf_hook_end();
1741
1742int __sys_socket(int family, int type, int protocol)
1743{
1744	struct socket *sock;
1745	int flags;
1746
1747	sock = __sys_socket_create(family, type,
1748				   update_socket_protocol(family, type, protocol));
1749	if (IS_ERR(sock))
1750		return PTR_ERR(sock);
1751
1752	flags = type & ~SOCK_TYPE_MASK;
1753	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1754		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1755
1756	return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1757}
1758
1759SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1760{
1761	return __sys_socket(family, type, protocol);
1762}
1763
1764/*
1765 *	Create a pair of connected sockets.
1766 */
1767
1768int __sys_socketpair(int family, int type, int protocol, int __user *usockvec)
1769{
1770	struct socket *sock1, *sock2;
1771	int fd1, fd2, err;
1772	struct file *newfile1, *newfile2;
1773	int flags;
1774
1775	flags = type & ~SOCK_TYPE_MASK;
1776	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1777		return -EINVAL;
1778	type &= SOCK_TYPE_MASK;
1779
1780	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1781		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1782
1783	/*
1784	 * reserve descriptors and make sure we won't fail
1785	 * to return them to userland.
1786	 */
1787	fd1 = get_unused_fd_flags(flags);
1788	if (unlikely(fd1 < 0))
1789		return fd1;
1790
1791	fd2 = get_unused_fd_flags(flags);
1792	if (unlikely(fd2 < 0)) {
1793		put_unused_fd(fd1);
1794		return fd2;
1795	}
1796
1797	err = put_user(fd1, &usockvec[0]);
1798	if (err)
1799		goto out;
1800
1801	err = put_user(fd2, &usockvec[1]);
1802	if (err)
1803		goto out;
1804
1805	/*
1806	 * Obtain the first socket and check if the underlying protocol
1807	 * supports the socketpair call.
1808	 */
1809
1810	err = sock_create(family, type, protocol, &sock1);
1811	if (unlikely(err < 0))
1812		goto out;
1813
1814	err = sock_create(family, type, protocol, &sock2);
1815	if (unlikely(err < 0)) {
1816		sock_release(sock1);
1817		goto out;
1818	}
1819
1820	err = security_socket_socketpair(sock1, sock2);
1821	if (unlikely(err)) {
1822		sock_release(sock2);
1823		sock_release(sock1);
1824		goto out;
1825	}
1826
1827	err = READ_ONCE(sock1->ops)->socketpair(sock1, sock2);
1828	if (unlikely(err < 0)) {
1829		sock_release(sock2);
1830		sock_release(sock1);
1831		goto out;
1832	}
1833
1834	newfile1 = sock_alloc_file(sock1, flags, NULL);
1835	if (IS_ERR(newfile1)) {
1836		err = PTR_ERR(newfile1);
1837		sock_release(sock2);
1838		goto out;
1839	}
1840
1841	newfile2 = sock_alloc_file(sock2, flags, NULL);
1842	if (IS_ERR(newfile2)) {
1843		err = PTR_ERR(newfile2);
1844		fput(newfile1);
1845		goto out;
1846	}
1847
1848	audit_fd_pair(fd1, fd2);
1849
1850	fd_install(fd1, newfile1);
1851	fd_install(fd2, newfile2);
1852	return 0;
1853
1854out:
1855	put_unused_fd(fd2);
1856	put_unused_fd(fd1);
1857	return err;
1858}
1859
1860SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1861		int __user *, usockvec)
1862{
1863	return __sys_socketpair(family, type, protocol, usockvec);
1864}
1865
1866int __sys_bind_socket(struct socket *sock, struct sockaddr_storage *address,
1867		      int addrlen)
1868{
1869	int err;
1870
1871	err = security_socket_bind(sock, (struct sockaddr *)address,
1872				   addrlen);
1873	if (!err)
1874		err = READ_ONCE(sock->ops)->bind(sock,
1875						 (struct sockaddr_unsized *)address,
1876						 addrlen);
1877	return err;
1878}
1879
1880/*
1881 *	Bind a name to a socket. Nothing much to do here since it's
1882 *	the protocol's responsibility to handle the local address.
1883 *
1884 *	We move the socket address to kernel space before we call
1885 *	the protocol layer (having also checked the address is ok).
1886 */
1887
1888int __sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
1889{
1890	struct socket *sock;
1891	struct sockaddr_storage address;
1892	CLASS(fd, f)(fd);
1893	int err;
1894
1895	if (fd_empty(f))
1896		return -EBADF;
1897	sock = sock_from_file(fd_file(f));
1898	if (unlikely(!sock))
1899		return -ENOTSOCK;
1900
1901	err = move_addr_to_kernel(umyaddr, addrlen, &address);
1902	if (unlikely(err))
1903		return err;
1904
1905	return __sys_bind_socket(sock, &address, addrlen);
1906}
1907
1908SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1909{
1910	return __sys_bind(fd, umyaddr, addrlen);
1911}
1912
1913/*
1914 *	Perform a listen. Basically, we allow the protocol to do anything
1915 *	necessary for a listen, and if that works, we mark the socket as
1916 *	ready for listening.
1917 */
1918int __sys_listen_socket(struct socket *sock, int backlog)
1919{
1920	int somaxconn, err;
1921
1922	somaxconn = READ_ONCE(sock_net(sock->sk)->core.sysctl_somaxconn);
1923	if ((unsigned int)backlog > somaxconn)
1924		backlog = somaxconn;
1925
1926	err = security_socket_listen(sock, backlog);
1927	if (!err)
1928		err = READ_ONCE(sock->ops)->listen(sock, backlog);
1929	return err;
1930}
1931
1932int __sys_listen(int fd, int backlog)
1933{
1934	CLASS(fd, f)(fd);
1935	struct socket *sock;
1936
1937	if (fd_empty(f))
1938		return -EBADF;
1939	sock = sock_from_file(fd_file(f));
1940	if (unlikely(!sock))
1941		return -ENOTSOCK;
1942
1943	return __sys_listen_socket(sock, backlog);
1944}
1945
1946SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1947{
1948	return __sys_listen(fd, backlog);
1949}
1950
1951struct file *do_accept(struct file *file, struct proto_accept_arg *arg,
1952		       struct sockaddr __user *upeer_sockaddr,
1953		       int __user *upeer_addrlen, int flags)
1954{
1955	struct socket *sock, *newsock;
1956	struct file *newfile;
1957	int err, len;
1958	struct sockaddr_storage address;
1959	const struct proto_ops *ops;
1960
1961	sock = sock_from_file(file);
1962	if (!sock)
1963		return ERR_PTR(-ENOTSOCK);
1964
1965	newsock = sock_alloc();
1966	if (!newsock)
1967		return ERR_PTR(-ENFILE);
1968	ops = READ_ONCE(sock->ops);
1969
1970	newsock->type = sock->type;
1971	newsock->ops = ops;
1972
1973	/*
1974	 * We don't need try_module_get here, as the listening socket (sock)
1975	 * has the protocol module (sock->ops->owner) held.
1976	 */
1977	__module_get(ops->owner);
1978
1979	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1980	if (IS_ERR(newfile))
1981		return newfile;
1982
1983	err = security_socket_accept(sock, newsock);
1984	if (err)
1985		goto out_fd;
1986
1987	arg->flags |= sock->file->f_flags;
1988	err = ops->accept(sock, newsock, arg);
1989	if (err < 0)
1990		goto out_fd;
1991
1992	if (upeer_sockaddr) {
1993		len = ops->getname(newsock, (struct sockaddr *)&address, 2);
1994		if (len < 0) {
1995			err = -ECONNABORTED;
1996			goto out_fd;
1997		}
1998		err = move_addr_to_user(&address,
1999					len, upeer_sockaddr, upeer_addrlen);
2000		if (err < 0)
2001			goto out_fd;
2002	}
2003
2004	/* File flags are not inherited via accept() unlike another OSes. */
2005	return newfile;
2006out_fd:
2007	fput(newfile);
2008	return ERR_PTR(err);
2009}
2010
2011static int __sys_accept4_file(struct file *file, struct sockaddr __user *upeer_sockaddr,
2012			      int __user *upeer_addrlen, int flags)
2013{
2014	struct proto_accept_arg arg = { };
2015
2016	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
2017		return -EINVAL;
2018
2019	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
2020		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
2021
2022	return FD_ADD(flags, do_accept(file, &arg, upeer_sockaddr, upeer_addrlen, flags));
2023}
2024
2025/*
2026 *	For accept, we attempt to create a new socket, set up the link
2027 *	with the client, wake up the client, then return the new
2028 *	connected fd. We collect the address of the connector in kernel
2029 *	space and move it to user at the very end. This is unclean because
2030 *	we open the socket then return an error.
2031 *
2032 *	1003.1g adds the ability to recvmsg() to query connection pending
2033 *	status to recvmsg. We need to add that support in a way thats
2034 *	clean when we restructure accept also.
2035 */
2036
2037int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
2038		  int __user *upeer_addrlen, int flags)
2039{
2040	CLASS(fd, f)(fd);
2041
2042	if (fd_empty(f))
2043		return -EBADF;
2044	return __sys_accept4_file(fd_file(f), upeer_sockaddr,
2045					 upeer_addrlen, flags);
2046}
2047
2048SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
2049		int __user *, upeer_addrlen, int, flags)
2050{
2051	return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags);
2052}
2053
2054SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
2055		int __user *, upeer_addrlen)
2056{
2057	return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
2058}
2059
2060/*
2061 *	Attempt to connect to a socket with the server address.  The address
2062 *	is in user space so we verify it is OK and move it to kernel space.
2063 *
2064 *	For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
2065 *	break bindings
2066 *
2067 *	NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
2068 *	other SEQPACKET protocols that take time to connect() as it doesn't
2069 *	include the -EINPROGRESS status for such sockets.
2070 */
2071
2072int __sys_connect_file(struct file *file, struct sockaddr_storage *address,
2073		       int addrlen, int file_flags)
2074{
2075	struct socket *sock;
2076	int err;
2077
2078	sock = sock_from_file(file);
2079	if (!sock) {
2080		err = -ENOTSOCK;
2081		goto out;
2082	}
2083
2084	err =
2085	    security_socket_connect(sock, (struct sockaddr *)address, addrlen);
2086	if (err)
2087		goto out;
2088
2089	err = READ_ONCE(sock->ops)->connect(sock, (struct sockaddr_unsized *)address,
2090					    addrlen, sock->file->f_flags | file_flags);
2091out:
2092	return err;
2093}
2094
2095int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
2096{
2097	struct sockaddr_storage address;
2098	CLASS(fd, f)(fd);
2099	int ret;
2100
2101	if (fd_empty(f))
2102		return -EBADF;
2103
2104	ret = move_addr_to_kernel(uservaddr, addrlen, &address);
2105	if (ret)
2106		return ret;
2107
2108	return __sys_connect_file(fd_file(f), &address, addrlen, 0);
2109}
2110
2111SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
2112		int, addrlen)
2113{
2114	return __sys_connect(fd, uservaddr, addrlen);
2115}
2116
2117int do_getsockname(struct socket *sock, int peer,
2118		   struct sockaddr __user *usockaddr, int __user *usockaddr_len)
2119{
2120	struct sockaddr_storage address;
2121	int err;
2122
2123	if (peer)
2124		err = security_socket_getpeername(sock);
2125	else
2126		err = security_socket_getsockname(sock);
2127	if (err)
2128		return err;
2129	err = READ_ONCE(sock->ops)->getname(sock, (struct sockaddr *)&address, peer);
2130	if (err < 0)
2131		return err;
2132	/* "err" is actually length in this case */
2133	return move_addr_to_user(&address, err, usockaddr, usockaddr_len);
2134}
2135
2136/*
2137 *	Get the remote or local address ('name') of a socket object. Move the
2138 *	obtained name to user space.
2139 */
2140int __sys_getsockname(int fd, struct sockaddr __user *usockaddr,
2141		      int __user *usockaddr_len, int peer)
2142{
2143	struct socket *sock;
2144	CLASS(fd, f)(fd);
2145
2146	if (fd_empty(f))
2147		return -EBADF;
2148	sock = sock_from_file(fd_file(f));
2149	if (unlikely(!sock))
2150		return -ENOTSOCK;
2151	return do_getsockname(sock, peer, usockaddr, usockaddr_len);
2152}
2153
2154SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
2155		int __user *, usockaddr_len)
2156{
2157	return __sys_getsockname(fd, usockaddr, usockaddr_len, 0);
2158}
2159
2160SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
2161		int __user *, usockaddr_len)
2162{
2163	return __sys_getsockname(fd, usockaddr, usockaddr_len, 1);
2164}
2165
2166/*
2167 *	Send a datagram to a given address. We move the address into kernel
2168 *	space and check the user space data area is readable before invoking
2169 *	the protocol.
2170 */
2171int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
2172		 struct sockaddr __user *addr,  int addr_len)
2173{
2174	struct socket *sock;
2175	struct sockaddr_storage address;
2176	int err;
2177	struct msghdr msg;
2178
2179	err = import_ubuf(ITER_SOURCE, buff, len, &msg.msg_iter);
2180	if (unlikely(err))
2181		return err;
2182
2183	CLASS(fd, f)(fd);
2184	if (fd_empty(f))
2185		return -EBADF;
2186	sock = sock_from_file(fd_file(f));
2187	if (unlikely(!sock))
2188		return -ENOTSOCK;
2189
2190	msg.msg_name = NULL;
2191	msg.msg_control = NULL;
2192	msg.msg_controllen = 0;
2193	msg.msg_namelen = 0;
2194	msg.msg_ubuf = NULL;
2195	if (addr) {
2196		err = move_addr_to_kernel(addr, addr_len, &address);
2197		if (err < 0)
2198			return err;
2199		msg.msg_name = (struct sockaddr *)&address;
2200		msg.msg_namelen = addr_len;
2201	}
2202	flags &= ~MSG_INTERNAL_SENDMSG_FLAGS;
2203	if (sock->file->f_flags & O_NONBLOCK)
2204		flags |= MSG_DONTWAIT;
2205	msg.msg_flags = flags;
2206	return __sock_sendmsg(sock, &msg);
2207}
2208
2209SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
2210		unsigned int, flags, struct sockaddr __user *, addr,
2211		int, addr_len)
2212{
2213	return __sys_sendto(fd, buff, len, flags, addr, addr_len);
2214}
2215
2216/*
2217 *	Send a datagram down a socket.
2218 */
2219
2220SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
2221		unsigned int, flags)
2222{
2223	return __sys_sendto(fd, buff, len, flags, NULL, 0);
2224}
2225
2226/*
2227 *	Receive a frame from the socket and optionally record the address of the
2228 *	sender. We verify the buffers are writable and if needed move the
2229 *	sender address from kernel to user space.
2230 */
2231int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
2232		   struct sockaddr __user *addr, int __user *addr_len)
2233{
2234	struct sockaddr_storage address;
2235	struct msghdr msg = {
2236		/* Save some cycles and don't copy the address if not needed */
2237		.msg_name = addr ? (struct sockaddr *)&address : NULL,
2238	};
2239	struct socket *sock;
2240	int err, err2;
2241
2242	err = import_ubuf(ITER_DEST, ubuf, size, &msg.msg_iter);
2243	if (unlikely(err))
2244		return err;
2245
2246	CLASS(fd, f)(fd);
2247
2248	if (fd_empty(f))
2249		return -EBADF;
2250	sock = sock_from_file(fd_file(f));
2251	if (unlikely(!sock))
2252		return -ENOTSOCK;
2253
2254	if (sock->file->f_flags & O_NONBLOCK)
2255		flags |= MSG_DONTWAIT;
2256	err = sock_recvmsg(sock, &msg, flags);
2257
2258	if (err >= 0 && addr != NULL) {
2259		err2 = move_addr_to_user(&address,
2260					 msg.msg_namelen, addr, addr_len);
2261		if (err2 < 0)
2262			err = err2;
2263	}
2264	return err;
2265}
2266
2267SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
2268		unsigned int, flags, struct sockaddr __user *, addr,
2269		int __user *, addr_len)
2270{
2271	return __sys_recvfrom(fd, ubuf, size, flags, addr, addr_len);
2272}
2273
2274/*
2275 *	Receive a datagram from a socket.
2276 */
2277
2278SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
2279		unsigned int, flags)
2280{
2281	return __sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
2282}
2283
2284static bool sock_use_custom_sol_socket(const struct socket *sock)
2285{
2286	return test_bit(SOCK_CUSTOM_SOCKOPT, &sock->flags);
2287}
2288
2289int do_sock_setsockopt(struct socket *sock, bool compat, int level,
2290		       int optname, sockptr_t optval, int optlen)
2291{
2292	const struct proto_ops *ops;
2293	char *kernel_optval = NULL;
2294	int err;
2295
2296	if (optlen < 0)
2297		return -EINVAL;
2298
2299	err = security_socket_setsockopt(sock, level, optname);
2300	if (err)
2301		goto out_put;
2302
2303	if (!compat)
2304		err = BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock->sk, &level, &optname,
2305						     optval, &optlen,
2306						     &kernel_optval);
2307	if (err < 0)
2308		goto out_put;
2309	if (err > 0) {
2310		err = 0;
2311		goto out_put;
2312	}
2313
2314	if (kernel_optval)
2315		optval = KERNEL_SOCKPTR(kernel_optval);
2316	ops = READ_ONCE(sock->ops);
2317	if (level == SOL_SOCKET && !sock_use_custom_sol_socket(sock))
2318		err = sock_setsockopt(sock, level, optname, optval, optlen);
2319	else if (unlikely(!ops->setsockopt))
2320		err = -EOPNOTSUPP;
2321	else
2322		err = ops->setsockopt(sock, level, optname, optval,
2323					    optlen);
2324	kfree(kernel_optval);
2325out_put:
2326	return err;
2327}
2328EXPORT_SYMBOL(do_sock_setsockopt);
2329
2330/* Set a socket option. Because we don't know the option lengths we have
2331 * to pass the user mode parameter for the protocols to sort out.
2332 */
2333int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval,
2334		     int optlen)
2335{
2336	sockptr_t optval = USER_SOCKPTR(user_optval);
2337	bool compat = in_compat_syscall();
2338	struct socket *sock;
2339	CLASS(fd, f)(fd);
2340
2341	if (fd_empty(f))
2342		return -EBADF;
2343	sock = sock_from_file(fd_file(f));
2344	if (unlikely(!sock))
2345		return -ENOTSOCK;
2346
2347	return do_sock_setsockopt(sock, compat, level, optname, optval, optlen);
2348}
2349
2350SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
2351		char __user *, optval, int, optlen)
2352{
2353	return __sys_setsockopt(fd, level, optname, optval, optlen);
2354}
2355
2356INDIRECT_CALLABLE_DECLARE(bool tcp_bpf_bypass_getsockopt(int level,
2357							 int optname));
2358
2359int do_sock_getsockopt(struct socket *sock, bool compat, int level,
2360		       int optname, sockptr_t optval, sockptr_t optlen)
2361{
2362	int max_optlen __maybe_unused = 0;
2363	const struct proto_ops *ops;
2364	int err;
2365
2366	err = security_socket_getsockopt(sock, level, optname);
2367	if (err)
2368		return err;
2369
2370	if (!compat)
2371		copy_from_sockptr(&max_optlen, optlen, sizeof(int));
2372
2373	ops = READ_ONCE(sock->ops);
2374	if (level == SOL_SOCKET) {
2375		err = sk_getsockopt(sock->sk, level, optname, optval, optlen);
2376	} else if (unlikely(!ops->getsockopt)) {
2377		err = -EOPNOTSUPP;
2378	} else {
2379		if (WARN_ONCE(optval.is_kernel || optlen.is_kernel,
2380			      "Invalid argument type"))
2381			return -EOPNOTSUPP;
2382
2383		err = ops->getsockopt(sock, level, optname, optval.user,
2384				      optlen.user);
2385	}
2386
2387	if (!compat)
2388		err = BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock->sk, level, optname,
2389						     optval, optlen, max_optlen,
2390						     err);
2391
2392	return err;
2393}
2394EXPORT_SYMBOL(do_sock_getsockopt);
2395
2396/*
2397 *	Get a socket option. Because we don't know the option lengths we have
2398 *	to pass a user mode parameter for the protocols to sort out.
2399 */
2400int __sys_getsockopt(int fd, int level, int optname, char __user *optval,
2401		int __user *optlen)
2402{
2403	struct socket *sock;
2404	CLASS(fd, f)(fd);
2405
2406	if (fd_empty(f))
2407		return -EBADF;
2408	sock = sock_from_file(fd_file(f));
2409	if (unlikely(!sock))
2410		return -ENOTSOCK;
2411
2412	return do_sock_getsockopt(sock, in_compat_syscall(), level, optname,
2413				 USER_SOCKPTR(optval), USER_SOCKPTR(optlen));
2414}
2415
2416SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
2417		char __user *, optval, int __user *, optlen)
2418{
2419	return __sys_getsockopt(fd, level, optname, optval, optlen);
2420}
2421
2422/*
2423 *	Shutdown a socket.
2424 */
2425
2426int __sys_shutdown_sock(struct socket *sock, int how)
2427{
2428	int err;
2429
2430	err = security_socket_shutdown(sock, how);
2431	if (!err)
2432		err = READ_ONCE(sock->ops)->shutdown(sock, how);
2433
2434	return err;
2435}
2436
2437int __sys_shutdown(int fd, int how)
2438{
2439	struct socket *sock;
2440	CLASS(fd, f)(fd);
2441
2442	if (fd_empty(f))
2443		return -EBADF;
2444	sock = sock_from_file(fd_file(f));
2445	if (unlikely(!sock))
2446		return -ENOTSOCK;
2447
2448	return __sys_shutdown_sock(sock, how);
2449}
2450
2451SYSCALL_DEFINE2(shutdown, int, fd, int, how)
2452{
2453	return __sys_shutdown(fd, how);
2454}
2455
2456/* A couple of helpful macros for getting the address of the 32/64 bit
2457 * fields which are the same type (int / unsigned) on our platforms.
2458 */
2459#define COMPAT_MSG(msg, member)	((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
2460#define COMPAT_NAMELEN(msg)	COMPAT_MSG(msg, msg_namelen)
2461#define COMPAT_FLAGS(msg)	COMPAT_MSG(msg, msg_flags)
2462
2463struct used_address {
2464	struct sockaddr_storage name;
2465	unsigned int name_len;
2466};
2467
2468int __copy_msghdr(struct msghdr *kmsg,
2469		  struct user_msghdr *msg,
2470		  struct sockaddr __user **save_addr)
2471{
2472	ssize_t err;
2473
2474	kmsg->msg_control_is_user = true;
2475	kmsg->msg_get_inq = 0;
2476	kmsg->msg_control_user = msg->msg_control;
2477	kmsg->msg_controllen = msg->msg_controllen;
2478	kmsg->msg_flags = msg->msg_flags;
2479
2480	kmsg->msg_namelen = msg->msg_namelen;
2481	if (!msg->msg_name)
2482		kmsg->msg_namelen = 0;
2483
2484	if (kmsg->msg_namelen < 0)
2485		return -EINVAL;
2486
2487	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
2488		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
2489
2490	if (save_addr)
2491		*save_addr = msg->msg_name;
2492
2493	if (msg->msg_name && kmsg->msg_namelen) {
2494		if (!save_addr) {
2495			err = move_addr_to_kernel(msg->msg_name,
2496						  kmsg->msg_namelen,
2497						  kmsg->msg_name);
2498			if (err < 0)
2499				return err;
2500		}
2501	} else {
2502		kmsg->msg_name = NULL;
2503		kmsg->msg_namelen = 0;
2504	}
2505
2506	if (msg->msg_iovlen > UIO_MAXIOV)
2507		return -EMSGSIZE;
2508
2509	kmsg->msg_iocb = NULL;
2510	kmsg->msg_ubuf = NULL;
2511	return 0;
2512}
2513
2514static int copy_msghdr_from_user(struct msghdr *kmsg,
2515				 struct user_msghdr __user *umsg,
2516				 struct sockaddr __user **save_addr,
2517				 struct iovec **iov)
2518{
2519	struct user_msghdr msg;
2520	ssize_t err;
2521
2522	if (copy_from_user(&msg, umsg, sizeof(*umsg)))
2523		return -EFAULT;
2524
2525	err = __copy_msghdr(kmsg, &msg, save_addr);
2526	if (err)
2527		return err;
2528
2529	err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE,
2530			    msg.msg_iov, msg.msg_iovlen,
2531			    UIO_FASTIOV, iov, &kmsg->msg_iter);
2532	return err < 0 ? err : 0;
2533}
2534
2535static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
2536			   unsigned int flags, struct used_address *used_address,
2537			   unsigned int allowed_msghdr_flags)
2538{
2539	unsigned char ctl[sizeof(struct cmsghdr) + 20]
2540				__aligned(sizeof(__kernel_size_t));
2541	/* 20 is size of ipv6_pktinfo */
2542	unsigned char *ctl_buf = ctl;
2543	int ctl_len;
2544	ssize_t err;
2545
2546	err = -ENOBUFS;
2547
2548	if (msg_sys->msg_controllen > INT_MAX)
2549		goto out;
2550	flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
2551	ctl_len = msg_sys->msg_controllen;
2552	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
2553		err =
2554		    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
2555						     sizeof(ctl));
2556		if (err)
2557			goto out;
2558		ctl_buf = msg_sys->msg_control;
2559		ctl_len = msg_sys->msg_controllen;
2560	} else if (ctl_len) {
2561		BUILD_BUG_ON(sizeof(struct cmsghdr) !=
2562			     CMSG_ALIGN(sizeof(struct cmsghdr)));
2563		if (ctl_len > sizeof(ctl)) {
2564			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
2565			if (ctl_buf == NULL)
2566				goto out;
2567		}
2568		err = -EFAULT;
2569		if (copy_from_user(ctl_buf, msg_sys->msg_control_user, ctl_len))
2570			goto out_freectl;
2571		msg_sys->msg_control = ctl_buf;
2572		msg_sys->msg_control_is_user = false;
2573	}
2574	flags &= ~MSG_INTERNAL_SENDMSG_FLAGS;
2575	msg_sys->msg_flags = flags;
2576
2577	if (sock->file->f_flags & O_NONBLOCK)
2578		msg_sys->msg_flags |= MSG_DONTWAIT;
2579	/*
2580	 * If this is sendmmsg() and current destination address is same as
2581	 * previously succeeded address, omit asking LSM's decision.
2582	 * used_address->name_len is initialized to UINT_MAX so that the first
2583	 * destination address never matches.
2584	 */
2585	if (used_address && msg_sys->msg_name &&
2586	    used_address->name_len == msg_sys->msg_namelen &&
2587	    !memcmp(&used_address->name, msg_sys->msg_name,
2588		    used_address->name_len)) {
2589		err = sock_sendmsg_nosec(sock, msg_sys);
2590		goto out_freectl;
2591	}
2592	err = __sock_sendmsg(sock, msg_sys);
2593	/*
2594	 * If this is sendmmsg() and sending to current destination address was
2595	 * successful, remember it.
2596	 */
2597	if (used_address && err >= 0) {
2598		used_address->name_len = msg_sys->msg_namelen;
2599		if (msg_sys->msg_name)
2600			memcpy(&used_address->name, msg_sys->msg_name,
2601			       used_address->name_len);
2602	}
2603
2604out_freectl:
2605	if (ctl_buf != ctl)
2606		sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2607out:
2608	return err;
2609}
2610
2611static int sendmsg_copy_msghdr(struct msghdr *msg,
2612			       struct user_msghdr __user *umsg, unsigned flags,
2613			       struct iovec **iov)
2614{
2615	int err;
2616
2617	if (flags & MSG_CMSG_COMPAT) {
2618		struct compat_msghdr __user *msg_compat;
2619
2620		msg_compat = (struct compat_msghdr __user *) umsg;
2621		err = get_compat_msghdr(msg, msg_compat, NULL, iov);
2622	} else {
2623		err = copy_msghdr_from_user(msg, umsg, NULL, iov);
2624	}
2625	if (err < 0)
2626		return err;
2627
2628	return 0;
2629}
2630
2631static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
2632			 struct msghdr *msg_sys, unsigned int flags,
2633			 struct used_address *used_address,
2634			 unsigned int allowed_msghdr_flags)
2635{
2636	struct sockaddr_storage address;
2637	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
2638	ssize_t err;
2639
2640	msg_sys->msg_name = &address;
2641
2642	err = sendmsg_copy_msghdr(msg_sys, msg, flags, &iov);
2643	if (err < 0)
2644		return err;
2645
2646	err = ____sys_sendmsg(sock, msg_sys, flags, used_address,
2647				allowed_msghdr_flags);
2648	kfree(iov);
2649	return err;
2650}
2651
2652/*
2653 *	BSD sendmsg interface
2654 */
2655long __sys_sendmsg_sock(struct socket *sock, struct msghdr *msg,
2656			unsigned int flags)
2657{
2658	return ____sys_sendmsg(sock, msg, flags, NULL, 0);
2659}
2660
2661long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
2662		   bool forbid_cmsg_compat)
2663{
2664	struct msghdr msg_sys;
2665	struct socket *sock;
2666
2667	if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
2668		return -EINVAL;
2669
2670	CLASS(fd, f)(fd);
2671
2672	if (fd_empty(f))
2673		return -EBADF;
2674	sock = sock_from_file(fd_file(f));
2675	if (unlikely(!sock))
2676		return -ENOTSOCK;
2677
2678	return ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
2679}
2680
2681SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2682{
2683	return __sys_sendmsg(fd, msg, flags, true);
2684}
2685
2686/*
2687 *	Linux sendmmsg interface
2688 */
2689
2690int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2691		   unsigned int flags, bool forbid_cmsg_compat)
2692{
2693	int err, datagrams;
2694	struct socket *sock;
2695	struct mmsghdr __user *entry;
2696	struct compat_mmsghdr __user *compat_entry;
2697	struct msghdr msg_sys;
2698	struct used_address used_address;
2699	unsigned int oflags = flags;
2700
2701	if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
2702		return -EINVAL;
2703
2704	if (vlen > UIO_MAXIOV)
2705		vlen = UIO_MAXIOV;
2706
2707	datagrams = 0;
2708
2709	CLASS(fd, f)(fd);
2710
2711	if (fd_empty(f))
2712		return -EBADF;
2713	sock = sock_from_file(fd_file(f));
2714	if (unlikely(!sock))
2715		return -ENOTSOCK;
2716
2717	used_address.name_len = UINT_MAX;
2718	entry = mmsg;
2719	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2720	err = 0;
2721	flags |= MSG_BATCH;
2722
2723	while (datagrams < vlen) {
2724		if (datagrams == vlen - 1)
2725			flags = oflags;
2726
2727		if (MSG_CMSG_COMPAT & flags) {
2728			err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2729					     &msg_sys, flags, &used_address, MSG_EOR);
2730			if (err < 0)
2731				break;
2732			err = __put_user(err, &compat_entry->msg_len);
2733			++compat_entry;
2734		} else {
2735			err = ___sys_sendmsg(sock,
2736					     (struct user_msghdr __user *)entry,
2737					     &msg_sys, flags, &used_address, MSG_EOR);
2738			if (err < 0)
2739				break;
2740			err = put_user(err, &entry->msg_len);
2741			++entry;
2742		}
2743
2744		if (err)
2745			break;
2746		++datagrams;
2747		if (msg_data_left(&msg_sys))
2748			break;
2749		cond_resched();
2750	}
2751
2752	/* We only return an error if no datagrams were able to be sent */
2753	if (datagrams != 0)
2754		return datagrams;
2755
2756	return err;
2757}
2758
2759SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2760		unsigned int, vlen, unsigned int, flags)
2761{
2762	return __sys_sendmmsg(fd, mmsg, vlen, flags, true);
2763}
2764
2765static int recvmsg_copy_msghdr(struct msghdr *msg,
2766			       struct user_msghdr __user *umsg, unsigned flags,
2767			       struct sockaddr __user **uaddr,
2768			       struct iovec **iov)
2769{
2770	ssize_t err;
2771
2772	if (MSG_CMSG_COMPAT & flags) {
2773		struct compat_msghdr __user *msg_compat;
2774
2775		msg_compat = (struct compat_msghdr __user *) umsg;
2776		err = get_compat_msghdr(msg, msg_compat, uaddr, iov);
2777	} else {
2778		err = copy_msghdr_from_user(msg, umsg, uaddr, iov);
2779	}
2780	if (err < 0)
2781		return err;
2782
2783	return 0;
2784}
2785
2786static int ____sys_recvmsg(struct socket *sock, struct msghdr *msg_sys,
2787			   struct user_msghdr __user *msg,
2788			   struct sockaddr __user *uaddr,
2789			   unsigned int flags, int nosec)
2790{
2791	struct compat_msghdr __user *msg_compat =
2792					(struct compat_msghdr __user *) msg;
2793	int __user *uaddr_len = COMPAT_NAMELEN(msg);
2794	struct sockaddr_storage addr;
2795	unsigned long cmsg_ptr;
2796	int len;
2797	ssize_t err;
2798
2799	msg_sys->msg_name = &addr;
2800	cmsg_ptr = (unsigned long)msg_sys->msg_control;
2801	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2802
2803	/* We assume all kernel code knows the size of sockaddr_storage */
2804	msg_sys->msg_namelen = 0;
2805
2806	if (sock->file->f_flags & O_NONBLOCK)
2807		flags |= MSG_DONTWAIT;
2808
2809	if (unlikely(nosec))
2810		err = sock_recvmsg_nosec(sock, msg_sys, flags);
2811	else
2812		err = sock_recvmsg(sock, msg_sys, flags);
2813
2814	if (err < 0)
2815		goto out;
2816	len = err;
2817
2818	if (uaddr != NULL) {
2819		err = move_addr_to_user(&addr,
2820					msg_sys->msg_namelen, uaddr,
2821					uaddr_len);
2822		if (err < 0)
2823			goto out;
2824	}
2825	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2826			 COMPAT_FLAGS(msg));
2827	if (err)
2828		goto out;
2829	if (MSG_CMSG_COMPAT & flags)
2830		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2831				 &msg_compat->msg_controllen);
2832	else
2833		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2834				 &msg->msg_controllen);
2835	if (err)
2836		goto out;
2837	err = len;
2838out:
2839	return err;
2840}
2841
2842static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
2843			 struct msghdr *msg_sys, unsigned int flags, int nosec)
2844{
2845	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
2846	/* user mode address pointers */
2847	struct sockaddr __user *uaddr;
2848	ssize_t err;
2849
2850	err = recvmsg_copy_msghdr(msg_sys, msg, flags, &uaddr, &iov);
2851	if (err < 0)
2852		return err;
2853
2854	err = ____sys_recvmsg(sock, msg_sys, msg, uaddr, flags, nosec);
2855	kfree(iov);
2856	return err;
2857}
2858
2859/*
2860 *	BSD recvmsg interface
2861 */
2862
2863long __sys_recvmsg_sock(struct socket *sock, struct msghdr *msg,
2864			struct user_msghdr __user *umsg,
2865			struct sockaddr __user *uaddr, unsigned int flags)
2866{
2867	return ____sys_recvmsg(sock, msg, umsg, uaddr, flags, 0);
2868}
2869
2870long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
2871		   bool forbid_cmsg_compat)
2872{
2873	struct msghdr msg_sys;
2874	struct socket *sock;
2875
2876	if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
2877		return -EINVAL;
2878
2879	CLASS(fd, f)(fd);
2880
2881	if (fd_empty(f))
2882		return -EBADF;
2883	sock = sock_from_file(fd_file(f));
2884	if (unlikely(!sock))
2885		return -ENOTSOCK;
2886
2887	return ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2888}
2889
2890SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2891		unsigned int, flags)
2892{
2893	return __sys_recvmsg(fd, msg, flags, true);
2894}
2895
2896/*
2897 *     Linux recvmmsg interface
2898 */
2899
2900static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
2901			  unsigned int vlen, unsigned int flags,
2902			  struct timespec64 *timeout)
2903{
2904	int err = 0, datagrams;
2905	struct socket *sock;
2906	struct mmsghdr __user *entry;
2907	struct compat_mmsghdr __user *compat_entry;
2908	struct msghdr msg_sys;
2909	struct timespec64 end_time;
2910	struct timespec64 timeout64;
2911
2912	if (timeout &&
2913	    poll_select_set_timeout(&end_time, timeout->tv_sec,
2914				    timeout->tv_nsec))
2915		return -EINVAL;
2916
2917	datagrams = 0;
2918
2919	CLASS(fd, f)(fd);
2920
2921	if (fd_empty(f))
2922		return -EBADF;
2923	sock = sock_from_file(fd_file(f));
2924	if (unlikely(!sock))
2925		return -ENOTSOCK;
2926
2927	if (likely(!(flags & MSG_ERRQUEUE))) {
2928		err = sock_error(sock->sk);
2929		if (err)
2930			return err;
2931	}
2932
2933	entry = mmsg;
2934	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2935
2936	while (datagrams < vlen) {
2937		/*
2938		 * No need to ask LSM for more than the first datagram.
2939		 */
2940		if (MSG_CMSG_COMPAT & flags) {
2941			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2942					     &msg_sys, flags & ~MSG_WAITFORONE,
2943					     datagrams);
2944			if (err < 0)
2945				break;
2946			err = __put_user(err, &compat_entry->msg_len);
2947			++compat_entry;
2948		} else {
2949			err = ___sys_recvmsg(sock,
2950					     (struct user_msghdr __user *)entry,
2951					     &msg_sys, flags & ~MSG_WAITFORONE,
2952					     datagrams);
2953			if (err < 0)
2954				break;
2955			err = put_user(err, &entry->msg_len);
2956			++entry;
2957		}
2958
2959		if (err)
2960			break;
2961		++datagrams;
2962
2963		/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2964		if (flags & MSG_WAITFORONE)
2965			flags |= MSG_DONTWAIT;
2966
2967		if (timeout) {
2968			ktime_get_ts64(&timeout64);
2969			*timeout = timespec64_sub(end_time, timeout64);
2970			if (timeout->tv_sec < 0) {
2971				timeout->tv_sec = timeout->tv_nsec = 0;
2972				break;
2973			}
2974
2975			/* Timeout, return less than vlen datagrams */
2976			if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2977				break;
2978		}
2979
2980		/* Out of band data, return right away */
2981		if (msg_sys.msg_flags & MSG_OOB)
2982			break;
2983		cond_resched();
2984	}
2985
2986	if (err == 0)
2987		return datagrams;
2988
2989	if (datagrams == 0)
2990		return err;
2991
2992	/*
2993	 * We may return less entries than requested (vlen) if the
2994	 * sock is non block and there aren't enough datagrams...
2995	 */
2996	if (err != -EAGAIN) {
2997		/*
2998		 * ... or  if recvmsg returns an error after we
2999		 * received some datagrams, where we record the
3000		 * error to return on the next call or if the
3001		 * app asks about it using getsockopt(SO_ERROR).
3002		 */
3003		WRITE_ONCE(sock->sk->sk_err, -err);
3004	}
3005	return datagrams;
3006}
3007
3008int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg,
3009		   unsigned int vlen, unsigned int flags,
3010		   struct __kernel_timespec __user *timeout,
3011		   struct old_timespec32 __user *timeout32)
3012{
3013	int datagrams;
3014	struct timespec64 timeout_sys;
3015
3016	if (timeout && get_timespec64(&timeout_sys, timeout))
3017		return -EFAULT;
3018
3019	if (timeout32 && get_old_timespec32(&timeout_sys, timeout32))
3020		return -EFAULT;
3021
3022	if (!timeout && !timeout32)
3023		return do_recvmmsg(fd, mmsg, vlen, flags, NULL);
3024
3025	datagrams = do_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
3026
3027	if (datagrams <= 0)
3028		return datagrams;
3029
3030	if (timeout && put_timespec64(&timeout_sys, timeout))
3031		datagrams = -EFAULT;
3032
3033	if (timeout32 && put_old_timespec32(&timeout_sys, timeout32))
3034		datagrams = -EFAULT;
3035
3036	return datagrams;
3037}
3038
3039SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
3040		unsigned int, vlen, unsigned int, flags,
3041		struct __kernel_timespec __user *, timeout)
3042{
3043	if (flags & MSG_CMSG_COMPAT)
3044		return -EINVAL;
3045
3046	return __sys_recvmmsg(fd, mmsg, vlen, flags, timeout, NULL);
3047}
3048
3049#ifdef CONFIG_COMPAT_32BIT_TIME
3050SYSCALL_DEFINE5(recvmmsg_time32, int, fd, struct mmsghdr __user *, mmsg,
3051		unsigned int, vlen, unsigned int, flags,
3052		struct old_timespec32 __user *, timeout)
3053{
3054	if (flags & MSG_CMSG_COMPAT)
3055		return -EINVAL;
3056
3057	return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL, timeout);
3058}
3059#endif
3060
3061#ifdef __ARCH_WANT_SYS_SOCKETCALL
3062/* Argument list sizes for sys_socketcall */
3063#define AL(x) ((x) * sizeof(unsigned long))
3064static const unsigned char nargs[21] = {
3065	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
3066	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
3067	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
3068	AL(4), AL(5), AL(4)
3069};
3070
3071#undef AL
3072
3073/*
3074 *	System call vectors.
3075 *
3076 *	Argument checking cleaned up. Saved 20% in size.
3077 *  This function doesn't need to set the kernel lock because
3078 *  it is set by the callees.
3079 */
3080
3081SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
3082{
3083	unsigned long a[AUDITSC_ARGS];
3084	unsigned long a0, a1;
3085	int err;
3086	unsigned int len;
3087
3088	if (call < 1 || call > SYS_SENDMMSG)
3089		return -EINVAL;
3090	call = array_index_nospec(call, SYS_SENDMMSG + 1);
3091
3092	len = nargs[call];
3093	if (len > sizeof(a))
3094		return -EINVAL;
3095
3096	/* copy_from_user should be SMP safe. */
3097	if (copy_from_user(a, args, len))
3098		return -EFAULT;
3099
3100	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
3101	if (err)
3102		return err;
3103
3104	a0 = a[0];
3105	a1 = a[1];
3106
3107	switch (call) {
3108	case SYS_SOCKET:
3109		err = __sys_socket(a0, a1, a[2]);
3110		break;
3111	case SYS_BIND:
3112		err = __sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
3113		break;
3114	case SYS_CONNECT:
3115		err = __sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
3116		break;
3117	case SYS_LISTEN:
3118		err = __sys_listen(a0, a1);
3119		break;
3120	case SYS_ACCEPT:
3121		err = __sys_accept4(a0, (struct sockaddr __user *)a1,
3122				    (int __user *)a[2], 0);
3123		break;
3124	case SYS_GETSOCKNAME:
3125		err =
3126		    __sys_getsockname(a0, (struct sockaddr __user *)a1,
3127				      (int __user *)a[2], 0);
3128		break;
3129	case SYS_GETPEERNAME:
3130		err =
3131		    __sys_getsockname(a0, (struct sockaddr __user *)a1,
3132				      (int __user *)a[2], 1);
3133		break;
3134	case SYS_SOCKETPAIR:
3135		err = __sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
3136		break;
3137	case SYS_SEND:
3138		err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
3139				   NULL, 0);
3140		break;
3141	case SYS_SENDTO:
3142		err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
3143				   (struct sockaddr __user *)a[4], a[5]);
3144		break;
3145	case SYS_RECV:
3146		err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
3147				     NULL, NULL);
3148		break;
3149	case SYS_RECVFROM:
3150		err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
3151				     (struct sockaddr __user *)a[4],
3152				     (int __user *)a[5]);
3153		break;
3154	case SYS_SHUTDOWN:
3155		err = __sys_shutdown(a0, a1);
3156		break;
3157	case SYS_SETSOCKOPT:
3158		err = __sys_setsockopt(a0, a1, a[2], (char __user *)a[3],
3159				       a[4]);
3160		break;
3161	case SYS_GETSOCKOPT:
3162		err =
3163		    __sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
3164				     (int __user *)a[4]);
3165		break;
3166	case SYS_SENDMSG:
3167		err = __sys_sendmsg(a0, (struct user_msghdr __user *)a1,
3168				    a[2], true);
3169		break;
3170	case SYS_SENDMMSG:
3171		err = __sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2],
3172				     a[3], true);
3173		break;
3174	case SYS_RECVMSG:
3175		err = __sys_recvmsg(a0, (struct user_msghdr __user *)a1,
3176				    a[2], true);
3177		break;
3178	case SYS_RECVMMSG:
3179		if (IS_ENABLED(CONFIG_64BIT))
3180			err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
3181					     a[2], a[3],
3182					     (struct __kernel_timespec __user *)a[4],
3183					     NULL);
3184		else
3185			err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
3186					     a[2], a[3], NULL,
3187					     (struct old_timespec32 __user *)a[4]);
3188		break;
3189	case SYS_ACCEPT4:
3190		err = __sys_accept4(a0, (struct sockaddr __user *)a1,
3191				    (int __user *)a[2], a[3]);
3192		break;
3193	default:
3194		err = -EINVAL;
3195		break;
3196	}
3197	return err;
3198}
3199
3200#endif				/* __ARCH_WANT_SYS_SOCKETCALL */
3201
3202/**
3203 *	sock_register - add a socket protocol handler
3204 *	@ops: description of protocol
3205 *
3206 *	This function is called by a protocol handler that wants to
3207 *	advertise its address family, and have it linked into the
3208 *	socket interface. The value ops->family corresponds to the
3209 *	socket system call protocol family.
3210 */
3211int sock_register(const struct net_proto_family *ops)
3212{
3213	int err;
3214
3215	if (ops->family >= NPROTO) {
3216		pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
3217		return -ENOBUFS;
3218	}
3219
3220	spin_lock(&net_family_lock);
3221	if (rcu_dereference_protected(net_families[ops->family],
3222				      lockdep_is_held(&net_family_lock)))
3223		err = -EEXIST;
3224	else {
3225		rcu_assign_pointer(net_families[ops->family], ops);
3226		err = 0;
3227	}
3228	spin_unlock(&net_family_lock);
3229
3230	pr_info("NET: Registered %s protocol family\n", pf_family_names[ops->family]);
3231	return err;
3232}
3233EXPORT_SYMBOL(sock_register);
3234
3235/**
3236 *	sock_unregister - remove a protocol handler
3237 *	@family: protocol family to remove
3238 *
3239 *	This function is called by a protocol handler that wants to
3240 *	remove its address family, and have it unlinked from the
3241 *	new socket creation.
3242 *
3243 *	If protocol handler is a module, then it can use module reference
3244 *	counts to protect against new references. If protocol handler is not
3245 *	a module then it needs to provide its own protection in
3246 *	the ops->create routine.
3247 */
3248void sock_unregister(int family)
3249{
3250	BUG_ON(family < 0 || family >= NPROTO);
3251
3252	spin_lock(&net_family_lock);
3253	RCU_INIT_POINTER(net_families[family], NULL);
3254	spin_unlock(&net_family_lock);
3255
3256	synchronize_rcu();
3257
3258	pr_info("NET: Unregistered %s protocol family\n", pf_family_names[family]);
3259}
3260EXPORT_SYMBOL(sock_unregister);
3261
3262bool sock_is_registered(int family)
3263{
3264	return family < NPROTO && rcu_access_pointer(net_families[family]);
3265}
3266
3267static int __init sock_init(void)
3268{
3269	int err;
3270	/*
3271	 *      Initialize the network sysctl infrastructure.
3272	 */
3273	err = net_sysctl_init();
3274	if (err)
3275		goto out;
3276
3277	/*
3278	 *      Initialize skbuff SLAB cache
3279	 */
3280	skb_init();
3281
3282	/*
3283	 *      Initialize the protocols module.
3284	 */
3285
3286	init_inodecache();
3287
3288	err = register_filesystem(&sock_fs_type);
3289	if (err)
3290		goto out;
3291	sock_mnt = kern_mount(&sock_fs_type);
3292	if (IS_ERR(sock_mnt)) {
3293		err = PTR_ERR(sock_mnt);
3294		goto out_mount;
3295	}
3296
3297	/* The real protocol initialization is performed in later initcalls.
3298	 */
3299
3300#ifdef CONFIG_NETFILTER
3301	err = netfilter_init();
3302	if (err)
3303		goto out;
3304#endif
3305
3306	ptp_classifier_init();
3307
3308out:
3309	return err;
3310
3311out_mount:
3312	unregister_filesystem(&sock_fs_type);
3313	goto out;
3314}
3315
3316core_initcall(sock_init);	/* early initcall */
3317
3318#ifdef CONFIG_PROC_FS
3319void socket_seq_show(struct seq_file *seq)
3320{
3321	seq_printf(seq, "sockets: used %d\n",
3322		   sock_inuse_get(seq->private));
3323}
3324#endif				/* CONFIG_PROC_FS */
3325
3326/* Handle the fact that while struct ifreq has the same *layout* on
3327 * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
3328 * which are handled elsewhere, it still has different *size* due to
3329 * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
3330 * resulting in struct ifreq being 32 and 40 bytes respectively).
3331 * As a result, if the struct happens to be at the end of a page and
3332 * the next page isn't readable/writable, we get a fault. To prevent
3333 * that, copy back and forth to the full size.
3334 */
3335int get_user_ifreq(struct ifreq *ifr, void __user **ifrdata, void __user *arg)
3336{
3337	if (in_compat_syscall()) {
3338		struct compat_ifreq *ifr32 = (struct compat_ifreq *)ifr;
3339
3340		memset(ifr, 0, sizeof(*ifr));
3341		if (copy_from_user(ifr32, arg, sizeof(*ifr32)))
3342			return -EFAULT;
3343
3344		if (ifrdata)
3345			*ifrdata = compat_ptr(ifr32->ifr_data);
3346
3347		return 0;
3348	}
3349
3350	if (copy_from_user(ifr, arg, sizeof(*ifr)))
3351		return -EFAULT;
3352
3353	if (ifrdata)
3354		*ifrdata = ifr->ifr_data;
3355
3356	return 0;
3357}
3358EXPORT_SYMBOL(get_user_ifreq);
3359
3360int put_user_ifreq(struct ifreq *ifr, void __user *arg)
3361{
3362	size_t size = sizeof(*ifr);
3363
3364	if (in_compat_syscall())
3365		size = sizeof(struct compat_ifreq);
3366
3367	if (copy_to_user(arg, ifr, size))
3368		return -EFAULT;
3369
3370	return 0;
3371}
3372EXPORT_SYMBOL(put_user_ifreq);
3373
3374#ifdef CONFIG_COMPAT
3375static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
3376{
3377	compat_uptr_t uptr32;
3378	struct ifreq ifr;
3379	void __user *saved;
3380	int err;
3381
3382	if (get_user_ifreq(&ifr, NULL, uifr32))
3383		return -EFAULT;
3384
3385	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
3386		return -EFAULT;
3387
3388	saved = ifr.ifr_settings.ifs_ifsu.raw_hdlc;
3389	ifr.ifr_settings.ifs_ifsu.raw_hdlc = compat_ptr(uptr32);
3390
3391	err = dev_ioctl(net, SIOCWANDEV, &ifr, NULL, NULL);
3392	if (!err) {
3393		ifr.ifr_settings.ifs_ifsu.raw_hdlc = saved;
3394		if (put_user_ifreq(&ifr, uifr32))
3395			err = -EFAULT;
3396	}
3397	return err;
3398}
3399
3400/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
3401static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
3402				 struct compat_ifreq __user *u_ifreq32)
3403{
3404	struct ifreq ifreq;
3405	void __user *data;
3406
3407	if (!is_socket_ioctl_cmd(cmd))
3408		return -ENOTTY;
3409	if (get_user_ifreq(&ifreq, &data, u_ifreq32))
3410		return -EFAULT;
3411	ifreq.ifr_data = data;
3412
3413	return dev_ioctl(net, cmd, &ifreq, data, NULL);
3414}
3415
3416static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3417			 unsigned int cmd, unsigned long arg)
3418{
3419	void __user *argp = compat_ptr(arg);
3420	struct sock *sk = sock->sk;
3421	struct net *net = sock_net(sk);
3422	const struct proto_ops *ops;
3423
3424	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3425		return sock_ioctl(file, cmd, (unsigned long)argp);
3426
3427	switch (cmd) {
3428	case SIOCWANDEV:
3429		return compat_siocwandev(net, argp);
3430	case SIOCGSTAMP_OLD:
3431	case SIOCGSTAMPNS_OLD:
3432		ops = READ_ONCE(sock->ops);
3433		if (!ops->gettstamp)
3434			return -ENOIOCTLCMD;
3435		return ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD,
3436				      !COMPAT_USE_64BIT_TIME);
3437
3438	case SIOCETHTOOL:
3439	case SIOCBONDSLAVEINFOQUERY:
3440	case SIOCBONDINFOQUERY:
3441	case SIOCSHWTSTAMP:
3442	case SIOCGHWTSTAMP:
3443		return compat_ifr_data_ioctl(net, cmd, argp);
3444
3445	case FIOSETOWN:
3446	case SIOCSPGRP:
3447	case FIOGETOWN:
3448	case SIOCGPGRP:
3449	case SIOCBRADDBR:
3450	case SIOCBRDELBR:
3451	case SIOCBRADDIF:
3452	case SIOCBRDELIF:
3453	case SIOCGIFVLAN:
3454	case SIOCSIFVLAN:
3455	case SIOCGSKNS:
3456	case SIOCGSTAMP_NEW:
3457	case SIOCGSTAMPNS_NEW:
3458	case SIOCGIFCONF:
3459	case SIOCSIFBR:
3460	case SIOCGIFBR:
3461		return sock_ioctl(file, cmd, arg);
3462
3463	case SIOCGIFFLAGS:
3464	case SIOCSIFFLAGS:
3465	case SIOCGIFMAP:
3466	case SIOCSIFMAP:
3467	case SIOCGIFMETRIC:
3468	case SIOCSIFMETRIC:
3469	case SIOCGIFMTU:
3470	case SIOCSIFMTU:
3471	case SIOCGIFMEM:
3472	case SIOCSIFMEM:
3473	case SIOCGIFHWADDR:
3474	case SIOCSIFHWADDR:
3475	case SIOCADDMULTI:
3476	case SIOCDELMULTI:
3477	case SIOCGIFINDEX:
3478	case SIOCGIFADDR:
3479	case SIOCSIFADDR:
3480	case SIOCSIFHWBROADCAST:
3481	case SIOCDIFADDR:
3482	case SIOCGIFBRDADDR:
3483	case SIOCSIFBRDADDR:
3484	case SIOCGIFDSTADDR:
3485	case SIOCSIFDSTADDR:
3486	case SIOCGIFNETMASK:
3487	case SIOCSIFNETMASK:
3488	case SIOCSIFPFLAGS:
3489	case SIOCGIFPFLAGS:
3490	case SIOCGIFTXQLEN:
3491	case SIOCSIFTXQLEN:
3492	case SIOCGIFNAME:
3493	case SIOCSIFNAME:
3494	case SIOCGMIIPHY:
3495	case SIOCGMIIREG:
3496	case SIOCSMIIREG:
3497	case SIOCBONDENSLAVE:
3498	case SIOCBONDRELEASE:
3499	case SIOCBONDSETHWADDR:
3500	case SIOCBONDCHANGEACTIVE:
3501	case SIOCSARP:
3502	case SIOCGARP:
3503	case SIOCDARP:
3504	case SIOCOUTQ:
3505	case SIOCOUTQNSD:
3506	case SIOCATMARK:
3507		return sock_do_ioctl(net, sock, cmd, arg);
3508	}
3509
3510	return -ENOIOCTLCMD;
3511}
3512
3513static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3514			      unsigned long arg)
3515{
3516	struct socket *sock = file->private_data;
3517	const struct proto_ops *ops = READ_ONCE(sock->ops);
3518	int ret = -ENOIOCTLCMD;
3519	struct sock *sk;
3520	struct net *net;
3521
3522	sk = sock->sk;
3523	net = sock_net(sk);
3524
3525	if (ops->compat_ioctl)
3526		ret = ops->compat_ioctl(sock, cmd, arg);
3527
3528	if (ret == -ENOIOCTLCMD &&
3529	    (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3530		ret = compat_wext_handle_ioctl(net, cmd, arg);
3531
3532	if (ret == -ENOIOCTLCMD)
3533		ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3534
3535	return ret;
3536}
3537#endif
3538
3539/**
3540 *	kernel_bind - bind an address to a socket (kernel space)
3541 *	@sock: socket
3542 *	@addr: address
3543 *	@addrlen: length of address
3544 *
3545 *	Returns 0 or an error.
3546 */
3547
3548int kernel_bind(struct socket *sock, struct sockaddr_unsized *addr, int addrlen)
3549{
3550	struct sockaddr_storage address;
3551
3552	memcpy(&address, addr, addrlen);
3553
3554	return READ_ONCE(sock->ops)->bind(sock, (struct sockaddr_unsized *)&address,
3555					  addrlen);
3556}
3557EXPORT_SYMBOL(kernel_bind);
3558
3559/**
3560 *	kernel_listen - move socket to listening state (kernel space)
3561 *	@sock: socket
3562 *	@backlog: pending connections queue size
3563 *
3564 *	Returns 0 or an error.
3565 */
3566
3567int kernel_listen(struct socket *sock, int backlog)
3568{
3569	return READ_ONCE(sock->ops)->listen(sock, backlog);
3570}
3571EXPORT_SYMBOL(kernel_listen);
3572
3573/**
3574 *	kernel_accept - accept a connection (kernel space)
3575 *	@sock: listening socket
3576 *	@newsock: new connected socket
3577 *	@flags: flags
3578 *
3579 *	@flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0.
3580 *	If it fails, @newsock is guaranteed to be %NULL.
3581 *	Returns 0 or an error.
3582 */
3583
3584int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3585{
3586	struct sock *sk = sock->sk;
3587	const struct proto_ops *ops = READ_ONCE(sock->ops);
3588	struct proto_accept_arg arg = {
3589		.flags = flags,
3590		.kern = true,
3591	};
3592	int err;
3593
3594	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3595			       newsock);
3596	if (err < 0)
3597		goto done;
3598
3599	err = ops->accept(sock, *newsock, &arg);
3600	if (err < 0) {
3601		sock_release(*newsock);
3602		*newsock = NULL;
3603		goto done;
3604	}
3605
3606	(*newsock)->ops = ops;
3607	__module_get(ops->owner);
3608
3609done:
3610	return err;
3611}
3612EXPORT_SYMBOL(kernel_accept);
3613
3614/**
3615 *	kernel_connect - connect a socket (kernel space)
3616 *	@sock: socket
3617 *	@addr: address
3618 *	@addrlen: address length
3619 *	@flags: flags (O_NONBLOCK, ...)
3620 *
3621 *	For datagram sockets, @addr is the address to which datagrams are sent
3622 *	by default, and the only address from which datagrams are received.
3623 *	For stream sockets, attempts to connect to @addr.
3624 *	Returns 0 or an error code.
3625 */
3626
3627int kernel_connect(struct socket *sock, struct sockaddr_unsized *addr, int addrlen,
3628		   int flags)
3629{
3630	struct sockaddr_storage address;
3631
3632	memcpy(&address, addr, addrlen);
3633
3634	return READ_ONCE(sock->ops)->connect(sock, (struct sockaddr_unsized *)&address,
3635					     addrlen, flags);
3636}
3637EXPORT_SYMBOL(kernel_connect);
3638
3639/**
3640 *	kernel_getsockname - get the address which the socket is bound (kernel space)
3641 *	@sock: socket
3642 *	@addr: address holder
3643 *
3644 * 	Fills the @addr pointer with the address which the socket is bound.
3645 *	Returns the length of the address in bytes or an error code.
3646 */
3647
3648int kernel_getsockname(struct socket *sock, struct sockaddr *addr)
3649{
3650	return READ_ONCE(sock->ops)->getname(sock, addr, 0);
3651}
3652EXPORT_SYMBOL(kernel_getsockname);
3653
3654/**
3655 *	kernel_getpeername - get the address which the socket is connected (kernel space)
3656 *	@sock: socket
3657 *	@addr: address holder
3658 *
3659 * 	Fills the @addr pointer with the address which the socket is connected.
3660 *	Returns the length of the address in bytes or an error code.
3661 */
3662
3663int kernel_getpeername(struct socket *sock, struct sockaddr *addr)
3664{
3665	return READ_ONCE(sock->ops)->getname(sock, addr, 1);
3666}
3667EXPORT_SYMBOL(kernel_getpeername);
3668
3669/**
3670 *	kernel_sock_shutdown - shut down part of a full-duplex connection (kernel space)
3671 *	@sock: socket
3672 *	@how: connection part
3673 *
3674 *	Returns 0 or an error.
3675 */
3676
3677int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3678{
3679	return READ_ONCE(sock->ops)->shutdown(sock, how);
3680}
3681EXPORT_SYMBOL(kernel_sock_shutdown);
3682
3683/**
3684 *	kernel_sock_ip_overhead - returns the IP overhead imposed by a socket
3685 *	@sk: socket
3686 *
3687 *	This routine returns the IP overhead imposed by a socket i.e.
3688 *	the length of the underlying IP header, depending on whether
3689 *	this is an IPv4 or IPv6 socket and the length from IP options turned
3690 *	on at the socket. Assumes that the caller has a lock on the socket.
3691 */
3692
3693u32 kernel_sock_ip_overhead(struct sock *sk)
3694{
3695	struct inet_sock *inet;
3696	struct ip_options_rcu *opt;
3697	u32 overhead = 0;
3698#if IS_ENABLED(CONFIG_IPV6)
3699	struct ipv6_pinfo *np;
3700	struct ipv6_txoptions *optv6 = NULL;
3701#endif /* IS_ENABLED(CONFIG_IPV6) */
3702
3703	if (!sk)
3704		return overhead;
3705
3706	switch (sk->sk_family) {
3707	case AF_INET:
3708		inet = inet_sk(sk);
3709		overhead += sizeof(struct iphdr);
3710		opt = rcu_dereference_protected(inet->inet_opt,
3711						sock_owned_by_user(sk));
3712		if (opt)
3713			overhead += opt->opt.optlen;
3714		return overhead;
3715#if IS_ENABLED(CONFIG_IPV6)
3716	case AF_INET6:
3717		np = inet6_sk(sk);
3718		overhead += sizeof(struct ipv6hdr);
3719		if (np)
3720			optv6 = rcu_dereference_protected(np->opt,
3721							  sock_owned_by_user(sk));
3722		if (optv6)
3723			overhead += (optv6->opt_flen + optv6->opt_nflen);
3724		return overhead;
3725#endif /* IS_ENABLED(CONFIG_IPV6) */
3726	default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
3727		return overhead;
3728	}
3729}
3730EXPORT_SYMBOL(kernel_sock_ip_overhead);