linux - net/socket.c

3441 lines · 83.1 KiB

1	/*
2	* NET An implementation of the SOCKET network access protocol.
3	*
4	* Version: @(#)socket.c 1.1.93 18/02/95
5	*
6	* Authors: Orest Zborowski, <[email protected]>
7	* Ross Biro
8	* Fred N. van Kempen, <[email protected]>
9	*
10	* Fixes:
11	* Anonymous : NOTSOCK/BADF cleanup. Error fix in
12	* shutdown()
13	* Alan Cox : verify_area() fixes
14	* Alan Cox : Removed DDI
15	* Jonathan Kamens : SOCK_DGRAM reconnect bug
16	* Alan Cox : Moved a load of checks to the very
17	* top level.
18	* Alan Cox : Move address structures to/from user
19	* mode above the protocol layers.
20	* Rob Janssen : Allow 0 length sends.
21	* Alan Cox : Asynchronous I/O support (cribbed from the
22	* tty drivers).
23	* Niibe Yutaka : Asynchronous I/O for writes (4.4BSD style)
24	* Jeff Uphoff : Made max number of sockets command-line
25	* configurable.
26	* Matti Aarnio : Made the number of sockets dynamic,
27	* to be allocated when needed, and mr.
28	* Uphoff's max is used as max to be
29	* allowed to allocate.
30	* Linus : Argh. removed all the socket allocation
31	* altogether: it's in the inode now.
32	* Alan Cox : Made sock_alloc()/sock_release() public
33	* for NetROM and future kernel nfsd type
34	* stuff.
35	* Alan Cox : sendmsg/recvmsg basics.
36	* Tom Dyas : Export net symbols.
37	* Marcin Dalecki : Fixed problems with CONFIG_NET="n".
38	* Alan Cox : Added thread locking to sys_* calls
39	* for sockets. May have errors at the
40	* moment.
41	* Kevin Buhr : Fixed the dumb errors in the above.
42	* Andi Kleen : Some small cleanups, optimizations,
43	* and fixed a copy_from_user() bug.
44	* Tigran Aivazian : sys_send(args) calls sys_sendto(args, NULL, 0)
45	* Tigran Aivazian : Made listen(2) backlog sanity checks
46	* protocol-independent
47	*
48	*
49	* This program is free software; you can redistribute it and/or
50	* modify it under the terms of the GNU General Public License
51	* as published by the Free Software Foundation; either version
52	* 2 of the License, or (at your option) any later version.
53	*
54	*
55	* This module is effectively the top level interface to the BSD socket
56	* paradigm.
57	*
58	* Based upon Swansea University Computer Society NET3.039
59	*/
60
61	#include <linux/mm.h>
62	#include <linux/socket.h>
63	#include <linux/file.h>
64	#include <linux/net.h>
65	#include <linux/interrupt.h>
66	#include <linux/thread_info.h>
67	#include <linux/rcupdate.h>
68	#include <linux/netdevice.h>
69	#include <linux/proc_fs.h>
70	#include <linux/seq_file.h>
71	#include <linux/mutex.h>
72	#include <linux/if_bridge.h>
73	#include <linux/if_frad.h>
74	#include <linux/if_vlan.h>
75	#include <linux/ptp_classify.h>
76	#include <linux/init.h>
77	#include <linux/poll.h>
78	#include <linux/cache.h>
79	#include <linux/module.h>
80	#include <linux/highmem.h>
81	#include <linux/mount.h>
82	#include <linux/security.h>
83	#include <linux/syscalls.h>
84	#include <linux/compat.h>
85	#include <linux/kmod.h>
86	#include <linux/audit.h>
87	#include <linux/wireless.h>
88	#include <linux/nsproxy.h>
89	#include <linux/magic.h>
90	#include <linux/slab.h>
91	#include <linux/xattr.h>
92
93	#include <asm/uaccess.h>
94	#include <asm/unistd.h>
95
96	#include <net/compat.h>
97	#include <net/wext.h>
98	#include <net/cls_cgroup.h>
99
100	#include <net/sock.h>
101	#include <linux/netfilter.h>
102
103	#include <linux/if_tun.h>
104	#include <linux/ipv6_route.h>
105	#include <linux/route.h>
106	#include <linux/sockios.h>
107	#include <linux/atalk.h>
108	#include <net/busy_poll.h>
109	#include <linux/errqueue.h>
110
111	#ifdef CONFIG_NET_RX_BUSY_POLL
112	unsigned int sysctl_net_busy_read __read_mostly;
113	unsigned int sysctl_net_busy_poll __read_mostly;
114	#endif
115
116	static ssize_t sock_aio_read(struct kiocb iocb, const struct iovec iov,
117	unsigned long nr_segs, loff_t pos);
118	static ssize_t sock_aio_write(struct kiocb iocb, const struct iovec iov,
119	unsigned long nr_segs, loff_t pos);
120	static int sock_mmap(struct file file, struct vm_area_struct vma);
121
122	static int sock_close(struct inode inode, struct file file);
123	static unsigned int sock_poll(struct file *file,
124	struct poll_table_struct *wait);
125	static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
126	#ifdef CONFIG_COMPAT
127	static long compat_sock_ioctl(struct file *file,
128	unsigned int cmd, unsigned long arg);
129	#endif
130	static int sock_fasync(int fd, struct file *filp, int on);
131	static ssize_t sock_sendpage(struct file file, struct page page,
132	int offset, size_t size, loff_t *ppos, int more);
133	static ssize_t sock_splice_read(struct file file, loff_t ppos,
134	struct pipe_inode_info *pipe, size_t len,
135	unsigned int flags);
136
137	/*
138	* Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
139	* in the operation structures but are done directly via the socketcall() multiplexor.
140	*/
141
142	static const struct file_operations socket_file_ops = {
143	.owner = THIS_MODULE,
144	.llseek = no_llseek,
145	.aio_read = sock_aio_read,
146	.aio_write = sock_aio_write,
147	.poll = sock_poll,
148	.unlocked_ioctl = sock_ioctl,
149	#ifdef CONFIG_COMPAT
150	.compat_ioctl = compat_sock_ioctl,
151	#endif
152	.mmap = sock_mmap,
153	.release = sock_close,
154	.fasync = sock_fasync,
155	.sendpage = sock_sendpage,
156	.splice_write = generic_splice_sendpage,
157	.splice_read = sock_splice_read,
158	};
159
160	/*
161	* The protocol list. Each protocol is registered in here.
162	*/
163
164	static DEFINE_SPINLOCK(net_family_lock);
165	static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
166
167	/*
168	* Statistics counters of the socket lists
169	*/
170
171	static DEFINE_PER_CPU(int, sockets_in_use);
172
173	/*
174	* Support routines.
175	* Move socket addresses back and forth across the kernel/user
176	* divide and look after the messy bits.
177	*/
178
179	/**
180	* move_addr_to_kernel - copy a socket address into kernel space
181	* @uaddr: Address in user space
182	* @kaddr: Address in kernel space
183	* @ulen: Length in user space
184	*
185	* The address is copied into kernel space. If the provided address is
186	* too long an error code of -EINVAL is returned. If the copy gives
187	* invalid addresses -EFAULT is returned. On a success 0 is returned.
188	*/
189
190	int move_addr_to_kernel(void __user uaddr, int ulen, struct sockaddr_storage kaddr)
191	{
192	if (ulen < 0 \|\| ulen > sizeof(struct sockaddr_storage))
193	return -EINVAL;
194	if (ulen == 0)
195	return 0;
196	if (copy_from_user(kaddr, uaddr, ulen))
197	return -EFAULT;
198	return audit_sockaddr(ulen, kaddr);
199	}
200
201	/**
202	* move_addr_to_user - copy an address to user space
203	* @kaddr: kernel space address
204	* @klen: length of address in kernel
205	* @uaddr: user space address
206	* @ulen: pointer to user length field
207	*
208	* The value pointed to by ulen on entry is the buffer length available.
209	* This is overwritten with the buffer space used. -EINVAL is returned
210	* if an overlong buffer is specified or a negative buffer size. -EFAULT
211	* is returned if either the buffer or the length field are not
212	* accessible.
213	* After copying the data up to the limit the user specifies, the true
214	* length of the data is written over the length limit the user
215	* specified. Zero is returned for a success.
216	*/
217
218	static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
219	void __user uaddr, int __user ulen)
220	{
221	int err;
222	int len;
223
224	BUG_ON(klen > sizeof(struct sockaddr_storage));
225	err = get_user(len, ulen);
226	if (err)
227	return err;
228	if (len > klen)
229	len = klen;
230	if (len < 0)
231	return -EINVAL;
232	if (len) {
233	if (audit_sockaddr(klen, kaddr))
234	return -ENOMEM;
235	if (copy_to_user(uaddr, kaddr, len))
236	return -EFAULT;
237	}
238	/*
239	* "fromlen shall refer to the value before truncation.."
240	* 1003.1g
241	*/
242	return __put_user(klen, ulen);
243	}
244
245	static struct kmem_cache *sock_inode_cachep __read_mostly;
246
247	static struct inode sock_alloc_inode(struct super_block sb)
248	{
249	struct socket_alloc *ei;
250	struct socket_wq *wq;
251
252	ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
253	if (!ei)
254	return NULL;
255	wq = kmalloc(sizeof(*wq), GFP_KERNEL);
256	if (!wq) {
257	kmem_cache_free(sock_inode_cachep, ei);
258	return NULL;
259	}
260	init_waitqueue_head(&wq->wait);
261	wq->fasync_list = NULL;
262	RCU_INIT_POINTER(ei->socket.wq, wq);
263
264	ei->socket.state = SS_UNCONNECTED;
265	ei->socket.flags = 0;
266	ei->socket.ops = NULL;
267	ei->socket.sk = NULL;
268	ei->socket.file = NULL;
269
270	return &ei->vfs_inode;
271	}
272
273	static void sock_destroy_inode(struct inode *inode)
274	{
275	struct socket_alloc *ei;
276	struct socket_wq *wq;
277
278	ei = container_of(inode, struct socket_alloc, vfs_inode);
279	wq = rcu_dereference_protected(ei->socket.wq, 1);
280	kfree_rcu(wq, rcu);
281	kmem_cache_free(sock_inode_cachep, ei);
282	}
283
284	static void init_once(void *foo)
285	{
286	struct socket_alloc ei = (struct socket_alloc )foo;
287
288	inode_init_once(&ei->vfs_inode);
289	}
290
291	static int init_inodecache(void)
292	{
293	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
294	sizeof(struct socket_alloc),
295	0,
296	(SLAB_HWCACHE_ALIGN \|
297	SLAB_RECLAIM_ACCOUNT \|
298	SLAB_MEM_SPREAD),
299	init_once);
300	if (sock_inode_cachep == NULL)
301	return -ENOMEM;
302	return 0;
303	}
304
305	static const struct super_operations sockfs_ops = {
306	.alloc_inode = sock_alloc_inode,
307	.destroy_inode = sock_destroy_inode,
308	.statfs = simple_statfs,
309	};
310
311	/*
312	* sockfs_dname() is called from d_path().
313	*/
314	static char sockfs_dname(struct dentry dentry, char *buffer, int buflen)
315	{
316	return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
317	dentry->d_inode->i_ino);
318	}
319
320	static const struct dentry_operations sockfs_dentry_operations = {
321	.d_dname = sockfs_dname,
322	};
323
324	static struct dentry sockfs_mount(struct file_system_type fs_type,
325	int flags, const char dev_name, void data)
326	{
327	return mount_pseudo(fs_type, "socket:", &sockfs_ops,
328	&sockfs_dentry_operations, SOCKFS_MAGIC);
329	}
330
331	static struct vfsmount *sock_mnt __read_mostly;
332
333	static struct file_system_type sock_fs_type = {
334	.name = "sockfs",
335	.mount = sockfs_mount,
336	.kill_sb = kill_anon_super,
337	};
338
339	/*
340	* Obtains the first available file descriptor and sets it up for use.
341	*
342	* These functions create file structures and maps them to fd space
343	* of the current process. On success it returns file descriptor
344	* and file struct implicitly stored in sock->file.
345	* Note that another thread may close file descriptor before we return
346	* from this function. We use the fact that now we do not refer
347	* to socket after mapping. If one day we will need it, this
348	* function will increment ref. count on file by 1.
349	*
350	* In any case returned fd MAY BE not valid!
351	* This race condition is unavoidable
352	* with shared fd spaces, we cannot solve it inside kernel,
353	* but we take care of internal coherence yet.
354	*/
355
356	struct file sock_alloc_file(struct socket sock, int flags, const char *dname)
357	{
358	struct qstr name = { .name = "" };
359	struct path path;
360	struct file *file;
361
362	if (dname) {
363	name.name = dname;
364	name.len = strlen(name.name);
365	} else if (sock->sk) {
366	name.name = sock->sk->sk_prot_creator->name;
367	name.len = strlen(name.name);
368	}
369	path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
370	if (unlikely(!path.dentry))
371	return ERR_PTR(-ENOMEM);
372	path.mnt = mntget(sock_mnt);
373
374	d_instantiate(path.dentry, SOCK_INODE(sock));
375
376	file = alloc_file(&path, FMODE_READ \| FMODE_WRITE,
377	&socket_file_ops);
378	if (unlikely(IS_ERR(file))) {
379	/* drop dentry, keep inode */
380	ihold(path.dentry->d_inode);
381	path_put(&path);
382	return file;
383	}
384
385	sock->file = file;
386	file->f_flags = O_RDWR \| (flags & O_NONBLOCK);
387	file->private_data = sock;
388	return file;
389	}
390	EXPORT_SYMBOL(sock_alloc_file);
391
392	static int sock_map_fd(struct socket *sock, int flags)
393	{
394	struct file *newfile;
395	int fd = get_unused_fd_flags(flags);
396	if (unlikely(fd < 0))
397	return fd;
398
399	newfile = sock_alloc_file(sock, flags, NULL);
400	if (likely(!IS_ERR(newfile))) {
401	fd_install(fd, newfile);
402	return fd;
403	}
404
405	put_unused_fd(fd);
406	return PTR_ERR(newfile);
407	}
408
409	struct socket sock_from_file(struct file file, int *err)
410	{
411	if (file->f_op == &socket_file_ops)
412	return file->private_data; /* set in sock_map_fd */
413
414	*err = -ENOTSOCK;
415	return NULL;
416	}
417	EXPORT_SYMBOL(sock_from_file);
418
419	/**
420	* sockfd_lookup - Go from a file number to its socket slot
421	* @fd: file handle
422	* @err: pointer to an error code return
423	*
424	* The file handle passed in is locked and the socket it is bound
425	* too is returned. If an error occurs the err pointer is overwritten
426	* with a negative errno code and NULL is returned. The function checks
427	* for both invalid handles and passing a handle which is not a socket.
428	*
429	* On a success the socket object pointer is returned.
430	*/
431
432	struct socket sockfd_lookup(int fd, int err)
433	{
434	struct file *file;
435	struct socket *sock;
436
437	file = fget(fd);
438	if (!file) {
439	*err = -EBADF;
440	return NULL;
441	}
442
443	sock = sock_from_file(file, err);
444	if (!sock)
445	fput(file);
446	return sock;
447	}
448	EXPORT_SYMBOL(sockfd_lookup);
449
450	static struct socket sockfd_lookup_light(int fd, int err, int *fput_needed)
451	{
452	struct fd f = fdget(fd);
453	struct socket *sock;
454
455	*err = -EBADF;
456	if (f.file) {
457	sock = sock_from_file(f.file, err);
458	if (likely(sock)) {
459	*fput_needed = f.flags;
460	return sock;
461	}
462	fdput(f);
463	}
464	return NULL;
465	}
466
467	#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
468	#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
469	#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
470	static ssize_t sockfs_getxattr(struct dentry *dentry,
471	const char name, void value, size_t size)
472	{
473	const char *proto_name;
474	size_t proto_size;
475	int error;
476
477	error = -ENODATA;
478	if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) {
479	proto_name = dentry->d_name.name;
480	proto_size = strlen(proto_name);
481
482	if (value) {
483	error = -ERANGE;
484	if (proto_size + 1 > size)
485	goto out;
486
487	strncpy(value, proto_name, proto_size + 1);
488	}
489	error = proto_size + 1;
490	}
491
492	out:
493	return error;
494	}
495
496	static ssize_t sockfs_listxattr(struct dentry dentry, char buffer,
497	size_t size)
498	{
499	ssize_t len;
500	ssize_t used = 0;
501
502	len = security_inode_listsecurity(dentry->d_inode, buffer, size);
503	if (len < 0)
504	return len;
505	used += len;
506	if (buffer) {
507	if (size < used)
508	return -ERANGE;
509	buffer += len;
510	}
511
512	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
513	used += len;
514	if (buffer) {
515	if (size < used)
516	return -ERANGE;
517	memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
518	buffer += len;
519	}
520
521	return used;
522	}
523
524	static const struct inode_operations sockfs_inode_ops = {
525	.getxattr = sockfs_getxattr,
526	.listxattr = sockfs_listxattr,
527	};
528
529	/**
530	* sock_alloc - allocate a socket
531	*
532	* Allocate a new inode and socket object. The two are bound together
533	* and initialised. The socket is then returned. If we are out of inodes
534	* NULL is returned.
535	*/
536
537	static struct socket *sock_alloc(void)
538	{
539	struct inode *inode;
540	struct socket *sock;
541
542	inode = new_inode_pseudo(sock_mnt->mnt_sb);
543	if (!inode)
544	return NULL;
545
546	sock = SOCKET_I(inode);
547
548	kmemcheck_annotate_bitfield(sock, type);
549	inode->i_ino = get_next_ino();
550	inode->i_mode = S_IFSOCK \| S_IRWXUGO;
551	inode->i_uid = current_fsuid();
552	inode->i_gid = current_fsgid();
553	inode->i_op = &sockfs_inode_ops;
554
555	this_cpu_add(sockets_in_use, 1);
556	return sock;
557	}
558
559	/**
560	* sock_release - close a socket
561	* @sock: socket to close
562	*
563	* The socket is released from the protocol stack if it has a release
564	* callback, and the inode is then released if the socket is bound to
565	* an inode not a file.
566	*/
567
568	void sock_release(struct socket *sock)
569	{
570	if (sock->ops) {
571	struct module *owner = sock->ops->owner;
572
573	sock->ops->release(sock);
574	sock->ops = NULL;
575	module_put(owner);
576	}
577
578	if (rcu_dereference_protected(sock->wq, 1)->fasync_list)
579	pr_err("%s: fasync list not empty!\n", __func__);
580
581	if (test_bit(SOCK_EXTERNALLY_ALLOCATED, &sock->flags))
582	return;
583
584	this_cpu_sub(sockets_in_use, 1);
585	if (!sock->file) {
586	iput(SOCK_INODE(sock));
587	return;
588	}
589	sock->file = NULL;
590	}
591	EXPORT_SYMBOL(sock_release);
592
593	void __sock_tx_timestamp(const struct sock sk, __u8 tx_flags)
594	{
595	u8 flags = *tx_flags;
596
597	if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
598	flags \|= SKBTX_HW_TSTAMP;
599
600	if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
601	flags \|= SKBTX_SW_TSTAMP;
602
603	if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)
604	flags \|= SKBTX_SCHED_TSTAMP;
605
606	if (sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)
607	flags \|= SKBTX_ACK_TSTAMP;
608
609	*tx_flags = flags;
610	}
611	EXPORT_SYMBOL(__sock_tx_timestamp);
612
613	static inline int __sock_sendmsg_nosec(struct kiocb iocb, struct socket sock,
614	struct msghdr *msg, size_t size)
615	{
616	struct sock_iocb *si = kiocb_to_siocb(iocb);
617
618	si->sock = sock;
619	si->scm = NULL;
620	si->msg = msg;
621	si->size = size;
622
623	return sock->ops->sendmsg(iocb, sock, msg, size);
624	}
625
626	static inline int __sock_sendmsg(struct kiocb iocb, struct socket sock,
627	struct msghdr *msg, size_t size)
628	{
629	int err = security_socket_sendmsg(sock, msg, size);
630
631	return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
632	}
633
634	static int do_sock_sendmsg(struct socket sock, struct msghdr msg,
635	size_t size, bool nosec)
636	{
637	struct kiocb iocb;
638	struct sock_iocb siocb;
639	int ret;
640
641	init_sync_kiocb(&iocb, NULL);
642	iocb.private = &siocb;
643	ret = nosec ? __sock_sendmsg_nosec(&iocb, sock, msg, size) :
644	__sock_sendmsg(&iocb, sock, msg, size);
645	if (-EIOCBQUEUED == ret)
646	ret = wait_on_sync_kiocb(&iocb);
647	return ret;
648	}
649
650	int sock_sendmsg(struct socket sock, struct msghdr msg, size_t size)
651	{
652	return do_sock_sendmsg(sock, msg, size, false);
653	}
654	EXPORT_SYMBOL(sock_sendmsg);
655
656	static int sock_sendmsg_nosec(struct socket sock, struct msghdr msg, size_t size)
657	{
658	return do_sock_sendmsg(sock, msg, size, true);
659	}
660
661	int kernel_sendmsg(struct socket sock, struct msghdr msg,
662	struct kvec *vec, size_t num, size_t size)
663	{
664	mm_segment_t oldfs = get_fs();
665	int result;
666
667	set_fs(KERNEL_DS);
668	/*
669	* the following is safe, since for compiler definitions of kvec and
670	* iovec are identical, yielding the same in-core layout and alignment
671	*/
672	iov_iter_init(&msg->msg_iter, WRITE, (struct iovec *)vec, num, size);
673	result = sock_sendmsg(sock, msg, size);
674	set_fs(oldfs);
675	return result;
676	}
677	EXPORT_SYMBOL(kernel_sendmsg);
678
679	/*
680	* called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
681	*/
682	void __sock_recv_timestamp(struct msghdr msg, struct sock sk,
683	struct sk_buff *skb)
684	{
685	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
686	struct scm_timestamping tss;
687	int empty = 1;
688	struct skb_shared_hwtstamps *shhwtstamps =
689	skb_hwtstamps(skb);
690
691	/* Race occurred between timestamp enabling and packet
692	receiving. Fill in the current time for now. */
693	if (need_software_tstamp && skb->tstamp.tv64 == 0)
694	__net_timestamp(skb);
695
696	if (need_software_tstamp) {
697	if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
698	struct timeval tv;
699	skb_get_timestamp(skb, &tv);
700	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMP,
701	sizeof(tv), &tv);
702	} else {
703	struct timespec ts;
704	skb_get_timestampns(skb, &ts);
705	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPNS,
706	sizeof(ts), &ts);
707	}
708	}
709
710	memset(&tss, 0, sizeof(tss));
711	if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
712	ktime_to_timespec_cond(skb->tstamp, tss.ts + 0))
713	empty = 0;
714	if (shhwtstamps &&
715	(sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
716	ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2))
717	empty = 0;
718	if (!empty)
719	put_cmsg(msg, SOL_SOCKET,
720	SCM_TIMESTAMPING, sizeof(tss), &tss);
721	}
722	EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
723
724	void __sock_recv_wifi_status(struct msghdr msg, struct sock sk,
725	struct sk_buff *skb)
726	{
727	int ack;
728
729	if (!sock_flag(sk, SOCK_WIFI_STATUS))
730	return;
731	if (!skb->wifi_acked_valid)
732	return;
733
734	ack = skb->wifi_acked;
735
736	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
737	}
738	EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
739
740	static inline void sock_recv_drops(struct msghdr msg, struct sock sk,
741	struct sk_buff *skb)
742	{
743	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
744	put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
745	sizeof(__u32), &skb->dropcount);
746	}
747
748	void __sock_recv_ts_and_drops(struct msghdr msg, struct sock sk,
749	struct sk_buff *skb)
750	{
751	sock_recv_timestamp(msg, sk, skb);
752	sock_recv_drops(msg, sk, skb);
753	}
754	EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
755
756	static inline int __sock_recvmsg_nosec(struct kiocb iocb, struct socket sock,
757	struct msghdr *msg, size_t size, int flags)
758	{
759	struct sock_iocb *si = kiocb_to_siocb(iocb);
760
761	si->sock = sock;
762	si->scm = NULL;
763	si->msg = msg;
764	si->size = size;
765	si->flags = flags;
766
767	return sock->ops->recvmsg(iocb, sock, msg, size, flags);
768	}
769
770	static inline int __sock_recvmsg(struct kiocb iocb, struct socket sock,
771	struct msghdr *msg, size_t size, int flags)
772	{
773	int err = security_socket_recvmsg(sock, msg, size, flags);
774
775	return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
776	}
777
778	int sock_recvmsg(struct socket sock, struct msghdr msg,
779	size_t size, int flags)
780	{
781	struct kiocb iocb;
782	struct sock_iocb siocb;
783	int ret;
784
785	init_sync_kiocb(&iocb, NULL);
786	iocb.private = &siocb;
787	ret = __sock_recvmsg(&iocb, sock, msg, size, flags);
788	if (-EIOCBQUEUED == ret)
789	ret = wait_on_sync_kiocb(&iocb);
790	return ret;
791	}
792	EXPORT_SYMBOL(sock_recvmsg);
793
794	static int sock_recvmsg_nosec(struct socket sock, struct msghdr msg,
795	size_t size, int flags)
796	{
797	struct kiocb iocb;
798	struct sock_iocb siocb;
799	int ret;
800
801	init_sync_kiocb(&iocb, NULL);
802	iocb.private = &siocb;
803	ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
804	if (-EIOCBQUEUED == ret)
805	ret = wait_on_sync_kiocb(&iocb);
806	return ret;
807	}
808
809	/**
810	* kernel_recvmsg - Receive a message from a socket (kernel space)
811	* @sock: The socket to receive the message from
812	* @msg: Received message
813	* @vec: Input s/g array for message data
814	* @num: Size of input s/g array
815	* @size: Number of bytes to read
816	* @flags: Message flags (MSG_DONTWAIT, etc...)
817	*
818	* On return the msg structure contains the scatter/gather array passed in the
819	* vec argument. The array is modified so that it consists of the unfilled
820	* portion of the original array.
821	*
822	* The returned value is the total number of bytes received, or an error.
823	*/
824	int kernel_recvmsg(struct socket sock, struct msghdr msg,
825	struct kvec *vec, size_t num, size_t size, int flags)
826	{
827	mm_segment_t oldfs = get_fs();
828	int result;
829
830	set_fs(KERNEL_DS);
831	/*
832	* the following is safe, since for compiler definitions of kvec and
833	* iovec are identical, yielding the same in-core layout and alignment
834	*/
835	iov_iter_init(&msg->msg_iter, READ, (struct iovec *)vec, num, size);
836	result = sock_recvmsg(sock, msg, size, flags);
837	set_fs(oldfs);
838	return result;
839	}
840	EXPORT_SYMBOL(kernel_recvmsg);
841
842	static ssize_t sock_sendpage(struct file file, struct page page,
843	int offset, size_t size, loff_t *ppos, int more)
844	{
845	struct socket *sock;
846	int flags;
847
848	sock = file->private_data;
849
850	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
851	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
852	flags \|= more;
853
854	return kernel_sendpage(sock, page, offset, size, flags);
855	}
856
857	static ssize_t sock_splice_read(struct file file, loff_t ppos,
858	struct pipe_inode_info *pipe, size_t len,
859	unsigned int flags)
860	{
861	struct socket *sock = file->private_data;
862
863	if (unlikely(!sock->ops->splice_read))
864	return -EINVAL;
865
866	return sock->ops->splice_read(sock, ppos, pipe, len, flags);
867	}
868
869	static struct sock_iocb alloc_sock_iocb(struct kiocb iocb,
870	struct sock_iocb *siocb)
871	{
872	siocb->kiocb = iocb;
873	iocb->private = siocb;
874	return siocb;
875	}
876
877	static ssize_t do_sock_read(struct msghdr msg, struct kiocb iocb,
878	struct file file, const struct iovec iov,
879	unsigned long nr_segs)
880	{
881	struct socket *sock = file->private_data;
882	size_t size = 0;
883	int i;
884
885	for (i = 0; i < nr_segs; i++)
886	size += iov[i].iov_len;
887
888	msg->msg_name = NULL;
889	msg->msg_namelen = 0;
890	msg->msg_control = NULL;
891	msg->msg_controllen = 0;
892	iov_iter_init(&msg->msg_iter, READ, iov, nr_segs, size);
893	msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
894
895	return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
896	}
897
898	static ssize_t sock_aio_read(struct kiocb iocb, const struct iovec iov,
899	unsigned long nr_segs, loff_t pos)
900	{
901	struct sock_iocb siocb, *x;
902
903	if (pos != 0)
904	return -ESPIPE;
905
906	if (iocb->ki_nbytes == 0) /* Match SYS5 behaviour */
907	return 0;
908
909
910	x = alloc_sock_iocb(iocb, &siocb);
911	if (!x)
912	return -ENOMEM;
913	return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
914	}
915
916	static ssize_t do_sock_write(struct msghdr msg, struct kiocb iocb,
917	struct file file, const struct iovec iov,
918	unsigned long nr_segs)
919	{
920	struct socket *sock = file->private_data;
921	size_t size = 0;
922	int i;
923
924	for (i = 0; i < nr_segs; i++)
925	size += iov[i].iov_len;
926
927	msg->msg_name = NULL;
928	msg->msg_namelen = 0;
929	msg->msg_control = NULL;
930	msg->msg_controllen = 0;
931	iov_iter_init(&msg->msg_iter, WRITE, iov, nr_segs, size);
932	msg->msg_flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
933	if (sock->type == SOCK_SEQPACKET)
934	msg->msg_flags \|= MSG_EOR;
935
936	return __sock_sendmsg(iocb, sock, msg, size);
937	}
938
939	static ssize_t sock_aio_write(struct kiocb iocb, const struct iovec iov,
940	unsigned long nr_segs, loff_t pos)
941	{
942	struct sock_iocb siocb, *x;
943
944	if (pos != 0)
945	return -ESPIPE;
946
947	x = alloc_sock_iocb(iocb, &siocb);
948	if (!x)
949	return -ENOMEM;
950
951	return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
952	}
953
954	/*
955	* Atomic setting of ioctl hooks to avoid race
956	* with module unload.
957	*/
958
959	static DEFINE_MUTEX(br_ioctl_mutex);
960	static int (br_ioctl_hook) (struct net , unsigned int cmd, void __user *arg);
961
962	void brioctl_set(int (hook) (struct net , unsigned int, void __user *))
963	{
964	mutex_lock(&br_ioctl_mutex);
965	br_ioctl_hook = hook;
966	mutex_unlock(&br_ioctl_mutex);
967	}
968	EXPORT_SYMBOL(brioctl_set);
969
970	static DEFINE_MUTEX(vlan_ioctl_mutex);
971	static int (vlan_ioctl_hook) (struct net , void __user *arg);
972
973	void vlan_ioctl_set(int (hook) (struct net , void __user *))
974	{
975	mutex_lock(&vlan_ioctl_mutex);
976	vlan_ioctl_hook = hook;
977	mutex_unlock(&vlan_ioctl_mutex);
978	}
979	EXPORT_SYMBOL(vlan_ioctl_set);
980
981	static DEFINE_MUTEX(dlci_ioctl_mutex);
982	static int (dlci_ioctl_hook) (unsigned int, void __user );
983
984	void dlci_ioctl_set(int (hook) (unsigned int, void __user ))
985	{
986	mutex_lock(&dlci_ioctl_mutex);
987	dlci_ioctl_hook = hook;
988	mutex_unlock(&dlci_ioctl_mutex);
989	}
990	EXPORT_SYMBOL(dlci_ioctl_set);
991
992	static long sock_do_ioctl(struct net net, struct socket sock,
993	unsigned int cmd, unsigned long arg)
994	{
995	int err;
996	void __user argp = (void __user )arg;
997
998	err = sock->ops->ioctl(sock, cmd, arg);
999
1000	/*
1001	* If this ioctl is unknown try to hand it down
1002	* to the NIC driver.
1003	*/
1004	if (err == -ENOIOCTLCMD)
1005	err = dev_ioctl(net, cmd, argp);
1006
1007	return err;
1008	}
1009
1010	/*
1011	* With an ioctl, arg may well be a user mode pointer, but we don't know
1012	* what to do with it - that's up to the protocol still.
1013	*/
1014
1015	static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1016	{
1017	struct socket *sock;
1018	struct sock *sk;
1019	void __user argp = (void __user )arg;
1020	int pid, err;
1021	struct net *net;
1022
1023	sock = file->private_data;
1024	sk = sock->sk;
1025	net = sock_net(sk);
1026	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
1027	err = dev_ioctl(net, cmd, argp);
1028	} else
1029	#ifdef CONFIG_WEXT_CORE
1030	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
1031	err = dev_ioctl(net, cmd, argp);
1032	} else
1033	#endif
1034	switch (cmd) {
1035	case FIOSETOWN:
1036	case SIOCSPGRP:
1037	err = -EFAULT;
1038	if (get_user(pid, (int __user *)argp))
1039	break;
1040	f_setown(sock->file, pid, 1);
1041	err = 0;
1042	break;
1043	case FIOGETOWN:
1044	case SIOCGPGRP:
1045	err = put_user(f_getown(sock->file),
1046	(int __user *)argp);
1047	break;
1048	case SIOCGIFBR:
1049	case SIOCSIFBR:
1050	case SIOCBRADDBR:
1051	case SIOCBRDELBR:
1052	err = -ENOPKG;
1053	if (!br_ioctl_hook)
1054	request_module("bridge");
1055
1056	mutex_lock(&br_ioctl_mutex);
1057	if (br_ioctl_hook)
1058	err = br_ioctl_hook(net, cmd, argp);
1059	mutex_unlock(&br_ioctl_mutex);
1060	break;
1061	case SIOCGIFVLAN:
1062	case SIOCSIFVLAN:
1063	err = -ENOPKG;
1064	if (!vlan_ioctl_hook)
1065	request_module("8021q");
1066
1067	mutex_lock(&vlan_ioctl_mutex);
1068	if (vlan_ioctl_hook)
1069	err = vlan_ioctl_hook(net, argp);
1070	mutex_unlock(&vlan_ioctl_mutex);
1071	break;
1072	case SIOCADDDLCI:
1073	case SIOCDELDLCI:
1074	err = -ENOPKG;
1075	if (!dlci_ioctl_hook)
1076	request_module("dlci");
1077
1078	mutex_lock(&dlci_ioctl_mutex);
1079	if (dlci_ioctl_hook)
1080	err = dlci_ioctl_hook(cmd, argp);
1081	mutex_unlock(&dlci_ioctl_mutex);
1082	break;
1083	default:
1084	err = sock_do_ioctl(net, sock, cmd, arg);
1085	break;
1086	}
1087	return err;
1088	}
1089
1090	int sock_create_lite(int family, int type, int protocol, struct socket **res)
1091	{
1092	int err;
1093	struct socket *sock = NULL;
1094
1095	err = security_socket_create(family, type, protocol, 1);
1096	if (err)
1097	goto out;
1098
1099	sock = sock_alloc();
1100	if (!sock) {
1101	err = -ENOMEM;
1102	goto out;
1103	}
1104
1105	sock->type = type;
1106	err = security_socket_post_create(sock, family, type, protocol, 1);
1107	if (err)
1108	goto out_release;
1109
1110	out:
1111	*res = sock;
1112	return err;
1113	out_release:
1114	sock_release(sock);
1115	sock = NULL;
1116	goto out;
1117	}
1118	EXPORT_SYMBOL(sock_create_lite);
1119
1120	/* No kernel lock held - perfect */
1121	static unsigned int sock_poll(struct file file, poll_table wait)
1122	{
1123	unsigned int busy_flag = 0;
1124	struct socket *sock;
1125
1126	/*
1127	* We can't return errors to poll, so it's either yes or no.
1128	*/
1129	sock = file->private_data;
1130
1131	if (sk_can_busy_loop(sock->sk)) {
1132	/* this socket can poll_ll so tell the system call */
1133	busy_flag = POLL_BUSY_LOOP;
1134
1135	/* once, only if requested by syscall */
1136	if (wait && (wait->_key & POLL_BUSY_LOOP))
1137	sk_busy_loop(sock->sk, 1);
1138	}
1139
1140	return busy_flag \| sock->ops->poll(file, sock, wait);
1141	}
1142
1143	static int sock_mmap(struct file file, struct vm_area_struct vma)
1144	{
1145	struct socket *sock = file->private_data;
1146
1147	return sock->ops->mmap(file, sock, vma);
1148	}
1149
1150	static int sock_close(struct inode inode, struct file filp)
1151	{
1152	sock_release(SOCKET_I(inode));
1153	return 0;
1154	}
1155
1156	/*
1157	* Update the socket async list
1158	*
1159	* Fasync_list locking strategy.
1160	*
1161	* 1. fasync_list is modified only under process context socket lock
1162	* i.e. under semaphore.
1163	* 2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1164	* or under socket lock
1165	*/
1166
1167	static int sock_fasync(int fd, struct file *filp, int on)
1168	{
1169	struct socket *sock = filp->private_data;
1170	struct sock *sk = sock->sk;
1171	struct socket_wq *wq;
1172
1173	if (sk == NULL)
1174	return -EINVAL;
1175
1176	lock_sock(sk);
1177	wq = rcu_dereference_protected(sock->wq, sock_owned_by_user(sk));
1178	fasync_helper(fd, filp, on, &wq->fasync_list);
1179
1180	if (!wq->fasync_list)
1181	sock_reset_flag(sk, SOCK_FASYNC);
1182	else
1183	sock_set_flag(sk, SOCK_FASYNC);
1184
1185	release_sock(sk);
1186	return 0;
1187	}
1188
1189	/* This function may be called only under socket lock or callback_lock or rcu_lock */
1190
1191	int sock_wake_async(struct socket *sock, int how, int band)
1192	{
1193	struct socket_wq *wq;
1194
1195	if (!sock)
1196	return -1;
1197	rcu_read_lock();
1198	wq = rcu_dereference(sock->wq);
1199	if (!wq \|\| !wq->fasync_list) {
1200	rcu_read_unlock();
1201	return -1;
1202	}
1203	switch (how) {
1204	case SOCK_WAKE_WAITD:
1205	if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
1206	break;
1207	goto call_kill;
1208	case SOCK_WAKE_SPACE:
1209	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags))
1210	break;
1211	/* fall through */
1212	case SOCK_WAKE_IO:
1213	call_kill:
1214	kill_fasync(&wq->fasync_list, SIGIO, band);
1215	break;
1216	case SOCK_WAKE_URG:
1217	kill_fasync(&wq->fasync_list, SIGURG, band);
1218	}
1219	rcu_read_unlock();
1220	return 0;
1221	}
1222	EXPORT_SYMBOL(sock_wake_async);
1223
1224	int __sock_create(struct net *net, int family, int type, int protocol,
1225	struct socket **res, int kern)
1226	{
1227	int err;
1228	struct socket *sock;
1229	const struct net_proto_family *pf;
1230
1231	/*
1232	* Check protocol is in range
1233	*/
1234	if (family < 0 \|\| family >= NPROTO)
1235	return -EAFNOSUPPORT;
1236	if (type < 0 \|\| type >= SOCK_MAX)
1237	return -EINVAL;
1238
1239	/* Compatibility.
1240
1241	This uglymoron is moved from INET layer to here to avoid
1242	deadlock in module load.
1243	*/
1244	if (family == PF_INET && type == SOCK_PACKET) {
1245	static int warned;
1246	if (!warned) {
1247	warned = 1;
1248	pr_info("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1249	current->comm);
1250	}
1251	family = PF_PACKET;
1252	}
1253
1254	err = security_socket_create(family, type, protocol, kern);
1255	if (err)
1256	return err;
1257
1258	/*
1259	* Allocate the socket and allow the family to set things up. if
1260	* the protocol is 0, the family is instructed to select an appropriate
1261	* default.
1262	*/
1263	sock = sock_alloc();
1264	if (!sock) {
1265	net_warn_ratelimited("socket: no more sockets\n");
1266	return -ENFILE; /* Not exactly a match, but its the
1267	closest posix thing */
1268	}
1269
1270	sock->type = type;
1271
1272	#ifdef CONFIG_MODULES
1273	/* Attempt to load a protocol module if the find failed.
1274	*
1275	* 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1276	* requested real, full-featured networking support upon configuration.
1277	* Otherwise module support will break!
1278	*/
1279	if (rcu_access_pointer(net_families[family]) == NULL)
1280	request_module("net-pf-%d", family);
1281	#endif
1282
1283	rcu_read_lock();
1284	pf = rcu_dereference(net_families[family]);
1285	err = -EAFNOSUPPORT;
1286	if (!pf)
1287	goto out_release;
1288
1289	/*
1290	* We will call the ->create function, that possibly is in a loadable
1291	* module, so we have to bump that loadable module refcnt first.
1292	*/
1293	if (!try_module_get(pf->owner))
1294	goto out_release;
1295
1296	/* Now protected by module ref count */
1297	rcu_read_unlock();
1298
1299	err = pf->create(net, sock, protocol, kern);
1300	if (err < 0)
1301	goto out_module_put;
1302
1303	/*
1304	* Now to bump the refcnt of the [loadable] module that owns this
1305	* socket at sock_release time we decrement its refcnt.
1306	*/
1307	if (!try_module_get(sock->ops->owner))
1308	goto out_module_busy;
1309
1310	/*
1311	* Now that we're done with the ->create function, the [loadable]
1312	* module can have its refcnt decremented
1313	*/
1314	module_put(pf->owner);
1315	err = security_socket_post_create(sock, family, type, protocol, kern);
1316	if (err)
1317	goto out_sock_release;
1318	*res = sock;
1319
1320	return 0;
1321
1322	out_module_busy:
1323	err = -EAFNOSUPPORT;
1324	out_module_put:
1325	sock->ops = NULL;
1326	module_put(pf->owner);
1327	out_sock_release:
1328	sock_release(sock);
1329	return err;
1330
1331	out_release:
1332	rcu_read_unlock();
1333	goto out_sock_release;
1334	}
1335	EXPORT_SYMBOL(__sock_create);
1336
1337	int sock_create(int family, int type, int protocol, struct socket **res)
1338	{
1339	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1340	}
1341	EXPORT_SYMBOL(sock_create);
1342
1343	int sock_create_kern(int family, int type, int protocol, struct socket **res)
1344	{
1345	return __sock_create(&init_net, family, type, protocol, res, 1);
1346	}
1347	EXPORT_SYMBOL(sock_create_kern);
1348
1349	SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1350	{
1351	int retval;
1352	struct socket *sock;
1353	int flags;
1354
1355	/* Check the SOCK_* constants for consistency. */
1356	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1357	BUILD_BUG_ON((SOCK_MAX \| SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1358	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1359	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1360
1361	flags = type & ~SOCK_TYPE_MASK;
1362	if (flags & ~(SOCK_CLOEXEC \| SOCK_NONBLOCK))
1363	return -EINVAL;
1364	type &= SOCK_TYPE_MASK;
1365
1366	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1367	flags = (flags & ~SOCK_NONBLOCK) \| O_NONBLOCK;
1368
1369	retval = sock_create(family, type, protocol, &sock);
1370	if (retval < 0)
1371	goto out;
1372
1373	retval = sock_map_fd(sock, flags & (O_CLOEXEC \| O_NONBLOCK));
1374	if (retval < 0)
1375	goto out_release;
1376
1377	out:
1378	/* It may be already another descriptor 8) Not kernel problem. */
1379	return retval;
1380
1381	out_release:
1382	sock_release(sock);
1383	return retval;
1384	}
1385
1386	/*
1387	* Create a pair of connected sockets.
1388	*/
1389
1390	SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1391	int __user *, usockvec)
1392	{
1393	struct socket sock1, sock2;
1394	int fd1, fd2, err;
1395	struct file newfile1, newfile2;
1396	int flags;
1397
1398	flags = type & ~SOCK_TYPE_MASK;
1399	if (flags & ~(SOCK_CLOEXEC \| SOCK_NONBLOCK))
1400	return -EINVAL;
1401	type &= SOCK_TYPE_MASK;
1402
1403	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1404	flags = (flags & ~SOCK_NONBLOCK) \| O_NONBLOCK;
1405
1406	/*
1407	* Obtain the first socket and check if the underlying protocol
1408	* supports the socketpair call.
1409	*/
1410
1411	err = sock_create(family, type, protocol, &sock1);
1412	if (err < 0)
1413	goto out;
1414
1415	err = sock_create(family, type, protocol, &sock2);
1416	if (err < 0)
1417	goto out_release_1;
1418
1419	err = sock1->ops->socketpair(sock1, sock2);
1420	if (err < 0)
1421	goto out_release_both;
1422
1423	fd1 = get_unused_fd_flags(flags);
1424	if (unlikely(fd1 < 0)) {
1425	err = fd1;
1426	goto out_release_both;
1427	}
1428
1429	fd2 = get_unused_fd_flags(flags);
1430	if (unlikely(fd2 < 0)) {
1431	err = fd2;
1432	goto out_put_unused_1;
1433	}
1434
1435	newfile1 = sock_alloc_file(sock1, flags, NULL);
1436	if (unlikely(IS_ERR(newfile1))) {
1437	err = PTR_ERR(newfile1);
1438	goto out_put_unused_both;
1439	}
1440
1441	newfile2 = sock_alloc_file(sock2, flags, NULL);
1442	if (IS_ERR(newfile2)) {
1443	err = PTR_ERR(newfile2);
1444	goto out_fput_1;
1445	}
1446
1447	err = put_user(fd1, &usockvec[0]);
1448	if (err)
1449	goto out_fput_both;
1450
1451	err = put_user(fd2, &usockvec[1]);
1452	if (err)
1453	goto out_fput_both;
1454
1455	audit_fd_pair(fd1, fd2);
1456
1457	fd_install(fd1, newfile1);
1458	fd_install(fd2, newfile2);
1459	/* fd1 and fd2 may be already another descriptors.
1460	* Not kernel problem.
1461	*/
1462
1463	return 0;
1464
1465	out_fput_both:
1466	fput(newfile2);
1467	fput(newfile1);
1468	put_unused_fd(fd2);
1469	put_unused_fd(fd1);
1470	goto out;
1471
1472	out_fput_1:
1473	fput(newfile1);
1474	put_unused_fd(fd2);
1475	put_unused_fd(fd1);
1476	sock_release(sock2);
1477	goto out;
1478
1479	out_put_unused_both:
1480	put_unused_fd(fd2);
1481	out_put_unused_1:
1482	put_unused_fd(fd1);
1483	out_release_both:
1484	sock_release(sock2);
1485	out_release_1:
1486	sock_release(sock1);
1487	out:
1488	return err;
1489	}
1490
1491	/*
1492	* Bind a name to a socket. Nothing much to do here since it's
1493	* the protocol's responsibility to handle the local address.
1494	*
1495	* We move the socket address to kernel space before we call
1496	* the protocol layer (having also checked the address is ok).
1497	*/
1498
1499	SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1500	{
1501	struct socket *sock;
1502	struct sockaddr_storage address;
1503	int err, fput_needed;
1504
1505	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1506	if (sock) {
1507	err = move_addr_to_kernel(umyaddr, addrlen, &address);
1508	if (err >= 0) {
1509	err = security_socket_bind(sock,
1510	(struct sockaddr *)&address,
1511	addrlen);
1512	if (!err)
1513	err = sock->ops->bind(sock,
1514	(struct sockaddr *)
1515	&address, addrlen);
1516	}
1517	fput_light(sock->file, fput_needed);
1518	}
1519	return err;
1520	}
1521
1522	/*
1523	* Perform a listen. Basically, we allow the protocol to do anything
1524	* necessary for a listen, and if that works, we mark the socket as
1525	* ready for listening.
1526	*/
1527
1528	SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1529	{
1530	struct socket *sock;
1531	int err, fput_needed;
1532	int somaxconn;
1533
1534	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1535	if (sock) {
1536	somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1537	if ((unsigned int)backlog > somaxconn)
1538	backlog = somaxconn;
1539
1540	err = security_socket_listen(sock, backlog);
1541	if (!err)
1542	err = sock->ops->listen(sock, backlog);
1543
1544	fput_light(sock->file, fput_needed);
1545	}
1546	return err;
1547	}
1548
1549	/*
1550	* For accept, we attempt to create a new socket, set up the link
1551	* with the client, wake up the client, then return the new
1552	* connected fd. We collect the address of the connector in kernel
1553	* space and move it to user at the very end. This is unclean because
1554	* we open the socket then return an error.
1555	*
1556	* 1003.1g adds the ability to recvmsg() to query connection pending
1557	* status to recvmsg. We need to add that support in a way thats
1558	* clean when we restucture accept also.
1559	*/
1560
1561	SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1562	int __user *, upeer_addrlen, int, flags)
1563	{
1564	struct socket sock, newsock;
1565	struct file *newfile;
1566	int err, len, newfd, fput_needed;
1567	struct sockaddr_storage address;
1568
1569	if (flags & ~(SOCK_CLOEXEC \| SOCK_NONBLOCK))
1570	return -EINVAL;
1571
1572	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1573	flags = (flags & ~SOCK_NONBLOCK) \| O_NONBLOCK;
1574
1575	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1576	if (!sock)
1577	goto out;
1578
1579	err = -ENFILE;
1580	newsock = sock_alloc();
1581	if (!newsock)
1582	goto out_put;
1583
1584	newsock->type = sock->type;
1585	newsock->ops = sock->ops;
1586
1587	/*
1588	* We don't need try_module_get here, as the listening socket (sock)
1589	* has the protocol module (sock->ops->owner) held.
1590	*/
1591	__module_get(newsock->ops->owner);
1592
1593	newfd = get_unused_fd_flags(flags);
1594	if (unlikely(newfd < 0)) {
1595	err = newfd;
1596	sock_release(newsock);
1597	goto out_put;
1598	}
1599	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1600	if (unlikely(IS_ERR(newfile))) {
1601	err = PTR_ERR(newfile);
1602	put_unused_fd(newfd);
1603	sock_release(newsock);
1604	goto out_put;
1605	}
1606
1607	err = security_socket_accept(sock, newsock);
1608	if (err)
1609	goto out_fd;
1610
1611	err = sock->ops->accept(sock, newsock, sock->file->f_flags);
1612	if (err < 0)
1613	goto out_fd;
1614
1615	if (upeer_sockaddr) {
1616	if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
1617	&len, 2) < 0) {
1618	err = -ECONNABORTED;
1619	goto out_fd;
1620	}
1621	err = move_addr_to_user(&address,
1622	len, upeer_sockaddr, upeer_addrlen);
1623	if (err < 0)
1624	goto out_fd;
1625	}
1626
1627	/* File flags are not inherited via accept() unlike another OSes. */
1628
1629	fd_install(newfd, newfile);
1630	err = newfd;
1631
1632	out_put:
1633	fput_light(sock->file, fput_needed);
1634	out:
1635	return err;
1636	out_fd:
1637	fput(newfile);
1638	put_unused_fd(newfd);
1639	goto out_put;
1640	}
1641
1642	SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1643	int __user *, upeer_addrlen)
1644	{
1645	return sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1646	}
1647
1648	/*
1649	* Attempt to connect to a socket with the server address. The address
1650	* is in user space so we verify it is OK and move it to kernel space.
1651	*
1652	* For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1653	* break bindings
1654	*
1655	* NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1656	* other SEQPACKET protocols that take time to connect() as it doesn't
1657	* include the -EINPROGRESS status for such sockets.
1658	*/
1659
1660	SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1661	int, addrlen)
1662	{
1663	struct socket *sock;
1664	struct sockaddr_storage address;
1665	int err, fput_needed;
1666
1667	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1668	if (!sock)
1669	goto out;
1670	err = move_addr_to_kernel(uservaddr, addrlen, &address);
1671	if (err < 0)
1672	goto out_put;
1673
1674	err =
1675	security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
1676	if (err)
1677	goto out_put;
1678
1679	err = sock->ops->connect(sock, (struct sockaddr *)&address, addrlen,
1680	sock->file->f_flags);
1681	out_put:
1682	fput_light(sock->file, fput_needed);
1683	out:
1684	return err;
1685	}
1686
1687	/*
1688	* Get the local address ('name') of a socket object. Move the obtained
1689	* name to user space.
1690	*/
1691
1692	SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1693	int __user *, usockaddr_len)
1694	{
1695	struct socket *sock;
1696	struct sockaddr_storage address;
1697	int len, err, fput_needed;
1698
1699	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1700	if (!sock)
1701	goto out;
1702
1703	err = security_socket_getsockname(sock);
1704	if (err)
1705	goto out_put;
1706
1707	err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
1708	if (err)
1709	goto out_put;
1710	err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
1711
1712	out_put:
1713	fput_light(sock->file, fput_needed);
1714	out:
1715	return err;
1716	}
1717
1718	/*
1719	* Get the remote address ('name') of a socket object. Move the obtained
1720	* name to user space.
1721	*/
1722
1723	SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1724	int __user *, usockaddr_len)
1725	{
1726	struct socket *sock;
1727	struct sockaddr_storage address;
1728	int len, err, fput_needed;
1729
1730	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1731	if (sock != NULL) {
1732	err = security_socket_getpeername(sock);
1733	if (err) {
1734	fput_light(sock->file, fput_needed);
1735	return err;
1736	}
1737
1738	err =
1739	sock->ops->getname(sock, (struct sockaddr *)&address, &len,
1740	1);
1741	if (!err)
1742	err = move_addr_to_user(&address, len, usockaddr,
1743	usockaddr_len);
1744	fput_light(sock->file, fput_needed);
1745	}
1746	return err;
1747	}
1748
1749	/*
1750	* Send a datagram to a given address. We move the address into kernel
1751	* space and check the user space data area is readable before invoking
1752	* the protocol.
1753	*/
1754
1755	SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
1756	unsigned int, flags, struct sockaddr __user *, addr,
1757	int, addr_len)
1758	{
1759	struct socket *sock;
1760	struct sockaddr_storage address;
1761	int err;
1762	struct msghdr msg;
1763	struct iovec iov;
1764	int fput_needed;
1765
1766	if (len > INT_MAX)
1767	len = INT_MAX;
1768	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1769	if (!sock)
1770	goto out;
1771
1772	iov.iov_base = buff;
1773	iov.iov_len = len;
1774	msg.msg_name = NULL;
1775	iov_iter_init(&msg.msg_iter, WRITE, &iov, 1, len);
1776	msg.msg_control = NULL;
1777	msg.msg_controllen = 0;
1778	msg.msg_namelen = 0;
1779	if (addr) {
1780	err = move_addr_to_kernel(addr, addr_len, &address);
1781	if (err < 0)
1782	goto out_put;
1783	msg.msg_name = (struct sockaddr *)&address;
1784	msg.msg_namelen = addr_len;
1785	}
1786	if (sock->file->f_flags & O_NONBLOCK)
1787	flags \|= MSG_DONTWAIT;
1788	msg.msg_flags = flags;
1789	err = sock_sendmsg(sock, &msg, len);
1790
1791	out_put:
1792	fput_light(sock->file, fput_needed);
1793	out:
1794	return err;
1795	}
1796
1797	/*
1798	* Send a datagram down a socket.
1799	*/
1800
1801	SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
1802	unsigned int, flags)
1803	{
1804	return sys_sendto(fd, buff, len, flags, NULL, 0);
1805	}
1806
1807	/*
1808	* Receive a frame from the socket and optionally record the address of the
1809	* sender. We verify the buffers are writable and if needed move the
1810	* sender address from kernel to user space.
1811	*/
1812
1813	SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
1814	unsigned int, flags, struct sockaddr __user *, addr,
1815	int __user *, addr_len)
1816	{
1817	struct socket *sock;
1818	struct iovec iov;
1819	struct msghdr msg;
1820	struct sockaddr_storage address;
1821	int err, err2;
1822	int fput_needed;
1823
1824	if (size > INT_MAX)
1825	size = INT_MAX;
1826	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1827	if (!sock)
1828	goto out;
1829
1830	msg.msg_control = NULL;
1831	msg.msg_controllen = 0;
1832	iov.iov_len = size;
1833	iov.iov_base = ubuf;
1834	iov_iter_init(&msg.msg_iter, READ, &iov, 1, size);
1835	/* Save some cycles and don't copy the address if not needed */
1836	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
1837	/* We assume all kernel code knows the size of sockaddr_storage */
1838	msg.msg_namelen = 0;
1839	if (sock->file->f_flags & O_NONBLOCK)
1840	flags \|= MSG_DONTWAIT;
1841	err = sock_recvmsg(sock, &msg, size, flags);
1842
1843	if (err >= 0 && addr != NULL) {
1844	err2 = move_addr_to_user(&address,
1845	msg.msg_namelen, addr, addr_len);
1846	if (err2 < 0)
1847	err = err2;
1848	}
1849
1850	fput_light(sock->file, fput_needed);
1851	out:
1852	return err;
1853	}
1854
1855	/*
1856	* Receive a datagram from a socket.
1857	*/
1858
1859	SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
1860	unsigned int, flags)
1861	{
1862	return sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
1863	}
1864
1865	/*
1866	* Set a socket option. Because we don't know the option lengths we have
1867	* to pass the user mode parameter for the protocols to sort out.
1868	*/
1869
1870	SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
1871	char __user *, optval, int, optlen)
1872	{
1873	int err, fput_needed;
1874	struct socket *sock;
1875
1876	if (optlen < 0)
1877	return -EINVAL;
1878
1879	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1880	if (sock != NULL) {
1881	err = security_socket_setsockopt(sock, level, optname);
1882	if (err)
1883	goto out_put;
1884
1885	if (level == SOL_SOCKET)
1886	err =
1887	sock_setsockopt(sock, level, optname, optval,
1888	optlen);
1889	else
1890	err =
1891	sock->ops->setsockopt(sock, level, optname, optval,
1892	optlen);
1893	out_put:
1894	fput_light(sock->file, fput_needed);
1895	}
1896	return err;
1897	}
1898
1899	/*
1900	* Get a socket option. Because we don't know the option lengths we have
1901	* to pass a user mode parameter for the protocols to sort out.
1902	*/
1903
1904	SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
1905	char __user , optval, int __user , optlen)
1906	{
1907	int err, fput_needed;
1908	struct socket *sock;
1909
1910	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1911	if (sock != NULL) {
1912	err = security_socket_getsockopt(sock, level, optname);
1913	if (err)
1914	goto out_put;
1915
1916	if (level == SOL_SOCKET)
1917	err =
1918	sock_getsockopt(sock, level, optname, optval,
1919	optlen);
1920	else
1921	err =
1922	sock->ops->getsockopt(sock, level, optname, optval,
1923	optlen);
1924	out_put:
1925	fput_light(sock->file, fput_needed);
1926	}
1927	return err;
1928	}
1929
1930	/*
1931	* Shutdown a socket.
1932	*/
1933
1934	SYSCALL_DEFINE2(shutdown, int, fd, int, how)
1935	{
1936	int err, fput_needed;
1937	struct socket *sock;
1938
1939	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1940	if (sock != NULL) {
1941	err = security_socket_shutdown(sock, how);
1942	if (!err)
1943	err = sock->ops->shutdown(sock, how);
1944	fput_light(sock->file, fput_needed);
1945	}
1946	return err;
1947	}
1948
1949	/* A couple of helpful macros for getting the address of the 32/64 bit
1950	* fields which are the same type (int / unsigned) on our platforms.
1951	*/
1952	#define COMPAT_MSG(msg, member) ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
1953	#define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen)
1954	#define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags)
1955
1956	struct used_address {
1957	struct sockaddr_storage name;
1958	unsigned int name_len;
1959	};
1960
1961	static ssize_t copy_msghdr_from_user(struct msghdr *kmsg,
1962	struct user_msghdr __user *umsg,
1963	struct sockaddr __user **save_addr,
1964	struct iovec **iov)
1965	{
1966	struct sockaddr __user *uaddr;
1967	struct iovec __user *uiov;
1968	size_t nr_segs;
1969	ssize_t err;
1970
1971	if (!access_ok(VERIFY_READ, umsg, sizeof(*umsg)) \|\|
1972	__get_user(uaddr, &umsg->msg_name) \|\|
1973	__get_user(kmsg->msg_namelen, &umsg->msg_namelen) \|\|
1974	__get_user(uiov, &umsg->msg_iov) \|\|
1975	__get_user(nr_segs, &umsg->msg_iovlen) \|\|
1976	__get_user(kmsg->msg_control, &umsg->msg_control) \|\|
1977	__get_user(kmsg->msg_controllen, &umsg->msg_controllen) \|\|
1978	__get_user(kmsg->msg_flags, &umsg->msg_flags))
1979	return -EFAULT;
1980
1981	if (!uaddr)
1982	kmsg->msg_namelen = 0;
1983
1984	if (kmsg->msg_namelen < 0)
1985	return -EINVAL;
1986
1987	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
1988	kmsg->msg_namelen = sizeof(struct sockaddr_storage);
1989
1990	if (save_addr)
1991	*save_addr = uaddr;
1992
1993	if (uaddr && kmsg->msg_namelen) {
1994	if (!save_addr) {
1995	err = move_addr_to_kernel(uaddr, kmsg->msg_namelen,
1996	kmsg->msg_name);
1997	if (err < 0)
1998	return err;
1999	}
2000	} else {
2001	kmsg->msg_name = NULL;
2002	kmsg->msg_namelen = 0;
2003	}
2004
2005	if (nr_segs > UIO_MAXIOV)
2006	return -EMSGSIZE;
2007
2008	err = rw_copy_check_uvector(save_addr ? READ : WRITE,
2009	uiov, nr_segs,
2010	UIO_FASTIOV, *iov, iov);
2011	if (err >= 0)
2012	iov_iter_init(&kmsg->msg_iter, save_addr ? READ : WRITE,
2013	*iov, nr_segs, err);
2014	return err;
2015	}
2016
2017	static int ___sys_sendmsg(struct socket sock, struct user_msghdr __user msg,
2018	struct msghdr *msg_sys, unsigned int flags,
2019	struct used_address *used_address)
2020	{
2021	struct compat_msghdr __user *msg_compat =
2022	(struct compat_msghdr __user *)msg;
2023	struct sockaddr_storage address;
2024	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
2025	unsigned char ctl[sizeof(struct cmsghdr) + 20]
2026	__attribute__ ((aligned(sizeof(__kernel_size_t))));
2027	/* 20 is size of ipv6_pktinfo */
2028	unsigned char *ctl_buf = ctl;
2029	int ctl_len, total_len;
2030	ssize_t err;
2031
2032	msg_sys->msg_name = &address;
2033
2034	if (MSG_CMSG_COMPAT & flags)
2035	err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
2036	else
2037	err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
2038	if (err < 0)
2039	goto out_freeiov;
2040	total_len = err;
2041
2042	err = -ENOBUFS;
2043
2044	if (msg_sys->msg_controllen > INT_MAX)
2045	goto out_freeiov;
2046	ctl_len = msg_sys->msg_controllen;
2047	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
2048	err =
2049	cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
2050	sizeof(ctl));
2051	if (err)
2052	goto out_freeiov;
2053	ctl_buf = msg_sys->msg_control;
2054	ctl_len = msg_sys->msg_controllen;
2055	} else if (ctl_len) {
2056	if (ctl_len > sizeof(ctl)) {
2057	ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
2058	if (ctl_buf == NULL)
2059	goto out_freeiov;
2060	}
2061	err = -EFAULT;
2062	/*
2063	* Careful! Before this, msg_sys->msg_control contains a user pointer.
2064	* Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2065	* checking falls down on this.
2066	*/
2067	if (copy_from_user(ctl_buf,
2068	(void __user __force *)msg_sys->msg_control,
2069	ctl_len))
2070	goto out_freectl;
2071	msg_sys->msg_control = ctl_buf;
2072	}
2073	msg_sys->msg_flags = flags;
2074
2075	if (sock->file->f_flags & O_NONBLOCK)
2076	msg_sys->msg_flags \|= MSG_DONTWAIT;
2077	/*
2078	* If this is sendmmsg() and current destination address is same as
2079	* previously succeeded address, omit asking LSM's decision.
2080	* used_address->name_len is initialized to UINT_MAX so that the first
2081	* destination address never matches.
2082	*/
2083	if (used_address && msg_sys->msg_name &&
2084	used_address->name_len == msg_sys->msg_namelen &&
2085	!memcmp(&used_address->name, msg_sys->msg_name,
2086	used_address->name_len)) {
2087	err = sock_sendmsg_nosec(sock, msg_sys, total_len);
2088	goto out_freectl;
2089	}
2090	err = sock_sendmsg(sock, msg_sys, total_len);
2091	/*
2092	* If this is sendmmsg() and sending to current destination address was
2093	* successful, remember it.
2094	*/
2095	if (used_address && err >= 0) {
2096	used_address->name_len = msg_sys->msg_namelen;
2097	if (msg_sys->msg_name)
2098	memcpy(&used_address->name, msg_sys->msg_name,
2099	used_address->name_len);
2100	}
2101
2102	out_freectl:
2103	if (ctl_buf != ctl)
2104	sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2105	out_freeiov:
2106	if (iov != iovstack)
2107	kfree(iov);
2108	return err;
2109	}
2110
2111	/*
2112	* BSD sendmsg interface
2113	*/
2114
2115	long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2116	{
2117	int fput_needed, err;
2118	struct msghdr msg_sys;
2119	struct socket *sock;
2120
2121	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2122	if (!sock)
2123	goto out;
2124
2125	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
2126
2127	fput_light(sock->file, fput_needed);
2128	out:
2129	return err;
2130	}
2131
2132	SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2133	{
2134	if (flags & MSG_CMSG_COMPAT)
2135	return -EINVAL;
2136	return __sys_sendmsg(fd, msg, flags);
2137	}
2138
2139	/*
2140	* Linux sendmmsg interface
2141	*/
2142
2143	int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2144	unsigned int flags)
2145	{
2146	int fput_needed, err, datagrams;
2147	struct socket *sock;
2148	struct mmsghdr __user *entry;
2149	struct compat_mmsghdr __user *compat_entry;
2150	struct msghdr msg_sys;
2151	struct used_address used_address;
2152
2153	if (vlen > UIO_MAXIOV)
2154	vlen = UIO_MAXIOV;
2155
2156	datagrams = 0;
2157
2158	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2159	if (!sock)
2160	return err;
2161
2162	used_address.name_len = UINT_MAX;
2163	entry = mmsg;
2164	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2165	err = 0;
2166
2167	while (datagrams < vlen) {
2168	if (MSG_CMSG_COMPAT & flags) {
2169	err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2170	&msg_sys, flags, &used_address);
2171	if (err < 0)
2172	break;
2173	err = __put_user(err, &compat_entry->msg_len);
2174	++compat_entry;
2175	} else {
2176	err = ___sys_sendmsg(sock,
2177	(struct user_msghdr __user *)entry,
2178	&msg_sys, flags, &used_address);
2179	if (err < 0)
2180	break;
2181	err = put_user(err, &entry->msg_len);
2182	++entry;
2183	}
2184
2185	if (err)
2186	break;
2187	++datagrams;
2188	}
2189
2190	fput_light(sock->file, fput_needed);
2191
2192	/* We only return an error if no datagrams were able to be sent */
2193	if (datagrams != 0)
2194	return datagrams;
2195
2196	return err;
2197	}
2198
2199	SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2200	unsigned int, vlen, unsigned int, flags)
2201	{
2202	if (flags & MSG_CMSG_COMPAT)
2203	return -EINVAL;
2204	return __sys_sendmmsg(fd, mmsg, vlen, flags);
2205	}
2206
2207	static int ___sys_recvmsg(struct socket sock, struct user_msghdr __user msg,
2208	struct msghdr *msg_sys, unsigned int flags, int nosec)
2209	{
2210	struct compat_msghdr __user *msg_compat =
2211	(struct compat_msghdr __user *)msg;
2212	struct iovec iovstack[UIO_FASTIOV];
2213	struct iovec *iov = iovstack;
2214	unsigned long cmsg_ptr;
2215	int total_len, len;
2216	ssize_t err;
2217
2218	/* kernel mode address */
2219	struct sockaddr_storage addr;
2220
2221	/* user mode address pointers */
2222	struct sockaddr __user *uaddr;
2223	int __user *uaddr_len = COMPAT_NAMELEN(msg);
2224
2225	msg_sys->msg_name = &addr;
2226
2227	if (MSG_CMSG_COMPAT & flags)
2228	err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
2229	else
2230	err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
2231	if (err < 0)
2232	goto out_freeiov;
2233	total_len = err;
2234
2235	cmsg_ptr = (unsigned long)msg_sys->msg_control;
2236	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC\|MSG_CMSG_COMPAT);
2237
2238	/* We assume all kernel code knows the size of sockaddr_storage */
2239	msg_sys->msg_namelen = 0;
2240
2241	if (sock->file->f_flags & O_NONBLOCK)
2242	flags \|= MSG_DONTWAIT;
2243	err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
2244	total_len, flags);
2245	if (err < 0)
2246	goto out_freeiov;
2247	len = err;
2248
2249	if (uaddr != NULL) {
2250	err = move_addr_to_user(&addr,
2251	msg_sys->msg_namelen, uaddr,
2252	uaddr_len);
2253	if (err < 0)
2254	goto out_freeiov;
2255	}
2256	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2257	COMPAT_FLAGS(msg));
2258	if (err)
2259	goto out_freeiov;
2260	if (MSG_CMSG_COMPAT & flags)
2261	err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2262	&msg_compat->msg_controllen);
2263	else
2264	err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2265	&msg->msg_controllen);
2266	if (err)
2267	goto out_freeiov;
2268	err = len;
2269
2270	out_freeiov:
2271	if (iov != iovstack)
2272	kfree(iov);
2273	return err;
2274	}
2275
2276	/*
2277	* BSD recvmsg interface
2278	*/
2279
2280	long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned flags)
2281	{
2282	int fput_needed, err;
2283	struct msghdr msg_sys;
2284	struct socket *sock;
2285
2286	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2287	if (!sock)
2288	goto out;
2289
2290	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2291
2292	fput_light(sock->file, fput_needed);
2293	out:
2294	return err;
2295	}
2296
2297	SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2298	unsigned int, flags)
2299	{
2300	if (flags & MSG_CMSG_COMPAT)
2301	return -EINVAL;
2302	return __sys_recvmsg(fd, msg, flags);
2303	}
2304
2305	/*
2306	* Linux recvmmsg interface
2307	*/
2308
2309	int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2310	unsigned int flags, struct timespec *timeout)
2311	{
2312	int fput_needed, err, datagrams;
2313	struct socket *sock;
2314	struct mmsghdr __user *entry;
2315	struct compat_mmsghdr __user *compat_entry;
2316	struct msghdr msg_sys;
2317	struct timespec end_time;
2318
2319	if (timeout &&
2320	poll_select_set_timeout(&end_time, timeout->tv_sec,
2321	timeout->tv_nsec))
2322	return -EINVAL;
2323
2324	datagrams = 0;
2325
2326	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2327	if (!sock)
2328	return err;
2329
2330	err = sock_error(sock->sk);
2331	if (err)
2332	goto out_put;
2333
2334	entry = mmsg;
2335	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2336
2337	while (datagrams < vlen) {
2338	/*
2339	* No need to ask LSM for more than the first datagram.
2340	*/
2341	if (MSG_CMSG_COMPAT & flags) {
2342	err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2343	&msg_sys, flags & ~MSG_WAITFORONE,
2344	datagrams);
2345	if (err < 0)
2346	break;
2347	err = __put_user(err, &compat_entry->msg_len);
2348	++compat_entry;
2349	} else {
2350	err = ___sys_recvmsg(sock,
2351	(struct user_msghdr __user *)entry,
2352	&msg_sys, flags & ~MSG_WAITFORONE,
2353	datagrams);
2354	if (err < 0)
2355	break;
2356	err = put_user(err, &entry->msg_len);
2357	++entry;
2358	}
2359
2360	if (err)
2361	break;
2362	++datagrams;
2363
2364	/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2365	if (flags & MSG_WAITFORONE)
2366	flags \|= MSG_DONTWAIT;
2367
2368	if (timeout) {
2369	ktime_get_ts(timeout);
2370	timeout = timespec_sub(end_time, timeout);
2371	if (timeout->tv_sec < 0) {
2372	timeout->tv_sec = timeout->tv_nsec = 0;
2373	break;
2374	}
2375
2376	/* Timeout, return less than vlen datagrams */
2377	if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2378	break;
2379	}
2380
2381	/* Out of band data, return right away */
2382	if (msg_sys.msg_flags & MSG_OOB)
2383	break;
2384	}
2385
2386	out_put:
2387	fput_light(sock->file, fput_needed);
2388
2389	if (err == 0)
2390	return datagrams;
2391
2392	if (datagrams != 0) {
2393	/*
2394	* We may return less entries than requested (vlen) if the
2395	* sock is non block and there aren't enough datagrams...
2396	*/
2397	if (err != -EAGAIN) {
2398	/*
2399	* ... or if recvmsg returns an error after we
2400	* received some datagrams, where we record the
2401	* error to return on the next call or if the
2402	* app asks about it using getsockopt(SO_ERROR).
2403	*/
2404	sock->sk->sk_err = -err;
2405	}
2406
2407	return datagrams;
2408	}
2409
2410	return err;
2411	}
2412
2413	SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2414	unsigned int, vlen, unsigned int, flags,
2415	struct timespec __user *, timeout)
2416	{
2417	int datagrams;
2418	struct timespec timeout_sys;
2419
2420	if (flags & MSG_CMSG_COMPAT)
2421	return -EINVAL;
2422
2423	if (!timeout)
2424	return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
2425
2426	if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
2427	return -EFAULT;
2428
2429	datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2430
2431	if (datagrams > 0 &&
2432	copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
2433	datagrams = -EFAULT;
2434
2435	return datagrams;
2436	}
2437
2438	#ifdef __ARCH_WANT_SYS_SOCKETCALL
2439	/* Argument list sizes for sys_socketcall */
2440	#define AL(x) ((x) * sizeof(unsigned long))
2441	static const unsigned char nargs[21] = {
2442	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2443	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2444	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2445	AL(4), AL(5), AL(4)
2446	};
2447
2448	#undef AL
2449
2450	/*
2451	* System call vectors.
2452	*
2453	* Argument checking cleaned up. Saved 20% in size.
2454	* This function doesn't need to set the kernel lock because
2455	* it is set by the callees.
2456	*/
2457
2458	SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2459	{
2460	unsigned long a[AUDITSC_ARGS];
2461	unsigned long a0, a1;
2462	int err;
2463	unsigned int len;
2464
2465	if (call < 1 \|\| call > SYS_SENDMMSG)
2466	return -EINVAL;
2467
2468	len = nargs[call];
2469	if (len > sizeof(a))
2470	return -EINVAL;
2471
2472	/* copy_from_user should be SMP safe. */
2473	if (copy_from_user(a, args, len))
2474	return -EFAULT;
2475
2476	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2477	if (err)
2478	return err;
2479
2480	a0 = a[0];
2481	a1 = a[1];
2482
2483	switch (call) {
2484	case SYS_SOCKET:
2485	err = sys_socket(a0, a1, a[2]);
2486	break;
2487	case SYS_BIND:
2488	err = sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2489	break;
2490	case SYS_CONNECT:
2491	err = sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2492	break;
2493	case SYS_LISTEN:
2494	err = sys_listen(a0, a1);
2495	break;
2496	case SYS_ACCEPT:
2497	err = sys_accept4(a0, (struct sockaddr __user *)a1,
2498	(int __user *)a[2], 0);
2499	break;
2500	case SYS_GETSOCKNAME:
2501	err =
2502	sys_getsockname(a0, (struct sockaddr __user *)a1,
2503	(int __user *)a[2]);
2504	break;
2505	case SYS_GETPEERNAME:
2506	err =
2507	sys_getpeername(a0, (struct sockaddr __user *)a1,
2508	(int __user *)a[2]);
2509	break;
2510	case SYS_SOCKETPAIR:
2511	err = sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2512	break;
2513	case SYS_SEND:
2514	err = sys_send(a0, (void __user *)a1, a[2], a[3]);
2515	break;
2516	case SYS_SENDTO:
2517	err = sys_sendto(a0, (void __user *)a1, a[2], a[3],
2518	(struct sockaddr __user *)a[4], a[5]);
2519	break;
2520	case SYS_RECV:
2521	err = sys_recv(a0, (void __user *)a1, a[2], a[3]);
2522	break;
2523	case SYS_RECVFROM:
2524	err = sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2525	(struct sockaddr __user *)a[4],
2526	(int __user *)a[5]);
2527	break;
2528	case SYS_SHUTDOWN:
2529	err = sys_shutdown(a0, a1);
2530	break;
2531	case SYS_SETSOCKOPT:
2532	err = sys_setsockopt(a0, a1, a[2], (char __user *)a[3], a[4]);
2533	break;
2534	case SYS_GETSOCKOPT:
2535	err =
2536	sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2537	(int __user *)a[4]);
2538	break;
2539	case SYS_SENDMSG:
2540	err = sys_sendmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2541	break;
2542	case SYS_SENDMMSG:
2543	err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
2544	break;
2545	case SYS_RECVMSG:
2546	err = sys_recvmsg(a0, (struct user_msghdr __user *)a1, a[2]);
2547	break;
2548	case SYS_RECVMMSG:
2549	err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
2550	(struct timespec __user *)a[4]);
2551	break;
2552	case SYS_ACCEPT4:
2553	err = sys_accept4(a0, (struct sockaddr __user *)a1,
2554	(int __user *)a[2], a[3]);
2555	break;
2556	default:
2557	err = -EINVAL;
2558	break;
2559	}
2560	return err;
2561	}
2562
2563	#endif /* __ARCH_WANT_SYS_SOCKETCALL */
2564
2565	/**
2566	* sock_register - add a socket protocol handler
2567	* @ops: description of protocol
2568	*
2569	* This function is called by a protocol handler that wants to
2570	* advertise its address family, and have it linked into the
2571	* socket interface. The value ops->family corresponds to the
2572	* socket system call protocol family.
2573	*/
2574	int sock_register(const struct net_proto_family *ops)
2575	{
2576	int err;
2577
2578	if (ops->family >= NPROTO) {
2579	pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
2580	return -ENOBUFS;
2581	}
2582
2583	spin_lock(&net_family_lock);
2584	if (rcu_dereference_protected(net_families[ops->family],
2585	lockdep_is_held(&net_family_lock)))
2586	err = -EEXIST;
2587	else {
2588	rcu_assign_pointer(net_families[ops->family], ops);
2589	err = 0;
2590	}
2591	spin_unlock(&net_family_lock);
2592
2593	pr_info("NET: Registered protocol family %d\n", ops->family);
2594	return err;
2595	}
2596	EXPORT_SYMBOL(sock_register);
2597
2598	/**
2599	* sock_unregister - remove a protocol handler
2600	* @family: protocol family to remove
2601	*
2602	* This function is called by a protocol handler that wants to
2603	* remove its address family, and have it unlinked from the
2604	* new socket creation.
2605	*
2606	* If protocol handler is a module, then it can use module reference
2607	* counts to protect against new references. If protocol handler is not
2608	* a module then it needs to provide its own protection in
2609	* the ops->create routine.
2610	*/
2611	void sock_unregister(int family)
2612	{
2613	BUG_ON(family < 0 \|\| family >= NPROTO);
2614
2615	spin_lock(&net_family_lock);
2616	RCU_INIT_POINTER(net_families[family], NULL);
2617	spin_unlock(&net_family_lock);
2618
2619	synchronize_rcu();
2620
2621	pr_info("NET: Unregistered protocol family %d\n", family);
2622	}
2623	EXPORT_SYMBOL(sock_unregister);
2624
2625	static int __init sock_init(void)
2626	{
2627	int err;
2628	/*
2629	* Initialize the network sysctl infrastructure.
2630	*/
2631	err = net_sysctl_init();
2632	if (err)
2633	goto out;
2634
2635	/*
2636	* Initialize skbuff SLAB cache
2637	*/
2638	skb_init();
2639
2640	/*
2641	* Initialize the protocols module.
2642	*/
2643
2644	init_inodecache();
2645
2646	err = register_filesystem(&sock_fs_type);
2647	if (err)
2648	goto out_fs;
2649	sock_mnt = kern_mount(&sock_fs_type);
2650	if (IS_ERR(sock_mnt)) {
2651	err = PTR_ERR(sock_mnt);
2652	goto out_mount;
2653	}
2654
2655	/* The real protocol initialization is performed in later initcalls.
2656	*/
2657
2658	#ifdef CONFIG_NETFILTER
2659	err = netfilter_init();
2660	if (err)
2661	goto out;
2662	#endif
2663
2664	ptp_classifier_init();
2665
2666	out:
2667	return err;
2668
2669	out_mount:
2670	unregister_filesystem(&sock_fs_type);
2671	out_fs:
2672	goto out;
2673	}
2674
2675	core_initcall(sock_init); /* early initcall */
2676
2677	#ifdef CONFIG_PROC_FS
2678	void socket_seq_show(struct seq_file *seq)
2679	{
2680	int cpu;
2681	int counter = 0;
2682
2683	for_each_possible_cpu(cpu)
2684	counter += per_cpu(sockets_in_use, cpu);
2685
2686	/* It can be negative, by the way. 8) */
2687	if (counter < 0)
2688	counter = 0;
2689
2690	seq_printf(seq, "sockets: used %d\n", counter);
2691	}
2692	#endif /* CONFIG_PROC_FS */
2693
2694	#ifdef CONFIG_COMPAT
2695	static int do_siocgstamp(struct net net, struct socket sock,
2696	unsigned int cmd, void __user *up)
2697	{
2698	mm_segment_t old_fs = get_fs();
2699	struct timeval ktv;
2700	int err;
2701
2702	set_fs(KERNEL_DS);
2703	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
2704	set_fs(old_fs);
2705	if (!err)
2706	err = compat_put_timeval(&ktv, up);
2707
2708	return err;
2709	}
2710
2711	static int do_siocgstampns(struct net net, struct socket sock,
2712	unsigned int cmd, void __user *up)
2713	{
2714	mm_segment_t old_fs = get_fs();
2715	struct timespec kts;
2716	int err;
2717
2718	set_fs(KERNEL_DS);
2719	err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
2720	set_fs(old_fs);
2721	if (!err)
2722	err = compat_put_timespec(&kts, up);
2723
2724	return err;
2725	}
2726
2727	static int dev_ifname32(struct net net, struct compat_ifreq __user uifr32)
2728	{
2729	struct ifreq __user *uifr;
2730	int err;
2731
2732	uifr = compat_alloc_user_space(sizeof(struct ifreq));
2733	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2734	return -EFAULT;
2735
2736	err = dev_ioctl(net, SIOCGIFNAME, uifr);
2737	if (err)
2738	return err;
2739
2740	if (copy_in_user(uifr32, uifr, sizeof(struct compat_ifreq)))
2741	return -EFAULT;
2742
2743	return 0;
2744	}
2745
2746	static int dev_ifconf(struct net net, struct compat_ifconf __user uifc32)
2747	{
2748	struct compat_ifconf ifc32;
2749	struct ifconf ifc;
2750	struct ifconf __user *uifc;
2751	struct compat_ifreq __user *ifr32;
2752	struct ifreq __user *ifr;
2753	unsigned int i, j;
2754	int err;
2755
2756	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
2757	return -EFAULT;
2758
2759	memset(&ifc, 0, sizeof(ifc));
2760	if (ifc32.ifcbuf == 0) {
2761	ifc32.ifc_len = 0;
2762	ifc.ifc_len = 0;
2763	ifc.ifc_req = NULL;
2764	uifc = compat_alloc_user_space(sizeof(struct ifconf));
2765	} else {
2766	size_t len = ((ifc32.ifc_len / sizeof(struct compat_ifreq)) + 1) *
2767	sizeof(struct ifreq);
2768	uifc = compat_alloc_user_space(sizeof(struct ifconf) + len);
2769	ifc.ifc_len = len;
2770	ifr = ifc.ifc_req = (void __user *)(uifc + 1);
2771	ifr32 = compat_ptr(ifc32.ifcbuf);
2772	for (i = 0; i < ifc32.ifc_len; i += sizeof(struct compat_ifreq)) {
2773	if (copy_in_user(ifr, ifr32, sizeof(struct compat_ifreq)))
2774	return -EFAULT;
2775	ifr++;
2776	ifr32++;
2777	}
2778	}
2779	if (copy_to_user(uifc, &ifc, sizeof(struct ifconf)))
2780	return -EFAULT;
2781
2782	err = dev_ioctl(net, SIOCGIFCONF, uifc);
2783	if (err)
2784	return err;
2785
2786	if (copy_from_user(&ifc, uifc, sizeof(struct ifconf)))
2787	return -EFAULT;
2788
2789	ifr = ifc.ifc_req;
2790	ifr32 = compat_ptr(ifc32.ifcbuf);
2791	for (i = 0, j = 0;
2792	i + sizeof(struct compat_ifreq) <= ifc32.ifc_len && j < ifc.ifc_len;
2793	i += sizeof(struct compat_ifreq), j += sizeof(struct ifreq)) {
2794	if (copy_in_user(ifr32, ifr, sizeof(struct compat_ifreq)))
2795	return -EFAULT;
2796	ifr32++;
2797	ifr++;
2798	}
2799
2800	if (ifc32.ifcbuf == 0) {
2801	/* Translate from 64-bit structure multiple to
2802	* a 32-bit one.
2803	*/
2804	i = ifc.ifc_len;
2805	i = ((i / sizeof(struct ifreq)) * sizeof(struct compat_ifreq));
2806	ifc32.ifc_len = i;
2807	} else {
2808	ifc32.ifc_len = i;
2809	}
2810	if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
2811	return -EFAULT;
2812
2813	return 0;
2814	}
2815
2816	static int ethtool_ioctl(struct net net, struct compat_ifreq __user ifr32)
2817	{
2818	struct compat_ethtool_rxnfc __user *compat_rxnfc;
2819	bool convert_in = false, convert_out = false;
2820	size_t buf_size = ALIGN(sizeof(struct ifreq), 8);
2821	struct ethtool_rxnfc __user *rxnfc;
2822	struct ifreq __user *ifr;
2823	u32 rule_cnt = 0, actual_rule_cnt;
2824	u32 ethcmd;
2825	u32 data;
2826	int ret;
2827
2828	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
2829	return -EFAULT;
2830
2831	compat_rxnfc = compat_ptr(data);
2832
2833	if (get_user(ethcmd, &compat_rxnfc->cmd))
2834	return -EFAULT;
2835
2836	/* Most ethtool structures are defined without padding.
2837	* Unfortunately struct ethtool_rxnfc is an exception.
2838	*/
2839	switch (ethcmd) {
2840	default:
2841	break;
2842	case ETHTOOL_GRXCLSRLALL:
2843	/* Buffer size is variable */
2844	if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
2845	return -EFAULT;
2846	if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
2847	return -ENOMEM;
2848	buf_size += rule_cnt * sizeof(u32);
2849	/* fall through */
2850	case ETHTOOL_GRXRINGS:
2851	case ETHTOOL_GRXCLSRLCNT:
2852	case ETHTOOL_GRXCLSRULE:
2853	case ETHTOOL_SRXCLSRLINS:
2854	convert_out = true;
2855	/* fall through */
2856	case ETHTOOL_SRXCLSRLDEL:
2857	buf_size += sizeof(struct ethtool_rxnfc);
2858	convert_in = true;
2859	break;
2860	}
2861
2862	ifr = compat_alloc_user_space(buf_size);
2863	rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
2864
2865	if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
2866	return -EFAULT;
2867
2868	if (put_user(convert_in ? rxnfc : compat_ptr(data),
2869	&ifr->ifr_ifru.ifru_data))
2870	return -EFAULT;
2871
2872	if (convert_in) {
2873	/* We expect there to be holes between fs.m_ext and
2874	* fs.ring_cookie and at the end of fs, but nowhere else.
2875	*/
2876	BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
2877	sizeof(compat_rxnfc->fs.m_ext) !=
2878	offsetof(struct ethtool_rxnfc, fs.m_ext) +
2879	sizeof(rxnfc->fs.m_ext));
2880	BUILD_BUG_ON(
2881	offsetof(struct compat_ethtool_rxnfc, fs.location) -
2882	offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
2883	offsetof(struct ethtool_rxnfc, fs.location) -
2884	offsetof(struct ethtool_rxnfc, fs.ring_cookie));
2885
2886	if (copy_in_user(rxnfc, compat_rxnfc,
2887	(void __user *)(&rxnfc->fs.m_ext + 1) -
2888	(void __user *)rxnfc) \|\|
2889	copy_in_user(&rxnfc->fs.ring_cookie,
2890	&compat_rxnfc->fs.ring_cookie,
2891	(void __user *)(&rxnfc->fs.location + 1) -
2892	(void __user *)&rxnfc->fs.ring_cookie) \|\|
2893	copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
2894	sizeof(rxnfc->rule_cnt)))
2895	return -EFAULT;
2896	}
2897
2898	ret = dev_ioctl(net, SIOCETHTOOL, ifr);
2899	if (ret)
2900	return ret;
2901
2902	if (convert_out) {
2903	if (copy_in_user(compat_rxnfc, rxnfc,
2904	(const void __user *)(&rxnfc->fs.m_ext + 1) -
2905	(const void __user *)rxnfc) \|\|
2906	copy_in_user(&compat_rxnfc->fs.ring_cookie,
2907	&rxnfc->fs.ring_cookie,
2908	(const void __user *)(&rxnfc->fs.location + 1) -
2909	(const void __user *)&rxnfc->fs.ring_cookie) \|\|
2910	copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
2911	sizeof(rxnfc->rule_cnt)))
2912	return -EFAULT;
2913
2914	if (ethcmd == ETHTOOL_GRXCLSRLALL) {
2915	/* As an optimisation, we only copy the actual
2916	* number of rules that the underlying
2917	* function returned. Since Mallory might
2918	* change the rule count in user memory, we
2919	* check that it is less than the rule count
2920	* originally given (as the user buffer size),
2921	* which has been range-checked.
2922	*/
2923	if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
2924	return -EFAULT;
2925	if (actual_rule_cnt < rule_cnt)
2926	rule_cnt = actual_rule_cnt;
2927	if (copy_in_user(&compat_rxnfc->rule_locs[0],
2928	&rxnfc->rule_locs[0],
2929	rule_cnt * sizeof(u32)))
2930	return -EFAULT;
2931	}
2932	}
2933
2934	return 0;
2935	}
2936
2937	static int compat_siocwandev(struct net net, struct compat_ifreq __user uifr32)
2938	{
2939	void __user *uptr;
2940	compat_uptr_t uptr32;
2941	struct ifreq __user *uifr;
2942
2943	uifr = compat_alloc_user_space(sizeof(*uifr));
2944	if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
2945	return -EFAULT;
2946
2947	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
2948	return -EFAULT;
2949
2950	uptr = compat_ptr(uptr32);
2951
2952	if (put_user(uptr, &uifr->ifr_settings.ifs_ifsu.raw_hdlc))
2953	return -EFAULT;
2954
2955	return dev_ioctl(net, SIOCWANDEV, uifr);
2956	}
2957
2958	static int bond_ioctl(struct net *net, unsigned int cmd,
2959	struct compat_ifreq __user *ifr32)
2960	{
2961	struct ifreq kifr;
2962	mm_segment_t old_fs;
2963	int err;
2964
2965	switch (cmd) {
2966	case SIOCBONDENSLAVE:
2967	case SIOCBONDRELEASE:
2968	case SIOCBONDSETHWADDR:
2969	case SIOCBONDCHANGEACTIVE:
2970	if (copy_from_user(&kifr, ifr32, sizeof(struct compat_ifreq)))
2971	return -EFAULT;
2972
2973	old_fs = get_fs();
2974	set_fs(KERNEL_DS);
2975	err = dev_ioctl(net, cmd,
2976	(struct ifreq __user __force *) &kifr);
2977	set_fs(old_fs);
2978
2979	return err;
2980	default:
2981	return -ENOIOCTLCMD;
2982	}
2983	}
2984
2985	/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
2986	static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
2987	struct compat_ifreq __user *u_ifreq32)
2988	{
2989	struct ifreq __user *u_ifreq64;
2990	char tmp_buf[IFNAMSIZ];
2991	void __user *data64;
2992	u32 data32;
2993
2994	if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
2995	IFNAMSIZ))
2996	return -EFAULT;
2997	if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
2998	return -EFAULT;
2999	data64 = compat_ptr(data32);
3000
3001	u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
3002
3003	if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
3004	IFNAMSIZ))
3005	return -EFAULT;
3006	if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
3007	return -EFAULT;
3008
3009	return dev_ioctl(net, cmd, u_ifreq64);
3010	}
3011
3012	static int dev_ifsioc(struct net net, struct socket sock,
3013	unsigned int cmd, struct compat_ifreq __user *uifr32)
3014	{
3015	struct ifreq __user *uifr;
3016	int err;
3017
3018	uifr = compat_alloc_user_space(sizeof(*uifr));
3019	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3020	return -EFAULT;
3021
3022	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3023
3024	if (!err) {
3025	switch (cmd) {
3026	case SIOCGIFFLAGS:
3027	case SIOCGIFMETRIC:
3028	case SIOCGIFMTU:
3029	case SIOCGIFMEM:
3030	case SIOCGIFHWADDR:
3031	case SIOCGIFINDEX:
3032	case SIOCGIFADDR:
3033	case SIOCGIFBRDADDR:
3034	case SIOCGIFDSTADDR:
3035	case SIOCGIFNETMASK:
3036	case SIOCGIFPFLAGS:
3037	case SIOCGIFTXQLEN:
3038	case SIOCGMIIPHY:
3039	case SIOCGMIIREG:
3040	if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
3041	err = -EFAULT;
3042	break;
3043	}
3044	}
3045	return err;
3046	}
3047
3048	static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3049	struct compat_ifreq __user *uifr32)
3050	{
3051	struct ifreq ifr;
3052	struct compat_ifmap __user *uifmap32;
3053	mm_segment_t old_fs;
3054	int err;
3055
3056	uifmap32 = &uifr32->ifr_ifru.ifru_map;
3057	err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3058	err \|= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3059	err \|= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3060	err \|= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3061	err \|= get_user(ifr.ifr_map.irq, &uifmap32->irq);
3062	err \|= get_user(ifr.ifr_map.dma, &uifmap32->dma);
3063	err \|= get_user(ifr.ifr_map.port, &uifmap32->port);
3064	if (err)
3065	return -EFAULT;
3066
3067	old_fs = get_fs();
3068	set_fs(KERNEL_DS);
3069	err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
3070	set_fs(old_fs);
3071
3072	if (cmd == SIOCGIFMAP && !err) {
3073	err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3074	err \|= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3075	err \|= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3076	err \|= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3077	err \|= put_user(ifr.ifr_map.irq, &uifmap32->irq);
3078	err \|= put_user(ifr.ifr_map.dma, &uifmap32->dma);
3079	err \|= put_user(ifr.ifr_map.port, &uifmap32->port);
3080	if (err)
3081	err = -EFAULT;
3082	}
3083	return err;
3084	}
3085
3086	struct rtentry32 {
3087	u32 rt_pad1;
3088	struct sockaddr rt_dst; /* target address */
3089	struct sockaddr rt_gateway; /* gateway addr (RTF_GATEWAY) */
3090	struct sockaddr rt_genmask; /* target network mask (IP) */
3091	unsigned short rt_flags;
3092	short rt_pad2;
3093	u32 rt_pad3;
3094	unsigned char rt_tos;
3095	unsigned char rt_class;
3096	short rt_pad4;
3097	short rt_metric; /* +1 for binary compatibility! */
3098	/* char * / u32 rt_dev; / forcing the device at add */
3099	u32 rt_mtu; /* per route MTU/Window */
3100	u32 rt_window; /* Window clamping */
3101	unsigned short rt_irtt; /* Initial RTT */
3102	};
3103
3104	struct in6_rtmsg32 {
3105	struct in6_addr rtmsg_dst;
3106	struct in6_addr rtmsg_src;
3107	struct in6_addr rtmsg_gateway;
3108	u32 rtmsg_type;
3109	u16 rtmsg_dst_len;
3110	u16 rtmsg_src_len;
3111	u32 rtmsg_metric;
3112	u32 rtmsg_info;
3113	u32 rtmsg_flags;
3114	s32 rtmsg_ifindex;
3115	};
3116
3117	static int routing_ioctl(struct net net, struct socket sock,
3118	unsigned int cmd, void __user *argp)
3119	{
3120	int ret;
3121	void *r = NULL;
3122	struct in6_rtmsg r6;
3123	struct rtentry r4;
3124	char devname[16];
3125	u32 rtdev;
3126	mm_segment_t old_fs = get_fs();
3127
3128	if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3129	struct in6_rtmsg32 __user *ur6 = argp;
3130	ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3131	3 * sizeof(struct in6_addr));
3132	ret \|= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3133	ret \|= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3134	ret \|= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3135	ret \|= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3136	ret \|= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3137	ret \|= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3138	ret \|= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3139
3140	r = (void *) &r6;
3141	} else { /* ipv4 */
3142	struct rtentry32 __user *ur4 = argp;
3143	ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3144	3 * sizeof(struct sockaddr));
3145	ret \|= get_user(r4.rt_flags, &(ur4->rt_flags));
3146	ret \|= get_user(r4.rt_metric, &(ur4->rt_metric));
3147	ret \|= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3148	ret \|= get_user(r4.rt_window, &(ur4->rt_window));
3149	ret \|= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3150	ret \|= get_user(rtdev, &(ur4->rt_dev));
3151	if (rtdev) {
3152	ret \|= copy_from_user(devname, compat_ptr(rtdev), 15);
3153	r4.rt_dev = (char __user __force *)devname;
3154	devname[15] = 0;
3155	} else
3156	r4.rt_dev = NULL;
3157
3158	r = (void *) &r4;
3159	}
3160
3161	if (ret) {
3162	ret = -EFAULT;
3163	goto out;
3164	}
3165
3166	set_fs(KERNEL_DS);
3167	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3168	set_fs(old_fs);
3169
3170	out:
3171	return ret;
3172	}
3173
3174	/* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3175	* for some operations; this forces use of the newer bridge-utils that
3176	* use compatible ioctls
3177	*/
3178	static int old_bridge_ioctl(compat_ulong_t __user *argp)
3179	{
3180	compat_ulong_t tmp;
3181
3182	if (get_user(tmp, argp))
3183	return -EFAULT;
3184	if (tmp == BRCTL_GET_VERSION)
3185	return BRCTL_VERSION + 1;
3186	return -EINVAL;
3187	}
3188
3189	static int compat_sock_ioctl_trans(struct file file, struct socket sock,
3190	unsigned int cmd, unsigned long arg)
3191	{
3192	void __user *argp = compat_ptr(arg);
3193	struct sock *sk = sock->sk;
3194	struct net *net = sock_net(sk);
3195
3196	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3197	return compat_ifr_data_ioctl(net, cmd, argp);
3198
3199	switch (cmd) {
3200	case SIOCSIFBR:
3201	case SIOCGIFBR:
3202	return old_bridge_ioctl(argp);
3203	case SIOCGIFNAME:
3204	return dev_ifname32(net, argp);
3205	case SIOCGIFCONF:
3206	return dev_ifconf(net, argp);
3207	case SIOCETHTOOL:
3208	return ethtool_ioctl(net, argp);
3209	case SIOCWANDEV:
3210	return compat_siocwandev(net, argp);
3211	case SIOCGIFMAP:
3212	case SIOCSIFMAP:
3213	return compat_sioc_ifmap(net, cmd, argp);
3214	case SIOCBONDENSLAVE:
3215	case SIOCBONDRELEASE:
3216	case SIOCBONDSETHWADDR:
3217	case SIOCBONDCHANGEACTIVE:
3218	return bond_ioctl(net, cmd, argp);
3219	case SIOCADDRT:
3220	case SIOCDELRT:
3221	return routing_ioctl(net, sock, cmd, argp);
3222	case SIOCGSTAMP:
3223	return do_siocgstamp(net, sock, cmd, argp);
3224	case SIOCGSTAMPNS:
3225	return do_siocgstampns(net, sock, cmd, argp);
3226	case SIOCBONDSLAVEINFOQUERY:
3227	case SIOCBONDINFOQUERY:
3228	case SIOCSHWTSTAMP:
3229	case SIOCGHWTSTAMP:
3230	return compat_ifr_data_ioctl(net, cmd, argp);
3231
3232	case FIOSETOWN:
3233	case SIOCSPGRP:
3234	case FIOGETOWN:
3235	case SIOCGPGRP:
3236	case SIOCBRADDBR:
3237	case SIOCBRDELBR:
3238	case SIOCGIFVLAN:
3239	case SIOCSIFVLAN:
3240	case SIOCADDDLCI:
3241	case SIOCDELDLCI:
3242	return sock_ioctl(file, cmd, arg);
3243
3244	case SIOCGIFFLAGS:
3245	case SIOCSIFFLAGS:
3246	case SIOCGIFMETRIC:
3247	case SIOCSIFMETRIC:
3248	case SIOCGIFMTU:
3249	case SIOCSIFMTU:
3250	case SIOCGIFMEM:
3251	case SIOCSIFMEM:
3252	case SIOCGIFHWADDR:
3253	case SIOCSIFHWADDR:
3254	case SIOCADDMULTI:
3255	case SIOCDELMULTI:
3256	case SIOCGIFINDEX:
3257	case SIOCGIFADDR:
3258	case SIOCSIFADDR:
3259	case SIOCSIFHWBROADCAST:
3260	case SIOCDIFADDR:
3261	case SIOCGIFBRDADDR:
3262	case SIOCSIFBRDADDR:
3263	case SIOCGIFDSTADDR:
3264	case SIOCSIFDSTADDR:
3265	case SIOCGIFNETMASK:
3266	case SIOCSIFNETMASK:
3267	case SIOCSIFPFLAGS:
3268	case SIOCGIFPFLAGS:
3269	case SIOCGIFTXQLEN:
3270	case SIOCSIFTXQLEN:
3271	case SIOCBRADDIF:
3272	case SIOCBRDELIF:
3273	case SIOCSIFNAME:
3274	case SIOCGMIIPHY:
3275	case SIOCGMIIREG:
3276	case SIOCSMIIREG:
3277	return dev_ifsioc(net, sock, cmd, argp);
3278
3279	case SIOCSARP:
3280	case SIOCGARP:
3281	case SIOCDARP:
3282	case SIOCATMARK:
3283	return sock_do_ioctl(net, sock, cmd, arg);
3284	}
3285
3286	return -ENOIOCTLCMD;
3287	}
3288
3289	static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3290	unsigned long arg)
3291	{
3292	struct socket *sock = file->private_data;
3293	int ret = -ENOIOCTLCMD;
3294	struct sock *sk;
3295	struct net *net;
3296
3297	sk = sock->sk;
3298	net = sock_net(sk);
3299
3300	if (sock->ops->compat_ioctl)
3301	ret = sock->ops->compat_ioctl(sock, cmd, arg);
3302
3303	if (ret == -ENOIOCTLCMD &&
3304	(cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3305	ret = compat_wext_handle_ioctl(net, cmd, arg);
3306
3307	if (ret == -ENOIOCTLCMD)
3308	ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3309
3310	return ret;
3311	}
3312	#endif
3313
3314	int kernel_bind(struct socket sock, struct sockaddr addr, int addrlen)
3315	{
3316	return sock->ops->bind(sock, addr, addrlen);
3317	}
3318	EXPORT_SYMBOL(kernel_bind);
3319
3320	int kernel_listen(struct socket *sock, int backlog)
3321	{
3322	return sock->ops->listen(sock, backlog);
3323	}
3324	EXPORT_SYMBOL(kernel_listen);
3325
3326	int kernel_accept(struct socket sock, struct socket *newsock, int flags)
3327	{
3328	struct sock *sk = sock->sk;
3329	int err;
3330
3331	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3332	newsock);
3333	if (err < 0)
3334	goto done;
3335
3336	err = sock->ops->accept(sock, *newsock, flags);
3337	if (err < 0) {
3338	sock_release(*newsock);
3339	*newsock = NULL;
3340	goto done;
3341	}
3342
3343	(*newsock)->ops = sock->ops;
3344	__module_get((*newsock)->ops->owner);
3345
3346	done:
3347	return err;
3348	}
3349	EXPORT_SYMBOL(kernel_accept);
3350
3351	int kernel_connect(struct socket sock, struct sockaddr addr, int addrlen,
3352	int flags)
3353	{
3354	return sock->ops->connect(sock, addr, addrlen, flags);
3355	}
3356	EXPORT_SYMBOL(kernel_connect);
3357
3358	int kernel_getsockname(struct socket sock, struct sockaddr addr,
3359	int *addrlen)
3360	{
3361	return sock->ops->getname(sock, addr, addrlen, 0);
3362	}
3363	EXPORT_SYMBOL(kernel_getsockname);
3364
3365	int kernel_getpeername(struct socket sock, struct sockaddr addr,
3366	int *addrlen)
3367	{
3368	return sock->ops->getname(sock, addr, addrlen, 1);
3369	}
3370	EXPORT_SYMBOL(kernel_getpeername);
3371
3372	int kernel_getsockopt(struct socket *sock, int level, int optname,
3373	char optval, int optlen)
3374	{
3375	mm_segment_t oldfs = get_fs();
3376	char __user *uoptval;
3377	int __user *uoptlen;
3378	int err;
3379
3380	uoptval = (char __user __force *) optval;
3381	uoptlen = (int __user __force *) optlen;
3382
3383	set_fs(KERNEL_DS);
3384	if (level == SOL_SOCKET)
3385	err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3386	else
3387	err = sock->ops->getsockopt(sock, level, optname, uoptval,
3388	uoptlen);
3389	set_fs(oldfs);
3390	return err;
3391	}
3392	EXPORT_SYMBOL(kernel_getsockopt);
3393
3394	int kernel_setsockopt(struct socket *sock, int level, int optname,
3395	char *optval, unsigned int optlen)
3396	{
3397	mm_segment_t oldfs = get_fs();
3398	char __user *uoptval;
3399	int err;
3400
3401	uoptval = (char __user __force *) optval;
3402
3403	set_fs(KERNEL_DS);
3404	if (level == SOL_SOCKET)
3405	err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3406	else
3407	err = sock->ops->setsockopt(sock, level, optname, uoptval,
3408	optlen);
3409	set_fs(oldfs);
3410	return err;
3411	}
3412	EXPORT_SYMBOL(kernel_setsockopt);
3413
3414	int kernel_sendpage(struct socket sock, struct page page, int offset,
3415	size_t size, int flags)
3416	{
3417	if (sock->ops->sendpage)
3418	return sock->ops->sendpage(sock, page, offset, size, flags);
3419
3420	return sock_no_sendpage(sock, page, offset, size, flags);
3421	}
3422	EXPORT_SYMBOL(kernel_sendpage);
3423
3424	int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg)
3425	{
3426	mm_segment_t oldfs = get_fs();
3427	int err;
3428
3429	set_fs(KERNEL_DS);
3430	err = sock->ops->ioctl(sock, cmd, arg);
3431	set_fs(oldfs);
3432
3433	return err;
3434	}
3435	EXPORT_SYMBOL(kernel_sock_ioctl);
3436
3437	int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3438	{
3439	return sock->ops->shutdown(sock, how);
3440	}
3441	EXPORT_SYMBOL(kernel_sock_shutdown);