xref: /openbmc/linux/net/core/sock.c (revision 97da55fc)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		Generic socket support routines. Memory allocators, socket lock/release
7  *		handler for protocols to use and generic option handler.
8  *
9  *
10  * Authors:	Ross Biro
11  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
12  *		Florian La Roche, <flla@stud.uni-sb.de>
13  *		Alan Cox, <A.Cox@swansea.ac.uk>
14  *
15  * Fixes:
16  *		Alan Cox	: 	Numerous verify_area() problems
17  *		Alan Cox	:	Connecting on a connecting socket
18  *					now returns an error for tcp.
19  *		Alan Cox	:	sock->protocol is set correctly.
20  *					and is not sometimes left as 0.
21  *		Alan Cox	:	connect handles icmp errors on a
22  *					connect properly. Unfortunately there
23  *					is a restart syscall nasty there. I
24  *					can't match BSD without hacking the C
25  *					library. Ideas urgently sought!
26  *		Alan Cox	:	Disallow bind() to addresses that are
27  *					not ours - especially broadcast ones!!
28  *		Alan Cox	:	Socket 1024 _IS_ ok for users. (fencepost)
29  *		Alan Cox	:	sock_wfree/sock_rfree don't destroy sockets,
30  *					instead they leave that for the DESTROY timer.
31  *		Alan Cox	:	Clean up error flag in accept
32  *		Alan Cox	:	TCP ack handling is buggy, the DESTROY timer
33  *					was buggy. Put a remove_sock() in the handler
34  *					for memory when we hit 0. Also altered the timer
35  *					code. The ACK stuff can wait and needs major
36  *					TCP layer surgery.
37  *		Alan Cox	:	Fixed TCP ack bug, removed remove sock
38  *					and fixed timer/inet_bh race.
39  *		Alan Cox	:	Added zapped flag for TCP
40  *		Alan Cox	:	Move kfree_skb into skbuff.c and tidied up surplus code
41  *		Alan Cox	:	for new sk_buff allocations wmalloc/rmalloc now call alloc_skb
42  *		Alan Cox	:	kfree_s calls now are kfree_skbmem so we can track skb resources
43  *		Alan Cox	:	Supports socket option broadcast now as does udp. Packet and raw need fixing.
44  *		Alan Cox	:	Added RCVBUF,SNDBUF size setting. It suddenly occurred to me how easy it was so...
45  *		Rick Sladkey	:	Relaxed UDP rules for matching packets.
46  *		C.E.Hawkins	:	IFF_PROMISC/SIOCGHWADDR support
47  *	Pauline Middelink	:	identd support
48  *		Alan Cox	:	Fixed connect() taking signals I think.
49  *		Alan Cox	:	SO_LINGER supported
50  *		Alan Cox	:	Error reporting fixes
51  *		Anonymous	:	inet_create tidied up (sk->reuse setting)
52  *		Alan Cox	:	inet sockets don't set sk->type!
53  *		Alan Cox	:	Split socket option code
54  *		Alan Cox	:	Callbacks
55  *		Alan Cox	:	Nagle flag for Charles & Johannes stuff
56  *		Alex		:	Removed restriction on inet fioctl
57  *		Alan Cox	:	Splitting INET from NET core
58  *		Alan Cox	:	Fixed bogus SO_TYPE handling in getsockopt()
59  *		Adam Caldwell	:	Missing return in SO_DONTROUTE/SO_DEBUG code
60  *		Alan Cox	:	Split IP from generic code
61  *		Alan Cox	:	New kfree_skbmem()
62  *		Alan Cox	:	Make SO_DEBUG superuser only.
63  *		Alan Cox	:	Allow anyone to clear SO_DEBUG
64  *					(compatibility fix)
65  *		Alan Cox	:	Added optimistic memory grabbing for AF_UNIX throughput.
66  *		Alan Cox	:	Allocator for a socket is settable.
67  *		Alan Cox	:	SO_ERROR includes soft errors.
68  *		Alan Cox	:	Allow NULL arguments on some SO_ opts
69  *		Alan Cox	: 	Generic socket allocation to make hooks
70  *					easier (suggested by Craig Metz).
71  *		Michael Pall	:	SO_ERROR returns positive errno again
72  *              Steve Whitehouse:       Added default destructor to free
73  *                                      protocol private data.
74  *              Steve Whitehouse:       Added various other default routines
75  *                                      common to several socket families.
76  *              Chris Evans     :       Call suser() check last on F_SETOWN
77  *		Jay Schulist	:	Added SO_ATTACH_FILTER and SO_DETACH_FILTER.
78  *		Andi Kleen	:	Add sock_kmalloc()/sock_kfree_s()
79  *		Andi Kleen	:	Fix write_space callback
80  *		Chris Evans	:	Security fixes - signedness again
81  *		Arnaldo C. Melo :       cleanups, use skb_queue_purge
82  *
83  * To Fix:
84  *
85  *
86  *		This program is free software; you can redistribute it and/or
87  *		modify it under the terms of the GNU General Public License
88  *		as published by the Free Software Foundation; either version
89  *		2 of the License, or (at your option) any later version.
90  */
91 
92 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
93 
94 #include <linux/capability.h>
95 #include <linux/errno.h>
96 #include <linux/types.h>
97 #include <linux/socket.h>
98 #include <linux/in.h>
99 #include <linux/kernel.h>
100 #include <linux/module.h>
101 #include <linux/proc_fs.h>
102 #include <linux/seq_file.h>
103 #include <linux/sched.h>
104 #include <linux/timer.h>
105 #include <linux/string.h>
106 #include <linux/sockios.h>
107 #include <linux/net.h>
108 #include <linux/mm.h>
109 #include <linux/slab.h>
110 #include <linux/interrupt.h>
111 #include <linux/poll.h>
112 #include <linux/tcp.h>
113 #include <linux/init.h>
114 #include <linux/highmem.h>
115 #include <linux/user_namespace.h>
116 #include <linux/static_key.h>
117 #include <linux/memcontrol.h>
118 #include <linux/prefetch.h>
119 
120 #include <asm/uaccess.h>
121 
122 #include <linux/netdevice.h>
123 #include <net/protocol.h>
124 #include <linux/skbuff.h>
125 #include <net/net_namespace.h>
126 #include <net/request_sock.h>
127 #include <net/sock.h>
128 #include <linux/net_tstamp.h>
129 #include <net/xfrm.h>
130 #include <linux/ipsec.h>
131 #include <net/cls_cgroup.h>
132 #include <net/netprio_cgroup.h>
133 
134 #include <linux/filter.h>
135 
136 #include <trace/events/sock.h>
137 
138 #ifdef CONFIG_INET
139 #include <net/tcp.h>
140 #endif
141 
142 static DEFINE_MUTEX(proto_list_mutex);
143 static LIST_HEAD(proto_list);
144 
145 #ifdef CONFIG_MEMCG_KMEM
146 int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
147 {
148 	struct proto *proto;
149 	int ret = 0;
150 
151 	mutex_lock(&proto_list_mutex);
152 	list_for_each_entry(proto, &proto_list, node) {
153 		if (proto->init_cgroup) {
154 			ret = proto->init_cgroup(memcg, ss);
155 			if (ret)
156 				goto out;
157 		}
158 	}
159 
160 	mutex_unlock(&proto_list_mutex);
161 	return ret;
162 out:
163 	list_for_each_entry_continue_reverse(proto, &proto_list, node)
164 		if (proto->destroy_cgroup)
165 			proto->destroy_cgroup(memcg);
166 	mutex_unlock(&proto_list_mutex);
167 	return ret;
168 }
169 
170 void mem_cgroup_sockets_destroy(struct mem_cgroup *memcg)
171 {
172 	struct proto *proto;
173 
174 	mutex_lock(&proto_list_mutex);
175 	list_for_each_entry_reverse(proto, &proto_list, node)
176 		if (proto->destroy_cgroup)
177 			proto->destroy_cgroup(memcg);
178 	mutex_unlock(&proto_list_mutex);
179 }
180 #endif
181 
182 /*
183  * Each address family might have different locking rules, so we have
184  * one slock key per address family:
185  */
186 static struct lock_class_key af_family_keys[AF_MAX];
187 static struct lock_class_key af_family_slock_keys[AF_MAX];
188 
189 #if defined(CONFIG_MEMCG_KMEM)
190 struct static_key memcg_socket_limit_enabled;
191 EXPORT_SYMBOL(memcg_socket_limit_enabled);
192 #endif
193 
194 /*
195  * Make lock validator output more readable. (we pre-construct these
196  * strings build-time, so that runtime initialization of socket
197  * locks is fast):
198  */
199 static const char *const af_family_key_strings[AF_MAX+1] = {
200   "sk_lock-AF_UNSPEC", "sk_lock-AF_UNIX"     , "sk_lock-AF_INET"     ,
201   "sk_lock-AF_AX25"  , "sk_lock-AF_IPX"      , "sk_lock-AF_APPLETALK",
202   "sk_lock-AF_NETROM", "sk_lock-AF_BRIDGE"   , "sk_lock-AF_ATMPVC"   ,
203   "sk_lock-AF_X25"   , "sk_lock-AF_INET6"    , "sk_lock-AF_ROSE"     ,
204   "sk_lock-AF_DECnet", "sk_lock-AF_NETBEUI"  , "sk_lock-AF_SECURITY" ,
205   "sk_lock-AF_KEY"   , "sk_lock-AF_NETLINK"  , "sk_lock-AF_PACKET"   ,
206   "sk_lock-AF_ASH"   , "sk_lock-AF_ECONET"   , "sk_lock-AF_ATMSVC"   ,
207   "sk_lock-AF_RDS"   , "sk_lock-AF_SNA"      , "sk_lock-AF_IRDA"     ,
208   "sk_lock-AF_PPPOX" , "sk_lock-AF_WANPIPE"  , "sk_lock-AF_LLC"      ,
209   "sk_lock-27"       , "sk_lock-28"          , "sk_lock-AF_CAN"      ,
210   "sk_lock-AF_TIPC"  , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV"        ,
211   "sk_lock-AF_RXRPC" , "sk_lock-AF_ISDN"     , "sk_lock-AF_PHONET"   ,
212   "sk_lock-AF_IEEE802154", "sk_lock-AF_CAIF" , "sk_lock-AF_ALG"      ,
213   "sk_lock-AF_NFC"   , "sk_lock-AF_MAX"
214 };
215 static const char *const af_family_slock_key_strings[AF_MAX+1] = {
216   "slock-AF_UNSPEC", "slock-AF_UNIX"     , "slock-AF_INET"     ,
217   "slock-AF_AX25"  , "slock-AF_IPX"      , "slock-AF_APPLETALK",
218   "slock-AF_NETROM", "slock-AF_BRIDGE"   , "slock-AF_ATMPVC"   ,
219   "slock-AF_X25"   , "slock-AF_INET6"    , "slock-AF_ROSE"     ,
220   "slock-AF_DECnet", "slock-AF_NETBEUI"  , "slock-AF_SECURITY" ,
221   "slock-AF_KEY"   , "slock-AF_NETLINK"  , "slock-AF_PACKET"   ,
222   "slock-AF_ASH"   , "slock-AF_ECONET"   , "slock-AF_ATMSVC"   ,
223   "slock-AF_RDS"   , "slock-AF_SNA"      , "slock-AF_IRDA"     ,
224   "slock-AF_PPPOX" , "slock-AF_WANPIPE"  , "slock-AF_LLC"      ,
225   "slock-27"       , "slock-28"          , "slock-AF_CAN"      ,
226   "slock-AF_TIPC"  , "slock-AF_BLUETOOTH", "slock-AF_IUCV"     ,
227   "slock-AF_RXRPC" , "slock-AF_ISDN"     , "slock-AF_PHONET"   ,
228   "slock-AF_IEEE802154", "slock-AF_CAIF" , "slock-AF_ALG"      ,
229   "slock-AF_NFC"   , "slock-AF_MAX"
230 };
231 static const char *const af_family_clock_key_strings[AF_MAX+1] = {
232   "clock-AF_UNSPEC", "clock-AF_UNIX"     , "clock-AF_INET"     ,
233   "clock-AF_AX25"  , "clock-AF_IPX"      , "clock-AF_APPLETALK",
234   "clock-AF_NETROM", "clock-AF_BRIDGE"   , "clock-AF_ATMPVC"   ,
235   "clock-AF_X25"   , "clock-AF_INET6"    , "clock-AF_ROSE"     ,
236   "clock-AF_DECnet", "clock-AF_NETBEUI"  , "clock-AF_SECURITY" ,
237   "clock-AF_KEY"   , "clock-AF_NETLINK"  , "clock-AF_PACKET"   ,
238   "clock-AF_ASH"   , "clock-AF_ECONET"   , "clock-AF_ATMSVC"   ,
239   "clock-AF_RDS"   , "clock-AF_SNA"      , "clock-AF_IRDA"     ,
240   "clock-AF_PPPOX" , "clock-AF_WANPIPE"  , "clock-AF_LLC"      ,
241   "clock-27"       , "clock-28"          , "clock-AF_CAN"      ,
242   "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
243   "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
244   "clock-AF_IEEE802154", "clock-AF_CAIF" , "clock-AF_ALG"      ,
245   "clock-AF_NFC"   , "clock-AF_MAX"
246 };
247 
248 /*
249  * sk_callback_lock locking rules are per-address-family,
250  * so split the lock classes by using a per-AF key:
251  */
252 static struct lock_class_key af_callback_keys[AF_MAX];
253 
254 /* Take into consideration the size of the struct sk_buff overhead in the
255  * determination of these values, since that is non-constant across
256  * platforms.  This makes socket queueing behavior and performance
257  * not depend upon such differences.
258  */
259 #define _SK_MEM_PACKETS		256
260 #define _SK_MEM_OVERHEAD	SKB_TRUESIZE(256)
261 #define SK_WMEM_MAX		(_SK_MEM_OVERHEAD * _SK_MEM_PACKETS)
262 #define SK_RMEM_MAX		(_SK_MEM_OVERHEAD * _SK_MEM_PACKETS)
263 
264 /* Run time adjustable parameters. */
265 __u32 sysctl_wmem_max __read_mostly = SK_WMEM_MAX;
266 EXPORT_SYMBOL(sysctl_wmem_max);
267 __u32 sysctl_rmem_max __read_mostly = SK_RMEM_MAX;
268 EXPORT_SYMBOL(sysctl_rmem_max);
269 __u32 sysctl_wmem_default __read_mostly = SK_WMEM_MAX;
270 __u32 sysctl_rmem_default __read_mostly = SK_RMEM_MAX;
271 
272 /* Maximal space eaten by iovec or ancillary data plus some space */
273 int sysctl_optmem_max __read_mostly = sizeof(unsigned long)*(2*UIO_MAXIOV+512);
274 EXPORT_SYMBOL(sysctl_optmem_max);
275 
276 struct static_key memalloc_socks = STATIC_KEY_INIT_FALSE;
277 EXPORT_SYMBOL_GPL(memalloc_socks);
278 
279 /**
280  * sk_set_memalloc - sets %SOCK_MEMALLOC
281  * @sk: socket to set it on
282  *
283  * Set %SOCK_MEMALLOC on a socket for access to emergency reserves.
284  * It's the responsibility of the admin to adjust min_free_kbytes
285  * to meet the requirements
286  */
287 void sk_set_memalloc(struct sock *sk)
288 {
289 	sock_set_flag(sk, SOCK_MEMALLOC);
290 	sk->sk_allocation |= __GFP_MEMALLOC;
291 	static_key_slow_inc(&memalloc_socks);
292 }
293 EXPORT_SYMBOL_GPL(sk_set_memalloc);
294 
295 void sk_clear_memalloc(struct sock *sk)
296 {
297 	sock_reset_flag(sk, SOCK_MEMALLOC);
298 	sk->sk_allocation &= ~__GFP_MEMALLOC;
299 	static_key_slow_dec(&memalloc_socks);
300 
301 	/*
302 	 * SOCK_MEMALLOC is allowed to ignore rmem limits to ensure forward
303 	 * progress of swapping. However, if SOCK_MEMALLOC is cleared while
304 	 * it has rmem allocations there is a risk that the user of the
305 	 * socket cannot make forward progress due to exceeding the rmem
306 	 * limits. By rights, sk_clear_memalloc() should only be called
307 	 * on sockets being torn down but warn and reset the accounting if
308 	 * that assumption breaks.
309 	 */
310 	if (WARN_ON(sk->sk_forward_alloc))
311 		sk_mem_reclaim(sk);
312 }
313 EXPORT_SYMBOL_GPL(sk_clear_memalloc);
314 
315 int __sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
316 {
317 	int ret;
318 	unsigned long pflags = current->flags;
319 
320 	/* these should have been dropped before queueing */
321 	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));
322 
323 	current->flags |= PF_MEMALLOC;
324 	ret = sk->sk_backlog_rcv(sk, skb);
325 	tsk_restore_flags(current, pflags, PF_MEMALLOC);
326 
327 	return ret;
328 }
329 EXPORT_SYMBOL(__sk_backlog_rcv);
330 
331 static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen)
332 {
333 	struct timeval tv;
334 
335 	if (optlen < sizeof(tv))
336 		return -EINVAL;
337 	if (copy_from_user(&tv, optval, sizeof(tv)))
338 		return -EFAULT;
339 	if (tv.tv_usec < 0 || tv.tv_usec >= USEC_PER_SEC)
340 		return -EDOM;
341 
342 	if (tv.tv_sec < 0) {
343 		static int warned __read_mostly;
344 
345 		*timeo_p = 0;
346 		if (warned < 10 && net_ratelimit()) {
347 			warned++;
348 			pr_info("%s: `%s' (pid %d) tries to set negative timeout\n",
349 				__func__, current->comm, task_pid_nr(current));
350 		}
351 		return 0;
352 	}
353 	*timeo_p = MAX_SCHEDULE_TIMEOUT;
354 	if (tv.tv_sec == 0 && tv.tv_usec == 0)
355 		return 0;
356 	if (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT/HZ - 1))
357 		*timeo_p = tv.tv_sec*HZ + (tv.tv_usec+(1000000/HZ-1))/(1000000/HZ);
358 	return 0;
359 }
360 
361 static void sock_warn_obsolete_bsdism(const char *name)
362 {
363 	static int warned;
364 	static char warncomm[TASK_COMM_LEN];
365 	if (strcmp(warncomm, current->comm) && warned < 5) {
366 		strcpy(warncomm,  current->comm);
367 		pr_warn("process `%s' is using obsolete %s SO_BSDCOMPAT\n",
368 			warncomm, name);
369 		warned++;
370 	}
371 }
372 
373 #define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
374 
375 static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
376 {
377 	if (sk->sk_flags & flags) {
378 		sk->sk_flags &= ~flags;
379 		if (!(sk->sk_flags & SK_FLAGS_TIMESTAMP))
380 			net_disable_timestamp();
381 	}
382 }
383 
384 
385 int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
386 {
387 	int err;
388 	int skb_len;
389 	unsigned long flags;
390 	struct sk_buff_head *list = &sk->sk_receive_queue;
391 
392 	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
393 		atomic_inc(&sk->sk_drops);
394 		trace_sock_rcvqueue_full(sk, skb);
395 		return -ENOMEM;
396 	}
397 
398 	err = sk_filter(sk, skb);
399 	if (err)
400 		return err;
401 
402 	if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
403 		atomic_inc(&sk->sk_drops);
404 		return -ENOBUFS;
405 	}
406 
407 	skb->dev = NULL;
408 	skb_set_owner_r(skb, sk);
409 
410 	/* Cache the SKB length before we tack it onto the receive
411 	 * queue.  Once it is added it no longer belongs to us and
412 	 * may be freed by other threads of control pulling packets
413 	 * from the queue.
414 	 */
415 	skb_len = skb->len;
416 
417 	/* we escape from rcu protected region, make sure we dont leak
418 	 * a norefcounted dst
419 	 */
420 	skb_dst_force(skb);
421 
422 	spin_lock_irqsave(&list->lock, flags);
423 	skb->dropcount = atomic_read(&sk->sk_drops);
424 	__skb_queue_tail(list, skb);
425 	spin_unlock_irqrestore(&list->lock, flags);
426 
427 	if (!sock_flag(sk, SOCK_DEAD))
428 		sk->sk_data_ready(sk, skb_len);
429 	return 0;
430 }
431 EXPORT_SYMBOL(sock_queue_rcv_skb);
432 
433 int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
434 {
435 	int rc = NET_RX_SUCCESS;
436 
437 	if (sk_filter(sk, skb))
438 		goto discard_and_relse;
439 
440 	skb->dev = NULL;
441 
442 	if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) {
443 		atomic_inc(&sk->sk_drops);
444 		goto discard_and_relse;
445 	}
446 	if (nested)
447 		bh_lock_sock_nested(sk);
448 	else
449 		bh_lock_sock(sk);
450 	if (!sock_owned_by_user(sk)) {
451 		/*
452 		 * trylock + unlock semantics:
453 		 */
454 		mutex_acquire(&sk->sk_lock.dep_map, 0, 1, _RET_IP_);
455 
456 		rc = sk_backlog_rcv(sk, skb);
457 
458 		mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
459 	} else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
460 		bh_unlock_sock(sk);
461 		atomic_inc(&sk->sk_drops);
462 		goto discard_and_relse;
463 	}
464 
465 	bh_unlock_sock(sk);
466 out:
467 	sock_put(sk);
468 	return rc;
469 discard_and_relse:
470 	kfree_skb(skb);
471 	goto out;
472 }
473 EXPORT_SYMBOL(sk_receive_skb);
474 
475 void sk_reset_txq(struct sock *sk)
476 {
477 	sk_tx_queue_clear(sk);
478 }
479 EXPORT_SYMBOL(sk_reset_txq);
480 
481 struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
482 {
483 	struct dst_entry *dst = __sk_dst_get(sk);
484 
485 	if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
486 		sk_tx_queue_clear(sk);
487 		RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
488 		dst_release(dst);
489 		return NULL;
490 	}
491 
492 	return dst;
493 }
494 EXPORT_SYMBOL(__sk_dst_check);
495 
496 struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie)
497 {
498 	struct dst_entry *dst = sk_dst_get(sk);
499 
500 	if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
501 		sk_dst_reset(sk);
502 		dst_release(dst);
503 		return NULL;
504 	}
505 
506 	return dst;
507 }
508 EXPORT_SYMBOL(sk_dst_check);
509 
510 static int sock_setbindtodevice(struct sock *sk, char __user *optval,
511 				int optlen)
512 {
513 	int ret = -ENOPROTOOPT;
514 #ifdef CONFIG_NETDEVICES
515 	struct net *net = sock_net(sk);
516 	char devname[IFNAMSIZ];
517 	int index;
518 
519 	/* Sorry... */
520 	ret = -EPERM;
521 	if (!ns_capable(net->user_ns, CAP_NET_RAW))
522 		goto out;
523 
524 	ret = -EINVAL;
525 	if (optlen < 0)
526 		goto out;
527 
528 	/* Bind this socket to a particular device like "eth0",
529 	 * as specified in the passed interface name. If the
530 	 * name is "" or the option length is zero the socket
531 	 * is not bound.
532 	 */
533 	if (optlen > IFNAMSIZ - 1)
534 		optlen = IFNAMSIZ - 1;
535 	memset(devname, 0, sizeof(devname));
536 
537 	ret = -EFAULT;
538 	if (copy_from_user(devname, optval, optlen))
539 		goto out;
540 
541 	index = 0;
542 	if (devname[0] != '\0') {
543 		struct net_device *dev;
544 
545 		rcu_read_lock();
546 		dev = dev_get_by_name_rcu(net, devname);
547 		if (dev)
548 			index = dev->ifindex;
549 		rcu_read_unlock();
550 		ret = -ENODEV;
551 		if (!dev)
552 			goto out;
553 	}
554 
555 	lock_sock(sk);
556 	sk->sk_bound_dev_if = index;
557 	sk_dst_reset(sk);
558 	release_sock(sk);
559 
560 	ret = 0;
561 
562 out:
563 #endif
564 
565 	return ret;
566 }
567 
568 static int sock_getbindtodevice(struct sock *sk, char __user *optval,
569 				int __user *optlen, int len)
570 {
571 	int ret = -ENOPROTOOPT;
572 #ifdef CONFIG_NETDEVICES
573 	struct net *net = sock_net(sk);
574 	struct net_device *dev;
575 	char devname[IFNAMSIZ];
576 	unsigned seq;
577 
578 	if (sk->sk_bound_dev_if == 0) {
579 		len = 0;
580 		goto zero;
581 	}
582 
583 	ret = -EINVAL;
584 	if (len < IFNAMSIZ)
585 		goto out;
586 
587 retry:
588 	seq = read_seqcount_begin(&devnet_rename_seq);
589 	rcu_read_lock();
590 	dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
591 	ret = -ENODEV;
592 	if (!dev) {
593 		rcu_read_unlock();
594 		goto out;
595 	}
596 
597 	strcpy(devname, dev->name);
598 	rcu_read_unlock();
599 	if (read_seqcount_retry(&devnet_rename_seq, seq))
600 		goto retry;
601 
602 	len = strlen(devname) + 1;
603 
604 	ret = -EFAULT;
605 	if (copy_to_user(optval, devname, len))
606 		goto out;
607 
608 zero:
609 	ret = -EFAULT;
610 	if (put_user(len, optlen))
611 		goto out;
612 
613 	ret = 0;
614 
615 out:
616 #endif
617 
618 	return ret;
619 }
620 
621 static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
622 {
623 	if (valbool)
624 		sock_set_flag(sk, bit);
625 	else
626 		sock_reset_flag(sk, bit);
627 }
628 
629 /*
630  *	This is meant for all protocols to use and covers goings on
631  *	at the socket level. Everything here is generic.
632  */
633 
634 int sock_setsockopt(struct socket *sock, int level, int optname,
635 		    char __user *optval, unsigned int optlen)
636 {
637 	struct sock *sk = sock->sk;
638 	int val;
639 	int valbool;
640 	struct linger ling;
641 	int ret = 0;
642 
643 	/*
644 	 *	Options without arguments
645 	 */
646 
647 	if (optname == SO_BINDTODEVICE)
648 		return sock_setbindtodevice(sk, optval, optlen);
649 
650 	if (optlen < sizeof(int))
651 		return -EINVAL;
652 
653 	if (get_user(val, (int __user *)optval))
654 		return -EFAULT;
655 
656 	valbool = val ? 1 : 0;
657 
658 	lock_sock(sk);
659 
660 	switch (optname) {
661 	case SO_DEBUG:
662 		if (val && !capable(CAP_NET_ADMIN))
663 			ret = -EACCES;
664 		else
665 			sock_valbool_flag(sk, SOCK_DBG, valbool);
666 		break;
667 	case SO_REUSEADDR:
668 		sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
669 		break;
670 	case SO_REUSEPORT:
671 		sk->sk_reuseport = valbool;
672 		break;
673 	case SO_TYPE:
674 	case SO_PROTOCOL:
675 	case SO_DOMAIN:
676 	case SO_ERROR:
677 		ret = -ENOPROTOOPT;
678 		break;
679 	case SO_DONTROUTE:
680 		sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);
681 		break;
682 	case SO_BROADCAST:
683 		sock_valbool_flag(sk, SOCK_BROADCAST, valbool);
684 		break;
685 	case SO_SNDBUF:
686 		/* Don't error on this BSD doesn't and if you think
687 		 * about it this is right. Otherwise apps have to
688 		 * play 'guess the biggest size' games. RCVBUF/SNDBUF
689 		 * are treated in BSD as hints
690 		 */
691 		val = min_t(u32, val, sysctl_wmem_max);
692 set_sndbuf:
693 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
694 		sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
695 		/* Wake up sending tasks if we upped the value. */
696 		sk->sk_write_space(sk);
697 		break;
698 
699 	case SO_SNDBUFFORCE:
700 		if (!capable(CAP_NET_ADMIN)) {
701 			ret = -EPERM;
702 			break;
703 		}
704 		goto set_sndbuf;
705 
706 	case SO_RCVBUF:
707 		/* Don't error on this BSD doesn't and if you think
708 		 * about it this is right. Otherwise apps have to
709 		 * play 'guess the biggest size' games. RCVBUF/SNDBUF
710 		 * are treated in BSD as hints
711 		 */
712 		val = min_t(u32, val, sysctl_rmem_max);
713 set_rcvbuf:
714 		sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
715 		/*
716 		 * We double it on the way in to account for
717 		 * "struct sk_buff" etc. overhead.   Applications
718 		 * assume that the SO_RCVBUF setting they make will
719 		 * allow that much actual data to be received on that
720 		 * socket.
721 		 *
722 		 * Applications are unaware that "struct sk_buff" and
723 		 * other overheads allocate from the receive buffer
724 		 * during socket buffer allocation.
725 		 *
726 		 * And after considering the possible alternatives,
727 		 * returning the value we actually used in getsockopt
728 		 * is the most desirable behavior.
729 		 */
730 		sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
731 		break;
732 
733 	case SO_RCVBUFFORCE:
734 		if (!capable(CAP_NET_ADMIN)) {
735 			ret = -EPERM;
736 			break;
737 		}
738 		goto set_rcvbuf;
739 
740 	case SO_KEEPALIVE:
741 #ifdef CONFIG_INET
742 		if (sk->sk_protocol == IPPROTO_TCP &&
743 		    sk->sk_type == SOCK_STREAM)
744 			tcp_set_keepalive(sk, valbool);
745 #endif
746 		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
747 		break;
748 
749 	case SO_OOBINLINE:
750 		sock_valbool_flag(sk, SOCK_URGINLINE, valbool);
751 		break;
752 
753 	case SO_NO_CHECK:
754 		sk->sk_no_check = valbool;
755 		break;
756 
757 	case SO_PRIORITY:
758 		if ((val >= 0 && val <= 6) ||
759 		    ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
760 			sk->sk_priority = val;
761 		else
762 			ret = -EPERM;
763 		break;
764 
765 	case SO_LINGER:
766 		if (optlen < sizeof(ling)) {
767 			ret = -EINVAL;	/* 1003.1g */
768 			break;
769 		}
770 		if (copy_from_user(&ling, optval, sizeof(ling))) {
771 			ret = -EFAULT;
772 			break;
773 		}
774 		if (!ling.l_onoff)
775 			sock_reset_flag(sk, SOCK_LINGER);
776 		else {
777 #if (BITS_PER_LONG == 32)
778 			if ((unsigned int)ling.l_linger >= MAX_SCHEDULE_TIMEOUT/HZ)
779 				sk->sk_lingertime = MAX_SCHEDULE_TIMEOUT;
780 			else
781 #endif
782 				sk->sk_lingertime = (unsigned int)ling.l_linger * HZ;
783 			sock_set_flag(sk, SOCK_LINGER);
784 		}
785 		break;
786 
787 	case SO_BSDCOMPAT:
788 		sock_warn_obsolete_bsdism("setsockopt");
789 		break;
790 
791 	case SO_PASSCRED:
792 		if (valbool)
793 			set_bit(SOCK_PASSCRED, &sock->flags);
794 		else
795 			clear_bit(SOCK_PASSCRED, &sock->flags);
796 		break;
797 
798 	case SO_TIMESTAMP:
799 	case SO_TIMESTAMPNS:
800 		if (valbool)  {
801 			if (optname == SO_TIMESTAMP)
802 				sock_reset_flag(sk, SOCK_RCVTSTAMPNS);
803 			else
804 				sock_set_flag(sk, SOCK_RCVTSTAMPNS);
805 			sock_set_flag(sk, SOCK_RCVTSTAMP);
806 			sock_enable_timestamp(sk, SOCK_TIMESTAMP);
807 		} else {
808 			sock_reset_flag(sk, SOCK_RCVTSTAMP);
809 			sock_reset_flag(sk, SOCK_RCVTSTAMPNS);
810 		}
811 		break;
812 
813 	case SO_TIMESTAMPING:
814 		if (val & ~SOF_TIMESTAMPING_MASK) {
815 			ret = -EINVAL;
816 			break;
817 		}
818 		sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE,
819 				  val & SOF_TIMESTAMPING_TX_HARDWARE);
820 		sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE,
821 				  val & SOF_TIMESTAMPING_TX_SOFTWARE);
822 		sock_valbool_flag(sk, SOCK_TIMESTAMPING_RX_HARDWARE,
823 				  val & SOF_TIMESTAMPING_RX_HARDWARE);
824 		if (val & SOF_TIMESTAMPING_RX_SOFTWARE)
825 			sock_enable_timestamp(sk,
826 					      SOCK_TIMESTAMPING_RX_SOFTWARE);
827 		else
828 			sock_disable_timestamp(sk,
829 					       (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE));
830 		sock_valbool_flag(sk, SOCK_TIMESTAMPING_SOFTWARE,
831 				  val & SOF_TIMESTAMPING_SOFTWARE);
832 		sock_valbool_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE,
833 				  val & SOF_TIMESTAMPING_SYS_HARDWARE);
834 		sock_valbool_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE,
835 				  val & SOF_TIMESTAMPING_RAW_HARDWARE);
836 		break;
837 
838 	case SO_RCVLOWAT:
839 		if (val < 0)
840 			val = INT_MAX;
841 		sk->sk_rcvlowat = val ? : 1;
842 		break;
843 
844 	case SO_RCVTIMEO:
845 		ret = sock_set_timeout(&sk->sk_rcvtimeo, optval, optlen);
846 		break;
847 
848 	case SO_SNDTIMEO:
849 		ret = sock_set_timeout(&sk->sk_sndtimeo, optval, optlen);
850 		break;
851 
852 	case SO_ATTACH_FILTER:
853 		ret = -EINVAL;
854 		if (optlen == sizeof(struct sock_fprog)) {
855 			struct sock_fprog fprog;
856 
857 			ret = -EFAULT;
858 			if (copy_from_user(&fprog, optval, sizeof(fprog)))
859 				break;
860 
861 			ret = sk_attach_filter(&fprog, sk);
862 		}
863 		break;
864 
865 	case SO_DETACH_FILTER:
866 		ret = sk_detach_filter(sk);
867 		break;
868 
869 	case SO_LOCK_FILTER:
870 		if (sock_flag(sk, SOCK_FILTER_LOCKED) && !valbool)
871 			ret = -EPERM;
872 		else
873 			sock_valbool_flag(sk, SOCK_FILTER_LOCKED, valbool);
874 		break;
875 
876 	case SO_PASSSEC:
877 		if (valbool)
878 			set_bit(SOCK_PASSSEC, &sock->flags);
879 		else
880 			clear_bit(SOCK_PASSSEC, &sock->flags);
881 		break;
882 	case SO_MARK:
883 		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
884 			ret = -EPERM;
885 		else
886 			sk->sk_mark = val;
887 		break;
888 
889 		/* We implement the SO_SNDLOWAT etc to
890 		   not be settable (1003.1g 5.3) */
891 	case SO_RXQ_OVFL:
892 		sock_valbool_flag(sk, SOCK_RXQ_OVFL, valbool);
893 		break;
894 
895 	case SO_WIFI_STATUS:
896 		sock_valbool_flag(sk, SOCK_WIFI_STATUS, valbool);
897 		break;
898 
899 	case SO_PEEK_OFF:
900 		if (sock->ops->set_peek_off)
901 			sock->ops->set_peek_off(sk, val);
902 		else
903 			ret = -EOPNOTSUPP;
904 		break;
905 
906 	case SO_NOFCS:
907 		sock_valbool_flag(sk, SOCK_NOFCS, valbool);
908 		break;
909 
910 	default:
911 		ret = -ENOPROTOOPT;
912 		break;
913 	}
914 	release_sock(sk);
915 	return ret;
916 }
917 EXPORT_SYMBOL(sock_setsockopt);
918 
919 
920 void cred_to_ucred(struct pid *pid, const struct cred *cred,
921 		   struct ucred *ucred)
922 {
923 	ucred->pid = pid_vnr(pid);
924 	ucred->uid = ucred->gid = -1;
925 	if (cred) {
926 		struct user_namespace *current_ns = current_user_ns();
927 
928 		ucred->uid = from_kuid_munged(current_ns, cred->euid);
929 		ucred->gid = from_kgid_munged(current_ns, cred->egid);
930 	}
931 }
932 EXPORT_SYMBOL_GPL(cred_to_ucred);
933 
934 int sock_getsockopt(struct socket *sock, int level, int optname,
935 		    char __user *optval, int __user *optlen)
936 {
937 	struct sock *sk = sock->sk;
938 
939 	union {
940 		int val;
941 		struct linger ling;
942 		struct timeval tm;
943 	} v;
944 
945 	int lv = sizeof(int);
946 	int len;
947 
948 	if (get_user(len, optlen))
949 		return -EFAULT;
950 	if (len < 0)
951 		return -EINVAL;
952 
953 	memset(&v, 0, sizeof(v));
954 
955 	switch (optname) {
956 	case SO_DEBUG:
957 		v.val = sock_flag(sk, SOCK_DBG);
958 		break;
959 
960 	case SO_DONTROUTE:
961 		v.val = sock_flag(sk, SOCK_LOCALROUTE);
962 		break;
963 
964 	case SO_BROADCAST:
965 		v.val = sock_flag(sk, SOCK_BROADCAST);
966 		break;
967 
968 	case SO_SNDBUF:
969 		v.val = sk->sk_sndbuf;
970 		break;
971 
972 	case SO_RCVBUF:
973 		v.val = sk->sk_rcvbuf;
974 		break;
975 
976 	case SO_REUSEADDR:
977 		v.val = sk->sk_reuse;
978 		break;
979 
980 	case SO_REUSEPORT:
981 		v.val = sk->sk_reuseport;
982 		break;
983 
984 	case SO_KEEPALIVE:
985 		v.val = sock_flag(sk, SOCK_KEEPOPEN);
986 		break;
987 
988 	case SO_TYPE:
989 		v.val = sk->sk_type;
990 		break;
991 
992 	case SO_PROTOCOL:
993 		v.val = sk->sk_protocol;
994 		break;
995 
996 	case SO_DOMAIN:
997 		v.val = sk->sk_family;
998 		break;
999 
1000 	case SO_ERROR:
1001 		v.val = -sock_error(sk);
1002 		if (v.val == 0)
1003 			v.val = xchg(&sk->sk_err_soft, 0);
1004 		break;
1005 
1006 	case SO_OOBINLINE:
1007 		v.val = sock_flag(sk, SOCK_URGINLINE);
1008 		break;
1009 
1010 	case SO_NO_CHECK:
1011 		v.val = sk->sk_no_check;
1012 		break;
1013 
1014 	case SO_PRIORITY:
1015 		v.val = sk->sk_priority;
1016 		break;
1017 
1018 	case SO_LINGER:
1019 		lv		= sizeof(v.ling);
1020 		v.ling.l_onoff	= sock_flag(sk, SOCK_LINGER);
1021 		v.ling.l_linger	= sk->sk_lingertime / HZ;
1022 		break;
1023 
1024 	case SO_BSDCOMPAT:
1025 		sock_warn_obsolete_bsdism("getsockopt");
1026 		break;
1027 
1028 	case SO_TIMESTAMP:
1029 		v.val = sock_flag(sk, SOCK_RCVTSTAMP) &&
1030 				!sock_flag(sk, SOCK_RCVTSTAMPNS);
1031 		break;
1032 
1033 	case SO_TIMESTAMPNS:
1034 		v.val = sock_flag(sk, SOCK_RCVTSTAMPNS);
1035 		break;
1036 
1037 	case SO_TIMESTAMPING:
1038 		v.val = 0;
1039 		if (sock_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE))
1040 			v.val |= SOF_TIMESTAMPING_TX_HARDWARE;
1041 		if (sock_flag(sk, SOCK_TIMESTAMPING_TX_SOFTWARE))
1042 			v.val |= SOF_TIMESTAMPING_TX_SOFTWARE;
1043 		if (sock_flag(sk, SOCK_TIMESTAMPING_RX_HARDWARE))
1044 			v.val |= SOF_TIMESTAMPING_RX_HARDWARE;
1045 		if (sock_flag(sk, SOCK_TIMESTAMPING_RX_SOFTWARE))
1046 			v.val |= SOF_TIMESTAMPING_RX_SOFTWARE;
1047 		if (sock_flag(sk, SOCK_TIMESTAMPING_SOFTWARE))
1048 			v.val |= SOF_TIMESTAMPING_SOFTWARE;
1049 		if (sock_flag(sk, SOCK_TIMESTAMPING_SYS_HARDWARE))
1050 			v.val |= SOF_TIMESTAMPING_SYS_HARDWARE;
1051 		if (sock_flag(sk, SOCK_TIMESTAMPING_RAW_HARDWARE))
1052 			v.val |= SOF_TIMESTAMPING_RAW_HARDWARE;
1053 		break;
1054 
1055 	case SO_RCVTIMEO:
1056 		lv = sizeof(struct timeval);
1057 		if (sk->sk_rcvtimeo == MAX_SCHEDULE_TIMEOUT) {
1058 			v.tm.tv_sec = 0;
1059 			v.tm.tv_usec = 0;
1060 		} else {
1061 			v.tm.tv_sec = sk->sk_rcvtimeo / HZ;
1062 			v.tm.tv_usec = ((sk->sk_rcvtimeo % HZ) * 1000000) / HZ;
1063 		}
1064 		break;
1065 
1066 	case SO_SNDTIMEO:
1067 		lv = sizeof(struct timeval);
1068 		if (sk->sk_sndtimeo == MAX_SCHEDULE_TIMEOUT) {
1069 			v.tm.tv_sec = 0;
1070 			v.tm.tv_usec = 0;
1071 		} else {
1072 			v.tm.tv_sec = sk->sk_sndtimeo / HZ;
1073 			v.tm.tv_usec = ((sk->sk_sndtimeo % HZ) * 1000000) / HZ;
1074 		}
1075 		break;
1076 
1077 	case SO_RCVLOWAT:
1078 		v.val = sk->sk_rcvlowat;
1079 		break;
1080 
1081 	case SO_SNDLOWAT:
1082 		v.val = 1;
1083 		break;
1084 
1085 	case SO_PASSCRED:
1086 		v.val = !!test_bit(SOCK_PASSCRED, &sock->flags);
1087 		break;
1088 
1089 	case SO_PEERCRED:
1090 	{
1091 		struct ucred peercred;
1092 		if (len > sizeof(peercred))
1093 			len = sizeof(peercred);
1094 		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
1095 		if (copy_to_user(optval, &peercred, len))
1096 			return -EFAULT;
1097 		goto lenout;
1098 	}
1099 
1100 	case SO_PEERNAME:
1101 	{
1102 		char address[128];
1103 
1104 		if (sock->ops->getname(sock, (struct sockaddr *)address, &lv, 2))
1105 			return -ENOTCONN;
1106 		if (lv < len)
1107 			return -EINVAL;
1108 		if (copy_to_user(optval, address, len))
1109 			return -EFAULT;
1110 		goto lenout;
1111 	}
1112 
1113 	/* Dubious BSD thing... Probably nobody even uses it, but
1114 	 * the UNIX standard wants it for whatever reason... -DaveM
1115 	 */
1116 	case SO_ACCEPTCONN:
1117 		v.val = sk->sk_state == TCP_LISTEN;
1118 		break;
1119 
1120 	case SO_PASSSEC:
1121 		v.val = !!test_bit(SOCK_PASSSEC, &sock->flags);
1122 		break;
1123 
1124 	case SO_PEERSEC:
1125 		return security_socket_getpeersec_stream(sock, optval, optlen, len);
1126 
1127 	case SO_MARK:
1128 		v.val = sk->sk_mark;
1129 		break;
1130 
1131 	case SO_RXQ_OVFL:
1132 		v.val = sock_flag(sk, SOCK_RXQ_OVFL);
1133 		break;
1134 
1135 	case SO_WIFI_STATUS:
1136 		v.val = sock_flag(sk, SOCK_WIFI_STATUS);
1137 		break;
1138 
1139 	case SO_PEEK_OFF:
1140 		if (!sock->ops->set_peek_off)
1141 			return -EOPNOTSUPP;
1142 
1143 		v.val = sk->sk_peek_off;
1144 		break;
1145 	case SO_NOFCS:
1146 		v.val = sock_flag(sk, SOCK_NOFCS);
1147 		break;
1148 
1149 	case SO_BINDTODEVICE:
1150 		return sock_getbindtodevice(sk, optval, optlen, len);
1151 
1152 	case SO_GET_FILTER:
1153 		len = sk_get_filter(sk, (struct sock_filter __user *)optval, len);
1154 		if (len < 0)
1155 			return len;
1156 
1157 		goto lenout;
1158 
1159 	case SO_LOCK_FILTER:
1160 		v.val = sock_flag(sk, SOCK_FILTER_LOCKED);
1161 		break;
1162 
1163 	default:
1164 		return -ENOPROTOOPT;
1165 	}
1166 
1167 	if (len > lv)
1168 		len = lv;
1169 	if (copy_to_user(optval, &v, len))
1170 		return -EFAULT;
1171 lenout:
1172 	if (put_user(len, optlen))
1173 		return -EFAULT;
1174 	return 0;
1175 }
1176 
1177 /*
1178  * Initialize an sk_lock.
1179  *
1180  * (We also register the sk_lock with the lock validator.)
1181  */
1182 static inline void sock_lock_init(struct sock *sk)
1183 {
1184 	sock_lock_init_class_and_name(sk,
1185 			af_family_slock_key_strings[sk->sk_family],
1186 			af_family_slock_keys + sk->sk_family,
1187 			af_family_key_strings[sk->sk_family],
1188 			af_family_keys + sk->sk_family);
1189 }
1190 
1191 /*
1192  * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
1193  * even temporarly, because of RCU lookups. sk_node should also be left as is.
1194  * We must not copy fields between sk_dontcopy_begin and sk_dontcopy_end
1195  */
1196 static void sock_copy(struct sock *nsk, const struct sock *osk)
1197 {
1198 #ifdef CONFIG_SECURITY_NETWORK
1199 	void *sptr = nsk->sk_security;
1200 #endif
1201 	memcpy(nsk, osk, offsetof(struct sock, sk_dontcopy_begin));
1202 
1203 	memcpy(&nsk->sk_dontcopy_end, &osk->sk_dontcopy_end,
1204 	       osk->sk_prot->obj_size - offsetof(struct sock, sk_dontcopy_end));
1205 
1206 #ifdef CONFIG_SECURITY_NETWORK
1207 	nsk->sk_security = sptr;
1208 	security_sk_clone(osk, nsk);
1209 #endif
1210 }
1211 
1212 /*
1213  * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
1214  * un-modified. Special care is taken when initializing object to zero.
1215  */
1216 static inline void sk_prot_clear_nulls(struct sock *sk, int size)
1217 {
1218 	if (offsetof(struct sock, sk_node.next) != 0)
1219 		memset(sk, 0, offsetof(struct sock, sk_node.next));
1220 	memset(&sk->sk_node.pprev, 0,
1221 	       size - offsetof(struct sock, sk_node.pprev));
1222 }
1223 
1224 void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)
1225 {
1226 	unsigned long nulls1, nulls2;
1227 
1228 	nulls1 = offsetof(struct sock, __sk_common.skc_node.next);
1229 	nulls2 = offsetof(struct sock, __sk_common.skc_portaddr_node.next);
1230 	if (nulls1 > nulls2)
1231 		swap(nulls1, nulls2);
1232 
1233 	if (nulls1 != 0)
1234 		memset((char *)sk, 0, nulls1);
1235 	memset((char *)sk + nulls1 + sizeof(void *), 0,
1236 	       nulls2 - nulls1 - sizeof(void *));
1237 	memset((char *)sk + nulls2 + sizeof(void *), 0,
1238 	       size - nulls2 - sizeof(void *));
1239 }
1240 EXPORT_SYMBOL(sk_prot_clear_portaddr_nulls);
1241 
1242 static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
1243 		int family)
1244 {
1245 	struct sock *sk;
1246 	struct kmem_cache *slab;
1247 
1248 	slab = prot->slab;
1249 	if (slab != NULL) {
1250 		sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
1251 		if (!sk)
1252 			return sk;
1253 		if (priority & __GFP_ZERO) {
1254 			if (prot->clear_sk)
1255 				prot->clear_sk(sk, prot->obj_size);
1256 			else
1257 				sk_prot_clear_nulls(sk, prot->obj_size);
1258 		}
1259 	} else
1260 		sk = kmalloc(prot->obj_size, priority);
1261 
1262 	if (sk != NULL) {
1263 		kmemcheck_annotate_bitfield(sk, flags);
1264 
1265 		if (security_sk_alloc(sk, family, priority))
1266 			goto out_free;
1267 
1268 		if (!try_module_get(prot->owner))
1269 			goto out_free_sec;
1270 		sk_tx_queue_clear(sk);
1271 	}
1272 
1273 	return sk;
1274 
1275 out_free_sec:
1276 	security_sk_free(sk);
1277 out_free:
1278 	if (slab != NULL)
1279 		kmem_cache_free(slab, sk);
1280 	else
1281 		kfree(sk);
1282 	return NULL;
1283 }
1284 
1285 static void sk_prot_free(struct proto *prot, struct sock *sk)
1286 {
1287 	struct kmem_cache *slab;
1288 	struct module *owner;
1289 
1290 	owner = prot->owner;
1291 	slab = prot->slab;
1292 
1293 	security_sk_free(sk);
1294 	if (slab != NULL)
1295 		kmem_cache_free(slab, sk);
1296 	else
1297 		kfree(sk);
1298 	module_put(owner);
1299 }
1300 
1301 #ifdef CONFIG_CGROUPS
1302 #if IS_ENABLED(CONFIG_NET_CLS_CGROUP)
1303 void sock_update_classid(struct sock *sk, struct task_struct *task)
1304 {
1305 	u32 classid;
1306 
1307 	classid = task_cls_classid(task);
1308 	if (classid != sk->sk_classid)
1309 		sk->sk_classid = classid;
1310 }
1311 EXPORT_SYMBOL(sock_update_classid);
1312 #endif
1313 
1314 #if IS_ENABLED(CONFIG_NETPRIO_CGROUP)
1315 void sock_update_netprioidx(struct sock *sk, struct task_struct *task)
1316 {
1317 	if (in_interrupt())
1318 		return;
1319 
1320 	sk->sk_cgrp_prioidx = task_netprioidx(task);
1321 }
1322 EXPORT_SYMBOL_GPL(sock_update_netprioidx);
1323 #endif
1324 #endif
1325 
1326 /**
1327  *	sk_alloc - All socket objects are allocated here
1328  *	@net: the applicable net namespace
1329  *	@family: protocol family
1330  *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
1331  *	@prot: struct proto associated with this new sock instance
1332  */
1333 struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
1334 		      struct proto *prot)
1335 {
1336 	struct sock *sk;
1337 
1338 	sk = sk_prot_alloc(prot, priority | __GFP_ZERO, family);
1339 	if (sk) {
1340 		sk->sk_family = family;
1341 		/*
1342 		 * See comment in struct sock definition to understand
1343 		 * why we need sk_prot_creator -acme
1344 		 */
1345 		sk->sk_prot = sk->sk_prot_creator = prot;
1346 		sock_lock_init(sk);
1347 		sock_net_set(sk, get_net(net));
1348 		atomic_set(&sk->sk_wmem_alloc, 1);
1349 
1350 		sock_update_classid(sk, current);
1351 		sock_update_netprioidx(sk, current);
1352 	}
1353 
1354 	return sk;
1355 }
1356 EXPORT_SYMBOL(sk_alloc);
1357 
1358 static void __sk_free(struct sock *sk)
1359 {
1360 	struct sk_filter *filter;
1361 
1362 	if (sk->sk_destruct)
1363 		sk->sk_destruct(sk);
1364 
1365 	filter = rcu_dereference_check(sk->sk_filter,
1366 				       atomic_read(&sk->sk_wmem_alloc) == 0);
1367 	if (filter) {
1368 		sk_filter_uncharge(sk, filter);
1369 		RCU_INIT_POINTER(sk->sk_filter, NULL);
1370 	}
1371 
1372 	sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
1373 
1374 	if (atomic_read(&sk->sk_omem_alloc))
1375 		pr_debug("%s: optmem leakage (%d bytes) detected\n",
1376 			 __func__, atomic_read(&sk->sk_omem_alloc));
1377 
1378 	if (sk->sk_peer_cred)
1379 		put_cred(sk->sk_peer_cred);
1380 	put_pid(sk->sk_peer_pid);
1381 	put_net(sock_net(sk));
1382 	sk_prot_free(sk->sk_prot_creator, sk);
1383 }
1384 
1385 void sk_free(struct sock *sk)
1386 {
1387 	/*
1388 	 * We subtract one from sk_wmem_alloc and can know if
1389 	 * some packets are still in some tx queue.
1390 	 * If not null, sock_wfree() will call __sk_free(sk) later
1391 	 */
1392 	if (atomic_dec_and_test(&sk->sk_wmem_alloc))
1393 		__sk_free(sk);
1394 }
1395 EXPORT_SYMBOL(sk_free);
1396 
1397 /*
1398  * Last sock_put should drop reference to sk->sk_net. It has already
1399  * been dropped in sk_change_net. Taking reference to stopping namespace
1400  * is not an option.
1401  * Take reference to a socket to remove it from hash _alive_ and after that
1402  * destroy it in the context of init_net.
1403  */
1404 void sk_release_kernel(struct sock *sk)
1405 {
1406 	if (sk == NULL || sk->sk_socket == NULL)
1407 		return;
1408 
1409 	sock_hold(sk);
1410 	sock_release(sk->sk_socket);
1411 	release_net(sock_net(sk));
1412 	sock_net_set(sk, get_net(&init_net));
1413 	sock_put(sk);
1414 }
1415 EXPORT_SYMBOL(sk_release_kernel);
1416 
1417 static void sk_update_clone(const struct sock *sk, struct sock *newsk)
1418 {
1419 	if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
1420 		sock_update_memcg(newsk);
1421 }
1422 
1423 /**
1424  *	sk_clone_lock - clone a socket, and lock its clone
1425  *	@sk: the socket to clone
1426  *	@priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
1427  *
1428  *	Caller must unlock socket even in error path (bh_unlock_sock(newsk))
1429  */
1430 struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
1431 {
1432 	struct sock *newsk;
1433 
1434 	newsk = sk_prot_alloc(sk->sk_prot, priority, sk->sk_family);
1435 	if (newsk != NULL) {
1436 		struct sk_filter *filter;
1437 
1438 		sock_copy(newsk, sk);
1439 
1440 		/* SANITY */
1441 		get_net(sock_net(newsk));
1442 		sk_node_init(&newsk->sk_node);
1443 		sock_lock_init(newsk);
1444 		bh_lock_sock(newsk);
1445 		newsk->sk_backlog.head	= newsk->sk_backlog.tail = NULL;
1446 		newsk->sk_backlog.len = 0;
1447 
1448 		atomic_set(&newsk->sk_rmem_alloc, 0);
1449 		/*
1450 		 * sk_wmem_alloc set to one (see sk_free() and sock_wfree())
1451 		 */
1452 		atomic_set(&newsk->sk_wmem_alloc, 1);
1453 		atomic_set(&newsk->sk_omem_alloc, 0);
1454 		skb_queue_head_init(&newsk->sk_receive_queue);
1455 		skb_queue_head_init(&newsk->sk_write_queue);
1456 #ifdef CONFIG_NET_DMA
1457 		skb_queue_head_init(&newsk->sk_async_wait_queue);
1458 #endif
1459 
1460 		spin_lock_init(&newsk->sk_dst_lock);
1461 		rwlock_init(&newsk->sk_callback_lock);
1462 		lockdep_set_class_and_name(&newsk->sk_callback_lock,
1463 				af_callback_keys + newsk->sk_family,
1464 				af_family_clock_key_strings[newsk->sk_family]);
1465 
1466 		newsk->sk_dst_cache	= NULL;
1467 		newsk->sk_wmem_queued	= 0;
1468 		newsk->sk_forward_alloc = 0;
1469 		newsk->sk_send_head	= NULL;
1470 		newsk->sk_userlocks	= sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;
1471 
1472 		sock_reset_flag(newsk, SOCK_DONE);
1473 		skb_queue_head_init(&newsk->sk_error_queue);
1474 
1475 		filter = rcu_dereference_protected(newsk->sk_filter, 1);
1476 		if (filter != NULL)
1477 			sk_filter_charge(newsk, filter);
1478 
1479 		if (unlikely(xfrm_sk_clone_policy(newsk))) {
1480 			/* It is still raw copy of parent, so invalidate
1481 			 * destructor and make plain sk_free() */
1482 			newsk->sk_destruct = NULL;
1483 			bh_unlock_sock(newsk);
1484 			sk_free(newsk);
1485 			newsk = NULL;
1486 			goto out;
1487 		}
1488 
1489 		newsk->sk_err	   = 0;
1490 		newsk->sk_priority = 0;
1491 		/*
1492 		 * Before updating sk_refcnt, we must commit prior changes to memory
1493 		 * (Documentation/RCU/rculist_nulls.txt for details)
1494 		 */
1495 		smp_wmb();
1496 		atomic_set(&newsk->sk_refcnt, 2);
1497 
1498 		/*
1499 		 * Increment the counter in the same struct proto as the master
1500 		 * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that
1501 		 * is the same as sk->sk_prot->socks, as this field was copied
1502 		 * with memcpy).
1503 		 *
1504 		 * This _changes_ the previous behaviour, where
1505 		 * tcp_create_openreq_child always was incrementing the
1506 		 * equivalent to tcp_prot->socks (inet_sock_nr), so this have
1507 		 * to be taken into account in all callers. -acme
1508 		 */
1509 		sk_refcnt_debug_inc(newsk);
1510 		sk_set_socket(newsk, NULL);
1511 		newsk->sk_wq = NULL;
1512 
1513 		sk_update_clone(sk, newsk);
1514 
1515 		if (newsk->sk_prot->sockets_allocated)
1516 			sk_sockets_allocated_inc(newsk);
1517 
1518 		if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
1519 			net_enable_timestamp();
1520 	}
1521 out:
1522 	return newsk;
1523 }
1524 EXPORT_SYMBOL_GPL(sk_clone_lock);
1525 
1526 void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
1527 {
1528 	__sk_dst_set(sk, dst);
1529 	sk->sk_route_caps = dst->dev->features;
1530 	if (sk->sk_route_caps & NETIF_F_GSO)
1531 		sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
1532 	sk->sk_route_caps &= ~sk->sk_route_nocaps;
1533 	if (sk_can_gso(sk)) {
1534 		if (dst->header_len) {
1535 			sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
1536 		} else {
1537 			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
1538 			sk->sk_gso_max_size = dst->dev->gso_max_size;
1539 			sk->sk_gso_max_segs = dst->dev->gso_max_segs;
1540 		}
1541 	}
1542 }
1543 EXPORT_SYMBOL_GPL(sk_setup_caps);
1544 
1545 /*
1546  *	Simple resource managers for sockets.
1547  */
1548 
1549 
1550 /*
1551  * Write buffer destructor automatically called from kfree_skb.
1552  */
1553 void sock_wfree(struct sk_buff *skb)
1554 {
1555 	struct sock *sk = skb->sk;
1556 	unsigned int len = skb->truesize;
1557 
1558 	if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) {
1559 		/*
1560 		 * Keep a reference on sk_wmem_alloc, this will be released
1561 		 * after sk_write_space() call
1562 		 */
1563 		atomic_sub(len - 1, &sk->sk_wmem_alloc);
1564 		sk->sk_write_space(sk);
1565 		len = 1;
1566 	}
1567 	/*
1568 	 * if sk_wmem_alloc reaches 0, we must finish what sk_free()
1569 	 * could not do because of in-flight packets
1570 	 */
1571 	if (atomic_sub_and_test(len, &sk->sk_wmem_alloc))
1572 		__sk_free(sk);
1573 }
1574 EXPORT_SYMBOL(sock_wfree);
1575 
1576 /*
1577  * Read buffer destructor automatically called from kfree_skb.
1578  */
1579 void sock_rfree(struct sk_buff *skb)
1580 {
1581 	struct sock *sk = skb->sk;
1582 	unsigned int len = skb->truesize;
1583 
1584 	atomic_sub(len, &sk->sk_rmem_alloc);
1585 	sk_mem_uncharge(sk, len);
1586 }
1587 EXPORT_SYMBOL(sock_rfree);
1588 
1589 void sock_edemux(struct sk_buff *skb)
1590 {
1591 	struct sock *sk = skb->sk;
1592 
1593 #ifdef CONFIG_INET
1594 	if (sk->sk_state == TCP_TIME_WAIT)
1595 		inet_twsk_put(inet_twsk(sk));
1596 	else
1597 #endif
1598 		sock_put(sk);
1599 }
1600 EXPORT_SYMBOL(sock_edemux);
1601 
1602 kuid_t sock_i_uid(struct sock *sk)
1603 {
1604 	kuid_t uid;
1605 
1606 	read_lock_bh(&sk->sk_callback_lock);
1607 	uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : GLOBAL_ROOT_UID;
1608 	read_unlock_bh(&sk->sk_callback_lock);
1609 	return uid;
1610 }
1611 EXPORT_SYMBOL(sock_i_uid);
1612 
1613 unsigned long sock_i_ino(struct sock *sk)
1614 {
1615 	unsigned long ino;
1616 
1617 	read_lock_bh(&sk->sk_callback_lock);
1618 	ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
1619 	read_unlock_bh(&sk->sk_callback_lock);
1620 	return ino;
1621 }
1622 EXPORT_SYMBOL(sock_i_ino);
1623 
1624 /*
1625  * Allocate a skb from the socket's send buffer.
1626  */
1627 struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
1628 			     gfp_t priority)
1629 {
1630 	if (force || atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
1631 		struct sk_buff *skb = alloc_skb(size, priority);
1632 		if (skb) {
1633 			skb_set_owner_w(skb, sk);
1634 			return skb;
1635 		}
1636 	}
1637 	return NULL;
1638 }
1639 EXPORT_SYMBOL(sock_wmalloc);
1640 
1641 /*
1642  * Allocate a skb from the socket's receive buffer.
1643  */
1644 struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force,
1645 			     gfp_t priority)
1646 {
1647 	if (force || atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf) {
1648 		struct sk_buff *skb = alloc_skb(size, priority);
1649 		if (skb) {
1650 			skb_set_owner_r(skb, sk);
1651 			return skb;
1652 		}
1653 	}
1654 	return NULL;
1655 }
1656 
1657 /*
1658  * Allocate a memory block from the socket's option memory buffer.
1659  */
1660 void *sock_kmalloc(struct sock *sk, int size, gfp_t priority)
1661 {
1662 	if ((unsigned int)size <= sysctl_optmem_max &&
1663 	    atomic_read(&sk->sk_omem_alloc) + size < sysctl_optmem_max) {
1664 		void *mem;
1665 		/* First do the add, to avoid the race if kmalloc
1666 		 * might sleep.
1667 		 */
1668 		atomic_add(size, &sk->sk_omem_alloc);
1669 		mem = kmalloc(size, priority);
1670 		if (mem)
1671 			return mem;
1672 		atomic_sub(size, &sk->sk_omem_alloc);
1673 	}
1674 	return NULL;
1675 }
1676 EXPORT_SYMBOL(sock_kmalloc);
1677 
1678 /*
1679  * Free an option memory block.
1680  */
1681 void sock_kfree_s(struct sock *sk, void *mem, int size)
1682 {
1683 	kfree(mem);
1684 	atomic_sub(size, &sk->sk_omem_alloc);
1685 }
1686 EXPORT_SYMBOL(sock_kfree_s);
1687 
1688 /* It is almost wait_for_tcp_memory minus release_sock/lock_sock.
1689    I think, these locks should be removed for datagram sockets.
1690  */
1691 static long sock_wait_for_wmem(struct sock *sk, long timeo)
1692 {
1693 	DEFINE_WAIT(wait);
1694 
1695 	clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
1696 	for (;;) {
1697 		if (!timeo)
1698 			break;
1699 		if (signal_pending(current))
1700 			break;
1701 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
1702 		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1703 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf)
1704 			break;
1705 		if (sk->sk_shutdown & SEND_SHUTDOWN)
1706 			break;
1707 		if (sk->sk_err)
1708 			break;
1709 		timeo = schedule_timeout(timeo);
1710 	}
1711 	finish_wait(sk_sleep(sk), &wait);
1712 	return timeo;
1713 }
1714 
1715 
1716 /*
1717  *	Generic send/receive buffer handlers
1718  */
1719 
1720 struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
1721 				     unsigned long data_len, int noblock,
1722 				     int *errcode)
1723 {
1724 	struct sk_buff *skb;
1725 	gfp_t gfp_mask;
1726 	long timeo;
1727 	int err;
1728 	int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
1729 
1730 	err = -EMSGSIZE;
1731 	if (npages > MAX_SKB_FRAGS)
1732 		goto failure;
1733 
1734 	gfp_mask = sk->sk_allocation;
1735 	if (gfp_mask & __GFP_WAIT)
1736 		gfp_mask |= __GFP_REPEAT;
1737 
1738 	timeo = sock_sndtimeo(sk, noblock);
1739 	while (1) {
1740 		err = sock_error(sk);
1741 		if (err != 0)
1742 			goto failure;
1743 
1744 		err = -EPIPE;
1745 		if (sk->sk_shutdown & SEND_SHUTDOWN)
1746 			goto failure;
1747 
1748 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
1749 			skb = alloc_skb(header_len, gfp_mask);
1750 			if (skb) {
1751 				int i;
1752 
1753 				/* No pages, we're done... */
1754 				if (!data_len)
1755 					break;
1756 
1757 				skb->truesize += data_len;
1758 				skb_shinfo(skb)->nr_frags = npages;
1759 				for (i = 0; i < npages; i++) {
1760 					struct page *page;
1761 
1762 					page = alloc_pages(sk->sk_allocation, 0);
1763 					if (!page) {
1764 						err = -ENOBUFS;
1765 						skb_shinfo(skb)->nr_frags = i;
1766 						kfree_skb(skb);
1767 						goto failure;
1768 					}
1769 
1770 					__skb_fill_page_desc(skb, i,
1771 							page, 0,
1772 							(data_len >= PAGE_SIZE ?
1773 							 PAGE_SIZE :
1774 							 data_len));
1775 					data_len -= PAGE_SIZE;
1776 				}
1777 
1778 				/* Full success... */
1779 				break;
1780 			}
1781 			err = -ENOBUFS;
1782 			goto failure;
1783 		}
1784 		set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
1785 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
1786 		err = -EAGAIN;
1787 		if (!timeo)
1788 			goto failure;
1789 		if (signal_pending(current))
1790 			goto interrupted;
1791 		timeo = sock_wait_for_wmem(sk, timeo);
1792 	}
1793 
1794 	skb_set_owner_w(skb, sk);
1795 	return skb;
1796 
1797 interrupted:
1798 	err = sock_intr_errno(timeo);
1799 failure:
1800 	*errcode = err;
1801 	return NULL;
1802 }
1803 EXPORT_SYMBOL(sock_alloc_send_pskb);
1804 
1805 struct sk_buff *sock_alloc_send_skb(struct sock *sk, unsigned long size,
1806 				    int noblock, int *errcode)
1807 {
1808 	return sock_alloc_send_pskb(sk, size, 0, noblock, errcode);
1809 }
1810 EXPORT_SYMBOL(sock_alloc_send_skb);
1811 
1812 /* On 32bit arches, an skb frag is limited to 2^15 */
1813 #define SKB_FRAG_PAGE_ORDER	get_order(32768)
1814 
1815 bool sk_page_frag_refill(struct sock *sk, struct page_frag *pfrag)
1816 {
1817 	int order;
1818 
1819 	if (pfrag->page) {
1820 		if (atomic_read(&pfrag->page->_count) == 1) {
1821 			pfrag->offset = 0;
1822 			return true;
1823 		}
1824 		if (pfrag->offset < pfrag->size)
1825 			return true;
1826 		put_page(pfrag->page);
1827 	}
1828 
1829 	/* We restrict high order allocations to users that can afford to wait */
1830 	order = (sk->sk_allocation & __GFP_WAIT) ? SKB_FRAG_PAGE_ORDER : 0;
1831 
1832 	do {
1833 		gfp_t gfp = sk->sk_allocation;
1834 
1835 		if (order)
1836 			gfp |= __GFP_COMP | __GFP_NOWARN;
1837 		pfrag->page = alloc_pages(gfp, order);
1838 		if (likely(pfrag->page)) {
1839 			pfrag->offset = 0;
1840 			pfrag->size = PAGE_SIZE << order;
1841 			return true;
1842 		}
1843 	} while (--order >= 0);
1844 
1845 	sk_enter_memory_pressure(sk);
1846 	sk_stream_moderate_sndbuf(sk);
1847 	return false;
1848 }
1849 EXPORT_SYMBOL(sk_page_frag_refill);
1850 
1851 static void __lock_sock(struct sock *sk)
1852 	__releases(&sk->sk_lock.slock)
1853 	__acquires(&sk->sk_lock.slock)
1854 {
1855 	DEFINE_WAIT(wait);
1856 
1857 	for (;;) {
1858 		prepare_to_wait_exclusive(&sk->sk_lock.wq, &wait,
1859 					TASK_UNINTERRUPTIBLE);
1860 		spin_unlock_bh(&sk->sk_lock.slock);
1861 		schedule();
1862 		spin_lock_bh(&sk->sk_lock.slock);
1863 		if (!sock_owned_by_user(sk))
1864 			break;
1865 	}
1866 	finish_wait(&sk->sk_lock.wq, &wait);
1867 }
1868 
1869 static void __release_sock(struct sock *sk)
1870 	__releases(&sk->sk_lock.slock)
1871 	__acquires(&sk->sk_lock.slock)
1872 {
1873 	struct sk_buff *skb = sk->sk_backlog.head;
1874 
1875 	do {
1876 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
1877 		bh_unlock_sock(sk);
1878 
1879 		do {
1880 			struct sk_buff *next = skb->next;
1881 
1882 			prefetch(next);
1883 			WARN_ON_ONCE(skb_dst_is_noref(skb));
1884 			skb->next = NULL;
1885 			sk_backlog_rcv(sk, skb);
1886 
1887 			/*
1888 			 * We are in process context here with softirqs
1889 			 * disabled, use cond_resched_softirq() to preempt.
1890 			 * This is safe to do because we've taken the backlog
1891 			 * queue private:
1892 			 */
1893 			cond_resched_softirq();
1894 
1895 			skb = next;
1896 		} while (skb != NULL);
1897 
1898 		bh_lock_sock(sk);
1899 	} while ((skb = sk->sk_backlog.head) != NULL);
1900 
1901 	/*
1902 	 * Doing the zeroing here guarantee we can not loop forever
1903 	 * while a wild producer attempts to flood us.
1904 	 */
1905 	sk->sk_backlog.len = 0;
1906 }
1907 
1908 /**
1909  * sk_wait_data - wait for data to arrive at sk_receive_queue
1910  * @sk:    sock to wait on
1911  * @timeo: for how long
1912  *
1913  * Now socket state including sk->sk_err is changed only under lock,
1914  * hence we may omit checks after joining wait queue.
1915  * We check receive queue before schedule() only as optimization;
1916  * it is very likely that release_sock() added new data.
1917  */
1918 int sk_wait_data(struct sock *sk, long *timeo)
1919 {
1920 	int rc;
1921 	DEFINE_WAIT(wait);
1922 
1923 	prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1924 	set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
1925 	rc = sk_wait_event(sk, timeo, !skb_queue_empty(&sk->sk_receive_queue));
1926 	clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
1927 	finish_wait(sk_sleep(sk), &wait);
1928 	return rc;
1929 }
1930 EXPORT_SYMBOL(sk_wait_data);
1931 
1932 /**
1933  *	__sk_mem_schedule - increase sk_forward_alloc and memory_allocated
1934  *	@sk: socket
1935  *	@size: memory size to allocate
1936  *	@kind: allocation type
1937  *
1938  *	If kind is SK_MEM_SEND, it means wmem allocation. Otherwise it means
1939  *	rmem allocation. This function assumes that protocols which have
1940  *	memory_pressure use sk_wmem_queued as write buffer accounting.
1941  */
1942 int __sk_mem_schedule(struct sock *sk, int size, int kind)
1943 {
1944 	struct proto *prot = sk->sk_prot;
1945 	int amt = sk_mem_pages(size);
1946 	long allocated;
1947 	int parent_status = UNDER_LIMIT;
1948 
1949 	sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
1950 
1951 	allocated = sk_memory_allocated_add(sk, amt, &parent_status);
1952 
1953 	/* Under limit. */
1954 	if (parent_status == UNDER_LIMIT &&
1955 			allocated <= sk_prot_mem_limits(sk, 0)) {
1956 		sk_leave_memory_pressure(sk);
1957 		return 1;
1958 	}
1959 
1960 	/* Under pressure. (we or our parents) */
1961 	if ((parent_status > SOFT_LIMIT) ||
1962 			allocated > sk_prot_mem_limits(sk, 1))
1963 		sk_enter_memory_pressure(sk);
1964 
1965 	/* Over hard limit (we or our parents) */
1966 	if ((parent_status == OVER_LIMIT) ||
1967 			(allocated > sk_prot_mem_limits(sk, 2)))
1968 		goto suppress_allocation;
1969 
1970 	/* guarantee minimum buffer size under pressure */
1971 	if (kind == SK_MEM_RECV) {
1972 		if (atomic_read(&sk->sk_rmem_alloc) < prot->sysctl_rmem[0])
1973 			return 1;
1974 
1975 	} else { /* SK_MEM_SEND */
1976 		if (sk->sk_type == SOCK_STREAM) {
1977 			if (sk->sk_wmem_queued < prot->sysctl_wmem[0])
1978 				return 1;
1979 		} else if (atomic_read(&sk->sk_wmem_alloc) <
1980 			   prot->sysctl_wmem[0])
1981 				return 1;
1982 	}
1983 
1984 	if (sk_has_memory_pressure(sk)) {
1985 		int alloc;
1986 
1987 		if (!sk_under_memory_pressure(sk))
1988 			return 1;
1989 		alloc = sk_sockets_allocated_read_positive(sk);
1990 		if (sk_prot_mem_limits(sk, 2) > alloc *
1991 		    sk_mem_pages(sk->sk_wmem_queued +
1992 				 atomic_read(&sk->sk_rmem_alloc) +
1993 				 sk->sk_forward_alloc))
1994 			return 1;
1995 	}
1996 
1997 suppress_allocation:
1998 
1999 	if (kind == SK_MEM_SEND && sk->sk_type == SOCK_STREAM) {
2000 		sk_stream_moderate_sndbuf(sk);
2001 
2002 		/* Fail only if socket is _under_ its sndbuf.
2003 		 * In this case we cannot block, so that we have to fail.
2004 		 */
2005 		if (sk->sk_wmem_queued + size >= sk->sk_sndbuf)
2006 			return 1;
2007 	}
2008 
2009 	trace_sock_exceed_buf_limit(sk, prot, allocated);
2010 
2011 	/* Alas. Undo changes. */
2012 	sk->sk_forward_alloc -= amt * SK_MEM_QUANTUM;
2013 
2014 	sk_memory_allocated_sub(sk, amt);
2015 
2016 	return 0;
2017 }
2018 EXPORT_SYMBOL(__sk_mem_schedule);
2019 
2020 /**
2021  *	__sk_reclaim - reclaim memory_allocated
2022  *	@sk: socket
2023  */
2024 void __sk_mem_reclaim(struct sock *sk)
2025 {
2026 	sk_memory_allocated_sub(sk,
2027 				sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT);
2028 	sk->sk_forward_alloc &= SK_MEM_QUANTUM - 1;
2029 
2030 	if (sk_under_memory_pressure(sk) &&
2031 	    (sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
2032 		sk_leave_memory_pressure(sk);
2033 }
2034 EXPORT_SYMBOL(__sk_mem_reclaim);
2035 
2036 
2037 /*
2038  * Set of default routines for initialising struct proto_ops when
2039  * the protocol does not support a particular function. In certain
2040  * cases where it makes no sense for a protocol to have a "do nothing"
2041  * function, some default processing is provided.
2042  */
2043 
2044 int sock_no_bind(struct socket *sock, struct sockaddr *saddr, int len)
2045 {
2046 	return -EOPNOTSUPP;
2047 }
2048 EXPORT_SYMBOL(sock_no_bind);
2049 
2050 int sock_no_connect(struct socket *sock, struct sockaddr *saddr,
2051 		    int len, int flags)
2052 {
2053 	return -EOPNOTSUPP;
2054 }
2055 EXPORT_SYMBOL(sock_no_connect);
2056 
2057 int sock_no_socketpair(struct socket *sock1, struct socket *sock2)
2058 {
2059 	return -EOPNOTSUPP;
2060 }
2061 EXPORT_SYMBOL(sock_no_socketpair);
2062 
2063 int sock_no_accept(struct socket *sock, struct socket *newsock, int flags)
2064 {
2065 	return -EOPNOTSUPP;
2066 }
2067 EXPORT_SYMBOL(sock_no_accept);
2068 
2069 int sock_no_getname(struct socket *sock, struct sockaddr *saddr,
2070 		    int *len, int peer)
2071 {
2072 	return -EOPNOTSUPP;
2073 }
2074 EXPORT_SYMBOL(sock_no_getname);
2075 
2076 unsigned int sock_no_poll(struct file *file, struct socket *sock, poll_table *pt)
2077 {
2078 	return 0;
2079 }
2080 EXPORT_SYMBOL(sock_no_poll);
2081 
2082 int sock_no_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
2083 {
2084 	return -EOPNOTSUPP;
2085 }
2086 EXPORT_SYMBOL(sock_no_ioctl);
2087 
2088 int sock_no_listen(struct socket *sock, int backlog)
2089 {
2090 	return -EOPNOTSUPP;
2091 }
2092 EXPORT_SYMBOL(sock_no_listen);
2093 
2094 int sock_no_shutdown(struct socket *sock, int how)
2095 {
2096 	return -EOPNOTSUPP;
2097 }
2098 EXPORT_SYMBOL(sock_no_shutdown);
2099 
2100 int sock_no_setsockopt(struct socket *sock, int level, int optname,
2101 		    char __user *optval, unsigned int optlen)
2102 {
2103 	return -EOPNOTSUPP;
2104 }
2105 EXPORT_SYMBOL(sock_no_setsockopt);
2106 
2107 int sock_no_getsockopt(struct socket *sock, int level, int optname,
2108 		    char __user *optval, int __user *optlen)
2109 {
2110 	return -EOPNOTSUPP;
2111 }
2112 EXPORT_SYMBOL(sock_no_getsockopt);
2113 
2114 int sock_no_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
2115 		    size_t len)
2116 {
2117 	return -EOPNOTSUPP;
2118 }
2119 EXPORT_SYMBOL(sock_no_sendmsg);
2120 
2121 int sock_no_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
2122 		    size_t len, int flags)
2123 {
2124 	return -EOPNOTSUPP;
2125 }
2126 EXPORT_SYMBOL(sock_no_recvmsg);
2127 
2128 int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma)
2129 {
2130 	/* Mirror missing mmap method error code */
2131 	return -ENODEV;
2132 }
2133 EXPORT_SYMBOL(sock_no_mmap);
2134 
2135 ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
2136 {
2137 	ssize_t res;
2138 	struct msghdr msg = {.msg_flags = flags};
2139 	struct kvec iov;
2140 	char *kaddr = kmap(page);
2141 	iov.iov_base = kaddr + offset;
2142 	iov.iov_len = size;
2143 	res = kernel_sendmsg(sock, &msg, &iov, 1, size);
2144 	kunmap(page);
2145 	return res;
2146 }
2147 EXPORT_SYMBOL(sock_no_sendpage);
2148 
2149 /*
2150  *	Default Socket Callbacks
2151  */
2152 
2153 static void sock_def_wakeup(struct sock *sk)
2154 {
2155 	struct socket_wq *wq;
2156 
2157 	rcu_read_lock();
2158 	wq = rcu_dereference(sk->sk_wq);
2159 	if (wq_has_sleeper(wq))
2160 		wake_up_interruptible_all(&wq->wait);
2161 	rcu_read_unlock();
2162 }
2163 
2164 static void sock_def_error_report(struct sock *sk)
2165 {
2166 	struct socket_wq *wq;
2167 
2168 	rcu_read_lock();
2169 	wq = rcu_dereference(sk->sk_wq);
2170 	if (wq_has_sleeper(wq))
2171 		wake_up_interruptible_poll(&wq->wait, POLLERR);
2172 	sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
2173 	rcu_read_unlock();
2174 }
2175 
2176 static void sock_def_readable(struct sock *sk, int len)
2177 {
2178 	struct socket_wq *wq;
2179 
2180 	rcu_read_lock();
2181 	wq = rcu_dereference(sk->sk_wq);
2182 	if (wq_has_sleeper(wq))
2183 		wake_up_interruptible_sync_poll(&wq->wait, POLLIN | POLLPRI |
2184 						POLLRDNORM | POLLRDBAND);
2185 	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
2186 	rcu_read_unlock();
2187 }
2188 
2189 static void sock_def_write_space(struct sock *sk)
2190 {
2191 	struct socket_wq *wq;
2192 
2193 	rcu_read_lock();
2194 
2195 	/* Do not wake up a writer until he can make "significant"
2196 	 * progress.  --DaveM
2197 	 */
2198 	if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
2199 		wq = rcu_dereference(sk->sk_wq);
2200 		if (wq_has_sleeper(wq))
2201 			wake_up_interruptible_sync_poll(&wq->wait, POLLOUT |
2202 						POLLWRNORM | POLLWRBAND);
2203 
2204 		/* Should agree with poll, otherwise some programs break */
2205 		if (sock_writeable(sk))
2206 			sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
2207 	}
2208 
2209 	rcu_read_unlock();
2210 }
2211 
2212 static void sock_def_destruct(struct sock *sk)
2213 {
2214 	kfree(sk->sk_protinfo);
2215 }
2216 
2217 void sk_send_sigurg(struct sock *sk)
2218 {
2219 	if (sk->sk_socket && sk->sk_socket->file)
2220 		if (send_sigurg(&sk->sk_socket->file->f_owner))
2221 			sk_wake_async(sk, SOCK_WAKE_URG, POLL_PRI);
2222 }
2223 EXPORT_SYMBOL(sk_send_sigurg);
2224 
2225 void sk_reset_timer(struct sock *sk, struct timer_list* timer,
2226 		    unsigned long expires)
2227 {
2228 	if (!mod_timer(timer, expires))
2229 		sock_hold(sk);
2230 }
2231 EXPORT_SYMBOL(sk_reset_timer);
2232 
2233 void sk_stop_timer(struct sock *sk, struct timer_list* timer)
2234 {
2235 	if (del_timer(timer))
2236 		__sock_put(sk);
2237 }
2238 EXPORT_SYMBOL(sk_stop_timer);
2239 
2240 void sock_init_data(struct socket *sock, struct sock *sk)
2241 {
2242 	skb_queue_head_init(&sk->sk_receive_queue);
2243 	skb_queue_head_init(&sk->sk_write_queue);
2244 	skb_queue_head_init(&sk->sk_error_queue);
2245 #ifdef CONFIG_NET_DMA
2246 	skb_queue_head_init(&sk->sk_async_wait_queue);
2247 #endif
2248 
2249 	sk->sk_send_head	=	NULL;
2250 
2251 	init_timer(&sk->sk_timer);
2252 
2253 	sk->sk_allocation	=	GFP_KERNEL;
2254 	sk->sk_rcvbuf		=	sysctl_rmem_default;
2255 	sk->sk_sndbuf		=	sysctl_wmem_default;
2256 	sk->sk_state		=	TCP_CLOSE;
2257 	sk_set_socket(sk, sock);
2258 
2259 	sock_set_flag(sk, SOCK_ZAPPED);
2260 
2261 	if (sock) {
2262 		sk->sk_type	=	sock->type;
2263 		sk->sk_wq	=	sock->wq;
2264 		sock->sk	=	sk;
2265 	} else
2266 		sk->sk_wq	=	NULL;
2267 
2268 	spin_lock_init(&sk->sk_dst_lock);
2269 	rwlock_init(&sk->sk_callback_lock);
2270 	lockdep_set_class_and_name(&sk->sk_callback_lock,
2271 			af_callback_keys + sk->sk_family,
2272 			af_family_clock_key_strings[sk->sk_family]);
2273 
2274 	sk->sk_state_change	=	sock_def_wakeup;
2275 	sk->sk_data_ready	=	sock_def_readable;
2276 	sk->sk_write_space	=	sock_def_write_space;
2277 	sk->sk_error_report	=	sock_def_error_report;
2278 	sk->sk_destruct		=	sock_def_destruct;
2279 
2280 	sk->sk_frag.page	=	NULL;
2281 	sk->sk_frag.offset	=	0;
2282 	sk->sk_peek_off		=	-1;
2283 
2284 	sk->sk_peer_pid 	=	NULL;
2285 	sk->sk_peer_cred	=	NULL;
2286 	sk->sk_write_pending	=	0;
2287 	sk->sk_rcvlowat		=	1;
2288 	sk->sk_rcvtimeo		=	MAX_SCHEDULE_TIMEOUT;
2289 	sk->sk_sndtimeo		=	MAX_SCHEDULE_TIMEOUT;
2290 
2291 	sk->sk_stamp = ktime_set(-1L, 0);
2292 
2293 	/*
2294 	 * Before updating sk_refcnt, we must commit prior changes to memory
2295 	 * (Documentation/RCU/rculist_nulls.txt for details)
2296 	 */
2297 	smp_wmb();
2298 	atomic_set(&sk->sk_refcnt, 1);
2299 	atomic_set(&sk->sk_drops, 0);
2300 }
2301 EXPORT_SYMBOL(sock_init_data);
2302 
2303 void lock_sock_nested(struct sock *sk, int subclass)
2304 {
2305 	might_sleep();
2306 	spin_lock_bh(&sk->sk_lock.slock);
2307 	if (sk->sk_lock.owned)
2308 		__lock_sock(sk);
2309 	sk->sk_lock.owned = 1;
2310 	spin_unlock(&sk->sk_lock.slock);
2311 	/*
2312 	 * The sk_lock has mutex_lock() semantics here:
2313 	 */
2314 	mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_);
2315 	local_bh_enable();
2316 }
2317 EXPORT_SYMBOL(lock_sock_nested);
2318 
2319 void release_sock(struct sock *sk)
2320 {
2321 	/*
2322 	 * The sk_lock has mutex_unlock() semantics:
2323 	 */
2324 	mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
2325 
2326 	spin_lock_bh(&sk->sk_lock.slock);
2327 	if (sk->sk_backlog.tail)
2328 		__release_sock(sk);
2329 
2330 	if (sk->sk_prot->release_cb)
2331 		sk->sk_prot->release_cb(sk);
2332 
2333 	sk->sk_lock.owned = 0;
2334 	if (waitqueue_active(&sk->sk_lock.wq))
2335 		wake_up(&sk->sk_lock.wq);
2336 	spin_unlock_bh(&sk->sk_lock.slock);
2337 }
2338 EXPORT_SYMBOL(release_sock);
2339 
2340 /**
2341  * lock_sock_fast - fast version of lock_sock
2342  * @sk: socket
2343  *
2344  * This version should be used for very small section, where process wont block
2345  * return false if fast path is taken
2346  *   sk_lock.slock locked, owned = 0, BH disabled
2347  * return true if slow path is taken
2348  *   sk_lock.slock unlocked, owned = 1, BH enabled
2349  */
2350 bool lock_sock_fast(struct sock *sk)
2351 {
2352 	might_sleep();
2353 	spin_lock_bh(&sk->sk_lock.slock);
2354 
2355 	if (!sk->sk_lock.owned)
2356 		/*
2357 		 * Note : We must disable BH
2358 		 */
2359 		return false;
2360 
2361 	__lock_sock(sk);
2362 	sk->sk_lock.owned = 1;
2363 	spin_unlock(&sk->sk_lock.slock);
2364 	/*
2365 	 * The sk_lock has mutex_lock() semantics here:
2366 	 */
2367 	mutex_acquire(&sk->sk_lock.dep_map, 0, 0, _RET_IP_);
2368 	local_bh_enable();
2369 	return true;
2370 }
2371 EXPORT_SYMBOL(lock_sock_fast);
2372 
2373 int sock_get_timestamp(struct sock *sk, struct timeval __user *userstamp)
2374 {
2375 	struct timeval tv;
2376 	if (!sock_flag(sk, SOCK_TIMESTAMP))
2377 		sock_enable_timestamp(sk, SOCK_TIMESTAMP);
2378 	tv = ktime_to_timeval(sk->sk_stamp);
2379 	if (tv.tv_sec == -1)
2380 		return -ENOENT;
2381 	if (tv.tv_sec == 0) {
2382 		sk->sk_stamp = ktime_get_real();
2383 		tv = ktime_to_timeval(sk->sk_stamp);
2384 	}
2385 	return copy_to_user(userstamp, &tv, sizeof(tv)) ? -EFAULT : 0;
2386 }
2387 EXPORT_SYMBOL(sock_get_timestamp);
2388 
2389 int sock_get_timestampns(struct sock *sk, struct timespec __user *userstamp)
2390 {
2391 	struct timespec ts;
2392 	if (!sock_flag(sk, SOCK_TIMESTAMP))
2393 		sock_enable_timestamp(sk, SOCK_TIMESTAMP);
2394 	ts = ktime_to_timespec(sk->sk_stamp);
2395 	if (ts.tv_sec == -1)
2396 		return -ENOENT;
2397 	if (ts.tv_sec == 0) {
2398 		sk->sk_stamp = ktime_get_real();
2399 		ts = ktime_to_timespec(sk->sk_stamp);
2400 	}
2401 	return copy_to_user(userstamp, &ts, sizeof(ts)) ? -EFAULT : 0;
2402 }
2403 EXPORT_SYMBOL(sock_get_timestampns);
2404 
2405 void sock_enable_timestamp(struct sock *sk, int flag)
2406 {
2407 	if (!sock_flag(sk, flag)) {
2408 		unsigned long previous_flags = sk->sk_flags;
2409 
2410 		sock_set_flag(sk, flag);
2411 		/*
2412 		 * we just set one of the two flags which require net
2413 		 * time stamping, but time stamping might have been on
2414 		 * already because of the other one
2415 		 */
2416 		if (!(previous_flags & SK_FLAGS_TIMESTAMP))
2417 			net_enable_timestamp();
2418 	}
2419 }
2420 
2421 /*
2422  *	Get a socket option on an socket.
2423  *
2424  *	FIX: POSIX 1003.1g is very ambiguous here. It states that
2425  *	asynchronous errors should be reported by getsockopt. We assume
2426  *	this means if you specify SO_ERROR (otherwise whats the point of it).
2427  */
2428 int sock_common_getsockopt(struct socket *sock, int level, int optname,
2429 			   char __user *optval, int __user *optlen)
2430 {
2431 	struct sock *sk = sock->sk;
2432 
2433 	return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);
2434 }
2435 EXPORT_SYMBOL(sock_common_getsockopt);
2436 
2437 #ifdef CONFIG_COMPAT
2438 int compat_sock_common_getsockopt(struct socket *sock, int level, int optname,
2439 				  char __user *optval, int __user *optlen)
2440 {
2441 	struct sock *sk = sock->sk;
2442 
2443 	if (sk->sk_prot->compat_getsockopt != NULL)
2444 		return sk->sk_prot->compat_getsockopt(sk, level, optname,
2445 						      optval, optlen);
2446 	return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);
2447 }
2448 EXPORT_SYMBOL(compat_sock_common_getsockopt);
2449 #endif
2450 
2451 int sock_common_recvmsg(struct kiocb *iocb, struct socket *sock,
2452 			struct msghdr *msg, size_t size, int flags)
2453 {
2454 	struct sock *sk = sock->sk;
2455 	int addr_len = 0;
2456 	int err;
2457 
2458 	err = sk->sk_prot->recvmsg(iocb, sk, msg, size, flags & MSG_DONTWAIT,
2459 				   flags & ~MSG_DONTWAIT, &addr_len);
2460 	if (err >= 0)
2461 		msg->msg_namelen = addr_len;
2462 	return err;
2463 }
2464 EXPORT_SYMBOL(sock_common_recvmsg);
2465 
2466 /*
2467  *	Set socket options on an inet socket.
2468  */
2469 int sock_common_setsockopt(struct socket *sock, int level, int optname,
2470 			   char __user *optval, unsigned int optlen)
2471 {
2472 	struct sock *sk = sock->sk;
2473 
2474 	return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen);
2475 }
2476 EXPORT_SYMBOL(sock_common_setsockopt);
2477 
2478 #ifdef CONFIG_COMPAT
2479 int compat_sock_common_setsockopt(struct socket *sock, int level, int optname,
2480 				  char __user *optval, unsigned int optlen)
2481 {
2482 	struct sock *sk = sock->sk;
2483 
2484 	if (sk->sk_prot->compat_setsockopt != NULL)
2485 		return sk->sk_prot->compat_setsockopt(sk, level, optname,
2486 						      optval, optlen);
2487 	return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen);
2488 }
2489 EXPORT_SYMBOL(compat_sock_common_setsockopt);
2490 #endif
2491 
2492 void sk_common_release(struct sock *sk)
2493 {
2494 	if (sk->sk_prot->destroy)
2495 		sk->sk_prot->destroy(sk);
2496 
2497 	/*
2498 	 * Observation: when sock_common_release is called, processes have
2499 	 * no access to socket. But net still has.
2500 	 * Step one, detach it from networking:
2501 	 *
2502 	 * A. Remove from hash tables.
2503 	 */
2504 
2505 	sk->sk_prot->unhash(sk);
2506 
2507 	/*
2508 	 * In this point socket cannot receive new packets, but it is possible
2509 	 * that some packets are in flight because some CPU runs receiver and
2510 	 * did hash table lookup before we unhashed socket. They will achieve
2511 	 * receive queue and will be purged by socket destructor.
2512 	 *
2513 	 * Also we still have packets pending on receive queue and probably,
2514 	 * our own packets waiting in device queues. sock_destroy will drain
2515 	 * receive queue, but transmitted packets will delay socket destruction
2516 	 * until the last reference will be released.
2517 	 */
2518 
2519 	sock_orphan(sk);
2520 
2521 	xfrm_sk_free_policy(sk);
2522 
2523 	sk_refcnt_debug_release(sk);
2524 
2525 	if (sk->sk_frag.page) {
2526 		put_page(sk->sk_frag.page);
2527 		sk->sk_frag.page = NULL;
2528 	}
2529 
2530 	sock_put(sk);
2531 }
2532 EXPORT_SYMBOL(sk_common_release);
2533 
2534 #ifdef CONFIG_PROC_FS
2535 #define PROTO_INUSE_NR	64	/* should be enough for the first time */
2536 struct prot_inuse {
2537 	int val[PROTO_INUSE_NR];
2538 };
2539 
2540 static DECLARE_BITMAP(proto_inuse_idx, PROTO_INUSE_NR);
2541 
2542 #ifdef CONFIG_NET_NS
2543 void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
2544 {
2545 	__this_cpu_add(net->core.inuse->val[prot->inuse_idx], val);
2546 }
2547 EXPORT_SYMBOL_GPL(sock_prot_inuse_add);
2548 
2549 int sock_prot_inuse_get(struct net *net, struct proto *prot)
2550 {
2551 	int cpu, idx = prot->inuse_idx;
2552 	int res = 0;
2553 
2554 	for_each_possible_cpu(cpu)
2555 		res += per_cpu_ptr(net->core.inuse, cpu)->val[idx];
2556 
2557 	return res >= 0 ? res : 0;
2558 }
2559 EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
2560 
2561 static int __net_init sock_inuse_init_net(struct net *net)
2562 {
2563 	net->core.inuse = alloc_percpu(struct prot_inuse);
2564 	return net->core.inuse ? 0 : -ENOMEM;
2565 }
2566 
2567 static void __net_exit sock_inuse_exit_net(struct net *net)
2568 {
2569 	free_percpu(net->core.inuse);
2570 }
2571 
2572 static struct pernet_operations net_inuse_ops = {
2573 	.init = sock_inuse_init_net,
2574 	.exit = sock_inuse_exit_net,
2575 };
2576 
2577 static __init int net_inuse_init(void)
2578 {
2579 	if (register_pernet_subsys(&net_inuse_ops))
2580 		panic("Cannot initialize net inuse counters");
2581 
2582 	return 0;
2583 }
2584 
2585 core_initcall(net_inuse_init);
2586 #else
2587 static DEFINE_PER_CPU(struct prot_inuse, prot_inuse);
2588 
2589 void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
2590 {
2591 	__this_cpu_add(prot_inuse.val[prot->inuse_idx], val);
2592 }
2593 EXPORT_SYMBOL_GPL(sock_prot_inuse_add);
2594 
2595 int sock_prot_inuse_get(struct net *net, struct proto *prot)
2596 {
2597 	int cpu, idx = prot->inuse_idx;
2598 	int res = 0;
2599 
2600 	for_each_possible_cpu(cpu)
2601 		res += per_cpu(prot_inuse, cpu).val[idx];
2602 
2603 	return res >= 0 ? res : 0;
2604 }
2605 EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
2606 #endif
2607 
2608 static void assign_proto_idx(struct proto *prot)
2609 {
2610 	prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
2611 
2612 	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
2613 		pr_err("PROTO_INUSE_NR exhausted\n");
2614 		return;
2615 	}
2616 
2617 	set_bit(prot->inuse_idx, proto_inuse_idx);
2618 }
2619 
2620 static void release_proto_idx(struct proto *prot)
2621 {
2622 	if (prot->inuse_idx != PROTO_INUSE_NR - 1)
2623 		clear_bit(prot->inuse_idx, proto_inuse_idx);
2624 }
2625 #else
2626 static inline void assign_proto_idx(struct proto *prot)
2627 {
2628 }
2629 
2630 static inline void release_proto_idx(struct proto *prot)
2631 {
2632 }
2633 #endif
2634 
2635 int proto_register(struct proto *prot, int alloc_slab)
2636 {
2637 	if (alloc_slab) {
2638 		prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
2639 					SLAB_HWCACHE_ALIGN | prot->slab_flags,
2640 					NULL);
2641 
2642 		if (prot->slab == NULL) {
2643 			pr_crit("%s: Can't create sock SLAB cache!\n",
2644 				prot->name);
2645 			goto out;
2646 		}
2647 
2648 		if (prot->rsk_prot != NULL) {
2649 			prot->rsk_prot->slab_name = kasprintf(GFP_KERNEL, "request_sock_%s", prot->name);
2650 			if (prot->rsk_prot->slab_name == NULL)
2651 				goto out_free_sock_slab;
2652 
2653 			prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
2654 								 prot->rsk_prot->obj_size, 0,
2655 								 SLAB_HWCACHE_ALIGN, NULL);
2656 
2657 			if (prot->rsk_prot->slab == NULL) {
2658 				pr_crit("%s: Can't create request sock SLAB cache!\n",
2659 					prot->name);
2660 				goto out_free_request_sock_slab_name;
2661 			}
2662 		}
2663 
2664 		if (prot->twsk_prot != NULL) {
2665 			prot->twsk_prot->twsk_slab_name = kasprintf(GFP_KERNEL, "tw_sock_%s", prot->name);
2666 
2667 			if (prot->twsk_prot->twsk_slab_name == NULL)
2668 				goto out_free_request_sock_slab;
2669 
2670 			prot->twsk_prot->twsk_slab =
2671 				kmem_cache_create(prot->twsk_prot->twsk_slab_name,
2672 						  prot->twsk_prot->twsk_obj_size,
2673 						  0,
2674 						  SLAB_HWCACHE_ALIGN |
2675 							prot->slab_flags,
2676 						  NULL);
2677 			if (prot->twsk_prot->twsk_slab == NULL)
2678 				goto out_free_timewait_sock_slab_name;
2679 		}
2680 	}
2681 
2682 	mutex_lock(&proto_list_mutex);
2683 	list_add(&prot->node, &proto_list);
2684 	assign_proto_idx(prot);
2685 	mutex_unlock(&proto_list_mutex);
2686 	return 0;
2687 
2688 out_free_timewait_sock_slab_name:
2689 	kfree(prot->twsk_prot->twsk_slab_name);
2690 out_free_request_sock_slab:
2691 	if (prot->rsk_prot && prot->rsk_prot->slab) {
2692 		kmem_cache_destroy(prot->rsk_prot->slab);
2693 		prot->rsk_prot->slab = NULL;
2694 	}
2695 out_free_request_sock_slab_name:
2696 	if (prot->rsk_prot)
2697 		kfree(prot->rsk_prot->slab_name);
2698 out_free_sock_slab:
2699 	kmem_cache_destroy(prot->slab);
2700 	prot->slab = NULL;
2701 out:
2702 	return -ENOBUFS;
2703 }
2704 EXPORT_SYMBOL(proto_register);
2705 
2706 void proto_unregister(struct proto *prot)
2707 {
2708 	mutex_lock(&proto_list_mutex);
2709 	release_proto_idx(prot);
2710 	list_del(&prot->node);
2711 	mutex_unlock(&proto_list_mutex);
2712 
2713 	if (prot->slab != NULL) {
2714 		kmem_cache_destroy(prot->slab);
2715 		prot->slab = NULL;
2716 	}
2717 
2718 	if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) {
2719 		kmem_cache_destroy(prot->rsk_prot->slab);
2720 		kfree(prot->rsk_prot->slab_name);
2721 		prot->rsk_prot->slab = NULL;
2722 	}
2723 
2724 	if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {
2725 		kmem_cache_destroy(prot->twsk_prot->twsk_slab);
2726 		kfree(prot->twsk_prot->twsk_slab_name);
2727 		prot->twsk_prot->twsk_slab = NULL;
2728 	}
2729 }
2730 EXPORT_SYMBOL(proto_unregister);
2731 
2732 #ifdef CONFIG_PROC_FS
2733 static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
2734 	__acquires(proto_list_mutex)
2735 {
2736 	mutex_lock(&proto_list_mutex);
2737 	return seq_list_start_head(&proto_list, *pos);
2738 }
2739 
2740 static void *proto_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2741 {
2742 	return seq_list_next(v, &proto_list, pos);
2743 }
2744 
2745 static void proto_seq_stop(struct seq_file *seq, void *v)
2746 	__releases(proto_list_mutex)
2747 {
2748 	mutex_unlock(&proto_list_mutex);
2749 }
2750 
2751 static char proto_method_implemented(const void *method)
2752 {
2753 	return method == NULL ? 'n' : 'y';
2754 }
2755 static long sock_prot_memory_allocated(struct proto *proto)
2756 {
2757 	return proto->memory_allocated != NULL ? proto_memory_allocated(proto) : -1L;
2758 }
2759 
2760 static char *sock_prot_memory_pressure(struct proto *proto)
2761 {
2762 	return proto->memory_pressure != NULL ?
2763 	proto_memory_pressure(proto) ? "yes" : "no" : "NI";
2764 }
2765 
2766 static void proto_seq_printf(struct seq_file *seq, struct proto *proto)
2767 {
2768 
2769 	seq_printf(seq, "%-9s %4u %6d  %6ld   %-3s %6u   %-3s  %-10s "
2770 			"%2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c %2c\n",
2771 		   proto->name,
2772 		   proto->obj_size,
2773 		   sock_prot_inuse_get(seq_file_net(seq), proto),
2774 		   sock_prot_memory_allocated(proto),
2775 		   sock_prot_memory_pressure(proto),
2776 		   proto->max_header,
2777 		   proto->slab == NULL ? "no" : "yes",
2778 		   module_name(proto->owner),
2779 		   proto_method_implemented(proto->close),
2780 		   proto_method_implemented(proto->connect),
2781 		   proto_method_implemented(proto->disconnect),
2782 		   proto_method_implemented(proto->accept),
2783 		   proto_method_implemented(proto->ioctl),
2784 		   proto_method_implemented(proto->init),
2785 		   proto_method_implemented(proto->destroy),
2786 		   proto_method_implemented(proto->shutdown),
2787 		   proto_method_implemented(proto->setsockopt),
2788 		   proto_method_implemented(proto->getsockopt),
2789 		   proto_method_implemented(proto->sendmsg),
2790 		   proto_method_implemented(proto->recvmsg),
2791 		   proto_method_implemented(proto->sendpage),
2792 		   proto_method_implemented(proto->bind),
2793 		   proto_method_implemented(proto->backlog_rcv),
2794 		   proto_method_implemented(proto->hash),
2795 		   proto_method_implemented(proto->unhash),
2796 		   proto_method_implemented(proto->get_port),
2797 		   proto_method_implemented(proto->enter_memory_pressure));
2798 }
2799 
2800 static int proto_seq_show(struct seq_file *seq, void *v)
2801 {
2802 	if (v == &proto_list)
2803 		seq_printf(seq, "%-9s %-4s %-8s %-6s %-5s %-7s %-4s %-10s %s",
2804 			   "protocol",
2805 			   "size",
2806 			   "sockets",
2807 			   "memory",
2808 			   "press",
2809 			   "maxhdr",
2810 			   "slab",
2811 			   "module",
2812 			   "cl co di ac io in de sh ss gs se re sp bi br ha uh gp em\n");
2813 	else
2814 		proto_seq_printf(seq, list_entry(v, struct proto, node));
2815 	return 0;
2816 }
2817 
2818 static const struct seq_operations proto_seq_ops = {
2819 	.start  = proto_seq_start,
2820 	.next   = proto_seq_next,
2821 	.stop   = proto_seq_stop,
2822 	.show   = proto_seq_show,
2823 };
2824 
2825 static int proto_seq_open(struct inode *inode, struct file *file)
2826 {
2827 	return seq_open_net(inode, file, &proto_seq_ops,
2828 			    sizeof(struct seq_net_private));
2829 }
2830 
2831 static const struct file_operations proto_seq_fops = {
2832 	.owner		= THIS_MODULE,
2833 	.open		= proto_seq_open,
2834 	.read		= seq_read,
2835 	.llseek		= seq_lseek,
2836 	.release	= seq_release_net,
2837 };
2838 
2839 static __net_init int proto_init_net(struct net *net)
2840 {
2841 	if (!proc_create("protocols", S_IRUGO, net->proc_net, &proto_seq_fops))
2842 		return -ENOMEM;
2843 
2844 	return 0;
2845 }
2846 
2847 static __net_exit void proto_exit_net(struct net *net)
2848 {
2849 	remove_proc_entry("protocols", net->proc_net);
2850 }
2851 
2852 
2853 static __net_initdata struct pernet_operations proto_net_ops = {
2854 	.init = proto_init_net,
2855 	.exit = proto_exit_net,
2856 };
2857 
2858 static int __init proto_init(void)
2859 {
2860 	return register_pernet_subsys(&proto_net_ops);
2861 }
2862 
2863 subsys_initcall(proto_init);
2864 
2865 #endif /* PROC_FS */
2866