xref: /openbmc/linux/net/ipv4/udp.c (revision b627b4ed)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		The User Datagram Protocol (UDP).
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Arnt Gulbrandsen, <agulbra@nvg.unit.no>
11  *		Alan Cox, <alan@lxorguk.ukuu.org.uk>
12  *		Hirokazu Takahashi, <taka@valinux.co.jp>
13  *
14  * Fixes:
15  *		Alan Cox	:	verify_area() calls
16  *		Alan Cox	: 	stopped close while in use off icmp
17  *					messages. Not a fix but a botch that
18  *					for udp at least is 'valid'.
19  *		Alan Cox	:	Fixed icmp handling properly
20  *		Alan Cox	: 	Correct error for oversized datagrams
21  *		Alan Cox	:	Tidied select() semantics.
22  *		Alan Cox	:	udp_err() fixed properly, also now
23  *					select and read wake correctly on errors
24  *		Alan Cox	:	udp_send verify_area moved to avoid mem leak
25  *		Alan Cox	:	UDP can count its memory
26  *		Alan Cox	:	send to an unknown connection causes
27  *					an ECONNREFUSED off the icmp, but
28  *					does NOT close.
29  *		Alan Cox	:	Switched to new sk_buff handlers. No more backlog!
30  *		Alan Cox	:	Using generic datagram code. Even smaller and the PEEK
31  *					bug no longer crashes it.
32  *		Fred Van Kempen	: 	Net2e support for sk->broadcast.
33  *		Alan Cox	:	Uses skb_free_datagram
34  *		Alan Cox	:	Added get/set sockopt support.
35  *		Alan Cox	:	Broadcasting without option set returns EACCES.
36  *		Alan Cox	:	No wakeup calls. Instead we now use the callbacks.
37  *		Alan Cox	:	Use ip_tos and ip_ttl
38  *		Alan Cox	:	SNMP Mibs
39  *		Alan Cox	:	MSG_DONTROUTE, and 0.0.0.0 support.
40  *		Matt Dillon	:	UDP length checks.
41  *		Alan Cox	:	Smarter af_inet used properly.
42  *		Alan Cox	:	Use new kernel side addressing.
43  *		Alan Cox	:	Incorrect return on truncated datagram receive.
44  *	Arnt Gulbrandsen 	:	New udp_send and stuff
45  *		Alan Cox	:	Cache last socket
46  *		Alan Cox	:	Route cache
47  *		Jon Peatfield	:	Minor efficiency fix to sendto().
48  *		Mike Shaver	:	RFC1122 checks.
49  *		Alan Cox	:	Nonblocking error fix.
50  *	Willy Konynenberg	:	Transparent proxying support.
51  *		Mike McLagan	:	Routing by source
52  *		David S. Miller	:	New socket lookup architecture.
53  *					Last socket cache retained as it
54  *					does have a high hit rate.
55  *		Olaf Kirch	:	Don't linearise iovec on sendmsg.
56  *		Andi Kleen	:	Some cleanups, cache destination entry
57  *					for connect.
58  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
59  *		Melvin Smith	:	Check msg_name not msg_namelen in sendto(),
60  *					return ENOTCONN for unconnected sockets (POSIX)
61  *		Janos Farkas	:	don't deliver multi/broadcasts to a different
62  *					bound-to-device socket
63  *	Hirokazu Takahashi	:	HW checksumming for outgoing UDP
64  *					datagrams.
65  *	Hirokazu Takahashi	:	sendfile() on UDP works now.
66  *		Arnaldo C. Melo :	convert /proc/net/udp to seq_file
67  *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
68  *	Alexey Kuznetsov:		allow both IPv4 and IPv6 sockets to bind
69  *					a single port at the same time.
70  *	Derek Atkins <derek@ihtfp.com>: Add Encapulation Support
71  *	James Chapman		:	Add L2TP encapsulation type.
72  *
73  *
74  *		This program is free software; you can redistribute it and/or
75  *		modify it under the terms of the GNU General Public License
76  *		as published by the Free Software Foundation; either version
77  *		2 of the License, or (at your option) any later version.
78  */
79 
80 #include <asm/system.h>
81 #include <asm/uaccess.h>
82 #include <asm/ioctls.h>
83 #include <linux/bootmem.h>
84 #include <linux/highmem.h>
85 #include <linux/swap.h>
86 #include <linux/types.h>
87 #include <linux/fcntl.h>
88 #include <linux/module.h>
89 #include <linux/socket.h>
90 #include <linux/sockios.h>
91 #include <linux/igmp.h>
92 #include <linux/in.h>
93 #include <linux/errno.h>
94 #include <linux/timer.h>
95 #include <linux/mm.h>
96 #include <linux/inet.h>
97 #include <linux/netdevice.h>
98 #include <net/tcp_states.h>
99 #include <linux/skbuff.h>
100 #include <linux/proc_fs.h>
101 #include <linux/seq_file.h>
102 #include <net/net_namespace.h>
103 #include <net/icmp.h>
104 #include <net/route.h>
105 #include <net/checksum.h>
106 #include <net/xfrm.h>
107 #include "udp_impl.h"
108 
109 struct udp_table udp_table;
110 EXPORT_SYMBOL(udp_table);
111 
112 int sysctl_udp_mem[3] __read_mostly;
113 int sysctl_udp_rmem_min __read_mostly;
114 int sysctl_udp_wmem_min __read_mostly;
115 
116 EXPORT_SYMBOL(sysctl_udp_mem);
117 EXPORT_SYMBOL(sysctl_udp_rmem_min);
118 EXPORT_SYMBOL(sysctl_udp_wmem_min);
119 
120 atomic_t udp_memory_allocated;
121 EXPORT_SYMBOL(udp_memory_allocated);
122 
123 #define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
124 
125 static int udp_lib_lport_inuse(struct net *net, __u16 num,
126 			       const struct udp_hslot *hslot,
127 			       unsigned long *bitmap,
128 			       struct sock *sk,
129 			       int (*saddr_comp)(const struct sock *sk1,
130 						 const struct sock *sk2))
131 {
132 	struct sock *sk2;
133 	struct hlist_nulls_node *node;
134 
135 	sk_nulls_for_each(sk2, node, &hslot->head)
136 		if (net_eq(sock_net(sk2), net)			&&
137 		    sk2 != sk					&&
138 		    (bitmap || sk2->sk_hash == num)		&&
139 		    (!sk2->sk_reuse || !sk->sk_reuse)		&&
140 		    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
141 			|| sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
142 		    (*saddr_comp)(sk, sk2)) {
143 			if (bitmap)
144 				__set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
145 					  bitmap);
146 			else
147 				return 1;
148 		}
149 	return 0;
150 }
151 
152 /**
153  *  udp_lib_get_port  -  UDP/-Lite port lookup for IPv4 and IPv6
154  *
155  *  @sk:          socket struct in question
156  *  @snum:        port number to look up
157  *  @saddr_comp:  AF-dependent comparison of bound local IP addresses
158  */
159 int udp_lib_get_port(struct sock *sk, unsigned short snum,
160 		       int (*saddr_comp)(const struct sock *sk1,
161 					 const struct sock *sk2 )    )
162 {
163 	struct udp_hslot *hslot;
164 	struct udp_table *udptable = sk->sk_prot->h.udp_table;
165 	int    error = 1;
166 	struct net *net = sock_net(sk);
167 
168 	if (!snum) {
169 		int low, high, remaining;
170 		unsigned rand;
171 		unsigned short first, last;
172 		DECLARE_BITMAP(bitmap, PORTS_PER_CHAIN);
173 
174 		inet_get_local_port_range(&low, &high);
175 		remaining = (high - low) + 1;
176 
177 		rand = net_random();
178 		first = (((u64)rand * remaining) >> 32) + low;
179 		/*
180 		 * force rand to be an odd multiple of UDP_HTABLE_SIZE
181 		 */
182 		rand = (rand | 1) * UDP_HTABLE_SIZE;
183 		for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
184 			hslot = &udptable->hash[udp_hashfn(net, first)];
185 			bitmap_zero(bitmap, PORTS_PER_CHAIN);
186 			spin_lock_bh(&hslot->lock);
187 			udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
188 					    saddr_comp);
189 
190 			snum = first;
191 			/*
192 			 * Iterate on all possible values of snum for this hash.
193 			 * Using steps of an odd multiple of UDP_HTABLE_SIZE
194 			 * give us randomization and full range coverage.
195 			 */
196 			do {
197 				if (low <= snum && snum <= high &&
198 				    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
199 					goto found;
200 				snum += rand;
201 			} while (snum != first);
202 			spin_unlock_bh(&hslot->lock);
203 		}
204 		goto fail;
205 	} else {
206 		hslot = &udptable->hash[udp_hashfn(net, snum)];
207 		spin_lock_bh(&hslot->lock);
208 		if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
209 			goto fail_unlock;
210 	}
211 found:
212 	inet_sk(sk)->num = snum;
213 	sk->sk_hash = snum;
214 	if (sk_unhashed(sk)) {
215 		sk_nulls_add_node_rcu(sk, &hslot->head);
216 		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
217 	}
218 	error = 0;
219 fail_unlock:
220 	spin_unlock_bh(&hslot->lock);
221 fail:
222 	return error;
223 }
224 
225 int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
226 {
227 	struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
228 
229 	return 	( !ipv6_only_sock(sk2)  &&
230 		  (!inet1->rcv_saddr || !inet2->rcv_saddr ||
231 		   inet1->rcv_saddr == inet2->rcv_saddr      ));
232 }
233 
234 int udp_v4_get_port(struct sock *sk, unsigned short snum)
235 {
236 	return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
237 }
238 
239 static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
240 			 unsigned short hnum,
241 			 __be16 sport, __be32 daddr, __be16 dport, int dif)
242 {
243 	int score = -1;
244 
245 	if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
246 			!ipv6_only_sock(sk)) {
247 		struct inet_sock *inet = inet_sk(sk);
248 
249 		score = (sk->sk_family == PF_INET ? 1 : 0);
250 		if (inet->rcv_saddr) {
251 			if (inet->rcv_saddr != daddr)
252 				return -1;
253 			score += 2;
254 		}
255 		if (inet->daddr) {
256 			if (inet->daddr != saddr)
257 				return -1;
258 			score += 2;
259 		}
260 		if (inet->dport) {
261 			if (inet->dport != sport)
262 				return -1;
263 			score += 2;
264 		}
265 		if (sk->sk_bound_dev_if) {
266 			if (sk->sk_bound_dev_if != dif)
267 				return -1;
268 			score += 2;
269 		}
270 	}
271 	return score;
272 }
273 
274 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
275  * harder than this. -DaveM
276  */
277 static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
278 		__be16 sport, __be32 daddr, __be16 dport,
279 		int dif, struct udp_table *udptable)
280 {
281 	struct sock *sk, *result;
282 	struct hlist_nulls_node *node;
283 	unsigned short hnum = ntohs(dport);
284 	unsigned int hash = udp_hashfn(net, hnum);
285 	struct udp_hslot *hslot = &udptable->hash[hash];
286 	int score, badness;
287 
288 	rcu_read_lock();
289 begin:
290 	result = NULL;
291 	badness = -1;
292 	sk_nulls_for_each_rcu(sk, node, &hslot->head) {
293 		score = compute_score(sk, net, saddr, hnum, sport,
294 				      daddr, dport, dif);
295 		if (score > badness) {
296 			result = sk;
297 			badness = score;
298 		}
299 	}
300 	/*
301 	 * if the nulls value we got at the end of this lookup is
302 	 * not the expected one, we must restart lookup.
303 	 * We probably met an item that was moved to another chain.
304 	 */
305 	if (get_nulls_value(node) != hash)
306 		goto begin;
307 
308 	if (result) {
309 		if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
310 			result = NULL;
311 		else if (unlikely(compute_score(result, net, saddr, hnum, sport,
312 				  daddr, dport, dif) < badness)) {
313 			sock_put(result);
314 			goto begin;
315 		}
316 	}
317 	rcu_read_unlock();
318 	return result;
319 }
320 
321 static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
322 						 __be16 sport, __be16 dport,
323 						 struct udp_table *udptable)
324 {
325 	struct sock *sk;
326 	const struct iphdr *iph = ip_hdr(skb);
327 
328 	if (unlikely(sk = skb_steal_sock(skb)))
329 		return sk;
330 	else
331 		return __udp4_lib_lookup(dev_net(skb->dst->dev), iph->saddr, sport,
332 					 iph->daddr, dport, inet_iif(skb),
333 					 udptable);
334 }
335 
336 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
337 			     __be32 daddr, __be16 dport, int dif)
338 {
339 	return __udp4_lib_lookup(net, saddr, sport, daddr, dport, dif, &udp_table);
340 }
341 EXPORT_SYMBOL_GPL(udp4_lib_lookup);
342 
343 static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
344 					     __be16 loc_port, __be32 loc_addr,
345 					     __be16 rmt_port, __be32 rmt_addr,
346 					     int dif)
347 {
348 	struct hlist_nulls_node *node;
349 	struct sock *s = sk;
350 	unsigned short hnum = ntohs(loc_port);
351 
352 	sk_nulls_for_each_from(s, node) {
353 		struct inet_sock *inet = inet_sk(s);
354 
355 		if (!net_eq(sock_net(s), net)				||
356 		    s->sk_hash != hnum					||
357 		    (inet->daddr && inet->daddr != rmt_addr)		||
358 		    (inet->dport != rmt_port && inet->dport)		||
359 		    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)	||
360 		    ipv6_only_sock(s)					||
361 		    (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
362 			continue;
363 		if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
364 			continue;
365 		goto found;
366 	}
367 	s = NULL;
368 found:
369 	return s;
370 }
371 
372 /*
373  * This routine is called by the ICMP module when it gets some
374  * sort of error condition.  If err < 0 then the socket should
375  * be closed and the error returned to the user.  If err > 0
376  * it's just the icmp type << 8 | icmp code.
377  * Header points to the ip header of the error packet. We move
378  * on past this. Then (as it used to claim before adjustment)
379  * header points to the first 8 bytes of the udp header.  We need
380  * to find the appropriate port.
381  */
382 
383 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
384 {
385 	struct inet_sock *inet;
386 	struct iphdr *iph = (struct iphdr*)skb->data;
387 	struct udphdr *uh = (struct udphdr*)(skb->data+(iph->ihl<<2));
388 	const int type = icmp_hdr(skb)->type;
389 	const int code = icmp_hdr(skb)->code;
390 	struct sock *sk;
391 	int harderr;
392 	int err;
393 	struct net *net = dev_net(skb->dev);
394 
395 	sk = __udp4_lib_lookup(net, iph->daddr, uh->dest,
396 			iph->saddr, uh->source, skb->dev->ifindex, udptable);
397 	if (sk == NULL) {
398 		ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
399 		return;	/* No socket for error */
400 	}
401 
402 	err = 0;
403 	harderr = 0;
404 	inet = inet_sk(sk);
405 
406 	switch (type) {
407 	default:
408 	case ICMP_TIME_EXCEEDED:
409 		err = EHOSTUNREACH;
410 		break;
411 	case ICMP_SOURCE_QUENCH:
412 		goto out;
413 	case ICMP_PARAMETERPROB:
414 		err = EPROTO;
415 		harderr = 1;
416 		break;
417 	case ICMP_DEST_UNREACH:
418 		if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
419 			if (inet->pmtudisc != IP_PMTUDISC_DONT) {
420 				err = EMSGSIZE;
421 				harderr = 1;
422 				break;
423 			}
424 			goto out;
425 		}
426 		err = EHOSTUNREACH;
427 		if (code <= NR_ICMP_UNREACH) {
428 			harderr = icmp_err_convert[code].fatal;
429 			err = icmp_err_convert[code].errno;
430 		}
431 		break;
432 	}
433 
434 	/*
435 	 *      RFC1122: OK.  Passes ICMP errors back to application, as per
436 	 *	4.1.3.3.
437 	 */
438 	if (!inet->recverr) {
439 		if (!harderr || sk->sk_state != TCP_ESTABLISHED)
440 			goto out;
441 	} else {
442 		ip_icmp_error(sk, skb, err, uh->dest, info, (u8*)(uh+1));
443 	}
444 	sk->sk_err = err;
445 	sk->sk_error_report(sk);
446 out:
447 	sock_put(sk);
448 }
449 
450 void udp_err(struct sk_buff *skb, u32 info)
451 {
452 	__udp4_lib_err(skb, info, &udp_table);
453 }
454 
455 /*
456  * Throw away all pending data and cancel the corking. Socket is locked.
457  */
458 void udp_flush_pending_frames(struct sock *sk)
459 {
460 	struct udp_sock *up = udp_sk(sk);
461 
462 	if (up->pending) {
463 		up->len = 0;
464 		up->pending = 0;
465 		ip_flush_pending_frames(sk);
466 	}
467 }
468 EXPORT_SYMBOL(udp_flush_pending_frames);
469 
470 /**
471  * 	udp4_hwcsum_outgoing  -  handle outgoing HW checksumming
472  * 	@sk: 	socket we are sending on
473  * 	@skb: 	sk_buff containing the filled-in UDP header
474  * 	        (checksum field must be zeroed out)
475  */
476 static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
477 				 __be32 src, __be32 dst, int len      )
478 {
479 	unsigned int offset;
480 	struct udphdr *uh = udp_hdr(skb);
481 	__wsum csum = 0;
482 
483 	if (skb_queue_len(&sk->sk_write_queue) == 1) {
484 		/*
485 		 * Only one fragment on the socket.
486 		 */
487 		skb->csum_start = skb_transport_header(skb) - skb->head;
488 		skb->csum_offset = offsetof(struct udphdr, check);
489 		uh->check = ~csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, 0);
490 	} else {
491 		/*
492 		 * HW-checksum won't work as there are two or more
493 		 * fragments on the socket so that all csums of sk_buffs
494 		 * should be together
495 		 */
496 		offset = skb_transport_offset(skb);
497 		skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
498 
499 		skb->ip_summed = CHECKSUM_NONE;
500 
501 		skb_queue_walk(&sk->sk_write_queue, skb) {
502 			csum = csum_add(csum, skb->csum);
503 		}
504 
505 		uh->check = csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, csum);
506 		if (uh->check == 0)
507 			uh->check = CSUM_MANGLED_0;
508 	}
509 }
510 
511 /*
512  * Push out all pending data as one UDP datagram. Socket is locked.
513  */
514 static int udp_push_pending_frames(struct sock *sk)
515 {
516 	struct udp_sock  *up = udp_sk(sk);
517 	struct inet_sock *inet = inet_sk(sk);
518 	struct flowi *fl = &inet->cork.fl;
519 	struct sk_buff *skb;
520 	struct udphdr *uh;
521 	int err = 0;
522 	int is_udplite = IS_UDPLITE(sk);
523 	__wsum csum = 0;
524 
525 	/* Grab the skbuff where UDP header space exists. */
526 	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
527 		goto out;
528 
529 	/*
530 	 * Create a UDP header
531 	 */
532 	uh = udp_hdr(skb);
533 	uh->source = fl->fl_ip_sport;
534 	uh->dest = fl->fl_ip_dport;
535 	uh->len = htons(up->len);
536 	uh->check = 0;
537 
538 	if (is_udplite)  				 /*     UDP-Lite      */
539 		csum  = udplite_csum_outgoing(sk, skb);
540 
541 	else if (sk->sk_no_check == UDP_CSUM_NOXMIT) {   /* UDP csum disabled */
542 
543 		skb->ip_summed = CHECKSUM_NONE;
544 		goto send;
545 
546 	} else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
547 
548 		udp4_hwcsum_outgoing(sk, skb, fl->fl4_src,fl->fl4_dst, up->len);
549 		goto send;
550 
551 	} else						 /*   `normal' UDP    */
552 		csum = udp_csum_outgoing(sk, skb);
553 
554 	/* add protocol-dependent pseudo-header */
555 	uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
556 				      sk->sk_protocol, csum             );
557 	if (uh->check == 0)
558 		uh->check = CSUM_MANGLED_0;
559 
560 send:
561 	err = ip_push_pending_frames(sk);
562 out:
563 	up->len = 0;
564 	up->pending = 0;
565 	if (!err)
566 		UDP_INC_STATS_USER(sock_net(sk),
567 				UDP_MIB_OUTDATAGRAMS, is_udplite);
568 	return err;
569 }
570 
571 int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
572 		size_t len)
573 {
574 	struct inet_sock *inet = inet_sk(sk);
575 	struct udp_sock *up = udp_sk(sk);
576 	int ulen = len;
577 	struct ipcm_cookie ipc;
578 	struct rtable *rt = NULL;
579 	int free = 0;
580 	int connected = 0;
581 	__be32 daddr, faddr, saddr;
582 	__be16 dport;
583 	u8  tos;
584 	int err, is_udplite = IS_UDPLITE(sk);
585 	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
586 	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
587 
588 	if (len > 0xFFFF)
589 		return -EMSGSIZE;
590 
591 	/*
592 	 *	Check the flags.
593 	 */
594 
595 	if (msg->msg_flags&MSG_OOB)	/* Mirror BSD error message compatibility */
596 		return -EOPNOTSUPP;
597 
598 	ipc.opt = NULL;
599 	ipc.shtx.flags = 0;
600 
601 	if (up->pending) {
602 		/*
603 		 * There are pending frames.
604 		 * The socket lock must be held while it's corked.
605 		 */
606 		lock_sock(sk);
607 		if (likely(up->pending)) {
608 			if (unlikely(up->pending != AF_INET)) {
609 				release_sock(sk);
610 				return -EINVAL;
611 			}
612 			goto do_append_data;
613 		}
614 		release_sock(sk);
615 	}
616 	ulen += sizeof(struct udphdr);
617 
618 	/*
619 	 *	Get and verify the address.
620 	 */
621 	if (msg->msg_name) {
622 		struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
623 		if (msg->msg_namelen < sizeof(*usin))
624 			return -EINVAL;
625 		if (usin->sin_family != AF_INET) {
626 			if (usin->sin_family != AF_UNSPEC)
627 				return -EAFNOSUPPORT;
628 		}
629 
630 		daddr = usin->sin_addr.s_addr;
631 		dport = usin->sin_port;
632 		if (dport == 0)
633 			return -EINVAL;
634 	} else {
635 		if (sk->sk_state != TCP_ESTABLISHED)
636 			return -EDESTADDRREQ;
637 		daddr = inet->daddr;
638 		dport = inet->dport;
639 		/* Open fast path for connected socket.
640 		   Route will not be used, if at least one option is set.
641 		 */
642 		connected = 1;
643 	}
644 	ipc.addr = inet->saddr;
645 
646 	ipc.oif = sk->sk_bound_dev_if;
647 	err = sock_tx_timestamp(msg, sk, &ipc.shtx);
648 	if (err)
649 		return err;
650 	if (msg->msg_controllen) {
651 		err = ip_cmsg_send(sock_net(sk), msg, &ipc);
652 		if (err)
653 			return err;
654 		if (ipc.opt)
655 			free = 1;
656 		connected = 0;
657 	}
658 	if (!ipc.opt)
659 		ipc.opt = inet->opt;
660 
661 	saddr = ipc.addr;
662 	ipc.addr = faddr = daddr;
663 
664 	if (ipc.opt && ipc.opt->srr) {
665 		if (!daddr)
666 			return -EINVAL;
667 		faddr = ipc.opt->faddr;
668 		connected = 0;
669 	}
670 	tos = RT_TOS(inet->tos);
671 	if (sock_flag(sk, SOCK_LOCALROUTE) ||
672 	    (msg->msg_flags & MSG_DONTROUTE) ||
673 	    (ipc.opt && ipc.opt->is_strictroute)) {
674 		tos |= RTO_ONLINK;
675 		connected = 0;
676 	}
677 
678 	if (ipv4_is_multicast(daddr)) {
679 		if (!ipc.oif)
680 			ipc.oif = inet->mc_index;
681 		if (!saddr)
682 			saddr = inet->mc_addr;
683 		connected = 0;
684 	}
685 
686 	if (connected)
687 		rt = (struct rtable*)sk_dst_check(sk, 0);
688 
689 	if (rt == NULL) {
690 		struct flowi fl = { .oif = ipc.oif,
691 				    .nl_u = { .ip4_u =
692 					      { .daddr = faddr,
693 						.saddr = saddr,
694 						.tos = tos } },
695 				    .proto = sk->sk_protocol,
696 				    .flags = inet_sk_flowi_flags(sk),
697 				    .uli_u = { .ports =
698 					       { .sport = inet->sport,
699 						 .dport = dport } } };
700 		struct net *net = sock_net(sk);
701 
702 		security_sk_classify_flow(sk, &fl);
703 		err = ip_route_output_flow(net, &rt, &fl, sk, 1);
704 		if (err) {
705 			if (err == -ENETUNREACH)
706 				IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
707 			goto out;
708 		}
709 
710 		err = -EACCES;
711 		if ((rt->rt_flags & RTCF_BROADCAST) &&
712 		    !sock_flag(sk, SOCK_BROADCAST))
713 			goto out;
714 		if (connected)
715 			sk_dst_set(sk, dst_clone(&rt->u.dst));
716 	}
717 
718 	if (msg->msg_flags&MSG_CONFIRM)
719 		goto do_confirm;
720 back_from_confirm:
721 
722 	saddr = rt->rt_src;
723 	if (!ipc.addr)
724 		daddr = ipc.addr = rt->rt_dst;
725 
726 	lock_sock(sk);
727 	if (unlikely(up->pending)) {
728 		/* The socket is already corked while preparing it. */
729 		/* ... which is an evident application bug. --ANK */
730 		release_sock(sk);
731 
732 		LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
733 		err = -EINVAL;
734 		goto out;
735 	}
736 	/*
737 	 *	Now cork the socket to pend data.
738 	 */
739 	inet->cork.fl.fl4_dst = daddr;
740 	inet->cork.fl.fl_ip_dport = dport;
741 	inet->cork.fl.fl4_src = saddr;
742 	inet->cork.fl.fl_ip_sport = inet->sport;
743 	up->pending = AF_INET;
744 
745 do_append_data:
746 	up->len += ulen;
747 	getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
748 	err = ip_append_data(sk, getfrag, msg->msg_iov, ulen,
749 			sizeof(struct udphdr), &ipc, &rt,
750 			corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
751 	if (err)
752 		udp_flush_pending_frames(sk);
753 	else if (!corkreq)
754 		err = udp_push_pending_frames(sk);
755 	else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
756 		up->pending = 0;
757 	release_sock(sk);
758 
759 out:
760 	ip_rt_put(rt);
761 	if (free)
762 		kfree(ipc.opt);
763 	if (!err)
764 		return len;
765 	/*
766 	 * ENOBUFS = no kernel mem, SOCK_NOSPACE = no sndbuf space.  Reporting
767 	 * ENOBUFS might not be good (it's not tunable per se), but otherwise
768 	 * we don't have a good statistic (IpOutDiscards but it can be too many
769 	 * things).  We could add another new stat but at least for now that
770 	 * seems like overkill.
771 	 */
772 	if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
773 		UDP_INC_STATS_USER(sock_net(sk),
774 				UDP_MIB_SNDBUFERRORS, is_udplite);
775 	}
776 	return err;
777 
778 do_confirm:
779 	dst_confirm(&rt->u.dst);
780 	if (!(msg->msg_flags&MSG_PROBE) || len)
781 		goto back_from_confirm;
782 	err = 0;
783 	goto out;
784 }
785 
786 int udp_sendpage(struct sock *sk, struct page *page, int offset,
787 		 size_t size, int flags)
788 {
789 	struct udp_sock *up = udp_sk(sk);
790 	int ret;
791 
792 	if (!up->pending) {
793 		struct msghdr msg = {	.msg_flags = flags|MSG_MORE };
794 
795 		/* Call udp_sendmsg to specify destination address which
796 		 * sendpage interface can't pass.
797 		 * This will succeed only when the socket is connected.
798 		 */
799 		ret = udp_sendmsg(NULL, sk, &msg, 0);
800 		if (ret < 0)
801 			return ret;
802 	}
803 
804 	lock_sock(sk);
805 
806 	if (unlikely(!up->pending)) {
807 		release_sock(sk);
808 
809 		LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 3\n");
810 		return -EINVAL;
811 	}
812 
813 	ret = ip_append_page(sk, page, offset, size, flags);
814 	if (ret == -EOPNOTSUPP) {
815 		release_sock(sk);
816 		return sock_no_sendpage(sk->sk_socket, page, offset,
817 					size, flags);
818 	}
819 	if (ret < 0) {
820 		udp_flush_pending_frames(sk);
821 		goto out;
822 	}
823 
824 	up->len += size;
825 	if (!(up->corkflag || (flags&MSG_MORE)))
826 		ret = udp_push_pending_frames(sk);
827 	if (!ret)
828 		ret = size;
829 out:
830 	release_sock(sk);
831 	return ret;
832 }
833 
834 /*
835  *	IOCTL requests applicable to the UDP protocol
836  */
837 
838 int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
839 {
840 	switch (cmd) {
841 	case SIOCOUTQ:
842 	{
843 		int amount = atomic_read(&sk->sk_wmem_alloc);
844 		return put_user(amount, (int __user *)arg);
845 	}
846 
847 	case SIOCINQ:
848 	{
849 		struct sk_buff *skb;
850 		unsigned long amount;
851 
852 		amount = 0;
853 		spin_lock_bh(&sk->sk_receive_queue.lock);
854 		skb = skb_peek(&sk->sk_receive_queue);
855 		if (skb != NULL) {
856 			/*
857 			 * We will only return the amount
858 			 * of this packet since that is all
859 			 * that will be read.
860 			 */
861 			amount = skb->len - sizeof(struct udphdr);
862 		}
863 		spin_unlock_bh(&sk->sk_receive_queue.lock);
864 		return put_user(amount, (int __user *)arg);
865 	}
866 
867 	default:
868 		return -ENOIOCTLCMD;
869 	}
870 
871 	return 0;
872 }
873 
874 /*
875  * 	This should be easy, if there is something there we
876  * 	return it, otherwise we block.
877  */
878 
879 int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
880 		size_t len, int noblock, int flags, int *addr_len)
881 {
882 	struct inet_sock *inet = inet_sk(sk);
883 	struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
884 	struct sk_buff *skb;
885 	unsigned int ulen, copied;
886 	int peeked;
887 	int err;
888 	int is_udplite = IS_UDPLITE(sk);
889 
890 	/*
891 	 *	Check any passed addresses
892 	 */
893 	if (addr_len)
894 		*addr_len=sizeof(*sin);
895 
896 	if (flags & MSG_ERRQUEUE)
897 		return ip_recv_error(sk, msg, len);
898 
899 try_again:
900 	skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
901 				  &peeked, &err);
902 	if (!skb)
903 		goto out;
904 
905 	ulen = skb->len - sizeof(struct udphdr);
906 	copied = len;
907 	if (copied > ulen)
908 		copied = ulen;
909 	else if (copied < ulen)
910 		msg->msg_flags |= MSG_TRUNC;
911 
912 	/*
913 	 * If checksum is needed at all, try to do it while copying the
914 	 * data.  If the data is truncated, or if we only want a partial
915 	 * coverage checksum (UDP-Lite), do it before the copy.
916 	 */
917 
918 	if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
919 		if (udp_lib_checksum_complete(skb))
920 			goto csum_copy_err;
921 	}
922 
923 	if (skb_csum_unnecessary(skb))
924 		err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
925 					      msg->msg_iov, copied       );
926 	else {
927 		err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
928 
929 		if (err == -EINVAL)
930 			goto csum_copy_err;
931 	}
932 
933 	if (err)
934 		goto out_free;
935 
936 	if (!peeked)
937 		UDP_INC_STATS_USER(sock_net(sk),
938 				UDP_MIB_INDATAGRAMS, is_udplite);
939 
940 	sock_recv_timestamp(msg, sk, skb);
941 
942 	/* Copy the address. */
943 	if (sin)
944 	{
945 		sin->sin_family = AF_INET;
946 		sin->sin_port = udp_hdr(skb)->source;
947 		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
948 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
949 	}
950 	if (inet->cmsg_flags)
951 		ip_cmsg_recv(msg, skb);
952 
953 	err = copied;
954 	if (flags & MSG_TRUNC)
955 		err = ulen;
956 
957 out_free:
958 	lock_sock(sk);
959 	skb_free_datagram(sk, skb);
960 	release_sock(sk);
961 out:
962 	return err;
963 
964 csum_copy_err:
965 	lock_sock(sk);
966 	if (!skb_kill_datagram(sk, skb, flags))
967 		UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
968 	release_sock(sk);
969 
970 	if (noblock)
971 		return -EAGAIN;
972 	goto try_again;
973 }
974 
975 
976 int udp_disconnect(struct sock *sk, int flags)
977 {
978 	struct inet_sock *inet = inet_sk(sk);
979 	/*
980 	 *	1003.1g - break association.
981 	 */
982 
983 	sk->sk_state = TCP_CLOSE;
984 	inet->daddr = 0;
985 	inet->dport = 0;
986 	sk->sk_bound_dev_if = 0;
987 	if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
988 		inet_reset_saddr(sk);
989 
990 	if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
991 		sk->sk_prot->unhash(sk);
992 		inet->sport = 0;
993 	}
994 	sk_dst_reset(sk);
995 	return 0;
996 }
997 
998 void udp_lib_unhash(struct sock *sk)
999 {
1000 	if (sk_hashed(sk)) {
1001 		struct udp_table *udptable = sk->sk_prot->h.udp_table;
1002 		unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
1003 		struct udp_hslot *hslot = &udptable->hash[hash];
1004 
1005 		spin_lock_bh(&hslot->lock);
1006 		if (sk_nulls_del_node_init_rcu(sk)) {
1007 			inet_sk(sk)->num = 0;
1008 			sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
1009 		}
1010 		spin_unlock_bh(&hslot->lock);
1011 	}
1012 }
1013 EXPORT_SYMBOL(udp_lib_unhash);
1014 
1015 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
1016 {
1017 	int is_udplite = IS_UDPLITE(sk);
1018 	int rc;
1019 
1020 	if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
1021 		/* Note that an ENOMEM error is charged twice */
1022 		if (rc == -ENOMEM) {
1023 			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
1024 					 is_udplite);
1025 			atomic_inc(&sk->sk_drops);
1026 		}
1027 		goto drop;
1028 	}
1029 
1030 	return 0;
1031 
1032 drop:
1033 	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
1034 	kfree_skb(skb);
1035 	return -1;
1036 }
1037 
1038 /* returns:
1039  *  -1: error
1040  *   0: success
1041  *  >0: "udp encap" protocol resubmission
1042  *
1043  * Note that in the success and error cases, the skb is assumed to
1044  * have either been requeued or freed.
1045  */
1046 int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
1047 {
1048 	struct udp_sock *up = udp_sk(sk);
1049 	int rc;
1050 	int is_udplite = IS_UDPLITE(sk);
1051 
1052 	/*
1053 	 *	Charge it to the socket, dropping if the queue is full.
1054 	 */
1055 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
1056 		goto drop;
1057 	nf_reset(skb);
1058 
1059 	if (up->encap_type) {
1060 		/*
1061 		 * This is an encapsulation socket so pass the skb to
1062 		 * the socket's udp_encap_rcv() hook. Otherwise, just
1063 		 * fall through and pass this up the UDP socket.
1064 		 * up->encap_rcv() returns the following value:
1065 		 * =0 if skb was successfully passed to the encap
1066 		 *    handler or was discarded by it.
1067 		 * >0 if skb should be passed on to UDP.
1068 		 * <0 if skb should be resubmitted as proto -N
1069 		 */
1070 
1071 		/* if we're overly short, let UDP handle it */
1072 		if (skb->len > sizeof(struct udphdr) &&
1073 		    up->encap_rcv != NULL) {
1074 			int ret;
1075 
1076 			ret = (*up->encap_rcv)(sk, skb);
1077 			if (ret <= 0) {
1078 				UDP_INC_STATS_BH(sock_net(sk),
1079 						 UDP_MIB_INDATAGRAMS,
1080 						 is_udplite);
1081 				return -ret;
1082 			}
1083 		}
1084 
1085 		/* FALLTHROUGH -- it's a UDP Packet */
1086 	}
1087 
1088 	/*
1089 	 * 	UDP-Lite specific tests, ignored on UDP sockets
1090 	 */
1091 	if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
1092 
1093 		/*
1094 		 * MIB statistics other than incrementing the error count are
1095 		 * disabled for the following two types of errors: these depend
1096 		 * on the application settings, not on the functioning of the
1097 		 * protocol stack as such.
1098 		 *
1099 		 * RFC 3828 here recommends (sec 3.3): "There should also be a
1100 		 * way ... to ... at least let the receiving application block
1101 		 * delivery of packets with coverage values less than a value
1102 		 * provided by the application."
1103 		 */
1104 		if (up->pcrlen == 0) {          /* full coverage was set  */
1105 			LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
1106 				"%d while full coverage %d requested\n",
1107 				UDP_SKB_CB(skb)->cscov, skb->len);
1108 			goto drop;
1109 		}
1110 		/* The next case involves violating the min. coverage requested
1111 		 * by the receiver. This is subtle: if receiver wants x and x is
1112 		 * greater than the buffersize/MTU then receiver will complain
1113 		 * that it wants x while sender emits packets of smaller size y.
1114 		 * Therefore the above ...()->partial_cov statement is essential.
1115 		 */
1116 		if (UDP_SKB_CB(skb)->cscov  <  up->pcrlen) {
1117 			LIMIT_NETDEBUG(KERN_WARNING
1118 				"UDPLITE: coverage %d too small, need min %d\n",
1119 				UDP_SKB_CB(skb)->cscov, up->pcrlen);
1120 			goto drop;
1121 		}
1122 	}
1123 
1124 	if (sk->sk_filter) {
1125 		if (udp_lib_checksum_complete(skb))
1126 			goto drop;
1127 	}
1128 
1129 	rc = 0;
1130 
1131 	bh_lock_sock(sk);
1132 	if (!sock_owned_by_user(sk))
1133 		rc = __udp_queue_rcv_skb(sk, skb);
1134 	else
1135 		sk_add_backlog(sk, skb);
1136 	bh_unlock_sock(sk);
1137 
1138 	return rc;
1139 
1140 drop:
1141 	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
1142 	kfree_skb(skb);
1143 	return -1;
1144 }
1145 
1146 /*
1147  *	Multicasts and broadcasts go to each listener.
1148  *
1149  *	Note: called only from the BH handler context,
1150  *	so we don't need to lock the hashes.
1151  */
1152 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
1153 				    struct udphdr  *uh,
1154 				    __be32 saddr, __be32 daddr,
1155 				    struct udp_table *udptable)
1156 {
1157 	struct sock *sk;
1158 	struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
1159 	int dif;
1160 
1161 	spin_lock(&hslot->lock);
1162 	sk = sk_nulls_head(&hslot->head);
1163 	dif = skb->dev->ifindex;
1164 	sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
1165 	if (sk) {
1166 		struct sock *sknext = NULL;
1167 
1168 		do {
1169 			struct sk_buff *skb1 = skb;
1170 
1171 			sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
1172 						   daddr, uh->source, saddr,
1173 						   dif);
1174 			if (sknext)
1175 				skb1 = skb_clone(skb, GFP_ATOMIC);
1176 
1177 			if (skb1) {
1178 				int ret = udp_queue_rcv_skb(sk, skb1);
1179 				if (ret > 0)
1180 					/* we should probably re-process instead
1181 					 * of dropping packets here. */
1182 					kfree_skb(skb1);
1183 			}
1184 			sk = sknext;
1185 		} while (sknext);
1186 	} else
1187 		consume_skb(skb);
1188 	spin_unlock(&hslot->lock);
1189 	return 0;
1190 }
1191 
1192 /* Initialize UDP checksum. If exited with zero value (success),
1193  * CHECKSUM_UNNECESSARY means, that no more checks are required.
1194  * Otherwise, csum completion requires chacksumming packet body,
1195  * including udp header and folding it to skb->csum.
1196  */
1197 static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
1198 				 int proto)
1199 {
1200 	const struct iphdr *iph;
1201 	int err;
1202 
1203 	UDP_SKB_CB(skb)->partial_cov = 0;
1204 	UDP_SKB_CB(skb)->cscov = skb->len;
1205 
1206 	if (proto == IPPROTO_UDPLITE) {
1207 		err = udplite_checksum_init(skb, uh);
1208 		if (err)
1209 			return err;
1210 	}
1211 
1212 	iph = ip_hdr(skb);
1213 	if (uh->check == 0) {
1214 		skb->ip_summed = CHECKSUM_UNNECESSARY;
1215 	} else if (skb->ip_summed == CHECKSUM_COMPLETE) {
1216 	       if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
1217 				      proto, skb->csum))
1218 			skb->ip_summed = CHECKSUM_UNNECESSARY;
1219 	}
1220 	if (!skb_csum_unnecessary(skb))
1221 		skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
1222 					       skb->len, proto, 0);
1223 	/* Probably, we should checksum udp header (it should be in cache
1224 	 * in any case) and data in tiny packets (< rx copybreak).
1225 	 */
1226 
1227 	return 0;
1228 }
1229 
1230 /*
1231  *	All we need to do is get the socket, and then do a checksum.
1232  */
1233 
1234 int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
1235 		   int proto)
1236 {
1237 	struct sock *sk;
1238 	struct udphdr *uh;
1239 	unsigned short ulen;
1240 	struct rtable *rt = (struct rtable*)skb->dst;
1241 	__be32 saddr, daddr;
1242 	struct net *net = dev_net(skb->dev);
1243 
1244 	/*
1245 	 *  Validate the packet.
1246 	 */
1247 	if (!pskb_may_pull(skb, sizeof(struct udphdr)))
1248 		goto drop;		/* No space for header. */
1249 
1250 	uh   = udp_hdr(skb);
1251 	ulen = ntohs(uh->len);
1252 	if (ulen > skb->len)
1253 		goto short_packet;
1254 
1255 	if (proto == IPPROTO_UDP) {
1256 		/* UDP validates ulen. */
1257 		if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
1258 			goto short_packet;
1259 		uh = udp_hdr(skb);
1260 	}
1261 
1262 	if (udp4_csum_init(skb, uh, proto))
1263 		goto csum_error;
1264 
1265 	saddr = ip_hdr(skb)->saddr;
1266 	daddr = ip_hdr(skb)->daddr;
1267 
1268 	if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
1269 		return __udp4_lib_mcast_deliver(net, skb, uh,
1270 				saddr, daddr, udptable);
1271 
1272 	sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
1273 
1274 	if (sk != NULL) {
1275 		int ret = udp_queue_rcv_skb(sk, skb);
1276 		sock_put(sk);
1277 
1278 		/* a return value > 0 means to resubmit the input, but
1279 		 * it wants the return to be -protocol, or 0
1280 		 */
1281 		if (ret > 0)
1282 			return -ret;
1283 		return 0;
1284 	}
1285 
1286 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
1287 		goto drop;
1288 	nf_reset(skb);
1289 
1290 	/* No socket. Drop packet silently, if checksum is wrong */
1291 	if (udp_lib_checksum_complete(skb))
1292 		goto csum_error;
1293 
1294 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
1295 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
1296 
1297 	/*
1298 	 * Hmm.  We got an UDP packet to a port to which we
1299 	 * don't wanna listen.  Ignore it.
1300 	 */
1301 	kfree_skb(skb);
1302 	return 0;
1303 
1304 short_packet:
1305 	LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %pI4:%u %d/%d to %pI4:%u\n",
1306 		       proto == IPPROTO_UDPLITE ? "-Lite" : "",
1307 		       &saddr,
1308 		       ntohs(uh->source),
1309 		       ulen,
1310 		       skb->len,
1311 		       &daddr,
1312 		       ntohs(uh->dest));
1313 	goto drop;
1314 
1315 csum_error:
1316 	/*
1317 	 * RFC1122: OK.  Discards the bad packet silently (as far as
1318 	 * the network is concerned, anyway) as per 4.1.3.4 (MUST).
1319 	 */
1320 	LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %pI4:%u to %pI4:%u ulen %d\n",
1321 		       proto == IPPROTO_UDPLITE ? "-Lite" : "",
1322 		       &saddr,
1323 		       ntohs(uh->source),
1324 		       &daddr,
1325 		       ntohs(uh->dest),
1326 		       ulen);
1327 drop:
1328 	UDP_INC_STATS_BH(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
1329 	kfree_skb(skb);
1330 	return 0;
1331 }
1332 
1333 int udp_rcv(struct sk_buff *skb)
1334 {
1335 	return __udp4_lib_rcv(skb, &udp_table, IPPROTO_UDP);
1336 }
1337 
1338 void udp_destroy_sock(struct sock *sk)
1339 {
1340 	lock_sock(sk);
1341 	udp_flush_pending_frames(sk);
1342 	release_sock(sk);
1343 }
1344 
1345 /*
1346  *	Socket option code for UDP
1347  */
1348 int udp_lib_setsockopt(struct sock *sk, int level, int optname,
1349 		       char __user *optval, int optlen,
1350 		       int (*push_pending_frames)(struct sock *))
1351 {
1352 	struct udp_sock *up = udp_sk(sk);
1353 	int val;
1354 	int err = 0;
1355 	int is_udplite = IS_UDPLITE(sk);
1356 
1357 	if (optlen<sizeof(int))
1358 		return -EINVAL;
1359 
1360 	if (get_user(val, (int __user *)optval))
1361 		return -EFAULT;
1362 
1363 	switch (optname) {
1364 	case UDP_CORK:
1365 		if (val != 0) {
1366 			up->corkflag = 1;
1367 		} else {
1368 			up->corkflag = 0;
1369 			lock_sock(sk);
1370 			(*push_pending_frames)(sk);
1371 			release_sock(sk);
1372 		}
1373 		break;
1374 
1375 	case UDP_ENCAP:
1376 		switch (val) {
1377 		case 0:
1378 		case UDP_ENCAP_ESPINUDP:
1379 		case UDP_ENCAP_ESPINUDP_NON_IKE:
1380 			up->encap_rcv = xfrm4_udp_encap_rcv;
1381 			/* FALLTHROUGH */
1382 		case UDP_ENCAP_L2TPINUDP:
1383 			up->encap_type = val;
1384 			break;
1385 		default:
1386 			err = -ENOPROTOOPT;
1387 			break;
1388 		}
1389 		break;
1390 
1391 	/*
1392 	 * 	UDP-Lite's partial checksum coverage (RFC 3828).
1393 	 */
1394 	/* The sender sets actual checksum coverage length via this option.
1395 	 * The case coverage > packet length is handled by send module. */
1396 	case UDPLITE_SEND_CSCOV:
1397 		if (!is_udplite)         /* Disable the option on UDP sockets */
1398 			return -ENOPROTOOPT;
1399 		if (val != 0 && val < 8) /* Illegal coverage: use default (8) */
1400 			val = 8;
1401 		else if (val > USHORT_MAX)
1402 			val = USHORT_MAX;
1403 		up->pcslen = val;
1404 		up->pcflag |= UDPLITE_SEND_CC;
1405 		break;
1406 
1407 	/* The receiver specifies a minimum checksum coverage value. To make
1408 	 * sense, this should be set to at least 8 (as done below). If zero is
1409 	 * used, this again means full checksum coverage.                     */
1410 	case UDPLITE_RECV_CSCOV:
1411 		if (!is_udplite)         /* Disable the option on UDP sockets */
1412 			return -ENOPROTOOPT;
1413 		if (val != 0 && val < 8) /* Avoid silly minimal values.       */
1414 			val = 8;
1415 		else if (val > USHORT_MAX)
1416 			val = USHORT_MAX;
1417 		up->pcrlen = val;
1418 		up->pcflag |= UDPLITE_RECV_CC;
1419 		break;
1420 
1421 	default:
1422 		err = -ENOPROTOOPT;
1423 		break;
1424 	}
1425 
1426 	return err;
1427 }
1428 
1429 int udp_setsockopt(struct sock *sk, int level, int optname,
1430 		   char __user *optval, int optlen)
1431 {
1432 	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1433 		return udp_lib_setsockopt(sk, level, optname, optval, optlen,
1434 					  udp_push_pending_frames);
1435 	return ip_setsockopt(sk, level, optname, optval, optlen);
1436 }
1437 
1438 #ifdef CONFIG_COMPAT
1439 int compat_udp_setsockopt(struct sock *sk, int level, int optname,
1440 			  char __user *optval, int optlen)
1441 {
1442 	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1443 		return udp_lib_setsockopt(sk, level, optname, optval, optlen,
1444 					  udp_push_pending_frames);
1445 	return compat_ip_setsockopt(sk, level, optname, optval, optlen);
1446 }
1447 #endif
1448 
1449 int udp_lib_getsockopt(struct sock *sk, int level, int optname,
1450 		       char __user *optval, int __user *optlen)
1451 {
1452 	struct udp_sock *up = udp_sk(sk);
1453 	int val, len;
1454 
1455 	if (get_user(len,optlen))
1456 		return -EFAULT;
1457 
1458 	len = min_t(unsigned int, len, sizeof(int));
1459 
1460 	if (len < 0)
1461 		return -EINVAL;
1462 
1463 	switch (optname) {
1464 	case UDP_CORK:
1465 		val = up->corkflag;
1466 		break;
1467 
1468 	case UDP_ENCAP:
1469 		val = up->encap_type;
1470 		break;
1471 
1472 	/* The following two cannot be changed on UDP sockets, the return is
1473 	 * always 0 (which corresponds to the full checksum coverage of UDP). */
1474 	case UDPLITE_SEND_CSCOV:
1475 		val = up->pcslen;
1476 		break;
1477 
1478 	case UDPLITE_RECV_CSCOV:
1479 		val = up->pcrlen;
1480 		break;
1481 
1482 	default:
1483 		return -ENOPROTOOPT;
1484 	}
1485 
1486 	if (put_user(len, optlen))
1487 		return -EFAULT;
1488 	if (copy_to_user(optval, &val,len))
1489 		return -EFAULT;
1490 	return 0;
1491 }
1492 
1493 int udp_getsockopt(struct sock *sk, int level, int optname,
1494 		   char __user *optval, int __user *optlen)
1495 {
1496 	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1497 		return udp_lib_getsockopt(sk, level, optname, optval, optlen);
1498 	return ip_getsockopt(sk, level, optname, optval, optlen);
1499 }
1500 
1501 #ifdef CONFIG_COMPAT
1502 int compat_udp_getsockopt(struct sock *sk, int level, int optname,
1503 				 char __user *optval, int __user *optlen)
1504 {
1505 	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1506 		return udp_lib_getsockopt(sk, level, optname, optval, optlen);
1507 	return compat_ip_getsockopt(sk, level, optname, optval, optlen);
1508 }
1509 #endif
1510 /**
1511  * 	udp_poll - wait for a UDP event.
1512  *	@file - file struct
1513  *	@sock - socket
1514  *	@wait - poll table
1515  *
1516  *	This is same as datagram poll, except for the special case of
1517  *	blocking sockets. If application is using a blocking fd
1518  *	and a packet with checksum error is in the queue;
1519  *	then it could get return from select indicating data available
1520  *	but then block when reading it. Add special case code
1521  *	to work around these arguably broken applications.
1522  */
1523 unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
1524 {
1525 	unsigned int mask = datagram_poll(file, sock, wait);
1526 	struct sock *sk = sock->sk;
1527 	int 	is_lite = IS_UDPLITE(sk);
1528 
1529 	/* Check for false positives due to checksum errors */
1530 	if ( (mask & POLLRDNORM) &&
1531 	     !(file->f_flags & O_NONBLOCK) &&
1532 	     !(sk->sk_shutdown & RCV_SHUTDOWN)){
1533 		struct sk_buff_head *rcvq = &sk->sk_receive_queue;
1534 		struct sk_buff *skb;
1535 
1536 		spin_lock_bh(&rcvq->lock);
1537 		while ((skb = skb_peek(rcvq)) != NULL &&
1538 		       udp_lib_checksum_complete(skb)) {
1539 			UDP_INC_STATS_BH(sock_net(sk),
1540 					UDP_MIB_INERRORS, is_lite);
1541 			__skb_unlink(skb, rcvq);
1542 			kfree_skb(skb);
1543 		}
1544 		spin_unlock_bh(&rcvq->lock);
1545 
1546 		/* nothing to see, move along */
1547 		if (skb == NULL)
1548 			mask &= ~(POLLIN | POLLRDNORM);
1549 	}
1550 
1551 	return mask;
1552 
1553 }
1554 
1555 struct proto udp_prot = {
1556 	.name		   = "UDP",
1557 	.owner		   = THIS_MODULE,
1558 	.close		   = udp_lib_close,
1559 	.connect	   = ip4_datagram_connect,
1560 	.disconnect	   = udp_disconnect,
1561 	.ioctl		   = udp_ioctl,
1562 	.destroy	   = udp_destroy_sock,
1563 	.setsockopt	   = udp_setsockopt,
1564 	.getsockopt	   = udp_getsockopt,
1565 	.sendmsg	   = udp_sendmsg,
1566 	.recvmsg	   = udp_recvmsg,
1567 	.sendpage	   = udp_sendpage,
1568 	.backlog_rcv	   = __udp_queue_rcv_skb,
1569 	.hash		   = udp_lib_hash,
1570 	.unhash		   = udp_lib_unhash,
1571 	.get_port	   = udp_v4_get_port,
1572 	.memory_allocated  = &udp_memory_allocated,
1573 	.sysctl_mem	   = sysctl_udp_mem,
1574 	.sysctl_wmem	   = &sysctl_udp_wmem_min,
1575 	.sysctl_rmem	   = &sysctl_udp_rmem_min,
1576 	.obj_size	   = sizeof(struct udp_sock),
1577 	.slab_flags	   = SLAB_DESTROY_BY_RCU,
1578 	.h.udp_table	   = &udp_table,
1579 #ifdef CONFIG_COMPAT
1580 	.compat_setsockopt = compat_udp_setsockopt,
1581 	.compat_getsockopt = compat_udp_getsockopt,
1582 #endif
1583 };
1584 
1585 /* ------------------------------------------------------------------------ */
1586 #ifdef CONFIG_PROC_FS
1587 
1588 static struct sock *udp_get_first(struct seq_file *seq, int start)
1589 {
1590 	struct sock *sk;
1591 	struct udp_iter_state *state = seq->private;
1592 	struct net *net = seq_file_net(seq);
1593 
1594 	for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
1595 		struct hlist_nulls_node *node;
1596 		struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
1597 		spin_lock_bh(&hslot->lock);
1598 		sk_nulls_for_each(sk, node, &hslot->head) {
1599 			if (!net_eq(sock_net(sk), net))
1600 				continue;
1601 			if (sk->sk_family == state->family)
1602 				goto found;
1603 		}
1604 		spin_unlock_bh(&hslot->lock);
1605 	}
1606 	sk = NULL;
1607 found:
1608 	return sk;
1609 }
1610 
1611 static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
1612 {
1613 	struct udp_iter_state *state = seq->private;
1614 	struct net *net = seq_file_net(seq);
1615 
1616 	do {
1617 		sk = sk_nulls_next(sk);
1618 	} while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
1619 
1620 	if (!sk) {
1621 		if (state->bucket < UDP_HTABLE_SIZE)
1622 			spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
1623 		return udp_get_first(seq, state->bucket + 1);
1624 	}
1625 	return sk;
1626 }
1627 
1628 static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
1629 {
1630 	struct sock *sk = udp_get_first(seq, 0);
1631 
1632 	if (sk)
1633 		while (pos && (sk = udp_get_next(seq, sk)) != NULL)
1634 			--pos;
1635 	return pos ? NULL : sk;
1636 }
1637 
1638 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
1639 {
1640 	struct udp_iter_state *state = seq->private;
1641 	state->bucket = UDP_HTABLE_SIZE;
1642 
1643 	return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
1644 }
1645 
1646 static void *udp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1647 {
1648 	struct sock *sk;
1649 
1650 	if (v == SEQ_START_TOKEN)
1651 		sk = udp_get_idx(seq, 0);
1652 	else
1653 		sk = udp_get_next(seq, v);
1654 
1655 	++*pos;
1656 	return sk;
1657 }
1658 
1659 static void udp_seq_stop(struct seq_file *seq, void *v)
1660 {
1661 	struct udp_iter_state *state = seq->private;
1662 
1663 	if (state->bucket < UDP_HTABLE_SIZE)
1664 		spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
1665 }
1666 
1667 static int udp_seq_open(struct inode *inode, struct file *file)
1668 {
1669 	struct udp_seq_afinfo *afinfo = PDE(inode)->data;
1670 	struct udp_iter_state *s;
1671 	int err;
1672 
1673 	err = seq_open_net(inode, file, &afinfo->seq_ops,
1674 			   sizeof(struct udp_iter_state));
1675 	if (err < 0)
1676 		return err;
1677 
1678 	s = ((struct seq_file *)file->private_data)->private;
1679 	s->family		= afinfo->family;
1680 	s->udp_table		= afinfo->udp_table;
1681 	return err;
1682 }
1683 
1684 /* ------------------------------------------------------------------------ */
1685 int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
1686 {
1687 	struct proc_dir_entry *p;
1688 	int rc = 0;
1689 
1690 	afinfo->seq_fops.open		= udp_seq_open;
1691 	afinfo->seq_fops.read		= seq_read;
1692 	afinfo->seq_fops.llseek		= seq_lseek;
1693 	afinfo->seq_fops.release	= seq_release_net;
1694 
1695 	afinfo->seq_ops.start		= udp_seq_start;
1696 	afinfo->seq_ops.next		= udp_seq_next;
1697 	afinfo->seq_ops.stop		= udp_seq_stop;
1698 
1699 	p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
1700 			     &afinfo->seq_fops, afinfo);
1701 	if (!p)
1702 		rc = -ENOMEM;
1703 	return rc;
1704 }
1705 
1706 void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
1707 {
1708 	proc_net_remove(net, afinfo->name);
1709 }
1710 
1711 /* ------------------------------------------------------------------------ */
1712 static void udp4_format_sock(struct sock *sp, struct seq_file *f,
1713 		int bucket, int *len)
1714 {
1715 	struct inet_sock *inet = inet_sk(sp);
1716 	__be32 dest = inet->daddr;
1717 	__be32 src  = inet->rcv_saddr;
1718 	__u16 destp	  = ntohs(inet->dport);
1719 	__u16 srcp	  = ntohs(inet->sport);
1720 
1721 	seq_printf(f, "%4d: %08X:%04X %08X:%04X"
1722 		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
1723 		bucket, src, srcp, dest, destp, sp->sk_state,
1724 		atomic_read(&sp->sk_wmem_alloc),
1725 		atomic_read(&sp->sk_rmem_alloc),
1726 		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
1727 		atomic_read(&sp->sk_refcnt), sp,
1728 		atomic_read(&sp->sk_drops), len);
1729 }
1730 
1731 int udp4_seq_show(struct seq_file *seq, void *v)
1732 {
1733 	if (v == SEQ_START_TOKEN)
1734 		seq_printf(seq, "%-127s\n",
1735 			   "  sl  local_address rem_address   st tx_queue "
1736 			   "rx_queue tr tm->when retrnsmt   uid  timeout "
1737 			   "inode ref pointer drops");
1738 	else {
1739 		struct udp_iter_state *state = seq->private;
1740 		int len;
1741 
1742 		udp4_format_sock(v, seq, state->bucket, &len);
1743 		seq_printf(seq, "%*s\n", 127 - len ,"");
1744 	}
1745 	return 0;
1746 }
1747 
1748 /* ------------------------------------------------------------------------ */
1749 static struct udp_seq_afinfo udp4_seq_afinfo = {
1750 	.name		= "udp",
1751 	.family		= AF_INET,
1752 	.udp_table	= &udp_table,
1753 	.seq_fops	= {
1754 		.owner	=	THIS_MODULE,
1755 	},
1756 	.seq_ops	= {
1757 		.show		= udp4_seq_show,
1758 	},
1759 };
1760 
1761 static int udp4_proc_init_net(struct net *net)
1762 {
1763 	return udp_proc_register(net, &udp4_seq_afinfo);
1764 }
1765 
1766 static void udp4_proc_exit_net(struct net *net)
1767 {
1768 	udp_proc_unregister(net, &udp4_seq_afinfo);
1769 }
1770 
1771 static struct pernet_operations udp4_net_ops = {
1772 	.init = udp4_proc_init_net,
1773 	.exit = udp4_proc_exit_net,
1774 };
1775 
1776 int __init udp4_proc_init(void)
1777 {
1778 	return register_pernet_subsys(&udp4_net_ops);
1779 }
1780 
1781 void udp4_proc_exit(void)
1782 {
1783 	unregister_pernet_subsys(&udp4_net_ops);
1784 }
1785 #endif /* CONFIG_PROC_FS */
1786 
1787 void __init udp_table_init(struct udp_table *table)
1788 {
1789 	int i;
1790 
1791 	for (i = 0; i < UDP_HTABLE_SIZE; i++) {
1792 		INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
1793 		spin_lock_init(&table->hash[i].lock);
1794 	}
1795 }
1796 
1797 void __init udp_init(void)
1798 {
1799 	unsigned long nr_pages, limit;
1800 
1801 	udp_table_init(&udp_table);
1802 	/* Set the pressure threshold up by the same strategy of TCP. It is a
1803 	 * fraction of global memory that is up to 1/2 at 256 MB, decreasing
1804 	 * toward zero with the amount of memory, with a floor of 128 pages.
1805 	 */
1806 	nr_pages = totalram_pages - totalhigh_pages;
1807 	limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
1808 	limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
1809 	limit = max(limit, 128UL);
1810 	sysctl_udp_mem[0] = limit / 4 * 3;
1811 	sysctl_udp_mem[1] = limit;
1812 	sysctl_udp_mem[2] = sysctl_udp_mem[0] * 2;
1813 
1814 	sysctl_udp_rmem_min = SK_MEM_QUANTUM;
1815 	sysctl_udp_wmem_min = SK_MEM_QUANTUM;
1816 }
1817 
1818 EXPORT_SYMBOL(udp_disconnect);
1819 EXPORT_SYMBOL(udp_ioctl);
1820 EXPORT_SYMBOL(udp_prot);
1821 EXPORT_SYMBOL(udp_sendmsg);
1822 EXPORT_SYMBOL(udp_lib_getsockopt);
1823 EXPORT_SYMBOL(udp_lib_setsockopt);
1824 EXPORT_SYMBOL(udp_poll);
1825 EXPORT_SYMBOL(udp_lib_get_port);
1826 EXPORT_SYMBOL(ipv4_rcv_saddr_equal);
1827 
1828 #ifdef CONFIG_PROC_FS
1829 EXPORT_SYMBOL(udp_proc_register);
1830 EXPORT_SYMBOL(udp_proc_unregister);
1831 #endif
1832