xref: /openbmc/linux/net/socket.c (revision d198b34f3855eee2571dda03eea75a09c7c31480)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * NET		An implementation of the SOCKET network access protocol.
4  *
5  * Version:	@(#)socket.c	1.1.93	18/02/95
6  *
7  * Authors:	Orest Zborowski, <obz@Kodak.COM>
8  *		Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *
11  * Fixes:
12  *		Anonymous	:	NOTSOCK/BADF cleanup. Error fix in
13  *					shutdown()
14  *		Alan Cox	:	verify_area() fixes
15  *		Alan Cox	:	Removed DDI
16  *		Jonathan Kamens	:	SOCK_DGRAM reconnect bug
17  *		Alan Cox	:	Moved a load of checks to the very
18  *					top level.
19  *		Alan Cox	:	Move address structures to/from user
20  *					mode above the protocol layers.
21  *		Rob Janssen	:	Allow 0 length sends.
22  *		Alan Cox	:	Asynchronous I/O support (cribbed from the
23  *					tty drivers).
24  *		Niibe Yutaka	:	Asynchronous I/O for writes (4.4BSD style)
25  *		Jeff Uphoff	:	Made max number of sockets command-line
26  *					configurable.
27  *		Matti Aarnio	:	Made the number of sockets dynamic,
28  *					to be allocated when needed, and mr.
29  *					Uphoff's max is used as max to be
30  *					allowed to allocate.
31  *		Linus		:	Argh. removed all the socket allocation
32  *					altogether: it's in the inode now.
33  *		Alan Cox	:	Made sock_alloc()/sock_release() public
34  *					for NetROM and future kernel nfsd type
35  *					stuff.
36  *		Alan Cox	:	sendmsg/recvmsg basics.
37  *		Tom Dyas	:	Export net symbols.
38  *		Marcin Dalecki	:	Fixed problems with CONFIG_NET="n".
39  *		Alan Cox	:	Added thread locking to sys_* calls
40  *					for sockets. May have errors at the
41  *					moment.
42  *		Kevin Buhr	:	Fixed the dumb errors in the above.
43  *		Andi Kleen	:	Some small cleanups, optimizations,
44  *					and fixed a copy_from_user() bug.
45  *		Tigran Aivazian	:	sys_send(args) calls sys_sendto(args, NULL, 0)
46  *		Tigran Aivazian	:	Made listen(2) backlog sanity checks
47  *					protocol-independent
48  *
49  *	This module is effectively the top level interface to the BSD socket
50  *	paradigm.
51  *
52  *	Based upon Swansea University Computer Society NET3.039
53  */
54 
55 #include <linux/mm.h>
56 #include <linux/socket.h>
57 #include <linux/file.h>
58 #include <linux/net.h>
59 #include <linux/interrupt.h>
60 #include <linux/thread_info.h>
61 #include <linux/rcupdate.h>
62 #include <linux/netdevice.h>
63 #include <linux/proc_fs.h>
64 #include <linux/seq_file.h>
65 #include <linux/mutex.h>
66 #include <linux/if_bridge.h>
67 #include <linux/if_frad.h>
68 #include <linux/if_vlan.h>
69 #include <linux/ptp_classify.h>
70 #include <linux/init.h>
71 #include <linux/poll.h>
72 #include <linux/cache.h>
73 #include <linux/module.h>
74 #include <linux/highmem.h>
75 #include <linux/mount.h>
76 #include <linux/pseudo_fs.h>
77 #include <linux/security.h>
78 #include <linux/syscalls.h>
79 #include <linux/compat.h>
80 #include <linux/kmod.h>
81 #include <linux/audit.h>
82 #include <linux/wireless.h>
83 #include <linux/nsproxy.h>
84 #include <linux/magic.h>
85 #include <linux/slab.h>
86 #include <linux/xattr.h>
87 #include <linux/nospec.h>
88 #include <linux/indirect_call_wrapper.h>
89 
90 #include <linux/uaccess.h>
91 #include <asm/unistd.h>
92 
93 #include <net/compat.h>
94 #include <net/wext.h>
95 #include <net/cls_cgroup.h>
96 
97 #include <net/sock.h>
98 #include <linux/netfilter.h>
99 
100 #include <linux/if_tun.h>
101 #include <linux/ipv6_route.h>
102 #include <linux/route.h>
103 #include <linux/termios.h>
104 #include <linux/sockios.h>
105 #include <net/busy_poll.h>
106 #include <linux/errqueue.h>
107 
108 #ifdef CONFIG_NET_RX_BUSY_POLL
109 unsigned int sysctl_net_busy_read __read_mostly;
110 unsigned int sysctl_net_busy_poll __read_mostly;
111 #endif
112 
113 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
114 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
115 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
116 
117 static int sock_close(struct inode *inode, struct file *file);
118 static __poll_t sock_poll(struct file *file,
119 			      struct poll_table_struct *wait);
120 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
121 #ifdef CONFIG_COMPAT
122 static long compat_sock_ioctl(struct file *file,
123 			      unsigned int cmd, unsigned long arg);
124 #endif
125 static int sock_fasync(int fd, struct file *filp, int on);
126 static ssize_t sock_sendpage(struct file *file, struct page *page,
127 			     int offset, size_t size, loff_t *ppos, int more);
128 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
129 				struct pipe_inode_info *pipe, size_t len,
130 				unsigned int flags);
131 
132 #ifdef CONFIG_PROC_FS
133 static void sock_show_fdinfo(struct seq_file *m, struct file *f)
134 {
135 	struct socket *sock = f->private_data;
136 
137 	if (sock->ops->show_fdinfo)
138 		sock->ops->show_fdinfo(m, sock);
139 }
140 #else
141 #define sock_show_fdinfo NULL
142 #endif
143 
144 /*
145  *	Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
146  *	in the operation structures but are done directly via the socketcall() multiplexor.
147  */
148 
149 static const struct file_operations socket_file_ops = {
150 	.owner =	THIS_MODULE,
151 	.llseek =	no_llseek,
152 	.read_iter =	sock_read_iter,
153 	.write_iter =	sock_write_iter,
154 	.poll =		sock_poll,
155 	.unlocked_ioctl = sock_ioctl,
156 #ifdef CONFIG_COMPAT
157 	.compat_ioctl = compat_sock_ioctl,
158 #endif
159 	.mmap =		sock_mmap,
160 	.release =	sock_close,
161 	.fasync =	sock_fasync,
162 	.sendpage =	sock_sendpage,
163 	.splice_write = generic_splice_sendpage,
164 	.splice_read =	sock_splice_read,
165 	.show_fdinfo =	sock_show_fdinfo,
166 };
167 
168 /*
169  *	The protocol list. Each protocol is registered in here.
170  */
171 
172 static DEFINE_SPINLOCK(net_family_lock);
173 static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
174 
175 /*
176  * Support routines.
177  * Move socket addresses back and forth across the kernel/user
178  * divide and look after the messy bits.
179  */
180 
181 /**
182  *	move_addr_to_kernel	-	copy a socket address into kernel space
183  *	@uaddr: Address in user space
184  *	@kaddr: Address in kernel space
185  *	@ulen: Length in user space
186  *
187  *	The address is copied into kernel space. If the provided address is
188  *	too long an error code of -EINVAL is returned. If the copy gives
189  *	invalid addresses -EFAULT is returned. On a success 0 is returned.
190  */
191 
192 int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
193 {
194 	if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
195 		return -EINVAL;
196 	if (ulen == 0)
197 		return 0;
198 	if (copy_from_user(kaddr, uaddr, ulen))
199 		return -EFAULT;
200 	return audit_sockaddr(ulen, kaddr);
201 }
202 
203 /**
204  *	move_addr_to_user	-	copy an address to user space
205  *	@kaddr: kernel space address
206  *	@klen: length of address in kernel
207  *	@uaddr: user space address
208  *	@ulen: pointer to user length field
209  *
210  *	The value pointed to by ulen on entry is the buffer length available.
211  *	This is overwritten with the buffer space used. -EINVAL is returned
212  *	if an overlong buffer is specified or a negative buffer size. -EFAULT
213  *	is returned if either the buffer or the length field are not
214  *	accessible.
215  *	After copying the data up to the limit the user specifies, the true
216  *	length of the data is written over the length limit the user
217  *	specified. Zero is returned for a success.
218  */
219 
220 static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
221 			     void __user *uaddr, int __user *ulen)
222 {
223 	int err;
224 	int len;
225 
226 	BUG_ON(klen > sizeof(struct sockaddr_storage));
227 	err = get_user(len, ulen);
228 	if (err)
229 		return err;
230 	if (len > klen)
231 		len = klen;
232 	if (len < 0)
233 		return -EINVAL;
234 	if (len) {
235 		if (audit_sockaddr(klen, kaddr))
236 			return -ENOMEM;
237 		if (copy_to_user(uaddr, kaddr, len))
238 			return -EFAULT;
239 	}
240 	/*
241 	 *      "fromlen shall refer to the value before truncation.."
242 	 *                      1003.1g
243 	 */
244 	return __put_user(klen, ulen);
245 }
246 
247 static struct kmem_cache *sock_inode_cachep __ro_after_init;
248 
249 static struct inode *sock_alloc_inode(struct super_block *sb)
250 {
251 	struct socket_alloc *ei;
252 
253 	ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
254 	if (!ei)
255 		return NULL;
256 	init_waitqueue_head(&ei->socket.wq.wait);
257 	ei->socket.wq.fasync_list = NULL;
258 	ei->socket.wq.flags = 0;
259 
260 	ei->socket.state = SS_UNCONNECTED;
261 	ei->socket.flags = 0;
262 	ei->socket.ops = NULL;
263 	ei->socket.sk = NULL;
264 	ei->socket.file = NULL;
265 
266 	return &ei->vfs_inode;
267 }
268 
269 static void sock_free_inode(struct inode *inode)
270 {
271 	struct socket_alloc *ei;
272 
273 	ei = container_of(inode, struct socket_alloc, vfs_inode);
274 	kmem_cache_free(sock_inode_cachep, ei);
275 }
276 
277 static void init_once(void *foo)
278 {
279 	struct socket_alloc *ei = (struct socket_alloc *)foo;
280 
281 	inode_init_once(&ei->vfs_inode);
282 }
283 
284 static void init_inodecache(void)
285 {
286 	sock_inode_cachep = kmem_cache_create("sock_inode_cache",
287 					      sizeof(struct socket_alloc),
288 					      0,
289 					      (SLAB_HWCACHE_ALIGN |
290 					       SLAB_RECLAIM_ACCOUNT |
291 					       SLAB_MEM_SPREAD | SLAB_ACCOUNT),
292 					      init_once);
293 	BUG_ON(sock_inode_cachep == NULL);
294 }
295 
296 static const struct super_operations sockfs_ops = {
297 	.alloc_inode	= sock_alloc_inode,
298 	.free_inode	= sock_free_inode,
299 	.statfs		= simple_statfs,
300 };
301 
302 /*
303  * sockfs_dname() is called from d_path().
304  */
305 static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
306 {
307 	return dynamic_dname(dentry, buffer, buflen, "socket:[%lu]",
308 				d_inode(dentry)->i_ino);
309 }
310 
311 static const struct dentry_operations sockfs_dentry_operations = {
312 	.d_dname  = sockfs_dname,
313 };
314 
315 static int sockfs_xattr_get(const struct xattr_handler *handler,
316 			    struct dentry *dentry, struct inode *inode,
317 			    const char *suffix, void *value, size_t size)
318 {
319 	if (value) {
320 		if (dentry->d_name.len + 1 > size)
321 			return -ERANGE;
322 		memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
323 	}
324 	return dentry->d_name.len + 1;
325 }
326 
327 #define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
328 #define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
329 #define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)
330 
331 static const struct xattr_handler sockfs_xattr_handler = {
332 	.name = XATTR_NAME_SOCKPROTONAME,
333 	.get = sockfs_xattr_get,
334 };
335 
336 static int sockfs_security_xattr_set(const struct xattr_handler *handler,
337 				     struct dentry *dentry, struct inode *inode,
338 				     const char *suffix, const void *value,
339 				     size_t size, int flags)
340 {
341 	/* Handled by LSM. */
342 	return -EAGAIN;
343 }
344 
345 static const struct xattr_handler sockfs_security_xattr_handler = {
346 	.prefix = XATTR_SECURITY_PREFIX,
347 	.set = sockfs_security_xattr_set,
348 };
349 
350 static const struct xattr_handler *sockfs_xattr_handlers[] = {
351 	&sockfs_xattr_handler,
352 	&sockfs_security_xattr_handler,
353 	NULL
354 };
355 
356 static int sockfs_init_fs_context(struct fs_context *fc)
357 {
358 	struct pseudo_fs_context *ctx = init_pseudo(fc, SOCKFS_MAGIC);
359 	if (!ctx)
360 		return -ENOMEM;
361 	ctx->ops = &sockfs_ops;
362 	ctx->dops = &sockfs_dentry_operations;
363 	ctx->xattr = sockfs_xattr_handlers;
364 	return 0;
365 }
366 
367 static struct vfsmount *sock_mnt __read_mostly;
368 
369 static struct file_system_type sock_fs_type = {
370 	.name =		"sockfs",
371 	.init_fs_context = sockfs_init_fs_context,
372 	.kill_sb =	kill_anon_super,
373 };
374 
375 /*
376  *	Obtains the first available file descriptor and sets it up for use.
377  *
378  *	These functions create file structures and maps them to fd space
379  *	of the current process. On success it returns file descriptor
380  *	and file struct implicitly stored in sock->file.
381  *	Note that another thread may close file descriptor before we return
382  *	from this function. We use the fact that now we do not refer
383  *	to socket after mapping. If one day we will need it, this
384  *	function will increment ref. count on file by 1.
385  *
386  *	In any case returned fd MAY BE not valid!
387  *	This race condition is unavoidable
388  *	with shared fd spaces, we cannot solve it inside kernel,
389  *	but we take care of internal coherence yet.
390  */
391 
392 /**
393  *	sock_alloc_file - Bind a &socket to a &file
394  *	@sock: socket
395  *	@flags: file status flags
396  *	@dname: protocol name
397  *
398  *	Returns the &file bound with @sock, implicitly storing it
399  *	in sock->file. If dname is %NULL, sets to "".
400  *	On failure the return is a ERR pointer (see linux/err.h).
401  *	This function uses GFP_KERNEL internally.
402  */
403 
404 struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
405 {
406 	struct file *file;
407 
408 	if (!dname)
409 		dname = sock->sk ? sock->sk->sk_prot_creator->name : "";
410 
411 	file = alloc_file_pseudo(SOCK_INODE(sock), sock_mnt, dname,
412 				O_RDWR | (flags & O_NONBLOCK),
413 				&socket_file_ops);
414 	if (IS_ERR(file)) {
415 		sock_release(sock);
416 		return file;
417 	}
418 
419 	sock->file = file;
420 	file->private_data = sock;
421 	stream_open(SOCK_INODE(sock), file);
422 	return file;
423 }
424 EXPORT_SYMBOL(sock_alloc_file);
425 
426 static int sock_map_fd(struct socket *sock, int flags)
427 {
428 	struct file *newfile;
429 	int fd = get_unused_fd_flags(flags);
430 	if (unlikely(fd < 0)) {
431 		sock_release(sock);
432 		return fd;
433 	}
434 
435 	newfile = sock_alloc_file(sock, flags, NULL);
436 	if (!IS_ERR(newfile)) {
437 		fd_install(fd, newfile);
438 		return fd;
439 	}
440 
441 	put_unused_fd(fd);
442 	return PTR_ERR(newfile);
443 }
444 
445 /**
446  *	sock_from_file - Return the &socket bounded to @file.
447  *	@file: file
448  *	@err: pointer to an error code return
449  *
450  *	On failure returns %NULL and assigns -ENOTSOCK to @err.
451  */
452 
453 struct socket *sock_from_file(struct file *file, int *err)
454 {
455 	if (file->f_op == &socket_file_ops)
456 		return file->private_data;	/* set in sock_map_fd */
457 
458 	*err = -ENOTSOCK;
459 	return NULL;
460 }
461 EXPORT_SYMBOL(sock_from_file);
462 
463 /**
464  *	sockfd_lookup - Go from a file number to its socket slot
465  *	@fd: file handle
466  *	@err: pointer to an error code return
467  *
468  *	The file handle passed in is locked and the socket it is bound
469  *	to is returned. If an error occurs the err pointer is overwritten
470  *	with a negative errno code and NULL is returned. The function checks
471  *	for both invalid handles and passing a handle which is not a socket.
472  *
473  *	On a success the socket object pointer is returned.
474  */
475 
476 struct socket *sockfd_lookup(int fd, int *err)
477 {
478 	struct file *file;
479 	struct socket *sock;
480 
481 	file = fget(fd);
482 	if (!file) {
483 		*err = -EBADF;
484 		return NULL;
485 	}
486 
487 	sock = sock_from_file(file, err);
488 	if (!sock)
489 		fput(file);
490 	return sock;
491 }
492 EXPORT_SYMBOL(sockfd_lookup);
493 
494 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
495 {
496 	struct fd f = fdget(fd);
497 	struct socket *sock;
498 
499 	*err = -EBADF;
500 	if (f.file) {
501 		sock = sock_from_file(f.file, err);
502 		if (likely(sock)) {
503 			*fput_needed = f.flags;
504 			return sock;
505 		}
506 		fdput(f);
507 	}
508 	return NULL;
509 }
510 
511 static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
512 				size_t size)
513 {
514 	ssize_t len;
515 	ssize_t used = 0;
516 
517 	len = security_inode_listsecurity(d_inode(dentry), buffer, size);
518 	if (len < 0)
519 		return len;
520 	used += len;
521 	if (buffer) {
522 		if (size < used)
523 			return -ERANGE;
524 		buffer += len;
525 	}
526 
527 	len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
528 	used += len;
529 	if (buffer) {
530 		if (size < used)
531 			return -ERANGE;
532 		memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
533 		buffer += len;
534 	}
535 
536 	return used;
537 }
538 
539 static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
540 {
541 	int err = simple_setattr(dentry, iattr);
542 
543 	if (!err && (iattr->ia_valid & ATTR_UID)) {
544 		struct socket *sock = SOCKET_I(d_inode(dentry));
545 
546 		if (sock->sk)
547 			sock->sk->sk_uid = iattr->ia_uid;
548 		else
549 			err = -ENOENT;
550 	}
551 
552 	return err;
553 }
554 
555 static const struct inode_operations sockfs_inode_ops = {
556 	.listxattr = sockfs_listxattr,
557 	.setattr = sockfs_setattr,
558 };
559 
560 /**
561  *	sock_alloc - allocate a socket
562  *
563  *	Allocate a new inode and socket object. The two are bound together
564  *	and initialised. The socket is then returned. If we are out of inodes
565  *	NULL is returned. This functions uses GFP_KERNEL internally.
566  */
567 
568 struct socket *sock_alloc(void)
569 {
570 	struct inode *inode;
571 	struct socket *sock;
572 
573 	inode = new_inode_pseudo(sock_mnt->mnt_sb);
574 	if (!inode)
575 		return NULL;
576 
577 	sock = SOCKET_I(inode);
578 
579 	inode->i_ino = get_next_ino();
580 	inode->i_mode = S_IFSOCK | S_IRWXUGO;
581 	inode->i_uid = current_fsuid();
582 	inode->i_gid = current_fsgid();
583 	inode->i_op = &sockfs_inode_ops;
584 
585 	return sock;
586 }
587 EXPORT_SYMBOL(sock_alloc);
588 
589 /**
590  *	sock_release - close a socket
591  *	@sock: socket to close
592  *
593  *	The socket is released from the protocol stack if it has a release
594  *	callback, and the inode is then released if the socket is bound to
595  *	an inode not a file.
596  */
597 
598 static void __sock_release(struct socket *sock, struct inode *inode)
599 {
600 	if (sock->ops) {
601 		struct module *owner = sock->ops->owner;
602 
603 		if (inode)
604 			inode_lock(inode);
605 		sock->ops->release(sock);
606 		sock->sk = NULL;
607 		if (inode)
608 			inode_unlock(inode);
609 		sock->ops = NULL;
610 		module_put(owner);
611 	}
612 
613 	if (sock->wq.fasync_list)
614 		pr_err("%s: fasync list not empty!\n", __func__);
615 
616 	if (!sock->file) {
617 		iput(SOCK_INODE(sock));
618 		return;
619 	}
620 	sock->file = NULL;
621 }
622 
623 void sock_release(struct socket *sock)
624 {
625 	__sock_release(sock, NULL);
626 }
627 EXPORT_SYMBOL(sock_release);
628 
629 void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
630 {
631 	u8 flags = *tx_flags;
632 
633 	if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE)
634 		flags |= SKBTX_HW_TSTAMP;
635 
636 	if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
637 		flags |= SKBTX_SW_TSTAMP;
638 
639 	if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
640 		flags |= SKBTX_SCHED_TSTAMP;
641 
642 	*tx_flags = flags;
643 }
644 EXPORT_SYMBOL(__sock_tx_timestamp);
645 
646 INDIRECT_CALLABLE_DECLARE(int inet_sendmsg(struct socket *, struct msghdr *,
647 					   size_t));
648 INDIRECT_CALLABLE_DECLARE(int inet6_sendmsg(struct socket *, struct msghdr *,
649 					    size_t));
650 static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
651 {
652 	int ret = INDIRECT_CALL_INET(sock->ops->sendmsg, inet6_sendmsg,
653 				     inet_sendmsg, sock, msg,
654 				     msg_data_left(msg));
655 	BUG_ON(ret == -EIOCBQUEUED);
656 	return ret;
657 }
658 
659 /**
660  *	sock_sendmsg - send a message through @sock
661  *	@sock: socket
662  *	@msg: message to send
663  *
664  *	Sends @msg through @sock, passing through LSM.
665  *	Returns the number of bytes sent, or an error code.
666  */
667 int sock_sendmsg(struct socket *sock, struct msghdr *msg)
668 {
669 	int err = security_socket_sendmsg(sock, msg,
670 					  msg_data_left(msg));
671 
672 	return err ?: sock_sendmsg_nosec(sock, msg);
673 }
674 EXPORT_SYMBOL(sock_sendmsg);
675 
676 /**
677  *	kernel_sendmsg - send a message through @sock (kernel-space)
678  *	@sock: socket
679  *	@msg: message header
680  *	@vec: kernel vec
681  *	@num: vec array length
682  *	@size: total message data size
683  *
684  *	Builds the message data with @vec and sends it through @sock.
685  *	Returns the number of bytes sent, or an error code.
686  */
687 
688 int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
689 		   struct kvec *vec, size_t num, size_t size)
690 {
691 	iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size);
692 	return sock_sendmsg(sock, msg);
693 }
694 EXPORT_SYMBOL(kernel_sendmsg);
695 
696 /**
697  *	kernel_sendmsg_locked - send a message through @sock (kernel-space)
698  *	@sk: sock
699  *	@msg: message header
700  *	@vec: output s/g array
701  *	@num: output s/g array length
702  *	@size: total message data size
703  *
704  *	Builds the message data with @vec and sends it through @sock.
705  *	Returns the number of bytes sent, or an error code.
706  *	Caller must hold @sk.
707  */
708 
709 int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
710 			  struct kvec *vec, size_t num, size_t size)
711 {
712 	struct socket *sock = sk->sk_socket;
713 
714 	if (!sock->ops->sendmsg_locked)
715 		return sock_no_sendmsg_locked(sk, msg, size);
716 
717 	iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size);
718 
719 	return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg));
720 }
721 EXPORT_SYMBOL(kernel_sendmsg_locked);
722 
723 static bool skb_is_err_queue(const struct sk_buff *skb)
724 {
725 	/* pkt_type of skbs enqueued on the error queue are set to
726 	 * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
727 	 * in recvmsg, since skbs received on a local socket will never
728 	 * have a pkt_type of PACKET_OUTGOING.
729 	 */
730 	return skb->pkt_type == PACKET_OUTGOING;
731 }
732 
733 /* On transmit, software and hardware timestamps are returned independently.
734  * As the two skb clones share the hardware timestamp, which may be updated
735  * before the software timestamp is received, a hardware TX timestamp may be
736  * returned only if there is no software TX timestamp. Ignore false software
737  * timestamps, which may be made in the __sock_recv_timestamp() call when the
738  * option SO_TIMESTAMP_OLD(NS) is enabled on the socket, even when the skb has a
739  * hardware timestamp.
740  */
741 static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp)
742 {
743 	return skb->tstamp && !false_tstamp && skb_is_err_queue(skb);
744 }
745 
746 static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb)
747 {
748 	struct scm_ts_pktinfo ts_pktinfo;
749 	struct net_device *orig_dev;
750 
751 	if (!skb_mac_header_was_set(skb))
752 		return;
753 
754 	memset(&ts_pktinfo, 0, sizeof(ts_pktinfo));
755 
756 	rcu_read_lock();
757 	orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
758 	if (orig_dev)
759 		ts_pktinfo.if_index = orig_dev->ifindex;
760 	rcu_read_unlock();
761 
762 	ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb);
763 	put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
764 		 sizeof(ts_pktinfo), &ts_pktinfo);
765 }
766 
767 /*
768  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
769  */
770 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
771 	struct sk_buff *skb)
772 {
773 	int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
774 	int new_tstamp = sock_flag(sk, SOCK_TSTAMP_NEW);
775 	struct scm_timestamping_internal tss;
776 
777 	int empty = 1, false_tstamp = 0;
778 	struct skb_shared_hwtstamps *shhwtstamps =
779 		skb_hwtstamps(skb);
780 
781 	/* Race occurred between timestamp enabling and packet
782 	   receiving.  Fill in the current time for now. */
783 	if (need_software_tstamp && skb->tstamp == 0) {
784 		__net_timestamp(skb);
785 		false_tstamp = 1;
786 	}
787 
788 	if (need_software_tstamp) {
789 		if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
790 			if (new_tstamp) {
791 				struct __kernel_sock_timeval tv;
792 
793 				skb_get_new_timestamp(skb, &tv);
794 				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_NEW,
795 					 sizeof(tv), &tv);
796 			} else {
797 				struct __kernel_old_timeval tv;
798 
799 				skb_get_timestamp(skb, &tv);
800 				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_OLD,
801 					 sizeof(tv), &tv);
802 			}
803 		} else {
804 			if (new_tstamp) {
805 				struct __kernel_timespec ts;
806 
807 				skb_get_new_timestampns(skb, &ts);
808 				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_NEW,
809 					 sizeof(ts), &ts);
810 			} else {
811 				struct __kernel_old_timespec ts;
812 
813 				skb_get_timestampns(skb, &ts);
814 				put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_OLD,
815 					 sizeof(ts), &ts);
816 			}
817 		}
818 	}
819 
820 	memset(&tss, 0, sizeof(tss));
821 	if ((sk->sk_tsflags & SOF_TIMESTAMPING_SOFTWARE) &&
822 	    ktime_to_timespec64_cond(skb->tstamp, tss.ts + 0))
823 		empty = 0;
824 	if (shhwtstamps &&
825 	    (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE) &&
826 	    !skb_is_swtx_tstamp(skb, false_tstamp) &&
827 	    ktime_to_timespec64_cond(shhwtstamps->hwtstamp, tss.ts + 2)) {
828 		empty = 0;
829 		if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) &&
830 		    !skb_is_err_queue(skb))
831 			put_ts_pktinfo(msg, skb);
832 	}
833 	if (!empty) {
834 		if (sock_flag(sk, SOCK_TSTAMP_NEW))
835 			put_cmsg_scm_timestamping64(msg, &tss);
836 		else
837 			put_cmsg_scm_timestamping(msg, &tss);
838 
839 		if (skb_is_err_queue(skb) && skb->len &&
840 		    SKB_EXT_ERR(skb)->opt_stats)
841 			put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
842 				 skb->len, skb->data);
843 	}
844 }
845 EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
846 
847 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
848 	struct sk_buff *skb)
849 {
850 	int ack;
851 
852 	if (!sock_flag(sk, SOCK_WIFI_STATUS))
853 		return;
854 	if (!skb->wifi_acked_valid)
855 		return;
856 
857 	ack = skb->wifi_acked;
858 
859 	put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
860 }
861 EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
862 
863 static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
864 				   struct sk_buff *skb)
865 {
866 	if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
867 		put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
868 			sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
869 }
870 
871 void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
872 	struct sk_buff *skb)
873 {
874 	sock_recv_timestamp(msg, sk, skb);
875 	sock_recv_drops(msg, sk, skb);
876 }
877 EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
878 
879 INDIRECT_CALLABLE_DECLARE(int inet_recvmsg(struct socket *, struct msghdr *,
880 					   size_t, int));
881 INDIRECT_CALLABLE_DECLARE(int inet6_recvmsg(struct socket *, struct msghdr *,
882 					    size_t, int));
883 static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
884 				     int flags)
885 {
886 	return INDIRECT_CALL_INET(sock->ops->recvmsg, inet6_recvmsg,
887 				  inet_recvmsg, sock, msg, msg_data_left(msg),
888 				  flags);
889 }
890 
891 /**
892  *	sock_recvmsg - receive a message from @sock
893  *	@sock: socket
894  *	@msg: message to receive
895  *	@flags: message flags
896  *
897  *	Receives @msg from @sock, passing through LSM. Returns the total number
898  *	of bytes received, or an error.
899  */
900 int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
901 {
902 	int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);
903 
904 	return err ?: sock_recvmsg_nosec(sock, msg, flags);
905 }
906 EXPORT_SYMBOL(sock_recvmsg);
907 
908 /**
909  *	kernel_recvmsg - Receive a message from a socket (kernel space)
910  *	@sock: The socket to receive the message from
911  *	@msg: Received message
912  *	@vec: Input s/g array for message data
913  *	@num: Size of input s/g array
914  *	@size: Number of bytes to read
915  *	@flags: Message flags (MSG_DONTWAIT, etc...)
916  *
917  *	On return the msg structure contains the scatter/gather array passed in the
918  *	vec argument. The array is modified so that it consists of the unfilled
919  *	portion of the original array.
920  *
921  *	The returned value is the total number of bytes received, or an error.
922  */
923 
924 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
925 		   struct kvec *vec, size_t num, size_t size, int flags)
926 {
927 	mm_segment_t oldfs = get_fs();
928 	int result;
929 
930 	iov_iter_kvec(&msg->msg_iter, READ, vec, num, size);
931 	set_fs(KERNEL_DS);
932 	result = sock_recvmsg(sock, msg, flags);
933 	set_fs(oldfs);
934 	return result;
935 }
936 EXPORT_SYMBOL(kernel_recvmsg);
937 
938 static ssize_t sock_sendpage(struct file *file, struct page *page,
939 			     int offset, size_t size, loff_t *ppos, int more)
940 {
941 	struct socket *sock;
942 	int flags;
943 
944 	sock = file->private_data;
945 
946 	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
947 	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
948 	flags |= more;
949 
950 	return kernel_sendpage(sock, page, offset, size, flags);
951 }
952 
953 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
954 				struct pipe_inode_info *pipe, size_t len,
955 				unsigned int flags)
956 {
957 	struct socket *sock = file->private_data;
958 
959 	if (unlikely(!sock->ops->splice_read))
960 		return generic_file_splice_read(file, ppos, pipe, len, flags);
961 
962 	return sock->ops->splice_read(sock, ppos, pipe, len, flags);
963 }
964 
965 static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
966 {
967 	struct file *file = iocb->ki_filp;
968 	struct socket *sock = file->private_data;
969 	struct msghdr msg = {.msg_iter = *to,
970 			     .msg_iocb = iocb};
971 	ssize_t res;
972 
973 	if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
974 		msg.msg_flags = MSG_DONTWAIT;
975 
976 	if (iocb->ki_pos != 0)
977 		return -ESPIPE;
978 
979 	if (!iov_iter_count(to))	/* Match SYS5 behaviour */
980 		return 0;
981 
982 	res = sock_recvmsg(sock, &msg, msg.msg_flags);
983 	*to = msg.msg_iter;
984 	return res;
985 }
986 
987 static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
988 {
989 	struct file *file = iocb->ki_filp;
990 	struct socket *sock = file->private_data;
991 	struct msghdr msg = {.msg_iter = *from,
992 			     .msg_iocb = iocb};
993 	ssize_t res;
994 
995 	if (iocb->ki_pos != 0)
996 		return -ESPIPE;
997 
998 	if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
999 		msg.msg_flags = MSG_DONTWAIT;
1000 
1001 	if (sock->type == SOCK_SEQPACKET)
1002 		msg.msg_flags |= MSG_EOR;
1003 
1004 	res = sock_sendmsg(sock, &msg);
1005 	*from = msg.msg_iter;
1006 	return res;
1007 }
1008 
1009 /*
1010  * Atomic setting of ioctl hooks to avoid race
1011  * with module unload.
1012  */
1013 
1014 static DEFINE_MUTEX(br_ioctl_mutex);
1015 static int (*br_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg);
1016 
1017 void brioctl_set(int (*hook) (struct net *, unsigned int, void __user *))
1018 {
1019 	mutex_lock(&br_ioctl_mutex);
1020 	br_ioctl_hook = hook;
1021 	mutex_unlock(&br_ioctl_mutex);
1022 }
1023 EXPORT_SYMBOL(brioctl_set);
1024 
1025 static DEFINE_MUTEX(vlan_ioctl_mutex);
1026 static int (*vlan_ioctl_hook) (struct net *, void __user *arg);
1027 
1028 void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
1029 {
1030 	mutex_lock(&vlan_ioctl_mutex);
1031 	vlan_ioctl_hook = hook;
1032 	mutex_unlock(&vlan_ioctl_mutex);
1033 }
1034 EXPORT_SYMBOL(vlan_ioctl_set);
1035 
1036 static DEFINE_MUTEX(dlci_ioctl_mutex);
1037 static int (*dlci_ioctl_hook) (unsigned int, void __user *);
1038 
1039 void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
1040 {
1041 	mutex_lock(&dlci_ioctl_mutex);
1042 	dlci_ioctl_hook = hook;
1043 	mutex_unlock(&dlci_ioctl_mutex);
1044 }
1045 EXPORT_SYMBOL(dlci_ioctl_set);
1046 
1047 static long sock_do_ioctl(struct net *net, struct socket *sock,
1048 			  unsigned int cmd, unsigned long arg)
1049 {
1050 	int err;
1051 	void __user *argp = (void __user *)arg;
1052 
1053 	err = sock->ops->ioctl(sock, cmd, arg);
1054 
1055 	/*
1056 	 * If this ioctl is unknown try to hand it down
1057 	 * to the NIC driver.
1058 	 */
1059 	if (err != -ENOIOCTLCMD)
1060 		return err;
1061 
1062 	if (cmd == SIOCGIFCONF) {
1063 		struct ifconf ifc;
1064 		if (copy_from_user(&ifc, argp, sizeof(struct ifconf)))
1065 			return -EFAULT;
1066 		rtnl_lock();
1067 		err = dev_ifconf(net, &ifc, sizeof(struct ifreq));
1068 		rtnl_unlock();
1069 		if (!err && copy_to_user(argp, &ifc, sizeof(struct ifconf)))
1070 			err = -EFAULT;
1071 	} else {
1072 		struct ifreq ifr;
1073 		bool need_copyout;
1074 		if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
1075 			return -EFAULT;
1076 		err = dev_ioctl(net, cmd, &ifr, &need_copyout);
1077 		if (!err && need_copyout)
1078 			if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
1079 				return -EFAULT;
1080 	}
1081 	return err;
1082 }
1083 
1084 /*
1085  *	With an ioctl, arg may well be a user mode pointer, but we don't know
1086  *	what to do with it - that's up to the protocol still.
1087  */
1088 
1089 /**
1090  *	get_net_ns - increment the refcount of the network namespace
1091  *	@ns: common namespace (net)
1092  *
1093  *	Returns the net's common namespace.
1094  */
1095 
1096 struct ns_common *get_net_ns(struct ns_common *ns)
1097 {
1098 	return &get_net(container_of(ns, struct net, ns))->ns;
1099 }
1100 EXPORT_SYMBOL_GPL(get_net_ns);
1101 
1102 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
1103 {
1104 	struct socket *sock;
1105 	struct sock *sk;
1106 	void __user *argp = (void __user *)arg;
1107 	int pid, err;
1108 	struct net *net;
1109 
1110 	sock = file->private_data;
1111 	sk = sock->sk;
1112 	net = sock_net(sk);
1113 	if (unlikely(cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))) {
1114 		struct ifreq ifr;
1115 		bool need_copyout;
1116 		if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
1117 			return -EFAULT;
1118 		err = dev_ioctl(net, cmd, &ifr, &need_copyout);
1119 		if (!err && need_copyout)
1120 			if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
1121 				return -EFAULT;
1122 	} else
1123 #ifdef CONFIG_WEXT_CORE
1124 	if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
1125 		err = wext_handle_ioctl(net, cmd, argp);
1126 	} else
1127 #endif
1128 		switch (cmd) {
1129 		case FIOSETOWN:
1130 		case SIOCSPGRP:
1131 			err = -EFAULT;
1132 			if (get_user(pid, (int __user *)argp))
1133 				break;
1134 			err = f_setown(sock->file, pid, 1);
1135 			break;
1136 		case FIOGETOWN:
1137 		case SIOCGPGRP:
1138 			err = put_user(f_getown(sock->file),
1139 				       (int __user *)argp);
1140 			break;
1141 		case SIOCGIFBR:
1142 		case SIOCSIFBR:
1143 		case SIOCBRADDBR:
1144 		case SIOCBRDELBR:
1145 			err = -ENOPKG;
1146 			if (!br_ioctl_hook)
1147 				request_module("bridge");
1148 
1149 			mutex_lock(&br_ioctl_mutex);
1150 			if (br_ioctl_hook)
1151 				err = br_ioctl_hook(net, cmd, argp);
1152 			mutex_unlock(&br_ioctl_mutex);
1153 			break;
1154 		case SIOCGIFVLAN:
1155 		case SIOCSIFVLAN:
1156 			err = -ENOPKG;
1157 			if (!vlan_ioctl_hook)
1158 				request_module("8021q");
1159 
1160 			mutex_lock(&vlan_ioctl_mutex);
1161 			if (vlan_ioctl_hook)
1162 				err = vlan_ioctl_hook(net, argp);
1163 			mutex_unlock(&vlan_ioctl_mutex);
1164 			break;
1165 		case SIOCADDDLCI:
1166 		case SIOCDELDLCI:
1167 			err = -ENOPKG;
1168 			if (!dlci_ioctl_hook)
1169 				request_module("dlci");
1170 
1171 			mutex_lock(&dlci_ioctl_mutex);
1172 			if (dlci_ioctl_hook)
1173 				err = dlci_ioctl_hook(cmd, argp);
1174 			mutex_unlock(&dlci_ioctl_mutex);
1175 			break;
1176 		case SIOCGSKNS:
1177 			err = -EPERM;
1178 			if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1179 				break;
1180 
1181 			err = open_related_ns(&net->ns, get_net_ns);
1182 			break;
1183 		case SIOCGSTAMP_OLD:
1184 		case SIOCGSTAMPNS_OLD:
1185 			if (!sock->ops->gettstamp) {
1186 				err = -ENOIOCTLCMD;
1187 				break;
1188 			}
1189 			err = sock->ops->gettstamp(sock, argp,
1190 						   cmd == SIOCGSTAMP_OLD,
1191 						   !IS_ENABLED(CONFIG_64BIT));
1192 			break;
1193 		case SIOCGSTAMP_NEW:
1194 		case SIOCGSTAMPNS_NEW:
1195 			if (!sock->ops->gettstamp) {
1196 				err = -ENOIOCTLCMD;
1197 				break;
1198 			}
1199 			err = sock->ops->gettstamp(sock, argp,
1200 						   cmd == SIOCGSTAMP_NEW,
1201 						   false);
1202 			break;
1203 		default:
1204 			err = sock_do_ioctl(net, sock, cmd, arg);
1205 			break;
1206 		}
1207 	return err;
1208 }
1209 
1210 /**
1211  *	sock_create_lite - creates a socket
1212  *	@family: protocol family (AF_INET, ...)
1213  *	@type: communication type (SOCK_STREAM, ...)
1214  *	@protocol: protocol (0, ...)
1215  *	@res: new socket
1216  *
1217  *	Creates a new socket and assigns it to @res, passing through LSM.
1218  *	The new socket initialization is not complete, see kernel_accept().
1219  *	Returns 0 or an error. On failure @res is set to %NULL.
1220  *	This function internally uses GFP_KERNEL.
1221  */
1222 
1223 int sock_create_lite(int family, int type, int protocol, struct socket **res)
1224 {
1225 	int err;
1226 	struct socket *sock = NULL;
1227 
1228 	err = security_socket_create(family, type, protocol, 1);
1229 	if (err)
1230 		goto out;
1231 
1232 	sock = sock_alloc();
1233 	if (!sock) {
1234 		err = -ENOMEM;
1235 		goto out;
1236 	}
1237 
1238 	sock->type = type;
1239 	err = security_socket_post_create(sock, family, type, protocol, 1);
1240 	if (err)
1241 		goto out_release;
1242 
1243 out:
1244 	*res = sock;
1245 	return err;
1246 out_release:
1247 	sock_release(sock);
1248 	sock = NULL;
1249 	goto out;
1250 }
1251 EXPORT_SYMBOL(sock_create_lite);
1252 
1253 /* No kernel lock held - perfect */
1254 static __poll_t sock_poll(struct file *file, poll_table *wait)
1255 {
1256 	struct socket *sock = file->private_data;
1257 	__poll_t events = poll_requested_events(wait), flag = 0;
1258 
1259 	if (!sock->ops->poll)
1260 		return 0;
1261 
1262 	if (sk_can_busy_loop(sock->sk)) {
1263 		/* poll once if requested by the syscall */
1264 		if (events & POLL_BUSY_LOOP)
1265 			sk_busy_loop(sock->sk, 1);
1266 
1267 		/* if this socket can poll_ll, tell the system call */
1268 		flag = POLL_BUSY_LOOP;
1269 	}
1270 
1271 	return sock->ops->poll(file, sock, wait) | flag;
1272 }
1273 
1274 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
1275 {
1276 	struct socket *sock = file->private_data;
1277 
1278 	return sock->ops->mmap(file, sock, vma);
1279 }
1280 
1281 static int sock_close(struct inode *inode, struct file *filp)
1282 {
1283 	__sock_release(SOCKET_I(inode), inode);
1284 	return 0;
1285 }
1286 
1287 /*
1288  *	Update the socket async list
1289  *
1290  *	Fasync_list locking strategy.
1291  *
1292  *	1. fasync_list is modified only under process context socket lock
1293  *	   i.e. under semaphore.
1294  *	2. fasync_list is used under read_lock(&sk->sk_callback_lock)
1295  *	   or under socket lock
1296  */
1297 
1298 static int sock_fasync(int fd, struct file *filp, int on)
1299 {
1300 	struct socket *sock = filp->private_data;
1301 	struct sock *sk = sock->sk;
1302 	struct socket_wq *wq = &sock->wq;
1303 
1304 	if (sk == NULL)
1305 		return -EINVAL;
1306 
1307 	lock_sock(sk);
1308 	fasync_helper(fd, filp, on, &wq->fasync_list);
1309 
1310 	if (!wq->fasync_list)
1311 		sock_reset_flag(sk, SOCK_FASYNC);
1312 	else
1313 		sock_set_flag(sk, SOCK_FASYNC);
1314 
1315 	release_sock(sk);
1316 	return 0;
1317 }
1318 
1319 /* This function may be called only under rcu_lock */
1320 
1321 int sock_wake_async(struct socket_wq *wq, int how, int band)
1322 {
1323 	if (!wq || !wq->fasync_list)
1324 		return -1;
1325 
1326 	switch (how) {
1327 	case SOCK_WAKE_WAITD:
1328 		if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
1329 			break;
1330 		goto call_kill;
1331 	case SOCK_WAKE_SPACE:
1332 		if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
1333 			break;
1334 		/* fall through */
1335 	case SOCK_WAKE_IO:
1336 call_kill:
1337 		kill_fasync(&wq->fasync_list, SIGIO, band);
1338 		break;
1339 	case SOCK_WAKE_URG:
1340 		kill_fasync(&wq->fasync_list, SIGURG, band);
1341 	}
1342 
1343 	return 0;
1344 }
1345 EXPORT_SYMBOL(sock_wake_async);
1346 
1347 /**
1348  *	__sock_create - creates a socket
1349  *	@net: net namespace
1350  *	@family: protocol family (AF_INET, ...)
1351  *	@type: communication type (SOCK_STREAM, ...)
1352  *	@protocol: protocol (0, ...)
1353  *	@res: new socket
1354  *	@kern: boolean for kernel space sockets
1355  *
1356  *	Creates a new socket and assigns it to @res, passing through LSM.
1357  *	Returns 0 or an error. On failure @res is set to %NULL. @kern must
1358  *	be set to true if the socket resides in kernel space.
1359  *	This function internally uses GFP_KERNEL.
1360  */
1361 
1362 int __sock_create(struct net *net, int family, int type, int protocol,
1363 			 struct socket **res, int kern)
1364 {
1365 	int err;
1366 	struct socket *sock;
1367 	const struct net_proto_family *pf;
1368 
1369 	/*
1370 	 *      Check protocol is in range
1371 	 */
1372 	if (family < 0 || family >= NPROTO)
1373 		return -EAFNOSUPPORT;
1374 	if (type < 0 || type >= SOCK_MAX)
1375 		return -EINVAL;
1376 
1377 	/* Compatibility.
1378 
1379 	   This uglymoron is moved from INET layer to here to avoid
1380 	   deadlock in module load.
1381 	 */
1382 	if (family == PF_INET && type == SOCK_PACKET) {
1383 		pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
1384 			     current->comm);
1385 		family = PF_PACKET;
1386 	}
1387 
1388 	err = security_socket_create(family, type, protocol, kern);
1389 	if (err)
1390 		return err;
1391 
1392 	/*
1393 	 *	Allocate the socket and allow the family to set things up. if
1394 	 *	the protocol is 0, the family is instructed to select an appropriate
1395 	 *	default.
1396 	 */
1397 	sock = sock_alloc();
1398 	if (!sock) {
1399 		net_warn_ratelimited("socket: no more sockets\n");
1400 		return -ENFILE;	/* Not exactly a match, but its the
1401 				   closest posix thing */
1402 	}
1403 
1404 	sock->type = type;
1405 
1406 #ifdef CONFIG_MODULES
1407 	/* Attempt to load a protocol module if the find failed.
1408 	 *
1409 	 * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
1410 	 * requested real, full-featured networking support upon configuration.
1411 	 * Otherwise module support will break!
1412 	 */
1413 	if (rcu_access_pointer(net_families[family]) == NULL)
1414 		request_module("net-pf-%d", family);
1415 #endif
1416 
1417 	rcu_read_lock();
1418 	pf = rcu_dereference(net_families[family]);
1419 	err = -EAFNOSUPPORT;
1420 	if (!pf)
1421 		goto out_release;
1422 
1423 	/*
1424 	 * We will call the ->create function, that possibly is in a loadable
1425 	 * module, so we have to bump that loadable module refcnt first.
1426 	 */
1427 	if (!try_module_get(pf->owner))
1428 		goto out_release;
1429 
1430 	/* Now protected by module ref count */
1431 	rcu_read_unlock();
1432 
1433 	err = pf->create(net, sock, protocol, kern);
1434 	if (err < 0)
1435 		goto out_module_put;
1436 
1437 	/*
1438 	 * Now to bump the refcnt of the [loadable] module that owns this
1439 	 * socket at sock_release time we decrement its refcnt.
1440 	 */
1441 	if (!try_module_get(sock->ops->owner))
1442 		goto out_module_busy;
1443 
1444 	/*
1445 	 * Now that we're done with the ->create function, the [loadable]
1446 	 * module can have its refcnt decremented
1447 	 */
1448 	module_put(pf->owner);
1449 	err = security_socket_post_create(sock, family, type, protocol, kern);
1450 	if (err)
1451 		goto out_sock_release;
1452 	*res = sock;
1453 
1454 	return 0;
1455 
1456 out_module_busy:
1457 	err = -EAFNOSUPPORT;
1458 out_module_put:
1459 	sock->ops = NULL;
1460 	module_put(pf->owner);
1461 out_sock_release:
1462 	sock_release(sock);
1463 	return err;
1464 
1465 out_release:
1466 	rcu_read_unlock();
1467 	goto out_sock_release;
1468 }
1469 EXPORT_SYMBOL(__sock_create);
1470 
1471 /**
1472  *	sock_create - creates a socket
1473  *	@family: protocol family (AF_INET, ...)
1474  *	@type: communication type (SOCK_STREAM, ...)
1475  *	@protocol: protocol (0, ...)
1476  *	@res: new socket
1477  *
1478  *	A wrapper around __sock_create().
1479  *	Returns 0 or an error. This function internally uses GFP_KERNEL.
1480  */
1481 
1482 int sock_create(int family, int type, int protocol, struct socket **res)
1483 {
1484 	return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
1485 }
1486 EXPORT_SYMBOL(sock_create);
1487 
1488 /**
1489  *	sock_create_kern - creates a socket (kernel space)
1490  *	@net: net namespace
1491  *	@family: protocol family (AF_INET, ...)
1492  *	@type: communication type (SOCK_STREAM, ...)
1493  *	@protocol: protocol (0, ...)
1494  *	@res: new socket
1495  *
1496  *	A wrapper around __sock_create().
1497  *	Returns 0 or an error. This function internally uses GFP_KERNEL.
1498  */
1499 
1500 int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
1501 {
1502 	return __sock_create(net, family, type, protocol, res, 1);
1503 }
1504 EXPORT_SYMBOL(sock_create_kern);
1505 
1506 int __sys_socket(int family, int type, int protocol)
1507 {
1508 	int retval;
1509 	struct socket *sock;
1510 	int flags;
1511 
1512 	/* Check the SOCK_* constants for consistency.  */
1513 	BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
1514 	BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
1515 	BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
1516 	BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);
1517 
1518 	flags = type & ~SOCK_TYPE_MASK;
1519 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1520 		return -EINVAL;
1521 	type &= SOCK_TYPE_MASK;
1522 
1523 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1524 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1525 
1526 	retval = sock_create(family, type, protocol, &sock);
1527 	if (retval < 0)
1528 		return retval;
1529 
1530 	return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
1531 }
1532 
1533 SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
1534 {
1535 	return __sys_socket(family, type, protocol);
1536 }
1537 
1538 /*
1539  *	Create a pair of connected sockets.
1540  */
1541 
1542 int __sys_socketpair(int family, int type, int protocol, int __user *usockvec)
1543 {
1544 	struct socket *sock1, *sock2;
1545 	int fd1, fd2, err;
1546 	struct file *newfile1, *newfile2;
1547 	int flags;
1548 
1549 	flags = type & ~SOCK_TYPE_MASK;
1550 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1551 		return -EINVAL;
1552 	type &= SOCK_TYPE_MASK;
1553 
1554 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1555 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1556 
1557 	/*
1558 	 * reserve descriptors and make sure we won't fail
1559 	 * to return them to userland.
1560 	 */
1561 	fd1 = get_unused_fd_flags(flags);
1562 	if (unlikely(fd1 < 0))
1563 		return fd1;
1564 
1565 	fd2 = get_unused_fd_flags(flags);
1566 	if (unlikely(fd2 < 0)) {
1567 		put_unused_fd(fd1);
1568 		return fd2;
1569 	}
1570 
1571 	err = put_user(fd1, &usockvec[0]);
1572 	if (err)
1573 		goto out;
1574 
1575 	err = put_user(fd2, &usockvec[1]);
1576 	if (err)
1577 		goto out;
1578 
1579 	/*
1580 	 * Obtain the first socket and check if the underlying protocol
1581 	 * supports the socketpair call.
1582 	 */
1583 
1584 	err = sock_create(family, type, protocol, &sock1);
1585 	if (unlikely(err < 0))
1586 		goto out;
1587 
1588 	err = sock_create(family, type, protocol, &sock2);
1589 	if (unlikely(err < 0)) {
1590 		sock_release(sock1);
1591 		goto out;
1592 	}
1593 
1594 	err = security_socket_socketpair(sock1, sock2);
1595 	if (unlikely(err)) {
1596 		sock_release(sock2);
1597 		sock_release(sock1);
1598 		goto out;
1599 	}
1600 
1601 	err = sock1->ops->socketpair(sock1, sock2);
1602 	if (unlikely(err < 0)) {
1603 		sock_release(sock2);
1604 		sock_release(sock1);
1605 		goto out;
1606 	}
1607 
1608 	newfile1 = sock_alloc_file(sock1, flags, NULL);
1609 	if (IS_ERR(newfile1)) {
1610 		err = PTR_ERR(newfile1);
1611 		sock_release(sock2);
1612 		goto out;
1613 	}
1614 
1615 	newfile2 = sock_alloc_file(sock2, flags, NULL);
1616 	if (IS_ERR(newfile2)) {
1617 		err = PTR_ERR(newfile2);
1618 		fput(newfile1);
1619 		goto out;
1620 	}
1621 
1622 	audit_fd_pair(fd1, fd2);
1623 
1624 	fd_install(fd1, newfile1);
1625 	fd_install(fd2, newfile2);
1626 	return 0;
1627 
1628 out:
1629 	put_unused_fd(fd2);
1630 	put_unused_fd(fd1);
1631 	return err;
1632 }
1633 
1634 SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
1635 		int __user *, usockvec)
1636 {
1637 	return __sys_socketpair(family, type, protocol, usockvec);
1638 }
1639 
1640 /*
1641  *	Bind a name to a socket. Nothing much to do here since it's
1642  *	the protocol's responsibility to handle the local address.
1643  *
1644  *	We move the socket address to kernel space before we call
1645  *	the protocol layer (having also checked the address is ok).
1646  */
1647 
1648 int __sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
1649 {
1650 	struct socket *sock;
1651 	struct sockaddr_storage address;
1652 	int err, fput_needed;
1653 
1654 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1655 	if (sock) {
1656 		err = move_addr_to_kernel(umyaddr, addrlen, &address);
1657 		if (!err) {
1658 			err = security_socket_bind(sock,
1659 						   (struct sockaddr *)&address,
1660 						   addrlen);
1661 			if (!err)
1662 				err = sock->ops->bind(sock,
1663 						      (struct sockaddr *)
1664 						      &address, addrlen);
1665 		}
1666 		fput_light(sock->file, fput_needed);
1667 	}
1668 	return err;
1669 }
1670 
1671 SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
1672 {
1673 	return __sys_bind(fd, umyaddr, addrlen);
1674 }
1675 
1676 /*
1677  *	Perform a listen. Basically, we allow the protocol to do anything
1678  *	necessary for a listen, and if that works, we mark the socket as
1679  *	ready for listening.
1680  */
1681 
1682 int __sys_listen(int fd, int backlog)
1683 {
1684 	struct socket *sock;
1685 	int err, fput_needed;
1686 	int somaxconn;
1687 
1688 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1689 	if (sock) {
1690 		somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
1691 		if ((unsigned int)backlog > somaxconn)
1692 			backlog = somaxconn;
1693 
1694 		err = security_socket_listen(sock, backlog);
1695 		if (!err)
1696 			err = sock->ops->listen(sock, backlog);
1697 
1698 		fput_light(sock->file, fput_needed);
1699 	}
1700 	return err;
1701 }
1702 
1703 SYSCALL_DEFINE2(listen, int, fd, int, backlog)
1704 {
1705 	return __sys_listen(fd, backlog);
1706 }
1707 
1708 int __sys_accept4_file(struct file *file, unsigned file_flags,
1709 		       struct sockaddr __user *upeer_sockaddr,
1710 		       int __user *upeer_addrlen, int flags,
1711 		       unsigned long nofile)
1712 {
1713 	struct socket *sock, *newsock;
1714 	struct file *newfile;
1715 	int err, len, newfd;
1716 	struct sockaddr_storage address;
1717 
1718 	if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
1719 		return -EINVAL;
1720 
1721 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
1722 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
1723 
1724 	sock = sock_from_file(file, &err);
1725 	if (!sock)
1726 		goto out;
1727 
1728 	err = -ENFILE;
1729 	newsock = sock_alloc();
1730 	if (!newsock)
1731 		goto out;
1732 
1733 	newsock->type = sock->type;
1734 	newsock->ops = sock->ops;
1735 
1736 	/*
1737 	 * We don't need try_module_get here, as the listening socket (sock)
1738 	 * has the protocol module (sock->ops->owner) held.
1739 	 */
1740 	__module_get(newsock->ops->owner);
1741 
1742 	newfd = __get_unused_fd_flags(flags, nofile);
1743 	if (unlikely(newfd < 0)) {
1744 		err = newfd;
1745 		sock_release(newsock);
1746 		goto out;
1747 	}
1748 	newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
1749 	if (IS_ERR(newfile)) {
1750 		err = PTR_ERR(newfile);
1751 		put_unused_fd(newfd);
1752 		goto out;
1753 	}
1754 
1755 	err = security_socket_accept(sock, newsock);
1756 	if (err)
1757 		goto out_fd;
1758 
1759 	err = sock->ops->accept(sock, newsock, sock->file->f_flags | file_flags,
1760 					false);
1761 	if (err < 0)
1762 		goto out_fd;
1763 
1764 	if (upeer_sockaddr) {
1765 		len = newsock->ops->getname(newsock,
1766 					(struct sockaddr *)&address, 2);
1767 		if (len < 0) {
1768 			err = -ECONNABORTED;
1769 			goto out_fd;
1770 		}
1771 		err = move_addr_to_user(&address,
1772 					len, upeer_sockaddr, upeer_addrlen);
1773 		if (err < 0)
1774 			goto out_fd;
1775 	}
1776 
1777 	/* File flags are not inherited via accept() unlike another OSes. */
1778 
1779 	fd_install(newfd, newfile);
1780 	err = newfd;
1781 out:
1782 	return err;
1783 out_fd:
1784 	fput(newfile);
1785 	put_unused_fd(newfd);
1786 	goto out;
1787 
1788 }
1789 
1790 /*
1791  *	For accept, we attempt to create a new socket, set up the link
1792  *	with the client, wake up the client, then return the new
1793  *	connected fd. We collect the address of the connector in kernel
1794  *	space and move it to user at the very end. This is unclean because
1795  *	we open the socket then return an error.
1796  *
1797  *	1003.1g adds the ability to recvmsg() to query connection pending
1798  *	status to recvmsg. We need to add that support in a way thats
1799  *	clean when we restructure accept also.
1800  */
1801 
1802 int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
1803 		  int __user *upeer_addrlen, int flags)
1804 {
1805 	int ret = -EBADF;
1806 	struct fd f;
1807 
1808 	f = fdget(fd);
1809 	if (f.file) {
1810 		ret = __sys_accept4_file(f.file, 0, upeer_sockaddr,
1811 						upeer_addrlen, flags,
1812 						rlimit(RLIMIT_NOFILE));
1813 		if (f.flags)
1814 			fput(f.file);
1815 	}
1816 
1817 	return ret;
1818 }
1819 
1820 SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
1821 		int __user *, upeer_addrlen, int, flags)
1822 {
1823 	return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags);
1824 }
1825 
1826 SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
1827 		int __user *, upeer_addrlen)
1828 {
1829 	return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
1830 }
1831 
1832 /*
1833  *	Attempt to connect to a socket with the server address.  The address
1834  *	is in user space so we verify it is OK and move it to kernel space.
1835  *
1836  *	For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
1837  *	break bindings
1838  *
1839  *	NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
1840  *	other SEQPACKET protocols that take time to connect() as it doesn't
1841  *	include the -EINPROGRESS status for such sockets.
1842  */
1843 
1844 int __sys_connect_file(struct file *file, struct sockaddr_storage *address,
1845 		       int addrlen, int file_flags)
1846 {
1847 	struct socket *sock;
1848 	int err;
1849 
1850 	sock = sock_from_file(file, &err);
1851 	if (!sock)
1852 		goto out;
1853 
1854 	err =
1855 	    security_socket_connect(sock, (struct sockaddr *)address, addrlen);
1856 	if (err)
1857 		goto out;
1858 
1859 	err = sock->ops->connect(sock, (struct sockaddr *)address, addrlen,
1860 				 sock->file->f_flags | file_flags);
1861 out:
1862 	return err;
1863 }
1864 
1865 int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
1866 {
1867 	int ret = -EBADF;
1868 	struct fd f;
1869 
1870 	f = fdget(fd);
1871 	if (f.file) {
1872 		struct sockaddr_storage address;
1873 
1874 		ret = move_addr_to_kernel(uservaddr, addrlen, &address);
1875 		if (!ret)
1876 			ret = __sys_connect_file(f.file, &address, addrlen, 0);
1877 		if (f.flags)
1878 			fput(f.file);
1879 	}
1880 
1881 	return ret;
1882 }
1883 
1884 SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
1885 		int, addrlen)
1886 {
1887 	return __sys_connect(fd, uservaddr, addrlen);
1888 }
1889 
1890 /*
1891  *	Get the local address ('name') of a socket object. Move the obtained
1892  *	name to user space.
1893  */
1894 
1895 int __sys_getsockname(int fd, struct sockaddr __user *usockaddr,
1896 		      int __user *usockaddr_len)
1897 {
1898 	struct socket *sock;
1899 	struct sockaddr_storage address;
1900 	int err, fput_needed;
1901 
1902 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1903 	if (!sock)
1904 		goto out;
1905 
1906 	err = security_socket_getsockname(sock);
1907 	if (err)
1908 		goto out_put;
1909 
1910 	err = sock->ops->getname(sock, (struct sockaddr *)&address, 0);
1911 	if (err < 0)
1912 		goto out_put;
1913         /* "err" is actually length in this case */
1914 	err = move_addr_to_user(&address, err, usockaddr, usockaddr_len);
1915 
1916 out_put:
1917 	fput_light(sock->file, fput_needed);
1918 out:
1919 	return err;
1920 }
1921 
1922 SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
1923 		int __user *, usockaddr_len)
1924 {
1925 	return __sys_getsockname(fd, usockaddr, usockaddr_len);
1926 }
1927 
1928 /*
1929  *	Get the remote address ('name') of a socket object. Move the obtained
1930  *	name to user space.
1931  */
1932 
1933 int __sys_getpeername(int fd, struct sockaddr __user *usockaddr,
1934 		      int __user *usockaddr_len)
1935 {
1936 	struct socket *sock;
1937 	struct sockaddr_storage address;
1938 	int err, fput_needed;
1939 
1940 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1941 	if (sock != NULL) {
1942 		err = security_socket_getpeername(sock);
1943 		if (err) {
1944 			fput_light(sock->file, fput_needed);
1945 			return err;
1946 		}
1947 
1948 		err = sock->ops->getname(sock, (struct sockaddr *)&address, 1);
1949 		if (err >= 0)
1950 			/* "err" is actually length in this case */
1951 			err = move_addr_to_user(&address, err, usockaddr,
1952 						usockaddr_len);
1953 		fput_light(sock->file, fput_needed);
1954 	}
1955 	return err;
1956 }
1957 
1958 SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
1959 		int __user *, usockaddr_len)
1960 {
1961 	return __sys_getpeername(fd, usockaddr, usockaddr_len);
1962 }
1963 
1964 /*
1965  *	Send a datagram to a given address. We move the address into kernel
1966  *	space and check the user space data area is readable before invoking
1967  *	the protocol.
1968  */
1969 int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
1970 		 struct sockaddr __user *addr,  int addr_len)
1971 {
1972 	struct socket *sock;
1973 	struct sockaddr_storage address;
1974 	int err;
1975 	struct msghdr msg;
1976 	struct iovec iov;
1977 	int fput_needed;
1978 
1979 	err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
1980 	if (unlikely(err))
1981 		return err;
1982 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
1983 	if (!sock)
1984 		goto out;
1985 
1986 	msg.msg_name = NULL;
1987 	msg.msg_control = NULL;
1988 	msg.msg_controllen = 0;
1989 	msg.msg_namelen = 0;
1990 	if (addr) {
1991 		err = move_addr_to_kernel(addr, addr_len, &address);
1992 		if (err < 0)
1993 			goto out_put;
1994 		msg.msg_name = (struct sockaddr *)&address;
1995 		msg.msg_namelen = addr_len;
1996 	}
1997 	if (sock->file->f_flags & O_NONBLOCK)
1998 		flags |= MSG_DONTWAIT;
1999 	msg.msg_flags = flags;
2000 	err = sock_sendmsg(sock, &msg);
2001 
2002 out_put:
2003 	fput_light(sock->file, fput_needed);
2004 out:
2005 	return err;
2006 }
2007 
2008 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
2009 		unsigned int, flags, struct sockaddr __user *, addr,
2010 		int, addr_len)
2011 {
2012 	return __sys_sendto(fd, buff, len, flags, addr, addr_len);
2013 }
2014 
2015 /*
2016  *	Send a datagram down a socket.
2017  */
2018 
2019 SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
2020 		unsigned int, flags)
2021 {
2022 	return __sys_sendto(fd, buff, len, flags, NULL, 0);
2023 }
2024 
2025 /*
2026  *	Receive a frame from the socket and optionally record the address of the
2027  *	sender. We verify the buffers are writable and if needed move the
2028  *	sender address from kernel to user space.
2029  */
2030 int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
2031 		   struct sockaddr __user *addr, int __user *addr_len)
2032 {
2033 	struct socket *sock;
2034 	struct iovec iov;
2035 	struct msghdr msg;
2036 	struct sockaddr_storage address;
2037 	int err, err2;
2038 	int fput_needed;
2039 
2040 	err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
2041 	if (unlikely(err))
2042 		return err;
2043 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2044 	if (!sock)
2045 		goto out;
2046 
2047 	msg.msg_control = NULL;
2048 	msg.msg_controllen = 0;
2049 	/* Save some cycles and don't copy the address if not needed */
2050 	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
2051 	/* We assume all kernel code knows the size of sockaddr_storage */
2052 	msg.msg_namelen = 0;
2053 	msg.msg_iocb = NULL;
2054 	msg.msg_flags = 0;
2055 	if (sock->file->f_flags & O_NONBLOCK)
2056 		flags |= MSG_DONTWAIT;
2057 	err = sock_recvmsg(sock, &msg, flags);
2058 
2059 	if (err >= 0 && addr != NULL) {
2060 		err2 = move_addr_to_user(&address,
2061 					 msg.msg_namelen, addr, addr_len);
2062 		if (err2 < 0)
2063 			err = err2;
2064 	}
2065 
2066 	fput_light(sock->file, fput_needed);
2067 out:
2068 	return err;
2069 }
2070 
2071 SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
2072 		unsigned int, flags, struct sockaddr __user *, addr,
2073 		int __user *, addr_len)
2074 {
2075 	return __sys_recvfrom(fd, ubuf, size, flags, addr, addr_len);
2076 }
2077 
2078 /*
2079  *	Receive a datagram from a socket.
2080  */
2081 
2082 SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
2083 		unsigned int, flags)
2084 {
2085 	return __sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
2086 }
2087 
2088 /*
2089  *	Set a socket option. Because we don't know the option lengths we have
2090  *	to pass the user mode parameter for the protocols to sort out.
2091  */
2092 
2093 static int __sys_setsockopt(int fd, int level, int optname,
2094 			    char __user *optval, int optlen)
2095 {
2096 	mm_segment_t oldfs = get_fs();
2097 	char *kernel_optval = NULL;
2098 	int err, fput_needed;
2099 	struct socket *sock;
2100 
2101 	if (optlen < 0)
2102 		return -EINVAL;
2103 
2104 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2105 	if (sock != NULL) {
2106 		err = security_socket_setsockopt(sock, level, optname);
2107 		if (err)
2108 			goto out_put;
2109 
2110 		err = BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock->sk, &level,
2111 						     &optname, optval, &optlen,
2112 						     &kernel_optval);
2113 
2114 		if (err < 0) {
2115 			goto out_put;
2116 		} else if (err > 0) {
2117 			err = 0;
2118 			goto out_put;
2119 		}
2120 
2121 		if (kernel_optval) {
2122 			set_fs(KERNEL_DS);
2123 			optval = (char __user __force *)kernel_optval;
2124 		}
2125 
2126 		if (level == SOL_SOCKET)
2127 			err =
2128 			    sock_setsockopt(sock, level, optname, optval,
2129 					    optlen);
2130 		else
2131 			err =
2132 			    sock->ops->setsockopt(sock, level, optname, optval,
2133 						  optlen);
2134 
2135 		if (kernel_optval) {
2136 			set_fs(oldfs);
2137 			kfree(kernel_optval);
2138 		}
2139 out_put:
2140 		fput_light(sock->file, fput_needed);
2141 	}
2142 	return err;
2143 }
2144 
2145 SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
2146 		char __user *, optval, int, optlen)
2147 {
2148 	return __sys_setsockopt(fd, level, optname, optval, optlen);
2149 }
2150 
2151 /*
2152  *	Get a socket option. Because we don't know the option lengths we have
2153  *	to pass a user mode parameter for the protocols to sort out.
2154  */
2155 
2156 static int __sys_getsockopt(int fd, int level, int optname,
2157 			    char __user *optval, int __user *optlen)
2158 {
2159 	int err, fput_needed;
2160 	struct socket *sock;
2161 	int max_optlen;
2162 
2163 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2164 	if (sock != NULL) {
2165 		err = security_socket_getsockopt(sock, level, optname);
2166 		if (err)
2167 			goto out_put;
2168 
2169 		max_optlen = BPF_CGROUP_GETSOCKOPT_MAX_OPTLEN(optlen);
2170 
2171 		if (level == SOL_SOCKET)
2172 			err =
2173 			    sock_getsockopt(sock, level, optname, optval,
2174 					    optlen);
2175 		else
2176 			err =
2177 			    sock->ops->getsockopt(sock, level, optname, optval,
2178 						  optlen);
2179 
2180 		err = BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock->sk, level, optname,
2181 						     optval, optlen,
2182 						     max_optlen, err);
2183 out_put:
2184 		fput_light(sock->file, fput_needed);
2185 	}
2186 	return err;
2187 }
2188 
2189 SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
2190 		char __user *, optval, int __user *, optlen)
2191 {
2192 	return __sys_getsockopt(fd, level, optname, optval, optlen);
2193 }
2194 
2195 /*
2196  *	Shutdown a socket.
2197  */
2198 
2199 int __sys_shutdown(int fd, int how)
2200 {
2201 	int err, fput_needed;
2202 	struct socket *sock;
2203 
2204 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2205 	if (sock != NULL) {
2206 		err = security_socket_shutdown(sock, how);
2207 		if (!err)
2208 			err = sock->ops->shutdown(sock, how);
2209 		fput_light(sock->file, fput_needed);
2210 	}
2211 	return err;
2212 }
2213 
2214 SYSCALL_DEFINE2(shutdown, int, fd, int, how)
2215 {
2216 	return __sys_shutdown(fd, how);
2217 }
2218 
2219 /* A couple of helpful macros for getting the address of the 32/64 bit
2220  * fields which are the same type (int / unsigned) on our platforms.
2221  */
2222 #define COMPAT_MSG(msg, member)	((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
2223 #define COMPAT_NAMELEN(msg)	COMPAT_MSG(msg, msg_namelen)
2224 #define COMPAT_FLAGS(msg)	COMPAT_MSG(msg, msg_flags)
2225 
2226 struct used_address {
2227 	struct sockaddr_storage name;
2228 	unsigned int name_len;
2229 };
2230 
2231 static int copy_msghdr_from_user(struct msghdr *kmsg,
2232 				 struct user_msghdr __user *umsg,
2233 				 struct sockaddr __user **save_addr,
2234 				 struct iovec **iov)
2235 {
2236 	struct user_msghdr msg;
2237 	ssize_t err;
2238 
2239 	if (copy_from_user(&msg, umsg, sizeof(*umsg)))
2240 		return -EFAULT;
2241 
2242 	kmsg->msg_control = (void __force *)msg.msg_control;
2243 	kmsg->msg_controllen = msg.msg_controllen;
2244 	kmsg->msg_flags = msg.msg_flags;
2245 
2246 	kmsg->msg_namelen = msg.msg_namelen;
2247 	if (!msg.msg_name)
2248 		kmsg->msg_namelen = 0;
2249 
2250 	if (kmsg->msg_namelen < 0)
2251 		return -EINVAL;
2252 
2253 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
2254 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
2255 
2256 	if (save_addr)
2257 		*save_addr = msg.msg_name;
2258 
2259 	if (msg.msg_name && kmsg->msg_namelen) {
2260 		if (!save_addr) {
2261 			err = move_addr_to_kernel(msg.msg_name,
2262 						  kmsg->msg_namelen,
2263 						  kmsg->msg_name);
2264 			if (err < 0)
2265 				return err;
2266 		}
2267 	} else {
2268 		kmsg->msg_name = NULL;
2269 		kmsg->msg_namelen = 0;
2270 	}
2271 
2272 	if (msg.msg_iovlen > UIO_MAXIOV)
2273 		return -EMSGSIZE;
2274 
2275 	kmsg->msg_iocb = NULL;
2276 
2277 	err = import_iovec(save_addr ? READ : WRITE,
2278 			    msg.msg_iov, msg.msg_iovlen,
2279 			    UIO_FASTIOV, iov, &kmsg->msg_iter);
2280 	return err < 0 ? err : 0;
2281 }
2282 
2283 static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
2284 			   unsigned int flags, struct used_address *used_address,
2285 			   unsigned int allowed_msghdr_flags)
2286 {
2287 	unsigned char ctl[sizeof(struct cmsghdr) + 20]
2288 				__aligned(sizeof(__kernel_size_t));
2289 	/* 20 is size of ipv6_pktinfo */
2290 	unsigned char *ctl_buf = ctl;
2291 	int ctl_len;
2292 	ssize_t err;
2293 
2294 	err = -ENOBUFS;
2295 
2296 	if (msg_sys->msg_controllen > INT_MAX)
2297 		goto out;
2298 	flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
2299 	ctl_len = msg_sys->msg_controllen;
2300 	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
2301 		err =
2302 		    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
2303 						     sizeof(ctl));
2304 		if (err)
2305 			goto out;
2306 		ctl_buf = msg_sys->msg_control;
2307 		ctl_len = msg_sys->msg_controllen;
2308 	} else if (ctl_len) {
2309 		BUILD_BUG_ON(sizeof(struct cmsghdr) !=
2310 			     CMSG_ALIGN(sizeof(struct cmsghdr)));
2311 		if (ctl_len > sizeof(ctl)) {
2312 			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
2313 			if (ctl_buf == NULL)
2314 				goto out;
2315 		}
2316 		err = -EFAULT;
2317 		/*
2318 		 * Careful! Before this, msg_sys->msg_control contains a user pointer.
2319 		 * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
2320 		 * checking falls down on this.
2321 		 */
2322 		if (copy_from_user(ctl_buf,
2323 				   (void __user __force *)msg_sys->msg_control,
2324 				   ctl_len))
2325 			goto out_freectl;
2326 		msg_sys->msg_control = ctl_buf;
2327 	}
2328 	msg_sys->msg_flags = flags;
2329 
2330 	if (sock->file->f_flags & O_NONBLOCK)
2331 		msg_sys->msg_flags |= MSG_DONTWAIT;
2332 	/*
2333 	 * If this is sendmmsg() and current destination address is same as
2334 	 * previously succeeded address, omit asking LSM's decision.
2335 	 * used_address->name_len is initialized to UINT_MAX so that the first
2336 	 * destination address never matches.
2337 	 */
2338 	if (used_address && msg_sys->msg_name &&
2339 	    used_address->name_len == msg_sys->msg_namelen &&
2340 	    !memcmp(&used_address->name, msg_sys->msg_name,
2341 		    used_address->name_len)) {
2342 		err = sock_sendmsg_nosec(sock, msg_sys);
2343 		goto out_freectl;
2344 	}
2345 	err = sock_sendmsg(sock, msg_sys);
2346 	/*
2347 	 * If this is sendmmsg() and sending to current destination address was
2348 	 * successful, remember it.
2349 	 */
2350 	if (used_address && err >= 0) {
2351 		used_address->name_len = msg_sys->msg_namelen;
2352 		if (msg_sys->msg_name)
2353 			memcpy(&used_address->name, msg_sys->msg_name,
2354 			       used_address->name_len);
2355 	}
2356 
2357 out_freectl:
2358 	if (ctl_buf != ctl)
2359 		sock_kfree_s(sock->sk, ctl_buf, ctl_len);
2360 out:
2361 	return err;
2362 }
2363 
2364 int sendmsg_copy_msghdr(struct msghdr *msg,
2365 			struct user_msghdr __user *umsg, unsigned flags,
2366 			struct iovec **iov)
2367 {
2368 	int err;
2369 
2370 	if (flags & MSG_CMSG_COMPAT) {
2371 		struct compat_msghdr __user *msg_compat;
2372 
2373 		msg_compat = (struct compat_msghdr __user *) umsg;
2374 		err = get_compat_msghdr(msg, msg_compat, NULL, iov);
2375 	} else {
2376 		err = copy_msghdr_from_user(msg, umsg, NULL, iov);
2377 	}
2378 	if (err < 0)
2379 		return err;
2380 
2381 	return 0;
2382 }
2383 
2384 static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
2385 			 struct msghdr *msg_sys, unsigned int flags,
2386 			 struct used_address *used_address,
2387 			 unsigned int allowed_msghdr_flags)
2388 {
2389 	struct sockaddr_storage address;
2390 	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
2391 	ssize_t err;
2392 
2393 	msg_sys->msg_name = &address;
2394 
2395 	err = sendmsg_copy_msghdr(msg_sys, msg, flags, &iov);
2396 	if (err < 0)
2397 		return err;
2398 
2399 	err = ____sys_sendmsg(sock, msg_sys, flags, used_address,
2400 				allowed_msghdr_flags);
2401 	kfree(iov);
2402 	return err;
2403 }
2404 
2405 /*
2406  *	BSD sendmsg interface
2407  */
2408 long __sys_sendmsg_sock(struct socket *sock, struct msghdr *msg,
2409 			unsigned int flags)
2410 {
2411 	/* disallow ancillary data requests from this path */
2412 	if (msg->msg_control || msg->msg_controllen)
2413 		return -EINVAL;
2414 
2415 	return ____sys_sendmsg(sock, msg, flags, NULL, 0);
2416 }
2417 
2418 long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
2419 		   bool forbid_cmsg_compat)
2420 {
2421 	int fput_needed, err;
2422 	struct msghdr msg_sys;
2423 	struct socket *sock;
2424 
2425 	if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
2426 		return -EINVAL;
2427 
2428 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2429 	if (!sock)
2430 		goto out;
2431 
2432 	err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
2433 
2434 	fput_light(sock->file, fput_needed);
2435 out:
2436 	return err;
2437 }
2438 
2439 SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
2440 {
2441 	return __sys_sendmsg(fd, msg, flags, true);
2442 }
2443 
2444 /*
2445  *	Linux sendmmsg interface
2446  */
2447 
2448 int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
2449 		   unsigned int flags, bool forbid_cmsg_compat)
2450 {
2451 	int fput_needed, err, datagrams;
2452 	struct socket *sock;
2453 	struct mmsghdr __user *entry;
2454 	struct compat_mmsghdr __user *compat_entry;
2455 	struct msghdr msg_sys;
2456 	struct used_address used_address;
2457 	unsigned int oflags = flags;
2458 
2459 	if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
2460 		return -EINVAL;
2461 
2462 	if (vlen > UIO_MAXIOV)
2463 		vlen = UIO_MAXIOV;
2464 
2465 	datagrams = 0;
2466 
2467 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2468 	if (!sock)
2469 		return err;
2470 
2471 	used_address.name_len = UINT_MAX;
2472 	entry = mmsg;
2473 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2474 	err = 0;
2475 	flags |= MSG_BATCH;
2476 
2477 	while (datagrams < vlen) {
2478 		if (datagrams == vlen - 1)
2479 			flags = oflags;
2480 
2481 		if (MSG_CMSG_COMPAT & flags) {
2482 			err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
2483 					     &msg_sys, flags, &used_address, MSG_EOR);
2484 			if (err < 0)
2485 				break;
2486 			err = __put_user(err, &compat_entry->msg_len);
2487 			++compat_entry;
2488 		} else {
2489 			err = ___sys_sendmsg(sock,
2490 					     (struct user_msghdr __user *)entry,
2491 					     &msg_sys, flags, &used_address, MSG_EOR);
2492 			if (err < 0)
2493 				break;
2494 			err = put_user(err, &entry->msg_len);
2495 			++entry;
2496 		}
2497 
2498 		if (err)
2499 			break;
2500 		++datagrams;
2501 		if (msg_data_left(&msg_sys))
2502 			break;
2503 		cond_resched();
2504 	}
2505 
2506 	fput_light(sock->file, fput_needed);
2507 
2508 	/* We only return an error if no datagrams were able to be sent */
2509 	if (datagrams != 0)
2510 		return datagrams;
2511 
2512 	return err;
2513 }
2514 
2515 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
2516 		unsigned int, vlen, unsigned int, flags)
2517 {
2518 	return __sys_sendmmsg(fd, mmsg, vlen, flags, true);
2519 }
2520 
2521 int recvmsg_copy_msghdr(struct msghdr *msg,
2522 			struct user_msghdr __user *umsg, unsigned flags,
2523 			struct sockaddr __user **uaddr,
2524 			struct iovec **iov)
2525 {
2526 	ssize_t err;
2527 
2528 	if (MSG_CMSG_COMPAT & flags) {
2529 		struct compat_msghdr __user *msg_compat;
2530 
2531 		msg_compat = (struct compat_msghdr __user *) umsg;
2532 		err = get_compat_msghdr(msg, msg_compat, uaddr, iov);
2533 	} else {
2534 		err = copy_msghdr_from_user(msg, umsg, uaddr, iov);
2535 	}
2536 	if (err < 0)
2537 		return err;
2538 
2539 	return 0;
2540 }
2541 
2542 static int ____sys_recvmsg(struct socket *sock, struct msghdr *msg_sys,
2543 			   struct user_msghdr __user *msg,
2544 			   struct sockaddr __user *uaddr,
2545 			   unsigned int flags, int nosec)
2546 {
2547 	struct compat_msghdr __user *msg_compat =
2548 					(struct compat_msghdr __user *) msg;
2549 	int __user *uaddr_len = COMPAT_NAMELEN(msg);
2550 	struct sockaddr_storage addr;
2551 	unsigned long cmsg_ptr;
2552 	int len;
2553 	ssize_t err;
2554 
2555 	msg_sys->msg_name = &addr;
2556 	cmsg_ptr = (unsigned long)msg_sys->msg_control;
2557 	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
2558 
2559 	/* We assume all kernel code knows the size of sockaddr_storage */
2560 	msg_sys->msg_namelen = 0;
2561 
2562 	if (sock->file->f_flags & O_NONBLOCK)
2563 		flags |= MSG_DONTWAIT;
2564 
2565 	if (unlikely(nosec))
2566 		err = sock_recvmsg_nosec(sock, msg_sys, flags);
2567 	else
2568 		err = sock_recvmsg(sock, msg_sys, flags);
2569 
2570 	if (err < 0)
2571 		goto out;
2572 	len = err;
2573 
2574 	if (uaddr != NULL) {
2575 		err = move_addr_to_user(&addr,
2576 					msg_sys->msg_namelen, uaddr,
2577 					uaddr_len);
2578 		if (err < 0)
2579 			goto out;
2580 	}
2581 	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
2582 			 COMPAT_FLAGS(msg));
2583 	if (err)
2584 		goto out;
2585 	if (MSG_CMSG_COMPAT & flags)
2586 		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2587 				 &msg_compat->msg_controllen);
2588 	else
2589 		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
2590 				 &msg->msg_controllen);
2591 	if (err)
2592 		goto out;
2593 	err = len;
2594 out:
2595 	return err;
2596 }
2597 
2598 static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
2599 			 struct msghdr *msg_sys, unsigned int flags, int nosec)
2600 {
2601 	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
2602 	/* user mode address pointers */
2603 	struct sockaddr __user *uaddr;
2604 	ssize_t err;
2605 
2606 	err = recvmsg_copy_msghdr(msg_sys, msg, flags, &uaddr, &iov);
2607 	if (err < 0)
2608 		return err;
2609 
2610 	err = ____sys_recvmsg(sock, msg_sys, msg, uaddr, flags, nosec);
2611 	kfree(iov);
2612 	return err;
2613 }
2614 
2615 /*
2616  *	BSD recvmsg interface
2617  */
2618 
2619 long __sys_recvmsg_sock(struct socket *sock, struct msghdr *msg,
2620 			struct user_msghdr __user *umsg,
2621 			struct sockaddr __user *uaddr, unsigned int flags)
2622 {
2623 	/* disallow ancillary data requests from this path */
2624 	if (msg->msg_control || msg->msg_controllen)
2625 		return -EINVAL;
2626 
2627 	return ____sys_recvmsg(sock, msg, umsg, uaddr, flags, 0);
2628 }
2629 
2630 long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
2631 		   bool forbid_cmsg_compat)
2632 {
2633 	int fput_needed, err;
2634 	struct msghdr msg_sys;
2635 	struct socket *sock;
2636 
2637 	if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
2638 		return -EINVAL;
2639 
2640 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2641 	if (!sock)
2642 		goto out;
2643 
2644 	err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
2645 
2646 	fput_light(sock->file, fput_needed);
2647 out:
2648 	return err;
2649 }
2650 
2651 SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
2652 		unsigned int, flags)
2653 {
2654 	return __sys_recvmsg(fd, msg, flags, true);
2655 }
2656 
2657 /*
2658  *     Linux recvmmsg interface
2659  */
2660 
2661 static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
2662 			  unsigned int vlen, unsigned int flags,
2663 			  struct timespec64 *timeout)
2664 {
2665 	int fput_needed, err, datagrams;
2666 	struct socket *sock;
2667 	struct mmsghdr __user *entry;
2668 	struct compat_mmsghdr __user *compat_entry;
2669 	struct msghdr msg_sys;
2670 	struct timespec64 end_time;
2671 	struct timespec64 timeout64;
2672 
2673 	if (timeout &&
2674 	    poll_select_set_timeout(&end_time, timeout->tv_sec,
2675 				    timeout->tv_nsec))
2676 		return -EINVAL;
2677 
2678 	datagrams = 0;
2679 
2680 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
2681 	if (!sock)
2682 		return err;
2683 
2684 	if (likely(!(flags & MSG_ERRQUEUE))) {
2685 		err = sock_error(sock->sk);
2686 		if (err) {
2687 			datagrams = err;
2688 			goto out_put;
2689 		}
2690 	}
2691 
2692 	entry = mmsg;
2693 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
2694 
2695 	while (datagrams < vlen) {
2696 		/*
2697 		 * No need to ask LSM for more than the first datagram.
2698 		 */
2699 		if (MSG_CMSG_COMPAT & flags) {
2700 			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
2701 					     &msg_sys, flags & ~MSG_WAITFORONE,
2702 					     datagrams);
2703 			if (err < 0)
2704 				break;
2705 			err = __put_user(err, &compat_entry->msg_len);
2706 			++compat_entry;
2707 		} else {
2708 			err = ___sys_recvmsg(sock,
2709 					     (struct user_msghdr __user *)entry,
2710 					     &msg_sys, flags & ~MSG_WAITFORONE,
2711 					     datagrams);
2712 			if (err < 0)
2713 				break;
2714 			err = put_user(err, &entry->msg_len);
2715 			++entry;
2716 		}
2717 
2718 		if (err)
2719 			break;
2720 		++datagrams;
2721 
2722 		/* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2723 		if (flags & MSG_WAITFORONE)
2724 			flags |= MSG_DONTWAIT;
2725 
2726 		if (timeout) {
2727 			ktime_get_ts64(&timeout64);
2728 			*timeout = timespec64_sub(end_time, timeout64);
2729 			if (timeout->tv_sec < 0) {
2730 				timeout->tv_sec = timeout->tv_nsec = 0;
2731 				break;
2732 			}
2733 
2734 			/* Timeout, return less than vlen datagrams */
2735 			if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
2736 				break;
2737 		}
2738 
2739 		/* Out of band data, return right away */
2740 		if (msg_sys.msg_flags & MSG_OOB)
2741 			break;
2742 		cond_resched();
2743 	}
2744 
2745 	if (err == 0)
2746 		goto out_put;
2747 
2748 	if (datagrams == 0) {
2749 		datagrams = err;
2750 		goto out_put;
2751 	}
2752 
2753 	/*
2754 	 * We may return less entries than requested (vlen) if the
2755 	 * sock is non block and there aren't enough datagrams...
2756 	 */
2757 	if (err != -EAGAIN) {
2758 		/*
2759 		 * ... or  if recvmsg returns an error after we
2760 		 * received some datagrams, where we record the
2761 		 * error to return on the next call or if the
2762 		 * app asks about it using getsockopt(SO_ERROR).
2763 		 */
2764 		sock->sk->sk_err = -err;
2765 	}
2766 out_put:
2767 	fput_light(sock->file, fput_needed);
2768 
2769 	return datagrams;
2770 }
2771 
2772 int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg,
2773 		   unsigned int vlen, unsigned int flags,
2774 		   struct __kernel_timespec __user *timeout,
2775 		   struct old_timespec32 __user *timeout32)
2776 {
2777 	int datagrams;
2778 	struct timespec64 timeout_sys;
2779 
2780 	if (timeout && get_timespec64(&timeout_sys, timeout))
2781 		return -EFAULT;
2782 
2783 	if (timeout32 && get_old_timespec32(&timeout_sys, timeout32))
2784 		return -EFAULT;
2785 
2786 	if (!timeout && !timeout32)
2787 		return do_recvmmsg(fd, mmsg, vlen, flags, NULL);
2788 
2789 	datagrams = do_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
2790 
2791 	if (datagrams <= 0)
2792 		return datagrams;
2793 
2794 	if (timeout && put_timespec64(&timeout_sys, timeout))
2795 		datagrams = -EFAULT;
2796 
2797 	if (timeout32 && put_old_timespec32(&timeout_sys, timeout32))
2798 		datagrams = -EFAULT;
2799 
2800 	return datagrams;
2801 }
2802 
2803 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
2804 		unsigned int, vlen, unsigned int, flags,
2805 		struct __kernel_timespec __user *, timeout)
2806 {
2807 	if (flags & MSG_CMSG_COMPAT)
2808 		return -EINVAL;
2809 
2810 	return __sys_recvmmsg(fd, mmsg, vlen, flags, timeout, NULL);
2811 }
2812 
2813 #ifdef CONFIG_COMPAT_32BIT_TIME
2814 SYSCALL_DEFINE5(recvmmsg_time32, int, fd, struct mmsghdr __user *, mmsg,
2815 		unsigned int, vlen, unsigned int, flags,
2816 		struct old_timespec32 __user *, timeout)
2817 {
2818 	if (flags & MSG_CMSG_COMPAT)
2819 		return -EINVAL;
2820 
2821 	return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL, timeout);
2822 }
2823 #endif
2824 
2825 #ifdef __ARCH_WANT_SYS_SOCKETCALL
2826 /* Argument list sizes for sys_socketcall */
2827 #define AL(x) ((x) * sizeof(unsigned long))
2828 static const unsigned char nargs[21] = {
2829 	AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
2830 	AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
2831 	AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
2832 	AL(4), AL(5), AL(4)
2833 };
2834 
2835 #undef AL
2836 
2837 /*
2838  *	System call vectors.
2839  *
2840  *	Argument checking cleaned up. Saved 20% in size.
2841  *  This function doesn't need to set the kernel lock because
2842  *  it is set by the callees.
2843  */
2844 
2845 SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
2846 {
2847 	unsigned long a[AUDITSC_ARGS];
2848 	unsigned long a0, a1;
2849 	int err;
2850 	unsigned int len;
2851 
2852 	if (call < 1 || call > SYS_SENDMMSG)
2853 		return -EINVAL;
2854 	call = array_index_nospec(call, SYS_SENDMMSG + 1);
2855 
2856 	len = nargs[call];
2857 	if (len > sizeof(a))
2858 		return -EINVAL;
2859 
2860 	/* copy_from_user should be SMP safe. */
2861 	if (copy_from_user(a, args, len))
2862 		return -EFAULT;
2863 
2864 	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
2865 	if (err)
2866 		return err;
2867 
2868 	a0 = a[0];
2869 	a1 = a[1];
2870 
2871 	switch (call) {
2872 	case SYS_SOCKET:
2873 		err = __sys_socket(a0, a1, a[2]);
2874 		break;
2875 	case SYS_BIND:
2876 		err = __sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
2877 		break;
2878 	case SYS_CONNECT:
2879 		err = __sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
2880 		break;
2881 	case SYS_LISTEN:
2882 		err = __sys_listen(a0, a1);
2883 		break;
2884 	case SYS_ACCEPT:
2885 		err = __sys_accept4(a0, (struct sockaddr __user *)a1,
2886 				    (int __user *)a[2], 0);
2887 		break;
2888 	case SYS_GETSOCKNAME:
2889 		err =
2890 		    __sys_getsockname(a0, (struct sockaddr __user *)a1,
2891 				      (int __user *)a[2]);
2892 		break;
2893 	case SYS_GETPEERNAME:
2894 		err =
2895 		    __sys_getpeername(a0, (struct sockaddr __user *)a1,
2896 				      (int __user *)a[2]);
2897 		break;
2898 	case SYS_SOCKETPAIR:
2899 		err = __sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
2900 		break;
2901 	case SYS_SEND:
2902 		err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
2903 				   NULL, 0);
2904 		break;
2905 	case SYS_SENDTO:
2906 		err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
2907 				   (struct sockaddr __user *)a[4], a[5]);
2908 		break;
2909 	case SYS_RECV:
2910 		err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2911 				     NULL, NULL);
2912 		break;
2913 	case SYS_RECVFROM:
2914 		err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
2915 				     (struct sockaddr __user *)a[4],
2916 				     (int __user *)a[5]);
2917 		break;
2918 	case SYS_SHUTDOWN:
2919 		err = __sys_shutdown(a0, a1);
2920 		break;
2921 	case SYS_SETSOCKOPT:
2922 		err = __sys_setsockopt(a0, a1, a[2], (char __user *)a[3],
2923 				       a[4]);
2924 		break;
2925 	case SYS_GETSOCKOPT:
2926 		err =
2927 		    __sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
2928 				     (int __user *)a[4]);
2929 		break;
2930 	case SYS_SENDMSG:
2931 		err = __sys_sendmsg(a0, (struct user_msghdr __user *)a1,
2932 				    a[2], true);
2933 		break;
2934 	case SYS_SENDMMSG:
2935 		err = __sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2],
2936 				     a[3], true);
2937 		break;
2938 	case SYS_RECVMSG:
2939 		err = __sys_recvmsg(a0, (struct user_msghdr __user *)a1,
2940 				    a[2], true);
2941 		break;
2942 	case SYS_RECVMMSG:
2943 		if (IS_ENABLED(CONFIG_64BIT))
2944 			err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
2945 					     a[2], a[3],
2946 					     (struct __kernel_timespec __user *)a[4],
2947 					     NULL);
2948 		else
2949 			err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
2950 					     a[2], a[3], NULL,
2951 					     (struct old_timespec32 __user *)a[4]);
2952 		break;
2953 	case SYS_ACCEPT4:
2954 		err = __sys_accept4(a0, (struct sockaddr __user *)a1,
2955 				    (int __user *)a[2], a[3]);
2956 		break;
2957 	default:
2958 		err = -EINVAL;
2959 		break;
2960 	}
2961 	return err;
2962 }
2963 
2964 #endif				/* __ARCH_WANT_SYS_SOCKETCALL */
2965 
2966 /**
2967  *	sock_register - add a socket protocol handler
2968  *	@ops: description of protocol
2969  *
2970  *	This function is called by a protocol handler that wants to
2971  *	advertise its address family, and have it linked into the
2972  *	socket interface. The value ops->family corresponds to the
2973  *	socket system call protocol family.
2974  */
2975 int sock_register(const struct net_proto_family *ops)
2976 {
2977 	int err;
2978 
2979 	if (ops->family >= NPROTO) {
2980 		pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
2981 		return -ENOBUFS;
2982 	}
2983 
2984 	spin_lock(&net_family_lock);
2985 	if (rcu_dereference_protected(net_families[ops->family],
2986 				      lockdep_is_held(&net_family_lock)))
2987 		err = -EEXIST;
2988 	else {
2989 		rcu_assign_pointer(net_families[ops->family], ops);
2990 		err = 0;
2991 	}
2992 	spin_unlock(&net_family_lock);
2993 
2994 	pr_info("NET: Registered protocol family %d\n", ops->family);
2995 	return err;
2996 }
2997 EXPORT_SYMBOL(sock_register);
2998 
2999 /**
3000  *	sock_unregister - remove a protocol handler
3001  *	@family: protocol family to remove
3002  *
3003  *	This function is called by a protocol handler that wants to
3004  *	remove its address family, and have it unlinked from the
3005  *	new socket creation.
3006  *
3007  *	If protocol handler is a module, then it can use module reference
3008  *	counts to protect against new references. If protocol handler is not
3009  *	a module then it needs to provide its own protection in
3010  *	the ops->create routine.
3011  */
3012 void sock_unregister(int family)
3013 {
3014 	BUG_ON(family < 0 || family >= NPROTO);
3015 
3016 	spin_lock(&net_family_lock);
3017 	RCU_INIT_POINTER(net_families[family], NULL);
3018 	spin_unlock(&net_family_lock);
3019 
3020 	synchronize_rcu();
3021 
3022 	pr_info("NET: Unregistered protocol family %d\n", family);
3023 }
3024 EXPORT_SYMBOL(sock_unregister);
3025 
3026 bool sock_is_registered(int family)
3027 {
3028 	return family < NPROTO && rcu_access_pointer(net_families[family]);
3029 }
3030 
3031 static int __init sock_init(void)
3032 {
3033 	int err;
3034 	/*
3035 	 *      Initialize the network sysctl infrastructure.
3036 	 */
3037 	err = net_sysctl_init();
3038 	if (err)
3039 		goto out;
3040 
3041 	/*
3042 	 *      Initialize skbuff SLAB cache
3043 	 */
3044 	skb_init();
3045 
3046 	/*
3047 	 *      Initialize the protocols module.
3048 	 */
3049 
3050 	init_inodecache();
3051 
3052 	err = register_filesystem(&sock_fs_type);
3053 	if (err)
3054 		goto out_fs;
3055 	sock_mnt = kern_mount(&sock_fs_type);
3056 	if (IS_ERR(sock_mnt)) {
3057 		err = PTR_ERR(sock_mnt);
3058 		goto out_mount;
3059 	}
3060 
3061 	/* The real protocol initialization is performed in later initcalls.
3062 	 */
3063 
3064 #ifdef CONFIG_NETFILTER
3065 	err = netfilter_init();
3066 	if (err)
3067 		goto out;
3068 #endif
3069 
3070 	ptp_classifier_init();
3071 
3072 out:
3073 	return err;
3074 
3075 out_mount:
3076 	unregister_filesystem(&sock_fs_type);
3077 out_fs:
3078 	goto out;
3079 }
3080 
3081 core_initcall(sock_init);	/* early initcall */
3082 
3083 #ifdef CONFIG_PROC_FS
3084 void socket_seq_show(struct seq_file *seq)
3085 {
3086 	seq_printf(seq, "sockets: used %d\n",
3087 		   sock_inuse_get(seq->private));
3088 }
3089 #endif				/* CONFIG_PROC_FS */
3090 
3091 #ifdef CONFIG_COMPAT
3092 static int compat_dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
3093 {
3094 	struct compat_ifconf ifc32;
3095 	struct ifconf ifc;
3096 	int err;
3097 
3098 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
3099 		return -EFAULT;
3100 
3101 	ifc.ifc_len = ifc32.ifc_len;
3102 	ifc.ifc_req = compat_ptr(ifc32.ifcbuf);
3103 
3104 	rtnl_lock();
3105 	err = dev_ifconf(net, &ifc, sizeof(struct compat_ifreq));
3106 	rtnl_unlock();
3107 	if (err)
3108 		return err;
3109 
3110 	ifc32.ifc_len = ifc.ifc_len;
3111 	if (copy_to_user(uifc32, &ifc32, sizeof(struct compat_ifconf)))
3112 		return -EFAULT;
3113 
3114 	return 0;
3115 }
3116 
3117 static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
3118 {
3119 	struct compat_ethtool_rxnfc __user *compat_rxnfc;
3120 	bool convert_in = false, convert_out = false;
3121 	size_t buf_size = 0;
3122 	struct ethtool_rxnfc __user *rxnfc = NULL;
3123 	struct ifreq ifr;
3124 	u32 rule_cnt = 0, actual_rule_cnt;
3125 	u32 ethcmd;
3126 	u32 data;
3127 	int ret;
3128 
3129 	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
3130 		return -EFAULT;
3131 
3132 	compat_rxnfc = compat_ptr(data);
3133 
3134 	if (get_user(ethcmd, &compat_rxnfc->cmd))
3135 		return -EFAULT;
3136 
3137 	/* Most ethtool structures are defined without padding.
3138 	 * Unfortunately struct ethtool_rxnfc is an exception.
3139 	 */
3140 	switch (ethcmd) {
3141 	default:
3142 		break;
3143 	case ETHTOOL_GRXCLSRLALL:
3144 		/* Buffer size is variable */
3145 		if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
3146 			return -EFAULT;
3147 		if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
3148 			return -ENOMEM;
3149 		buf_size += rule_cnt * sizeof(u32);
3150 		/* fall through */
3151 	case ETHTOOL_GRXRINGS:
3152 	case ETHTOOL_GRXCLSRLCNT:
3153 	case ETHTOOL_GRXCLSRULE:
3154 	case ETHTOOL_SRXCLSRLINS:
3155 		convert_out = true;
3156 		/* fall through */
3157 	case ETHTOOL_SRXCLSRLDEL:
3158 		buf_size += sizeof(struct ethtool_rxnfc);
3159 		convert_in = true;
3160 		rxnfc = compat_alloc_user_space(buf_size);
3161 		break;
3162 	}
3163 
3164 	if (copy_from_user(&ifr.ifr_name, &ifr32->ifr_name, IFNAMSIZ))
3165 		return -EFAULT;
3166 
3167 	ifr.ifr_data = convert_in ? rxnfc : (void __user *)compat_rxnfc;
3168 
3169 	if (convert_in) {
3170 		/* We expect there to be holes between fs.m_ext and
3171 		 * fs.ring_cookie and at the end of fs, but nowhere else.
3172 		 */
3173 		BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
3174 			     sizeof(compat_rxnfc->fs.m_ext) !=
3175 			     offsetof(struct ethtool_rxnfc, fs.m_ext) +
3176 			     sizeof(rxnfc->fs.m_ext));
3177 		BUILD_BUG_ON(
3178 			offsetof(struct compat_ethtool_rxnfc, fs.location) -
3179 			offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
3180 			offsetof(struct ethtool_rxnfc, fs.location) -
3181 			offsetof(struct ethtool_rxnfc, fs.ring_cookie));
3182 
3183 		if (copy_in_user(rxnfc, compat_rxnfc,
3184 				 (void __user *)(&rxnfc->fs.m_ext + 1) -
3185 				 (void __user *)rxnfc) ||
3186 		    copy_in_user(&rxnfc->fs.ring_cookie,
3187 				 &compat_rxnfc->fs.ring_cookie,
3188 				 (void __user *)(&rxnfc->fs.location + 1) -
3189 				 (void __user *)&rxnfc->fs.ring_cookie))
3190 			return -EFAULT;
3191 		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
3192 			if (put_user(rule_cnt, &rxnfc->rule_cnt))
3193 				return -EFAULT;
3194 		} else if (copy_in_user(&rxnfc->rule_cnt,
3195 					&compat_rxnfc->rule_cnt,
3196 					sizeof(rxnfc->rule_cnt)))
3197 			return -EFAULT;
3198 	}
3199 
3200 	ret = dev_ioctl(net, SIOCETHTOOL, &ifr, NULL);
3201 	if (ret)
3202 		return ret;
3203 
3204 	if (convert_out) {
3205 		if (copy_in_user(compat_rxnfc, rxnfc,
3206 				 (const void __user *)(&rxnfc->fs.m_ext + 1) -
3207 				 (const void __user *)rxnfc) ||
3208 		    copy_in_user(&compat_rxnfc->fs.ring_cookie,
3209 				 &rxnfc->fs.ring_cookie,
3210 				 (const void __user *)(&rxnfc->fs.location + 1) -
3211 				 (const void __user *)&rxnfc->fs.ring_cookie) ||
3212 		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
3213 				 sizeof(rxnfc->rule_cnt)))
3214 			return -EFAULT;
3215 
3216 		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
3217 			/* As an optimisation, we only copy the actual
3218 			 * number of rules that the underlying
3219 			 * function returned.  Since Mallory might
3220 			 * change the rule count in user memory, we
3221 			 * check that it is less than the rule count
3222 			 * originally given (as the user buffer size),
3223 			 * which has been range-checked.
3224 			 */
3225 			if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
3226 				return -EFAULT;
3227 			if (actual_rule_cnt < rule_cnt)
3228 				rule_cnt = actual_rule_cnt;
3229 			if (copy_in_user(&compat_rxnfc->rule_locs[0],
3230 					 &rxnfc->rule_locs[0],
3231 					 rule_cnt * sizeof(u32)))
3232 				return -EFAULT;
3233 		}
3234 	}
3235 
3236 	return 0;
3237 }
3238 
3239 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
3240 {
3241 	compat_uptr_t uptr32;
3242 	struct ifreq ifr;
3243 	void __user *saved;
3244 	int err;
3245 
3246 	if (copy_from_user(&ifr, uifr32, sizeof(struct compat_ifreq)))
3247 		return -EFAULT;
3248 
3249 	if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
3250 		return -EFAULT;
3251 
3252 	saved = ifr.ifr_settings.ifs_ifsu.raw_hdlc;
3253 	ifr.ifr_settings.ifs_ifsu.raw_hdlc = compat_ptr(uptr32);
3254 
3255 	err = dev_ioctl(net, SIOCWANDEV, &ifr, NULL);
3256 	if (!err) {
3257 		ifr.ifr_settings.ifs_ifsu.raw_hdlc = saved;
3258 		if (copy_to_user(uifr32, &ifr, sizeof(struct compat_ifreq)))
3259 			err = -EFAULT;
3260 	}
3261 	return err;
3262 }
3263 
3264 /* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
3265 static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
3266 				 struct compat_ifreq __user *u_ifreq32)
3267 {
3268 	struct ifreq ifreq;
3269 	u32 data32;
3270 
3271 	if (copy_from_user(ifreq.ifr_name, u_ifreq32->ifr_name, IFNAMSIZ))
3272 		return -EFAULT;
3273 	if (get_user(data32, &u_ifreq32->ifr_data))
3274 		return -EFAULT;
3275 	ifreq.ifr_data = compat_ptr(data32);
3276 
3277 	return dev_ioctl(net, cmd, &ifreq, NULL);
3278 }
3279 
3280 static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
3281 			      unsigned int cmd,
3282 			      struct compat_ifreq __user *uifr32)
3283 {
3284 	struct ifreq __user *uifr;
3285 	int err;
3286 
3287 	/* Handle the fact that while struct ifreq has the same *layout* on
3288 	 * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
3289 	 * which are handled elsewhere, it still has different *size* due to
3290 	 * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
3291 	 * resulting in struct ifreq being 32 and 40 bytes respectively).
3292 	 * As a result, if the struct happens to be at the end of a page and
3293 	 * the next page isn't readable/writable, we get a fault. To prevent
3294 	 * that, copy back and forth to the full size.
3295 	 */
3296 
3297 	uifr = compat_alloc_user_space(sizeof(*uifr));
3298 	if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
3299 		return -EFAULT;
3300 
3301 	err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
3302 
3303 	if (!err) {
3304 		switch (cmd) {
3305 		case SIOCGIFFLAGS:
3306 		case SIOCGIFMETRIC:
3307 		case SIOCGIFMTU:
3308 		case SIOCGIFMEM:
3309 		case SIOCGIFHWADDR:
3310 		case SIOCGIFINDEX:
3311 		case SIOCGIFADDR:
3312 		case SIOCGIFBRDADDR:
3313 		case SIOCGIFDSTADDR:
3314 		case SIOCGIFNETMASK:
3315 		case SIOCGIFPFLAGS:
3316 		case SIOCGIFTXQLEN:
3317 		case SIOCGMIIPHY:
3318 		case SIOCGMIIREG:
3319 		case SIOCGIFNAME:
3320 			if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
3321 				err = -EFAULT;
3322 			break;
3323 		}
3324 	}
3325 	return err;
3326 }
3327 
3328 static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
3329 			struct compat_ifreq __user *uifr32)
3330 {
3331 	struct ifreq ifr;
3332 	struct compat_ifmap __user *uifmap32;
3333 	int err;
3334 
3335 	uifmap32 = &uifr32->ifr_ifru.ifru_map;
3336 	err = copy_from_user(&ifr, uifr32, sizeof(ifr.ifr_name));
3337 	err |= get_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3338 	err |= get_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3339 	err |= get_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3340 	err |= get_user(ifr.ifr_map.irq, &uifmap32->irq);
3341 	err |= get_user(ifr.ifr_map.dma, &uifmap32->dma);
3342 	err |= get_user(ifr.ifr_map.port, &uifmap32->port);
3343 	if (err)
3344 		return -EFAULT;
3345 
3346 	err = dev_ioctl(net, cmd, &ifr, NULL);
3347 
3348 	if (cmd == SIOCGIFMAP && !err) {
3349 		err = copy_to_user(uifr32, &ifr, sizeof(ifr.ifr_name));
3350 		err |= put_user(ifr.ifr_map.mem_start, &uifmap32->mem_start);
3351 		err |= put_user(ifr.ifr_map.mem_end, &uifmap32->mem_end);
3352 		err |= put_user(ifr.ifr_map.base_addr, &uifmap32->base_addr);
3353 		err |= put_user(ifr.ifr_map.irq, &uifmap32->irq);
3354 		err |= put_user(ifr.ifr_map.dma, &uifmap32->dma);
3355 		err |= put_user(ifr.ifr_map.port, &uifmap32->port);
3356 		if (err)
3357 			err = -EFAULT;
3358 	}
3359 	return err;
3360 }
3361 
3362 struct rtentry32 {
3363 	u32		rt_pad1;
3364 	struct sockaddr rt_dst;         /* target address               */
3365 	struct sockaddr rt_gateway;     /* gateway addr (RTF_GATEWAY)   */
3366 	struct sockaddr rt_genmask;     /* target network mask (IP)     */
3367 	unsigned short	rt_flags;
3368 	short		rt_pad2;
3369 	u32		rt_pad3;
3370 	unsigned char	rt_tos;
3371 	unsigned char	rt_class;
3372 	short		rt_pad4;
3373 	short		rt_metric;      /* +1 for binary compatibility! */
3374 	/* char * */ u32 rt_dev;        /* forcing the device at add    */
3375 	u32		rt_mtu;         /* per route MTU/Window         */
3376 	u32		rt_window;      /* Window clamping              */
3377 	unsigned short  rt_irtt;        /* Initial RTT                  */
3378 };
3379 
3380 struct in6_rtmsg32 {
3381 	struct in6_addr		rtmsg_dst;
3382 	struct in6_addr		rtmsg_src;
3383 	struct in6_addr		rtmsg_gateway;
3384 	u32			rtmsg_type;
3385 	u16			rtmsg_dst_len;
3386 	u16			rtmsg_src_len;
3387 	u32			rtmsg_metric;
3388 	u32			rtmsg_info;
3389 	u32			rtmsg_flags;
3390 	s32			rtmsg_ifindex;
3391 };
3392 
3393 static int routing_ioctl(struct net *net, struct socket *sock,
3394 			 unsigned int cmd, void __user *argp)
3395 {
3396 	int ret;
3397 	void *r = NULL;
3398 	struct in6_rtmsg r6;
3399 	struct rtentry r4;
3400 	char devname[16];
3401 	u32 rtdev;
3402 	mm_segment_t old_fs = get_fs();
3403 
3404 	if (sock && sock->sk && sock->sk->sk_family == AF_INET6) { /* ipv6 */
3405 		struct in6_rtmsg32 __user *ur6 = argp;
3406 		ret = copy_from_user(&r6.rtmsg_dst, &(ur6->rtmsg_dst),
3407 			3 * sizeof(struct in6_addr));
3408 		ret |= get_user(r6.rtmsg_type, &(ur6->rtmsg_type));
3409 		ret |= get_user(r6.rtmsg_dst_len, &(ur6->rtmsg_dst_len));
3410 		ret |= get_user(r6.rtmsg_src_len, &(ur6->rtmsg_src_len));
3411 		ret |= get_user(r6.rtmsg_metric, &(ur6->rtmsg_metric));
3412 		ret |= get_user(r6.rtmsg_info, &(ur6->rtmsg_info));
3413 		ret |= get_user(r6.rtmsg_flags, &(ur6->rtmsg_flags));
3414 		ret |= get_user(r6.rtmsg_ifindex, &(ur6->rtmsg_ifindex));
3415 
3416 		r = (void *) &r6;
3417 	} else { /* ipv4 */
3418 		struct rtentry32 __user *ur4 = argp;
3419 		ret = copy_from_user(&r4.rt_dst, &(ur4->rt_dst),
3420 					3 * sizeof(struct sockaddr));
3421 		ret |= get_user(r4.rt_flags, &(ur4->rt_flags));
3422 		ret |= get_user(r4.rt_metric, &(ur4->rt_metric));
3423 		ret |= get_user(r4.rt_mtu, &(ur4->rt_mtu));
3424 		ret |= get_user(r4.rt_window, &(ur4->rt_window));
3425 		ret |= get_user(r4.rt_irtt, &(ur4->rt_irtt));
3426 		ret |= get_user(rtdev, &(ur4->rt_dev));
3427 		if (rtdev) {
3428 			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
3429 			r4.rt_dev = (char __user __force *)devname;
3430 			devname[15] = 0;
3431 		} else
3432 			r4.rt_dev = NULL;
3433 
3434 		r = (void *) &r4;
3435 	}
3436 
3437 	if (ret) {
3438 		ret = -EFAULT;
3439 		goto out;
3440 	}
3441 
3442 	set_fs(KERNEL_DS);
3443 	ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
3444 	set_fs(old_fs);
3445 
3446 out:
3447 	return ret;
3448 }
3449 
3450 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
3451  * for some operations; this forces use of the newer bridge-utils that
3452  * use compatible ioctls
3453  */
3454 static int old_bridge_ioctl(compat_ulong_t __user *argp)
3455 {
3456 	compat_ulong_t tmp;
3457 
3458 	if (get_user(tmp, argp))
3459 		return -EFAULT;
3460 	if (tmp == BRCTL_GET_VERSION)
3461 		return BRCTL_VERSION + 1;
3462 	return -EINVAL;
3463 }
3464 
3465 static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
3466 			 unsigned int cmd, unsigned long arg)
3467 {
3468 	void __user *argp = compat_ptr(arg);
3469 	struct sock *sk = sock->sk;
3470 	struct net *net = sock_net(sk);
3471 
3472 	if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
3473 		return compat_ifr_data_ioctl(net, cmd, argp);
3474 
3475 	switch (cmd) {
3476 	case SIOCSIFBR:
3477 	case SIOCGIFBR:
3478 		return old_bridge_ioctl(argp);
3479 	case SIOCGIFCONF:
3480 		return compat_dev_ifconf(net, argp);
3481 	case SIOCETHTOOL:
3482 		return ethtool_ioctl(net, argp);
3483 	case SIOCWANDEV:
3484 		return compat_siocwandev(net, argp);
3485 	case SIOCGIFMAP:
3486 	case SIOCSIFMAP:
3487 		return compat_sioc_ifmap(net, cmd, argp);
3488 	case SIOCADDRT:
3489 	case SIOCDELRT:
3490 		return routing_ioctl(net, sock, cmd, argp);
3491 	case SIOCGSTAMP_OLD:
3492 	case SIOCGSTAMPNS_OLD:
3493 		if (!sock->ops->gettstamp)
3494 			return -ENOIOCTLCMD;
3495 		return sock->ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD,
3496 					    !COMPAT_USE_64BIT_TIME);
3497 
3498 	case SIOCBONDSLAVEINFOQUERY:
3499 	case SIOCBONDINFOQUERY:
3500 	case SIOCSHWTSTAMP:
3501 	case SIOCGHWTSTAMP:
3502 		return compat_ifr_data_ioctl(net, cmd, argp);
3503 
3504 	case FIOSETOWN:
3505 	case SIOCSPGRP:
3506 	case FIOGETOWN:
3507 	case SIOCGPGRP:
3508 	case SIOCBRADDBR:
3509 	case SIOCBRDELBR:
3510 	case SIOCGIFVLAN:
3511 	case SIOCSIFVLAN:
3512 	case SIOCADDDLCI:
3513 	case SIOCDELDLCI:
3514 	case SIOCGSKNS:
3515 	case SIOCGSTAMP_NEW:
3516 	case SIOCGSTAMPNS_NEW:
3517 		return sock_ioctl(file, cmd, arg);
3518 
3519 	case SIOCGIFFLAGS:
3520 	case SIOCSIFFLAGS:
3521 	case SIOCGIFMETRIC:
3522 	case SIOCSIFMETRIC:
3523 	case SIOCGIFMTU:
3524 	case SIOCSIFMTU:
3525 	case SIOCGIFMEM:
3526 	case SIOCSIFMEM:
3527 	case SIOCGIFHWADDR:
3528 	case SIOCSIFHWADDR:
3529 	case SIOCADDMULTI:
3530 	case SIOCDELMULTI:
3531 	case SIOCGIFINDEX:
3532 	case SIOCGIFADDR:
3533 	case SIOCSIFADDR:
3534 	case SIOCSIFHWBROADCAST:
3535 	case SIOCDIFADDR:
3536 	case SIOCGIFBRDADDR:
3537 	case SIOCSIFBRDADDR:
3538 	case SIOCGIFDSTADDR:
3539 	case SIOCSIFDSTADDR:
3540 	case SIOCGIFNETMASK:
3541 	case SIOCSIFNETMASK:
3542 	case SIOCSIFPFLAGS:
3543 	case SIOCGIFPFLAGS:
3544 	case SIOCGIFTXQLEN:
3545 	case SIOCSIFTXQLEN:
3546 	case SIOCBRADDIF:
3547 	case SIOCBRDELIF:
3548 	case SIOCGIFNAME:
3549 	case SIOCSIFNAME:
3550 	case SIOCGMIIPHY:
3551 	case SIOCGMIIREG:
3552 	case SIOCSMIIREG:
3553 	case SIOCBONDENSLAVE:
3554 	case SIOCBONDRELEASE:
3555 	case SIOCBONDSETHWADDR:
3556 	case SIOCBONDCHANGEACTIVE:
3557 		return compat_ifreq_ioctl(net, sock, cmd, argp);
3558 
3559 	case SIOCSARP:
3560 	case SIOCGARP:
3561 	case SIOCDARP:
3562 	case SIOCOUTQ:
3563 	case SIOCOUTQNSD:
3564 	case SIOCATMARK:
3565 		return sock_do_ioctl(net, sock, cmd, arg);
3566 	}
3567 
3568 	return -ENOIOCTLCMD;
3569 }
3570 
3571 static long compat_sock_ioctl(struct file *file, unsigned int cmd,
3572 			      unsigned long arg)
3573 {
3574 	struct socket *sock = file->private_data;
3575 	int ret = -ENOIOCTLCMD;
3576 	struct sock *sk;
3577 	struct net *net;
3578 
3579 	sk = sock->sk;
3580 	net = sock_net(sk);
3581 
3582 	if (sock->ops->compat_ioctl)
3583 		ret = sock->ops->compat_ioctl(sock, cmd, arg);
3584 
3585 	if (ret == -ENOIOCTLCMD &&
3586 	    (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
3587 		ret = compat_wext_handle_ioctl(net, cmd, arg);
3588 
3589 	if (ret == -ENOIOCTLCMD)
3590 		ret = compat_sock_ioctl_trans(file, sock, cmd, arg);
3591 
3592 	return ret;
3593 }
3594 #endif
3595 
3596 /**
3597  *	kernel_bind - bind an address to a socket (kernel space)
3598  *	@sock: socket
3599  *	@addr: address
3600  *	@addrlen: length of address
3601  *
3602  *	Returns 0 or an error.
3603  */
3604 
3605 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
3606 {
3607 	return sock->ops->bind(sock, addr, addrlen);
3608 }
3609 EXPORT_SYMBOL(kernel_bind);
3610 
3611 /**
3612  *	kernel_listen - move socket to listening state (kernel space)
3613  *	@sock: socket
3614  *	@backlog: pending connections queue size
3615  *
3616  *	Returns 0 or an error.
3617  */
3618 
3619 int kernel_listen(struct socket *sock, int backlog)
3620 {
3621 	return sock->ops->listen(sock, backlog);
3622 }
3623 EXPORT_SYMBOL(kernel_listen);
3624 
3625 /**
3626  *	kernel_accept - accept a connection (kernel space)
3627  *	@sock: listening socket
3628  *	@newsock: new connected socket
3629  *	@flags: flags
3630  *
3631  *	@flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0.
3632  *	If it fails, @newsock is guaranteed to be %NULL.
3633  *	Returns 0 or an error.
3634  */
3635 
3636 int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
3637 {
3638 	struct sock *sk = sock->sk;
3639 	int err;
3640 
3641 	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
3642 			       newsock);
3643 	if (err < 0)
3644 		goto done;
3645 
3646 	err = sock->ops->accept(sock, *newsock, flags, true);
3647 	if (err < 0) {
3648 		sock_release(*newsock);
3649 		*newsock = NULL;
3650 		goto done;
3651 	}
3652 
3653 	(*newsock)->ops = sock->ops;
3654 	__module_get((*newsock)->ops->owner);
3655 
3656 done:
3657 	return err;
3658 }
3659 EXPORT_SYMBOL(kernel_accept);
3660 
3661 /**
3662  *	kernel_connect - connect a socket (kernel space)
3663  *	@sock: socket
3664  *	@addr: address
3665  *	@addrlen: address length
3666  *	@flags: flags (O_NONBLOCK, ...)
3667  *
3668  *	For datagram sockets, @addr is the addres to which datagrams are sent
3669  *	by default, and the only address from which datagrams are received.
3670  *	For stream sockets, attempts to connect to @addr.
3671  *	Returns 0 or an error code.
3672  */
3673 
3674 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
3675 		   int flags)
3676 {
3677 	return sock->ops->connect(sock, addr, addrlen, flags);
3678 }
3679 EXPORT_SYMBOL(kernel_connect);
3680 
3681 /**
3682  *	kernel_getsockname - get the address which the socket is bound (kernel space)
3683  *	@sock: socket
3684  *	@addr: address holder
3685  *
3686  * 	Fills the @addr pointer with the address which the socket is bound.
3687  *	Returns 0 or an error code.
3688  */
3689 
3690 int kernel_getsockname(struct socket *sock, struct sockaddr *addr)
3691 {
3692 	return sock->ops->getname(sock, addr, 0);
3693 }
3694 EXPORT_SYMBOL(kernel_getsockname);
3695 
3696 /**
3697  *	kernel_peername - get the address which the socket is connected (kernel space)
3698  *	@sock: socket
3699  *	@addr: address holder
3700  *
3701  * 	Fills the @addr pointer with the address which the socket is connected.
3702  *	Returns 0 or an error code.
3703  */
3704 
3705 int kernel_getpeername(struct socket *sock, struct sockaddr *addr)
3706 {
3707 	return sock->ops->getname(sock, addr, 1);
3708 }
3709 EXPORT_SYMBOL(kernel_getpeername);
3710 
3711 /**
3712  *	kernel_getsockopt - get a socket option (kernel space)
3713  *	@sock: socket
3714  *	@level: API level (SOL_SOCKET, ...)
3715  *	@optname: option tag
3716  *	@optval: option value
3717  *	@optlen: option length
3718  *
3719  *	Assigns the option length to @optlen.
3720  *	Returns 0 or an error.
3721  */
3722 
3723 int kernel_getsockopt(struct socket *sock, int level, int optname,
3724 			char *optval, int *optlen)
3725 {
3726 	mm_segment_t oldfs = get_fs();
3727 	char __user *uoptval;
3728 	int __user *uoptlen;
3729 	int err;
3730 
3731 	uoptval = (char __user __force *) optval;
3732 	uoptlen = (int __user __force *) optlen;
3733 
3734 	set_fs(KERNEL_DS);
3735 	if (level == SOL_SOCKET)
3736 		err = sock_getsockopt(sock, level, optname, uoptval, uoptlen);
3737 	else
3738 		err = sock->ops->getsockopt(sock, level, optname, uoptval,
3739 					    uoptlen);
3740 	set_fs(oldfs);
3741 	return err;
3742 }
3743 EXPORT_SYMBOL(kernel_getsockopt);
3744 
3745 /**
3746  *	kernel_setsockopt - set a socket option (kernel space)
3747  *	@sock: socket
3748  *	@level: API level (SOL_SOCKET, ...)
3749  *	@optname: option tag
3750  *	@optval: option value
3751  *	@optlen: option length
3752  *
3753  *	Returns 0 or an error.
3754  */
3755 
3756 int kernel_setsockopt(struct socket *sock, int level, int optname,
3757 			char *optval, unsigned int optlen)
3758 {
3759 	mm_segment_t oldfs = get_fs();
3760 	char __user *uoptval;
3761 	int err;
3762 
3763 	uoptval = (char __user __force *) optval;
3764 
3765 	set_fs(KERNEL_DS);
3766 	if (level == SOL_SOCKET)
3767 		err = sock_setsockopt(sock, level, optname, uoptval, optlen);
3768 	else
3769 		err = sock->ops->setsockopt(sock, level, optname, uoptval,
3770 					    optlen);
3771 	set_fs(oldfs);
3772 	return err;
3773 }
3774 EXPORT_SYMBOL(kernel_setsockopt);
3775 
3776 /**
3777  *	kernel_sendpage - send a &page through a socket (kernel space)
3778  *	@sock: socket
3779  *	@page: page
3780  *	@offset: page offset
3781  *	@size: total size in bytes
3782  *	@flags: flags (MSG_DONTWAIT, ...)
3783  *
3784  *	Returns the total amount sent in bytes or an error.
3785  */
3786 
3787 int kernel_sendpage(struct socket *sock, struct page *page, int offset,
3788 		    size_t size, int flags)
3789 {
3790 	if (sock->ops->sendpage)
3791 		return sock->ops->sendpage(sock, page, offset, size, flags);
3792 
3793 	return sock_no_sendpage(sock, page, offset, size, flags);
3794 }
3795 EXPORT_SYMBOL(kernel_sendpage);
3796 
3797 /**
3798  *	kernel_sendpage_locked - send a &page through the locked sock (kernel space)
3799  *	@sk: sock
3800  *	@page: page
3801  *	@offset: page offset
3802  *	@size: total size in bytes
3803  *	@flags: flags (MSG_DONTWAIT, ...)
3804  *
3805  *	Returns the total amount sent in bytes or an error.
3806  *	Caller must hold @sk.
3807  */
3808 
3809 int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset,
3810 			   size_t size, int flags)
3811 {
3812 	struct socket *sock = sk->sk_socket;
3813 
3814 	if (sock->ops->sendpage_locked)
3815 		return sock->ops->sendpage_locked(sk, page, offset, size,
3816 						  flags);
3817 
3818 	return sock_no_sendpage_locked(sk, page, offset, size, flags);
3819 }
3820 EXPORT_SYMBOL(kernel_sendpage_locked);
3821 
3822 /**
3823  *	kernel_shutdown - shut down part of a full-duplex connection (kernel space)
3824  *	@sock: socket
3825  *	@how: connection part
3826  *
3827  *	Returns 0 or an error.
3828  */
3829 
3830 int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
3831 {
3832 	return sock->ops->shutdown(sock, how);
3833 }
3834 EXPORT_SYMBOL(kernel_sock_shutdown);
3835 
3836 /**
3837  *	kernel_sock_ip_overhead - returns the IP overhead imposed by a socket
3838  *	@sk: socket
3839  *
3840  *	This routine returns the IP overhead imposed by a socket i.e.
3841  *	the length of the underlying IP header, depending on whether
3842  *	this is an IPv4 or IPv6 socket and the length from IP options turned
3843  *	on at the socket. Assumes that the caller has a lock on the socket.
3844  */
3845 
3846 u32 kernel_sock_ip_overhead(struct sock *sk)
3847 {
3848 	struct inet_sock *inet;
3849 	struct ip_options_rcu *opt;
3850 	u32 overhead = 0;
3851 #if IS_ENABLED(CONFIG_IPV6)
3852 	struct ipv6_pinfo *np;
3853 	struct ipv6_txoptions *optv6 = NULL;
3854 #endif /* IS_ENABLED(CONFIG_IPV6) */
3855 
3856 	if (!sk)
3857 		return overhead;
3858 
3859 	switch (sk->sk_family) {
3860 	case AF_INET:
3861 		inet = inet_sk(sk);
3862 		overhead += sizeof(struct iphdr);
3863 		opt = rcu_dereference_protected(inet->inet_opt,
3864 						sock_owned_by_user(sk));
3865 		if (opt)
3866 			overhead += opt->opt.optlen;
3867 		return overhead;
3868 #if IS_ENABLED(CONFIG_IPV6)
3869 	case AF_INET6:
3870 		np = inet6_sk(sk);
3871 		overhead += sizeof(struct ipv6hdr);
3872 		if (np)
3873 			optv6 = rcu_dereference_protected(np->opt,
3874 							  sock_owned_by_user(sk));
3875 		if (optv6)
3876 			overhead += (optv6->opt_flen + optv6->opt_nflen);
3877 		return overhead;
3878 #endif /* IS_ENABLED(CONFIG_IPV6) */
3879 	default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
3880 		return overhead;
3881 	}
3882 }
3883 EXPORT_SYMBOL(kernel_sock_ip_overhead);
3884