1 // SPDX-License-Identifier: GPL-2.0-only
3 * 32bit Socket syscall emulation. Based on arch/sparc64/kernel/sys_sparc32.c.
5 * Copyright (C) 2000 VA Linux Co
6 * Copyright (C) 2000 Don Dugger <n0ano@valinux.com>
7 * Copyright (C) 1999 Arun Sharma <arun.sharma@intel.com>
8 * Copyright (C) 1997,1998 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
9 * Copyright (C) 1997 David S. Miller (davem@caip.rutgers.edu)
10 * Copyright (C) 2000 Hewlett-Packard Co.
11 * Copyright (C) 2000 David Mosberger-Tang <davidm@hpl.hp.com>
12 * Copyright (C) 2000,2001 Andi Kleen, SuSE Labs
15 #include <linux/kernel.h>
16 #include <linux/gfp.h>
18 #include <linux/types.h>
19 #include <linux/file.h>
20 #include <linux/icmpv6.h>
21 #include <linux/socket.h>
22 #include <linux/syscalls.h>
23 #include <linux/filter.h>
24 #include <linux/compat.h>
25 #include <linux/security.h>
26 #include <linux/audit.h>
27 #include <linux/export.h>
33 #include <linux/uaccess.h>
34 #include <net/compat.h>
36 int __get_compat_msghdr(struct msghdr
*kmsg
,
37 struct compat_msghdr __user
*umsg
,
38 struct sockaddr __user
**save_addr
,
39 compat_uptr_t
*ptr
, compat_size_t
*len
)
41 struct compat_msghdr msg
;
44 if (copy_from_user(&msg
, umsg
, sizeof(*umsg
)))
47 kmsg
->msg_flags
= msg
.msg_flags
;
48 kmsg
->msg_namelen
= msg
.msg_namelen
;
51 kmsg
->msg_namelen
= 0;
53 if (kmsg
->msg_namelen
< 0)
56 if (kmsg
->msg_namelen
> sizeof(struct sockaddr_storage
))
57 kmsg
->msg_namelen
= sizeof(struct sockaddr_storage
);
59 kmsg
->msg_control_is_user
= true;
60 kmsg
->msg_control_user
= compat_ptr(msg
.msg_control
);
61 kmsg
->msg_controllen
= msg
.msg_controllen
;
64 *save_addr
= compat_ptr(msg
.msg_name
);
66 if (msg
.msg_name
&& kmsg
->msg_namelen
) {
68 err
= move_addr_to_kernel(compat_ptr(msg
.msg_name
),
75 kmsg
->msg_name
= NULL
;
76 kmsg
->msg_namelen
= 0;
79 if (msg
.msg_iovlen
> UIO_MAXIOV
)
82 kmsg
->msg_iocb
= NULL
;
84 *len
= msg
.msg_iovlen
;
88 int get_compat_msghdr(struct msghdr
*kmsg
,
89 struct compat_msghdr __user
*umsg
,
90 struct sockaddr __user
**save_addr
,
97 err
= __get_compat_msghdr(kmsg
, umsg
, save_addr
, &ptr
, &len
);
101 err
= compat_import_iovec(save_addr
? READ
: WRITE
, compat_ptr(ptr
),
102 len
, UIO_FASTIOV
, iov
, &kmsg
->msg_iter
);
103 return err
< 0 ? err
: 0;
107 #define CMSG_COMPAT_ALIGN(len) ALIGN((len), sizeof(s32))
109 #define CMSG_COMPAT_DATA(cmsg) \
110 ((void __user *)((char __user *)(cmsg) + sizeof(struct compat_cmsghdr)))
111 #define CMSG_COMPAT_SPACE(len) \
112 (sizeof(struct compat_cmsghdr) + CMSG_COMPAT_ALIGN(len))
113 #define CMSG_COMPAT_LEN(len) \
114 (sizeof(struct compat_cmsghdr) + (len))
116 #define CMSG_COMPAT_FIRSTHDR(msg) \
117 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
118 (struct compat_cmsghdr __user *)((msg)->msg_control) : \
119 (struct compat_cmsghdr __user *)NULL)
121 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
122 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
123 (ucmlen) <= (unsigned long) \
124 ((mhdr)->msg_controllen - \
125 ((char __user *)(ucmsg) - (char __user *)(mhdr)->msg_control_user)))
127 static inline struct compat_cmsghdr __user
*cmsg_compat_nxthdr(struct msghdr
*msg
,
128 struct compat_cmsghdr __user
*cmsg
, int cmsg_len
)
130 char __user
*ptr
= (char __user
*)cmsg
+ CMSG_COMPAT_ALIGN(cmsg_len
);
131 if ((unsigned long)(ptr
+ 1 - (char __user
*)msg
->msg_control
) >
134 return (struct compat_cmsghdr __user
*)ptr
;
137 /* There is a lot of hair here because the alignment rules (and
138 * thus placement) of cmsg headers and length are different for
139 * 32-bit apps. -DaveM
141 int cmsghdr_from_user_compat_to_kern(struct msghdr
*kmsg
, struct sock
*sk
,
142 unsigned char *stackbuf
, int stackbuf_size
)
144 struct compat_cmsghdr __user
*ucmsg
;
145 struct cmsghdr
*kcmsg
, *kcmsg_base
;
146 compat_size_t ucmlen
;
147 __kernel_size_t kcmlen
, tmp
;
150 BUILD_BUG_ON(sizeof(struct compat_cmsghdr
) !=
151 CMSG_COMPAT_ALIGN(sizeof(struct compat_cmsghdr
)));
154 kcmsg_base
= kcmsg
= (struct cmsghdr
*)stackbuf
;
155 ucmsg
= CMSG_COMPAT_FIRSTHDR(kmsg
);
156 while (ucmsg
!= NULL
) {
157 if (get_user(ucmlen
, &ucmsg
->cmsg_len
))
161 if (!CMSG_COMPAT_OK(ucmlen
, ucmsg
, kmsg
))
164 tmp
= ((ucmlen
- sizeof(*ucmsg
)) + sizeof(struct cmsghdr
));
165 tmp
= CMSG_ALIGN(tmp
);
167 ucmsg
= cmsg_compat_nxthdr(kmsg
, ucmsg
, ucmlen
);
172 /* The kcmlen holds the 64-bit version of the control length.
173 * It may not be modified as we do not stick it into the kmsg
174 * until we have successfully copied over all of the data
177 if (kcmlen
> stackbuf_size
)
178 kcmsg_base
= kcmsg
= sock_kmalloc(sk
, kcmlen
, GFP_KERNEL
);
182 /* Now copy them over neatly. */
183 memset(kcmsg
, 0, kcmlen
);
184 ucmsg
= CMSG_COMPAT_FIRSTHDR(kmsg
);
185 while (ucmsg
!= NULL
) {
186 struct compat_cmsghdr cmsg
;
187 if (copy_from_user(&cmsg
, ucmsg
, sizeof(cmsg
)))
189 if (!CMSG_COMPAT_OK(cmsg
.cmsg_len
, ucmsg
, kmsg
))
191 tmp
= ((cmsg
.cmsg_len
- sizeof(*ucmsg
)) + sizeof(struct cmsghdr
));
192 if ((char *)kcmsg_base
+ kcmlen
- (char *)kcmsg
< CMSG_ALIGN(tmp
))
194 kcmsg
->cmsg_len
= tmp
;
195 kcmsg
->cmsg_level
= cmsg
.cmsg_level
;
196 kcmsg
->cmsg_type
= cmsg
.cmsg_type
;
197 tmp
= CMSG_ALIGN(tmp
);
198 if (copy_from_user(CMSG_DATA(kcmsg
),
199 CMSG_COMPAT_DATA(ucmsg
),
200 (cmsg
.cmsg_len
- sizeof(*ucmsg
))))
204 kcmsg
= (struct cmsghdr
*)((char *)kcmsg
+ tmp
);
205 ucmsg
= cmsg_compat_nxthdr(kmsg
, ucmsg
, cmsg
.cmsg_len
);
209 * check the length of messages copied in is the same as the
210 * what we get from the first loop
212 if ((char *)kcmsg
- (char *)kcmsg_base
!= kcmlen
)
215 /* Ok, looks like we made it. Hook it up and return success. */
216 kmsg
->msg_control
= kcmsg_base
;
217 kmsg
->msg_controllen
= kcmlen
;
223 if (kcmsg_base
!= (struct cmsghdr
*)stackbuf
)
224 sock_kfree_s(sk
, kcmsg_base
, kcmlen
);
228 int put_cmsg_compat(struct msghdr
*kmsg
, int level
, int type
, int len
, void *data
)
230 struct compat_cmsghdr __user
*cm
= (struct compat_cmsghdr __user
*) kmsg
->msg_control
;
231 struct compat_cmsghdr cmhdr
;
232 struct old_timeval32 ctv
;
233 struct old_timespec32 cts
[3];
236 if (cm
== NULL
|| kmsg
->msg_controllen
< sizeof(*cm
)) {
237 kmsg
->msg_flags
|= MSG_CTRUNC
;
238 return 0; /* XXX: return error? check spec. */
241 if (!COMPAT_USE_64BIT_TIME
) {
242 if (level
== SOL_SOCKET
&& type
== SO_TIMESTAMP_OLD
) {
243 struct __kernel_old_timeval
*tv
= (struct __kernel_old_timeval
*)data
;
244 ctv
.tv_sec
= tv
->tv_sec
;
245 ctv
.tv_usec
= tv
->tv_usec
;
249 if (level
== SOL_SOCKET
&&
250 (type
== SO_TIMESTAMPNS_OLD
|| type
== SO_TIMESTAMPING_OLD
)) {
251 int count
= type
== SO_TIMESTAMPNS_OLD
? 1 : 3;
253 struct __kernel_old_timespec
*ts
= data
;
254 for (i
= 0; i
< count
; i
++) {
255 cts
[i
].tv_sec
= ts
[i
].tv_sec
;
256 cts
[i
].tv_nsec
= ts
[i
].tv_nsec
;
259 len
= sizeof(cts
[0]) * count
;
263 cmlen
= CMSG_COMPAT_LEN(len
);
264 if (kmsg
->msg_controllen
< cmlen
) {
265 kmsg
->msg_flags
|= MSG_CTRUNC
;
266 cmlen
= kmsg
->msg_controllen
;
268 cmhdr
.cmsg_level
= level
;
269 cmhdr
.cmsg_type
= type
;
270 cmhdr
.cmsg_len
= cmlen
;
272 if (copy_to_user(cm
, &cmhdr
, sizeof cmhdr
))
274 if (copy_to_user(CMSG_COMPAT_DATA(cm
), data
, cmlen
- sizeof(struct compat_cmsghdr
)))
276 cmlen
= CMSG_COMPAT_SPACE(len
);
277 if (kmsg
->msg_controllen
< cmlen
)
278 cmlen
= kmsg
->msg_controllen
;
279 kmsg
->msg_control
+= cmlen
;
280 kmsg
->msg_controllen
-= cmlen
;
284 void scm_detach_fds_compat(struct msghdr
*kmsg
, struct scm_cookie
*scm
)
286 struct compat_cmsghdr __user
*cm
= (struct compat_cmsghdr __user
*) kmsg
->msg_control
;
287 int fdmax
= (kmsg
->msg_controllen
- sizeof(struct compat_cmsghdr
)) / sizeof(int);
288 int fdnum
= scm
->fp
->count
;
289 struct file
**fp
= scm
->fp
->fp
;
296 for (i
= 0, cmfptr
= (int __user
*) CMSG_COMPAT_DATA(cm
); i
< fdmax
; i
++, cmfptr
++) {
298 err
= security_file_receive(fp
[i
]);
301 err
= get_unused_fd_flags(MSG_CMSG_CLOEXEC
& kmsg
->msg_flags
306 err
= put_user(new_fd
, cmfptr
);
308 put_unused_fd(new_fd
);
311 /* Bump the usage count and install the file. */
312 __receive_sock(fp
[i
]);
313 fd_install(new_fd
, get_file(fp
[i
]));
317 int cmlen
= CMSG_COMPAT_LEN(i
* sizeof(int));
318 err
= put_user(SOL_SOCKET
, &cm
->cmsg_level
);
320 err
= put_user(SCM_RIGHTS
, &cm
->cmsg_type
);
322 err
= put_user(cmlen
, &cm
->cmsg_len
);
324 cmlen
= CMSG_COMPAT_SPACE(i
* sizeof(int));
325 kmsg
->msg_control
+= cmlen
;
326 kmsg
->msg_controllen
-= cmlen
;
330 kmsg
->msg_flags
|= MSG_CTRUNC
;
333 * All of the files that fit in the message have had their
334 * usage counts incremented, so we just free the list.
339 /* allocate a 64-bit sock_fprog on the user stack for duration of syscall. */
340 struct sock_fprog __user
*get_compat_bpf_fprog(char __user
*optval
)
342 struct compat_sock_fprog __user
*fprog32
= (struct compat_sock_fprog __user
*)optval
;
343 struct sock_fprog __user
*kfprog
= compat_alloc_user_space(sizeof(struct sock_fprog
));
344 struct compat_sock_fprog f32
;
347 if (copy_from_user(&f32
, fprog32
, sizeof(*fprog32
)))
349 memset(&f
, 0, sizeof(f
));
351 f
.filter
= compat_ptr(f32
.filter
);
352 if (copy_to_user(kfprog
, &f
, sizeof(struct sock_fprog
)))
357 EXPORT_SYMBOL_GPL(get_compat_bpf_fprog
);
359 static int do_set_attach_filter(struct socket
*sock
, int level
, int optname
,
360 char __user
*optval
, unsigned int optlen
)
362 struct sock_fprog __user
*kfprog
;
364 kfprog
= get_compat_bpf_fprog(optval
);
368 return sock_setsockopt(sock
, level
, optname
, (char __user
*)kfprog
,
369 sizeof(struct sock_fprog
));
372 static int compat_sock_setsockopt(struct socket
*sock
, int level
, int optname
,
373 char __user
*optval
, unsigned int optlen
)
375 if (optname
== SO_ATTACH_FILTER
||
376 optname
== SO_ATTACH_REUSEPORT_CBPF
)
377 return do_set_attach_filter(sock
, level
, optname
,
379 return sock_setsockopt(sock
, level
, optname
, optval
, optlen
);
382 static int __compat_sys_setsockopt(int fd
, int level
, int optname
,
383 char __user
*optval
, unsigned int optlen
)
388 if (optlen
> INT_MAX
)
391 sock
= sockfd_lookup(fd
, &err
);
393 err
= security_socket_setsockopt(sock
, level
, optname
);
399 if (level
== SOL_SOCKET
)
400 err
= compat_sock_setsockopt(sock
, level
,
401 optname
, optval
, optlen
);
402 else if (sock
->ops
->compat_setsockopt
)
403 err
= sock
->ops
->compat_setsockopt(sock
, level
,
404 optname
, optval
, optlen
);
406 err
= sock
->ops
->setsockopt(sock
, level
,
407 optname
, optval
, optlen
);
413 COMPAT_SYSCALL_DEFINE5(setsockopt
, int, fd
, int, level
, int, optname
,
414 char __user
*, optval
, unsigned int, optlen
)
416 return __compat_sys_setsockopt(fd
, level
, optname
, optval
, optlen
);
419 static int __compat_sys_getsockopt(int fd
, int level
, int optname
,
424 struct socket
*sock
= sockfd_lookup(fd
, &err
);
427 err
= security_socket_getsockopt(sock
, level
, optname
);
433 if (level
== SOL_SOCKET
)
434 err
= sock_getsockopt(sock
, level
,
435 optname
, optval
, optlen
);
436 else if (sock
->ops
->compat_getsockopt
)
437 err
= sock
->ops
->compat_getsockopt(sock
, level
,
438 optname
, optval
, optlen
);
440 err
= sock
->ops
->getsockopt(sock
, level
,
441 optname
, optval
, optlen
);
447 COMPAT_SYSCALL_DEFINE5(getsockopt
, int, fd
, int, level
, int, optname
,
448 char __user
*, optval
, int __user
*, optlen
)
450 return __compat_sys_getsockopt(fd
, level
, optname
, optval
, optlen
);
453 /* Argument list sizes for compat_sys_socketcall */
454 #define AL(x) ((x) * sizeof(u32))
455 static unsigned char nas
[21] = {
456 AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
457 AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
458 AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
463 static inline long __compat_sys_sendmsg(int fd
,
464 struct compat_msghdr __user
*msg
,
467 return __sys_sendmsg(fd
, (struct user_msghdr __user
*)msg
,
468 flags
| MSG_CMSG_COMPAT
, false);
471 COMPAT_SYSCALL_DEFINE3(sendmsg
, int, fd
, struct compat_msghdr __user
*, msg
,
474 return __compat_sys_sendmsg(fd
, msg
, flags
);
477 static inline long __compat_sys_sendmmsg(int fd
,
478 struct compat_mmsghdr __user
*mmsg
,
479 unsigned int vlen
, unsigned int flags
)
481 return __sys_sendmmsg(fd
, (struct mmsghdr __user
*)mmsg
, vlen
,
482 flags
| MSG_CMSG_COMPAT
, false);
485 COMPAT_SYSCALL_DEFINE4(sendmmsg
, int, fd
, struct compat_mmsghdr __user
*, mmsg
,
486 unsigned int, vlen
, unsigned int, flags
)
488 return __compat_sys_sendmmsg(fd
, mmsg
, vlen
, flags
);
491 static inline long __compat_sys_recvmsg(int fd
,
492 struct compat_msghdr __user
*msg
,
495 return __sys_recvmsg(fd
, (struct user_msghdr __user
*)msg
,
496 flags
| MSG_CMSG_COMPAT
, false);
499 COMPAT_SYSCALL_DEFINE3(recvmsg
, int, fd
, struct compat_msghdr __user
*, msg
,
502 return __compat_sys_recvmsg(fd
, msg
, flags
);
505 static inline long __compat_sys_recvfrom(int fd
, void __user
*buf
,
506 compat_size_t len
, unsigned int flags
,
507 struct sockaddr __user
*addr
,
510 return __sys_recvfrom(fd
, buf
, len
, flags
| MSG_CMSG_COMPAT
, addr
,
514 COMPAT_SYSCALL_DEFINE4(recv
, int, fd
, void __user
*, buf
, compat_size_t
, len
, unsigned int, flags
)
516 return __compat_sys_recvfrom(fd
, buf
, len
, flags
, NULL
, NULL
);
519 COMPAT_SYSCALL_DEFINE6(recvfrom
, int, fd
, void __user
*, buf
, compat_size_t
, len
,
520 unsigned int, flags
, struct sockaddr __user
*, addr
,
521 int __user
*, addrlen
)
523 return __compat_sys_recvfrom(fd
, buf
, len
, flags
, addr
, addrlen
);
526 COMPAT_SYSCALL_DEFINE5(recvmmsg_time64
, int, fd
, struct compat_mmsghdr __user
*, mmsg
,
527 unsigned int, vlen
, unsigned int, flags
,
528 struct __kernel_timespec __user
*, timeout
)
530 return __sys_recvmmsg(fd
, (struct mmsghdr __user
*)mmsg
, vlen
,
531 flags
| MSG_CMSG_COMPAT
, timeout
, NULL
);
534 #ifdef CONFIG_COMPAT_32BIT_TIME
535 COMPAT_SYSCALL_DEFINE5(recvmmsg_time32
, int, fd
, struct compat_mmsghdr __user
*, mmsg
,
536 unsigned int, vlen
, unsigned int, flags
,
537 struct old_timespec32 __user
*, timeout
)
539 return __sys_recvmmsg(fd
, (struct mmsghdr __user
*)mmsg
, vlen
,
540 flags
| MSG_CMSG_COMPAT
, NULL
, timeout
);
544 COMPAT_SYSCALL_DEFINE2(socketcall
, int, call
, u32 __user
*, args
)
551 if (call
< SYS_SOCKET
|| call
> SYS_SENDMMSG
)
557 if (copy_from_user(a
, args
, len
))
560 ret
= audit_socketcall_compat(len
/ sizeof(a
[0]), a
);
569 ret
= __sys_socket(a0
, a1
, a
[2]);
572 ret
= __sys_bind(a0
, compat_ptr(a1
), a
[2]);
575 ret
= __sys_connect(a0
, compat_ptr(a1
), a
[2]);
578 ret
= __sys_listen(a0
, a1
);
581 ret
= __sys_accept4(a0
, compat_ptr(a1
), compat_ptr(a
[2]), 0);
583 case SYS_GETSOCKNAME
:
584 ret
= __sys_getsockname(a0
, compat_ptr(a1
), compat_ptr(a
[2]));
586 case SYS_GETPEERNAME
:
587 ret
= __sys_getpeername(a0
, compat_ptr(a1
), compat_ptr(a
[2]));
590 ret
= __sys_socketpair(a0
, a1
, a
[2], compat_ptr(a
[3]));
593 ret
= __sys_sendto(a0
, compat_ptr(a1
), a
[2], a
[3], NULL
, 0);
596 ret
= __sys_sendto(a0
, compat_ptr(a1
), a
[2], a
[3],
597 compat_ptr(a
[4]), a
[5]);
600 ret
= __compat_sys_recvfrom(a0
, compat_ptr(a1
), a
[2], a
[3],
604 ret
= __compat_sys_recvfrom(a0
, compat_ptr(a1
), a
[2], a
[3],
609 ret
= __sys_shutdown(a0
, a1
);
612 ret
= __compat_sys_setsockopt(a0
, a1
, a
[2],
613 compat_ptr(a
[3]), a
[4]);
616 ret
= __compat_sys_getsockopt(a0
, a1
, a
[2],
621 ret
= __compat_sys_sendmsg(a0
, compat_ptr(a1
), a
[2]);
624 ret
= __compat_sys_sendmmsg(a0
, compat_ptr(a1
), a
[2], a
[3]);
627 ret
= __compat_sys_recvmsg(a0
, compat_ptr(a1
), a
[2]);
630 ret
= __sys_recvmmsg(a0
, compat_ptr(a1
), a
[2],
631 a
[3] | MSG_CMSG_COMPAT
, NULL
,
635 ret
= __sys_accept4(a0
, compat_ptr(a1
), compat_ptr(a
[2]), a
[3]);