11da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* scm.c - Socket level control messages processing. 21da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 31da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 41da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Alignment and value checking mods by Craig Metz 51da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 61da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * This program is free software; you can redistribute it and/or 71da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * modify it under the terms of the GNU General Public License 81da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * as published by the Free Software Foundation; either version 91da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 2 of the License, or (at your option) any later version. 101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/module.h> 131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/signal.h> 144fc268d24ceb9f4150777c1b5b2b8e6214e56b2bRandy Dunlap#include <linux/capability.h> 151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/errno.h> 161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/sched.h> 171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/mm.h> 181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/kernel.h> 191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/stat.h> 201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/socket.h> 211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/file.h> 221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/fcntl.h> 231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/net.h> 241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/interrupt.h> 251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/netdevice.h> 261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/security.h> 2792f28d973cce45ef5823209aab3138eb45d8b349Eric W. Biederman#include <linux/pid_namespace.h> 28b488893a390edfe027bae7a46e9af8083e740668Pavel Emelyanov#include <linux/pid.h> 29b488893a390edfe027bae7a46e9af8083e740668Pavel Emelyanov#include <linux/nsproxy.h> 305a0e3ad6af8660be21ca98a971cd00f331318c05Tejun Heo#include <linux/slab.h> 311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <asm/uaccess.h> 331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/protocol.h> 351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/skbuff.h> 361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/sock.h> 371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/compat.h> 381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <net/scm.h> 39d84295067fc7e95660d84c014aa528f4409c070dDaniel Wagner#include <net/cls_cgroup.h> 401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* 434ec93edb14fe5fdee9fae6335f2cbba204627eacYOSHIFUJI Hideaki * Only allow a user to send credentials, that they could set with 441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * setu(g)id. 451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic __inline__ int scm_check_creds(struct ucred *creds) 481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 4986a264abe542cfececb4df129bc45a0338d8cdb9David Howells const struct cred *cred = current_cred(); 50b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman kuid_t uid = make_kuid(cred->user_ns, creds->uid); 51b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman kgid_t gid = make_kgid(cred->user_ns, creds->gid); 52b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman 53b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman if (!uid_valid(uid) || !gid_valid(gid)) 54b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman return -EINVAL; 55b6dff3ec5e116e3af6f537d4caedcad6b9e5082aDavid Howells 5692f28d973cce45ef5823209aab3138eb45d8b349Eric W. Biederman if ((creds->pid == task_tgid_vnr(current) || 57d661684cf6820331feae71146c35da83d794467eAndy Lutomirski ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) && 58b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) || 59c7b96acf1456ef127fef461fcfedb54b81fecfbbEric W. Biederman uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) && 60b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) || 61c7b96acf1456ef127fef461fcfedb54b81fecfbbEric W. Biederman gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) { 621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return 0; 631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return -EPERM; 651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int *fdp = (int*)CMSG_DATA(cmsg); 701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct scm_fp_list *fpl = *fplp; 711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct file **fpp; 721da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i, num; 731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int); 751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (num <= 0) 771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return 0; 781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 791da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (num > SCM_MAX_FD) 801da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return -EINVAL; 811da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!fpl) 831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL); 851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!fpl) 861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return -ENOMEM; 871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds *fplp = fpl; 881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fpl->count = 0; 89bba14de98753cb6599a2dae0e520714b2153522dEric Dumazet fpl->max = SCM_MAX_FD; 901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fpp = &fpl->fp[fpl->count]; 921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 93bba14de98753cb6599a2dae0e520714b2153522dEric Dumazet if (fpl->count + num > fpl->max) 941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return -EINVAL; 954ec93edb14fe5fdee9fae6335f2cbba204627eacYOSHIFUJI Hideaki 961da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* 971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Verify the descriptors and increment the usage count. 981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 994ec93edb14fe5fdee9fae6335f2cbba204627eacYOSHIFUJI Hideaki 1001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds for (i=0; i< num; i++) 1011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 1021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int fd = fdp[i]; 1031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct file *file; 1041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 105326be7b484843988afe57566b627fb7a70beac56Al Viro if (fd < 0 || !(file = fget_raw(fd))) 1061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return -EBADF; 1071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds *fpp++ = file; 1081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fpl->count++; 1091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return num; 1111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsvoid __scm_destroy(struct scm_cookie *scm) 1141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct scm_fp_list *fpl = scm->fp; 1161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i; 1171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (fpl) { 1191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds scm->fp = NULL; 1206120d3dbb1220792ebea88cd475e1ec8f8620a93Al Viro for (i=fpl->count-1; i>=0; i--) 1216120d3dbb1220792ebea88cd475e1ec8f8620a93Al Viro fput(fpl->fp[i]); 1226120d3dbb1220792ebea88cd475e1ec8f8620a93Al Viro kfree(fpl); 1231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1259e34a5b51684bc90ac827ec4ba339f3892632eacEric DumazetEXPORT_SYMBOL(__scm_destroy); 1261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsint __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) 1281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct cmsghdr *cmsg; 1301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int err; 1311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) 1331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 1341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = -EINVAL; 1351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */ 1371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* The first check was omitted in <= 2.2.5. The reasoning was 1381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds that parser checks cmsg_len in any case, so that 1391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds additional check would be work duplication. 1404ec93edb14fe5fdee9fae6335f2cbba204627eacYOSHIFUJI Hideaki But if cmsg_level is not SOL_SOCKET, we do not check 1411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds for too short ancillary data object at all! Oops. 1421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds OK, let's add it... 1431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 1441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!CMSG_OK(msg, cmsg)) 1451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto error; 1461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (cmsg->cmsg_level != SOL_SOCKET) 1481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds continue; 1491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds switch (cmsg->cmsg_type) 1511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 1521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds case SCM_RIGHTS: 15376dadd76c265a0cdb5a76aa4eef03fcc9639b388Eric W. Biederman if (!sock->ops || sock->ops->family != PF_UNIX) 15476dadd76c265a0cdb5a76aa4eef03fcc9639b388Eric W. Biederman goto error; 1551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err=scm_fp_copy(cmsg, &p->fp); 1561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (err<0) 1571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto error; 1581da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; 1591da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds case SCM_CREDENTIALS: 160b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman { 161dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman struct ucred creds; 162b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman kuid_t uid; 163b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman kgid_t gid; 1641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred))) 1651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto error; 166dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred)); 167dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman err = scm_check_creds(&creds); 1681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (err) 1691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto error; 170257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman 171dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman p->creds.pid = creds.pid; 172dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman if (!p->pid || pid_vnr(p->pid) != creds.pid) { 173257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman struct pid *pid; 174257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman err = -ESRCH; 175dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman pid = find_get_pid(creds.pid); 176257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman if (!pid) 177257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman goto error; 178257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman put_pid(p->pid); 179257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman p->pid = pid; 180257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman } 181257b5358b32f17e0603b6ff57b13610b0e02348fEric W. Biederman 182b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman err = -EINVAL; 183dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman uid = make_kuid(current_user_ns(), creds.uid); 184dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman gid = make_kgid(current_user_ns(), creds.gid); 185b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman if (!uid_valid(uid) || !gid_valid(gid)) 186b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman goto error; 187b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman 188dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman p->creds.uid = uid; 189dbe9a4173ea53b72b2c35d19f676a85b69f1c9feEric W. Biederman p->creds.gid = gid; 1901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; 191b2e4f544fddc812d6fe802bab5f600b4b783f45dEric W. Biederman } 1921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds default: 1931da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto error; 1941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1951da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 1961da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (p->fp && !p->fp->count) 1981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 1991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds kfree(p->fp); 2001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds p->fp = NULL; 2011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return 0; 2034ec93edb14fe5fdee9fae6335f2cbba204627eacYOSHIFUJI Hideaki 2041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldserror: 2051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds scm_destroy(p); 2061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return err; 2071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2089e34a5b51684bc90ac827ec4ba339f3892632eacEric DumazetEXPORT_SYMBOL(__scm_send); 2091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsint put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) 2111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 212cfcabdcc2d5a810208e5bb3974121b7ed60119aaStephen Hemminger struct cmsghdr __user *cm 213cfcabdcc2d5a810208e5bb3974121b7ed60119aaStephen Hemminger = (__force struct cmsghdr __user *)msg->msg_control; 2141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct cmsghdr cmhdr; 2151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int cmlen = CMSG_LEN(len); 2161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int err; 2171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (MSG_CMSG_COMPAT & msg->msg_flags) 2191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return put_cmsg_compat(msg, level, type, len, data); 2201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (cm==NULL || msg->msg_controllen < sizeof(*cm)) { 2221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_flags |= MSG_CTRUNC; 2231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return 0; /* XXX: return error? check spec. */ 2241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (msg->msg_controllen < cmlen) { 2261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_flags |= MSG_CTRUNC; 2271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cmlen = msg->msg_controllen; 2281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cmhdr.cmsg_level = level; 2301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cmhdr.cmsg_type = type; 2311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cmhdr.cmsg_len = cmlen; 2321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2331da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = -EFAULT; 2341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (copy_to_user(cm, &cmhdr, sizeof cmhdr)) 2354ec93edb14fe5fdee9fae6335f2cbba204627eacYOSHIFUJI Hideaki goto out; 2361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr))) 2371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto out; 2381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cmlen = CMSG_SPACE(len); 2391ac70e7ad24a88710cf9b6d7ababaefa2b575df0Wei Yongjun if (msg->msg_controllen < cmlen) 2401ac70e7ad24a88710cf9b6d7ababaefa2b575df0Wei Yongjun cmlen = msg->msg_controllen; 2411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_control += cmlen; 2421da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_controllen -= cmlen; 2431da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = 0; 2441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsout: 2451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return err; 2461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 2479e34a5b51684bc90ac827ec4ba339f3892632eacEric DumazetEXPORT_SYMBOL(put_cmsg); 2481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsvoid scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) 2501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 251cfcabdcc2d5a810208e5bb3974121b7ed60119aaStephen Hemminger struct cmsghdr __user *cm 252cfcabdcc2d5a810208e5bb3974121b7ed60119aaStephen Hemminger = (__force struct cmsghdr __user*)msg->msg_control; 2531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int fdmax = 0; 2551da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int fdnum = scm->fp->count; 2561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct file **fp = scm->fp->fp; 2571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int __user *cmfptr; 2581da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int err = 0, i; 2591da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2601da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (MSG_CMSG_COMPAT & msg->msg_flags) { 2611da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds scm_detach_fds_compat(msg, scm); 2621da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return; 2631da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2641da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2651da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (msg->msg_controllen > sizeof(struct cmsghdr)) 2661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr)) 2671da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds / sizeof(int)); 2681da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2691da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (fdnum < fdmax) 2701da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds fdmax = fdnum; 2711da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 272cfcabdcc2d5a810208e5bb3974121b7ed60119aaStephen Hemminger for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax; 273cfcabdcc2d5a810208e5bb3974121b7ed60119aaStephen Hemminger i++, cmfptr++) 2741da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 27548a87cc26c13b68f6cce4e9d769fcb17a6b3e4b8John Fastabend struct socket *sock; 2761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int new_fd; 2771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = security_file_receive(fp[i]); 2781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (err) 2791da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; 2804a19542e5f694cd408a32c3d9dc593ba9366e2d7Ulrich Drepper err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags 2814a19542e5f694cd408a32c3d9dc593ba9366e2d7Ulrich Drepper ? O_CLOEXEC : 0); 2821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (err < 0) 2831da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; 2841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds new_fd = err; 2851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = put_user(new_fd, cmfptr); 2861da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (err) { 2871da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds put_unused_fd(new_fd); 2881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds break; 2891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Bump the usage count and install the file. */ 29148a87cc26c13b68f6cce4e9d769fcb17a6b3e4b8John Fastabend sock = sock_from_file(fp[i], &err); 292d84295067fc7e95660d84c014aa528f4409c070dDaniel Wagner if (sock) { 2936ffd46410248ee39b46c2cdafb79791c2e618932Zefan Li sock_update_netprioidx(sock->sk); 294211d2f97e936d206a5e45f6f64ecbc2c51a2b46cZefan Li sock_update_classid(sock->sk); 295d84295067fc7e95660d84c014aa528f4409c070dDaniel Wagner } 296cb0942b81249798e15c3f04eee2946ef543e8115Al Viro fd_install(new_fd, get_file(fp[i])); 2971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 2981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 2991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (i > 0) 3001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 3011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int cmlen = CMSG_LEN(i*sizeof(int)); 302effee6a00034a8d83a6dea6d221820d87364ac21Miklos Szeredi err = put_user(SOL_SOCKET, &cm->cmsg_level); 3031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!err) 3041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = put_user(SCM_RIGHTS, &cm->cmsg_type); 3051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!err) 3061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds err = put_user(cmlen, &cm->cmsg_len); 3071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!err) { 3081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cmlen = CMSG_SPACE(i*sizeof(int)); 3091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_control += cmlen; 3101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_controllen -= cmlen; 3111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 3121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 3131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (i < fdnum || (fdnum && fdmax <= 0)) 3141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds msg->msg_flags |= MSG_CTRUNC; 3151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* 3171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * All of the files that fit in the message have had their 3181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * usage counts incremented, so we just free the list. 3191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 3201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds __scm_destroy(scm); 3211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 3229e34a5b51684bc90ac827ec4ba339f3892632eacEric DumazetEXPORT_SYMBOL(scm_detach_fds); 3231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstruct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) 3251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 3261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct scm_fp_list *new_fpl; 3271da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int i; 3281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (!fpl) 3301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return NULL; 3311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 332bba14de98753cb6599a2dae0e520714b2153522dEric Dumazet new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]), 333bba14de98753cb6599a2dae0e520714b2153522dEric Dumazet GFP_KERNEL); 3341da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (new_fpl) { 335bba14de98753cb6599a2dae0e520714b2153522dEric Dumazet for (i = 0; i < fpl->count; i++) 3361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds get_file(fpl->fp[i]); 337bba14de98753cb6599a2dae0e520714b2153522dEric Dumazet new_fpl->max = new_fpl->count; 3381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds } 3391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return new_fpl; 3401da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 3411da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus TorvaldsEXPORT_SYMBOL(scm_fp_dup); 342