1/* SCTP kernel implementation
2 * (C) Copyright IBM Corp. 2001, 2004
3 * Copyright (c) 1999-2000 Cisco, Inc.
4 * Copyright (c) 1999-2001 Motorola, Inc.
5 * Copyright (c) 2001-2003 Intel Corp.
6 * Copyright (c) 2001-2002 Nokia, Inc.
7 * Copyright (c) 2001 La Monte H.P. Yarroll
8 *
9 * This file is part of the SCTP kernel implementation
10 *
11 * These functions interface with the sockets layer to implement the
12 * SCTP Extensions for the Sockets API.
13 *
14 * Note that the descriptions from the specification are USER level
15 * functions--this file is the functions which populate the struct proto
16 * for SCTP which is the BOTTOM of the sockets interface.
17 *
18 * This SCTP implementation is free software;
19 * you can redistribute it and/or modify it under the terms of
20 * the GNU General Public License as published by
21 * the Free Software Foundation; either version 2, or (at your option)
22 * any later version.
23 *
24 * This SCTP implementation is distributed in the hope that it
25 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
26 *                 ************************
27 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28 * See the GNU General Public License for more details.
29 *
30 * You should have received a copy of the GNU General Public License
31 * along with GNU CC; see the file COPYING.  If not, see
32 * <http://www.gnu.org/licenses/>.
33 *
34 * Please send any bug reports or fixes you make to the
35 * email address(es):
36 *    lksctp developers <linux-sctp@vger.kernel.org>
37 *
38 * Written or modified by:
39 *    La Monte H.P. Yarroll <piggy@acm.org>
40 *    Narasimha Budihal     <narsi@refcode.org>
41 *    Karl Knutson          <karl@athena.chicago.il.us>
42 *    Jon Grimm             <jgrimm@us.ibm.com>
43 *    Xingang Guo           <xingang.guo@intel.com>
44 *    Daisy Chang           <daisyc@us.ibm.com>
45 *    Sridhar Samudrala     <samudrala@us.ibm.com>
46 *    Inaky Perez-Gonzalez  <inaky.gonzalez@intel.com>
47 *    Ardelle Fan	    <ardelle.fan@intel.com>
48 *    Ryan Layer	    <rmlayer@us.ibm.com>
49 *    Anup Pemmaiah         <pemmaiah@cc.usu.edu>
50 *    Kevin Gao             <kevin.gao@intel.com>
51 */
52
53#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
54
55#include <linux/types.h>
56#include <linux/kernel.h>
57#include <linux/wait.h>
58#include <linux/time.h>
59#include <linux/ip.h>
60#include <linux/capability.h>
61#include <linux/fcntl.h>
62#include <linux/poll.h>
63#include <linux/init.h>
64#include <linux/crypto.h>
65#include <linux/slab.h>
66#include <linux/file.h>
67#include <linux/compat.h>
68
69#include <net/ip.h>
70#include <net/icmp.h>
71#include <net/route.h>
72#include <net/ipv6.h>
73#include <net/inet_common.h>
74#include <net/busy_poll.h>
75
76#include <linux/socket.h> /* for sa_family_t */
77#include <linux/export.h>
78#include <net/sock.h>
79#include <net/sctp/sctp.h>
80#include <net/sctp/sm.h>
81
82/* Forward declarations for internal helper functions. */
83static int sctp_writeable(struct sock *sk);
84static void sctp_wfree(struct sk_buff *skb);
85static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
86				size_t msg_len);
87static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
88static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
89static int sctp_wait_for_accept(struct sock *sk, long timeo);
90static void sctp_wait_for_close(struct sock *sk, long timeo);
91static void sctp_destruct_sock(struct sock *sk);
92static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
93					union sctp_addr *addr, int len);
94static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
95static int sctp_bindx_rem(struct sock *, struct sockaddr *, int);
96static int sctp_send_asconf_add_ip(struct sock *, struct sockaddr *, int);
97static int sctp_send_asconf_del_ip(struct sock *, struct sockaddr *, int);
98static int sctp_send_asconf(struct sctp_association *asoc,
99			    struct sctp_chunk *chunk);
100static int sctp_do_bind(struct sock *, union sctp_addr *, int);
101static int sctp_autobind(struct sock *sk);
102static void sctp_sock_migrate(struct sock *, struct sock *,
103			      struct sctp_association *, sctp_socket_type_t);
104
105extern struct kmem_cache *sctp_bucket_cachep;
106extern long sysctl_sctp_mem[3];
107extern int sysctl_sctp_rmem[3];
108extern int sysctl_sctp_wmem[3];
109
110static int sctp_memory_pressure;
111static atomic_long_t sctp_memory_allocated;
112struct percpu_counter sctp_sockets_allocated;
113
114static void sctp_enter_memory_pressure(struct sock *sk)
115{
116	sctp_memory_pressure = 1;
117}
118
119
120/* Get the sndbuf space available at the time on the association.  */
121static inline int sctp_wspace(struct sctp_association *asoc)
122{
123	int amt;
124
125	if (asoc->ep->sndbuf_policy)
126		amt = asoc->sndbuf_used;
127	else
128		amt = sk_wmem_alloc_get(asoc->base.sk);
129
130	if (amt >= asoc->base.sk->sk_sndbuf) {
131		if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
132			amt = 0;
133		else {
134			amt = sk_stream_wspace(asoc->base.sk);
135			if (amt < 0)
136				amt = 0;
137		}
138	} else {
139		amt = asoc->base.sk->sk_sndbuf - amt;
140	}
141	return amt;
142}
143
144/* Increment the used sndbuf space count of the corresponding association by
145 * the size of the outgoing data chunk.
146 * Also, set the skb destructor for sndbuf accounting later.
147 *
148 * Since it is always 1-1 between chunk and skb, and also a new skb is always
149 * allocated for chunk bundling in sctp_packet_transmit(), we can use the
150 * destructor in the data chunk skb for the purpose of the sndbuf space
151 * tracking.
152 */
153static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
154{
155	struct sctp_association *asoc = chunk->asoc;
156	struct sock *sk = asoc->base.sk;
157
158	/* The sndbuf space is tracked per association.  */
159	sctp_association_hold(asoc);
160
161	skb_set_owner_w(chunk->skb, sk);
162
163	chunk->skb->destructor = sctp_wfree;
164	/* Save the chunk pointer in skb for sctp_wfree to use later.  */
165	*((struct sctp_chunk **)(chunk->skb->cb)) = chunk;
166
167	asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
168				sizeof(struct sk_buff) +
169				sizeof(struct sctp_chunk);
170
171	atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
172	sk->sk_wmem_queued += chunk->skb->truesize;
173	sk_mem_charge(sk, chunk->skb->truesize);
174}
175
176/* Verify that this is a valid address. */
177static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
178				   int len)
179{
180	struct sctp_af *af;
181
182	/* Verify basic sockaddr. */
183	af = sctp_sockaddr_af(sctp_sk(sk), addr, len);
184	if (!af)
185		return -EINVAL;
186
187	/* Is this a valid SCTP address?  */
188	if (!af->addr_valid(addr, sctp_sk(sk), NULL))
189		return -EINVAL;
190
191	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
192		return -EINVAL;
193
194	return 0;
195}
196
197/* Look up the association by its id.  If this is not a UDP-style
198 * socket, the ID field is always ignored.
199 */
200struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id)
201{
202	struct sctp_association *asoc = NULL;
203
204	/* If this is not a UDP-style socket, assoc id should be ignored. */
205	if (!sctp_style(sk, UDP)) {
206		/* Return NULL if the socket state is not ESTABLISHED. It
207		 * could be a TCP-style listening socket or a socket which
208		 * hasn't yet called connect() to establish an association.
209		 */
210		if (!sctp_sstate(sk, ESTABLISHED))
211			return NULL;
212
213		/* Get the first and the only association from the list. */
214		if (!list_empty(&sctp_sk(sk)->ep->asocs))
215			asoc = list_entry(sctp_sk(sk)->ep->asocs.next,
216					  struct sctp_association, asocs);
217		return asoc;
218	}
219
220	/* Otherwise this is a UDP-style socket. */
221	if (!id || (id == (sctp_assoc_t)-1))
222		return NULL;
223
224	spin_lock_bh(&sctp_assocs_id_lock);
225	asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id);
226	spin_unlock_bh(&sctp_assocs_id_lock);
227
228	if (!asoc || (asoc->base.sk != sk) || asoc->base.dead)
229		return NULL;
230
231	return asoc;
232}
233
234/* Look up the transport from an address and an assoc id. If both address and
235 * id are specified, the associations matching the address and the id should be
236 * the same.
237 */
238static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
239					      struct sockaddr_storage *addr,
240					      sctp_assoc_t id)
241{
242	struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
243	struct sctp_transport *transport;
244	union sctp_addr *laddr = (union sctp_addr *)addr;
245
246	addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
247					       laddr,
248					       &transport);
249
250	if (!addr_asoc)
251		return NULL;
252
253	id_asoc = sctp_id2assoc(sk, id);
254	if (id_asoc && (id_asoc != addr_asoc))
255		return NULL;
256
257	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
258						(union sctp_addr *)addr);
259
260	return transport;
261}
262
263/* API 3.1.2 bind() - UDP Style Syntax
264 * The syntax of bind() is,
265 *
266 *   ret = bind(int sd, struct sockaddr *addr, int addrlen);
267 *
268 *   sd      - the socket descriptor returned by socket().
269 *   addr    - the address structure (struct sockaddr_in or struct
270 *             sockaddr_in6 [RFC 2553]),
271 *   addr_len - the size of the address structure.
272 */
273static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
274{
275	int retval = 0;
276
277	lock_sock(sk);
278
279	pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
280		 addr, addr_len);
281
282	/* Disallow binding twice. */
283	if (!sctp_sk(sk)->ep->base.bind_addr.port)
284		retval = sctp_do_bind(sk, (union sctp_addr *)addr,
285				      addr_len);
286	else
287		retval = -EINVAL;
288
289	release_sock(sk);
290
291	return retval;
292}
293
294static long sctp_get_port_local(struct sock *, union sctp_addr *);
295
296/* Verify this is a valid sockaddr. */
297static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
298					union sctp_addr *addr, int len)
299{
300	struct sctp_af *af;
301
302	/* Check minimum size.  */
303	if (len < sizeof (struct sockaddr))
304		return NULL;
305
306	/* V4 mapped address are really of AF_INET family */
307	if (addr->sa.sa_family == AF_INET6 &&
308	    ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
309		if (!opt->pf->af_supported(AF_INET, opt))
310			return NULL;
311	} else {
312		/* Does this PF support this AF? */
313		if (!opt->pf->af_supported(addr->sa.sa_family, opt))
314			return NULL;
315	}
316
317	/* If we get this far, af is valid. */
318	af = sctp_get_af_specific(addr->sa.sa_family);
319
320	if (len < af->sockaddr_len)
321		return NULL;
322
323	return af;
324}
325
326/* Bind a local address either to an endpoint or to an association.  */
327static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
328{
329	struct net *net = sock_net(sk);
330	struct sctp_sock *sp = sctp_sk(sk);
331	struct sctp_endpoint *ep = sp->ep;
332	struct sctp_bind_addr *bp = &ep->base.bind_addr;
333	struct sctp_af *af;
334	unsigned short snum;
335	int ret = 0;
336
337	/* Common sockaddr verification. */
338	af = sctp_sockaddr_af(sp, addr, len);
339	if (!af) {
340		pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
341			 __func__, sk, addr, len);
342		return -EINVAL;
343	}
344
345	snum = ntohs(addr->v4.sin_port);
346
347	pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
348		 __func__, sk, &addr->sa, bp->port, snum, len);
349
350	/* PF specific bind() address verification. */
351	if (!sp->pf->bind_verify(sp, addr))
352		return -EADDRNOTAVAIL;
353
354	/* We must either be unbound, or bind to the same port.
355	 * It's OK to allow 0 ports if we are already bound.
356	 * We'll just inhert an already bound port in this case
357	 */
358	if (bp->port) {
359		if (!snum)
360			snum = bp->port;
361		else if (snum != bp->port) {
362			pr_debug("%s: new port %d doesn't match existing port "
363				 "%d\n", __func__, snum, bp->port);
364			return -EINVAL;
365		}
366	}
367
368	if (snum && snum < PROT_SOCK &&
369	    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
370		return -EACCES;
371
372	/* See if the address matches any of the addresses we may have
373	 * already bound before checking against other endpoints.
374	 */
375	if (sctp_bind_addr_match(bp, addr, sp))
376		return -EINVAL;
377
378	/* Make sure we are allowed to bind here.
379	 * The function sctp_get_port_local() does duplicate address
380	 * detection.
381	 */
382	addr->v4.sin_port = htons(snum);
383	if ((ret = sctp_get_port_local(sk, addr))) {
384		return -EADDRINUSE;
385	}
386
387	/* Refresh ephemeral port.  */
388	if (!bp->port)
389		bp->port = inet_sk(sk)->inet_num;
390
391	/* Add the address to the bind address list.
392	 * Use GFP_ATOMIC since BHs will be disabled.
393	 */
394	ret = sctp_add_bind_addr(bp, addr, SCTP_ADDR_SRC, GFP_ATOMIC);
395
396	/* Copy back into socket for getsockname() use. */
397	if (!ret) {
398		inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
399		sp->pf->to_sk_saddr(addr, sk);
400	}
401
402	return ret;
403}
404
405 /* ADDIP Section 4.1.1 Congestion Control of ASCONF Chunks
406 *
407 * R1) One and only one ASCONF Chunk MAY be in transit and unacknowledged
408 * at any one time.  If a sender, after sending an ASCONF chunk, decides
409 * it needs to transfer another ASCONF Chunk, it MUST wait until the
410 * ASCONF-ACK Chunk returns from the previous ASCONF Chunk before sending a
411 * subsequent ASCONF. Note this restriction binds each side, so at any
412 * time two ASCONF may be in-transit on any given association (one sent
413 * from each endpoint).
414 */
415static int sctp_send_asconf(struct sctp_association *asoc,
416			    struct sctp_chunk *chunk)
417{
418	struct net 	*net = sock_net(asoc->base.sk);
419	int		retval = 0;
420
421	/* If there is an outstanding ASCONF chunk, queue it for later
422	 * transmission.
423	 */
424	if (asoc->addip_last_asconf) {
425		list_add_tail(&chunk->list, &asoc->addip_chunk_list);
426		goto out;
427	}
428
429	/* Hold the chunk until an ASCONF_ACK is received. */
430	sctp_chunk_hold(chunk);
431	retval = sctp_primitive_ASCONF(net, asoc, chunk);
432	if (retval)
433		sctp_chunk_free(chunk);
434	else
435		asoc->addip_last_asconf = chunk;
436
437out:
438	return retval;
439}
440
441/* Add a list of addresses as bind addresses to local endpoint or
442 * association.
443 *
444 * Basically run through each address specified in the addrs/addrcnt
445 * array/length pair, determine if it is IPv6 or IPv4 and call
446 * sctp_do_bind() on it.
447 *
448 * If any of them fails, then the operation will be reversed and the
449 * ones that were added will be removed.
450 *
451 * Only sctp_setsockopt_bindx() is supposed to call this function.
452 */
453static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
454{
455	int cnt;
456	int retval = 0;
457	void *addr_buf;
458	struct sockaddr *sa_addr;
459	struct sctp_af *af;
460
461	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
462		 addrs, addrcnt);
463
464	addr_buf = addrs;
465	for (cnt = 0; cnt < addrcnt; cnt++) {
466		/* The list may contain either IPv4 or IPv6 address;
467		 * determine the address length for walking thru the list.
468		 */
469		sa_addr = addr_buf;
470		af = sctp_get_af_specific(sa_addr->sa_family);
471		if (!af) {
472			retval = -EINVAL;
473			goto err_bindx_add;
474		}
475
476		retval = sctp_do_bind(sk, (union sctp_addr *)sa_addr,
477				      af->sockaddr_len);
478
479		addr_buf += af->sockaddr_len;
480
481err_bindx_add:
482		if (retval < 0) {
483			/* Failed. Cleanup the ones that have been added */
484			if (cnt > 0)
485				sctp_bindx_rem(sk, addrs, cnt);
486			return retval;
487		}
488	}
489
490	return retval;
491}
492
493/* Send an ASCONF chunk with Add IP address parameters to all the peers of the
494 * associations that are part of the endpoint indicating that a list of local
495 * addresses are added to the endpoint.
496 *
497 * If any of the addresses is already in the bind address list of the
498 * association, we do not send the chunk for that association.  But it will not
499 * affect other associations.
500 *
501 * Only sctp_setsockopt_bindx() is supposed to call this function.
502 */
503static int sctp_send_asconf_add_ip(struct sock		*sk,
504				   struct sockaddr	*addrs,
505				   int 			addrcnt)
506{
507	struct net *net = sock_net(sk);
508	struct sctp_sock		*sp;
509	struct sctp_endpoint		*ep;
510	struct sctp_association		*asoc;
511	struct sctp_bind_addr		*bp;
512	struct sctp_chunk		*chunk;
513	struct sctp_sockaddr_entry	*laddr;
514	union sctp_addr			*addr;
515	union sctp_addr			saveaddr;
516	void				*addr_buf;
517	struct sctp_af			*af;
518	struct list_head		*p;
519	int 				i;
520	int 				retval = 0;
521
522	if (!net->sctp.addip_enable)
523		return retval;
524
525	sp = sctp_sk(sk);
526	ep = sp->ep;
527
528	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
529		 __func__, sk, addrs, addrcnt);
530
531	list_for_each_entry(asoc, &ep->asocs, asocs) {
532		if (!asoc->peer.asconf_capable)
533			continue;
534
535		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_ADD_IP)
536			continue;
537
538		if (!sctp_state(asoc, ESTABLISHED))
539			continue;
540
541		/* Check if any address in the packed array of addresses is
542		 * in the bind address list of the association. If so,
543		 * do not send the asconf chunk to its peer, but continue with
544		 * other associations.
545		 */
546		addr_buf = addrs;
547		for (i = 0; i < addrcnt; i++) {
548			addr = addr_buf;
549			af = sctp_get_af_specific(addr->v4.sin_family);
550			if (!af) {
551				retval = -EINVAL;
552				goto out;
553			}
554
555			if (sctp_assoc_lookup_laddr(asoc, addr))
556				break;
557
558			addr_buf += af->sockaddr_len;
559		}
560		if (i < addrcnt)
561			continue;
562
563		/* Use the first valid address in bind addr list of
564		 * association as Address Parameter of ASCONF CHUNK.
565		 */
566		bp = &asoc->base.bind_addr;
567		p = bp->address_list.next;
568		laddr = list_entry(p, struct sctp_sockaddr_entry, list);
569		chunk = sctp_make_asconf_update_ip(asoc, &laddr->a, addrs,
570						   addrcnt, SCTP_PARAM_ADD_IP);
571		if (!chunk) {
572			retval = -ENOMEM;
573			goto out;
574		}
575
576		/* Add the new addresses to the bind address list with
577		 * use_as_src set to 0.
578		 */
579		addr_buf = addrs;
580		for (i = 0; i < addrcnt; i++) {
581			addr = addr_buf;
582			af = sctp_get_af_specific(addr->v4.sin_family);
583			memcpy(&saveaddr, addr, af->sockaddr_len);
584			retval = sctp_add_bind_addr(bp, &saveaddr,
585						    SCTP_ADDR_NEW, GFP_ATOMIC);
586			addr_buf += af->sockaddr_len;
587		}
588		if (asoc->src_out_of_asoc_ok) {
589			struct sctp_transport *trans;
590
591			list_for_each_entry(trans,
592			    &asoc->peer.transport_addr_list, transports) {
593				/* Clear the source and route cache */
594				dst_release(trans->dst);
595				trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
596				    2*asoc->pathmtu, 4380));
597				trans->ssthresh = asoc->peer.i.a_rwnd;
598				trans->rto = asoc->rto_initial;
599				sctp_max_rto(asoc, trans);
600				trans->rtt = trans->srtt = trans->rttvar = 0;
601				sctp_transport_route(trans, NULL,
602				    sctp_sk(asoc->base.sk));
603			}
604		}
605		retval = sctp_send_asconf(asoc, chunk);
606	}
607
608out:
609	return retval;
610}
611
612/* Remove a list of addresses from bind addresses list.  Do not remove the
613 * last address.
614 *
615 * Basically run through each address specified in the addrs/addrcnt
616 * array/length pair, determine if it is IPv6 or IPv4 and call
617 * sctp_del_bind() on it.
618 *
619 * If any of them fails, then the operation will be reversed and the
620 * ones that were removed will be added back.
621 *
622 * At least one address has to be left; if only one address is
623 * available, the operation will return -EBUSY.
624 *
625 * Only sctp_setsockopt_bindx() is supposed to call this function.
626 */
627static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
628{
629	struct sctp_sock *sp = sctp_sk(sk);
630	struct sctp_endpoint *ep = sp->ep;
631	int cnt;
632	struct sctp_bind_addr *bp = &ep->base.bind_addr;
633	int retval = 0;
634	void *addr_buf;
635	union sctp_addr *sa_addr;
636	struct sctp_af *af;
637
638	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
639		 __func__, sk, addrs, addrcnt);
640
641	addr_buf = addrs;
642	for (cnt = 0; cnt < addrcnt; cnt++) {
643		/* If the bind address list is empty or if there is only one
644		 * bind address, there is nothing more to be removed (we need
645		 * at least one address here).
646		 */
647		if (list_empty(&bp->address_list) ||
648		    (sctp_list_single_entry(&bp->address_list))) {
649			retval = -EBUSY;
650			goto err_bindx_rem;
651		}
652
653		sa_addr = addr_buf;
654		af = sctp_get_af_specific(sa_addr->sa.sa_family);
655		if (!af) {
656			retval = -EINVAL;
657			goto err_bindx_rem;
658		}
659
660		if (!af->addr_valid(sa_addr, sp, NULL)) {
661			retval = -EADDRNOTAVAIL;
662			goto err_bindx_rem;
663		}
664
665		if (sa_addr->v4.sin_port &&
666		    sa_addr->v4.sin_port != htons(bp->port)) {
667			retval = -EINVAL;
668			goto err_bindx_rem;
669		}
670
671		if (!sa_addr->v4.sin_port)
672			sa_addr->v4.sin_port = htons(bp->port);
673
674		/* FIXME - There is probably a need to check if sk->sk_saddr and
675		 * sk->sk_rcv_addr are currently set to one of the addresses to
676		 * be removed. This is something which needs to be looked into
677		 * when we are fixing the outstanding issues with multi-homing
678		 * socket routing and failover schemes. Refer to comments in
679		 * sctp_do_bind(). -daisy
680		 */
681		retval = sctp_del_bind_addr(bp, sa_addr);
682
683		addr_buf += af->sockaddr_len;
684err_bindx_rem:
685		if (retval < 0) {
686			/* Failed. Add the ones that has been removed back */
687			if (cnt > 0)
688				sctp_bindx_add(sk, addrs, cnt);
689			return retval;
690		}
691	}
692
693	return retval;
694}
695
696/* Send an ASCONF chunk with Delete IP address parameters to all the peers of
697 * the associations that are part of the endpoint indicating that a list of
698 * local addresses are removed from the endpoint.
699 *
700 * If any of the addresses is already in the bind address list of the
701 * association, we do not send the chunk for that association.  But it will not
702 * affect other associations.
703 *
704 * Only sctp_setsockopt_bindx() is supposed to call this function.
705 */
706static int sctp_send_asconf_del_ip(struct sock		*sk,
707				   struct sockaddr	*addrs,
708				   int			addrcnt)
709{
710	struct net *net = sock_net(sk);
711	struct sctp_sock	*sp;
712	struct sctp_endpoint	*ep;
713	struct sctp_association	*asoc;
714	struct sctp_transport	*transport;
715	struct sctp_bind_addr	*bp;
716	struct sctp_chunk	*chunk;
717	union sctp_addr		*laddr;
718	void			*addr_buf;
719	struct sctp_af		*af;
720	struct sctp_sockaddr_entry *saddr;
721	int 			i;
722	int 			retval = 0;
723	int			stored = 0;
724
725	chunk = NULL;
726	if (!net->sctp.addip_enable)
727		return retval;
728
729	sp = sctp_sk(sk);
730	ep = sp->ep;
731
732	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
733		 __func__, sk, addrs, addrcnt);
734
735	list_for_each_entry(asoc, &ep->asocs, asocs) {
736
737		if (!asoc->peer.asconf_capable)
738			continue;
739
740		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_DEL_IP)
741			continue;
742
743		if (!sctp_state(asoc, ESTABLISHED))
744			continue;
745
746		/* Check if any address in the packed array of addresses is
747		 * not present in the bind address list of the association.
748		 * If so, do not send the asconf chunk to its peer, but
749		 * continue with other associations.
750		 */
751		addr_buf = addrs;
752		for (i = 0; i < addrcnt; i++) {
753			laddr = addr_buf;
754			af = sctp_get_af_specific(laddr->v4.sin_family);
755			if (!af) {
756				retval = -EINVAL;
757				goto out;
758			}
759
760			if (!sctp_assoc_lookup_laddr(asoc, laddr))
761				break;
762
763			addr_buf += af->sockaddr_len;
764		}
765		if (i < addrcnt)
766			continue;
767
768		/* Find one address in the association's bind address list
769		 * that is not in the packed array of addresses. This is to
770		 * make sure that we do not delete all the addresses in the
771		 * association.
772		 */
773		bp = &asoc->base.bind_addr;
774		laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
775					       addrcnt, sp);
776		if ((laddr == NULL) && (addrcnt == 1)) {
777			if (asoc->asconf_addr_del_pending)
778				continue;
779			asoc->asconf_addr_del_pending =
780			    kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
781			if (asoc->asconf_addr_del_pending == NULL) {
782				retval = -ENOMEM;
783				goto out;
784			}
785			asoc->asconf_addr_del_pending->sa.sa_family =
786				    addrs->sa_family;
787			asoc->asconf_addr_del_pending->v4.sin_port =
788				    htons(bp->port);
789			if (addrs->sa_family == AF_INET) {
790				struct sockaddr_in *sin;
791
792				sin = (struct sockaddr_in *)addrs;
793				asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
794			} else if (addrs->sa_family == AF_INET6) {
795				struct sockaddr_in6 *sin6;
796
797				sin6 = (struct sockaddr_in6 *)addrs;
798				asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
799			}
800
801			pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
802				 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
803				 asoc->asconf_addr_del_pending);
804
805			asoc->src_out_of_asoc_ok = 1;
806			stored = 1;
807			goto skip_mkasconf;
808		}
809
810		if (laddr == NULL)
811			return -EINVAL;
812
813		/* We do not need RCU protection throughout this loop
814		 * because this is done under a socket lock from the
815		 * setsockopt call.
816		 */
817		chunk = sctp_make_asconf_update_ip(asoc, laddr, addrs, addrcnt,
818						   SCTP_PARAM_DEL_IP);
819		if (!chunk) {
820			retval = -ENOMEM;
821			goto out;
822		}
823
824skip_mkasconf:
825		/* Reset use_as_src flag for the addresses in the bind address
826		 * list that are to be deleted.
827		 */
828		addr_buf = addrs;
829		for (i = 0; i < addrcnt; i++) {
830			laddr = addr_buf;
831			af = sctp_get_af_specific(laddr->v4.sin_family);
832			list_for_each_entry(saddr, &bp->address_list, list) {
833				if (sctp_cmp_addr_exact(&saddr->a, laddr))
834					saddr->state = SCTP_ADDR_DEL;
835			}
836			addr_buf += af->sockaddr_len;
837		}
838
839		/* Update the route and saddr entries for all the transports
840		 * as some of the addresses in the bind address list are
841		 * about to be deleted and cannot be used as source addresses.
842		 */
843		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
844					transports) {
845			dst_release(transport->dst);
846			sctp_transport_route(transport, NULL,
847					     sctp_sk(asoc->base.sk));
848		}
849
850		if (stored)
851			/* We don't need to transmit ASCONF */
852			continue;
853		retval = sctp_send_asconf(asoc, chunk);
854	}
855out:
856	return retval;
857}
858
859/* set addr events to assocs in the endpoint.  ep and addr_wq must be locked */
860int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
861{
862	struct sock *sk = sctp_opt2sk(sp);
863	union sctp_addr *addr;
864	struct sctp_af *af;
865
866	/* It is safe to write port space in caller. */
867	addr = &addrw->a;
868	addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
869	af = sctp_get_af_specific(addr->sa.sa_family);
870	if (!af)
871		return -EINVAL;
872	if (sctp_verify_addr(sk, addr, af->sockaddr_len))
873		return -EINVAL;
874
875	if (addrw->state == SCTP_ADDR_NEW)
876		return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
877	else
878		return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
879}
880
881/* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
882 *
883 * API 8.1
884 * int sctp_bindx(int sd, struct sockaddr *addrs, int addrcnt,
885 *                int flags);
886 *
887 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
888 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
889 * or IPv6 addresses.
890 *
891 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
892 * Section 3.1.2 for this usage.
893 *
894 * addrs is a pointer to an array of one or more socket addresses. Each
895 * address is contained in its appropriate structure (i.e. struct
896 * sockaddr_in or struct sockaddr_in6) the family of the address type
897 * must be used to distinguish the address length (note that this
898 * representation is termed a "packed array" of addresses). The caller
899 * specifies the number of addresses in the array with addrcnt.
900 *
901 * On success, sctp_bindx() returns 0. On failure, sctp_bindx() returns
902 * -1, and sets errno to the appropriate error code.
903 *
904 * For SCTP, the port given in each socket address must be the same, or
905 * sctp_bindx() will fail, setting errno to EINVAL.
906 *
907 * The flags parameter is formed from the bitwise OR of zero or more of
908 * the following currently defined flags:
909 *
910 * SCTP_BINDX_ADD_ADDR
911 *
912 * SCTP_BINDX_REM_ADDR
913 *
914 * SCTP_BINDX_ADD_ADDR directs SCTP to add the given addresses to the
915 * association, and SCTP_BINDX_REM_ADDR directs SCTP to remove the given
916 * addresses from the association. The two flags are mutually exclusive;
917 * if both are given, sctp_bindx() will fail with EINVAL. A caller may
918 * not remove all addresses from an association; sctp_bindx() will
919 * reject such an attempt with EINVAL.
920 *
921 * An application can use sctp_bindx(SCTP_BINDX_ADD_ADDR) to associate
922 * additional addresses with an endpoint after calling bind().  Or use
923 * sctp_bindx(SCTP_BINDX_REM_ADDR) to remove some addresses a listening
924 * socket is associated with so that no new association accepted will be
925 * associated with those addresses. If the endpoint supports dynamic
926 * address a SCTP_BINDX_REM_ADDR or SCTP_BINDX_ADD_ADDR may cause a
927 * endpoint to send the appropriate message to the peer to change the
928 * peers address lists.
929 *
930 * Adding and removing addresses from a connected association is
931 * optional functionality. Implementations that do not support this
932 * functionality should return EOPNOTSUPP.
933 *
934 * Basically do nothing but copying the addresses from user to kernel
935 * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
936 * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
937 * from userspace.
938 *
939 * We don't use copy_from_user() for optimization: we first do the
940 * sanity checks (buffer size -fast- and access check-healthy
941 * pointer); if all of those succeed, then we can alloc the memory
942 * (expensive operation) needed to copy the data to kernel. Then we do
943 * the copying without checking the user space area
944 * (__copy_from_user()).
945 *
946 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
947 * it.
948 *
949 * sk        The sk of the socket
950 * addrs     The pointer to the addresses in user land
951 * addrssize Size of the addrs buffer
952 * op        Operation to perform (add or remove, see the flags of
953 *           sctp_bindx)
954 *
955 * Returns 0 if ok, <0 errno code on error.
956 */
957static int sctp_setsockopt_bindx(struct sock *sk,
958				 struct sockaddr __user *addrs,
959				 int addrs_size, int op)
960{
961	struct sockaddr *kaddrs;
962	int err;
963	int addrcnt = 0;
964	int walk_size = 0;
965	struct sockaddr *sa_addr;
966	void *addr_buf;
967	struct sctp_af *af;
968
969	pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
970		 __func__, sk, addrs, addrs_size, op);
971
972	if (unlikely(addrs_size <= 0))
973		return -EINVAL;
974
975	/* Check the user passed a healthy pointer.  */
976	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
977		return -EFAULT;
978
979	/* Alloc space for the address array in kernel memory.  */
980	kaddrs = kmalloc(addrs_size, GFP_KERNEL);
981	if (unlikely(!kaddrs))
982		return -ENOMEM;
983
984	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
985		kfree(kaddrs);
986		return -EFAULT;
987	}
988
989	/* Walk through the addrs buffer and count the number of addresses. */
990	addr_buf = kaddrs;
991	while (walk_size < addrs_size) {
992		if (walk_size + sizeof(sa_family_t) > addrs_size) {
993			kfree(kaddrs);
994			return -EINVAL;
995		}
996
997		sa_addr = addr_buf;
998		af = sctp_get_af_specific(sa_addr->sa_family);
999
1000		/* If the address family is not supported or if this address
1001		 * causes the address buffer to overflow return EINVAL.
1002		 */
1003		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
1004			kfree(kaddrs);
1005			return -EINVAL;
1006		}
1007		addrcnt++;
1008		addr_buf += af->sockaddr_len;
1009		walk_size += af->sockaddr_len;
1010	}
1011
1012	/* Do the work. */
1013	switch (op) {
1014	case SCTP_BINDX_ADD_ADDR:
1015		err = sctp_bindx_add(sk, kaddrs, addrcnt);
1016		if (err)
1017			goto out;
1018		err = sctp_send_asconf_add_ip(sk, kaddrs, addrcnt);
1019		break;
1020
1021	case SCTP_BINDX_REM_ADDR:
1022		err = sctp_bindx_rem(sk, kaddrs, addrcnt);
1023		if (err)
1024			goto out;
1025		err = sctp_send_asconf_del_ip(sk, kaddrs, addrcnt);
1026		break;
1027
1028	default:
1029		err = -EINVAL;
1030		break;
1031	}
1032
1033out:
1034	kfree(kaddrs);
1035
1036	return err;
1037}
1038
1039/* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
1040 *
1041 * Common routine for handling connect() and sctp_connectx().
1042 * Connect will come in with just a single address.
1043 */
1044static int __sctp_connect(struct sock *sk,
1045			  struct sockaddr *kaddrs,
1046			  int addrs_size,
1047			  sctp_assoc_t *assoc_id)
1048{
1049	struct net *net = sock_net(sk);
1050	struct sctp_sock *sp;
1051	struct sctp_endpoint *ep;
1052	struct sctp_association *asoc = NULL;
1053	struct sctp_association *asoc2;
1054	struct sctp_transport *transport;
1055	union sctp_addr to;
1056	sctp_scope_t scope;
1057	long timeo;
1058	int err = 0;
1059	int addrcnt = 0;
1060	int walk_size = 0;
1061	union sctp_addr *sa_addr = NULL;
1062	void *addr_buf;
1063	unsigned short port;
1064	unsigned int f_flags = 0;
1065
1066	sp = sctp_sk(sk);
1067	ep = sp->ep;
1068
1069	/* connect() cannot be done on a socket that is already in ESTABLISHED
1070	 * state - UDP-style peeled off socket or a TCP-style socket that
1071	 * is already connected.
1072	 * It cannot be done even on a TCP-style listening socket.
1073	 */
1074	if (sctp_sstate(sk, ESTABLISHED) ||
1075	    (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
1076		err = -EISCONN;
1077		goto out_free;
1078	}
1079
1080	/* Walk through the addrs buffer and count the number of addresses. */
1081	addr_buf = kaddrs;
1082	while (walk_size < addrs_size) {
1083		struct sctp_af *af;
1084
1085		if (walk_size + sizeof(sa_family_t) > addrs_size) {
1086			err = -EINVAL;
1087			goto out_free;
1088		}
1089
1090		sa_addr = addr_buf;
1091		af = sctp_get_af_specific(sa_addr->sa.sa_family);
1092
1093		/* If the address family is not supported or if this address
1094		 * causes the address buffer to overflow return EINVAL.
1095		 */
1096		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
1097			err = -EINVAL;
1098			goto out_free;
1099		}
1100
1101		port = ntohs(sa_addr->v4.sin_port);
1102
1103		/* Save current address so we can work with it */
1104		memcpy(&to, sa_addr, af->sockaddr_len);
1105
1106		err = sctp_verify_addr(sk, &to, af->sockaddr_len);
1107		if (err)
1108			goto out_free;
1109
1110		/* Make sure the destination port is correctly set
1111		 * in all addresses.
1112		 */
1113		if (asoc && asoc->peer.port && asoc->peer.port != port) {
1114			err = -EINVAL;
1115			goto out_free;
1116		}
1117
1118		/* Check if there already is a matching association on the
1119		 * endpoint (other than the one created here).
1120		 */
1121		asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1122		if (asoc2 && asoc2 != asoc) {
1123			if (asoc2->state >= SCTP_STATE_ESTABLISHED)
1124				err = -EISCONN;
1125			else
1126				err = -EALREADY;
1127			goto out_free;
1128		}
1129
1130		/* If we could not find a matching association on the endpoint,
1131		 * make sure that there is no peeled-off association matching
1132		 * the peer address even on another socket.
1133		 */
1134		if (sctp_endpoint_is_peeled_off(ep, &to)) {
1135			err = -EADDRNOTAVAIL;
1136			goto out_free;
1137		}
1138
1139		if (!asoc) {
1140			/* If a bind() or sctp_bindx() is not called prior to
1141			 * an sctp_connectx() call, the system picks an
1142			 * ephemeral port and will choose an address set
1143			 * equivalent to binding with a wildcard address.
1144			 */
1145			if (!ep->base.bind_addr.port) {
1146				if (sctp_autobind(sk)) {
1147					err = -EAGAIN;
1148					goto out_free;
1149				}
1150			} else {
1151				/*
1152				 * If an unprivileged user inherits a 1-many
1153				 * style socket with open associations on a
1154				 * privileged port, it MAY be permitted to
1155				 * accept new associations, but it SHOULD NOT
1156				 * be permitted to open new associations.
1157				 */
1158				if (ep->base.bind_addr.port < PROT_SOCK &&
1159				    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1160					err = -EACCES;
1161					goto out_free;
1162				}
1163			}
1164
1165			scope = sctp_scope(&to);
1166			asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1167			if (!asoc) {
1168				err = -ENOMEM;
1169				goto out_free;
1170			}
1171
1172			err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
1173							      GFP_KERNEL);
1174			if (err < 0) {
1175				goto out_free;
1176			}
1177
1178		}
1179
1180		/* Prime the peer's transport structures.  */
1181		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
1182						SCTP_UNKNOWN);
1183		if (!transport) {
1184			err = -ENOMEM;
1185			goto out_free;
1186		}
1187
1188		addrcnt++;
1189		addr_buf += af->sockaddr_len;
1190		walk_size += af->sockaddr_len;
1191	}
1192
1193	/* In case the user of sctp_connectx() wants an association
1194	 * id back, assign one now.
1195	 */
1196	if (assoc_id) {
1197		err = sctp_assoc_set_id(asoc, GFP_KERNEL);
1198		if (err < 0)
1199			goto out_free;
1200	}
1201
1202	err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1203	if (err < 0) {
1204		goto out_free;
1205	}
1206
1207	/* Initialize sk's dport and daddr for getpeername() */
1208	inet_sk(sk)->inet_dport = htons(asoc->peer.port);
1209	sp->pf->to_sk_daddr(sa_addr, sk);
1210	sk->sk_err = 0;
1211
1212	/* in-kernel sockets don't generally have a file allocated to them
1213	 * if all they do is call sock_create_kern().
1214	 */
1215	if (sk->sk_socket->file)
1216		f_flags = sk->sk_socket->file->f_flags;
1217
1218	timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
1219
1220	err = sctp_wait_for_connect(asoc, &timeo);
1221	if ((err == 0 || err == -EINPROGRESS) && assoc_id)
1222		*assoc_id = asoc->assoc_id;
1223
1224	/* Don't free association on exit. */
1225	asoc = NULL;
1226
1227out_free:
1228	pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
1229		 __func__, asoc, kaddrs, err);
1230
1231	if (asoc) {
1232		/* sctp_primitive_ASSOCIATE may have added this association
1233		 * To the hash table, try to unhash it, just in case, its a noop
1234		 * if it wasn't hashed so we're safe
1235		 */
1236		sctp_unhash_established(asoc);
1237		sctp_association_free(asoc);
1238	}
1239	return err;
1240}
1241
1242/* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
1243 *
1244 * API 8.9
1245 * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt,
1246 * 			sctp_assoc_t *asoc);
1247 *
1248 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
1249 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
1250 * or IPv6 addresses.
1251 *
1252 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
1253 * Section 3.1.2 for this usage.
1254 *
1255 * addrs is a pointer to an array of one or more socket addresses. Each
1256 * address is contained in its appropriate structure (i.e. struct
1257 * sockaddr_in or struct sockaddr_in6) the family of the address type
1258 * must be used to distengish the address length (note that this
1259 * representation is termed a "packed array" of addresses). The caller
1260 * specifies the number of addresses in the array with addrcnt.
1261 *
1262 * On success, sctp_connectx() returns 0. It also sets the assoc_id to
1263 * the association id of the new association.  On failure, sctp_connectx()
1264 * returns -1, and sets errno to the appropriate error code.  The assoc_id
1265 * is not touched by the kernel.
1266 *
1267 * For SCTP, the port given in each socket address must be the same, or
1268 * sctp_connectx() will fail, setting errno to EINVAL.
1269 *
1270 * An application can use sctp_connectx to initiate an association with
1271 * an endpoint that is multi-homed.  Much like sctp_bindx() this call
1272 * allows a caller to specify multiple addresses at which a peer can be
1273 * reached.  The way the SCTP stack uses the list of addresses to set up
1274 * the association is implementation dependent.  This function only
1275 * specifies that the stack will try to make use of all the addresses in
1276 * the list when needed.
1277 *
1278 * Note that the list of addresses passed in is only used for setting up
1279 * the association.  It does not necessarily equal the set of addresses
1280 * the peer uses for the resulting association.  If the caller wants to
1281 * find out the set of peer addresses, it must use sctp_getpaddrs() to
1282 * retrieve them after the association has been set up.
1283 *
1284 * Basically do nothing but copying the addresses from user to kernel
1285 * land and invoking either sctp_connectx(). This is used for tunneling
1286 * the sctp_connectx() request through sctp_setsockopt() from userspace.
1287 *
1288 * We don't use copy_from_user() for optimization: we first do the
1289 * sanity checks (buffer size -fast- and access check-healthy
1290 * pointer); if all of those succeed, then we can alloc the memory
1291 * (expensive operation) needed to copy the data to kernel. Then we do
1292 * the copying without checking the user space area
1293 * (__copy_from_user()).
1294 *
1295 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
1296 * it.
1297 *
1298 * sk        The sk of the socket
1299 * addrs     The pointer to the addresses in user land
1300 * addrssize Size of the addrs buffer
1301 *
1302 * Returns >=0 if ok, <0 errno code on error.
1303 */
1304static int __sctp_setsockopt_connectx(struct sock *sk,
1305				      struct sockaddr __user *addrs,
1306				      int addrs_size,
1307				      sctp_assoc_t *assoc_id)
1308{
1309	int err = 0;
1310	struct sockaddr *kaddrs;
1311
1312	pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
1313		 __func__, sk, addrs, addrs_size);
1314
1315	if (unlikely(addrs_size <= 0))
1316		return -EINVAL;
1317
1318	/* Check the user passed a healthy pointer.  */
1319	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
1320		return -EFAULT;
1321
1322	/* Alloc space for the address array in kernel memory.  */
1323	kaddrs = kmalloc(addrs_size, GFP_KERNEL);
1324	if (unlikely(!kaddrs))
1325		return -ENOMEM;
1326
1327	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
1328		err = -EFAULT;
1329	} else {
1330		err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1331	}
1332
1333	kfree(kaddrs);
1334
1335	return err;
1336}
1337
1338/*
1339 * This is an older interface.  It's kept for backward compatibility
1340 * to the option that doesn't provide association id.
1341 */
1342static int sctp_setsockopt_connectx_old(struct sock *sk,
1343					struct sockaddr __user *addrs,
1344					int addrs_size)
1345{
1346	return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
1347}
1348
1349/*
1350 * New interface for the API.  The since the API is done with a socket
1351 * option, to make it simple we feed back the association id is as a return
1352 * indication to the call.  Error is always negative and association id is
1353 * always positive.
1354 */
1355static int sctp_setsockopt_connectx(struct sock *sk,
1356				    struct sockaddr __user *addrs,
1357				    int addrs_size)
1358{
1359	sctp_assoc_t assoc_id = 0;
1360	int err = 0;
1361
1362	err = __sctp_setsockopt_connectx(sk, addrs, addrs_size, &assoc_id);
1363
1364	if (err)
1365		return err;
1366	else
1367		return assoc_id;
1368}
1369
1370/*
1371 * New (hopefully final) interface for the API.
1372 * We use the sctp_getaddrs_old structure so that use-space library
1373 * can avoid any unnecessary allocations. The only different part
1374 * is that we store the actual length of the address buffer into the
1375 * addrs_num structure member. That way we can re-use the existing
1376 * code.
1377 */
1378#ifdef CONFIG_COMPAT
1379struct compat_sctp_getaddrs_old {
1380	sctp_assoc_t	assoc_id;
1381	s32		addr_num;
1382	compat_uptr_t	addrs;		/* struct sockaddr * */
1383};
1384#endif
1385
1386static int sctp_getsockopt_connectx3(struct sock *sk, int len,
1387				     char __user *optval,
1388				     int __user *optlen)
1389{
1390	struct sctp_getaddrs_old param;
1391	sctp_assoc_t assoc_id = 0;
1392	int err = 0;
1393
1394#ifdef CONFIG_COMPAT
1395	if (is_compat_task()) {
1396		struct compat_sctp_getaddrs_old param32;
1397
1398		if (len < sizeof(param32))
1399			return -EINVAL;
1400		if (copy_from_user(&param32, optval, sizeof(param32)))
1401			return -EFAULT;
1402
1403		param.assoc_id = param32.assoc_id;
1404		param.addr_num = param32.addr_num;
1405		param.addrs = compat_ptr(param32.addrs);
1406	} else
1407#endif
1408	{
1409		if (len < sizeof(param))
1410			return -EINVAL;
1411		if (copy_from_user(&param, optval, sizeof(param)))
1412			return -EFAULT;
1413	}
1414
1415	err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
1416					 param.addrs, param.addr_num,
1417					 &assoc_id);
1418	if (err == 0 || err == -EINPROGRESS) {
1419		if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
1420			return -EFAULT;
1421		if (put_user(sizeof(assoc_id), optlen))
1422			return -EFAULT;
1423	}
1424
1425	return err;
1426}
1427
1428/* API 3.1.4 close() - UDP Style Syntax
1429 * Applications use close() to perform graceful shutdown (as described in
1430 * Section 10.1 of [SCTP]) on ALL the associations currently represented
1431 * by a UDP-style socket.
1432 *
1433 * The syntax is
1434 *
1435 *   ret = close(int sd);
1436 *
1437 *   sd      - the socket descriptor of the associations to be closed.
1438 *
1439 * To gracefully shutdown a specific association represented by the
1440 * UDP-style socket, an application should use the sendmsg() call,
1441 * passing no user data, but including the appropriate flag in the
1442 * ancillary data (see Section xxxx).
1443 *
1444 * If sd in the close() call is a branched-off socket representing only
1445 * one association, the shutdown is performed on that association only.
1446 *
1447 * 4.1.6 close() - TCP Style Syntax
1448 *
1449 * Applications use close() to gracefully close down an association.
1450 *
1451 * The syntax is:
1452 *
1453 *    int close(int sd);
1454 *
1455 *      sd      - the socket descriptor of the association to be closed.
1456 *
1457 * After an application calls close() on a socket descriptor, no further
1458 * socket operations will succeed on that descriptor.
1459 *
1460 * API 7.1.4 SO_LINGER
1461 *
1462 * An application using the TCP-style socket can use this option to
1463 * perform the SCTP ABORT primitive.  The linger option structure is:
1464 *
1465 *  struct  linger {
1466 *     int     l_onoff;                // option on/off
1467 *     int     l_linger;               // linger time
1468 * };
1469 *
1470 * To enable the option, set l_onoff to 1.  If the l_linger value is set
1471 * to 0, calling close() is the same as the ABORT primitive.  If the
1472 * value is set to a negative value, the setsockopt() call will return
1473 * an error.  If the value is set to a positive value linger_time, the
1474 * close() can be blocked for at most linger_time ms.  If the graceful
1475 * shutdown phase does not finish during this period, close() will
1476 * return but the graceful shutdown phase continues in the system.
1477 */
1478static void sctp_close(struct sock *sk, long timeout)
1479{
1480	struct net *net = sock_net(sk);
1481	struct sctp_endpoint *ep;
1482	struct sctp_association *asoc;
1483	struct list_head *pos, *temp;
1484	unsigned int data_was_unread;
1485
1486	pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
1487
1488	lock_sock(sk);
1489	sk->sk_shutdown = SHUTDOWN_MASK;
1490	sk->sk_state = SCTP_SS_CLOSING;
1491
1492	ep = sctp_sk(sk)->ep;
1493
1494	/* Clean up any skbs sitting on the receive queue.  */
1495	data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
1496	data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
1497
1498	/* Walk all associations on an endpoint.  */
1499	list_for_each_safe(pos, temp, &ep->asocs) {
1500		asoc = list_entry(pos, struct sctp_association, asocs);
1501
1502		if (sctp_style(sk, TCP)) {
1503			/* A closed association can still be in the list if
1504			 * it belongs to a TCP-style listening socket that is
1505			 * not yet accepted. If so, free it. If not, send an
1506			 * ABORT or SHUTDOWN based on the linger options.
1507			 */
1508			if (sctp_state(asoc, CLOSED)) {
1509				sctp_unhash_established(asoc);
1510				sctp_association_free(asoc);
1511				continue;
1512			}
1513		}
1514
1515		if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
1516		    !skb_queue_empty(&asoc->ulpq.reasm) ||
1517		    (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
1518			struct sctp_chunk *chunk;
1519
1520			chunk = sctp_make_abort_user(asoc, NULL, 0);
1521			if (chunk)
1522				sctp_primitive_ABORT(net, asoc, chunk);
1523		} else
1524			sctp_primitive_SHUTDOWN(net, asoc, NULL);
1525	}
1526
1527	/* On a TCP-style socket, block for at most linger_time if set. */
1528	if (sctp_style(sk, TCP) && timeout)
1529		sctp_wait_for_close(sk, timeout);
1530
1531	/* This will run the backlog queue.  */
1532	release_sock(sk);
1533
1534	/* Supposedly, no process has access to the socket, but
1535	 * the net layers still may.
1536	 */
1537	local_bh_disable();
1538	bh_lock_sock(sk);
1539
1540	/* Hold the sock, since sk_common_release() will put sock_put()
1541	 * and we have just a little more cleanup.
1542	 */
1543	sock_hold(sk);
1544	sk_common_release(sk);
1545
1546	bh_unlock_sock(sk);
1547	local_bh_enable();
1548
1549	sock_put(sk);
1550
1551	SCTP_DBG_OBJCNT_DEC(sock);
1552}
1553
1554/* Handle EPIPE error. */
1555static int sctp_error(struct sock *sk, int flags, int err)
1556{
1557	if (err == -EPIPE)
1558		err = sock_error(sk) ? : -EPIPE;
1559	if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
1560		send_sig(SIGPIPE, current, 0);
1561	return err;
1562}
1563
1564/* API 3.1.3 sendmsg() - UDP Style Syntax
1565 *
1566 * An application uses sendmsg() and recvmsg() calls to transmit data to
1567 * and receive data from its peer.
1568 *
1569 *  ssize_t sendmsg(int socket, const struct msghdr *message,
1570 *                  int flags);
1571 *
1572 *  socket  - the socket descriptor of the endpoint.
1573 *  message - pointer to the msghdr structure which contains a single
1574 *            user message and possibly some ancillary data.
1575 *
1576 *            See Section 5 for complete description of the data
1577 *            structures.
1578 *
1579 *  flags   - flags sent or received with the user message, see Section
1580 *            5 for complete description of the flags.
1581 *
1582 * Note:  This function could use a rewrite especially when explicit
1583 * connect support comes in.
1584 */
1585/* BUG:  We do not implement the equivalent of sk_stream_wait_memory(). */
1586
1587static int sctp_msghdr_parse(const struct msghdr *, sctp_cmsgs_t *);
1588
1589static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
1590			struct msghdr *msg, size_t msg_len)
1591{
1592	struct net *net = sock_net(sk);
1593	struct sctp_sock *sp;
1594	struct sctp_endpoint *ep;
1595	struct sctp_association *new_asoc = NULL, *asoc = NULL;
1596	struct sctp_transport *transport, *chunk_tp;
1597	struct sctp_chunk *chunk;
1598	union sctp_addr to;
1599	struct sockaddr *msg_name = NULL;
1600	struct sctp_sndrcvinfo default_sinfo;
1601	struct sctp_sndrcvinfo *sinfo;
1602	struct sctp_initmsg *sinit;
1603	sctp_assoc_t associd = 0;
1604	sctp_cmsgs_t cmsgs = { NULL };
1605	sctp_scope_t scope;
1606	bool fill_sinfo_ttl = false;
1607	struct sctp_datamsg *datamsg;
1608	int msg_flags = msg->msg_flags;
1609	__u16 sinfo_flags = 0;
1610	long timeo;
1611	int err;
1612
1613	err = 0;
1614	sp = sctp_sk(sk);
1615	ep = sp->ep;
1616
1617	pr_debug("%s: sk:%p, msg:%p, msg_len:%zu ep:%p\n", __func__, sk,
1618		 msg, msg_len, ep);
1619
1620	/* We cannot send a message over a TCP-style listening socket. */
1621	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING)) {
1622		err = -EPIPE;
1623		goto out_nounlock;
1624	}
1625
1626	/* Parse out the SCTP CMSGs.  */
1627	err = sctp_msghdr_parse(msg, &cmsgs);
1628	if (err) {
1629		pr_debug("%s: msghdr parse err:%x\n", __func__, err);
1630		goto out_nounlock;
1631	}
1632
1633	/* Fetch the destination address for this packet.  This
1634	 * address only selects the association--it is not necessarily
1635	 * the address we will send to.
1636	 * For a peeled-off socket, msg_name is ignored.
1637	 */
1638	if (!sctp_style(sk, UDP_HIGH_BANDWIDTH) && msg->msg_name) {
1639		int msg_namelen = msg->msg_namelen;
1640
1641		err = sctp_verify_addr(sk, (union sctp_addr *)msg->msg_name,
1642				       msg_namelen);
1643		if (err)
1644			return err;
1645
1646		if (msg_namelen > sizeof(to))
1647			msg_namelen = sizeof(to);
1648		memcpy(&to, msg->msg_name, msg_namelen);
1649		msg_name = msg->msg_name;
1650	}
1651
1652	sinit = cmsgs.init;
1653	if (cmsgs.sinfo != NULL) {
1654		memset(&default_sinfo, 0, sizeof(default_sinfo));
1655		default_sinfo.sinfo_stream = cmsgs.sinfo->snd_sid;
1656		default_sinfo.sinfo_flags = cmsgs.sinfo->snd_flags;
1657		default_sinfo.sinfo_ppid = cmsgs.sinfo->snd_ppid;
1658		default_sinfo.sinfo_context = cmsgs.sinfo->snd_context;
1659		default_sinfo.sinfo_assoc_id = cmsgs.sinfo->snd_assoc_id;
1660
1661		sinfo = &default_sinfo;
1662		fill_sinfo_ttl = true;
1663	} else {
1664		sinfo = cmsgs.srinfo;
1665	}
1666	/* Did the user specify SNDINFO/SNDRCVINFO? */
1667	if (sinfo) {
1668		sinfo_flags = sinfo->sinfo_flags;
1669		associd = sinfo->sinfo_assoc_id;
1670	}
1671
1672	pr_debug("%s: msg_len:%zu, sinfo_flags:0x%x\n", __func__,
1673		 msg_len, sinfo_flags);
1674
1675	/* SCTP_EOF or SCTP_ABORT cannot be set on a TCP-style socket. */
1676	if (sctp_style(sk, TCP) && (sinfo_flags & (SCTP_EOF | SCTP_ABORT))) {
1677		err = -EINVAL;
1678		goto out_nounlock;
1679	}
1680
1681	/* If SCTP_EOF is set, no data can be sent. Disallow sending zero
1682	 * length messages when SCTP_EOF|SCTP_ABORT is not set.
1683	 * If SCTP_ABORT is set, the message length could be non zero with
1684	 * the msg_iov set to the user abort reason.
1685	 */
1686	if (((sinfo_flags & SCTP_EOF) && (msg_len > 0)) ||
1687	    (!(sinfo_flags & (SCTP_EOF|SCTP_ABORT)) && (msg_len == 0))) {
1688		err = -EINVAL;
1689		goto out_nounlock;
1690	}
1691
1692	/* If SCTP_ADDR_OVER is set, there must be an address
1693	 * specified in msg_name.
1694	 */
1695	if ((sinfo_flags & SCTP_ADDR_OVER) && (!msg->msg_name)) {
1696		err = -EINVAL;
1697		goto out_nounlock;
1698	}
1699
1700	transport = NULL;
1701
1702	pr_debug("%s: about to look up association\n", __func__);
1703
1704	lock_sock(sk);
1705
1706	/* If a msg_name has been specified, assume this is to be used.  */
1707	if (msg_name) {
1708		/* Look for a matching association on the endpoint. */
1709		asoc = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1710		if (!asoc) {
1711			/* If we could not find a matching association on the
1712			 * endpoint, make sure that it is not a TCP-style
1713			 * socket that already has an association or there is
1714			 * no peeled-off association on another socket.
1715			 */
1716			if ((sctp_style(sk, TCP) &&
1717			     sctp_sstate(sk, ESTABLISHED)) ||
1718			    sctp_endpoint_is_peeled_off(ep, &to)) {
1719				err = -EADDRNOTAVAIL;
1720				goto out_unlock;
1721			}
1722		}
1723	} else {
1724		asoc = sctp_id2assoc(sk, associd);
1725		if (!asoc) {
1726			err = -EPIPE;
1727			goto out_unlock;
1728		}
1729	}
1730
1731	if (asoc) {
1732		pr_debug("%s: just looked up association:%p\n", __func__, asoc);
1733
1734		/* We cannot send a message on a TCP-style SCTP_SS_ESTABLISHED
1735		 * socket that has an association in CLOSED state. This can
1736		 * happen when an accepted socket has an association that is
1737		 * already CLOSED.
1738		 */
1739		if (sctp_state(asoc, CLOSED) && sctp_style(sk, TCP)) {
1740			err = -EPIPE;
1741			goto out_unlock;
1742		}
1743
1744		if (sinfo_flags & SCTP_EOF) {
1745			pr_debug("%s: shutting down association:%p\n",
1746				 __func__, asoc);
1747
1748			sctp_primitive_SHUTDOWN(net, asoc, NULL);
1749			err = 0;
1750			goto out_unlock;
1751		}
1752		if (sinfo_flags & SCTP_ABORT) {
1753
1754			chunk = sctp_make_abort_user(asoc, msg, msg_len);
1755			if (!chunk) {
1756				err = -ENOMEM;
1757				goto out_unlock;
1758			}
1759
1760			pr_debug("%s: aborting association:%p\n",
1761				 __func__, asoc);
1762
1763			sctp_primitive_ABORT(net, asoc, chunk);
1764			err = 0;
1765			goto out_unlock;
1766		}
1767	}
1768
1769	/* Do we need to create the association?  */
1770	if (!asoc) {
1771		pr_debug("%s: there is no association yet\n", __func__);
1772
1773		if (sinfo_flags & (SCTP_EOF | SCTP_ABORT)) {
1774			err = -EINVAL;
1775			goto out_unlock;
1776		}
1777
1778		/* Check for invalid stream against the stream counts,
1779		 * either the default or the user specified stream counts.
1780		 */
1781		if (sinfo) {
1782			if (!sinit || !sinit->sinit_num_ostreams) {
1783				/* Check against the defaults. */
1784				if (sinfo->sinfo_stream >=
1785				    sp->initmsg.sinit_num_ostreams) {
1786					err = -EINVAL;
1787					goto out_unlock;
1788				}
1789			} else {
1790				/* Check against the requested.  */
1791				if (sinfo->sinfo_stream >=
1792				    sinit->sinit_num_ostreams) {
1793					err = -EINVAL;
1794					goto out_unlock;
1795				}
1796			}
1797		}
1798
1799		/*
1800		 * API 3.1.2 bind() - UDP Style Syntax
1801		 * If a bind() or sctp_bindx() is not called prior to a
1802		 * sendmsg() call that initiates a new association, the
1803		 * system picks an ephemeral port and will choose an address
1804		 * set equivalent to binding with a wildcard address.
1805		 */
1806		if (!ep->base.bind_addr.port) {
1807			if (sctp_autobind(sk)) {
1808				err = -EAGAIN;
1809				goto out_unlock;
1810			}
1811		} else {
1812			/*
1813			 * If an unprivileged user inherits a one-to-many
1814			 * style socket with open associations on a privileged
1815			 * port, it MAY be permitted to accept new associations,
1816			 * but it SHOULD NOT be permitted to open new
1817			 * associations.
1818			 */
1819			if (ep->base.bind_addr.port < PROT_SOCK &&
1820			    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1821				err = -EACCES;
1822				goto out_unlock;
1823			}
1824		}
1825
1826		scope = sctp_scope(&to);
1827		new_asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1828		if (!new_asoc) {
1829			err = -ENOMEM;
1830			goto out_unlock;
1831		}
1832		asoc = new_asoc;
1833		err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
1834		if (err < 0) {
1835			err = -ENOMEM;
1836			goto out_free;
1837		}
1838
1839		/* If the SCTP_INIT ancillary data is specified, set all
1840		 * the association init values accordingly.
1841		 */
1842		if (sinit) {
1843			if (sinit->sinit_num_ostreams) {
1844				asoc->c.sinit_num_ostreams =
1845					sinit->sinit_num_ostreams;
1846			}
1847			if (sinit->sinit_max_instreams) {
1848				asoc->c.sinit_max_instreams =
1849					sinit->sinit_max_instreams;
1850			}
1851			if (sinit->sinit_max_attempts) {
1852				asoc->max_init_attempts
1853					= sinit->sinit_max_attempts;
1854			}
1855			if (sinit->sinit_max_init_timeo) {
1856				asoc->max_init_timeo =
1857				 msecs_to_jiffies(sinit->sinit_max_init_timeo);
1858			}
1859		}
1860
1861		/* Prime the peer's transport structures.  */
1862		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL, SCTP_UNKNOWN);
1863		if (!transport) {
1864			err = -ENOMEM;
1865			goto out_free;
1866		}
1867	}
1868
1869	/* ASSERT: we have a valid association at this point.  */
1870	pr_debug("%s: we have a valid association\n", __func__);
1871
1872	if (!sinfo) {
1873		/* If the user didn't specify SNDINFO/SNDRCVINFO, make up
1874		 * one with some defaults.
1875		 */
1876		memset(&default_sinfo, 0, sizeof(default_sinfo));
1877		default_sinfo.sinfo_stream = asoc->default_stream;
1878		default_sinfo.sinfo_flags = asoc->default_flags;
1879		default_sinfo.sinfo_ppid = asoc->default_ppid;
1880		default_sinfo.sinfo_context = asoc->default_context;
1881		default_sinfo.sinfo_timetolive = asoc->default_timetolive;
1882		default_sinfo.sinfo_assoc_id = sctp_assoc2id(asoc);
1883
1884		sinfo = &default_sinfo;
1885	} else if (fill_sinfo_ttl) {
1886		/* In case SNDINFO was specified, we still need to fill
1887		 * it with a default ttl from the assoc here.
1888		 */
1889		sinfo->sinfo_timetolive = asoc->default_timetolive;
1890	}
1891
1892	/* API 7.1.7, the sndbuf size per association bounds the
1893	 * maximum size of data that can be sent in a single send call.
1894	 */
1895	if (msg_len > sk->sk_sndbuf) {
1896		err = -EMSGSIZE;
1897		goto out_free;
1898	}
1899
1900	if (asoc->pmtu_pending)
1901		sctp_assoc_pending_pmtu(sk, asoc);
1902
1903	/* If fragmentation is disabled and the message length exceeds the
1904	 * association fragmentation point, return EMSGSIZE.  The I-D
1905	 * does not specify what this error is, but this looks like
1906	 * a great fit.
1907	 */
1908	if (sctp_sk(sk)->disable_fragments && (msg_len > asoc->frag_point)) {
1909		err = -EMSGSIZE;
1910		goto out_free;
1911	}
1912
1913	/* Check for invalid stream. */
1914	if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
1915		err = -EINVAL;
1916		goto out_free;
1917	}
1918
1919	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1920	if (!sctp_wspace(asoc)) {
1921		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
1922		if (err)
1923			goto out_free;
1924	}
1925
1926	/* If an address is passed with the sendto/sendmsg call, it is used
1927	 * to override the primary destination address in the TCP model, or
1928	 * when SCTP_ADDR_OVER flag is set in the UDP model.
1929	 */
1930	if ((sctp_style(sk, TCP) && msg_name) ||
1931	    (sinfo_flags & SCTP_ADDR_OVER)) {
1932		chunk_tp = sctp_assoc_lookup_paddr(asoc, &to);
1933		if (!chunk_tp) {
1934			err = -EINVAL;
1935			goto out_free;
1936		}
1937	} else
1938		chunk_tp = NULL;
1939
1940	/* Auto-connect, if we aren't connected already. */
1941	if (sctp_state(asoc, CLOSED)) {
1942		err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1943		if (err < 0)
1944			goto out_free;
1945
1946		pr_debug("%s: we associated primitively\n", __func__);
1947	}
1948
1949	/* Break the message into multiple chunks of maximum size. */
1950	datamsg = sctp_datamsg_from_user(asoc, sinfo, msg, msg_len);
1951	if (IS_ERR(datamsg)) {
1952		err = PTR_ERR(datamsg);
1953		goto out_free;
1954	}
1955
1956	/* Now send the (possibly) fragmented message. */
1957	list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
1958		sctp_chunk_hold(chunk);
1959
1960		/* Do accounting for the write space.  */
1961		sctp_set_owner_w(chunk);
1962
1963		chunk->transport = chunk_tp;
1964	}
1965
1966	/* Send it to the lower layers.  Note:  all chunks
1967	 * must either fail or succeed.   The lower layer
1968	 * works that way today.  Keep it that way or this
1969	 * breaks.
1970	 */
1971	err = sctp_primitive_SEND(net, asoc, datamsg);
1972	/* Did the lower layer accept the chunk? */
1973	if (err) {
1974		sctp_datamsg_free(datamsg);
1975		goto out_free;
1976	}
1977
1978	pr_debug("%s: we sent primitively\n", __func__);
1979
1980	sctp_datamsg_put(datamsg);
1981	err = msg_len;
1982
1983	/* If we are already past ASSOCIATE, the lower
1984	 * layers are responsible for association cleanup.
1985	 */
1986	goto out_unlock;
1987
1988out_free:
1989	if (new_asoc) {
1990		sctp_unhash_established(asoc);
1991		sctp_association_free(asoc);
1992	}
1993out_unlock:
1994	release_sock(sk);
1995
1996out_nounlock:
1997	return sctp_error(sk, msg_flags, err);
1998
1999#if 0
2000do_sock_err:
2001	if (msg_len)
2002		err = msg_len;
2003	else
2004		err = sock_error(sk);
2005	goto out;
2006
2007do_interrupted:
2008	if (msg_len)
2009		err = msg_len;
2010	goto out;
2011#endif /* 0 */
2012}
2013
2014/* This is an extended version of skb_pull() that removes the data from the
2015 * start of a skb even when data is spread across the list of skb's in the
2016 * frag_list. len specifies the total amount of data that needs to be removed.
2017 * when 'len' bytes could be removed from the skb, it returns 0.
2018 * If 'len' exceeds the total skb length,  it returns the no. of bytes that
2019 * could not be removed.
2020 */
2021static int sctp_skb_pull(struct sk_buff *skb, int len)
2022{
2023	struct sk_buff *list;
2024	int skb_len = skb_headlen(skb);
2025	int rlen;
2026
2027	if (len <= skb_len) {
2028		__skb_pull(skb, len);
2029		return 0;
2030	}
2031	len -= skb_len;
2032	__skb_pull(skb, skb_len);
2033
2034	skb_walk_frags(skb, list) {
2035		rlen = sctp_skb_pull(list, len);
2036		skb->len -= (len-rlen);
2037		skb->data_len -= (len-rlen);
2038
2039		if (!rlen)
2040			return 0;
2041
2042		len = rlen;
2043	}
2044
2045	return len;
2046}
2047
2048/* API 3.1.3  recvmsg() - UDP Style Syntax
2049 *
2050 *  ssize_t recvmsg(int socket, struct msghdr *message,
2051 *                    int flags);
2052 *
2053 *  socket  - the socket descriptor of the endpoint.
2054 *  message - pointer to the msghdr structure which contains a single
2055 *            user message and possibly some ancillary data.
2056 *
2057 *            See Section 5 for complete description of the data
2058 *            structures.
2059 *
2060 *  flags   - flags sent or received with the user message, see Section
2061 *            5 for complete description of the flags.
2062 */
2063static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
2064			struct msghdr *msg, size_t len, int noblock,
2065			int flags, int *addr_len)
2066{
2067	struct sctp_ulpevent *event = NULL;
2068	struct sctp_sock *sp = sctp_sk(sk);
2069	struct sk_buff *skb;
2070	int copied;
2071	int err = 0;
2072	int skb_len;
2073
2074	pr_debug("%s: sk:%p, msghdr:%p, len:%zd, noblock:%d, flags:0x%x, "
2075		 "addr_len:%p)\n", __func__, sk, msg, len, noblock, flags,
2076		 addr_len);
2077
2078	lock_sock(sk);
2079
2080	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED)) {
2081		err = -ENOTCONN;
2082		goto out;
2083	}
2084
2085	skb = sctp_skb_recv_datagram(sk, flags, noblock, &err);
2086	if (!skb)
2087		goto out;
2088
2089	/* Get the total length of the skb including any skb's in the
2090	 * frag_list.
2091	 */
2092	skb_len = skb->len;
2093
2094	copied = skb_len;
2095	if (copied > len)
2096		copied = len;
2097
2098	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
2099
2100	event = sctp_skb2event(skb);
2101
2102	if (err)
2103		goto out_free;
2104
2105	sock_recv_ts_and_drops(msg, sk, skb);
2106	if (sctp_ulpevent_is_notification(event)) {
2107		msg->msg_flags |= MSG_NOTIFICATION;
2108		sp->pf->event_msgname(event, msg->msg_name, addr_len);
2109	} else {
2110		sp->pf->skb_msgname(skb, msg->msg_name, addr_len);
2111	}
2112
2113	/* Check if we allow SCTP_NXTINFO. */
2114	if (sp->recvnxtinfo)
2115		sctp_ulpevent_read_nxtinfo(event, msg, sk);
2116	/* Check if we allow SCTP_RCVINFO. */
2117	if (sp->recvrcvinfo)
2118		sctp_ulpevent_read_rcvinfo(event, msg);
2119	/* Check if we allow SCTP_SNDRCVINFO. */
2120	if (sp->subscribe.sctp_data_io_event)
2121		sctp_ulpevent_read_sndrcvinfo(event, msg);
2122
2123#if 0
2124	/* FIXME: we should be calling IP/IPv6 layers.  */
2125	if (sk->sk_protinfo.af_inet.cmsg_flags)
2126		ip_cmsg_recv(msg, skb);
2127#endif
2128
2129	err = copied;
2130
2131	/* If skb's length exceeds the user's buffer, update the skb and
2132	 * push it back to the receive_queue so that the next call to
2133	 * recvmsg() will return the remaining data. Don't set MSG_EOR.
2134	 */
2135	if (skb_len > copied) {
2136		msg->msg_flags &= ~MSG_EOR;
2137		if (flags & MSG_PEEK)
2138			goto out_free;
2139		sctp_skb_pull(skb, copied);
2140		skb_queue_head(&sk->sk_receive_queue, skb);
2141
2142		/* When only partial message is copied to the user, increase
2143		 * rwnd by that amount. If all the data in the skb is read,
2144		 * rwnd is updated when the event is freed.
2145		 */
2146		if (!sctp_ulpevent_is_notification(event))
2147			sctp_assoc_rwnd_increase(event->asoc, copied);
2148		goto out;
2149	} else if ((event->msg_flags & MSG_NOTIFICATION) ||
2150		   (event->msg_flags & MSG_EOR))
2151		msg->msg_flags |= MSG_EOR;
2152	else
2153		msg->msg_flags &= ~MSG_EOR;
2154
2155out_free:
2156	if (flags & MSG_PEEK) {
2157		/* Release the skb reference acquired after peeking the skb in
2158		 * sctp_skb_recv_datagram().
2159		 */
2160		kfree_skb(skb);
2161	} else {
2162		/* Free the event which includes releasing the reference to
2163		 * the owner of the skb, freeing the skb and updating the
2164		 * rwnd.
2165		 */
2166		sctp_ulpevent_free(event);
2167	}
2168out:
2169	release_sock(sk);
2170	return err;
2171}
2172
2173/* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
2174 *
2175 * This option is a on/off flag.  If enabled no SCTP message
2176 * fragmentation will be performed.  Instead if a message being sent
2177 * exceeds the current PMTU size, the message will NOT be sent and
2178 * instead a error will be indicated to the user.
2179 */
2180static int sctp_setsockopt_disable_fragments(struct sock *sk,
2181					     char __user *optval,
2182					     unsigned int optlen)
2183{
2184	int val;
2185
2186	if (optlen < sizeof(int))
2187		return -EINVAL;
2188
2189	if (get_user(val, (int __user *)optval))
2190		return -EFAULT;
2191
2192	sctp_sk(sk)->disable_fragments = (val == 0) ? 0 : 1;
2193
2194	return 0;
2195}
2196
2197static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
2198				  unsigned int optlen)
2199{
2200	struct sctp_association *asoc;
2201	struct sctp_ulpevent *event;
2202
2203	if (optlen > sizeof(struct sctp_event_subscribe))
2204		return -EINVAL;
2205	if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
2206		return -EFAULT;
2207
2208	if (sctp_sk(sk)->subscribe.sctp_data_io_event)
2209		pr_warn_ratelimited(DEPRECATED "%s (pid %d) "
2210				    "Requested SCTP_SNDRCVINFO event.\n"
2211				    "Use SCTP_RCVINFO through SCTP_RECVRCVINFO option instead.\n",
2212				    current->comm, task_pid_nr(current));
2213
2214	/* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
2215	 * if there is no data to be sent or retransmit, the stack will
2216	 * immediately send up this notification.
2217	 */
2218	if (sctp_ulpevent_type_enabled(SCTP_SENDER_DRY_EVENT,
2219				       &sctp_sk(sk)->subscribe)) {
2220		asoc = sctp_id2assoc(sk, 0);
2221
2222		if (asoc && sctp_outq_is_empty(&asoc->outqueue)) {
2223			event = sctp_ulpevent_make_sender_dry_event(asoc,
2224					GFP_ATOMIC);
2225			if (!event)
2226				return -ENOMEM;
2227
2228			sctp_ulpq_tail_event(&asoc->ulpq, event);
2229		}
2230	}
2231
2232	return 0;
2233}
2234
2235/* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
2236 *
2237 * This socket option is applicable to the UDP-style socket only.  When
2238 * set it will cause associations that are idle for more than the
2239 * specified number of seconds to automatically close.  An association
2240 * being idle is defined an association that has NOT sent or received
2241 * user data.  The special value of '0' indicates that no automatic
2242 * close of any associations should be performed.  The option expects an
2243 * integer defining the number of seconds of idle time before an
2244 * association is closed.
2245 */
2246static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
2247				     unsigned int optlen)
2248{
2249	struct sctp_sock *sp = sctp_sk(sk);
2250	struct net *net = sock_net(sk);
2251
2252	/* Applicable to UDP-style socket only */
2253	if (sctp_style(sk, TCP))
2254		return -EOPNOTSUPP;
2255	if (optlen != sizeof(int))
2256		return -EINVAL;
2257	if (copy_from_user(&sp->autoclose, optval, optlen))
2258		return -EFAULT;
2259
2260	if (sp->autoclose > net->sctp.max_autoclose)
2261		sp->autoclose = net->sctp.max_autoclose;
2262
2263	return 0;
2264}
2265
2266/* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
2267 *
2268 * Applications can enable or disable heartbeats for any peer address of
2269 * an association, modify an address's heartbeat interval, force a
2270 * heartbeat to be sent immediately, and adjust the address's maximum
2271 * number of retransmissions sent before an address is considered
2272 * unreachable.  The following structure is used to access and modify an
2273 * address's parameters:
2274 *
2275 *  struct sctp_paddrparams {
2276 *     sctp_assoc_t            spp_assoc_id;
2277 *     struct sockaddr_storage spp_address;
2278 *     uint32_t                spp_hbinterval;
2279 *     uint16_t                spp_pathmaxrxt;
2280 *     uint32_t                spp_pathmtu;
2281 *     uint32_t                spp_sackdelay;
2282 *     uint32_t                spp_flags;
2283 * };
2284 *
2285 *   spp_assoc_id    - (one-to-many style socket) This is filled in the
2286 *                     application, and identifies the association for
2287 *                     this query.
2288 *   spp_address     - This specifies which address is of interest.
2289 *   spp_hbinterval  - This contains the value of the heartbeat interval,
2290 *                     in milliseconds.  If a  value of zero
2291 *                     is present in this field then no changes are to
2292 *                     be made to this parameter.
2293 *   spp_pathmaxrxt  - This contains the maximum number of
2294 *                     retransmissions before this address shall be
2295 *                     considered unreachable. If a  value of zero
2296 *                     is present in this field then no changes are to
2297 *                     be made to this parameter.
2298 *   spp_pathmtu     - When Path MTU discovery is disabled the value
2299 *                     specified here will be the "fixed" path mtu.
2300 *                     Note that if the spp_address field is empty
2301 *                     then all associations on this address will
2302 *                     have this fixed path mtu set upon them.
2303 *
2304 *   spp_sackdelay   - When delayed sack is enabled, this value specifies
2305 *                     the number of milliseconds that sacks will be delayed
2306 *                     for. This value will apply to all addresses of an
2307 *                     association if the spp_address field is empty. Note
2308 *                     also, that if delayed sack is enabled and this
2309 *                     value is set to 0, no change is made to the last
2310 *                     recorded delayed sack timer value.
2311 *
2312 *   spp_flags       - These flags are used to control various features
2313 *                     on an association. The flag field may contain
2314 *                     zero or more of the following options.
2315 *
2316 *                     SPP_HB_ENABLE  - Enable heartbeats on the
2317 *                     specified address. Note that if the address
2318 *                     field is empty all addresses for the association
2319 *                     have heartbeats enabled upon them.
2320 *
2321 *                     SPP_HB_DISABLE - Disable heartbeats on the
2322 *                     speicifed address. Note that if the address
2323 *                     field is empty all addresses for the association
2324 *                     will have their heartbeats disabled. Note also
2325 *                     that SPP_HB_ENABLE and SPP_HB_DISABLE are
2326 *                     mutually exclusive, only one of these two should
2327 *                     be specified. Enabling both fields will have
2328 *                     undetermined results.
2329 *
2330 *                     SPP_HB_DEMAND - Request a user initiated heartbeat
2331 *                     to be made immediately.
2332 *
2333 *                     SPP_HB_TIME_IS_ZERO - Specify's that the time for
2334 *                     heartbeat delayis to be set to the value of 0
2335 *                     milliseconds.
2336 *
2337 *                     SPP_PMTUD_ENABLE - This field will enable PMTU
2338 *                     discovery upon the specified address. Note that
2339 *                     if the address feild is empty then all addresses
2340 *                     on the association are effected.
2341 *
2342 *                     SPP_PMTUD_DISABLE - This field will disable PMTU
2343 *                     discovery upon the specified address. Note that
2344 *                     if the address feild is empty then all addresses
2345 *                     on the association are effected. Not also that
2346 *                     SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
2347 *                     exclusive. Enabling both will have undetermined
2348 *                     results.
2349 *
2350 *                     SPP_SACKDELAY_ENABLE - Setting this flag turns
2351 *                     on delayed sack. The time specified in spp_sackdelay
2352 *                     is used to specify the sack delay for this address. Note
2353 *                     that if spp_address is empty then all addresses will
2354 *                     enable delayed sack and take on the sack delay
2355 *                     value specified in spp_sackdelay.
2356 *                     SPP_SACKDELAY_DISABLE - Setting this flag turns
2357 *                     off delayed sack. If the spp_address field is blank then
2358 *                     delayed sack is disabled for the entire association. Note
2359 *                     also that this field is mutually exclusive to
2360 *                     SPP_SACKDELAY_ENABLE, setting both will have undefined
2361 *                     results.
2362 */
2363static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
2364				       struct sctp_transport   *trans,
2365				       struct sctp_association *asoc,
2366				       struct sctp_sock        *sp,
2367				       int                      hb_change,
2368				       int                      pmtud_change,
2369				       int                      sackdelay_change)
2370{
2371	int error;
2372
2373	if (params->spp_flags & SPP_HB_DEMAND && trans) {
2374		struct net *net = sock_net(trans->asoc->base.sk);
2375
2376		error = sctp_primitive_REQUESTHEARTBEAT(net, trans->asoc, trans);
2377		if (error)
2378			return error;
2379	}
2380
2381	/* Note that unless the spp_flag is set to SPP_HB_ENABLE the value of
2382	 * this field is ignored.  Note also that a value of zero indicates
2383	 * the current setting should be left unchanged.
2384	 */
2385	if (params->spp_flags & SPP_HB_ENABLE) {
2386
2387		/* Re-zero the interval if the SPP_HB_TIME_IS_ZERO is
2388		 * set.  This lets us use 0 value when this flag
2389		 * is set.
2390		 */
2391		if (params->spp_flags & SPP_HB_TIME_IS_ZERO)
2392			params->spp_hbinterval = 0;
2393
2394		if (params->spp_hbinterval ||
2395		    (params->spp_flags & SPP_HB_TIME_IS_ZERO)) {
2396			if (trans) {
2397				trans->hbinterval =
2398				    msecs_to_jiffies(params->spp_hbinterval);
2399			} else if (asoc) {
2400				asoc->hbinterval =
2401				    msecs_to_jiffies(params->spp_hbinterval);
2402			} else {
2403				sp->hbinterval = params->spp_hbinterval;
2404			}
2405		}
2406	}
2407
2408	if (hb_change) {
2409		if (trans) {
2410			trans->param_flags =
2411				(trans->param_flags & ~SPP_HB) | hb_change;
2412		} else if (asoc) {
2413			asoc->param_flags =
2414				(asoc->param_flags & ~SPP_HB) | hb_change;
2415		} else {
2416			sp->param_flags =
2417				(sp->param_flags & ~SPP_HB) | hb_change;
2418		}
2419	}
2420
2421	/* When Path MTU discovery is disabled the value specified here will
2422	 * be the "fixed" path mtu (i.e. the value of the spp_flags field must
2423	 * include the flag SPP_PMTUD_DISABLE for this field to have any
2424	 * effect).
2425	 */
2426	if ((params->spp_flags & SPP_PMTUD_DISABLE) && params->spp_pathmtu) {
2427		if (trans) {
2428			trans->pathmtu = params->spp_pathmtu;
2429			sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
2430		} else if (asoc) {
2431			asoc->pathmtu = params->spp_pathmtu;
2432			sctp_frag_point(asoc, params->spp_pathmtu);
2433		} else {
2434			sp->pathmtu = params->spp_pathmtu;
2435		}
2436	}
2437
2438	if (pmtud_change) {
2439		if (trans) {
2440			int update = (trans->param_flags & SPP_PMTUD_DISABLE) &&
2441				(params->spp_flags & SPP_PMTUD_ENABLE);
2442			trans->param_flags =
2443				(trans->param_flags & ~SPP_PMTUD) | pmtud_change;
2444			if (update) {
2445				sctp_transport_pmtu(trans, sctp_opt2sk(sp));
2446				sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
2447			}
2448		} else if (asoc) {
2449			asoc->param_flags =
2450				(asoc->param_flags & ~SPP_PMTUD) | pmtud_change;
2451		} else {
2452			sp->param_flags =
2453				(sp->param_flags & ~SPP_PMTUD) | pmtud_change;
2454		}
2455	}
2456
2457	/* Note that unless the spp_flag is set to SPP_SACKDELAY_ENABLE the
2458	 * value of this field is ignored.  Note also that a value of zero
2459	 * indicates the current setting should be left unchanged.
2460	 */
2461	if ((params->spp_flags & SPP_SACKDELAY_ENABLE) && params->spp_sackdelay) {
2462		if (trans) {
2463			trans->sackdelay =
2464				msecs_to_jiffies(params->spp_sackdelay);
2465		} else if (asoc) {
2466			asoc->sackdelay =
2467				msecs_to_jiffies(params->spp_sackdelay);
2468		} else {
2469			sp->sackdelay = params->spp_sackdelay;
2470		}
2471	}
2472
2473	if (sackdelay_change) {
2474		if (trans) {
2475			trans->param_flags =
2476				(trans->param_flags & ~SPP_SACKDELAY) |
2477				sackdelay_change;
2478		} else if (asoc) {
2479			asoc->param_flags =
2480				(asoc->param_flags & ~SPP_SACKDELAY) |
2481				sackdelay_change;
2482		} else {
2483			sp->param_flags =
2484				(sp->param_flags & ~SPP_SACKDELAY) |
2485				sackdelay_change;
2486		}
2487	}
2488
2489	/* Note that a value of zero indicates the current setting should be
2490	   left unchanged.
2491	 */
2492	if (params->spp_pathmaxrxt) {
2493		if (trans) {
2494			trans->pathmaxrxt = params->spp_pathmaxrxt;
2495		} else if (asoc) {
2496			asoc->pathmaxrxt = params->spp_pathmaxrxt;
2497		} else {
2498			sp->pathmaxrxt = params->spp_pathmaxrxt;
2499		}
2500	}
2501
2502	return 0;
2503}
2504
2505static int sctp_setsockopt_peer_addr_params(struct sock *sk,
2506					    char __user *optval,
2507					    unsigned int optlen)
2508{
2509	struct sctp_paddrparams  params;
2510	struct sctp_transport   *trans = NULL;
2511	struct sctp_association *asoc = NULL;
2512	struct sctp_sock        *sp = sctp_sk(sk);
2513	int error;
2514	int hb_change, pmtud_change, sackdelay_change;
2515
2516	if (optlen != sizeof(struct sctp_paddrparams))
2517		return -EINVAL;
2518
2519	if (copy_from_user(&params, optval, optlen))
2520		return -EFAULT;
2521
2522	/* Validate flags and value parameters. */
2523	hb_change        = params.spp_flags & SPP_HB;
2524	pmtud_change     = params.spp_flags & SPP_PMTUD;
2525	sackdelay_change = params.spp_flags & SPP_SACKDELAY;
2526
2527	if (hb_change        == SPP_HB ||
2528	    pmtud_change     == SPP_PMTUD ||
2529	    sackdelay_change == SPP_SACKDELAY ||
2530	    params.spp_sackdelay > 500 ||
2531	    (params.spp_pathmtu &&
2532	     params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
2533		return -EINVAL;
2534
2535	/* If an address other than INADDR_ANY is specified, and
2536	 * no transport is found, then the request is invalid.
2537	 */
2538	if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
2539		trans = sctp_addr_id2transport(sk, &params.spp_address,
2540					       params.spp_assoc_id);
2541		if (!trans)
2542			return -EINVAL;
2543	}
2544
2545	/* Get association, if assoc_id != 0 and the socket is a one
2546	 * to many style socket, and an association was not found, then
2547	 * the id was invalid.
2548	 */
2549	asoc = sctp_id2assoc(sk, params.spp_assoc_id);
2550	if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP))
2551		return -EINVAL;
2552
2553	/* Heartbeat demand can only be sent on a transport or
2554	 * association, but not a socket.
2555	 */
2556	if (params.spp_flags & SPP_HB_DEMAND && !trans && !asoc)
2557		return -EINVAL;
2558
2559	/* Process parameters. */
2560	error = sctp_apply_peer_addr_params(&params, trans, asoc, sp,
2561					    hb_change, pmtud_change,
2562					    sackdelay_change);
2563
2564	if (error)
2565		return error;
2566
2567	/* If changes are for association, also apply parameters to each
2568	 * transport.
2569	 */
2570	if (!trans && asoc) {
2571		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2572				transports) {
2573			sctp_apply_peer_addr_params(&params, trans, asoc, sp,
2574						    hb_change, pmtud_change,
2575						    sackdelay_change);
2576		}
2577	}
2578
2579	return 0;
2580}
2581
2582static inline __u32 sctp_spp_sackdelay_enable(__u32 param_flags)
2583{
2584	return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_ENABLE;
2585}
2586
2587static inline __u32 sctp_spp_sackdelay_disable(__u32 param_flags)
2588{
2589	return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_DISABLE;
2590}
2591
2592/*
2593 * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
2594 *
2595 * This option will effect the way delayed acks are performed.  This
2596 * option allows you to get or set the delayed ack time, in
2597 * milliseconds.  It also allows changing the delayed ack frequency.
2598 * Changing the frequency to 1 disables the delayed sack algorithm.  If
2599 * the assoc_id is 0, then this sets or gets the endpoints default
2600 * values.  If the assoc_id field is non-zero, then the set or get
2601 * effects the specified association for the one to many model (the
2602 * assoc_id field is ignored by the one to one model).  Note that if
2603 * sack_delay or sack_freq are 0 when setting this option, then the
2604 * current values will remain unchanged.
2605 *
2606 * struct sctp_sack_info {
2607 *     sctp_assoc_t            sack_assoc_id;
2608 *     uint32_t                sack_delay;
2609 *     uint32_t                sack_freq;
2610 * };
2611 *
2612 * sack_assoc_id -  This parameter, indicates which association the user
2613 *    is performing an action upon.  Note that if this field's value is
2614 *    zero then the endpoints default value is changed (effecting future
2615 *    associations only).
2616 *
2617 * sack_delay -  This parameter contains the number of milliseconds that
2618 *    the user is requesting the delayed ACK timer be set to.  Note that
2619 *    this value is defined in the standard to be between 200 and 500
2620 *    milliseconds.
2621 *
2622 * sack_freq -  This parameter contains the number of packets that must
2623 *    be received before a sack is sent without waiting for the delay
2624 *    timer to expire.  The default value for this is 2, setting this
2625 *    value to 1 will disable the delayed sack algorithm.
2626 */
2627
2628static int sctp_setsockopt_delayed_ack(struct sock *sk,
2629				       char __user *optval, unsigned int optlen)
2630{
2631	struct sctp_sack_info    params;
2632	struct sctp_transport   *trans = NULL;
2633	struct sctp_association *asoc = NULL;
2634	struct sctp_sock        *sp = sctp_sk(sk);
2635
2636	if (optlen == sizeof(struct sctp_sack_info)) {
2637		if (copy_from_user(&params, optval, optlen))
2638			return -EFAULT;
2639
2640		if (params.sack_delay == 0 && params.sack_freq == 0)
2641			return 0;
2642	} else if (optlen == sizeof(struct sctp_assoc_value)) {
2643		pr_warn_ratelimited(DEPRECATED
2644				    "%s (pid %d) "
2645				    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
2646				    "Use struct sctp_sack_info instead\n",
2647				    current->comm, task_pid_nr(current));
2648		if (copy_from_user(&params, optval, optlen))
2649			return -EFAULT;
2650
2651		if (params.sack_delay == 0)
2652			params.sack_freq = 1;
2653		else
2654			params.sack_freq = 0;
2655	} else
2656		return -EINVAL;
2657
2658	/* Validate value parameter. */
2659	if (params.sack_delay > 500)
2660		return -EINVAL;
2661
2662	/* Get association, if sack_assoc_id != 0 and the socket is a one
2663	 * to many style socket, and an association was not found, then
2664	 * the id was invalid.
2665	 */
2666	asoc = sctp_id2assoc(sk, params.sack_assoc_id);
2667	if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
2668		return -EINVAL;
2669
2670	if (params.sack_delay) {
2671		if (asoc) {
2672			asoc->sackdelay =
2673				msecs_to_jiffies(params.sack_delay);
2674			asoc->param_flags =
2675				sctp_spp_sackdelay_enable(asoc->param_flags);
2676		} else {
2677			sp->sackdelay = params.sack_delay;
2678			sp->param_flags =
2679				sctp_spp_sackdelay_enable(sp->param_flags);
2680		}
2681	}
2682
2683	if (params.sack_freq == 1) {
2684		if (asoc) {
2685			asoc->param_flags =
2686				sctp_spp_sackdelay_disable(asoc->param_flags);
2687		} else {
2688			sp->param_flags =
2689				sctp_spp_sackdelay_disable(sp->param_flags);
2690		}
2691	} else if (params.sack_freq > 1) {
2692		if (asoc) {
2693			asoc->sackfreq = params.sack_freq;
2694			asoc->param_flags =
2695				sctp_spp_sackdelay_enable(asoc->param_flags);
2696		} else {
2697			sp->sackfreq = params.sack_freq;
2698			sp->param_flags =
2699				sctp_spp_sackdelay_enable(sp->param_flags);
2700		}
2701	}
2702
2703	/* If change is for association, also apply to each transport. */
2704	if (asoc) {
2705		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2706				transports) {
2707			if (params.sack_delay) {
2708				trans->sackdelay =
2709					msecs_to_jiffies(params.sack_delay);
2710				trans->param_flags =
2711					sctp_spp_sackdelay_enable(trans->param_flags);
2712			}
2713			if (params.sack_freq == 1) {
2714				trans->param_flags =
2715					sctp_spp_sackdelay_disable(trans->param_flags);
2716			} else if (params.sack_freq > 1) {
2717				trans->sackfreq = params.sack_freq;
2718				trans->param_flags =
2719					sctp_spp_sackdelay_enable(trans->param_flags);
2720			}
2721		}
2722	}
2723
2724	return 0;
2725}
2726
2727/* 7.1.3 Initialization Parameters (SCTP_INITMSG)
2728 *
2729 * Applications can specify protocol parameters for the default association
2730 * initialization.  The option name argument to setsockopt() and getsockopt()
2731 * is SCTP_INITMSG.
2732 *
2733 * Setting initialization parameters is effective only on an unconnected
2734 * socket (for UDP-style sockets only future associations are effected
2735 * by the change).  With TCP-style sockets, this option is inherited by
2736 * sockets derived from a listener socket.
2737 */
2738static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, unsigned int optlen)
2739{
2740	struct sctp_initmsg sinit;
2741	struct sctp_sock *sp = sctp_sk(sk);
2742
2743	if (optlen != sizeof(struct sctp_initmsg))
2744		return -EINVAL;
2745	if (copy_from_user(&sinit, optval, optlen))
2746		return -EFAULT;
2747
2748	if (sinit.sinit_num_ostreams)
2749		sp->initmsg.sinit_num_ostreams = sinit.sinit_num_ostreams;
2750	if (sinit.sinit_max_instreams)
2751		sp->initmsg.sinit_max_instreams = sinit.sinit_max_instreams;
2752	if (sinit.sinit_max_attempts)
2753		sp->initmsg.sinit_max_attempts = sinit.sinit_max_attempts;
2754	if (sinit.sinit_max_init_timeo)
2755		sp->initmsg.sinit_max_init_timeo = sinit.sinit_max_init_timeo;
2756
2757	return 0;
2758}
2759
2760/*
2761 * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
2762 *
2763 *   Applications that wish to use the sendto() system call may wish to
2764 *   specify a default set of parameters that would normally be supplied
2765 *   through the inclusion of ancillary data.  This socket option allows
2766 *   such an application to set the default sctp_sndrcvinfo structure.
2767 *   The application that wishes to use this socket option simply passes
2768 *   in to this call the sctp_sndrcvinfo structure defined in Section
2769 *   5.2.2) The input parameters accepted by this call include
2770 *   sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
2771 *   sinfo_timetolive.  The user must provide the sinfo_assoc_id field in
2772 *   to this call if the caller is using the UDP model.
2773 */
2774static int sctp_setsockopt_default_send_param(struct sock *sk,
2775					      char __user *optval,
2776					      unsigned int optlen)
2777{
2778	struct sctp_sock *sp = sctp_sk(sk);
2779	struct sctp_association *asoc;
2780	struct sctp_sndrcvinfo info;
2781
2782	if (optlen != sizeof(info))
2783		return -EINVAL;
2784	if (copy_from_user(&info, optval, optlen))
2785		return -EFAULT;
2786	if (info.sinfo_flags &
2787	    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2788	      SCTP_ABORT | SCTP_EOF))
2789		return -EINVAL;
2790
2791	asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
2792	if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
2793		return -EINVAL;
2794	if (asoc) {
2795		asoc->default_stream = info.sinfo_stream;
2796		asoc->default_flags = info.sinfo_flags;
2797		asoc->default_ppid = info.sinfo_ppid;
2798		asoc->default_context = info.sinfo_context;
2799		asoc->default_timetolive = info.sinfo_timetolive;
2800	} else {
2801		sp->default_stream = info.sinfo_stream;
2802		sp->default_flags = info.sinfo_flags;
2803		sp->default_ppid = info.sinfo_ppid;
2804		sp->default_context = info.sinfo_context;
2805		sp->default_timetolive = info.sinfo_timetolive;
2806	}
2807
2808	return 0;
2809}
2810
2811/* RFC6458, Section 8.1.31. Set/get Default Send Parameters
2812 * (SCTP_DEFAULT_SNDINFO)
2813 */
2814static int sctp_setsockopt_default_sndinfo(struct sock *sk,
2815					   char __user *optval,
2816					   unsigned int optlen)
2817{
2818	struct sctp_sock *sp = sctp_sk(sk);
2819	struct sctp_association *asoc;
2820	struct sctp_sndinfo info;
2821
2822	if (optlen != sizeof(info))
2823		return -EINVAL;
2824	if (copy_from_user(&info, optval, optlen))
2825		return -EFAULT;
2826	if (info.snd_flags &
2827	    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2828	      SCTP_ABORT | SCTP_EOF))
2829		return -EINVAL;
2830
2831	asoc = sctp_id2assoc(sk, info.snd_assoc_id);
2832	if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
2833		return -EINVAL;
2834	if (asoc) {
2835		asoc->default_stream = info.snd_sid;
2836		asoc->default_flags = info.snd_flags;
2837		asoc->default_ppid = info.snd_ppid;
2838		asoc->default_context = info.snd_context;
2839	} else {
2840		sp->default_stream = info.snd_sid;
2841		sp->default_flags = info.snd_flags;
2842		sp->default_ppid = info.snd_ppid;
2843		sp->default_context = info.snd_context;
2844	}
2845
2846	return 0;
2847}
2848
2849/* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
2850 *
2851 * Requests that the local SCTP stack use the enclosed peer address as
2852 * the association primary.  The enclosed address must be one of the
2853 * association peer's addresses.
2854 */
2855static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
2856					unsigned int optlen)
2857{
2858	struct sctp_prim prim;
2859	struct sctp_transport *trans;
2860
2861	if (optlen != sizeof(struct sctp_prim))
2862		return -EINVAL;
2863
2864	if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
2865		return -EFAULT;
2866
2867	trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
2868	if (!trans)
2869		return -EINVAL;
2870
2871	sctp_assoc_set_primary(trans->asoc, trans);
2872
2873	return 0;
2874}
2875
2876/*
2877 * 7.1.5 SCTP_NODELAY
2878 *
2879 * Turn on/off any Nagle-like algorithm.  This means that packets are
2880 * generally sent as soon as possible and no unnecessary delays are
2881 * introduced, at the cost of more packets in the network.  Expects an
2882 *  integer boolean flag.
2883 */
2884static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval,
2885				   unsigned int optlen)
2886{
2887	int val;
2888
2889	if (optlen < sizeof(int))
2890		return -EINVAL;
2891	if (get_user(val, (int __user *)optval))
2892		return -EFAULT;
2893
2894	sctp_sk(sk)->nodelay = (val == 0) ? 0 : 1;
2895	return 0;
2896}
2897
2898/*
2899 *
2900 * 7.1.1 SCTP_RTOINFO
2901 *
2902 * The protocol parameters used to initialize and bound retransmission
2903 * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
2904 * and modify these parameters.
2905 * All parameters are time values, in milliseconds.  A value of 0, when
2906 * modifying the parameters, indicates that the current value should not
2907 * be changed.
2908 *
2909 */
2910static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigned int optlen)
2911{
2912	struct sctp_rtoinfo rtoinfo;
2913	struct sctp_association *asoc;
2914	unsigned long rto_min, rto_max;
2915	struct sctp_sock *sp = sctp_sk(sk);
2916
2917	if (optlen != sizeof (struct sctp_rtoinfo))
2918		return -EINVAL;
2919
2920	if (copy_from_user(&rtoinfo, optval, optlen))
2921		return -EFAULT;
2922
2923	asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
2924
2925	/* Set the values to the specific association */
2926	if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
2927		return -EINVAL;
2928
2929	rto_max = rtoinfo.srto_max;
2930	rto_min = rtoinfo.srto_min;
2931
2932	if (rto_max)
2933		rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
2934	else
2935		rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
2936
2937	if (rto_min)
2938		rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
2939	else
2940		rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
2941
2942	if (rto_min > rto_max)
2943		return -EINVAL;
2944
2945	if (asoc) {
2946		if (rtoinfo.srto_initial != 0)
2947			asoc->rto_initial =
2948				msecs_to_jiffies(rtoinfo.srto_initial);
2949		asoc->rto_max = rto_max;
2950		asoc->rto_min = rto_min;
2951	} else {
2952		/* If there is no association or the association-id = 0
2953		 * set the values to the endpoint.
2954		 */
2955		if (rtoinfo.srto_initial != 0)
2956			sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
2957		sp->rtoinfo.srto_max = rto_max;
2958		sp->rtoinfo.srto_min = rto_min;
2959	}
2960
2961	return 0;
2962}
2963
2964/*
2965 *
2966 * 7.1.2 SCTP_ASSOCINFO
2967 *
2968 * This option is used to tune the maximum retransmission attempts
2969 * of the association.
2970 * Returns an error if the new association retransmission value is
2971 * greater than the sum of the retransmission value  of the peer.
2972 * See [SCTP] for more information.
2973 *
2974 */
2975static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, unsigned int optlen)
2976{
2977
2978	struct sctp_assocparams assocparams;
2979	struct sctp_association *asoc;
2980
2981	if (optlen != sizeof(struct sctp_assocparams))
2982		return -EINVAL;
2983	if (copy_from_user(&assocparams, optval, optlen))
2984		return -EFAULT;
2985
2986	asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
2987
2988	if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
2989		return -EINVAL;
2990
2991	/* Set the values to the specific association */
2992	if (asoc) {
2993		if (assocparams.sasoc_asocmaxrxt != 0) {
2994			__u32 path_sum = 0;
2995			int   paths = 0;
2996			struct sctp_transport *peer_addr;
2997
2998			list_for_each_entry(peer_addr, &asoc->peer.transport_addr_list,
2999					transports) {
3000				path_sum += peer_addr->pathmaxrxt;
3001				paths++;
3002			}
3003
3004			/* Only validate asocmaxrxt if we have more than
3005			 * one path/transport.  We do this because path
3006			 * retransmissions are only counted when we have more
3007			 * then one path.
3008			 */
3009			if (paths > 1 &&
3010			    assocparams.sasoc_asocmaxrxt > path_sum)
3011				return -EINVAL;
3012
3013			asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
3014		}
3015
3016		if (assocparams.sasoc_cookie_life != 0)
3017			asoc->cookie_life = ms_to_ktime(assocparams.sasoc_cookie_life);
3018	} else {
3019		/* Set the values to the endpoint */
3020		struct sctp_sock *sp = sctp_sk(sk);
3021
3022		if (assocparams.sasoc_asocmaxrxt != 0)
3023			sp->assocparams.sasoc_asocmaxrxt =
3024						assocparams.sasoc_asocmaxrxt;
3025		if (assocparams.sasoc_cookie_life != 0)
3026			sp->assocparams.sasoc_cookie_life =
3027						assocparams.sasoc_cookie_life;
3028	}
3029	return 0;
3030}
3031
3032/*
3033 * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
3034 *
3035 * This socket option is a boolean flag which turns on or off mapped V4
3036 * addresses.  If this option is turned on and the socket is type
3037 * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
3038 * If this option is turned off, then no mapping will be done of V4
3039 * addresses and a user will receive both PF_INET6 and PF_INET type
3040 * addresses on the socket.
3041 */
3042static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsigned int optlen)
3043{
3044	int val;
3045	struct sctp_sock *sp = sctp_sk(sk);
3046
3047	if (optlen < sizeof(int))
3048		return -EINVAL;
3049	if (get_user(val, (int __user *)optval))
3050		return -EFAULT;
3051	if (val)
3052		sp->v4mapped = 1;
3053	else
3054		sp->v4mapped = 0;
3055
3056	return 0;
3057}
3058
3059/*
3060 * 8.1.16.  Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
3061 * This option will get or set the maximum size to put in any outgoing
3062 * SCTP DATA chunk.  If a message is larger than this size it will be
3063 * fragmented by SCTP into the specified size.  Note that the underlying
3064 * SCTP implementation may fragment into smaller sized chunks when the
3065 * PMTU of the underlying association is smaller than the value set by
3066 * the user.  The default value for this option is '0' which indicates
3067 * the user is NOT limiting fragmentation and only the PMTU will effect
3068 * SCTP's choice of DATA chunk size.  Note also that values set larger
3069 * than the maximum size of an IP datagram will effectively let SCTP
3070 * control fragmentation (i.e. the same as setting this option to 0).
3071 *
3072 * The following structure is used to access and modify this parameter:
3073 *
3074 * struct sctp_assoc_value {
3075 *   sctp_assoc_t assoc_id;
3076 *   uint32_t assoc_value;
3077 * };
3078 *
3079 * assoc_id:  This parameter is ignored for one-to-one style sockets.
3080 *    For one-to-many style sockets this parameter indicates which
3081 *    association the user is performing an action upon.  Note that if
3082 *    this field's value is zero then the endpoints default value is
3083 *    changed (effecting future associations only).
3084 * assoc_value:  This parameter specifies the maximum size in bytes.
3085 */
3086static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
3087{
3088	struct sctp_assoc_value params;
3089	struct sctp_association *asoc;
3090	struct sctp_sock *sp = sctp_sk(sk);
3091	int val;
3092
3093	if (optlen == sizeof(int)) {
3094		pr_warn_ratelimited(DEPRECATED
3095				    "%s (pid %d) "
3096				    "Use of int in maxseg socket option.\n"
3097				    "Use struct sctp_assoc_value instead\n",
3098				    current->comm, task_pid_nr(current));
3099		if (copy_from_user(&val, optval, optlen))
3100			return -EFAULT;
3101		params.assoc_id = 0;
3102	} else if (optlen == sizeof(struct sctp_assoc_value)) {
3103		if (copy_from_user(&params, optval, optlen))
3104			return -EFAULT;
3105		val = params.assoc_value;
3106	} else
3107		return -EINVAL;
3108
3109	if ((val != 0) && ((val < 8) || (val > SCTP_MAX_CHUNK_LEN)))
3110		return -EINVAL;
3111
3112	asoc = sctp_id2assoc(sk, params.assoc_id);
3113	if (!asoc && params.assoc_id && sctp_style(sk, UDP))
3114		return -EINVAL;
3115
3116	if (asoc) {
3117		if (val == 0) {
3118			val = asoc->pathmtu;
3119			val -= sp->pf->af->net_header_len;
3120			val -= sizeof(struct sctphdr) +
3121					sizeof(struct sctp_data_chunk);
3122		}
3123		asoc->user_frag = val;
3124		asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
3125	} else {
3126		sp->user_frag = val;
3127	}
3128
3129	return 0;
3130}
3131
3132
3133/*
3134 *  7.1.9 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
3135 *
3136 *   Requests that the peer mark the enclosed address as the association
3137 *   primary. The enclosed address must be one of the association's
3138 *   locally bound addresses. The following structure is used to make a
3139 *   set primary request:
3140 */
3141static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optval,
3142					     unsigned int optlen)
3143{
3144	struct net *net = sock_net(sk);
3145	struct sctp_sock	*sp;
3146	struct sctp_association	*asoc = NULL;
3147	struct sctp_setpeerprim	prim;
3148	struct sctp_chunk	*chunk;
3149	struct sctp_af		*af;
3150	int 			err;
3151
3152	sp = sctp_sk(sk);
3153
3154	if (!net->sctp.addip_enable)
3155		return -EPERM;
3156
3157	if (optlen != sizeof(struct sctp_setpeerprim))
3158		return -EINVAL;
3159
3160	if (copy_from_user(&prim, optval, optlen))
3161		return -EFAULT;
3162
3163	asoc = sctp_id2assoc(sk, prim.sspp_assoc_id);
3164	if (!asoc)
3165		return -EINVAL;
3166
3167	if (!asoc->peer.asconf_capable)
3168		return -EPERM;
3169
3170	if (asoc->peer.addip_disabled_mask & SCTP_PARAM_SET_PRIMARY)
3171		return -EPERM;
3172
3173	if (!sctp_state(asoc, ESTABLISHED))
3174		return -ENOTCONN;
3175
3176	af = sctp_get_af_specific(prim.sspp_addr.ss_family);
3177	if (!af)
3178		return -EINVAL;
3179
3180	if (!af->addr_valid((union sctp_addr *)&prim.sspp_addr, sp, NULL))
3181		return -EADDRNOTAVAIL;
3182
3183	if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
3184		return -EADDRNOTAVAIL;
3185
3186	/* Create an ASCONF chunk with SET_PRIMARY parameter	*/
3187	chunk = sctp_make_asconf_set_prim(asoc,
3188					  (union sctp_addr *)&prim.sspp_addr);
3189	if (!chunk)
3190		return -ENOMEM;
3191
3192	err = sctp_send_asconf(asoc, chunk);
3193
3194	pr_debug("%s: we set peer primary addr primitively\n", __func__);
3195
3196	return err;
3197}
3198
3199static int sctp_setsockopt_adaptation_layer(struct sock *sk, char __user *optval,
3200					    unsigned int optlen)
3201{
3202	struct sctp_setadaptation adaptation;
3203
3204	if (optlen != sizeof(struct sctp_setadaptation))
3205		return -EINVAL;
3206	if (copy_from_user(&adaptation, optval, optlen))
3207		return -EFAULT;
3208
3209	sctp_sk(sk)->adaptation_ind = adaptation.ssb_adaptation_ind;
3210
3211	return 0;
3212}
3213
3214/*
3215 * 7.1.29.  Set or Get the default context (SCTP_CONTEXT)
3216 *
3217 * The context field in the sctp_sndrcvinfo structure is normally only
3218 * used when a failed message is retrieved holding the value that was
3219 * sent down on the actual send call.  This option allows the setting of
3220 * a default context on an association basis that will be received on
3221 * reading messages from the peer.  This is especially helpful in the
3222 * one-2-many model for an application to keep some reference to an
3223 * internal state machine that is processing messages on the
3224 * association.  Note that the setting of this value only effects
3225 * received messages from the peer and does not effect the value that is
3226 * saved with outbound messages.
3227 */
3228static int sctp_setsockopt_context(struct sock *sk, char __user *optval,
3229				   unsigned int optlen)
3230{
3231	struct sctp_assoc_value params;
3232	struct sctp_sock *sp;
3233	struct sctp_association *asoc;
3234
3235	if (optlen != sizeof(struct sctp_assoc_value))
3236		return -EINVAL;
3237	if (copy_from_user(&params, optval, optlen))
3238		return -EFAULT;
3239
3240	sp = sctp_sk(sk);
3241
3242	if (params.assoc_id != 0) {
3243		asoc = sctp_id2assoc(sk, params.assoc_id);
3244		if (!asoc)
3245			return -EINVAL;
3246		asoc->default_rcv_context = params.assoc_value;
3247	} else {
3248		sp->default_rcv_context = params.assoc_value;
3249	}
3250
3251	return 0;
3252}
3253
3254/*
3255 * 7.1.24.  Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
3256 *
3257 * This options will at a minimum specify if the implementation is doing
3258 * fragmented interleave.  Fragmented interleave, for a one to many
3259 * socket, is when subsequent calls to receive a message may return
3260 * parts of messages from different associations.  Some implementations
3261 * may allow you to turn this value on or off.  If so, when turned off,
3262 * no fragment interleave will occur (which will cause a head of line
3263 * blocking amongst multiple associations sharing the same one to many
3264 * socket).  When this option is turned on, then each receive call may
3265 * come from a different association (thus the user must receive data
3266 * with the extended calls (e.g. sctp_recvmsg) to keep track of which
3267 * association each receive belongs to.
3268 *
3269 * This option takes a boolean value.  A non-zero value indicates that
3270 * fragmented interleave is on.  A value of zero indicates that
3271 * fragmented interleave is off.
3272 *
3273 * Note that it is important that an implementation that allows this
3274 * option to be turned on, have it off by default.  Otherwise an unaware
3275 * application using the one to many model may become confused and act
3276 * incorrectly.
3277 */
3278static int sctp_setsockopt_fragment_interleave(struct sock *sk,
3279					       char __user *optval,
3280					       unsigned int optlen)
3281{
3282	int val;
3283
3284	if (optlen != sizeof(int))
3285		return -EINVAL;
3286	if (get_user(val, (int __user *)optval))
3287		return -EFAULT;
3288
3289	sctp_sk(sk)->frag_interleave = (val == 0) ? 0 : 1;
3290
3291	return 0;
3292}
3293
3294/*
3295 * 8.1.21.  Set or Get the SCTP Partial Delivery Point
3296 *       (SCTP_PARTIAL_DELIVERY_POINT)
3297 *
3298 * This option will set or get the SCTP partial delivery point.  This
3299 * point is the size of a message where the partial delivery API will be
3300 * invoked to help free up rwnd space for the peer.  Setting this to a
3301 * lower value will cause partial deliveries to happen more often.  The
3302 * calls argument is an integer that sets or gets the partial delivery
3303 * point.  Note also that the call will fail if the user attempts to set
3304 * this value larger than the socket receive buffer size.
3305 *
3306 * Note that any single message having a length smaller than or equal to
3307 * the SCTP partial delivery point will be delivered in one single read
3308 * call as long as the user provided buffer is large enough to hold the
3309 * message.
3310 */
3311static int sctp_setsockopt_partial_delivery_point(struct sock *sk,
3312						  char __user *optval,
3313						  unsigned int optlen)
3314{
3315	u32 val;
3316
3317	if (optlen != sizeof(u32))
3318		return -EINVAL;
3319	if (get_user(val, (int __user *)optval))
3320		return -EFAULT;
3321
3322	/* Note: We double the receive buffer from what the user sets
3323	 * it to be, also initial rwnd is based on rcvbuf/2.
3324	 */
3325	if (val > (sk->sk_rcvbuf >> 1))
3326		return -EINVAL;
3327
3328	sctp_sk(sk)->pd_point = val;
3329
3330	return 0; /* is this the right error code? */
3331}
3332
3333/*
3334 * 7.1.28.  Set or Get the maximum burst (SCTP_MAX_BURST)
3335 *
3336 * This option will allow a user to change the maximum burst of packets
3337 * that can be emitted by this association.  Note that the default value
3338 * is 4, and some implementations may restrict this setting so that it
3339 * can only be lowered.
3340 *
3341 * NOTE: This text doesn't seem right.  Do this on a socket basis with
3342 * future associations inheriting the socket value.
3343 */
3344static int sctp_setsockopt_maxburst(struct sock *sk,
3345				    char __user *optval,
3346				    unsigned int optlen)
3347{
3348	struct sctp_assoc_value params;
3349	struct sctp_sock *sp;
3350	struct sctp_association *asoc;
3351	int val;
3352	int assoc_id = 0;
3353
3354	if (optlen == sizeof(int)) {
3355		pr_warn_ratelimited(DEPRECATED
3356				    "%s (pid %d) "
3357				    "Use of int in max_burst socket option deprecated.\n"
3358				    "Use struct sctp_assoc_value instead\n",
3359				    current->comm, task_pid_nr(current));
3360		if (copy_from_user(&val, optval, optlen))
3361			return -EFAULT;
3362	} else if (optlen == sizeof(struct sctp_assoc_value)) {
3363		if (copy_from_user(&params, optval, optlen))
3364			return -EFAULT;
3365		val = params.assoc_value;
3366		assoc_id = params.assoc_id;
3367	} else
3368		return -EINVAL;
3369
3370	sp = sctp_sk(sk);
3371
3372	if (assoc_id != 0) {
3373		asoc = sctp_id2assoc(sk, assoc_id);
3374		if (!asoc)
3375			return -EINVAL;
3376		asoc->max_burst = val;
3377	} else
3378		sp->max_burst = val;
3379
3380	return 0;
3381}
3382
3383/*
3384 * 7.1.18.  Add a chunk that must be authenticated (SCTP_AUTH_CHUNK)
3385 *
3386 * This set option adds a chunk type that the user is requesting to be
3387 * received only in an authenticated way.  Changes to the list of chunks
3388 * will only effect future associations on the socket.
3389 */
3390static int sctp_setsockopt_auth_chunk(struct sock *sk,
3391				      char __user *optval,
3392				      unsigned int optlen)
3393{
3394	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3395	struct sctp_authchunk val;
3396
3397	if (!ep->auth_enable)
3398		return -EACCES;
3399
3400	if (optlen != sizeof(struct sctp_authchunk))
3401		return -EINVAL;
3402	if (copy_from_user(&val, optval, optlen))
3403		return -EFAULT;
3404
3405	switch (val.sauth_chunk) {
3406	case SCTP_CID_INIT:
3407	case SCTP_CID_INIT_ACK:
3408	case SCTP_CID_SHUTDOWN_COMPLETE:
3409	case SCTP_CID_AUTH:
3410		return -EINVAL;
3411	}
3412
3413	/* add this chunk id to the endpoint */
3414	return sctp_auth_ep_add_chunkid(ep, val.sauth_chunk);
3415}
3416
3417/*
3418 * 7.1.19.  Get or set the list of supported HMAC Identifiers (SCTP_HMAC_IDENT)
3419 *
3420 * This option gets or sets the list of HMAC algorithms that the local
3421 * endpoint requires the peer to use.
3422 */
3423static int sctp_setsockopt_hmac_ident(struct sock *sk,
3424				      char __user *optval,
3425				      unsigned int optlen)
3426{
3427	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3428	struct sctp_hmacalgo *hmacs;
3429	u32 idents;
3430	int err;
3431
3432	if (!ep->auth_enable)
3433		return -EACCES;
3434
3435	if (optlen < sizeof(struct sctp_hmacalgo))
3436		return -EINVAL;
3437
3438	hmacs = memdup_user(optval, optlen);
3439	if (IS_ERR(hmacs))
3440		return PTR_ERR(hmacs);
3441
3442	idents = hmacs->shmac_num_idents;
3443	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
3444	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
3445		err = -EINVAL;
3446		goto out;
3447	}
3448
3449	err = sctp_auth_ep_set_hmacs(ep, hmacs);
3450out:
3451	kfree(hmacs);
3452	return err;
3453}
3454
3455/*
3456 * 7.1.20.  Set a shared key (SCTP_AUTH_KEY)
3457 *
3458 * This option will set a shared secret key which is used to build an
3459 * association shared key.
3460 */
3461static int sctp_setsockopt_auth_key(struct sock *sk,
3462				    char __user *optval,
3463				    unsigned int optlen)
3464{
3465	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3466	struct sctp_authkey *authkey;
3467	struct sctp_association *asoc;
3468	int ret;
3469
3470	if (!ep->auth_enable)
3471		return -EACCES;
3472
3473	if (optlen <= sizeof(struct sctp_authkey))
3474		return -EINVAL;
3475
3476	authkey = memdup_user(optval, optlen);
3477	if (IS_ERR(authkey))
3478		return PTR_ERR(authkey);
3479
3480	if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
3481		ret = -EINVAL;
3482		goto out;
3483	}
3484
3485	asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
3486	if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
3487		ret = -EINVAL;
3488		goto out;
3489	}
3490
3491	ret = sctp_auth_set_key(ep, asoc, authkey);
3492out:
3493	kzfree(authkey);
3494	return ret;
3495}
3496
3497/*
3498 * 7.1.21.  Get or set the active shared key (SCTP_AUTH_ACTIVE_KEY)
3499 *
3500 * This option will get or set the active shared key to be used to build
3501 * the association shared key.
3502 */
3503static int sctp_setsockopt_active_key(struct sock *sk,
3504				      char __user *optval,
3505				      unsigned int optlen)
3506{
3507	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3508	struct sctp_authkeyid val;
3509	struct sctp_association *asoc;
3510
3511	if (!ep->auth_enable)
3512		return -EACCES;
3513
3514	if (optlen != sizeof(struct sctp_authkeyid))
3515		return -EINVAL;
3516	if (copy_from_user(&val, optval, optlen))
3517		return -EFAULT;
3518
3519	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3520	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3521		return -EINVAL;
3522
3523	return sctp_auth_set_active_key(ep, asoc, val.scact_keynumber);
3524}
3525
3526/*
3527 * 7.1.22.  Delete a shared key (SCTP_AUTH_DELETE_KEY)
3528 *
3529 * This set option will delete a shared secret key from use.
3530 */
3531static int sctp_setsockopt_del_key(struct sock *sk,
3532				   char __user *optval,
3533				   unsigned int optlen)
3534{
3535	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3536	struct sctp_authkeyid val;
3537	struct sctp_association *asoc;
3538
3539	if (!ep->auth_enable)
3540		return -EACCES;
3541
3542	if (optlen != sizeof(struct sctp_authkeyid))
3543		return -EINVAL;
3544	if (copy_from_user(&val, optval, optlen))
3545		return -EFAULT;
3546
3547	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3548	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3549		return -EINVAL;
3550
3551	return sctp_auth_del_key_id(ep, asoc, val.scact_keynumber);
3552
3553}
3554
3555/*
3556 * 8.1.23 SCTP_AUTO_ASCONF
3557 *
3558 * This option will enable or disable the use of the automatic generation of
3559 * ASCONF chunks to add and delete addresses to an existing association.  Note
3560 * that this option has two caveats namely: a) it only affects sockets that
3561 * are bound to all addresses available to the SCTP stack, and b) the system
3562 * administrator may have an overriding control that turns the ASCONF feature
3563 * off no matter what setting the socket option may have.
3564 * This option expects an integer boolean flag, where a non-zero value turns on
3565 * the option, and a zero value turns off the option.
3566 * Note. In this implementation, socket operation overrides default parameter
3567 * being set by sysctl as well as FreeBSD implementation
3568 */
3569static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
3570					unsigned int optlen)
3571{
3572	int val;
3573	struct sctp_sock *sp = sctp_sk(sk);
3574
3575	if (optlen < sizeof(int))
3576		return -EINVAL;
3577	if (get_user(val, (int __user *)optval))
3578		return -EFAULT;
3579	if (!sctp_is_ep_boundall(sk) && val)
3580		return -EINVAL;
3581	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
3582		return 0;
3583
3584	if (val == 0 && sp->do_auto_asconf) {
3585		list_del(&sp->auto_asconf_list);
3586		sp->do_auto_asconf = 0;
3587	} else if (val && !sp->do_auto_asconf) {
3588		list_add_tail(&sp->auto_asconf_list,
3589		    &sock_net(sk)->sctp.auto_asconf_splist);
3590		sp->do_auto_asconf = 1;
3591	}
3592	return 0;
3593}
3594
3595/*
3596 * SCTP_PEER_ADDR_THLDS
3597 *
3598 * This option allows us to alter the partially failed threshold for one or all
3599 * transports in an association.  See Section 6.1 of:
3600 * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
3601 */
3602static int sctp_setsockopt_paddr_thresholds(struct sock *sk,
3603					    char __user *optval,
3604					    unsigned int optlen)
3605{
3606	struct sctp_paddrthlds val;
3607	struct sctp_transport *trans;
3608	struct sctp_association *asoc;
3609
3610	if (optlen < sizeof(struct sctp_paddrthlds))
3611		return -EINVAL;
3612	if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval,
3613			   sizeof(struct sctp_paddrthlds)))
3614		return -EFAULT;
3615
3616
3617	if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
3618		asoc = sctp_id2assoc(sk, val.spt_assoc_id);
3619		if (!asoc)
3620			return -ENOENT;
3621		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
3622				    transports) {
3623			if (val.spt_pathmaxrxt)
3624				trans->pathmaxrxt = val.spt_pathmaxrxt;
3625			trans->pf_retrans = val.spt_pathpfthld;
3626		}
3627
3628		if (val.spt_pathmaxrxt)
3629			asoc->pathmaxrxt = val.spt_pathmaxrxt;
3630		asoc->pf_retrans = val.spt_pathpfthld;
3631	} else {
3632		trans = sctp_addr_id2transport(sk, &val.spt_address,
3633					       val.spt_assoc_id);
3634		if (!trans)
3635			return -ENOENT;
3636
3637		if (val.spt_pathmaxrxt)
3638			trans->pathmaxrxt = val.spt_pathmaxrxt;
3639		trans->pf_retrans = val.spt_pathpfthld;
3640	}
3641
3642	return 0;
3643}
3644
3645static int sctp_setsockopt_recvrcvinfo(struct sock *sk,
3646				       char __user *optval,
3647				       unsigned int optlen)
3648{
3649	int val;
3650
3651	if (optlen < sizeof(int))
3652		return -EINVAL;
3653	if (get_user(val, (int __user *) optval))
3654		return -EFAULT;
3655
3656	sctp_sk(sk)->recvrcvinfo = (val == 0) ? 0 : 1;
3657
3658	return 0;
3659}
3660
3661static int sctp_setsockopt_recvnxtinfo(struct sock *sk,
3662				       char __user *optval,
3663				       unsigned int optlen)
3664{
3665	int val;
3666
3667	if (optlen < sizeof(int))
3668		return -EINVAL;
3669	if (get_user(val, (int __user *) optval))
3670		return -EFAULT;
3671
3672	sctp_sk(sk)->recvnxtinfo = (val == 0) ? 0 : 1;
3673
3674	return 0;
3675}
3676
3677/* API 6.2 setsockopt(), getsockopt()
3678 *
3679 * Applications use setsockopt() and getsockopt() to set or retrieve
3680 * socket options.  Socket options are used to change the default
3681 * behavior of sockets calls.  They are described in Section 7.
3682 *
3683 * The syntax is:
3684 *
3685 *   ret = getsockopt(int sd, int level, int optname, void __user *optval,
3686 *                    int __user *optlen);
3687 *   ret = setsockopt(int sd, int level, int optname, const void __user *optval,
3688 *                    int optlen);
3689 *
3690 *   sd      - the socket descript.
3691 *   level   - set to IPPROTO_SCTP for all SCTP options.
3692 *   optname - the option name.
3693 *   optval  - the buffer to store the value of the option.
3694 *   optlen  - the size of the buffer.
3695 */
3696static int sctp_setsockopt(struct sock *sk, int level, int optname,
3697			   char __user *optval, unsigned int optlen)
3698{
3699	int retval = 0;
3700
3701	pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
3702
3703	/* I can hardly begin to describe how wrong this is.  This is
3704	 * so broken as to be worse than useless.  The API draft
3705	 * REALLY is NOT helpful here...  I am not convinced that the
3706	 * semantics of setsockopt() with a level OTHER THAN SOL_SCTP
3707	 * are at all well-founded.
3708	 */
3709	if (level != SOL_SCTP) {
3710		struct sctp_af *af = sctp_sk(sk)->pf->af;
3711		retval = af->setsockopt(sk, level, optname, optval, optlen);
3712		goto out_nounlock;
3713	}
3714
3715	lock_sock(sk);
3716
3717	switch (optname) {
3718	case SCTP_SOCKOPT_BINDX_ADD:
3719		/* 'optlen' is the size of the addresses buffer. */
3720		retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
3721					       optlen, SCTP_BINDX_ADD_ADDR);
3722		break;
3723
3724	case SCTP_SOCKOPT_BINDX_REM:
3725		/* 'optlen' is the size of the addresses buffer. */
3726		retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
3727					       optlen, SCTP_BINDX_REM_ADDR);
3728		break;
3729
3730	case SCTP_SOCKOPT_CONNECTX_OLD:
3731		/* 'optlen' is the size of the addresses buffer. */
3732		retval = sctp_setsockopt_connectx_old(sk,
3733					    (struct sockaddr __user *)optval,
3734					    optlen);
3735		break;
3736
3737	case SCTP_SOCKOPT_CONNECTX:
3738		/* 'optlen' is the size of the addresses buffer. */
3739		retval = sctp_setsockopt_connectx(sk,
3740					    (struct sockaddr __user *)optval,
3741					    optlen);
3742		break;
3743
3744	case SCTP_DISABLE_FRAGMENTS:
3745		retval = sctp_setsockopt_disable_fragments(sk, optval, optlen);
3746		break;
3747
3748	case SCTP_EVENTS:
3749		retval = sctp_setsockopt_events(sk, optval, optlen);
3750		break;
3751
3752	case SCTP_AUTOCLOSE:
3753		retval = sctp_setsockopt_autoclose(sk, optval, optlen);
3754		break;
3755
3756	case SCTP_PEER_ADDR_PARAMS:
3757		retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
3758		break;
3759
3760	case SCTP_DELAYED_SACK:
3761		retval = sctp_setsockopt_delayed_ack(sk, optval, optlen);
3762		break;
3763	case SCTP_PARTIAL_DELIVERY_POINT:
3764		retval = sctp_setsockopt_partial_delivery_point(sk, optval, optlen);
3765		break;
3766
3767	case SCTP_INITMSG:
3768		retval = sctp_setsockopt_initmsg(sk, optval, optlen);
3769		break;
3770	case SCTP_DEFAULT_SEND_PARAM:
3771		retval = sctp_setsockopt_default_send_param(sk, optval,
3772							    optlen);
3773		break;
3774	case SCTP_DEFAULT_SNDINFO:
3775		retval = sctp_setsockopt_default_sndinfo(sk, optval, optlen);
3776		break;
3777	case SCTP_PRIMARY_ADDR:
3778		retval = sctp_setsockopt_primary_addr(sk, optval, optlen);
3779		break;
3780	case SCTP_SET_PEER_PRIMARY_ADDR:
3781		retval = sctp_setsockopt_peer_primary_addr(sk, optval, optlen);
3782		break;
3783	case SCTP_NODELAY:
3784		retval = sctp_setsockopt_nodelay(sk, optval, optlen);
3785		break;
3786	case SCTP_RTOINFO:
3787		retval = sctp_setsockopt_rtoinfo(sk, optval, optlen);
3788		break;
3789	case SCTP_ASSOCINFO:
3790		retval = sctp_setsockopt_associnfo(sk, optval, optlen);
3791		break;
3792	case SCTP_I_WANT_MAPPED_V4_ADDR:
3793		retval = sctp_setsockopt_mappedv4(sk, optval, optlen);
3794		break;
3795	case SCTP_MAXSEG:
3796		retval = sctp_setsockopt_maxseg(sk, optval, optlen);
3797		break;
3798	case SCTP_ADAPTATION_LAYER:
3799		retval = sctp_setsockopt_adaptation_layer(sk, optval, optlen);
3800		break;
3801	case SCTP_CONTEXT:
3802		retval = sctp_setsockopt_context(sk, optval, optlen);
3803		break;
3804	case SCTP_FRAGMENT_INTERLEAVE:
3805		retval = sctp_setsockopt_fragment_interleave(sk, optval, optlen);
3806		break;
3807	case SCTP_MAX_BURST:
3808		retval = sctp_setsockopt_maxburst(sk, optval, optlen);
3809		break;
3810	case SCTP_AUTH_CHUNK:
3811		retval = sctp_setsockopt_auth_chunk(sk, optval, optlen);
3812		break;
3813	case SCTP_HMAC_IDENT:
3814		retval = sctp_setsockopt_hmac_ident(sk, optval, optlen);
3815		break;
3816	case SCTP_AUTH_KEY:
3817		retval = sctp_setsockopt_auth_key(sk, optval, optlen);
3818		break;
3819	case SCTP_AUTH_ACTIVE_KEY:
3820		retval = sctp_setsockopt_active_key(sk, optval, optlen);
3821		break;
3822	case SCTP_AUTH_DELETE_KEY:
3823		retval = sctp_setsockopt_del_key(sk, optval, optlen);
3824		break;
3825	case SCTP_AUTO_ASCONF:
3826		retval = sctp_setsockopt_auto_asconf(sk, optval, optlen);
3827		break;
3828	case SCTP_PEER_ADDR_THLDS:
3829		retval = sctp_setsockopt_paddr_thresholds(sk, optval, optlen);
3830		break;
3831	case SCTP_RECVRCVINFO:
3832		retval = sctp_setsockopt_recvrcvinfo(sk, optval, optlen);
3833		break;
3834	case SCTP_RECVNXTINFO:
3835		retval = sctp_setsockopt_recvnxtinfo(sk, optval, optlen);
3836		break;
3837	default:
3838		retval = -ENOPROTOOPT;
3839		break;
3840	}
3841
3842	release_sock(sk);
3843
3844out_nounlock:
3845	return retval;
3846}
3847
3848/* API 3.1.6 connect() - UDP Style Syntax
3849 *
3850 * An application may use the connect() call in the UDP model to initiate an
3851 * association without sending data.
3852 *
3853 * The syntax is:
3854 *
3855 * ret = connect(int sd, const struct sockaddr *nam, socklen_t len);
3856 *
3857 * sd: the socket descriptor to have a new association added to.
3858 *
3859 * nam: the address structure (either struct sockaddr_in or struct
3860 *    sockaddr_in6 defined in RFC2553 [7]).
3861 *
3862 * len: the size of the address.
3863 */
3864static int sctp_connect(struct sock *sk, struct sockaddr *addr,
3865			int addr_len)
3866{
3867	int err = 0;
3868	struct sctp_af *af;
3869
3870	lock_sock(sk);
3871
3872	pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
3873		 addr, addr_len);
3874
3875	/* Validate addr_len before calling common connect/connectx routine. */
3876	af = sctp_get_af_specific(addr->sa_family);
3877	if (!af || addr_len < af->sockaddr_len) {
3878		err = -EINVAL;
3879	} else {
3880		/* Pass correct addr len to common routine (so it knows there
3881		 * is only one address being passed.
3882		 */
3883		err = __sctp_connect(sk, addr, af->sockaddr_len, NULL);
3884	}
3885
3886	release_sock(sk);
3887	return err;
3888}
3889
3890/* FIXME: Write comments. */
3891static int sctp_disconnect(struct sock *sk, int flags)
3892{
3893	return -EOPNOTSUPP; /* STUB */
3894}
3895
3896/* 4.1.4 accept() - TCP Style Syntax
3897 *
3898 * Applications use accept() call to remove an established SCTP
3899 * association from the accept queue of the endpoint.  A new socket
3900 * descriptor will be returned from accept() to represent the newly
3901 * formed association.
3902 */
3903static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
3904{
3905	struct sctp_sock *sp;
3906	struct sctp_endpoint *ep;
3907	struct sock *newsk = NULL;
3908	struct sctp_association *asoc;
3909	long timeo;
3910	int error = 0;
3911
3912	lock_sock(sk);
3913
3914	sp = sctp_sk(sk);
3915	ep = sp->ep;
3916
3917	if (!sctp_style(sk, TCP)) {
3918		error = -EOPNOTSUPP;
3919		goto out;
3920	}
3921
3922	if (!sctp_sstate(sk, LISTENING)) {
3923		error = -EINVAL;
3924		goto out;
3925	}
3926
3927	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
3928
3929	error = sctp_wait_for_accept(sk, timeo);
3930	if (error)
3931		goto out;
3932
3933	/* We treat the list of associations on the endpoint as the accept
3934	 * queue and pick the first association on the list.
3935	 */
3936	asoc = list_entry(ep->asocs.next, struct sctp_association, asocs);
3937
3938	newsk = sp->pf->create_accept_sk(sk, asoc);
3939	if (!newsk) {
3940		error = -ENOMEM;
3941		goto out;
3942	}
3943
3944	/* Populate the fields of the newsk from the oldsk and migrate the
3945	 * asoc to the newsk.
3946	 */
3947	sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
3948
3949out:
3950	release_sock(sk);
3951	*err = error;
3952	return newsk;
3953}
3954
3955/* The SCTP ioctl handler. */
3956static int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
3957{
3958	int rc = -ENOTCONN;
3959
3960	lock_sock(sk);
3961
3962	/*
3963	 * SEQPACKET-style sockets in LISTENING state are valid, for
3964	 * SCTP, so only discard TCP-style sockets in LISTENING state.
3965	 */
3966	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
3967		goto out;
3968
3969	switch (cmd) {
3970	case SIOCINQ: {
3971		struct sk_buff *skb;
3972		unsigned int amount = 0;
3973
3974		skb = skb_peek(&sk->sk_receive_queue);
3975		if (skb != NULL) {
3976			/*
3977			 * We will only return the amount of this packet since
3978			 * that is all that will be read.
3979			 */
3980			amount = skb->len;
3981		}
3982		rc = put_user(amount, (int __user *)arg);
3983		break;
3984	}
3985	default:
3986		rc = -ENOIOCTLCMD;
3987		break;
3988	}
3989out:
3990	release_sock(sk);
3991	return rc;
3992}
3993
3994/* This is the function which gets called during socket creation to
3995 * initialized the SCTP-specific portion of the sock.
3996 * The sock structure should already be zero-filled memory.
3997 */
3998static int sctp_init_sock(struct sock *sk)
3999{
4000	struct net *net = sock_net(sk);
4001	struct sctp_sock *sp;
4002
4003	pr_debug("%s: sk:%p\n", __func__, sk);
4004
4005	sp = sctp_sk(sk);
4006
4007	/* Initialize the SCTP per socket area.  */
4008	switch (sk->sk_type) {
4009	case SOCK_SEQPACKET:
4010		sp->type = SCTP_SOCKET_UDP;
4011		break;
4012	case SOCK_STREAM:
4013		sp->type = SCTP_SOCKET_TCP;
4014		break;
4015	default:
4016		return -ESOCKTNOSUPPORT;
4017	}
4018
4019	/* Initialize default send parameters. These parameters can be
4020	 * modified with the SCTP_DEFAULT_SEND_PARAM socket option.
4021	 */
4022	sp->default_stream = 0;
4023	sp->default_ppid = 0;
4024	sp->default_flags = 0;
4025	sp->default_context = 0;
4026	sp->default_timetolive = 0;
4027
4028	sp->default_rcv_context = 0;
4029	sp->max_burst = net->sctp.max_burst;
4030
4031	sp->sctp_hmac_alg = net->sctp.sctp_hmac_alg;
4032
4033	/* Initialize default setup parameters. These parameters
4034	 * can be modified with the SCTP_INITMSG socket option or
4035	 * overridden by the SCTP_INIT CMSG.
4036	 */
4037	sp->initmsg.sinit_num_ostreams   = sctp_max_outstreams;
4038	sp->initmsg.sinit_max_instreams  = sctp_max_instreams;
4039	sp->initmsg.sinit_max_attempts   = net->sctp.max_retrans_init;
4040	sp->initmsg.sinit_max_init_timeo = net->sctp.rto_max;
4041
4042	/* Initialize default RTO related parameters.  These parameters can
4043	 * be modified for with the SCTP_RTOINFO socket option.
4044	 */
4045	sp->rtoinfo.srto_initial = net->sctp.rto_initial;
4046	sp->rtoinfo.srto_max     = net->sctp.rto_max;
4047	sp->rtoinfo.srto_min     = net->sctp.rto_min;
4048
4049	/* Initialize default association related parameters. These parameters
4050	 * can be modified with the SCTP_ASSOCINFO socket option.
4051	 */
4052	sp->assocparams.sasoc_asocmaxrxt = net->sctp.max_retrans_association;
4053	sp->assocparams.sasoc_number_peer_destinations = 0;
4054	sp->assocparams.sasoc_peer_rwnd = 0;
4055	sp->assocparams.sasoc_local_rwnd = 0;
4056	sp->assocparams.sasoc_cookie_life = net->sctp.valid_cookie_life;
4057
4058	/* Initialize default event subscriptions. By default, all the
4059	 * options are off.
4060	 */
4061	memset(&sp->subscribe, 0, sizeof(struct sctp_event_subscribe));
4062
4063	/* Default Peer Address Parameters.  These defaults can
4064	 * be modified via SCTP_PEER_ADDR_PARAMS
4065	 */
4066	sp->hbinterval  = net->sctp.hb_interval;
4067	sp->pathmaxrxt  = net->sctp.max_retrans_path;
4068	sp->pathmtu     = 0; /* allow default discovery */
4069	sp->sackdelay   = net->sctp.sack_timeout;
4070	sp->sackfreq	= 2;
4071	sp->param_flags = SPP_HB_ENABLE |
4072			  SPP_PMTUD_ENABLE |
4073			  SPP_SACKDELAY_ENABLE;
4074
4075	/* If enabled no SCTP message fragmentation will be performed.
4076	 * Configure through SCTP_DISABLE_FRAGMENTS socket option.
4077	 */
4078	sp->disable_fragments = 0;
4079
4080	/* Enable Nagle algorithm by default.  */
4081	sp->nodelay           = 0;
4082
4083	sp->recvrcvinfo = 0;
4084	sp->recvnxtinfo = 0;
4085
4086	/* Enable by default. */
4087	sp->v4mapped          = 1;
4088
4089	/* Auto-close idle associations after the configured
4090	 * number of seconds.  A value of 0 disables this
4091	 * feature.  Configure through the SCTP_AUTOCLOSE socket option,
4092	 * for UDP-style sockets only.
4093	 */
4094	sp->autoclose         = 0;
4095
4096	/* User specified fragmentation limit. */
4097	sp->user_frag         = 0;
4098
4099	sp->adaptation_ind = 0;
4100
4101	sp->pf = sctp_get_pf_specific(sk->sk_family);
4102
4103	/* Control variables for partial data delivery. */
4104	atomic_set(&sp->pd_mode, 0);
4105	skb_queue_head_init(&sp->pd_lobby);
4106	sp->frag_interleave = 0;
4107
4108	/* Create a per socket endpoint structure.  Even if we
4109	 * change the data structure relationships, this may still
4110	 * be useful for storing pre-connect address information.
4111	 */
4112	sp->ep = sctp_endpoint_new(sk, GFP_KERNEL);
4113	if (!sp->ep)
4114		return -ENOMEM;
4115
4116	sp->hmac = NULL;
4117
4118	sk->sk_destruct = sctp_destruct_sock;
4119
4120	SCTP_DBG_OBJCNT_INC(sock);
4121
4122	local_bh_disable();
4123	percpu_counter_inc(&sctp_sockets_allocated);
4124	sock_prot_inuse_add(net, sk->sk_prot, 1);
4125	if (net->sctp.default_auto_asconf) {
4126		list_add_tail(&sp->auto_asconf_list,
4127		    &net->sctp.auto_asconf_splist);
4128		sp->do_auto_asconf = 1;
4129	} else
4130		sp->do_auto_asconf = 0;
4131	local_bh_enable();
4132
4133	return 0;
4134}
4135
4136/* Cleanup any SCTP per socket resources.  */
4137static void sctp_destroy_sock(struct sock *sk)
4138{
4139	struct sctp_sock *sp;
4140
4141	pr_debug("%s: sk:%p\n", __func__, sk);
4142
4143	/* Release our hold on the endpoint. */
4144	sp = sctp_sk(sk);
4145	/* This could happen during socket init, thus we bail out
4146	 * early, since the rest of the below is not setup either.
4147	 */
4148	if (sp->ep == NULL)
4149		return;
4150
4151	if (sp->do_auto_asconf) {
4152		sp->do_auto_asconf = 0;
4153		list_del(&sp->auto_asconf_list);
4154	}
4155	sctp_endpoint_free(sp->ep);
4156	local_bh_disable();
4157	percpu_counter_dec(&sctp_sockets_allocated);
4158	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
4159	local_bh_enable();
4160}
4161
4162/* Triggered when there are no references on the socket anymore */
4163static void sctp_destruct_sock(struct sock *sk)
4164{
4165	struct sctp_sock *sp = sctp_sk(sk);
4166
4167	/* Free up the HMAC transform. */
4168	crypto_free_hash(sp->hmac);
4169
4170	inet_sock_destruct(sk);
4171}
4172
4173/* API 4.1.7 shutdown() - TCP Style Syntax
4174 *     int shutdown(int socket, int how);
4175 *
4176 *     sd      - the socket descriptor of the association to be closed.
4177 *     how     - Specifies the type of shutdown.  The  values  are
4178 *               as follows:
4179 *               SHUT_RD
4180 *                     Disables further receive operations. No SCTP
4181 *                     protocol action is taken.
4182 *               SHUT_WR
4183 *                     Disables further send operations, and initiates
4184 *                     the SCTP shutdown sequence.
4185 *               SHUT_RDWR
4186 *                     Disables further send  and  receive  operations
4187 *                     and initiates the SCTP shutdown sequence.
4188 */
4189static void sctp_shutdown(struct sock *sk, int how)
4190{
4191	struct net *net = sock_net(sk);
4192	struct sctp_endpoint *ep;
4193	struct sctp_association *asoc;
4194
4195	if (!sctp_style(sk, TCP))
4196		return;
4197
4198	if (how & SEND_SHUTDOWN) {
4199		ep = sctp_sk(sk)->ep;
4200		if (!list_empty(&ep->asocs)) {
4201			asoc = list_entry(ep->asocs.next,
4202					  struct sctp_association, asocs);
4203			sctp_primitive_SHUTDOWN(net, asoc, NULL);
4204		}
4205	}
4206}
4207
4208/* 7.2.1 Association Status (SCTP_STATUS)
4209
4210 * Applications can retrieve current status information about an
4211 * association, including association state, peer receiver window size,
4212 * number of unacked data chunks, and number of data chunks pending
4213 * receipt.  This information is read-only.
4214 */
4215static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
4216				       char __user *optval,
4217				       int __user *optlen)
4218{
4219	struct sctp_status status;
4220	struct sctp_association *asoc = NULL;
4221	struct sctp_transport *transport;
4222	sctp_assoc_t associd;
4223	int retval = 0;
4224
4225	if (len < sizeof(status)) {
4226		retval = -EINVAL;
4227		goto out;
4228	}
4229
4230	len = sizeof(status);
4231	if (copy_from_user(&status, optval, len)) {
4232		retval = -EFAULT;
4233		goto out;
4234	}
4235
4236	associd = status.sstat_assoc_id;
4237	asoc = sctp_id2assoc(sk, associd);
4238	if (!asoc) {
4239		retval = -EINVAL;
4240		goto out;
4241	}
4242
4243	transport = asoc->peer.primary_path;
4244
4245	status.sstat_assoc_id = sctp_assoc2id(asoc);
4246	status.sstat_state = sctp_assoc_to_state(asoc);
4247	status.sstat_rwnd =  asoc->peer.rwnd;
4248	status.sstat_unackdata = asoc->unack_data;
4249
4250	status.sstat_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
4251	status.sstat_instrms = asoc->c.sinit_max_instreams;
4252	status.sstat_outstrms = asoc->c.sinit_num_ostreams;
4253	status.sstat_fragmentation_point = asoc->frag_point;
4254	status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4255	memcpy(&status.sstat_primary.spinfo_address, &transport->ipaddr,
4256			transport->af_specific->sockaddr_len);
4257	/* Map ipv4 address into v4-mapped-on-v6 address.  */
4258	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
4259		(union sctp_addr *)&status.sstat_primary.spinfo_address);
4260	status.sstat_primary.spinfo_state = transport->state;
4261	status.sstat_primary.spinfo_cwnd = transport->cwnd;
4262	status.sstat_primary.spinfo_srtt = transport->srtt;
4263	status.sstat_primary.spinfo_rto = jiffies_to_msecs(transport->rto);
4264	status.sstat_primary.spinfo_mtu = transport->pathmtu;
4265
4266	if (status.sstat_primary.spinfo_state == SCTP_UNKNOWN)
4267		status.sstat_primary.spinfo_state = SCTP_ACTIVE;
4268
4269	if (put_user(len, optlen)) {
4270		retval = -EFAULT;
4271		goto out;
4272	}
4273
4274	pr_debug("%s: len:%d, state:%d, rwnd:%d, assoc_id:%d\n",
4275		 __func__, len, status.sstat_state, status.sstat_rwnd,
4276		 status.sstat_assoc_id);
4277
4278	if (copy_to_user(optval, &status, len)) {
4279		retval = -EFAULT;
4280		goto out;
4281	}
4282
4283out:
4284	return retval;
4285}
4286
4287
4288/* 7.2.2 Peer Address Information (SCTP_GET_PEER_ADDR_INFO)
4289 *
4290 * Applications can retrieve information about a specific peer address
4291 * of an association, including its reachability state, congestion
4292 * window, and retransmission timer values.  This information is
4293 * read-only.
4294 */
4295static int sctp_getsockopt_peer_addr_info(struct sock *sk, int len,
4296					  char __user *optval,
4297					  int __user *optlen)
4298{
4299	struct sctp_paddrinfo pinfo;
4300	struct sctp_transport *transport;
4301	int retval = 0;
4302
4303	if (len < sizeof(pinfo)) {
4304		retval = -EINVAL;
4305		goto out;
4306	}
4307
4308	len = sizeof(pinfo);
4309	if (copy_from_user(&pinfo, optval, len)) {
4310		retval = -EFAULT;
4311		goto out;
4312	}
4313
4314	transport = sctp_addr_id2transport(sk, &pinfo.spinfo_address,
4315					   pinfo.spinfo_assoc_id);
4316	if (!transport)
4317		return -EINVAL;
4318
4319	pinfo.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4320	pinfo.spinfo_state = transport->state;
4321	pinfo.spinfo_cwnd = transport->cwnd;
4322	pinfo.spinfo_srtt = transport->srtt;
4323	pinfo.spinfo_rto = jiffies_to_msecs(transport->rto);
4324	pinfo.spinfo_mtu = transport->pathmtu;
4325
4326	if (pinfo.spinfo_state == SCTP_UNKNOWN)
4327		pinfo.spinfo_state = SCTP_ACTIVE;
4328
4329	if (put_user(len, optlen)) {
4330		retval = -EFAULT;
4331		goto out;
4332	}
4333
4334	if (copy_to_user(optval, &pinfo, len)) {
4335		retval = -EFAULT;
4336		goto out;
4337	}
4338
4339out:
4340	return retval;
4341}
4342
4343/* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
4344 *
4345 * This option is a on/off flag.  If enabled no SCTP message
4346 * fragmentation will be performed.  Instead if a message being sent
4347 * exceeds the current PMTU size, the message will NOT be sent and
4348 * instead a error will be indicated to the user.
4349 */
4350static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
4351					char __user *optval, int __user *optlen)
4352{
4353	int val;
4354
4355	if (len < sizeof(int))
4356		return -EINVAL;
4357
4358	len = sizeof(int);
4359	val = (sctp_sk(sk)->disable_fragments == 1);
4360	if (put_user(len, optlen))
4361		return -EFAULT;
4362	if (copy_to_user(optval, &val, len))
4363		return -EFAULT;
4364	return 0;
4365}
4366
4367/* 7.1.15 Set notification and ancillary events (SCTP_EVENTS)
4368 *
4369 * This socket option is used to specify various notifications and
4370 * ancillary data the user wishes to receive.
4371 */
4372static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
4373				  int __user *optlen)
4374{
4375	if (len <= 0)
4376		return -EINVAL;
4377	if (len > sizeof(struct sctp_event_subscribe))
4378		len = sizeof(struct sctp_event_subscribe);
4379	if (put_user(len, optlen))
4380		return -EFAULT;
4381	if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
4382		return -EFAULT;
4383	return 0;
4384}
4385
4386/* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
4387 *
4388 * This socket option is applicable to the UDP-style socket only.  When
4389 * set it will cause associations that are idle for more than the
4390 * specified number of seconds to automatically close.  An association
4391 * being idle is defined an association that has NOT sent or received
4392 * user data.  The special value of '0' indicates that no automatic
4393 * close of any associations should be performed.  The option expects an
4394 * integer defining the number of seconds of idle time before an
4395 * association is closed.
4396 */
4397static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
4398{
4399	/* Applicable to UDP-style socket only */
4400	if (sctp_style(sk, TCP))
4401		return -EOPNOTSUPP;
4402	if (len < sizeof(int))
4403		return -EINVAL;
4404	len = sizeof(int);
4405	if (put_user(len, optlen))
4406		return -EFAULT;
4407	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
4408		return -EFAULT;
4409	return 0;
4410}
4411
4412/* Helper routine to branch off an association to a new socket.  */
4413int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
4414{
4415	struct sctp_association *asoc = sctp_id2assoc(sk, id);
4416	struct sctp_sock *sp = sctp_sk(sk);
4417	struct socket *sock;
4418	int err = 0;
4419
4420	if (!asoc)
4421		return -EINVAL;
4422
4423	/* An association cannot be branched off from an already peeled-off
4424	 * socket, nor is this supported for tcp style sockets.
4425	 */
4426	if (!sctp_style(sk, UDP))
4427		return -EINVAL;
4428
4429	/* Create a new socket.  */
4430	err = sock_create(sk->sk_family, SOCK_SEQPACKET, IPPROTO_SCTP, &sock);
4431	if (err < 0)
4432		return err;
4433
4434	sctp_copy_sock(sock->sk, sk, asoc);
4435
4436	/* Make peeled-off sockets more like 1-1 accepted sockets.
4437	 * Set the daddr and initialize id to something more random
4438	 */
4439	sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk);
4440
4441	/* Populate the fields of the newsk from the oldsk and migrate the
4442	 * asoc to the newsk.
4443	 */
4444	sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
4445
4446	*sockp = sock;
4447
4448	return err;
4449}
4450EXPORT_SYMBOL(sctp_do_peeloff);
4451
4452static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen)
4453{
4454	sctp_peeloff_arg_t peeloff;
4455	struct socket *newsock;
4456	struct file *newfile;
4457	int retval = 0;
4458
4459	if (len < sizeof(sctp_peeloff_arg_t))
4460		return -EINVAL;
4461	len = sizeof(sctp_peeloff_arg_t);
4462	if (copy_from_user(&peeloff, optval, len))
4463		return -EFAULT;
4464
4465	retval = sctp_do_peeloff(sk, peeloff.associd, &newsock);
4466	if (retval < 0)
4467		goto out;
4468
4469	/* Map the socket to an unused fd that can be returned to the user.  */
4470	retval = get_unused_fd_flags(0);
4471	if (retval < 0) {
4472		sock_release(newsock);
4473		goto out;
4474	}
4475
4476	newfile = sock_alloc_file(newsock, 0, NULL);
4477	if (unlikely(IS_ERR(newfile))) {
4478		put_unused_fd(retval);
4479		sock_release(newsock);
4480		return PTR_ERR(newfile);
4481	}
4482
4483	pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
4484		 retval);
4485
4486	/* Return the fd mapped to the new socket.  */
4487	if (put_user(len, optlen)) {
4488		fput(newfile);
4489		put_unused_fd(retval);
4490		return -EFAULT;
4491	}
4492	peeloff.sd = retval;
4493	if (copy_to_user(optval, &peeloff, len)) {
4494		fput(newfile);
4495		put_unused_fd(retval);
4496		return -EFAULT;
4497	}
4498	fd_install(retval, newfile);
4499out:
4500	return retval;
4501}
4502
4503/* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
4504 *
4505 * Applications can enable or disable heartbeats for any peer address of
4506 * an association, modify an address's heartbeat interval, force a
4507 * heartbeat to be sent immediately, and adjust the address's maximum
4508 * number of retransmissions sent before an address is considered
4509 * unreachable.  The following structure is used to access and modify an
4510 * address's parameters:
4511 *
4512 *  struct sctp_paddrparams {
4513 *     sctp_assoc_t            spp_assoc_id;
4514 *     struct sockaddr_storage spp_address;
4515 *     uint32_t                spp_hbinterval;
4516 *     uint16_t                spp_pathmaxrxt;
4517 *     uint32_t                spp_pathmtu;
4518 *     uint32_t                spp_sackdelay;
4519 *     uint32_t                spp_flags;
4520 * };
4521 *
4522 *   spp_assoc_id    - (one-to-many style socket) This is filled in the
4523 *                     application, and identifies the association for
4524 *                     this query.
4525 *   spp_address     - This specifies which address is of interest.
4526 *   spp_hbinterval  - This contains the value of the heartbeat interval,
4527 *                     in milliseconds.  If a  value of zero
4528 *                     is present in this field then no changes are to
4529 *                     be made to this parameter.
4530 *   spp_pathmaxrxt  - This contains the maximum number of
4531 *                     retransmissions before this address shall be
4532 *                     considered unreachable. If a  value of zero
4533 *                     is present in this field then no changes are to
4534 *                     be made to this parameter.
4535 *   spp_pathmtu     - When Path MTU discovery is disabled the value
4536 *                     specified here will be the "fixed" path mtu.
4537 *                     Note that if the spp_address field is empty
4538 *                     then all associations on this address will
4539 *                     have this fixed path mtu set upon them.
4540 *
4541 *   spp_sackdelay   - When delayed sack is enabled, this value specifies
4542 *                     the number of milliseconds that sacks will be delayed
4543 *                     for. This value will apply to all addresses of an
4544 *                     association if the spp_address field is empty. Note
4545 *                     also, that if delayed sack is enabled and this
4546 *                     value is set to 0, no change is made to the last
4547 *                     recorded delayed sack timer value.
4548 *
4549 *   spp_flags       - These flags are used to control various features
4550 *                     on an association. The flag field may contain
4551 *                     zero or more of the following options.
4552 *
4553 *                     SPP_HB_ENABLE  - Enable heartbeats on the
4554 *                     specified address. Note that if the address
4555 *                     field is empty all addresses for the association
4556 *                     have heartbeats enabled upon them.
4557 *
4558 *                     SPP_HB_DISABLE - Disable heartbeats on the
4559 *                     speicifed address. Note that if the address
4560 *                     field is empty all addresses for the association
4561 *                     will have their heartbeats disabled. Note also
4562 *                     that SPP_HB_ENABLE and SPP_HB_DISABLE are
4563 *                     mutually exclusive, only one of these two should
4564 *                     be specified. Enabling both fields will have
4565 *                     undetermined results.
4566 *
4567 *                     SPP_HB_DEMAND - Request a user initiated heartbeat
4568 *                     to be made immediately.
4569 *
4570 *                     SPP_PMTUD_ENABLE - This field will enable PMTU
4571 *                     discovery upon the specified address. Note that
4572 *                     if the address feild is empty then all addresses
4573 *                     on the association are effected.
4574 *
4575 *                     SPP_PMTUD_DISABLE - This field will disable PMTU
4576 *                     discovery upon the specified address. Note that
4577 *                     if the address feild is empty then all addresses
4578 *                     on the association are effected. Not also that
4579 *                     SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
4580 *                     exclusive. Enabling both will have undetermined
4581 *                     results.
4582 *
4583 *                     SPP_SACKDELAY_ENABLE - Setting this flag turns
4584 *                     on delayed sack. The time specified in spp_sackdelay
4585 *                     is used to specify the sack delay for this address. Note
4586 *                     that if spp_address is empty then all addresses will
4587 *                     enable delayed sack and take on the sack delay
4588 *                     value specified in spp_sackdelay.
4589 *                     SPP_SACKDELAY_DISABLE - Setting this flag turns
4590 *                     off delayed sack. If the spp_address field is blank then
4591 *                     delayed sack is disabled for the entire association. Note
4592 *                     also that this field is mutually exclusive to
4593 *                     SPP_SACKDELAY_ENABLE, setting both will have undefined
4594 *                     results.
4595 */
4596static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
4597					    char __user *optval, int __user *optlen)
4598{
4599	struct sctp_paddrparams  params;
4600	struct sctp_transport   *trans = NULL;
4601	struct sctp_association *asoc = NULL;
4602	struct sctp_sock        *sp = sctp_sk(sk);
4603
4604	if (len < sizeof(struct sctp_paddrparams))
4605		return -EINVAL;
4606	len = sizeof(struct sctp_paddrparams);
4607	if (copy_from_user(&params, optval, len))
4608		return -EFAULT;
4609
4610	/* If an address other than INADDR_ANY is specified, and
4611	 * no transport is found, then the request is invalid.
4612	 */
4613	if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
4614		trans = sctp_addr_id2transport(sk, &params.spp_address,
4615					       params.spp_assoc_id);
4616		if (!trans) {
4617			pr_debug("%s: failed no transport\n", __func__);
4618			return -EINVAL;
4619		}
4620	}
4621
4622	/* Get association, if assoc_id != 0 and the socket is a one
4623	 * to many style socket, and an association was not found, then
4624	 * the id was invalid.
4625	 */
4626	asoc = sctp_id2assoc(sk, params.spp_assoc_id);
4627	if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP)) {
4628		pr_debug("%s: failed no association\n", __func__);
4629		return -EINVAL;
4630	}
4631
4632	if (trans) {
4633		/* Fetch transport values. */
4634		params.spp_hbinterval = jiffies_to_msecs(trans->hbinterval);
4635		params.spp_pathmtu    = trans->pathmtu;
4636		params.spp_pathmaxrxt = trans->pathmaxrxt;
4637		params.spp_sackdelay  = jiffies_to_msecs(trans->sackdelay);
4638
4639		/*draft-11 doesn't say what to return in spp_flags*/
4640		params.spp_flags      = trans->param_flags;
4641	} else if (asoc) {
4642		/* Fetch association values. */
4643		params.spp_hbinterval = jiffies_to_msecs(asoc->hbinterval);
4644		params.spp_pathmtu    = asoc->pathmtu;
4645		params.spp_pathmaxrxt = asoc->pathmaxrxt;
4646		params.spp_sackdelay  = jiffies_to_msecs(asoc->sackdelay);
4647
4648		/*draft-11 doesn't say what to return in spp_flags*/
4649		params.spp_flags      = asoc->param_flags;
4650	} else {
4651		/* Fetch socket values. */
4652		params.spp_hbinterval = sp->hbinterval;
4653		params.spp_pathmtu    = sp->pathmtu;
4654		params.spp_sackdelay  = sp->sackdelay;
4655		params.spp_pathmaxrxt = sp->pathmaxrxt;
4656
4657		/*draft-11 doesn't say what to return in spp_flags*/
4658		params.spp_flags      = sp->param_flags;
4659	}
4660
4661	if (copy_to_user(optval, &params, len))
4662		return -EFAULT;
4663
4664	if (put_user(len, optlen))
4665		return -EFAULT;
4666
4667	return 0;
4668}
4669
4670/*
4671 * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
4672 *
4673 * This option will effect the way delayed acks are performed.  This
4674 * option allows you to get or set the delayed ack time, in
4675 * milliseconds.  It also allows changing the delayed ack frequency.
4676 * Changing the frequency to 1 disables the delayed sack algorithm.  If
4677 * the assoc_id is 0, then this sets or gets the endpoints default
4678 * values.  If the assoc_id field is non-zero, then the set or get
4679 * effects the specified association for the one to many model (the
4680 * assoc_id field is ignored by the one to one model).  Note that if
4681 * sack_delay or sack_freq are 0 when setting this option, then the
4682 * current values will remain unchanged.
4683 *
4684 * struct sctp_sack_info {
4685 *     sctp_assoc_t            sack_assoc_id;
4686 *     uint32_t                sack_delay;
4687 *     uint32_t                sack_freq;
4688 * };
4689 *
4690 * sack_assoc_id -  This parameter, indicates which association the user
4691 *    is performing an action upon.  Note that if this field's value is
4692 *    zero then the endpoints default value is changed (effecting future
4693 *    associations only).
4694 *
4695 * sack_delay -  This parameter contains the number of milliseconds that
4696 *    the user is requesting the delayed ACK timer be set to.  Note that
4697 *    this value is defined in the standard to be between 200 and 500
4698 *    milliseconds.
4699 *
4700 * sack_freq -  This parameter contains the number of packets that must
4701 *    be received before a sack is sent without waiting for the delay
4702 *    timer to expire.  The default value for this is 2, setting this
4703 *    value to 1 will disable the delayed sack algorithm.
4704 */
4705static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
4706					    char __user *optval,
4707					    int __user *optlen)
4708{
4709	struct sctp_sack_info    params;
4710	struct sctp_association *asoc = NULL;
4711	struct sctp_sock        *sp = sctp_sk(sk);
4712
4713	if (len >= sizeof(struct sctp_sack_info)) {
4714		len = sizeof(struct sctp_sack_info);
4715
4716		if (copy_from_user(&params, optval, len))
4717			return -EFAULT;
4718	} else if (len == sizeof(struct sctp_assoc_value)) {
4719		pr_warn_ratelimited(DEPRECATED
4720				    "%s (pid %d) "
4721				    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
4722				    "Use struct sctp_sack_info instead\n",
4723				    current->comm, task_pid_nr(current));
4724		if (copy_from_user(&params, optval, len))
4725			return -EFAULT;
4726	} else
4727		return -EINVAL;
4728
4729	/* Get association, if sack_assoc_id != 0 and the socket is a one
4730	 * to many style socket, and an association was not found, then
4731	 * the id was invalid.
4732	 */
4733	asoc = sctp_id2assoc(sk, params.sack_assoc_id);
4734	if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
4735		return -EINVAL;
4736
4737	if (asoc) {
4738		/* Fetch association values. */
4739		if (asoc->param_flags & SPP_SACKDELAY_ENABLE) {
4740			params.sack_delay = jiffies_to_msecs(
4741				asoc->sackdelay);
4742			params.sack_freq = asoc->sackfreq;
4743
4744		} else {
4745			params.sack_delay = 0;
4746			params.sack_freq = 1;
4747		}
4748	} else {
4749		/* Fetch socket values. */
4750		if (sp->param_flags & SPP_SACKDELAY_ENABLE) {
4751			params.sack_delay  = sp->sackdelay;
4752			params.sack_freq = sp->sackfreq;
4753		} else {
4754			params.sack_delay  = 0;
4755			params.sack_freq = 1;
4756		}
4757	}
4758
4759	if (copy_to_user(optval, &params, len))
4760		return -EFAULT;
4761
4762	if (put_user(len, optlen))
4763		return -EFAULT;
4764
4765	return 0;
4766}
4767
4768/* 7.1.3 Initialization Parameters (SCTP_INITMSG)
4769 *
4770 * Applications can specify protocol parameters for the default association
4771 * initialization.  The option name argument to setsockopt() and getsockopt()
4772 * is SCTP_INITMSG.
4773 *
4774 * Setting initialization parameters is effective only on an unconnected
4775 * socket (for UDP-style sockets only future associations are effected
4776 * by the change).  With TCP-style sockets, this option is inherited by
4777 * sockets derived from a listener socket.
4778 */
4779static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
4780{
4781	if (len < sizeof(struct sctp_initmsg))
4782		return -EINVAL;
4783	len = sizeof(struct sctp_initmsg);
4784	if (put_user(len, optlen))
4785		return -EFAULT;
4786	if (copy_to_user(optval, &sctp_sk(sk)->initmsg, len))
4787		return -EFAULT;
4788	return 0;
4789}
4790
4791
4792static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
4793				      char __user *optval, int __user *optlen)
4794{
4795	struct sctp_association *asoc;
4796	int cnt = 0;
4797	struct sctp_getaddrs getaddrs;
4798	struct sctp_transport *from;
4799	void __user *to;
4800	union sctp_addr temp;
4801	struct sctp_sock *sp = sctp_sk(sk);
4802	int addrlen;
4803	size_t space_left;
4804	int bytes_copied;
4805
4806	if (len < sizeof(struct sctp_getaddrs))
4807		return -EINVAL;
4808
4809	if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
4810		return -EFAULT;
4811
4812	/* For UDP-style sockets, id specifies the association to query.  */
4813	asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
4814	if (!asoc)
4815		return -EINVAL;
4816
4817	to = optval + offsetof(struct sctp_getaddrs, addrs);
4818	space_left = len - offsetof(struct sctp_getaddrs, addrs);
4819
4820	list_for_each_entry(from, &asoc->peer.transport_addr_list,
4821				transports) {
4822		memcpy(&temp, &from->ipaddr, sizeof(temp));
4823		addrlen = sctp_get_pf_specific(sk->sk_family)
4824			      ->addr_to_user(sp, &temp);
4825		if (space_left < addrlen)
4826			return -ENOMEM;
4827		if (copy_to_user(to, &temp, addrlen))
4828			return -EFAULT;
4829		to += addrlen;
4830		cnt++;
4831		space_left -= addrlen;
4832	}
4833
4834	if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num))
4835		return -EFAULT;
4836	bytes_copied = ((char __user *)to) - optval;
4837	if (put_user(bytes_copied, optlen))
4838		return -EFAULT;
4839
4840	return 0;
4841}
4842
4843static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
4844			    size_t space_left, int *bytes_copied)
4845{
4846	struct sctp_sockaddr_entry *addr;
4847	union sctp_addr temp;
4848	int cnt = 0;
4849	int addrlen;
4850	struct net *net = sock_net(sk);
4851
4852	rcu_read_lock();
4853	list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
4854		if (!addr->valid)
4855			continue;
4856
4857		if ((PF_INET == sk->sk_family) &&
4858		    (AF_INET6 == addr->a.sa.sa_family))
4859			continue;
4860		if ((PF_INET6 == sk->sk_family) &&
4861		    inet_v6_ipv6only(sk) &&
4862		    (AF_INET == addr->a.sa.sa_family))
4863			continue;
4864		memcpy(&temp, &addr->a, sizeof(temp));
4865		if (!temp.v4.sin_port)
4866			temp.v4.sin_port = htons(port);
4867
4868		addrlen = sctp_get_pf_specific(sk->sk_family)
4869			      ->addr_to_user(sctp_sk(sk), &temp);
4870
4871		if (space_left < addrlen) {
4872			cnt =  -ENOMEM;
4873			break;
4874		}
4875		memcpy(to, &temp, addrlen);
4876
4877		to += addrlen;
4878		cnt++;
4879		space_left -= addrlen;
4880		*bytes_copied += addrlen;
4881	}
4882	rcu_read_unlock();
4883
4884	return cnt;
4885}
4886
4887
4888static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
4889				       char __user *optval, int __user *optlen)
4890{
4891	struct sctp_bind_addr *bp;
4892	struct sctp_association *asoc;
4893	int cnt = 0;
4894	struct sctp_getaddrs getaddrs;
4895	struct sctp_sockaddr_entry *addr;
4896	void __user *to;
4897	union sctp_addr temp;
4898	struct sctp_sock *sp = sctp_sk(sk);
4899	int addrlen;
4900	int err = 0;
4901	size_t space_left;
4902	int bytes_copied = 0;
4903	void *addrs;
4904	void *buf;
4905
4906	if (len < sizeof(struct sctp_getaddrs))
4907		return -EINVAL;
4908
4909	if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
4910		return -EFAULT;
4911
4912	/*
4913	 *  For UDP-style sockets, id specifies the association to query.
4914	 *  If the id field is set to the value '0' then the locally bound
4915	 *  addresses are returned without regard to any particular
4916	 *  association.
4917	 */
4918	if (0 == getaddrs.assoc_id) {
4919		bp = &sctp_sk(sk)->ep->base.bind_addr;
4920	} else {
4921		asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
4922		if (!asoc)
4923			return -EINVAL;
4924		bp = &asoc->base.bind_addr;
4925	}
4926
4927	to = optval + offsetof(struct sctp_getaddrs, addrs);
4928	space_left = len - offsetof(struct sctp_getaddrs, addrs);
4929
4930	addrs = kmalloc(space_left, GFP_KERNEL);
4931	if (!addrs)
4932		return -ENOMEM;
4933
4934	/* If the endpoint is bound to 0.0.0.0 or ::0, get the valid
4935	 * addresses from the global local address list.
4936	 */
4937	if (sctp_list_single_entry(&bp->address_list)) {
4938		addr = list_entry(bp->address_list.next,
4939				  struct sctp_sockaddr_entry, list);
4940		if (sctp_is_any(sk, &addr->a)) {
4941			cnt = sctp_copy_laddrs(sk, bp->port, addrs,
4942						space_left, &bytes_copied);
4943			if (cnt < 0) {
4944				err = cnt;
4945				goto out;
4946			}
4947			goto copy_getaddrs;
4948		}
4949	}
4950
4951	buf = addrs;
4952	/* Protection on the bound address list is not needed since
4953	 * in the socket option context we hold a socket lock and
4954	 * thus the bound address list can't change.
4955	 */
4956	list_for_each_entry(addr, &bp->address_list, list) {
4957		memcpy(&temp, &addr->a, sizeof(temp));
4958		addrlen = sctp_get_pf_specific(sk->sk_family)
4959			      ->addr_to_user(sp, &temp);
4960		if (space_left < addrlen) {
4961			err =  -ENOMEM; /*fixme: right error?*/
4962			goto out;
4963		}
4964		memcpy(buf, &temp, addrlen);
4965		buf += addrlen;
4966		bytes_copied += addrlen;
4967		cnt++;
4968		space_left -= addrlen;
4969	}
4970
4971copy_getaddrs:
4972	if (copy_to_user(to, addrs, bytes_copied)) {
4973		err = -EFAULT;
4974		goto out;
4975	}
4976	if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num)) {
4977		err = -EFAULT;
4978		goto out;
4979	}
4980	if (put_user(bytes_copied, optlen))
4981		err = -EFAULT;
4982out:
4983	kfree(addrs);
4984	return err;
4985}
4986
4987/* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
4988 *
4989 * Requests that the local SCTP stack use the enclosed peer address as
4990 * the association primary.  The enclosed address must be one of the
4991 * association peer's addresses.
4992 */
4993static int sctp_getsockopt_primary_addr(struct sock *sk, int len,
4994					char __user *optval, int __user *optlen)
4995{
4996	struct sctp_prim prim;
4997	struct sctp_association *asoc;
4998	struct sctp_sock *sp = sctp_sk(sk);
4999
5000	if (len < sizeof(struct sctp_prim))
5001		return -EINVAL;
5002
5003	len = sizeof(struct sctp_prim);
5004
5005	if (copy_from_user(&prim, optval, len))
5006		return -EFAULT;
5007
5008	asoc = sctp_id2assoc(sk, prim.ssp_assoc_id);
5009	if (!asoc)
5010		return -EINVAL;
5011
5012	if (!asoc->peer.primary_path)
5013		return -ENOTCONN;
5014
5015	memcpy(&prim.ssp_addr, &asoc->peer.primary_path->ipaddr,
5016		asoc->peer.primary_path->af_specific->sockaddr_len);
5017
5018	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sp,
5019			(union sctp_addr *)&prim.ssp_addr);
5020
5021	if (put_user(len, optlen))
5022		return -EFAULT;
5023	if (copy_to_user(optval, &prim, len))
5024		return -EFAULT;
5025
5026	return 0;
5027}
5028
5029/*
5030 * 7.1.11  Set Adaptation Layer Indicator (SCTP_ADAPTATION_LAYER)
5031 *
5032 * Requests that the local endpoint set the specified Adaptation Layer
5033 * Indication parameter for all future INIT and INIT-ACK exchanges.
5034 */
5035static int sctp_getsockopt_adaptation_layer(struct sock *sk, int len,
5036				  char __user *optval, int __user *optlen)
5037{
5038	struct sctp_setadaptation adaptation;
5039
5040	if (len < sizeof(struct sctp_setadaptation))
5041		return -EINVAL;
5042
5043	len = sizeof(struct sctp_setadaptation);
5044
5045	adaptation.ssb_adaptation_ind = sctp_sk(sk)->adaptation_ind;
5046
5047	if (put_user(len, optlen))
5048		return -EFAULT;
5049	if (copy_to_user(optval, &adaptation, len))
5050		return -EFAULT;
5051
5052	return 0;
5053}
5054
5055/*
5056 *
5057 * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
5058 *
5059 *   Applications that wish to use the sendto() system call may wish to
5060 *   specify a default set of parameters that would normally be supplied
5061 *   through the inclusion of ancillary data.  This socket option allows
5062 *   such an application to set the default sctp_sndrcvinfo structure.
5063
5064
5065 *   The application that wishes to use this socket option simply passes
5066 *   in to this call the sctp_sndrcvinfo structure defined in Section
5067 *   5.2.2) The input parameters accepted by this call include
5068 *   sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
5069 *   sinfo_timetolive.  The user must provide the sinfo_assoc_id field in
5070 *   to this call if the caller is using the UDP model.
5071 *
5072 *   For getsockopt, it get the default sctp_sndrcvinfo structure.
5073 */
5074static int sctp_getsockopt_default_send_param(struct sock *sk,
5075					int len, char __user *optval,
5076					int __user *optlen)
5077{
5078	struct sctp_sock *sp = sctp_sk(sk);
5079	struct sctp_association *asoc;
5080	struct sctp_sndrcvinfo info;
5081
5082	if (len < sizeof(info))
5083		return -EINVAL;
5084
5085	len = sizeof(info);
5086
5087	if (copy_from_user(&info, optval, len))
5088		return -EFAULT;
5089
5090	asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
5091	if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
5092		return -EINVAL;
5093	if (asoc) {
5094		info.sinfo_stream = asoc->default_stream;
5095		info.sinfo_flags = asoc->default_flags;
5096		info.sinfo_ppid = asoc->default_ppid;
5097		info.sinfo_context = asoc->default_context;
5098		info.sinfo_timetolive = asoc->default_timetolive;
5099	} else {
5100		info.sinfo_stream = sp->default_stream;
5101		info.sinfo_flags = sp->default_flags;
5102		info.sinfo_ppid = sp->default_ppid;
5103		info.sinfo_context = sp->default_context;
5104		info.sinfo_timetolive = sp->default_timetolive;
5105	}
5106
5107	if (put_user(len, optlen))
5108		return -EFAULT;
5109	if (copy_to_user(optval, &info, len))
5110		return -EFAULT;
5111
5112	return 0;
5113}
5114
5115/* RFC6458, Section 8.1.31. Set/get Default Send Parameters
5116 * (SCTP_DEFAULT_SNDINFO)
5117 */
5118static int sctp_getsockopt_default_sndinfo(struct sock *sk, int len,
5119					   char __user *optval,
5120					   int __user *optlen)
5121{
5122	struct sctp_sock *sp = sctp_sk(sk);
5123	struct sctp_association *asoc;
5124	struct sctp_sndinfo info;
5125
5126	if (len < sizeof(info))
5127		return -EINVAL;
5128
5129	len = sizeof(info);
5130
5131	if (copy_from_user(&info, optval, len))
5132		return -EFAULT;
5133
5134	asoc = sctp_id2assoc(sk, info.snd_assoc_id);
5135	if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
5136		return -EINVAL;
5137	if (asoc) {
5138		info.snd_sid = asoc->default_stream;
5139		info.snd_flags = asoc->default_flags;
5140		info.snd_ppid = asoc->default_ppid;
5141		info.snd_context = asoc->default_context;
5142	} else {
5143		info.snd_sid = sp->default_stream;
5144		info.snd_flags = sp->default_flags;
5145		info.snd_ppid = sp->default_ppid;
5146		info.snd_context = sp->default_context;
5147	}
5148
5149	if (put_user(len, optlen))
5150		return -EFAULT;
5151	if (copy_to_user(optval, &info, len))
5152		return -EFAULT;
5153
5154	return 0;
5155}
5156
5157/*
5158 *
5159 * 7.1.5 SCTP_NODELAY
5160 *
5161 * Turn on/off any Nagle-like algorithm.  This means that packets are
5162 * generally sent as soon as possible and no unnecessary delays are
5163 * introduced, at the cost of more packets in the network.  Expects an
5164 * integer boolean flag.
5165 */
5166
5167static int sctp_getsockopt_nodelay(struct sock *sk, int len,
5168				   char __user *optval, int __user *optlen)
5169{
5170	int val;
5171
5172	if (len < sizeof(int))
5173		return -EINVAL;
5174
5175	len = sizeof(int);
5176	val = (sctp_sk(sk)->nodelay == 1);
5177	if (put_user(len, optlen))
5178		return -EFAULT;
5179	if (copy_to_user(optval, &val, len))
5180		return -EFAULT;
5181	return 0;
5182}
5183
5184/*
5185 *
5186 * 7.1.1 SCTP_RTOINFO
5187 *
5188 * The protocol parameters used to initialize and bound retransmission
5189 * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
5190 * and modify these parameters.
5191 * All parameters are time values, in milliseconds.  A value of 0, when
5192 * modifying the parameters, indicates that the current value should not
5193 * be changed.
5194 *
5195 */
5196static int sctp_getsockopt_rtoinfo(struct sock *sk, int len,
5197				char __user *optval,
5198				int __user *optlen) {
5199	struct sctp_rtoinfo rtoinfo;
5200	struct sctp_association *asoc;
5201
5202	if (len < sizeof (struct sctp_rtoinfo))
5203		return -EINVAL;
5204
5205	len = sizeof(struct sctp_rtoinfo);
5206
5207	if (copy_from_user(&rtoinfo, optval, len))
5208		return -EFAULT;
5209
5210	asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
5211
5212	if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
5213		return -EINVAL;
5214
5215	/* Values corresponding to the specific association. */
5216	if (asoc) {
5217		rtoinfo.srto_initial = jiffies_to_msecs(asoc->rto_initial);
5218		rtoinfo.srto_max = jiffies_to_msecs(asoc->rto_max);
5219		rtoinfo.srto_min = jiffies_to_msecs(asoc->rto_min);
5220	} else {
5221		/* Values corresponding to the endpoint. */
5222		struct sctp_sock *sp = sctp_sk(sk);
5223
5224		rtoinfo.srto_initial = sp->rtoinfo.srto_initial;
5225		rtoinfo.srto_max = sp->rtoinfo.srto_max;
5226		rtoinfo.srto_min = sp->rtoinfo.srto_min;
5227	}
5228
5229	if (put_user(len, optlen))
5230		return -EFAULT;
5231
5232	if (copy_to_user(optval, &rtoinfo, len))
5233		return -EFAULT;
5234
5235	return 0;
5236}
5237
5238/*
5239 *
5240 * 7.1.2 SCTP_ASSOCINFO
5241 *
5242 * This option is used to tune the maximum retransmission attempts
5243 * of the association.
5244 * Returns an error if the new association retransmission value is
5245 * greater than the sum of the retransmission value  of the peer.
5246 * See [SCTP] for more information.
5247 *
5248 */
5249static int sctp_getsockopt_associnfo(struct sock *sk, int len,
5250				     char __user *optval,
5251				     int __user *optlen)
5252{
5253
5254	struct sctp_assocparams assocparams;
5255	struct sctp_association *asoc;
5256	struct list_head *pos;
5257	int cnt = 0;
5258
5259	if (len < sizeof (struct sctp_assocparams))
5260		return -EINVAL;
5261
5262	len = sizeof(struct sctp_assocparams);
5263
5264	if (copy_from_user(&assocparams, optval, len))
5265		return -EFAULT;
5266
5267	asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
5268
5269	if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
5270		return -EINVAL;
5271
5272	/* Values correspoinding to the specific association */
5273	if (asoc) {
5274		assocparams.sasoc_asocmaxrxt = asoc->max_retrans;
5275		assocparams.sasoc_peer_rwnd = asoc->peer.rwnd;
5276		assocparams.sasoc_local_rwnd = asoc->a_rwnd;
5277		assocparams.sasoc_cookie_life = ktime_to_ms(asoc->cookie_life);
5278
5279		list_for_each(pos, &asoc->peer.transport_addr_list) {
5280			cnt++;
5281		}
5282
5283		assocparams.sasoc_number_peer_destinations = cnt;
5284	} else {
5285		/* Values corresponding to the endpoint */
5286		struct sctp_sock *sp = sctp_sk(sk);
5287
5288		assocparams.sasoc_asocmaxrxt = sp->assocparams.sasoc_asocmaxrxt;
5289		assocparams.sasoc_peer_rwnd = sp->assocparams.sasoc_peer_rwnd;
5290		assocparams.sasoc_local_rwnd = sp->assocparams.sasoc_local_rwnd;
5291		assocparams.sasoc_cookie_life =
5292					sp->assocparams.sasoc_cookie_life;
5293		assocparams.sasoc_number_peer_destinations =
5294					sp->assocparams.
5295					sasoc_number_peer_destinations;
5296	}
5297
5298	if (put_user(len, optlen))
5299		return -EFAULT;
5300
5301	if (copy_to_user(optval, &assocparams, len))
5302		return -EFAULT;
5303
5304	return 0;
5305}
5306
5307/*
5308 * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
5309 *
5310 * This socket option is a boolean flag which turns on or off mapped V4
5311 * addresses.  If this option is turned on and the socket is type
5312 * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
5313 * If this option is turned off, then no mapping will be done of V4
5314 * addresses and a user will receive both PF_INET6 and PF_INET type
5315 * addresses on the socket.
5316 */
5317static int sctp_getsockopt_mappedv4(struct sock *sk, int len,
5318				    char __user *optval, int __user *optlen)
5319{
5320	int val;
5321	struct sctp_sock *sp = sctp_sk(sk);
5322
5323	if (len < sizeof(int))
5324		return -EINVAL;
5325
5326	len = sizeof(int);
5327	val = sp->v4mapped;
5328	if (put_user(len, optlen))
5329		return -EFAULT;
5330	if (copy_to_user(optval, &val, len))
5331		return -EFAULT;
5332
5333	return 0;
5334}
5335
5336/*
5337 * 7.1.29.  Set or Get the default context (SCTP_CONTEXT)
5338 * (chapter and verse is quoted at sctp_setsockopt_context())
5339 */
5340static int sctp_getsockopt_context(struct sock *sk, int len,
5341				   char __user *optval, int __user *optlen)
5342{
5343	struct sctp_assoc_value params;
5344	struct sctp_sock *sp;
5345	struct sctp_association *asoc;
5346
5347	if (len < sizeof(struct sctp_assoc_value))
5348		return -EINVAL;
5349
5350	len = sizeof(struct sctp_assoc_value);
5351
5352	if (copy_from_user(&params, optval, len))
5353		return -EFAULT;
5354
5355	sp = sctp_sk(sk);
5356
5357	if (params.assoc_id != 0) {
5358		asoc = sctp_id2assoc(sk, params.assoc_id);
5359		if (!asoc)
5360			return -EINVAL;
5361		params.assoc_value = asoc->default_rcv_context;
5362	} else {
5363		params.assoc_value = sp->default_rcv_context;
5364	}
5365
5366	if (put_user(len, optlen))
5367		return -EFAULT;
5368	if (copy_to_user(optval, &params, len))
5369		return -EFAULT;
5370
5371	return 0;
5372}
5373
5374/*
5375 * 8.1.16.  Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
5376 * This option will get or set the maximum size to put in any outgoing
5377 * SCTP DATA chunk.  If a message is larger than this size it will be
5378 * fragmented by SCTP into the specified size.  Note that the underlying
5379 * SCTP implementation may fragment into smaller sized chunks when the
5380 * PMTU of the underlying association is smaller than the value set by
5381 * the user.  The default value for this option is '0' which indicates
5382 * the user is NOT limiting fragmentation and only the PMTU will effect
5383 * SCTP's choice of DATA chunk size.  Note also that values set larger
5384 * than the maximum size of an IP datagram will effectively let SCTP
5385 * control fragmentation (i.e. the same as setting this option to 0).
5386 *
5387 * The following structure is used to access and modify this parameter:
5388 *
5389 * struct sctp_assoc_value {
5390 *   sctp_assoc_t assoc_id;
5391 *   uint32_t assoc_value;
5392 * };
5393 *
5394 * assoc_id:  This parameter is ignored for one-to-one style sockets.
5395 *    For one-to-many style sockets this parameter indicates which
5396 *    association the user is performing an action upon.  Note that if
5397 *    this field's value is zero then the endpoints default value is
5398 *    changed (effecting future associations only).
5399 * assoc_value:  This parameter specifies the maximum size in bytes.
5400 */
5401static int sctp_getsockopt_maxseg(struct sock *sk, int len,
5402				  char __user *optval, int __user *optlen)
5403{
5404	struct sctp_assoc_value params;
5405	struct sctp_association *asoc;
5406
5407	if (len == sizeof(int)) {
5408		pr_warn_ratelimited(DEPRECATED
5409				    "%s (pid %d) "
5410				    "Use of int in maxseg socket option.\n"
5411				    "Use struct sctp_assoc_value instead\n",
5412				    current->comm, task_pid_nr(current));
5413		params.assoc_id = 0;
5414	} else if (len >= sizeof(struct sctp_assoc_value)) {
5415		len = sizeof(struct sctp_assoc_value);
5416		if (copy_from_user(&params, optval, sizeof(params)))
5417			return -EFAULT;
5418	} else
5419		return -EINVAL;
5420
5421	asoc = sctp_id2assoc(sk, params.assoc_id);
5422	if (!asoc && params.assoc_id && sctp_style(sk, UDP))
5423		return -EINVAL;
5424
5425	if (asoc)
5426		params.assoc_value = asoc->frag_point;
5427	else
5428		params.assoc_value = sctp_sk(sk)->user_frag;
5429
5430	if (put_user(len, optlen))
5431		return -EFAULT;
5432	if (len == sizeof(int)) {
5433		if (copy_to_user(optval, &params.assoc_value, len))
5434			return -EFAULT;
5435	} else {
5436		if (copy_to_user(optval, &params, len))
5437			return -EFAULT;
5438	}
5439
5440	return 0;
5441}
5442
5443/*
5444 * 7.1.24.  Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
5445 * (chapter and verse is quoted at sctp_setsockopt_fragment_interleave())
5446 */
5447static int sctp_getsockopt_fragment_interleave(struct sock *sk, int len,
5448					       char __user *optval, int __user *optlen)
5449{
5450	int val;
5451
5452	if (len < sizeof(int))
5453		return -EINVAL;
5454
5455	len = sizeof(int);
5456
5457	val = sctp_sk(sk)->frag_interleave;
5458	if (put_user(len, optlen))
5459		return -EFAULT;
5460	if (copy_to_user(optval, &val, len))
5461		return -EFAULT;
5462
5463	return 0;
5464}
5465
5466/*
5467 * 7.1.25.  Set or Get the sctp partial delivery point
5468 * (chapter and verse is quoted at sctp_setsockopt_partial_delivery_point())
5469 */
5470static int sctp_getsockopt_partial_delivery_point(struct sock *sk, int len,
5471						  char __user *optval,
5472						  int __user *optlen)
5473{
5474	u32 val;
5475
5476	if (len < sizeof(u32))
5477		return -EINVAL;
5478
5479	len = sizeof(u32);
5480
5481	val = sctp_sk(sk)->pd_point;
5482	if (put_user(len, optlen))
5483		return -EFAULT;
5484	if (copy_to_user(optval, &val, len))
5485		return -EFAULT;
5486
5487	return 0;
5488}
5489
5490/*
5491 * 7.1.28.  Set or Get the maximum burst (SCTP_MAX_BURST)
5492 * (chapter and verse is quoted at sctp_setsockopt_maxburst())
5493 */
5494static int sctp_getsockopt_maxburst(struct sock *sk, int len,
5495				    char __user *optval,
5496				    int __user *optlen)
5497{
5498	struct sctp_assoc_value params;
5499	struct sctp_sock *sp;
5500	struct sctp_association *asoc;
5501
5502	if (len == sizeof(int)) {
5503		pr_warn_ratelimited(DEPRECATED
5504				    "%s (pid %d) "
5505				    "Use of int in max_burst socket option.\n"
5506				    "Use struct sctp_assoc_value instead\n",
5507				    current->comm, task_pid_nr(current));
5508		params.assoc_id = 0;
5509	} else if (len >= sizeof(struct sctp_assoc_value)) {
5510		len = sizeof(struct sctp_assoc_value);
5511		if (copy_from_user(&params, optval, len))
5512			return -EFAULT;
5513	} else
5514		return -EINVAL;
5515
5516	sp = sctp_sk(sk);
5517
5518	if (params.assoc_id != 0) {
5519		asoc = sctp_id2assoc(sk, params.assoc_id);
5520		if (!asoc)
5521			return -EINVAL;
5522		params.assoc_value = asoc->max_burst;
5523	} else
5524		params.assoc_value = sp->max_burst;
5525
5526	if (len == sizeof(int)) {
5527		if (copy_to_user(optval, &params.assoc_value, len))
5528			return -EFAULT;
5529	} else {
5530		if (copy_to_user(optval, &params, len))
5531			return -EFAULT;
5532	}
5533
5534	return 0;
5535
5536}
5537
5538static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
5539				    char __user *optval, int __user *optlen)
5540{
5541	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5542	struct sctp_hmacalgo  __user *p = (void __user *)optval;
5543	struct sctp_hmac_algo_param *hmacs;
5544	__u16 data_len = 0;
5545	u32 num_idents;
5546
5547	if (!ep->auth_enable)
5548		return -EACCES;
5549
5550	hmacs = ep->auth_hmacs_list;
5551	data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
5552
5553	if (len < sizeof(struct sctp_hmacalgo) + data_len)
5554		return -EINVAL;
5555
5556	len = sizeof(struct sctp_hmacalgo) + data_len;
5557	num_idents = data_len / sizeof(u16);
5558
5559	if (put_user(len, optlen))
5560		return -EFAULT;
5561	if (put_user(num_idents, &p->shmac_num_idents))
5562		return -EFAULT;
5563	if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
5564		return -EFAULT;
5565	return 0;
5566}
5567
5568static int sctp_getsockopt_active_key(struct sock *sk, int len,
5569				    char __user *optval, int __user *optlen)
5570{
5571	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5572	struct sctp_authkeyid val;
5573	struct sctp_association *asoc;
5574
5575	if (!ep->auth_enable)
5576		return -EACCES;
5577
5578	if (len < sizeof(struct sctp_authkeyid))
5579		return -EINVAL;
5580	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
5581		return -EFAULT;
5582
5583	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
5584	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
5585		return -EINVAL;
5586
5587	if (asoc)
5588		val.scact_keynumber = asoc->active_key_id;
5589	else
5590		val.scact_keynumber = ep->active_key_id;
5591
5592	len = sizeof(struct sctp_authkeyid);
5593	if (put_user(len, optlen))
5594		return -EFAULT;
5595	if (copy_to_user(optval, &val, len))
5596		return -EFAULT;
5597
5598	return 0;
5599}
5600
5601static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5602				    char __user *optval, int __user *optlen)
5603{
5604	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5605	struct sctp_authchunks __user *p = (void __user *)optval;
5606	struct sctp_authchunks val;
5607	struct sctp_association *asoc;
5608	struct sctp_chunks_param *ch;
5609	u32    num_chunks = 0;
5610	char __user *to;
5611
5612	if (!ep->auth_enable)
5613		return -EACCES;
5614
5615	if (len < sizeof(struct sctp_authchunks))
5616		return -EINVAL;
5617
5618	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5619		return -EFAULT;
5620
5621	to = p->gauth_chunks;
5622	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
5623	if (!asoc)
5624		return -EINVAL;
5625
5626	ch = asoc->peer.peer_chunks;
5627	if (!ch)
5628		goto num;
5629
5630	/* See if the user provided enough room for all the data */
5631	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5632	if (len < num_chunks)
5633		return -EINVAL;
5634
5635	if (copy_to_user(to, ch->chunks, num_chunks))
5636		return -EFAULT;
5637num:
5638	len = sizeof(struct sctp_authchunks) + num_chunks;
5639	if (put_user(len, optlen))
5640		return -EFAULT;
5641	if (put_user(num_chunks, &p->gauth_number_of_chunks))
5642		return -EFAULT;
5643	return 0;
5644}
5645
5646static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5647				    char __user *optval, int __user *optlen)
5648{
5649	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5650	struct sctp_authchunks __user *p = (void __user *)optval;
5651	struct sctp_authchunks val;
5652	struct sctp_association *asoc;
5653	struct sctp_chunks_param *ch;
5654	u32    num_chunks = 0;
5655	char __user *to;
5656
5657	if (!ep->auth_enable)
5658		return -EACCES;
5659
5660	if (len < sizeof(struct sctp_authchunks))
5661		return -EINVAL;
5662
5663	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5664		return -EFAULT;
5665
5666	to = p->gauth_chunks;
5667	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
5668	if (!asoc && val.gauth_assoc_id && sctp_style(sk, UDP))
5669		return -EINVAL;
5670
5671	if (asoc)
5672		ch = (struct sctp_chunks_param *)asoc->c.auth_chunks;
5673	else
5674		ch = ep->auth_chunk_list;
5675
5676	if (!ch)
5677		goto num;
5678
5679	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5680	if (len < sizeof(struct sctp_authchunks) + num_chunks)
5681		return -EINVAL;
5682
5683	if (copy_to_user(to, ch->chunks, num_chunks))
5684		return -EFAULT;
5685num:
5686	len = sizeof(struct sctp_authchunks) + num_chunks;
5687	if (put_user(len, optlen))
5688		return -EFAULT;
5689	if (put_user(num_chunks, &p->gauth_number_of_chunks))
5690		return -EFAULT;
5691
5692	return 0;
5693}
5694
5695/*
5696 * 8.2.5.  Get the Current Number of Associations (SCTP_GET_ASSOC_NUMBER)
5697 * This option gets the current number of associations that are attached
5698 * to a one-to-many style socket.  The option value is an uint32_t.
5699 */
5700static int sctp_getsockopt_assoc_number(struct sock *sk, int len,
5701				    char __user *optval, int __user *optlen)
5702{
5703	struct sctp_sock *sp = sctp_sk(sk);
5704	struct sctp_association *asoc;
5705	u32 val = 0;
5706
5707	if (sctp_style(sk, TCP))
5708		return -EOPNOTSUPP;
5709
5710	if (len < sizeof(u32))
5711		return -EINVAL;
5712
5713	len = sizeof(u32);
5714
5715	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5716		val++;
5717	}
5718
5719	if (put_user(len, optlen))
5720		return -EFAULT;
5721	if (copy_to_user(optval, &val, len))
5722		return -EFAULT;
5723
5724	return 0;
5725}
5726
5727/*
5728 * 8.1.23 SCTP_AUTO_ASCONF
5729 * See the corresponding setsockopt entry as description
5730 */
5731static int sctp_getsockopt_auto_asconf(struct sock *sk, int len,
5732				   char __user *optval, int __user *optlen)
5733{
5734	int val = 0;
5735
5736	if (len < sizeof(int))
5737		return -EINVAL;
5738
5739	len = sizeof(int);
5740	if (sctp_sk(sk)->do_auto_asconf && sctp_is_ep_boundall(sk))
5741		val = 1;
5742	if (put_user(len, optlen))
5743		return -EFAULT;
5744	if (copy_to_user(optval, &val, len))
5745		return -EFAULT;
5746	return 0;
5747}
5748
5749/*
5750 * 8.2.6. Get the Current Identifiers of Associations
5751 *        (SCTP_GET_ASSOC_ID_LIST)
5752 *
5753 * This option gets the current list of SCTP association identifiers of
5754 * the SCTP associations handled by a one-to-many style socket.
5755 */
5756static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
5757				    char __user *optval, int __user *optlen)
5758{
5759	struct sctp_sock *sp = sctp_sk(sk);
5760	struct sctp_association *asoc;
5761	struct sctp_assoc_ids *ids;
5762	u32 num = 0;
5763
5764	if (sctp_style(sk, TCP))
5765		return -EOPNOTSUPP;
5766
5767	if (len < sizeof(struct sctp_assoc_ids))
5768		return -EINVAL;
5769
5770	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5771		num++;
5772	}
5773
5774	if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
5775		return -EINVAL;
5776
5777	len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
5778
5779	ids = kmalloc(len, GFP_KERNEL);
5780	if (unlikely(!ids))
5781		return -ENOMEM;
5782
5783	ids->gaids_number_of_ids = num;
5784	num = 0;
5785	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5786		ids->gaids_assoc_id[num++] = asoc->assoc_id;
5787	}
5788
5789	if (put_user(len, optlen) || copy_to_user(optval, ids, len)) {
5790		kfree(ids);
5791		return -EFAULT;
5792	}
5793
5794	kfree(ids);
5795	return 0;
5796}
5797
5798/*
5799 * SCTP_PEER_ADDR_THLDS
5800 *
5801 * This option allows us to fetch the partially failed threshold for one or all
5802 * transports in an association.  See Section 6.1 of:
5803 * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
5804 */
5805static int sctp_getsockopt_paddr_thresholds(struct sock *sk,
5806					    char __user *optval,
5807					    int len,
5808					    int __user *optlen)
5809{
5810	struct sctp_paddrthlds val;
5811	struct sctp_transport *trans;
5812	struct sctp_association *asoc;
5813
5814	if (len < sizeof(struct sctp_paddrthlds))
5815		return -EINVAL;
5816	len = sizeof(struct sctp_paddrthlds);
5817	if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval, len))
5818		return -EFAULT;
5819
5820	if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
5821		asoc = sctp_id2assoc(sk, val.spt_assoc_id);
5822		if (!asoc)
5823			return -ENOENT;
5824
5825		val.spt_pathpfthld = asoc->pf_retrans;
5826		val.spt_pathmaxrxt = asoc->pathmaxrxt;
5827	} else {
5828		trans = sctp_addr_id2transport(sk, &val.spt_address,
5829					       val.spt_assoc_id);
5830		if (!trans)
5831			return -ENOENT;
5832
5833		val.spt_pathmaxrxt = trans->pathmaxrxt;
5834		val.spt_pathpfthld = trans->pf_retrans;
5835	}
5836
5837	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
5838		return -EFAULT;
5839
5840	return 0;
5841}
5842
5843/*
5844 * SCTP_GET_ASSOC_STATS
5845 *
5846 * This option retrieves local per endpoint statistics. It is modeled
5847 * after OpenSolaris' implementation
5848 */
5849static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
5850				       char __user *optval,
5851				       int __user *optlen)
5852{
5853	struct sctp_assoc_stats sas;
5854	struct sctp_association *asoc = NULL;
5855
5856	/* User must provide at least the assoc id */
5857	if (len < sizeof(sctp_assoc_t))
5858		return -EINVAL;
5859
5860	/* Allow the struct to grow and fill in as much as possible */
5861	len = min_t(size_t, len, sizeof(sas));
5862
5863	if (copy_from_user(&sas, optval, len))
5864		return -EFAULT;
5865
5866	asoc = sctp_id2assoc(sk, sas.sas_assoc_id);
5867	if (!asoc)
5868		return -EINVAL;
5869
5870	sas.sas_rtxchunks = asoc->stats.rtxchunks;
5871	sas.sas_gapcnt = asoc->stats.gapcnt;
5872	sas.sas_outofseqtsns = asoc->stats.outofseqtsns;
5873	sas.sas_osacks = asoc->stats.osacks;
5874	sas.sas_isacks = asoc->stats.isacks;
5875	sas.sas_octrlchunks = asoc->stats.octrlchunks;
5876	sas.sas_ictrlchunks = asoc->stats.ictrlchunks;
5877	sas.sas_oodchunks = asoc->stats.oodchunks;
5878	sas.sas_iodchunks = asoc->stats.iodchunks;
5879	sas.sas_ouodchunks = asoc->stats.ouodchunks;
5880	sas.sas_iuodchunks = asoc->stats.iuodchunks;
5881	sas.sas_idupchunks = asoc->stats.idupchunks;
5882	sas.sas_opackets = asoc->stats.opackets;
5883	sas.sas_ipackets = asoc->stats.ipackets;
5884
5885	/* New high max rto observed, will return 0 if not a single
5886	 * RTO update took place. obs_rto_ipaddr will be bogus
5887	 * in such a case
5888	 */
5889	sas.sas_maxrto = asoc->stats.max_obs_rto;
5890	memcpy(&sas.sas_obs_rto_ipaddr, &asoc->stats.obs_rto_ipaddr,
5891		sizeof(struct sockaddr_storage));
5892
5893	/* Mark beginning of a new observation period */
5894	asoc->stats.max_obs_rto = asoc->rto_min;
5895
5896	if (put_user(len, optlen))
5897		return -EFAULT;
5898
5899	pr_debug("%s: len:%d, assoc_id:%d\n", __func__, len, sas.sas_assoc_id);
5900
5901	if (copy_to_user(optval, &sas, len))
5902		return -EFAULT;
5903
5904	return 0;
5905}
5906
5907static int sctp_getsockopt_recvrcvinfo(struct sock *sk,	int len,
5908				       char __user *optval,
5909				       int __user *optlen)
5910{
5911	int val = 0;
5912
5913	if (len < sizeof(int))
5914		return -EINVAL;
5915
5916	len = sizeof(int);
5917	if (sctp_sk(sk)->recvrcvinfo)
5918		val = 1;
5919	if (put_user(len, optlen))
5920		return -EFAULT;
5921	if (copy_to_user(optval, &val, len))
5922		return -EFAULT;
5923
5924	return 0;
5925}
5926
5927static int sctp_getsockopt_recvnxtinfo(struct sock *sk,	int len,
5928				       char __user *optval,
5929				       int __user *optlen)
5930{
5931	int val = 0;
5932
5933	if (len < sizeof(int))
5934		return -EINVAL;
5935
5936	len = sizeof(int);
5937	if (sctp_sk(sk)->recvnxtinfo)
5938		val = 1;
5939	if (put_user(len, optlen))
5940		return -EFAULT;
5941	if (copy_to_user(optval, &val, len))
5942		return -EFAULT;
5943
5944	return 0;
5945}
5946
5947static int sctp_getsockopt(struct sock *sk, int level, int optname,
5948			   char __user *optval, int __user *optlen)
5949{
5950	int retval = 0;
5951	int len;
5952
5953	pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
5954
5955	/* I can hardly begin to describe how wrong this is.  This is
5956	 * so broken as to be worse than useless.  The API draft
5957	 * REALLY is NOT helpful here...  I am not convinced that the
5958	 * semantics of getsockopt() with a level OTHER THAN SOL_SCTP
5959	 * are at all well-founded.
5960	 */
5961	if (level != SOL_SCTP) {
5962		struct sctp_af *af = sctp_sk(sk)->pf->af;
5963
5964		retval = af->getsockopt(sk, level, optname, optval, optlen);
5965		return retval;
5966	}
5967
5968	if (get_user(len, optlen))
5969		return -EFAULT;
5970
5971	lock_sock(sk);
5972
5973	switch (optname) {
5974	case SCTP_STATUS:
5975		retval = sctp_getsockopt_sctp_status(sk, len, optval, optlen);
5976		break;
5977	case SCTP_DISABLE_FRAGMENTS:
5978		retval = sctp_getsockopt_disable_fragments(sk, len, optval,
5979							   optlen);
5980		break;
5981	case SCTP_EVENTS:
5982		retval = sctp_getsockopt_events(sk, len, optval, optlen);
5983		break;
5984	case SCTP_AUTOCLOSE:
5985		retval = sctp_getsockopt_autoclose(sk, len, optval, optlen);
5986		break;
5987	case SCTP_SOCKOPT_PEELOFF:
5988		retval = sctp_getsockopt_peeloff(sk, len, optval, optlen);
5989		break;
5990	case SCTP_PEER_ADDR_PARAMS:
5991		retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
5992							  optlen);
5993		break;
5994	case SCTP_DELAYED_SACK:
5995		retval = sctp_getsockopt_delayed_ack(sk, len, optval,
5996							  optlen);
5997		break;
5998	case SCTP_INITMSG:
5999		retval = sctp_getsockopt_initmsg(sk, len, optval, optlen);
6000		break;
6001	case SCTP_GET_PEER_ADDRS:
6002		retval = sctp_getsockopt_peer_addrs(sk, len, optval,
6003						    optlen);
6004		break;
6005	case SCTP_GET_LOCAL_ADDRS:
6006		retval = sctp_getsockopt_local_addrs(sk, len, optval,
6007						     optlen);
6008		break;
6009	case SCTP_SOCKOPT_CONNECTX3:
6010		retval = sctp_getsockopt_connectx3(sk, len, optval, optlen);
6011		break;
6012	case SCTP_DEFAULT_SEND_PARAM:
6013		retval = sctp_getsockopt_default_send_param(sk, len,
6014							    optval, optlen);
6015		break;
6016	case SCTP_DEFAULT_SNDINFO:
6017		retval = sctp_getsockopt_default_sndinfo(sk, len,
6018							 optval, optlen);
6019		break;
6020	case SCTP_PRIMARY_ADDR:
6021		retval = sctp_getsockopt_primary_addr(sk, len, optval, optlen);
6022		break;
6023	case SCTP_NODELAY:
6024		retval = sctp_getsockopt_nodelay(sk, len, optval, optlen);
6025		break;
6026	case SCTP_RTOINFO:
6027		retval = sctp_getsockopt_rtoinfo(sk, len, optval, optlen);
6028		break;
6029	case SCTP_ASSOCINFO:
6030		retval = sctp_getsockopt_associnfo(sk, len, optval, optlen);
6031		break;
6032	case SCTP_I_WANT_MAPPED_V4_ADDR:
6033		retval = sctp_getsockopt_mappedv4(sk, len, optval, optlen);
6034		break;
6035	case SCTP_MAXSEG:
6036		retval = sctp_getsockopt_maxseg(sk, len, optval, optlen);
6037		break;
6038	case SCTP_GET_PEER_ADDR_INFO:
6039		retval = sctp_getsockopt_peer_addr_info(sk, len, optval,
6040							optlen);
6041		break;
6042	case SCTP_ADAPTATION_LAYER:
6043		retval = sctp_getsockopt_adaptation_layer(sk, len, optval,
6044							optlen);
6045		break;
6046	case SCTP_CONTEXT:
6047		retval = sctp_getsockopt_context(sk, len, optval, optlen);
6048		break;
6049	case SCTP_FRAGMENT_INTERLEAVE:
6050		retval = sctp_getsockopt_fragment_interleave(sk, len, optval,
6051							     optlen);
6052		break;
6053	case SCTP_PARTIAL_DELIVERY_POINT:
6054		retval = sctp_getsockopt_partial_delivery_point(sk, len, optval,
6055								optlen);
6056		break;
6057	case SCTP_MAX_BURST:
6058		retval = sctp_getsockopt_maxburst(sk, len, optval, optlen);
6059		break;
6060	case SCTP_AUTH_KEY:
6061	case SCTP_AUTH_CHUNK:
6062	case SCTP_AUTH_DELETE_KEY:
6063		retval = -EOPNOTSUPP;
6064		break;
6065	case SCTP_HMAC_IDENT:
6066		retval = sctp_getsockopt_hmac_ident(sk, len, optval, optlen);
6067		break;
6068	case SCTP_AUTH_ACTIVE_KEY:
6069		retval = sctp_getsockopt_active_key(sk, len, optval, optlen);
6070		break;
6071	case SCTP_PEER_AUTH_CHUNKS:
6072		retval = sctp_getsockopt_peer_auth_chunks(sk, len, optval,
6073							optlen);
6074		break;
6075	case SCTP_LOCAL_AUTH_CHUNKS:
6076		retval = sctp_getsockopt_local_auth_chunks(sk, len, optval,
6077							optlen);
6078		break;
6079	case SCTP_GET_ASSOC_NUMBER:
6080		retval = sctp_getsockopt_assoc_number(sk, len, optval, optlen);
6081		break;
6082	case SCTP_GET_ASSOC_ID_LIST:
6083		retval = sctp_getsockopt_assoc_ids(sk, len, optval, optlen);
6084		break;
6085	case SCTP_AUTO_ASCONF:
6086		retval = sctp_getsockopt_auto_asconf(sk, len, optval, optlen);
6087		break;
6088	case SCTP_PEER_ADDR_THLDS:
6089		retval = sctp_getsockopt_paddr_thresholds(sk, optval, len, optlen);
6090		break;
6091	case SCTP_GET_ASSOC_STATS:
6092		retval = sctp_getsockopt_assoc_stats(sk, len, optval, optlen);
6093		break;
6094	case SCTP_RECVRCVINFO:
6095		retval = sctp_getsockopt_recvrcvinfo(sk, len, optval, optlen);
6096		break;
6097	case SCTP_RECVNXTINFO:
6098		retval = sctp_getsockopt_recvnxtinfo(sk, len, optval, optlen);
6099		break;
6100	default:
6101		retval = -ENOPROTOOPT;
6102		break;
6103	}
6104
6105	release_sock(sk);
6106	return retval;
6107}
6108
6109static void sctp_hash(struct sock *sk)
6110{
6111	/* STUB */
6112}
6113
6114static void sctp_unhash(struct sock *sk)
6115{
6116	/* STUB */
6117}
6118
6119/* Check if port is acceptable.  Possibly find first available port.
6120 *
6121 * The port hash table (contained in the 'global' SCTP protocol storage
6122 * returned by struct sctp_protocol *sctp_get_protocol()). The hash
6123 * table is an array of 4096 lists (sctp_bind_hashbucket). Each
6124 * list (the list number is the port number hashed out, so as you
6125 * would expect from a hash function, all the ports in a given list have
6126 * such a number that hashes out to the same list number; you were
6127 * expecting that, right?); so each list has a set of ports, with a
6128 * link to the socket (struct sock) that uses it, the port number and
6129 * a fastreuse flag (FIXME: NPI ipg).
6130 */
6131static struct sctp_bind_bucket *sctp_bucket_create(
6132	struct sctp_bind_hashbucket *head, struct net *, unsigned short snum);
6133
6134static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
6135{
6136	struct sctp_bind_hashbucket *head; /* hash list */
6137	struct sctp_bind_bucket *pp;
6138	unsigned short snum;
6139	int ret;
6140
6141	snum = ntohs(addr->v4.sin_port);
6142
6143	pr_debug("%s: begins, snum:%d\n", __func__, snum);
6144
6145	local_bh_disable();
6146
6147	if (snum == 0) {
6148		/* Search for an available port. */
6149		int low, high, remaining, index;
6150		unsigned int rover;
6151		struct net *net = sock_net(sk);
6152
6153		inet_get_local_port_range(net, &low, &high);
6154		remaining = (high - low) + 1;
6155		rover = prandom_u32() % remaining + low;
6156
6157		do {
6158			rover++;
6159			if ((rover < low) || (rover > high))
6160				rover = low;
6161			if (inet_is_local_reserved_port(net, rover))
6162				continue;
6163			index = sctp_phashfn(sock_net(sk), rover);
6164			head = &sctp_port_hashtable[index];
6165			spin_lock(&head->lock);
6166			sctp_for_each_hentry(pp, &head->chain)
6167				if ((pp->port == rover) &&
6168				    net_eq(sock_net(sk), pp->net))
6169					goto next;
6170			break;
6171		next:
6172			spin_unlock(&head->lock);
6173		} while (--remaining > 0);
6174
6175		/* Exhausted local port range during search? */
6176		ret = 1;
6177		if (remaining <= 0)
6178			goto fail;
6179
6180		/* OK, here is the one we will use.  HEAD (the port
6181		 * hash table list entry) is non-NULL and we hold it's
6182		 * mutex.
6183		 */
6184		snum = rover;
6185	} else {
6186		/* We are given an specific port number; we verify
6187		 * that it is not being used. If it is used, we will
6188		 * exahust the search in the hash list corresponding
6189		 * to the port number (snum) - we detect that with the
6190		 * port iterator, pp being NULL.
6191		 */
6192		head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
6193		spin_lock(&head->lock);
6194		sctp_for_each_hentry(pp, &head->chain) {
6195			if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
6196				goto pp_found;
6197		}
6198	}
6199	pp = NULL;
6200	goto pp_not_found;
6201pp_found:
6202	if (!hlist_empty(&pp->owner)) {
6203		/* We had a port hash table hit - there is an
6204		 * available port (pp != NULL) and it is being
6205		 * used by other socket (pp->owner not empty); that other
6206		 * socket is going to be sk2.
6207		 */
6208		int reuse = sk->sk_reuse;
6209		struct sock *sk2;
6210
6211		pr_debug("%s: found a possible match\n", __func__);
6212
6213		if (pp->fastreuse && sk->sk_reuse &&
6214			sk->sk_state != SCTP_SS_LISTENING)
6215			goto success;
6216
6217		/* Run through the list of sockets bound to the port
6218		 * (pp->port) [via the pointers bind_next and
6219		 * bind_pprev in the struct sock *sk2 (pp->sk)]. On each one,
6220		 * we get the endpoint they describe and run through
6221		 * the endpoint's list of IP (v4 or v6) addresses,
6222		 * comparing each of the addresses with the address of
6223		 * the socket sk. If we find a match, then that means
6224		 * that this port/socket (sk) combination are already
6225		 * in an endpoint.
6226		 */
6227		sk_for_each_bound(sk2, &pp->owner) {
6228			struct sctp_endpoint *ep2;
6229			ep2 = sctp_sk(sk2)->ep;
6230
6231			if (sk == sk2 ||
6232			    (reuse && sk2->sk_reuse &&
6233			     sk2->sk_state != SCTP_SS_LISTENING))
6234				continue;
6235
6236			if (sctp_bind_addr_conflict(&ep2->base.bind_addr, addr,
6237						 sctp_sk(sk2), sctp_sk(sk))) {
6238				ret = (long)sk2;
6239				goto fail_unlock;
6240			}
6241		}
6242
6243		pr_debug("%s: found a match\n", __func__);
6244	}
6245pp_not_found:
6246	/* If there was a hash table miss, create a new port.  */
6247	ret = 1;
6248	if (!pp && !(pp = sctp_bucket_create(head, sock_net(sk), snum)))
6249		goto fail_unlock;
6250
6251	/* In either case (hit or miss), make sure fastreuse is 1 only
6252	 * if sk->sk_reuse is too (that is, if the caller requested
6253	 * SO_REUSEADDR on this socket -sk-).
6254	 */
6255	if (hlist_empty(&pp->owner)) {
6256		if (sk->sk_reuse && sk->sk_state != SCTP_SS_LISTENING)
6257			pp->fastreuse = 1;
6258		else
6259			pp->fastreuse = 0;
6260	} else if (pp->fastreuse &&
6261		(!sk->sk_reuse || sk->sk_state == SCTP_SS_LISTENING))
6262		pp->fastreuse = 0;
6263
6264	/* We are set, so fill up all the data in the hash table
6265	 * entry, tie the socket list information with the rest of the
6266	 * sockets FIXME: Blurry, NPI (ipg).
6267	 */
6268success:
6269	if (!sctp_sk(sk)->bind_hash) {
6270		inet_sk(sk)->inet_num = snum;
6271		sk_add_bind_node(sk, &pp->owner);
6272		sctp_sk(sk)->bind_hash = pp;
6273	}
6274	ret = 0;
6275
6276fail_unlock:
6277	spin_unlock(&head->lock);
6278
6279fail:
6280	local_bh_enable();
6281	return ret;
6282}
6283
6284/* Assign a 'snum' port to the socket.  If snum == 0, an ephemeral
6285 * port is requested.
6286 */
6287static int sctp_get_port(struct sock *sk, unsigned short snum)
6288{
6289	union sctp_addr addr;
6290	struct sctp_af *af = sctp_sk(sk)->pf->af;
6291
6292	/* Set up a dummy address struct from the sk. */
6293	af->from_sk(&addr, sk);
6294	addr.v4.sin_port = htons(snum);
6295
6296	/* Note: sk->sk_num gets filled in if ephemeral port request. */
6297	return !!sctp_get_port_local(sk, &addr);
6298}
6299
6300/*
6301 *  Move a socket to LISTENING state.
6302 */
6303static int sctp_listen_start(struct sock *sk, int backlog)
6304{
6305	struct sctp_sock *sp = sctp_sk(sk);
6306	struct sctp_endpoint *ep = sp->ep;
6307	struct crypto_hash *tfm = NULL;
6308	char alg[32];
6309
6310	/* Allocate HMAC for generating cookie. */
6311	if (!sp->hmac && sp->sctp_hmac_alg) {
6312		sprintf(alg, "hmac(%s)", sp->sctp_hmac_alg);
6313		tfm = crypto_alloc_hash(alg, 0, CRYPTO_ALG_ASYNC);
6314		if (IS_ERR(tfm)) {
6315			net_info_ratelimited("failed to load transform for %s: %ld\n",
6316					     sp->sctp_hmac_alg, PTR_ERR(tfm));
6317			return -ENOSYS;
6318		}
6319		sctp_sk(sk)->hmac = tfm;
6320	}
6321
6322	/*
6323	 * If a bind() or sctp_bindx() is not called prior to a listen()
6324	 * call that allows new associations to be accepted, the system
6325	 * picks an ephemeral port and will choose an address set equivalent
6326	 * to binding with a wildcard address.
6327	 *
6328	 * This is not currently spelled out in the SCTP sockets
6329	 * extensions draft, but follows the practice as seen in TCP
6330	 * sockets.
6331	 *
6332	 */
6333	sk->sk_state = SCTP_SS_LISTENING;
6334	if (!ep->base.bind_addr.port) {
6335		if (sctp_autobind(sk))
6336			return -EAGAIN;
6337	} else {
6338		if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
6339			sk->sk_state = SCTP_SS_CLOSED;
6340			return -EADDRINUSE;
6341		}
6342	}
6343
6344	sk->sk_max_ack_backlog = backlog;
6345	sctp_hash_endpoint(ep);
6346	return 0;
6347}
6348
6349/*
6350 * 4.1.3 / 5.1.3 listen()
6351 *
6352 *   By default, new associations are not accepted for UDP style sockets.
6353 *   An application uses listen() to mark a socket as being able to
6354 *   accept new associations.
6355 *
6356 *   On TCP style sockets, applications use listen() to ready the SCTP
6357 *   endpoint for accepting inbound associations.
6358 *
6359 *   On both types of endpoints a backlog of '0' disables listening.
6360 *
6361 *  Move a socket to LISTENING state.
6362 */
6363int sctp_inet_listen(struct socket *sock, int backlog)
6364{
6365	struct sock *sk = sock->sk;
6366	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6367	int err = -EINVAL;
6368
6369	if (unlikely(backlog < 0))
6370		return err;
6371
6372	lock_sock(sk);
6373
6374	/* Peeled-off sockets are not allowed to listen().  */
6375	if (sctp_style(sk, UDP_HIGH_BANDWIDTH))
6376		goto out;
6377
6378	if (sock->state != SS_UNCONNECTED)
6379		goto out;
6380
6381	/* If backlog is zero, disable listening. */
6382	if (!backlog) {
6383		if (sctp_sstate(sk, CLOSED))
6384			goto out;
6385
6386		err = 0;
6387		sctp_unhash_endpoint(ep);
6388		sk->sk_state = SCTP_SS_CLOSED;
6389		if (sk->sk_reuse)
6390			sctp_sk(sk)->bind_hash->fastreuse = 1;
6391		goto out;
6392	}
6393
6394	/* If we are already listening, just update the backlog */
6395	if (sctp_sstate(sk, LISTENING))
6396		sk->sk_max_ack_backlog = backlog;
6397	else {
6398		err = sctp_listen_start(sk, backlog);
6399		if (err)
6400			goto out;
6401	}
6402
6403	err = 0;
6404out:
6405	release_sock(sk);
6406	return err;
6407}
6408
6409/*
6410 * This function is done by modeling the current datagram_poll() and the
6411 * tcp_poll().  Note that, based on these implementations, we don't
6412 * lock the socket in this function, even though it seems that,
6413 * ideally, locking or some other mechanisms can be used to ensure
6414 * the integrity of the counters (sndbuf and wmem_alloc) used
6415 * in this place.  We assume that we don't need locks either until proven
6416 * otherwise.
6417 *
6418 * Another thing to note is that we include the Async I/O support
6419 * here, again, by modeling the current TCP/UDP code.  We don't have
6420 * a good way to test with it yet.
6421 */
6422unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
6423{
6424	struct sock *sk = sock->sk;
6425	struct sctp_sock *sp = sctp_sk(sk);
6426	unsigned int mask;
6427
6428	poll_wait(file, sk_sleep(sk), wait);
6429
6430	/* A TCP-style listening socket becomes readable when the accept queue
6431	 * is not empty.
6432	 */
6433	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
6434		return (!list_empty(&sp->ep->asocs)) ?
6435			(POLLIN | POLLRDNORM) : 0;
6436
6437	mask = 0;
6438
6439	/* Is there any exceptional events?  */
6440	if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
6441		mask |= POLLERR |
6442			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
6443	if (sk->sk_shutdown & RCV_SHUTDOWN)
6444		mask |= POLLRDHUP | POLLIN | POLLRDNORM;
6445	if (sk->sk_shutdown == SHUTDOWN_MASK)
6446		mask |= POLLHUP;
6447
6448	/* Is it readable?  Reconsider this code with TCP-style support.  */
6449	if (!skb_queue_empty(&sk->sk_receive_queue))
6450		mask |= POLLIN | POLLRDNORM;
6451
6452	/* The association is either gone or not ready.  */
6453	if (!sctp_style(sk, UDP) && sctp_sstate(sk, CLOSED))
6454		return mask;
6455
6456	/* Is it writable?  */
6457	if (sctp_writeable(sk)) {
6458		mask |= POLLOUT | POLLWRNORM;
6459	} else {
6460		set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
6461		/*
6462		 * Since the socket is not locked, the buffer
6463		 * might be made available after the writeable check and
6464		 * before the bit is set.  This could cause a lost I/O
6465		 * signal.  tcp_poll() has a race breaker for this race
6466		 * condition.  Based on their implementation, we put
6467		 * in the following code to cover it as well.
6468		 */
6469		if (sctp_writeable(sk))
6470			mask |= POLLOUT | POLLWRNORM;
6471	}
6472	return mask;
6473}
6474
6475/********************************************************************
6476 * 2nd Level Abstractions
6477 ********************************************************************/
6478
6479static struct sctp_bind_bucket *sctp_bucket_create(
6480	struct sctp_bind_hashbucket *head, struct net *net, unsigned short snum)
6481{
6482	struct sctp_bind_bucket *pp;
6483
6484	pp = kmem_cache_alloc(sctp_bucket_cachep, GFP_ATOMIC);
6485	if (pp) {
6486		SCTP_DBG_OBJCNT_INC(bind_bucket);
6487		pp->port = snum;
6488		pp->fastreuse = 0;
6489		INIT_HLIST_HEAD(&pp->owner);
6490		pp->net = net;
6491		hlist_add_head(&pp->node, &head->chain);
6492	}
6493	return pp;
6494}
6495
6496/* Caller must hold hashbucket lock for this tb with local BH disabled */
6497static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
6498{
6499	if (pp && hlist_empty(&pp->owner)) {
6500		__hlist_del(&pp->node);
6501		kmem_cache_free(sctp_bucket_cachep, pp);
6502		SCTP_DBG_OBJCNT_DEC(bind_bucket);
6503	}
6504}
6505
6506/* Release this socket's reference to a local port.  */
6507static inline void __sctp_put_port(struct sock *sk)
6508{
6509	struct sctp_bind_hashbucket *head =
6510		&sctp_port_hashtable[sctp_phashfn(sock_net(sk),
6511						  inet_sk(sk)->inet_num)];
6512	struct sctp_bind_bucket *pp;
6513
6514	spin_lock(&head->lock);
6515	pp = sctp_sk(sk)->bind_hash;
6516	__sk_del_bind_node(sk);
6517	sctp_sk(sk)->bind_hash = NULL;
6518	inet_sk(sk)->inet_num = 0;
6519	sctp_bucket_destroy(pp);
6520	spin_unlock(&head->lock);
6521}
6522
6523void sctp_put_port(struct sock *sk)
6524{
6525	local_bh_disable();
6526	__sctp_put_port(sk);
6527	local_bh_enable();
6528}
6529
6530/*
6531 * The system picks an ephemeral port and choose an address set equivalent
6532 * to binding with a wildcard address.
6533 * One of those addresses will be the primary address for the association.
6534 * This automatically enables the multihoming capability of SCTP.
6535 */
6536static int sctp_autobind(struct sock *sk)
6537{
6538	union sctp_addr autoaddr;
6539	struct sctp_af *af;
6540	__be16 port;
6541
6542	/* Initialize a local sockaddr structure to INADDR_ANY. */
6543	af = sctp_sk(sk)->pf->af;
6544
6545	port = htons(inet_sk(sk)->inet_num);
6546	af->inaddr_any(&autoaddr, port);
6547
6548	return sctp_do_bind(sk, &autoaddr, af->sockaddr_len);
6549}
6550
6551/* Parse out IPPROTO_SCTP CMSG headers.  Perform only minimal validation.
6552 *
6553 * From RFC 2292
6554 * 4.2 The cmsghdr Structure *
6555 *
6556 * When ancillary data is sent or received, any number of ancillary data
6557 * objects can be specified by the msg_control and msg_controllen members of
6558 * the msghdr structure, because each object is preceded by
6559 * a cmsghdr structure defining the object's length (the cmsg_len member).
6560 * Historically Berkeley-derived implementations have passed only one object
6561 * at a time, but this API allows multiple objects to be
6562 * passed in a single call to sendmsg() or recvmsg(). The following example
6563 * shows two ancillary data objects in a control buffer.
6564 *
6565 *   |<--------------------------- msg_controllen -------------------------->|
6566 *   |                                                                       |
6567 *
6568 *   |<----- ancillary data object ----->|<----- ancillary data object ----->|
6569 *
6570 *   |<---------- CMSG_SPACE() --------->|<---------- CMSG_SPACE() --------->|
6571 *   |                                   |                                   |
6572 *
6573 *   |<---------- cmsg_len ---------->|  |<--------- cmsg_len ----------->|  |
6574 *
6575 *   |<--------- CMSG_LEN() --------->|  |<-------- CMSG_LEN() ---------->|  |
6576 *   |                                |  |                                |  |
6577 *
6578 *   +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
6579 *   |cmsg_|cmsg_|cmsg_|XX|           |XX|cmsg_|cmsg_|cmsg_|XX|           |XX|
6580 *
6581 *   |len  |level|type |XX|cmsg_data[]|XX|len  |level|type |XX|cmsg_data[]|XX|
6582 *
6583 *   +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
6584 *    ^
6585 *    |
6586 *
6587 * msg_control
6588 * points here
6589 */
6590static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
6591{
6592	struct cmsghdr *cmsg;
6593	struct msghdr *my_msg = (struct msghdr *)msg;
6594
6595	for (cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL;
6596	     cmsg = CMSG_NXTHDR(my_msg, cmsg)) {
6597		if (!CMSG_OK(my_msg, cmsg))
6598			return -EINVAL;
6599
6600		/* Should we parse this header or ignore?  */
6601		if (cmsg->cmsg_level != IPPROTO_SCTP)
6602			continue;
6603
6604		/* Strictly check lengths following example in SCM code.  */
6605		switch (cmsg->cmsg_type) {
6606		case SCTP_INIT:
6607			/* SCTP Socket API Extension
6608			 * 5.3.1 SCTP Initiation Structure (SCTP_INIT)
6609			 *
6610			 * This cmsghdr structure provides information for
6611			 * initializing new SCTP associations with sendmsg().
6612			 * The SCTP_INITMSG socket option uses this same data
6613			 * structure.  This structure is not used for
6614			 * recvmsg().
6615			 *
6616			 * cmsg_level    cmsg_type      cmsg_data[]
6617			 * ------------  ------------   ----------------------
6618			 * IPPROTO_SCTP  SCTP_INIT      struct sctp_initmsg
6619			 */
6620			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_initmsg)))
6621				return -EINVAL;
6622
6623			cmsgs->init = CMSG_DATA(cmsg);
6624			break;
6625
6626		case SCTP_SNDRCV:
6627			/* SCTP Socket API Extension
6628			 * 5.3.2 SCTP Header Information Structure(SCTP_SNDRCV)
6629			 *
6630			 * This cmsghdr structure specifies SCTP options for
6631			 * sendmsg() and describes SCTP header information
6632			 * about a received message through recvmsg().
6633			 *
6634			 * cmsg_level    cmsg_type      cmsg_data[]
6635			 * ------------  ------------   ----------------------
6636			 * IPPROTO_SCTP  SCTP_SNDRCV    struct sctp_sndrcvinfo
6637			 */
6638			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndrcvinfo)))
6639				return -EINVAL;
6640
6641			cmsgs->srinfo = CMSG_DATA(cmsg);
6642
6643			if (cmsgs->srinfo->sinfo_flags &
6644			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
6645			      SCTP_ABORT | SCTP_EOF))
6646				return -EINVAL;
6647			break;
6648
6649		case SCTP_SNDINFO:
6650			/* SCTP Socket API Extension
6651			 * 5.3.4 SCTP Send Information Structure (SCTP_SNDINFO)
6652			 *
6653			 * This cmsghdr structure specifies SCTP options for
6654			 * sendmsg(). This structure and SCTP_RCVINFO replaces
6655			 * SCTP_SNDRCV which has been deprecated.
6656			 *
6657			 * cmsg_level    cmsg_type      cmsg_data[]
6658			 * ------------  ------------   ---------------------
6659			 * IPPROTO_SCTP  SCTP_SNDINFO    struct sctp_sndinfo
6660			 */
6661			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndinfo)))
6662				return -EINVAL;
6663
6664			cmsgs->sinfo = CMSG_DATA(cmsg);
6665
6666			if (cmsgs->sinfo->snd_flags &
6667			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
6668			      SCTP_ABORT | SCTP_EOF))
6669				return -EINVAL;
6670			break;
6671		default:
6672			return -EINVAL;
6673		}
6674	}
6675
6676	return 0;
6677}
6678
6679/*
6680 * Wait for a packet..
6681 * Note: This function is the same function as in core/datagram.c
6682 * with a few modifications to make lksctp work.
6683 */
6684static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p)
6685{
6686	int error;
6687	DEFINE_WAIT(wait);
6688
6689	prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
6690
6691	/* Socket errors? */
6692	error = sock_error(sk);
6693	if (error)
6694		goto out;
6695
6696	if (!skb_queue_empty(&sk->sk_receive_queue))
6697		goto ready;
6698
6699	/* Socket shut down?  */
6700	if (sk->sk_shutdown & RCV_SHUTDOWN)
6701		goto out;
6702
6703	/* Sequenced packets can come disconnected.  If so we report the
6704	 * problem.
6705	 */
6706	error = -ENOTCONN;
6707
6708	/* Is there a good reason to think that we may receive some data?  */
6709	if (list_empty(&sctp_sk(sk)->ep->asocs) && !sctp_sstate(sk, LISTENING))
6710		goto out;
6711
6712	/* Handle signals.  */
6713	if (signal_pending(current))
6714		goto interrupted;
6715
6716	/* Let another process have a go.  Since we are going to sleep
6717	 * anyway.  Note: This may cause odd behaviors if the message
6718	 * does not fit in the user's buffer, but this seems to be the
6719	 * only way to honor MSG_DONTWAIT realistically.
6720	 */
6721	release_sock(sk);
6722	*timeo_p = schedule_timeout(*timeo_p);
6723	lock_sock(sk);
6724
6725ready:
6726	finish_wait(sk_sleep(sk), &wait);
6727	return 0;
6728
6729interrupted:
6730	error = sock_intr_errno(*timeo_p);
6731
6732out:
6733	finish_wait(sk_sleep(sk), &wait);
6734	*err = error;
6735	return error;
6736}
6737
6738/* Receive a datagram.
6739 * Note: This is pretty much the same routine as in core/datagram.c
6740 * with a few changes to make lksctp work.
6741 */
6742struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
6743				       int noblock, int *err)
6744{
6745	int error;
6746	struct sk_buff *skb;
6747	long timeo;
6748
6749	timeo = sock_rcvtimeo(sk, noblock);
6750
6751	pr_debug("%s: timeo:%ld, max:%ld\n", __func__, timeo,
6752		 MAX_SCHEDULE_TIMEOUT);
6753
6754	do {
6755		/* Again only user level code calls this function,
6756		 * so nothing interrupt level
6757		 * will suddenly eat the receive_queue.
6758		 *
6759		 *  Look at current nfs client by the way...
6760		 *  However, this function was correct in any case. 8)
6761		 */
6762		if (flags & MSG_PEEK) {
6763			spin_lock_bh(&sk->sk_receive_queue.lock);
6764			skb = skb_peek(&sk->sk_receive_queue);
6765			if (skb)
6766				atomic_inc(&skb->users);
6767			spin_unlock_bh(&sk->sk_receive_queue.lock);
6768		} else {
6769			skb = skb_dequeue(&sk->sk_receive_queue);
6770		}
6771
6772		if (skb)
6773			return skb;
6774
6775		/* Caller is allowed not to check sk->sk_err before calling. */
6776		error = sock_error(sk);
6777		if (error)
6778			goto no_packet;
6779
6780		if (sk->sk_shutdown & RCV_SHUTDOWN)
6781			break;
6782
6783		if (sk_can_busy_loop(sk) &&
6784		    sk_busy_loop(sk, noblock))
6785			continue;
6786
6787		/* User doesn't want to wait.  */
6788		error = -EAGAIN;
6789		if (!timeo)
6790			goto no_packet;
6791	} while (sctp_wait_for_packet(sk, err, &timeo) == 0);
6792
6793	return NULL;
6794
6795no_packet:
6796	*err = error;
6797	return NULL;
6798}
6799
6800/* If sndbuf has changed, wake up per association sndbuf waiters.  */
6801static void __sctp_write_space(struct sctp_association *asoc)
6802{
6803	struct sock *sk = asoc->base.sk;
6804	struct socket *sock = sk->sk_socket;
6805
6806	if ((sctp_wspace(asoc) > 0) && sock) {
6807		if (waitqueue_active(&asoc->wait))
6808			wake_up_interruptible(&asoc->wait);
6809
6810		if (sctp_writeable(sk)) {
6811			wait_queue_head_t *wq = sk_sleep(sk);
6812
6813			if (wq && waitqueue_active(wq))
6814				wake_up_interruptible(wq);
6815
6816			/* Note that we try to include the Async I/O support
6817			 * here by modeling from the current TCP/UDP code.
6818			 * We have not tested with it yet.
6819			 */
6820			if (!(sk->sk_shutdown & SEND_SHUTDOWN))
6821				sock_wake_async(sock,
6822						SOCK_WAKE_SPACE, POLL_OUT);
6823		}
6824	}
6825}
6826
6827static void sctp_wake_up_waiters(struct sock *sk,
6828				 struct sctp_association *asoc)
6829{
6830	struct sctp_association *tmp = asoc;
6831
6832	/* We do accounting for the sndbuf space per association,
6833	 * so we only need to wake our own association.
6834	 */
6835	if (asoc->ep->sndbuf_policy)
6836		return __sctp_write_space(asoc);
6837
6838	/* If association goes down and is just flushing its
6839	 * outq, then just normally notify others.
6840	 */
6841	if (asoc->base.dead)
6842		return sctp_write_space(sk);
6843
6844	/* Accounting for the sndbuf space is per socket, so we
6845	 * need to wake up others, try to be fair and in case of
6846	 * other associations, let them have a go first instead
6847	 * of just doing a sctp_write_space() call.
6848	 *
6849	 * Note that we reach sctp_wake_up_waiters() only when
6850	 * associations free up queued chunks, thus we are under
6851	 * lock and the list of associations on a socket is
6852	 * guaranteed not to change.
6853	 */
6854	for (tmp = list_next_entry(tmp, asocs); 1;
6855	     tmp = list_next_entry(tmp, asocs)) {
6856		/* Manually skip the head element. */
6857		if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
6858			continue;
6859		/* Wake up association. */
6860		__sctp_write_space(tmp);
6861		/* We've reached the end. */
6862		if (tmp == asoc)
6863			break;
6864	}
6865}
6866
6867/* Do accounting for the sndbuf space.
6868 * Decrement the used sndbuf space of the corresponding association by the
6869 * data size which was just transmitted(freed).
6870 */
6871static void sctp_wfree(struct sk_buff *skb)
6872{
6873	struct sctp_association *asoc;
6874	struct sctp_chunk *chunk;
6875	struct sock *sk;
6876
6877	/* Get the saved chunk pointer.  */
6878	chunk = *((struct sctp_chunk **)(skb->cb));
6879	asoc = chunk->asoc;
6880	sk = asoc->base.sk;
6881	asoc->sndbuf_used -= SCTP_DATA_SNDSIZE(chunk) +
6882				sizeof(struct sk_buff) +
6883				sizeof(struct sctp_chunk);
6884
6885	atomic_sub(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
6886
6887	/*
6888	 * This undoes what is done via sctp_set_owner_w and sk_mem_charge
6889	 */
6890	sk->sk_wmem_queued   -= skb->truesize;
6891	sk_mem_uncharge(sk, skb->truesize);
6892
6893	sock_wfree(skb);
6894	sctp_wake_up_waiters(sk, asoc);
6895
6896	sctp_association_put(asoc);
6897}
6898
6899/* Do accounting for the receive space on the socket.
6900 * Accounting for the association is done in ulpevent.c
6901 * We set this as a destructor for the cloned data skbs so that
6902 * accounting is done at the correct time.
6903 */
6904void sctp_sock_rfree(struct sk_buff *skb)
6905{
6906	struct sock *sk = skb->sk;
6907	struct sctp_ulpevent *event = sctp_skb2event(skb);
6908
6909	atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
6910
6911	/*
6912	 * Mimic the behavior of sock_rfree
6913	 */
6914	sk_mem_uncharge(sk, event->rmem_len);
6915}
6916
6917
6918/* Helper function to wait for space in the sndbuf.  */
6919static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
6920				size_t msg_len)
6921{
6922	struct sock *sk = asoc->base.sk;
6923	int err = 0;
6924	long current_timeo = *timeo_p;
6925	DEFINE_WAIT(wait);
6926
6927	pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
6928		 *timeo_p, msg_len);
6929
6930	/* Increment the association's refcnt.  */
6931	sctp_association_hold(asoc);
6932
6933	/* Wait on the association specific sndbuf space. */
6934	for (;;) {
6935		prepare_to_wait_exclusive(&asoc->wait, &wait,
6936					  TASK_INTERRUPTIBLE);
6937		if (!*timeo_p)
6938			goto do_nonblock;
6939		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
6940		    asoc->base.dead)
6941			goto do_error;
6942		if (signal_pending(current))
6943			goto do_interrupted;
6944		if (msg_len <= sctp_wspace(asoc))
6945			break;
6946
6947		/* Let another process have a go.  Since we are going
6948		 * to sleep anyway.
6949		 */
6950		release_sock(sk);
6951		current_timeo = schedule_timeout(current_timeo);
6952		BUG_ON(sk != asoc->base.sk);
6953		lock_sock(sk);
6954
6955		*timeo_p = current_timeo;
6956	}
6957
6958out:
6959	finish_wait(&asoc->wait, &wait);
6960
6961	/* Release the association's refcnt.  */
6962	sctp_association_put(asoc);
6963
6964	return err;
6965
6966do_error:
6967	err = -EPIPE;
6968	goto out;
6969
6970do_interrupted:
6971	err = sock_intr_errno(*timeo_p);
6972	goto out;
6973
6974do_nonblock:
6975	err = -EAGAIN;
6976	goto out;
6977}
6978
6979void sctp_data_ready(struct sock *sk)
6980{
6981	struct socket_wq *wq;
6982
6983	rcu_read_lock();
6984	wq = rcu_dereference(sk->sk_wq);
6985	if (wq_has_sleeper(wq))
6986		wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
6987						POLLRDNORM | POLLRDBAND);
6988	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
6989	rcu_read_unlock();
6990}
6991
6992/* If socket sndbuf has changed, wake up all per association waiters.  */
6993void sctp_write_space(struct sock *sk)
6994{
6995	struct sctp_association *asoc;
6996
6997	/* Wake up the tasks in each wait queue.  */
6998	list_for_each_entry(asoc, &((sctp_sk(sk))->ep->asocs), asocs) {
6999		__sctp_write_space(asoc);
7000	}
7001}
7002
7003/* Is there any sndbuf space available on the socket?
7004 *
7005 * Note that sk_wmem_alloc is the sum of the send buffers on all of the
7006 * associations on the same socket.  For a UDP-style socket with
7007 * multiple associations, it is possible for it to be "unwriteable"
7008 * prematurely.  I assume that this is acceptable because
7009 * a premature "unwriteable" is better than an accidental "writeable" which
7010 * would cause an unwanted block under certain circumstances.  For the 1-1
7011 * UDP-style sockets or TCP-style sockets, this code should work.
7012 *  - Daisy
7013 */
7014static int sctp_writeable(struct sock *sk)
7015{
7016	int amt = 0;
7017
7018	amt = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
7019	if (amt < 0)
7020		amt = 0;
7021	return amt;
7022}
7023
7024/* Wait for an association to go into ESTABLISHED state. If timeout is 0,
7025 * returns immediately with EINPROGRESS.
7026 */
7027static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
7028{
7029	struct sock *sk = asoc->base.sk;
7030	int err = 0;
7031	long current_timeo = *timeo_p;
7032	DEFINE_WAIT(wait);
7033
7034	pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
7035
7036	/* Increment the association's refcnt.  */
7037	sctp_association_hold(asoc);
7038
7039	for (;;) {
7040		prepare_to_wait_exclusive(&asoc->wait, &wait,
7041					  TASK_INTERRUPTIBLE);
7042		if (!*timeo_p)
7043			goto do_nonblock;
7044		if (sk->sk_shutdown & RCV_SHUTDOWN)
7045			break;
7046		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
7047		    asoc->base.dead)
7048			goto do_error;
7049		if (signal_pending(current))
7050			goto do_interrupted;
7051
7052		if (sctp_state(asoc, ESTABLISHED))
7053			break;
7054
7055		/* Let another process have a go.  Since we are going
7056		 * to sleep anyway.
7057		 */
7058		release_sock(sk);
7059		current_timeo = schedule_timeout(current_timeo);
7060		lock_sock(sk);
7061
7062		*timeo_p = current_timeo;
7063	}
7064
7065out:
7066	finish_wait(&asoc->wait, &wait);
7067
7068	/* Release the association's refcnt.  */
7069	sctp_association_put(asoc);
7070
7071	return err;
7072
7073do_error:
7074	if (asoc->init_err_counter + 1 > asoc->max_init_attempts)
7075		err = -ETIMEDOUT;
7076	else
7077		err = -ECONNREFUSED;
7078	goto out;
7079
7080do_interrupted:
7081	err = sock_intr_errno(*timeo_p);
7082	goto out;
7083
7084do_nonblock:
7085	err = -EINPROGRESS;
7086	goto out;
7087}
7088
7089static int sctp_wait_for_accept(struct sock *sk, long timeo)
7090{
7091	struct sctp_endpoint *ep;
7092	int err = 0;
7093	DEFINE_WAIT(wait);
7094
7095	ep = sctp_sk(sk)->ep;
7096
7097
7098	for (;;) {
7099		prepare_to_wait_exclusive(sk_sleep(sk), &wait,
7100					  TASK_INTERRUPTIBLE);
7101
7102		if (list_empty(&ep->asocs)) {
7103			release_sock(sk);
7104			timeo = schedule_timeout(timeo);
7105			lock_sock(sk);
7106		}
7107
7108		err = -EINVAL;
7109		if (!sctp_sstate(sk, LISTENING))
7110			break;
7111
7112		err = 0;
7113		if (!list_empty(&ep->asocs))
7114			break;
7115
7116		err = sock_intr_errno(timeo);
7117		if (signal_pending(current))
7118			break;
7119
7120		err = -EAGAIN;
7121		if (!timeo)
7122			break;
7123	}
7124
7125	finish_wait(sk_sleep(sk), &wait);
7126
7127	return err;
7128}
7129
7130static void sctp_wait_for_close(struct sock *sk, long timeout)
7131{
7132	DEFINE_WAIT(wait);
7133
7134	do {
7135		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
7136		if (list_empty(&sctp_sk(sk)->ep->asocs))
7137			break;
7138		release_sock(sk);
7139		timeout = schedule_timeout(timeout);
7140		lock_sock(sk);
7141	} while (!signal_pending(current) && timeout);
7142
7143	finish_wait(sk_sleep(sk), &wait);
7144}
7145
7146static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
7147{
7148	struct sk_buff *frag;
7149
7150	if (!skb->data_len)
7151		goto done;
7152
7153	/* Don't forget the fragments. */
7154	skb_walk_frags(skb, frag)
7155		sctp_skb_set_owner_r_frag(frag, sk);
7156
7157done:
7158	sctp_skb_set_owner_r(skb, sk);
7159}
7160
7161void sctp_copy_sock(struct sock *newsk, struct sock *sk,
7162		    struct sctp_association *asoc)
7163{
7164	struct inet_sock *inet = inet_sk(sk);
7165	struct inet_sock *newinet;
7166
7167	newsk->sk_type = sk->sk_type;
7168	newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
7169	newsk->sk_flags = sk->sk_flags;
7170	newsk->sk_no_check_tx = sk->sk_no_check_tx;
7171	newsk->sk_no_check_rx = sk->sk_no_check_rx;
7172	newsk->sk_reuse = sk->sk_reuse;
7173
7174	newsk->sk_shutdown = sk->sk_shutdown;
7175	newsk->sk_destruct = sctp_destruct_sock;
7176	newsk->sk_family = sk->sk_family;
7177	newsk->sk_protocol = IPPROTO_SCTP;
7178	newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
7179	newsk->sk_sndbuf = sk->sk_sndbuf;
7180	newsk->sk_rcvbuf = sk->sk_rcvbuf;
7181	newsk->sk_lingertime = sk->sk_lingertime;
7182	newsk->sk_rcvtimeo = sk->sk_rcvtimeo;
7183	newsk->sk_sndtimeo = sk->sk_sndtimeo;
7184
7185	newinet = inet_sk(newsk);
7186
7187	/* Initialize sk's sport, dport, rcv_saddr and daddr for
7188	 * getsockname() and getpeername()
7189	 */
7190	newinet->inet_sport = inet->inet_sport;
7191	newinet->inet_saddr = inet->inet_saddr;
7192	newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
7193	newinet->inet_dport = htons(asoc->peer.port);
7194	newinet->pmtudisc = inet->pmtudisc;
7195	newinet->inet_id = asoc->next_tsn ^ jiffies;
7196
7197	newinet->uc_ttl = inet->uc_ttl;
7198	newinet->mc_loop = 1;
7199	newinet->mc_ttl = 1;
7200	newinet->mc_index = 0;
7201	newinet->mc_list = NULL;
7202}
7203
7204/* Populate the fields of the newsk from the oldsk and migrate the assoc
7205 * and its messages to the newsk.
7206 */
7207static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
7208			      struct sctp_association *assoc,
7209			      sctp_socket_type_t type)
7210{
7211	struct sctp_sock *oldsp = sctp_sk(oldsk);
7212	struct sctp_sock *newsp = sctp_sk(newsk);
7213	struct sctp_bind_bucket *pp; /* hash list port iterator */
7214	struct sctp_endpoint *newep = newsp->ep;
7215	struct sk_buff *skb, *tmp;
7216	struct sctp_ulpevent *event;
7217	struct sctp_bind_hashbucket *head;
7218	struct list_head tmplist;
7219
7220	/* Migrate socket buffer sizes and all the socket level options to the
7221	 * new socket.
7222	 */
7223	newsk->sk_sndbuf = oldsk->sk_sndbuf;
7224	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
7225	/* Brute force copy old sctp opt. */
7226	if (oldsp->do_auto_asconf) {
7227		memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
7228		inet_sk_copy_descendant(newsk, oldsk);
7229		memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
7230	} else
7231		inet_sk_copy_descendant(newsk, oldsk);
7232
7233	/* Restore the ep value that was overwritten with the above structure
7234	 * copy.
7235	 */
7236	newsp->ep = newep;
7237	newsp->hmac = NULL;
7238
7239	/* Hook this new socket in to the bind_hash list. */
7240	head = &sctp_port_hashtable[sctp_phashfn(sock_net(oldsk),
7241						 inet_sk(oldsk)->inet_num)];
7242	local_bh_disable();
7243	spin_lock(&head->lock);
7244	pp = sctp_sk(oldsk)->bind_hash;
7245	sk_add_bind_node(newsk, &pp->owner);
7246	sctp_sk(newsk)->bind_hash = pp;
7247	inet_sk(newsk)->inet_num = inet_sk(oldsk)->inet_num;
7248	spin_unlock(&head->lock);
7249	local_bh_enable();
7250
7251	/* Copy the bind_addr list from the original endpoint to the new
7252	 * endpoint so that we can handle restarts properly
7253	 */
7254	sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
7255				&oldsp->ep->base.bind_addr, GFP_KERNEL);
7256
7257	/* Move any messages in the old socket's receive queue that are for the
7258	 * peeled off association to the new socket's receive queue.
7259	 */
7260	sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
7261		event = sctp_skb2event(skb);
7262		if (event->asoc == assoc) {
7263			__skb_unlink(skb, &oldsk->sk_receive_queue);
7264			__skb_queue_tail(&newsk->sk_receive_queue, skb);
7265			sctp_skb_set_owner_r_frag(skb, newsk);
7266		}
7267	}
7268
7269	/* Clean up any messages pending delivery due to partial
7270	 * delivery.   Three cases:
7271	 * 1) No partial deliver;  no work.
7272	 * 2) Peeling off partial delivery; keep pd_lobby in new pd_lobby.
7273	 * 3) Peeling off non-partial delivery; move pd_lobby to receive_queue.
7274	 */
7275	skb_queue_head_init(&newsp->pd_lobby);
7276	atomic_set(&sctp_sk(newsk)->pd_mode, assoc->ulpq.pd_mode);
7277
7278	if (atomic_read(&sctp_sk(oldsk)->pd_mode)) {
7279		struct sk_buff_head *queue;
7280
7281		/* Decide which queue to move pd_lobby skbs to. */
7282		if (assoc->ulpq.pd_mode) {
7283			queue = &newsp->pd_lobby;
7284		} else
7285			queue = &newsk->sk_receive_queue;
7286
7287		/* Walk through the pd_lobby, looking for skbs that
7288		 * need moved to the new socket.
7289		 */
7290		sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
7291			event = sctp_skb2event(skb);
7292			if (event->asoc == assoc) {
7293				__skb_unlink(skb, &oldsp->pd_lobby);
7294				__skb_queue_tail(queue, skb);
7295				sctp_skb_set_owner_r_frag(skb, newsk);
7296			}
7297		}
7298
7299		/* Clear up any skbs waiting for the partial
7300		 * delivery to finish.
7301		 */
7302		if (assoc->ulpq.pd_mode)
7303			sctp_clear_pd(oldsk, NULL);
7304
7305	}
7306
7307	sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
7308		sctp_skb_set_owner_r_frag(skb, newsk);
7309
7310	sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
7311		sctp_skb_set_owner_r_frag(skb, newsk);
7312
7313	/* Set the type of socket to indicate that it is peeled off from the
7314	 * original UDP-style socket or created with the accept() call on a
7315	 * TCP-style socket..
7316	 */
7317	newsp->type = type;
7318
7319	/* Mark the new socket "in-use" by the user so that any packets
7320	 * that may arrive on the association after we've moved it are
7321	 * queued to the backlog.  This prevents a potential race between
7322	 * backlog processing on the old socket and new-packet processing
7323	 * on the new socket.
7324	 *
7325	 * The caller has just allocated newsk so we can guarantee that other
7326	 * paths won't try to lock it and then oldsk.
7327	 */
7328	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
7329	sctp_assoc_migrate(assoc, newsk);
7330
7331	/* If the association on the newsk is already closed before accept()
7332	 * is called, set RCV_SHUTDOWN flag.
7333	 */
7334	if (sctp_state(assoc, CLOSED) && sctp_style(newsk, TCP))
7335		newsk->sk_shutdown |= RCV_SHUTDOWN;
7336
7337	newsk->sk_state = SCTP_SS_ESTABLISHED;
7338	release_sock(newsk);
7339}
7340
7341
7342/* This proto struct describes the ULP interface for SCTP.  */
7343struct proto sctp_prot = {
7344	.name        =	"SCTP",
7345	.owner       =	THIS_MODULE,
7346	.close       =	sctp_close,
7347	.connect     =	sctp_connect,
7348	.disconnect  =	sctp_disconnect,
7349	.accept      =	sctp_accept,
7350	.ioctl       =	sctp_ioctl,
7351	.init        =	sctp_init_sock,
7352	.destroy     =	sctp_destroy_sock,
7353	.shutdown    =	sctp_shutdown,
7354	.setsockopt  =	sctp_setsockopt,
7355	.getsockopt  =	sctp_getsockopt,
7356	.sendmsg     =	sctp_sendmsg,
7357	.recvmsg     =	sctp_recvmsg,
7358	.bind        =	sctp_bind,
7359	.backlog_rcv =	sctp_backlog_rcv,
7360	.hash        =	sctp_hash,
7361	.unhash      =	sctp_unhash,
7362	.get_port    =	sctp_get_port,
7363	.obj_size    =  sizeof(struct sctp_sock),
7364	.sysctl_mem  =  sysctl_sctp_mem,
7365	.sysctl_rmem =  sysctl_sctp_rmem,
7366	.sysctl_wmem =  sysctl_sctp_wmem,
7367	.memory_pressure = &sctp_memory_pressure,
7368	.enter_memory_pressure = sctp_enter_memory_pressure,
7369	.memory_allocated = &sctp_memory_allocated,
7370	.sockets_allocated = &sctp_sockets_allocated,
7371};
7372
7373#if IS_ENABLED(CONFIG_IPV6)
7374
7375struct proto sctpv6_prot = {
7376	.name		= "SCTPv6",
7377	.owner		= THIS_MODULE,
7378	.close		= sctp_close,
7379	.connect	= sctp_connect,
7380	.disconnect	= sctp_disconnect,
7381	.accept		= sctp_accept,
7382	.ioctl		= sctp_ioctl,
7383	.init		= sctp_init_sock,
7384	.destroy	= sctp_destroy_sock,
7385	.shutdown	= sctp_shutdown,
7386	.setsockopt	= sctp_setsockopt,
7387	.getsockopt	= sctp_getsockopt,
7388	.sendmsg	= sctp_sendmsg,
7389	.recvmsg	= sctp_recvmsg,
7390	.bind		= sctp_bind,
7391	.backlog_rcv	= sctp_backlog_rcv,
7392	.hash		= sctp_hash,
7393	.unhash		= sctp_unhash,
7394	.get_port	= sctp_get_port,
7395	.obj_size	= sizeof(struct sctp6_sock),
7396	.sysctl_mem	= sysctl_sctp_mem,
7397	.sysctl_rmem	= sysctl_sctp_rmem,
7398	.sysctl_wmem	= sysctl_sctp_wmem,
7399	.memory_pressure = &sctp_memory_pressure,
7400	.enter_memory_pressure = sctp_enter_memory_pressure,
7401	.memory_allocated = &sctp_memory_allocated,
7402	.sockets_allocated = &sctp_sockets_allocated,
7403};
7404#endif /* IS_ENABLED(CONFIG_IPV6) */
7405