1/* SCTP kernel implementation
2 * (C) Copyright IBM Corp. 2001, 2004
3 * Copyright (c) 1999-2000 Cisco, Inc.
4 * Copyright (c) 1999-2001 Motorola, Inc.
5 * Copyright (c) 2001-2003 Intel Corp.
6 * Copyright (c) 2001-2002 Nokia, Inc.
7 * Copyright (c) 2001 La Monte H.P. Yarroll
8 *
9 * This file is part of the SCTP kernel implementation
10 *
11 * These functions interface with the sockets layer to implement the
12 * SCTP Extensions for the Sockets API.
13 *
14 * Note that the descriptions from the specification are USER level
15 * functions--this file is the functions which populate the struct proto
16 * for SCTP which is the BOTTOM of the sockets interface.
17 *
18 * This SCTP implementation is free software;
19 * you can redistribute it and/or modify it under the terms of
20 * the GNU General Public License as published by
21 * the Free Software Foundation; either version 2, or (at your option)
22 * any later version.
23 *
24 * This SCTP implementation is distributed in the hope that it
25 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
26 *                 ************************
27 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
28 * See the GNU General Public License for more details.
29 *
30 * You should have received a copy of the GNU General Public License
31 * along with GNU CC; see the file COPYING.  If not, see
32 * <http://www.gnu.org/licenses/>.
33 *
34 * Please send any bug reports or fixes you make to the
35 * email address(es):
36 *    lksctp developers <linux-sctp@vger.kernel.org>
37 *
38 * Written or modified by:
39 *    La Monte H.P. Yarroll <piggy@acm.org>
40 *    Narasimha Budihal     <narsi@refcode.org>
41 *    Karl Knutson          <karl@athena.chicago.il.us>
42 *    Jon Grimm             <jgrimm@us.ibm.com>
43 *    Xingang Guo           <xingang.guo@intel.com>
44 *    Daisy Chang           <daisyc@us.ibm.com>
45 *    Sridhar Samudrala     <samudrala@us.ibm.com>
46 *    Inaky Perez-Gonzalez  <inaky.gonzalez@intel.com>
47 *    Ardelle Fan	    <ardelle.fan@intel.com>
48 *    Ryan Layer	    <rmlayer@us.ibm.com>
49 *    Anup Pemmaiah         <pemmaiah@cc.usu.edu>
50 *    Kevin Gao             <kevin.gao@intel.com>
51 */
52
53#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
54
55#include <linux/types.h>
56#include <linux/kernel.h>
57#include <linux/wait.h>
58#include <linux/time.h>
59#include <linux/ip.h>
60#include <linux/capability.h>
61#include <linux/fcntl.h>
62#include <linux/poll.h>
63#include <linux/init.h>
64#include <linux/crypto.h>
65#include <linux/slab.h>
66#include <linux/file.h>
67#include <linux/compat.h>
68
69#include <net/ip.h>
70#include <net/icmp.h>
71#include <net/route.h>
72#include <net/ipv6.h>
73#include <net/inet_common.h>
74#include <net/busy_poll.h>
75
76#include <linux/socket.h> /* for sa_family_t */
77#include <linux/export.h>
78#include <net/sock.h>
79#include <net/sctp/sctp.h>
80#include <net/sctp/sm.h>
81
82/* Forward declarations for internal helper functions. */
83static int sctp_writeable(struct sock *sk);
84static void sctp_wfree(struct sk_buff *skb);
85static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
86				size_t msg_len);
87static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
88static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
89static int sctp_wait_for_accept(struct sock *sk, long timeo);
90static void sctp_wait_for_close(struct sock *sk, long timeo);
91static void sctp_destruct_sock(struct sock *sk);
92static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
93					union sctp_addr *addr, int len);
94static int sctp_bindx_add(struct sock *, struct sockaddr *, int);
95static int sctp_bindx_rem(struct sock *, struct sockaddr *, int);
96static int sctp_send_asconf_add_ip(struct sock *, struct sockaddr *, int);
97static int sctp_send_asconf_del_ip(struct sock *, struct sockaddr *, int);
98static int sctp_send_asconf(struct sctp_association *asoc,
99			    struct sctp_chunk *chunk);
100static int sctp_do_bind(struct sock *, union sctp_addr *, int);
101static int sctp_autobind(struct sock *sk);
102static void sctp_sock_migrate(struct sock *, struct sock *,
103			      struct sctp_association *, sctp_socket_type_t);
104
105static int sctp_memory_pressure;
106static atomic_long_t sctp_memory_allocated;
107struct percpu_counter sctp_sockets_allocated;
108
109static void sctp_enter_memory_pressure(struct sock *sk)
110{
111	sctp_memory_pressure = 1;
112}
113
114
115/* Get the sndbuf space available at the time on the association.  */
116static inline int sctp_wspace(struct sctp_association *asoc)
117{
118	int amt;
119
120	if (asoc->ep->sndbuf_policy)
121		amt = asoc->sndbuf_used;
122	else
123		amt = sk_wmem_alloc_get(asoc->base.sk);
124
125	if (amt >= asoc->base.sk->sk_sndbuf) {
126		if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
127			amt = 0;
128		else {
129			amt = sk_stream_wspace(asoc->base.sk);
130			if (amt < 0)
131				amt = 0;
132		}
133	} else {
134		amt = asoc->base.sk->sk_sndbuf - amt;
135	}
136	return amt;
137}
138
139/* Increment the used sndbuf space count of the corresponding association by
140 * the size of the outgoing data chunk.
141 * Also, set the skb destructor for sndbuf accounting later.
142 *
143 * Since it is always 1-1 between chunk and skb, and also a new skb is always
144 * allocated for chunk bundling in sctp_packet_transmit(), we can use the
145 * destructor in the data chunk skb for the purpose of the sndbuf space
146 * tracking.
147 */
148static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
149{
150	struct sctp_association *asoc = chunk->asoc;
151	struct sock *sk = asoc->base.sk;
152
153	/* The sndbuf space is tracked per association.  */
154	sctp_association_hold(asoc);
155
156	skb_set_owner_w(chunk->skb, sk);
157
158	chunk->skb->destructor = sctp_wfree;
159	/* Save the chunk pointer in skb for sctp_wfree to use later.  */
160	skb_shinfo(chunk->skb)->destructor_arg = chunk;
161
162	asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
163				sizeof(struct sk_buff) +
164				sizeof(struct sctp_chunk);
165
166	atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
167	sk->sk_wmem_queued += chunk->skb->truesize;
168	sk_mem_charge(sk, chunk->skb->truesize);
169}
170
171/* Verify that this is a valid address. */
172static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
173				   int len)
174{
175	struct sctp_af *af;
176
177	/* Verify basic sockaddr. */
178	af = sctp_sockaddr_af(sctp_sk(sk), addr, len);
179	if (!af)
180		return -EINVAL;
181
182	/* Is this a valid SCTP address?  */
183	if (!af->addr_valid(addr, sctp_sk(sk), NULL))
184		return -EINVAL;
185
186	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
187		return -EINVAL;
188
189	return 0;
190}
191
192/* Look up the association by its id.  If this is not a UDP-style
193 * socket, the ID field is always ignored.
194 */
195struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id)
196{
197	struct sctp_association *asoc = NULL;
198
199	/* If this is not a UDP-style socket, assoc id should be ignored. */
200	if (!sctp_style(sk, UDP)) {
201		/* Return NULL if the socket state is not ESTABLISHED. It
202		 * could be a TCP-style listening socket or a socket which
203		 * hasn't yet called connect() to establish an association.
204		 */
205		if (!sctp_sstate(sk, ESTABLISHED))
206			return NULL;
207
208		/* Get the first and the only association from the list. */
209		if (!list_empty(&sctp_sk(sk)->ep->asocs))
210			asoc = list_entry(sctp_sk(sk)->ep->asocs.next,
211					  struct sctp_association, asocs);
212		return asoc;
213	}
214
215	/* Otherwise this is a UDP-style socket. */
216	if (!id || (id == (sctp_assoc_t)-1))
217		return NULL;
218
219	spin_lock_bh(&sctp_assocs_id_lock);
220	asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id);
221	spin_unlock_bh(&sctp_assocs_id_lock);
222
223	if (!asoc || (asoc->base.sk != sk) || asoc->base.dead)
224		return NULL;
225
226	return asoc;
227}
228
229/* Look up the transport from an address and an assoc id. If both address and
230 * id are specified, the associations matching the address and the id should be
231 * the same.
232 */
233static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
234					      struct sockaddr_storage *addr,
235					      sctp_assoc_t id)
236{
237	struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
238	struct sctp_transport *transport;
239	union sctp_addr *laddr = (union sctp_addr *)addr;
240
241	addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
242					       laddr,
243					       &transport);
244
245	if (!addr_asoc)
246		return NULL;
247
248	id_asoc = sctp_id2assoc(sk, id);
249	if (id_asoc && (id_asoc != addr_asoc))
250		return NULL;
251
252	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
253						(union sctp_addr *)addr);
254
255	return transport;
256}
257
258/* API 3.1.2 bind() - UDP Style Syntax
259 * The syntax of bind() is,
260 *
261 *   ret = bind(int sd, struct sockaddr *addr, int addrlen);
262 *
263 *   sd      - the socket descriptor returned by socket().
264 *   addr    - the address structure (struct sockaddr_in or struct
265 *             sockaddr_in6 [RFC 2553]),
266 *   addr_len - the size of the address structure.
267 */
268static int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
269{
270	int retval = 0;
271
272	lock_sock(sk);
273
274	pr_debug("%s: sk:%p, addr:%p, addr_len:%d\n", __func__, sk,
275		 addr, addr_len);
276
277	/* Disallow binding twice. */
278	if (!sctp_sk(sk)->ep->base.bind_addr.port)
279		retval = sctp_do_bind(sk, (union sctp_addr *)addr,
280				      addr_len);
281	else
282		retval = -EINVAL;
283
284	release_sock(sk);
285
286	return retval;
287}
288
289static long sctp_get_port_local(struct sock *, union sctp_addr *);
290
291/* Verify this is a valid sockaddr. */
292static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
293					union sctp_addr *addr, int len)
294{
295	struct sctp_af *af;
296
297	/* Check minimum size.  */
298	if (len < sizeof (struct sockaddr))
299		return NULL;
300
301	/* V4 mapped address are really of AF_INET family */
302	if (addr->sa.sa_family == AF_INET6 &&
303	    ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
304		if (!opt->pf->af_supported(AF_INET, opt))
305			return NULL;
306	} else {
307		/* Does this PF support this AF? */
308		if (!opt->pf->af_supported(addr->sa.sa_family, opt))
309			return NULL;
310	}
311
312	/* If we get this far, af is valid. */
313	af = sctp_get_af_specific(addr->sa.sa_family);
314
315	if (len < af->sockaddr_len)
316		return NULL;
317
318	return af;
319}
320
321/* Bind a local address either to an endpoint or to an association.  */
322static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
323{
324	struct net *net = sock_net(sk);
325	struct sctp_sock *sp = sctp_sk(sk);
326	struct sctp_endpoint *ep = sp->ep;
327	struct sctp_bind_addr *bp = &ep->base.bind_addr;
328	struct sctp_af *af;
329	unsigned short snum;
330	int ret = 0;
331
332	/* Common sockaddr verification. */
333	af = sctp_sockaddr_af(sp, addr, len);
334	if (!af) {
335		pr_debug("%s: sk:%p, newaddr:%p, len:%d EINVAL\n",
336			 __func__, sk, addr, len);
337		return -EINVAL;
338	}
339
340	snum = ntohs(addr->v4.sin_port);
341
342	pr_debug("%s: sk:%p, new addr:%pISc, port:%d, new port:%d, len:%d\n",
343		 __func__, sk, &addr->sa, bp->port, snum, len);
344
345	/* PF specific bind() address verification. */
346	if (!sp->pf->bind_verify(sp, addr))
347		return -EADDRNOTAVAIL;
348
349	/* We must either be unbound, or bind to the same port.
350	 * It's OK to allow 0 ports if we are already bound.
351	 * We'll just inhert an already bound port in this case
352	 */
353	if (bp->port) {
354		if (!snum)
355			snum = bp->port;
356		else if (snum != bp->port) {
357			pr_debug("%s: new port %d doesn't match existing port "
358				 "%d\n", __func__, snum, bp->port);
359			return -EINVAL;
360		}
361	}
362
363	if (snum && snum < PROT_SOCK &&
364	    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
365		return -EACCES;
366
367	/* See if the address matches any of the addresses we may have
368	 * already bound before checking against other endpoints.
369	 */
370	if (sctp_bind_addr_match(bp, addr, sp))
371		return -EINVAL;
372
373	/* Make sure we are allowed to bind here.
374	 * The function sctp_get_port_local() does duplicate address
375	 * detection.
376	 */
377	addr->v4.sin_port = htons(snum);
378	if ((ret = sctp_get_port_local(sk, addr))) {
379		return -EADDRINUSE;
380	}
381
382	/* Refresh ephemeral port.  */
383	if (!bp->port)
384		bp->port = inet_sk(sk)->inet_num;
385
386	/* Add the address to the bind address list.
387	 * Use GFP_ATOMIC since BHs will be disabled.
388	 */
389	ret = sctp_add_bind_addr(bp, addr, SCTP_ADDR_SRC, GFP_ATOMIC);
390
391	/* Copy back into socket for getsockname() use. */
392	if (!ret) {
393		inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
394		sp->pf->to_sk_saddr(addr, sk);
395	}
396
397	return ret;
398}
399
400 /* ADDIP Section 4.1.1 Congestion Control of ASCONF Chunks
401 *
402 * R1) One and only one ASCONF Chunk MAY be in transit and unacknowledged
403 * at any one time.  If a sender, after sending an ASCONF chunk, decides
404 * it needs to transfer another ASCONF Chunk, it MUST wait until the
405 * ASCONF-ACK Chunk returns from the previous ASCONF Chunk before sending a
406 * subsequent ASCONF. Note this restriction binds each side, so at any
407 * time two ASCONF may be in-transit on any given association (one sent
408 * from each endpoint).
409 */
410static int sctp_send_asconf(struct sctp_association *asoc,
411			    struct sctp_chunk *chunk)
412{
413	struct net 	*net = sock_net(asoc->base.sk);
414	int		retval = 0;
415
416	/* If there is an outstanding ASCONF chunk, queue it for later
417	 * transmission.
418	 */
419	if (asoc->addip_last_asconf) {
420		list_add_tail(&chunk->list, &asoc->addip_chunk_list);
421		goto out;
422	}
423
424	/* Hold the chunk until an ASCONF_ACK is received. */
425	sctp_chunk_hold(chunk);
426	retval = sctp_primitive_ASCONF(net, asoc, chunk);
427	if (retval)
428		sctp_chunk_free(chunk);
429	else
430		asoc->addip_last_asconf = chunk;
431
432out:
433	return retval;
434}
435
436/* Add a list of addresses as bind addresses to local endpoint or
437 * association.
438 *
439 * Basically run through each address specified in the addrs/addrcnt
440 * array/length pair, determine if it is IPv6 or IPv4 and call
441 * sctp_do_bind() on it.
442 *
443 * If any of them fails, then the operation will be reversed and the
444 * ones that were added will be removed.
445 *
446 * Only sctp_setsockopt_bindx() is supposed to call this function.
447 */
448static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
449{
450	int cnt;
451	int retval = 0;
452	void *addr_buf;
453	struct sockaddr *sa_addr;
454	struct sctp_af *af;
455
456	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n", __func__, sk,
457		 addrs, addrcnt);
458
459	addr_buf = addrs;
460	for (cnt = 0; cnt < addrcnt; cnt++) {
461		/* The list may contain either IPv4 or IPv6 address;
462		 * determine the address length for walking thru the list.
463		 */
464		sa_addr = addr_buf;
465		af = sctp_get_af_specific(sa_addr->sa_family);
466		if (!af) {
467			retval = -EINVAL;
468			goto err_bindx_add;
469		}
470
471		retval = sctp_do_bind(sk, (union sctp_addr *)sa_addr,
472				      af->sockaddr_len);
473
474		addr_buf += af->sockaddr_len;
475
476err_bindx_add:
477		if (retval < 0) {
478			/* Failed. Cleanup the ones that have been added */
479			if (cnt > 0)
480				sctp_bindx_rem(sk, addrs, cnt);
481			return retval;
482		}
483	}
484
485	return retval;
486}
487
488/* Send an ASCONF chunk with Add IP address parameters to all the peers of the
489 * associations that are part of the endpoint indicating that a list of local
490 * addresses are added to the endpoint.
491 *
492 * If any of the addresses is already in the bind address list of the
493 * association, we do not send the chunk for that association.  But it will not
494 * affect other associations.
495 *
496 * Only sctp_setsockopt_bindx() is supposed to call this function.
497 */
498static int sctp_send_asconf_add_ip(struct sock		*sk,
499				   struct sockaddr	*addrs,
500				   int 			addrcnt)
501{
502	struct net *net = sock_net(sk);
503	struct sctp_sock		*sp;
504	struct sctp_endpoint		*ep;
505	struct sctp_association		*asoc;
506	struct sctp_bind_addr		*bp;
507	struct sctp_chunk		*chunk;
508	struct sctp_sockaddr_entry	*laddr;
509	union sctp_addr			*addr;
510	union sctp_addr			saveaddr;
511	void				*addr_buf;
512	struct sctp_af			*af;
513	struct list_head		*p;
514	int 				i;
515	int 				retval = 0;
516
517	if (!net->sctp.addip_enable)
518		return retval;
519
520	sp = sctp_sk(sk);
521	ep = sp->ep;
522
523	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
524		 __func__, sk, addrs, addrcnt);
525
526	list_for_each_entry(asoc, &ep->asocs, asocs) {
527		if (!asoc->peer.asconf_capable)
528			continue;
529
530		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_ADD_IP)
531			continue;
532
533		if (!sctp_state(asoc, ESTABLISHED))
534			continue;
535
536		/* Check if any address in the packed array of addresses is
537		 * in the bind address list of the association. If so,
538		 * do not send the asconf chunk to its peer, but continue with
539		 * other associations.
540		 */
541		addr_buf = addrs;
542		for (i = 0; i < addrcnt; i++) {
543			addr = addr_buf;
544			af = sctp_get_af_specific(addr->v4.sin_family);
545			if (!af) {
546				retval = -EINVAL;
547				goto out;
548			}
549
550			if (sctp_assoc_lookup_laddr(asoc, addr))
551				break;
552
553			addr_buf += af->sockaddr_len;
554		}
555		if (i < addrcnt)
556			continue;
557
558		/* Use the first valid address in bind addr list of
559		 * association as Address Parameter of ASCONF CHUNK.
560		 */
561		bp = &asoc->base.bind_addr;
562		p = bp->address_list.next;
563		laddr = list_entry(p, struct sctp_sockaddr_entry, list);
564		chunk = sctp_make_asconf_update_ip(asoc, &laddr->a, addrs,
565						   addrcnt, SCTP_PARAM_ADD_IP);
566		if (!chunk) {
567			retval = -ENOMEM;
568			goto out;
569		}
570
571		/* Add the new addresses to the bind address list with
572		 * use_as_src set to 0.
573		 */
574		addr_buf = addrs;
575		for (i = 0; i < addrcnt; i++) {
576			addr = addr_buf;
577			af = sctp_get_af_specific(addr->v4.sin_family);
578			memcpy(&saveaddr, addr, af->sockaddr_len);
579			retval = sctp_add_bind_addr(bp, &saveaddr,
580						    SCTP_ADDR_NEW, GFP_ATOMIC);
581			addr_buf += af->sockaddr_len;
582		}
583		if (asoc->src_out_of_asoc_ok) {
584			struct sctp_transport *trans;
585
586			list_for_each_entry(trans,
587			    &asoc->peer.transport_addr_list, transports) {
588				/* Clear the source and route cache */
589				dst_release(trans->dst);
590				trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
591				    2*asoc->pathmtu, 4380));
592				trans->ssthresh = asoc->peer.i.a_rwnd;
593				trans->rto = asoc->rto_initial;
594				sctp_max_rto(asoc, trans);
595				trans->rtt = trans->srtt = trans->rttvar = 0;
596				sctp_transport_route(trans, NULL,
597				    sctp_sk(asoc->base.sk));
598			}
599		}
600		retval = sctp_send_asconf(asoc, chunk);
601	}
602
603out:
604	return retval;
605}
606
607/* Remove a list of addresses from bind addresses list.  Do not remove the
608 * last address.
609 *
610 * Basically run through each address specified in the addrs/addrcnt
611 * array/length pair, determine if it is IPv6 or IPv4 and call
612 * sctp_del_bind() on it.
613 *
614 * If any of them fails, then the operation will be reversed and the
615 * ones that were removed will be added back.
616 *
617 * At least one address has to be left; if only one address is
618 * available, the operation will return -EBUSY.
619 *
620 * Only sctp_setsockopt_bindx() is supposed to call this function.
621 */
622static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
623{
624	struct sctp_sock *sp = sctp_sk(sk);
625	struct sctp_endpoint *ep = sp->ep;
626	int cnt;
627	struct sctp_bind_addr *bp = &ep->base.bind_addr;
628	int retval = 0;
629	void *addr_buf;
630	union sctp_addr *sa_addr;
631	struct sctp_af *af;
632
633	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
634		 __func__, sk, addrs, addrcnt);
635
636	addr_buf = addrs;
637	for (cnt = 0; cnt < addrcnt; cnt++) {
638		/* If the bind address list is empty or if there is only one
639		 * bind address, there is nothing more to be removed (we need
640		 * at least one address here).
641		 */
642		if (list_empty(&bp->address_list) ||
643		    (sctp_list_single_entry(&bp->address_list))) {
644			retval = -EBUSY;
645			goto err_bindx_rem;
646		}
647
648		sa_addr = addr_buf;
649		af = sctp_get_af_specific(sa_addr->sa.sa_family);
650		if (!af) {
651			retval = -EINVAL;
652			goto err_bindx_rem;
653		}
654
655		if (!af->addr_valid(sa_addr, sp, NULL)) {
656			retval = -EADDRNOTAVAIL;
657			goto err_bindx_rem;
658		}
659
660		if (sa_addr->v4.sin_port &&
661		    sa_addr->v4.sin_port != htons(bp->port)) {
662			retval = -EINVAL;
663			goto err_bindx_rem;
664		}
665
666		if (!sa_addr->v4.sin_port)
667			sa_addr->v4.sin_port = htons(bp->port);
668
669		/* FIXME - There is probably a need to check if sk->sk_saddr and
670		 * sk->sk_rcv_addr are currently set to one of the addresses to
671		 * be removed. This is something which needs to be looked into
672		 * when we are fixing the outstanding issues with multi-homing
673		 * socket routing and failover schemes. Refer to comments in
674		 * sctp_do_bind(). -daisy
675		 */
676		retval = sctp_del_bind_addr(bp, sa_addr);
677
678		addr_buf += af->sockaddr_len;
679err_bindx_rem:
680		if (retval < 0) {
681			/* Failed. Add the ones that has been removed back */
682			if (cnt > 0)
683				sctp_bindx_add(sk, addrs, cnt);
684			return retval;
685		}
686	}
687
688	return retval;
689}
690
691/* Send an ASCONF chunk with Delete IP address parameters to all the peers of
692 * the associations that are part of the endpoint indicating that a list of
693 * local addresses are removed from the endpoint.
694 *
695 * If any of the addresses is already in the bind address list of the
696 * association, we do not send the chunk for that association.  But it will not
697 * affect other associations.
698 *
699 * Only sctp_setsockopt_bindx() is supposed to call this function.
700 */
701static int sctp_send_asconf_del_ip(struct sock		*sk,
702				   struct sockaddr	*addrs,
703				   int			addrcnt)
704{
705	struct net *net = sock_net(sk);
706	struct sctp_sock	*sp;
707	struct sctp_endpoint	*ep;
708	struct sctp_association	*asoc;
709	struct sctp_transport	*transport;
710	struct sctp_bind_addr	*bp;
711	struct sctp_chunk	*chunk;
712	union sctp_addr		*laddr;
713	void			*addr_buf;
714	struct sctp_af		*af;
715	struct sctp_sockaddr_entry *saddr;
716	int 			i;
717	int 			retval = 0;
718	int			stored = 0;
719
720	chunk = NULL;
721	if (!net->sctp.addip_enable)
722		return retval;
723
724	sp = sctp_sk(sk);
725	ep = sp->ep;
726
727	pr_debug("%s: sk:%p, addrs:%p, addrcnt:%d\n",
728		 __func__, sk, addrs, addrcnt);
729
730	list_for_each_entry(asoc, &ep->asocs, asocs) {
731
732		if (!asoc->peer.asconf_capable)
733			continue;
734
735		if (asoc->peer.addip_disabled_mask & SCTP_PARAM_DEL_IP)
736			continue;
737
738		if (!sctp_state(asoc, ESTABLISHED))
739			continue;
740
741		/* Check if any address in the packed array of addresses is
742		 * not present in the bind address list of the association.
743		 * If so, do not send the asconf chunk to its peer, but
744		 * continue with other associations.
745		 */
746		addr_buf = addrs;
747		for (i = 0; i < addrcnt; i++) {
748			laddr = addr_buf;
749			af = sctp_get_af_specific(laddr->v4.sin_family);
750			if (!af) {
751				retval = -EINVAL;
752				goto out;
753			}
754
755			if (!sctp_assoc_lookup_laddr(asoc, laddr))
756				break;
757
758			addr_buf += af->sockaddr_len;
759		}
760		if (i < addrcnt)
761			continue;
762
763		/* Find one address in the association's bind address list
764		 * that is not in the packed array of addresses. This is to
765		 * make sure that we do not delete all the addresses in the
766		 * association.
767		 */
768		bp = &asoc->base.bind_addr;
769		laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
770					       addrcnt, sp);
771		if ((laddr == NULL) && (addrcnt == 1)) {
772			if (asoc->asconf_addr_del_pending)
773				continue;
774			asoc->asconf_addr_del_pending =
775			    kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
776			if (asoc->asconf_addr_del_pending == NULL) {
777				retval = -ENOMEM;
778				goto out;
779			}
780			asoc->asconf_addr_del_pending->sa.sa_family =
781				    addrs->sa_family;
782			asoc->asconf_addr_del_pending->v4.sin_port =
783				    htons(bp->port);
784			if (addrs->sa_family == AF_INET) {
785				struct sockaddr_in *sin;
786
787				sin = (struct sockaddr_in *)addrs;
788				asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
789			} else if (addrs->sa_family == AF_INET6) {
790				struct sockaddr_in6 *sin6;
791
792				sin6 = (struct sockaddr_in6 *)addrs;
793				asoc->asconf_addr_del_pending->v6.sin6_addr = sin6->sin6_addr;
794			}
795
796			pr_debug("%s: keep the last address asoc:%p %pISc at %p\n",
797				 __func__, asoc, &asoc->asconf_addr_del_pending->sa,
798				 asoc->asconf_addr_del_pending);
799
800			asoc->src_out_of_asoc_ok = 1;
801			stored = 1;
802			goto skip_mkasconf;
803		}
804
805		if (laddr == NULL)
806			return -EINVAL;
807
808		/* We do not need RCU protection throughout this loop
809		 * because this is done under a socket lock from the
810		 * setsockopt call.
811		 */
812		chunk = sctp_make_asconf_update_ip(asoc, laddr, addrs, addrcnt,
813						   SCTP_PARAM_DEL_IP);
814		if (!chunk) {
815			retval = -ENOMEM;
816			goto out;
817		}
818
819skip_mkasconf:
820		/* Reset use_as_src flag for the addresses in the bind address
821		 * list that are to be deleted.
822		 */
823		addr_buf = addrs;
824		for (i = 0; i < addrcnt; i++) {
825			laddr = addr_buf;
826			af = sctp_get_af_specific(laddr->v4.sin_family);
827			list_for_each_entry(saddr, &bp->address_list, list) {
828				if (sctp_cmp_addr_exact(&saddr->a, laddr))
829					saddr->state = SCTP_ADDR_DEL;
830			}
831			addr_buf += af->sockaddr_len;
832		}
833
834		/* Update the route and saddr entries for all the transports
835		 * as some of the addresses in the bind address list are
836		 * about to be deleted and cannot be used as source addresses.
837		 */
838		list_for_each_entry(transport, &asoc->peer.transport_addr_list,
839					transports) {
840			dst_release(transport->dst);
841			sctp_transport_route(transport, NULL,
842					     sctp_sk(asoc->base.sk));
843		}
844
845		if (stored)
846			/* We don't need to transmit ASCONF */
847			continue;
848		retval = sctp_send_asconf(asoc, chunk);
849	}
850out:
851	return retval;
852}
853
854/* set addr events to assocs in the endpoint.  ep and addr_wq must be locked */
855int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
856{
857	struct sock *sk = sctp_opt2sk(sp);
858	union sctp_addr *addr;
859	struct sctp_af *af;
860
861	/* It is safe to write port space in caller. */
862	addr = &addrw->a;
863	addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
864	af = sctp_get_af_specific(addr->sa.sa_family);
865	if (!af)
866		return -EINVAL;
867	if (sctp_verify_addr(sk, addr, af->sockaddr_len))
868		return -EINVAL;
869
870	if (addrw->state == SCTP_ADDR_NEW)
871		return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
872	else
873		return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
874}
875
876/* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
877 *
878 * API 8.1
879 * int sctp_bindx(int sd, struct sockaddr *addrs, int addrcnt,
880 *                int flags);
881 *
882 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
883 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
884 * or IPv6 addresses.
885 *
886 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
887 * Section 3.1.2 for this usage.
888 *
889 * addrs is a pointer to an array of one or more socket addresses. Each
890 * address is contained in its appropriate structure (i.e. struct
891 * sockaddr_in or struct sockaddr_in6) the family of the address type
892 * must be used to distinguish the address length (note that this
893 * representation is termed a "packed array" of addresses). The caller
894 * specifies the number of addresses in the array with addrcnt.
895 *
896 * On success, sctp_bindx() returns 0. On failure, sctp_bindx() returns
897 * -1, and sets errno to the appropriate error code.
898 *
899 * For SCTP, the port given in each socket address must be the same, or
900 * sctp_bindx() will fail, setting errno to EINVAL.
901 *
902 * The flags parameter is formed from the bitwise OR of zero or more of
903 * the following currently defined flags:
904 *
905 * SCTP_BINDX_ADD_ADDR
906 *
907 * SCTP_BINDX_REM_ADDR
908 *
909 * SCTP_BINDX_ADD_ADDR directs SCTP to add the given addresses to the
910 * association, and SCTP_BINDX_REM_ADDR directs SCTP to remove the given
911 * addresses from the association. The two flags are mutually exclusive;
912 * if both are given, sctp_bindx() will fail with EINVAL. A caller may
913 * not remove all addresses from an association; sctp_bindx() will
914 * reject such an attempt with EINVAL.
915 *
916 * An application can use sctp_bindx(SCTP_BINDX_ADD_ADDR) to associate
917 * additional addresses with an endpoint after calling bind().  Or use
918 * sctp_bindx(SCTP_BINDX_REM_ADDR) to remove some addresses a listening
919 * socket is associated with so that no new association accepted will be
920 * associated with those addresses. If the endpoint supports dynamic
921 * address a SCTP_BINDX_REM_ADDR or SCTP_BINDX_ADD_ADDR may cause a
922 * endpoint to send the appropriate message to the peer to change the
923 * peers address lists.
924 *
925 * Adding and removing addresses from a connected association is
926 * optional functionality. Implementations that do not support this
927 * functionality should return EOPNOTSUPP.
928 *
929 * Basically do nothing but copying the addresses from user to kernel
930 * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
931 * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
932 * from userspace.
933 *
934 * We don't use copy_from_user() for optimization: we first do the
935 * sanity checks (buffer size -fast- and access check-healthy
936 * pointer); if all of those succeed, then we can alloc the memory
937 * (expensive operation) needed to copy the data to kernel. Then we do
938 * the copying without checking the user space area
939 * (__copy_from_user()).
940 *
941 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
942 * it.
943 *
944 * sk        The sk of the socket
945 * addrs     The pointer to the addresses in user land
946 * addrssize Size of the addrs buffer
947 * op        Operation to perform (add or remove, see the flags of
948 *           sctp_bindx)
949 *
950 * Returns 0 if ok, <0 errno code on error.
951 */
952static int sctp_setsockopt_bindx(struct sock *sk,
953				 struct sockaddr __user *addrs,
954				 int addrs_size, int op)
955{
956	struct sockaddr *kaddrs;
957	int err;
958	int addrcnt = 0;
959	int walk_size = 0;
960	struct sockaddr *sa_addr;
961	void *addr_buf;
962	struct sctp_af *af;
963
964	pr_debug("%s: sk:%p addrs:%p addrs_size:%d opt:%d\n",
965		 __func__, sk, addrs, addrs_size, op);
966
967	if (unlikely(addrs_size <= 0))
968		return -EINVAL;
969
970	/* Check the user passed a healthy pointer.  */
971	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
972		return -EFAULT;
973
974	/* Alloc space for the address array in kernel memory.  */
975	kaddrs = kmalloc(addrs_size, GFP_KERNEL);
976	if (unlikely(!kaddrs))
977		return -ENOMEM;
978
979	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
980		kfree(kaddrs);
981		return -EFAULT;
982	}
983
984	/* Walk through the addrs buffer and count the number of addresses. */
985	addr_buf = kaddrs;
986	while (walk_size < addrs_size) {
987		if (walk_size + sizeof(sa_family_t) > addrs_size) {
988			kfree(kaddrs);
989			return -EINVAL;
990		}
991
992		sa_addr = addr_buf;
993		af = sctp_get_af_specific(sa_addr->sa_family);
994
995		/* If the address family is not supported or if this address
996		 * causes the address buffer to overflow return EINVAL.
997		 */
998		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
999			kfree(kaddrs);
1000			return -EINVAL;
1001		}
1002		addrcnt++;
1003		addr_buf += af->sockaddr_len;
1004		walk_size += af->sockaddr_len;
1005	}
1006
1007	/* Do the work. */
1008	switch (op) {
1009	case SCTP_BINDX_ADD_ADDR:
1010		err = sctp_bindx_add(sk, kaddrs, addrcnt);
1011		if (err)
1012			goto out;
1013		err = sctp_send_asconf_add_ip(sk, kaddrs, addrcnt);
1014		break;
1015
1016	case SCTP_BINDX_REM_ADDR:
1017		err = sctp_bindx_rem(sk, kaddrs, addrcnt);
1018		if (err)
1019			goto out;
1020		err = sctp_send_asconf_del_ip(sk, kaddrs, addrcnt);
1021		break;
1022
1023	default:
1024		err = -EINVAL;
1025		break;
1026	}
1027
1028out:
1029	kfree(kaddrs);
1030
1031	return err;
1032}
1033
1034/* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
1035 *
1036 * Common routine for handling connect() and sctp_connectx().
1037 * Connect will come in with just a single address.
1038 */
1039static int __sctp_connect(struct sock *sk,
1040			  struct sockaddr *kaddrs,
1041			  int addrs_size,
1042			  sctp_assoc_t *assoc_id)
1043{
1044	struct net *net = sock_net(sk);
1045	struct sctp_sock *sp;
1046	struct sctp_endpoint *ep;
1047	struct sctp_association *asoc = NULL;
1048	struct sctp_association *asoc2;
1049	struct sctp_transport *transport;
1050	union sctp_addr to;
1051	sctp_scope_t scope;
1052	long timeo;
1053	int err = 0;
1054	int addrcnt = 0;
1055	int walk_size = 0;
1056	union sctp_addr *sa_addr = NULL;
1057	void *addr_buf;
1058	unsigned short port;
1059	unsigned int f_flags = 0;
1060
1061	sp = sctp_sk(sk);
1062	ep = sp->ep;
1063
1064	/* connect() cannot be done on a socket that is already in ESTABLISHED
1065	 * state - UDP-style peeled off socket or a TCP-style socket that
1066	 * is already connected.
1067	 * It cannot be done even on a TCP-style listening socket.
1068	 */
1069	if (sctp_sstate(sk, ESTABLISHED) ||
1070	    (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
1071		err = -EISCONN;
1072		goto out_free;
1073	}
1074
1075	/* Walk through the addrs buffer and count the number of addresses. */
1076	addr_buf = kaddrs;
1077	while (walk_size < addrs_size) {
1078		struct sctp_af *af;
1079
1080		if (walk_size + sizeof(sa_family_t) > addrs_size) {
1081			err = -EINVAL;
1082			goto out_free;
1083		}
1084
1085		sa_addr = addr_buf;
1086		af = sctp_get_af_specific(sa_addr->sa.sa_family);
1087
1088		/* If the address family is not supported or if this address
1089		 * causes the address buffer to overflow return EINVAL.
1090		 */
1091		if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
1092			err = -EINVAL;
1093			goto out_free;
1094		}
1095
1096		port = ntohs(sa_addr->v4.sin_port);
1097
1098		/* Save current address so we can work with it */
1099		memcpy(&to, sa_addr, af->sockaddr_len);
1100
1101		err = sctp_verify_addr(sk, &to, af->sockaddr_len);
1102		if (err)
1103			goto out_free;
1104
1105		/* Make sure the destination port is correctly set
1106		 * in all addresses.
1107		 */
1108		if (asoc && asoc->peer.port && asoc->peer.port != port) {
1109			err = -EINVAL;
1110			goto out_free;
1111		}
1112
1113		/* Check if there already is a matching association on the
1114		 * endpoint (other than the one created here).
1115		 */
1116		asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1117		if (asoc2 && asoc2 != asoc) {
1118			if (asoc2->state >= SCTP_STATE_ESTABLISHED)
1119				err = -EISCONN;
1120			else
1121				err = -EALREADY;
1122			goto out_free;
1123		}
1124
1125		/* If we could not find a matching association on the endpoint,
1126		 * make sure that there is no peeled-off association matching
1127		 * the peer address even on another socket.
1128		 */
1129		if (sctp_endpoint_is_peeled_off(ep, &to)) {
1130			err = -EADDRNOTAVAIL;
1131			goto out_free;
1132		}
1133
1134		if (!asoc) {
1135			/* If a bind() or sctp_bindx() is not called prior to
1136			 * an sctp_connectx() call, the system picks an
1137			 * ephemeral port and will choose an address set
1138			 * equivalent to binding with a wildcard address.
1139			 */
1140			if (!ep->base.bind_addr.port) {
1141				if (sctp_autobind(sk)) {
1142					err = -EAGAIN;
1143					goto out_free;
1144				}
1145			} else {
1146				/*
1147				 * If an unprivileged user inherits a 1-many
1148				 * style socket with open associations on a
1149				 * privileged port, it MAY be permitted to
1150				 * accept new associations, but it SHOULD NOT
1151				 * be permitted to open new associations.
1152				 */
1153				if (ep->base.bind_addr.port < PROT_SOCK &&
1154				    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1155					err = -EACCES;
1156					goto out_free;
1157				}
1158			}
1159
1160			scope = sctp_scope(&to);
1161			asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1162			if (!asoc) {
1163				err = -ENOMEM;
1164				goto out_free;
1165			}
1166
1167			err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
1168							      GFP_KERNEL);
1169			if (err < 0) {
1170				goto out_free;
1171			}
1172
1173		}
1174
1175		/* Prime the peer's transport structures.  */
1176		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
1177						SCTP_UNKNOWN);
1178		if (!transport) {
1179			err = -ENOMEM;
1180			goto out_free;
1181		}
1182
1183		addrcnt++;
1184		addr_buf += af->sockaddr_len;
1185		walk_size += af->sockaddr_len;
1186	}
1187
1188	/* In case the user of sctp_connectx() wants an association
1189	 * id back, assign one now.
1190	 */
1191	if (assoc_id) {
1192		err = sctp_assoc_set_id(asoc, GFP_KERNEL);
1193		if (err < 0)
1194			goto out_free;
1195	}
1196
1197	err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1198	if (err < 0) {
1199		goto out_free;
1200	}
1201
1202	/* Initialize sk's dport and daddr for getpeername() */
1203	inet_sk(sk)->inet_dport = htons(asoc->peer.port);
1204	sp->pf->to_sk_daddr(sa_addr, sk);
1205	sk->sk_err = 0;
1206
1207	/* in-kernel sockets don't generally have a file allocated to them
1208	 * if all they do is call sock_create_kern().
1209	 */
1210	if (sk->sk_socket->file)
1211		f_flags = sk->sk_socket->file->f_flags;
1212
1213	timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
1214
1215	err = sctp_wait_for_connect(asoc, &timeo);
1216	if ((err == 0 || err == -EINPROGRESS) && assoc_id)
1217		*assoc_id = asoc->assoc_id;
1218
1219	/* Don't free association on exit. */
1220	asoc = NULL;
1221
1222out_free:
1223	pr_debug("%s: took out_free path with asoc:%p kaddrs:%p err:%d\n",
1224		 __func__, asoc, kaddrs, err);
1225
1226	if (asoc) {
1227		/* sctp_primitive_ASSOCIATE may have added this association
1228		 * To the hash table, try to unhash it, just in case, its a noop
1229		 * if it wasn't hashed so we're safe
1230		 */
1231		sctp_unhash_established(asoc);
1232		sctp_association_free(asoc);
1233	}
1234	return err;
1235}
1236
1237/* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
1238 *
1239 * API 8.9
1240 * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt,
1241 * 			sctp_assoc_t *asoc);
1242 *
1243 * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
1244 * If the sd is an IPv6 socket, the addresses passed can either be IPv4
1245 * or IPv6 addresses.
1246 *
1247 * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
1248 * Section 3.1.2 for this usage.
1249 *
1250 * addrs is a pointer to an array of one or more socket addresses. Each
1251 * address is contained in its appropriate structure (i.e. struct
1252 * sockaddr_in or struct sockaddr_in6) the family of the address type
1253 * must be used to distengish the address length (note that this
1254 * representation is termed a "packed array" of addresses). The caller
1255 * specifies the number of addresses in the array with addrcnt.
1256 *
1257 * On success, sctp_connectx() returns 0. It also sets the assoc_id to
1258 * the association id of the new association.  On failure, sctp_connectx()
1259 * returns -1, and sets errno to the appropriate error code.  The assoc_id
1260 * is not touched by the kernel.
1261 *
1262 * For SCTP, the port given in each socket address must be the same, or
1263 * sctp_connectx() will fail, setting errno to EINVAL.
1264 *
1265 * An application can use sctp_connectx to initiate an association with
1266 * an endpoint that is multi-homed.  Much like sctp_bindx() this call
1267 * allows a caller to specify multiple addresses at which a peer can be
1268 * reached.  The way the SCTP stack uses the list of addresses to set up
1269 * the association is implementation dependent.  This function only
1270 * specifies that the stack will try to make use of all the addresses in
1271 * the list when needed.
1272 *
1273 * Note that the list of addresses passed in is only used for setting up
1274 * the association.  It does not necessarily equal the set of addresses
1275 * the peer uses for the resulting association.  If the caller wants to
1276 * find out the set of peer addresses, it must use sctp_getpaddrs() to
1277 * retrieve them after the association has been set up.
1278 *
1279 * Basically do nothing but copying the addresses from user to kernel
1280 * land and invoking either sctp_connectx(). This is used for tunneling
1281 * the sctp_connectx() request through sctp_setsockopt() from userspace.
1282 *
1283 * We don't use copy_from_user() for optimization: we first do the
1284 * sanity checks (buffer size -fast- and access check-healthy
1285 * pointer); if all of those succeed, then we can alloc the memory
1286 * (expensive operation) needed to copy the data to kernel. Then we do
1287 * the copying without checking the user space area
1288 * (__copy_from_user()).
1289 *
1290 * On exit there is no need to do sockfd_put(), sys_setsockopt() does
1291 * it.
1292 *
1293 * sk        The sk of the socket
1294 * addrs     The pointer to the addresses in user land
1295 * addrssize Size of the addrs buffer
1296 *
1297 * Returns >=0 if ok, <0 errno code on error.
1298 */
1299static int __sctp_setsockopt_connectx(struct sock *sk,
1300				      struct sockaddr __user *addrs,
1301				      int addrs_size,
1302				      sctp_assoc_t *assoc_id)
1303{
1304	int err = 0;
1305	struct sockaddr *kaddrs;
1306
1307	pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
1308		 __func__, sk, addrs, addrs_size);
1309
1310	if (unlikely(addrs_size <= 0))
1311		return -EINVAL;
1312
1313	/* Check the user passed a healthy pointer.  */
1314	if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
1315		return -EFAULT;
1316
1317	/* Alloc space for the address array in kernel memory.  */
1318	kaddrs = kmalloc(addrs_size, GFP_KERNEL);
1319	if (unlikely(!kaddrs))
1320		return -ENOMEM;
1321
1322	if (__copy_from_user(kaddrs, addrs, addrs_size)) {
1323		err = -EFAULT;
1324	} else {
1325		err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1326	}
1327
1328	kfree(kaddrs);
1329
1330	return err;
1331}
1332
1333/*
1334 * This is an older interface.  It's kept for backward compatibility
1335 * to the option that doesn't provide association id.
1336 */
1337static int sctp_setsockopt_connectx_old(struct sock *sk,
1338					struct sockaddr __user *addrs,
1339					int addrs_size)
1340{
1341	return __sctp_setsockopt_connectx(sk, addrs, addrs_size, NULL);
1342}
1343
1344/*
1345 * New interface for the API.  The since the API is done with a socket
1346 * option, to make it simple we feed back the association id is as a return
1347 * indication to the call.  Error is always negative and association id is
1348 * always positive.
1349 */
1350static int sctp_setsockopt_connectx(struct sock *sk,
1351				    struct sockaddr __user *addrs,
1352				    int addrs_size)
1353{
1354	sctp_assoc_t assoc_id = 0;
1355	int err = 0;
1356
1357	err = __sctp_setsockopt_connectx(sk, addrs, addrs_size, &assoc_id);
1358
1359	if (err)
1360		return err;
1361	else
1362		return assoc_id;
1363}
1364
1365/*
1366 * New (hopefully final) interface for the API.
1367 * We use the sctp_getaddrs_old structure so that use-space library
1368 * can avoid any unnecessary allocations. The only different part
1369 * is that we store the actual length of the address buffer into the
1370 * addrs_num structure member. That way we can re-use the existing
1371 * code.
1372 */
1373#ifdef CONFIG_COMPAT
1374struct compat_sctp_getaddrs_old {
1375	sctp_assoc_t	assoc_id;
1376	s32		addr_num;
1377	compat_uptr_t	addrs;		/* struct sockaddr * */
1378};
1379#endif
1380
1381static int sctp_getsockopt_connectx3(struct sock *sk, int len,
1382				     char __user *optval,
1383				     int __user *optlen)
1384{
1385	struct sctp_getaddrs_old param;
1386	sctp_assoc_t assoc_id = 0;
1387	int err = 0;
1388
1389#ifdef CONFIG_COMPAT
1390	if (is_compat_task()) {
1391		struct compat_sctp_getaddrs_old param32;
1392
1393		if (len < sizeof(param32))
1394			return -EINVAL;
1395		if (copy_from_user(&param32, optval, sizeof(param32)))
1396			return -EFAULT;
1397
1398		param.assoc_id = param32.assoc_id;
1399		param.addr_num = param32.addr_num;
1400		param.addrs = compat_ptr(param32.addrs);
1401	} else
1402#endif
1403	{
1404		if (len < sizeof(param))
1405			return -EINVAL;
1406		if (copy_from_user(&param, optval, sizeof(param)))
1407			return -EFAULT;
1408	}
1409
1410	err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
1411					 param.addrs, param.addr_num,
1412					 &assoc_id);
1413	if (err == 0 || err == -EINPROGRESS) {
1414		if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
1415			return -EFAULT;
1416		if (put_user(sizeof(assoc_id), optlen))
1417			return -EFAULT;
1418	}
1419
1420	return err;
1421}
1422
1423/* API 3.1.4 close() - UDP Style Syntax
1424 * Applications use close() to perform graceful shutdown (as described in
1425 * Section 10.1 of [SCTP]) on ALL the associations currently represented
1426 * by a UDP-style socket.
1427 *
1428 * The syntax is
1429 *
1430 *   ret = close(int sd);
1431 *
1432 *   sd      - the socket descriptor of the associations to be closed.
1433 *
1434 * To gracefully shutdown a specific association represented by the
1435 * UDP-style socket, an application should use the sendmsg() call,
1436 * passing no user data, but including the appropriate flag in the
1437 * ancillary data (see Section xxxx).
1438 *
1439 * If sd in the close() call is a branched-off socket representing only
1440 * one association, the shutdown is performed on that association only.
1441 *
1442 * 4.1.6 close() - TCP Style Syntax
1443 *
1444 * Applications use close() to gracefully close down an association.
1445 *
1446 * The syntax is:
1447 *
1448 *    int close(int sd);
1449 *
1450 *      sd      - the socket descriptor of the association to be closed.
1451 *
1452 * After an application calls close() on a socket descriptor, no further
1453 * socket operations will succeed on that descriptor.
1454 *
1455 * API 7.1.4 SO_LINGER
1456 *
1457 * An application using the TCP-style socket can use this option to
1458 * perform the SCTP ABORT primitive.  The linger option structure is:
1459 *
1460 *  struct  linger {
1461 *     int     l_onoff;                // option on/off
1462 *     int     l_linger;               // linger time
1463 * };
1464 *
1465 * To enable the option, set l_onoff to 1.  If the l_linger value is set
1466 * to 0, calling close() is the same as the ABORT primitive.  If the
1467 * value is set to a negative value, the setsockopt() call will return
1468 * an error.  If the value is set to a positive value linger_time, the
1469 * close() can be blocked for at most linger_time ms.  If the graceful
1470 * shutdown phase does not finish during this period, close() will
1471 * return but the graceful shutdown phase continues in the system.
1472 */
1473static void sctp_close(struct sock *sk, long timeout)
1474{
1475	struct net *net = sock_net(sk);
1476	struct sctp_endpoint *ep;
1477	struct sctp_association *asoc;
1478	struct list_head *pos, *temp;
1479	unsigned int data_was_unread;
1480
1481	pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
1482
1483	lock_sock(sk);
1484	sk->sk_shutdown = SHUTDOWN_MASK;
1485	sk->sk_state = SCTP_SS_CLOSING;
1486
1487	ep = sctp_sk(sk)->ep;
1488
1489	/* Clean up any skbs sitting on the receive queue.  */
1490	data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
1491	data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
1492
1493	/* Walk all associations on an endpoint.  */
1494	list_for_each_safe(pos, temp, &ep->asocs) {
1495		asoc = list_entry(pos, struct sctp_association, asocs);
1496
1497		if (sctp_style(sk, TCP)) {
1498			/* A closed association can still be in the list if
1499			 * it belongs to a TCP-style listening socket that is
1500			 * not yet accepted. If so, free it. If not, send an
1501			 * ABORT or SHUTDOWN based on the linger options.
1502			 */
1503			if (sctp_state(asoc, CLOSED)) {
1504				sctp_unhash_established(asoc);
1505				sctp_association_free(asoc);
1506				continue;
1507			}
1508		}
1509
1510		if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
1511		    !skb_queue_empty(&asoc->ulpq.reasm) ||
1512		    (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
1513			struct sctp_chunk *chunk;
1514
1515			chunk = sctp_make_abort_user(asoc, NULL, 0);
1516			sctp_primitive_ABORT(net, asoc, chunk);
1517		} else
1518			sctp_primitive_SHUTDOWN(net, asoc, NULL);
1519	}
1520
1521	/* On a TCP-style socket, block for at most linger_time if set. */
1522	if (sctp_style(sk, TCP) && timeout)
1523		sctp_wait_for_close(sk, timeout);
1524
1525	/* This will run the backlog queue.  */
1526	release_sock(sk);
1527
1528	/* Supposedly, no process has access to the socket, but
1529	 * the net layers still may.
1530	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
1531	 * held and that should be grabbed before socket lock.
1532	 */
1533	spin_lock_bh(&net->sctp.addr_wq_lock);
1534	bh_lock_sock(sk);
1535
1536	/* Hold the sock, since sk_common_release() will put sock_put()
1537	 * and we have just a little more cleanup.
1538	 */
1539	sock_hold(sk);
1540	sk_common_release(sk);
1541
1542	bh_unlock_sock(sk);
1543	spin_unlock_bh(&net->sctp.addr_wq_lock);
1544
1545	sock_put(sk);
1546
1547	SCTP_DBG_OBJCNT_DEC(sock);
1548}
1549
1550/* Handle EPIPE error. */
1551static int sctp_error(struct sock *sk, int flags, int err)
1552{
1553	if (err == -EPIPE)
1554		err = sock_error(sk) ? : -EPIPE;
1555	if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
1556		send_sig(SIGPIPE, current, 0);
1557	return err;
1558}
1559
1560/* API 3.1.3 sendmsg() - UDP Style Syntax
1561 *
1562 * An application uses sendmsg() and recvmsg() calls to transmit data to
1563 * and receive data from its peer.
1564 *
1565 *  ssize_t sendmsg(int socket, const struct msghdr *message,
1566 *                  int flags);
1567 *
1568 *  socket  - the socket descriptor of the endpoint.
1569 *  message - pointer to the msghdr structure which contains a single
1570 *            user message and possibly some ancillary data.
1571 *
1572 *            See Section 5 for complete description of the data
1573 *            structures.
1574 *
1575 *  flags   - flags sent or received with the user message, see Section
1576 *            5 for complete description of the flags.
1577 *
1578 * Note:  This function could use a rewrite especially when explicit
1579 * connect support comes in.
1580 */
1581/* BUG:  We do not implement the equivalent of sk_stream_wait_memory(). */
1582
1583static int sctp_msghdr_parse(const struct msghdr *, sctp_cmsgs_t *);
1584
1585static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
1586{
1587	struct net *net = sock_net(sk);
1588	struct sctp_sock *sp;
1589	struct sctp_endpoint *ep;
1590	struct sctp_association *new_asoc = NULL, *asoc = NULL;
1591	struct sctp_transport *transport, *chunk_tp;
1592	struct sctp_chunk *chunk;
1593	union sctp_addr to;
1594	struct sockaddr *msg_name = NULL;
1595	struct sctp_sndrcvinfo default_sinfo;
1596	struct sctp_sndrcvinfo *sinfo;
1597	struct sctp_initmsg *sinit;
1598	sctp_assoc_t associd = 0;
1599	sctp_cmsgs_t cmsgs = { NULL };
1600	sctp_scope_t scope;
1601	bool fill_sinfo_ttl = false, wait_connect = false;
1602	struct sctp_datamsg *datamsg;
1603	int msg_flags = msg->msg_flags;
1604	__u16 sinfo_flags = 0;
1605	long timeo;
1606	int err;
1607
1608	err = 0;
1609	sp = sctp_sk(sk);
1610	ep = sp->ep;
1611
1612	pr_debug("%s: sk:%p, msg:%p, msg_len:%zu ep:%p\n", __func__, sk,
1613		 msg, msg_len, ep);
1614
1615	/* We cannot send a message over a TCP-style listening socket. */
1616	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING)) {
1617		err = -EPIPE;
1618		goto out_nounlock;
1619	}
1620
1621	/* Parse out the SCTP CMSGs.  */
1622	err = sctp_msghdr_parse(msg, &cmsgs);
1623	if (err) {
1624		pr_debug("%s: msghdr parse err:%x\n", __func__, err);
1625		goto out_nounlock;
1626	}
1627
1628	/* Fetch the destination address for this packet.  This
1629	 * address only selects the association--it is not necessarily
1630	 * the address we will send to.
1631	 * For a peeled-off socket, msg_name is ignored.
1632	 */
1633	if (!sctp_style(sk, UDP_HIGH_BANDWIDTH) && msg->msg_name) {
1634		int msg_namelen = msg->msg_namelen;
1635
1636		err = sctp_verify_addr(sk, (union sctp_addr *)msg->msg_name,
1637				       msg_namelen);
1638		if (err)
1639			return err;
1640
1641		if (msg_namelen > sizeof(to))
1642			msg_namelen = sizeof(to);
1643		memcpy(&to, msg->msg_name, msg_namelen);
1644		msg_name = msg->msg_name;
1645	}
1646
1647	sinit = cmsgs.init;
1648	if (cmsgs.sinfo != NULL) {
1649		memset(&default_sinfo, 0, sizeof(default_sinfo));
1650		default_sinfo.sinfo_stream = cmsgs.sinfo->snd_sid;
1651		default_sinfo.sinfo_flags = cmsgs.sinfo->snd_flags;
1652		default_sinfo.sinfo_ppid = cmsgs.sinfo->snd_ppid;
1653		default_sinfo.sinfo_context = cmsgs.sinfo->snd_context;
1654		default_sinfo.sinfo_assoc_id = cmsgs.sinfo->snd_assoc_id;
1655
1656		sinfo = &default_sinfo;
1657		fill_sinfo_ttl = true;
1658	} else {
1659		sinfo = cmsgs.srinfo;
1660	}
1661	/* Did the user specify SNDINFO/SNDRCVINFO? */
1662	if (sinfo) {
1663		sinfo_flags = sinfo->sinfo_flags;
1664		associd = sinfo->sinfo_assoc_id;
1665	}
1666
1667	pr_debug("%s: msg_len:%zu, sinfo_flags:0x%x\n", __func__,
1668		 msg_len, sinfo_flags);
1669
1670	/* SCTP_EOF or SCTP_ABORT cannot be set on a TCP-style socket. */
1671	if (sctp_style(sk, TCP) && (sinfo_flags & (SCTP_EOF | SCTP_ABORT))) {
1672		err = -EINVAL;
1673		goto out_nounlock;
1674	}
1675
1676	/* If SCTP_EOF is set, no data can be sent. Disallow sending zero
1677	 * length messages when SCTP_EOF|SCTP_ABORT is not set.
1678	 * If SCTP_ABORT is set, the message length could be non zero with
1679	 * the msg_iov set to the user abort reason.
1680	 */
1681	if (((sinfo_flags & SCTP_EOF) && (msg_len > 0)) ||
1682	    (!(sinfo_flags & (SCTP_EOF|SCTP_ABORT)) && (msg_len == 0))) {
1683		err = -EINVAL;
1684		goto out_nounlock;
1685	}
1686
1687	/* If SCTP_ADDR_OVER is set, there must be an address
1688	 * specified in msg_name.
1689	 */
1690	if ((sinfo_flags & SCTP_ADDR_OVER) && (!msg->msg_name)) {
1691		err = -EINVAL;
1692		goto out_nounlock;
1693	}
1694
1695	transport = NULL;
1696
1697	pr_debug("%s: about to look up association\n", __func__);
1698
1699	lock_sock(sk);
1700
1701	/* If a msg_name has been specified, assume this is to be used.  */
1702	if (msg_name) {
1703		/* Look for a matching association on the endpoint. */
1704		asoc = sctp_endpoint_lookup_assoc(ep, &to, &transport);
1705		if (!asoc) {
1706			/* If we could not find a matching association on the
1707			 * endpoint, make sure that it is not a TCP-style
1708			 * socket that already has an association or there is
1709			 * no peeled-off association on another socket.
1710			 */
1711			if ((sctp_style(sk, TCP) &&
1712			     sctp_sstate(sk, ESTABLISHED)) ||
1713			    sctp_endpoint_is_peeled_off(ep, &to)) {
1714				err = -EADDRNOTAVAIL;
1715				goto out_unlock;
1716			}
1717		}
1718	} else {
1719		asoc = sctp_id2assoc(sk, associd);
1720		if (!asoc) {
1721			err = -EPIPE;
1722			goto out_unlock;
1723		}
1724	}
1725
1726	if (asoc) {
1727		pr_debug("%s: just looked up association:%p\n", __func__, asoc);
1728
1729		/* We cannot send a message on a TCP-style SCTP_SS_ESTABLISHED
1730		 * socket that has an association in CLOSED state. This can
1731		 * happen when an accepted socket has an association that is
1732		 * already CLOSED.
1733		 */
1734		if (sctp_state(asoc, CLOSED) && sctp_style(sk, TCP)) {
1735			err = -EPIPE;
1736			goto out_unlock;
1737		}
1738
1739		if (sinfo_flags & SCTP_EOF) {
1740			pr_debug("%s: shutting down association:%p\n",
1741				 __func__, asoc);
1742
1743			sctp_primitive_SHUTDOWN(net, asoc, NULL);
1744			err = 0;
1745			goto out_unlock;
1746		}
1747		if (sinfo_flags & SCTP_ABORT) {
1748
1749			chunk = sctp_make_abort_user(asoc, msg, msg_len);
1750			if (!chunk) {
1751				err = -ENOMEM;
1752				goto out_unlock;
1753			}
1754
1755			pr_debug("%s: aborting association:%p\n",
1756				 __func__, asoc);
1757
1758			sctp_primitive_ABORT(net, asoc, chunk);
1759			err = 0;
1760			goto out_unlock;
1761		}
1762	}
1763
1764	/* Do we need to create the association?  */
1765	if (!asoc) {
1766		pr_debug("%s: there is no association yet\n", __func__);
1767
1768		if (sinfo_flags & (SCTP_EOF | SCTP_ABORT)) {
1769			err = -EINVAL;
1770			goto out_unlock;
1771		}
1772
1773		/* Check for invalid stream against the stream counts,
1774		 * either the default or the user specified stream counts.
1775		 */
1776		if (sinfo) {
1777			if (!sinit || !sinit->sinit_num_ostreams) {
1778				/* Check against the defaults. */
1779				if (sinfo->sinfo_stream >=
1780				    sp->initmsg.sinit_num_ostreams) {
1781					err = -EINVAL;
1782					goto out_unlock;
1783				}
1784			} else {
1785				/* Check against the requested.  */
1786				if (sinfo->sinfo_stream >=
1787				    sinit->sinit_num_ostreams) {
1788					err = -EINVAL;
1789					goto out_unlock;
1790				}
1791			}
1792		}
1793
1794		/*
1795		 * API 3.1.2 bind() - UDP Style Syntax
1796		 * If a bind() or sctp_bindx() is not called prior to a
1797		 * sendmsg() call that initiates a new association, the
1798		 * system picks an ephemeral port and will choose an address
1799		 * set equivalent to binding with a wildcard address.
1800		 */
1801		if (!ep->base.bind_addr.port) {
1802			if (sctp_autobind(sk)) {
1803				err = -EAGAIN;
1804				goto out_unlock;
1805			}
1806		} else {
1807			/*
1808			 * If an unprivileged user inherits a one-to-many
1809			 * style socket with open associations on a privileged
1810			 * port, it MAY be permitted to accept new associations,
1811			 * but it SHOULD NOT be permitted to open new
1812			 * associations.
1813			 */
1814			if (ep->base.bind_addr.port < PROT_SOCK &&
1815			    !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE)) {
1816				err = -EACCES;
1817				goto out_unlock;
1818			}
1819		}
1820
1821		scope = sctp_scope(&to);
1822		new_asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
1823		if (!new_asoc) {
1824			err = -ENOMEM;
1825			goto out_unlock;
1826		}
1827		asoc = new_asoc;
1828		err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
1829		if (err < 0) {
1830			err = -ENOMEM;
1831			goto out_free;
1832		}
1833
1834		/* If the SCTP_INIT ancillary data is specified, set all
1835		 * the association init values accordingly.
1836		 */
1837		if (sinit) {
1838			if (sinit->sinit_num_ostreams) {
1839				asoc->c.sinit_num_ostreams =
1840					sinit->sinit_num_ostreams;
1841			}
1842			if (sinit->sinit_max_instreams) {
1843				asoc->c.sinit_max_instreams =
1844					sinit->sinit_max_instreams;
1845			}
1846			if (sinit->sinit_max_attempts) {
1847				asoc->max_init_attempts
1848					= sinit->sinit_max_attempts;
1849			}
1850			if (sinit->sinit_max_init_timeo) {
1851				asoc->max_init_timeo =
1852				 msecs_to_jiffies(sinit->sinit_max_init_timeo);
1853			}
1854		}
1855
1856		/* Prime the peer's transport structures.  */
1857		transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL, SCTP_UNKNOWN);
1858		if (!transport) {
1859			err = -ENOMEM;
1860			goto out_free;
1861		}
1862	}
1863
1864	/* ASSERT: we have a valid association at this point.  */
1865	pr_debug("%s: we have a valid association\n", __func__);
1866
1867	if (!sinfo) {
1868		/* If the user didn't specify SNDINFO/SNDRCVINFO, make up
1869		 * one with some defaults.
1870		 */
1871		memset(&default_sinfo, 0, sizeof(default_sinfo));
1872		default_sinfo.sinfo_stream = asoc->default_stream;
1873		default_sinfo.sinfo_flags = asoc->default_flags;
1874		default_sinfo.sinfo_ppid = asoc->default_ppid;
1875		default_sinfo.sinfo_context = asoc->default_context;
1876		default_sinfo.sinfo_timetolive = asoc->default_timetolive;
1877		default_sinfo.sinfo_assoc_id = sctp_assoc2id(asoc);
1878
1879		sinfo = &default_sinfo;
1880	} else if (fill_sinfo_ttl) {
1881		/* In case SNDINFO was specified, we still need to fill
1882		 * it with a default ttl from the assoc here.
1883		 */
1884		sinfo->sinfo_timetolive = asoc->default_timetolive;
1885	}
1886
1887	/* API 7.1.7, the sndbuf size per association bounds the
1888	 * maximum size of data that can be sent in a single send call.
1889	 */
1890	if (msg_len > sk->sk_sndbuf) {
1891		err = -EMSGSIZE;
1892		goto out_free;
1893	}
1894
1895	if (asoc->pmtu_pending)
1896		sctp_assoc_pending_pmtu(sk, asoc);
1897
1898	/* If fragmentation is disabled and the message length exceeds the
1899	 * association fragmentation point, return EMSGSIZE.  The I-D
1900	 * does not specify what this error is, but this looks like
1901	 * a great fit.
1902	 */
1903	if (sctp_sk(sk)->disable_fragments && (msg_len > asoc->frag_point)) {
1904		err = -EMSGSIZE;
1905		goto out_free;
1906	}
1907
1908	/* Check for invalid stream. */
1909	if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
1910		err = -EINVAL;
1911		goto out_free;
1912	}
1913
1914	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1915	if (!sctp_wspace(asoc)) {
1916		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
1917		if (err)
1918			goto out_free;
1919	}
1920
1921	/* If an address is passed with the sendto/sendmsg call, it is used
1922	 * to override the primary destination address in the TCP model, or
1923	 * when SCTP_ADDR_OVER flag is set in the UDP model.
1924	 */
1925	if ((sctp_style(sk, TCP) && msg_name) ||
1926	    (sinfo_flags & SCTP_ADDR_OVER)) {
1927		chunk_tp = sctp_assoc_lookup_paddr(asoc, &to);
1928		if (!chunk_tp) {
1929			err = -EINVAL;
1930			goto out_free;
1931		}
1932	} else
1933		chunk_tp = NULL;
1934
1935	/* Auto-connect, if we aren't connected already. */
1936	if (sctp_state(asoc, CLOSED)) {
1937		err = sctp_primitive_ASSOCIATE(net, asoc, NULL);
1938		if (err < 0)
1939			goto out_free;
1940
1941		wait_connect = true;
1942		pr_debug("%s: we associated primitively\n", __func__);
1943	}
1944
1945	/* Break the message into multiple chunks of maximum size. */
1946	datamsg = sctp_datamsg_from_user(asoc, sinfo, &msg->msg_iter);
1947	if (IS_ERR(datamsg)) {
1948		err = PTR_ERR(datamsg);
1949		goto out_free;
1950	}
1951
1952	/* Now send the (possibly) fragmented message. */
1953	list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
1954		sctp_chunk_hold(chunk);
1955
1956		/* Do accounting for the write space.  */
1957		sctp_set_owner_w(chunk);
1958
1959		chunk->transport = chunk_tp;
1960	}
1961
1962	/* Send it to the lower layers.  Note:  all chunks
1963	 * must either fail or succeed.   The lower layer
1964	 * works that way today.  Keep it that way or this
1965	 * breaks.
1966	 */
1967	err = sctp_primitive_SEND(net, asoc, datamsg);
1968	/* Did the lower layer accept the chunk? */
1969	if (err) {
1970		sctp_datamsg_free(datamsg);
1971		goto out_free;
1972	}
1973
1974	pr_debug("%s: we sent primitively\n", __func__);
1975
1976	sctp_datamsg_put(datamsg);
1977	err = msg_len;
1978
1979	if (unlikely(wait_connect)) {
1980		timeo = sock_sndtimeo(sk, msg_flags & MSG_DONTWAIT);
1981		sctp_wait_for_connect(asoc, &timeo);
1982	}
1983
1984	/* If we are already past ASSOCIATE, the lower
1985	 * layers are responsible for association cleanup.
1986	 */
1987	goto out_unlock;
1988
1989out_free:
1990	if (new_asoc) {
1991		sctp_unhash_established(asoc);
1992		sctp_association_free(asoc);
1993	}
1994out_unlock:
1995	release_sock(sk);
1996
1997out_nounlock:
1998	return sctp_error(sk, msg_flags, err);
1999
2000#if 0
2001do_sock_err:
2002	if (msg_len)
2003		err = msg_len;
2004	else
2005		err = sock_error(sk);
2006	goto out;
2007
2008do_interrupted:
2009	if (msg_len)
2010		err = msg_len;
2011	goto out;
2012#endif /* 0 */
2013}
2014
2015/* This is an extended version of skb_pull() that removes the data from the
2016 * start of a skb even when data is spread across the list of skb's in the
2017 * frag_list. len specifies the total amount of data that needs to be removed.
2018 * when 'len' bytes could be removed from the skb, it returns 0.
2019 * If 'len' exceeds the total skb length,  it returns the no. of bytes that
2020 * could not be removed.
2021 */
2022static int sctp_skb_pull(struct sk_buff *skb, int len)
2023{
2024	struct sk_buff *list;
2025	int skb_len = skb_headlen(skb);
2026	int rlen;
2027
2028	if (len <= skb_len) {
2029		__skb_pull(skb, len);
2030		return 0;
2031	}
2032	len -= skb_len;
2033	__skb_pull(skb, skb_len);
2034
2035	skb_walk_frags(skb, list) {
2036		rlen = sctp_skb_pull(list, len);
2037		skb->len -= (len-rlen);
2038		skb->data_len -= (len-rlen);
2039
2040		if (!rlen)
2041			return 0;
2042
2043		len = rlen;
2044	}
2045
2046	return len;
2047}
2048
2049/* API 3.1.3  recvmsg() - UDP Style Syntax
2050 *
2051 *  ssize_t recvmsg(int socket, struct msghdr *message,
2052 *                    int flags);
2053 *
2054 *  socket  - the socket descriptor of the endpoint.
2055 *  message - pointer to the msghdr structure which contains a single
2056 *            user message and possibly some ancillary data.
2057 *
2058 *            See Section 5 for complete description of the data
2059 *            structures.
2060 *
2061 *  flags   - flags sent or received with the user message, see Section
2062 *            5 for complete description of the flags.
2063 */
2064static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
2065			int noblock, int flags, int *addr_len)
2066{
2067	struct sctp_ulpevent *event = NULL;
2068	struct sctp_sock *sp = sctp_sk(sk);
2069	struct sk_buff *skb;
2070	int copied;
2071	int err = 0;
2072	int skb_len;
2073
2074	pr_debug("%s: sk:%p, msghdr:%p, len:%zd, noblock:%d, flags:0x%x, "
2075		 "addr_len:%p)\n", __func__, sk, msg, len, noblock, flags,
2076		 addr_len);
2077
2078	lock_sock(sk);
2079
2080	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED)) {
2081		err = -ENOTCONN;
2082		goto out;
2083	}
2084
2085	skb = sctp_skb_recv_datagram(sk, flags, noblock, &err);
2086	if (!skb)
2087		goto out;
2088
2089	/* Get the total length of the skb including any skb's in the
2090	 * frag_list.
2091	 */
2092	skb_len = skb->len;
2093
2094	copied = skb_len;
2095	if (copied > len)
2096		copied = len;
2097
2098	err = skb_copy_datagram_msg(skb, 0, msg, copied);
2099
2100	event = sctp_skb2event(skb);
2101
2102	if (err)
2103		goto out_free;
2104
2105	sock_recv_ts_and_drops(msg, sk, skb);
2106	if (sctp_ulpevent_is_notification(event)) {
2107		msg->msg_flags |= MSG_NOTIFICATION;
2108		sp->pf->event_msgname(event, msg->msg_name, addr_len);
2109	} else {
2110		sp->pf->skb_msgname(skb, msg->msg_name, addr_len);
2111	}
2112
2113	/* Check if we allow SCTP_NXTINFO. */
2114	if (sp->recvnxtinfo)
2115		sctp_ulpevent_read_nxtinfo(event, msg, sk);
2116	/* Check if we allow SCTP_RCVINFO. */
2117	if (sp->recvrcvinfo)
2118		sctp_ulpevent_read_rcvinfo(event, msg);
2119	/* Check if we allow SCTP_SNDRCVINFO. */
2120	if (sp->subscribe.sctp_data_io_event)
2121		sctp_ulpevent_read_sndrcvinfo(event, msg);
2122
2123#if 0
2124	/* FIXME: we should be calling IP/IPv6 layers.  */
2125	if (sk->sk_protinfo.af_inet.cmsg_flags)
2126		ip_cmsg_recv(msg, skb);
2127#endif
2128
2129	err = copied;
2130
2131	/* If skb's length exceeds the user's buffer, update the skb and
2132	 * push it back to the receive_queue so that the next call to
2133	 * recvmsg() will return the remaining data. Don't set MSG_EOR.
2134	 */
2135	if (skb_len > copied) {
2136		msg->msg_flags &= ~MSG_EOR;
2137		if (flags & MSG_PEEK)
2138			goto out_free;
2139		sctp_skb_pull(skb, copied);
2140		skb_queue_head(&sk->sk_receive_queue, skb);
2141
2142		/* When only partial message is copied to the user, increase
2143		 * rwnd by that amount. If all the data in the skb is read,
2144		 * rwnd is updated when the event is freed.
2145		 */
2146		if (!sctp_ulpevent_is_notification(event))
2147			sctp_assoc_rwnd_increase(event->asoc, copied);
2148		goto out;
2149	} else if ((event->msg_flags & MSG_NOTIFICATION) ||
2150		   (event->msg_flags & MSG_EOR))
2151		msg->msg_flags |= MSG_EOR;
2152	else
2153		msg->msg_flags &= ~MSG_EOR;
2154
2155out_free:
2156	if (flags & MSG_PEEK) {
2157		/* Release the skb reference acquired after peeking the skb in
2158		 * sctp_skb_recv_datagram().
2159		 */
2160		kfree_skb(skb);
2161	} else {
2162		/* Free the event which includes releasing the reference to
2163		 * the owner of the skb, freeing the skb and updating the
2164		 * rwnd.
2165		 */
2166		sctp_ulpevent_free(event);
2167	}
2168out:
2169	release_sock(sk);
2170	return err;
2171}
2172
2173/* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
2174 *
2175 * This option is a on/off flag.  If enabled no SCTP message
2176 * fragmentation will be performed.  Instead if a message being sent
2177 * exceeds the current PMTU size, the message will NOT be sent and
2178 * instead a error will be indicated to the user.
2179 */
2180static int sctp_setsockopt_disable_fragments(struct sock *sk,
2181					     char __user *optval,
2182					     unsigned int optlen)
2183{
2184	int val;
2185
2186	if (optlen < sizeof(int))
2187		return -EINVAL;
2188
2189	if (get_user(val, (int __user *)optval))
2190		return -EFAULT;
2191
2192	sctp_sk(sk)->disable_fragments = (val == 0) ? 0 : 1;
2193
2194	return 0;
2195}
2196
2197static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
2198				  unsigned int optlen)
2199{
2200	struct sctp_association *asoc;
2201	struct sctp_ulpevent *event;
2202
2203	if (optlen > sizeof(struct sctp_event_subscribe))
2204		return -EINVAL;
2205	if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
2206		return -EFAULT;
2207
2208	if (sctp_sk(sk)->subscribe.sctp_data_io_event)
2209		pr_warn_ratelimited(DEPRECATED "%s (pid %d) "
2210				    "Requested SCTP_SNDRCVINFO event.\n"
2211				    "Use SCTP_RCVINFO through SCTP_RECVRCVINFO option instead.\n",
2212				    current->comm, task_pid_nr(current));
2213
2214	/* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
2215	 * if there is no data to be sent or retransmit, the stack will
2216	 * immediately send up this notification.
2217	 */
2218	if (sctp_ulpevent_type_enabled(SCTP_SENDER_DRY_EVENT,
2219				       &sctp_sk(sk)->subscribe)) {
2220		asoc = sctp_id2assoc(sk, 0);
2221
2222		if (asoc && sctp_outq_is_empty(&asoc->outqueue)) {
2223			event = sctp_ulpevent_make_sender_dry_event(asoc,
2224					GFP_ATOMIC);
2225			if (!event)
2226				return -ENOMEM;
2227
2228			sctp_ulpq_tail_event(&asoc->ulpq, event);
2229		}
2230	}
2231
2232	return 0;
2233}
2234
2235/* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
2236 *
2237 * This socket option is applicable to the UDP-style socket only.  When
2238 * set it will cause associations that are idle for more than the
2239 * specified number of seconds to automatically close.  An association
2240 * being idle is defined an association that has NOT sent or received
2241 * user data.  The special value of '0' indicates that no automatic
2242 * close of any associations should be performed.  The option expects an
2243 * integer defining the number of seconds of idle time before an
2244 * association is closed.
2245 */
2246static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
2247				     unsigned int optlen)
2248{
2249	struct sctp_sock *sp = sctp_sk(sk);
2250	struct net *net = sock_net(sk);
2251
2252	/* Applicable to UDP-style socket only */
2253	if (sctp_style(sk, TCP))
2254		return -EOPNOTSUPP;
2255	if (optlen != sizeof(int))
2256		return -EINVAL;
2257	if (copy_from_user(&sp->autoclose, optval, optlen))
2258		return -EFAULT;
2259
2260	if (sp->autoclose > net->sctp.max_autoclose)
2261		sp->autoclose = net->sctp.max_autoclose;
2262
2263	return 0;
2264}
2265
2266/* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
2267 *
2268 * Applications can enable or disable heartbeats for any peer address of
2269 * an association, modify an address's heartbeat interval, force a
2270 * heartbeat to be sent immediately, and adjust the address's maximum
2271 * number of retransmissions sent before an address is considered
2272 * unreachable.  The following structure is used to access and modify an
2273 * address's parameters:
2274 *
2275 *  struct sctp_paddrparams {
2276 *     sctp_assoc_t            spp_assoc_id;
2277 *     struct sockaddr_storage spp_address;
2278 *     uint32_t                spp_hbinterval;
2279 *     uint16_t                spp_pathmaxrxt;
2280 *     uint32_t                spp_pathmtu;
2281 *     uint32_t                spp_sackdelay;
2282 *     uint32_t                spp_flags;
2283 * };
2284 *
2285 *   spp_assoc_id    - (one-to-many style socket) This is filled in the
2286 *                     application, and identifies the association for
2287 *                     this query.
2288 *   spp_address     - This specifies which address is of interest.
2289 *   spp_hbinterval  - This contains the value of the heartbeat interval,
2290 *                     in milliseconds.  If a  value of zero
2291 *                     is present in this field then no changes are to
2292 *                     be made to this parameter.
2293 *   spp_pathmaxrxt  - This contains the maximum number of
2294 *                     retransmissions before this address shall be
2295 *                     considered unreachable. If a  value of zero
2296 *                     is present in this field then no changes are to
2297 *                     be made to this parameter.
2298 *   spp_pathmtu     - When Path MTU discovery is disabled the value
2299 *                     specified here will be the "fixed" path mtu.
2300 *                     Note that if the spp_address field is empty
2301 *                     then all associations on this address will
2302 *                     have this fixed path mtu set upon them.
2303 *
2304 *   spp_sackdelay   - When delayed sack is enabled, this value specifies
2305 *                     the number of milliseconds that sacks will be delayed
2306 *                     for. This value will apply to all addresses of an
2307 *                     association if the spp_address field is empty. Note
2308 *                     also, that if delayed sack is enabled and this
2309 *                     value is set to 0, no change is made to the last
2310 *                     recorded delayed sack timer value.
2311 *
2312 *   spp_flags       - These flags are used to control various features
2313 *                     on an association. The flag field may contain
2314 *                     zero or more of the following options.
2315 *
2316 *                     SPP_HB_ENABLE  - Enable heartbeats on the
2317 *                     specified address. Note that if the address
2318 *                     field is empty all addresses for the association
2319 *                     have heartbeats enabled upon them.
2320 *
2321 *                     SPP_HB_DISABLE - Disable heartbeats on the
2322 *                     speicifed address. Note that if the address
2323 *                     field is empty all addresses for the association
2324 *                     will have their heartbeats disabled. Note also
2325 *                     that SPP_HB_ENABLE and SPP_HB_DISABLE are
2326 *                     mutually exclusive, only one of these two should
2327 *                     be specified. Enabling both fields will have
2328 *                     undetermined results.
2329 *
2330 *                     SPP_HB_DEMAND - Request a user initiated heartbeat
2331 *                     to be made immediately.
2332 *
2333 *                     SPP_HB_TIME_IS_ZERO - Specify's that the time for
2334 *                     heartbeat delayis to be set to the value of 0
2335 *                     milliseconds.
2336 *
2337 *                     SPP_PMTUD_ENABLE - This field will enable PMTU
2338 *                     discovery upon the specified address. Note that
2339 *                     if the address feild is empty then all addresses
2340 *                     on the association are effected.
2341 *
2342 *                     SPP_PMTUD_DISABLE - This field will disable PMTU
2343 *                     discovery upon the specified address. Note that
2344 *                     if the address feild is empty then all addresses
2345 *                     on the association are effected. Not also that
2346 *                     SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
2347 *                     exclusive. Enabling both will have undetermined
2348 *                     results.
2349 *
2350 *                     SPP_SACKDELAY_ENABLE - Setting this flag turns
2351 *                     on delayed sack. The time specified in spp_sackdelay
2352 *                     is used to specify the sack delay for this address. Note
2353 *                     that if spp_address is empty then all addresses will
2354 *                     enable delayed sack and take on the sack delay
2355 *                     value specified in spp_sackdelay.
2356 *                     SPP_SACKDELAY_DISABLE - Setting this flag turns
2357 *                     off delayed sack. If the spp_address field is blank then
2358 *                     delayed sack is disabled for the entire association. Note
2359 *                     also that this field is mutually exclusive to
2360 *                     SPP_SACKDELAY_ENABLE, setting both will have undefined
2361 *                     results.
2362 */
2363static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
2364				       struct sctp_transport   *trans,
2365				       struct sctp_association *asoc,
2366				       struct sctp_sock        *sp,
2367				       int                      hb_change,
2368				       int                      pmtud_change,
2369				       int                      sackdelay_change)
2370{
2371	int error;
2372
2373	if (params->spp_flags & SPP_HB_DEMAND && trans) {
2374		struct net *net = sock_net(trans->asoc->base.sk);
2375
2376		error = sctp_primitive_REQUESTHEARTBEAT(net, trans->asoc, trans);
2377		if (error)
2378			return error;
2379	}
2380
2381	/* Note that unless the spp_flag is set to SPP_HB_ENABLE the value of
2382	 * this field is ignored.  Note also that a value of zero indicates
2383	 * the current setting should be left unchanged.
2384	 */
2385	if (params->spp_flags & SPP_HB_ENABLE) {
2386
2387		/* Re-zero the interval if the SPP_HB_TIME_IS_ZERO is
2388		 * set.  This lets us use 0 value when this flag
2389		 * is set.
2390		 */
2391		if (params->spp_flags & SPP_HB_TIME_IS_ZERO)
2392			params->spp_hbinterval = 0;
2393
2394		if (params->spp_hbinterval ||
2395		    (params->spp_flags & SPP_HB_TIME_IS_ZERO)) {
2396			if (trans) {
2397				trans->hbinterval =
2398				    msecs_to_jiffies(params->spp_hbinterval);
2399			} else if (asoc) {
2400				asoc->hbinterval =
2401				    msecs_to_jiffies(params->spp_hbinterval);
2402			} else {
2403				sp->hbinterval = params->spp_hbinterval;
2404			}
2405		}
2406	}
2407
2408	if (hb_change) {
2409		if (trans) {
2410			trans->param_flags =
2411				(trans->param_flags & ~SPP_HB) | hb_change;
2412		} else if (asoc) {
2413			asoc->param_flags =
2414				(asoc->param_flags & ~SPP_HB) | hb_change;
2415		} else {
2416			sp->param_flags =
2417				(sp->param_flags & ~SPP_HB) | hb_change;
2418		}
2419	}
2420
2421	/* When Path MTU discovery is disabled the value specified here will
2422	 * be the "fixed" path mtu (i.e. the value of the spp_flags field must
2423	 * include the flag SPP_PMTUD_DISABLE for this field to have any
2424	 * effect).
2425	 */
2426	if ((params->spp_flags & SPP_PMTUD_DISABLE) && params->spp_pathmtu) {
2427		if (trans) {
2428			trans->pathmtu = params->spp_pathmtu;
2429			sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
2430		} else if (asoc) {
2431			asoc->pathmtu = params->spp_pathmtu;
2432			sctp_frag_point(asoc, params->spp_pathmtu);
2433		} else {
2434			sp->pathmtu = params->spp_pathmtu;
2435		}
2436	}
2437
2438	if (pmtud_change) {
2439		if (trans) {
2440			int update = (trans->param_flags & SPP_PMTUD_DISABLE) &&
2441				(params->spp_flags & SPP_PMTUD_ENABLE);
2442			trans->param_flags =
2443				(trans->param_flags & ~SPP_PMTUD) | pmtud_change;
2444			if (update) {
2445				sctp_transport_pmtu(trans, sctp_opt2sk(sp));
2446				sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
2447			}
2448		} else if (asoc) {
2449			asoc->param_flags =
2450				(asoc->param_flags & ~SPP_PMTUD) | pmtud_change;
2451		} else {
2452			sp->param_flags =
2453				(sp->param_flags & ~SPP_PMTUD) | pmtud_change;
2454		}
2455	}
2456
2457	/* Note that unless the spp_flag is set to SPP_SACKDELAY_ENABLE the
2458	 * value of this field is ignored.  Note also that a value of zero
2459	 * indicates the current setting should be left unchanged.
2460	 */
2461	if ((params->spp_flags & SPP_SACKDELAY_ENABLE) && params->spp_sackdelay) {
2462		if (trans) {
2463			trans->sackdelay =
2464				msecs_to_jiffies(params->spp_sackdelay);
2465		} else if (asoc) {
2466			asoc->sackdelay =
2467				msecs_to_jiffies(params->spp_sackdelay);
2468		} else {
2469			sp->sackdelay = params->spp_sackdelay;
2470		}
2471	}
2472
2473	if (sackdelay_change) {
2474		if (trans) {
2475			trans->param_flags =
2476				(trans->param_flags & ~SPP_SACKDELAY) |
2477				sackdelay_change;
2478		} else if (asoc) {
2479			asoc->param_flags =
2480				(asoc->param_flags & ~SPP_SACKDELAY) |
2481				sackdelay_change;
2482		} else {
2483			sp->param_flags =
2484				(sp->param_flags & ~SPP_SACKDELAY) |
2485				sackdelay_change;
2486		}
2487	}
2488
2489	/* Note that a value of zero indicates the current setting should be
2490	   left unchanged.
2491	 */
2492	if (params->spp_pathmaxrxt) {
2493		if (trans) {
2494			trans->pathmaxrxt = params->spp_pathmaxrxt;
2495		} else if (asoc) {
2496			asoc->pathmaxrxt = params->spp_pathmaxrxt;
2497		} else {
2498			sp->pathmaxrxt = params->spp_pathmaxrxt;
2499		}
2500	}
2501
2502	return 0;
2503}
2504
2505static int sctp_setsockopt_peer_addr_params(struct sock *sk,
2506					    char __user *optval,
2507					    unsigned int optlen)
2508{
2509	struct sctp_paddrparams  params;
2510	struct sctp_transport   *trans = NULL;
2511	struct sctp_association *asoc = NULL;
2512	struct sctp_sock        *sp = sctp_sk(sk);
2513	int error;
2514	int hb_change, pmtud_change, sackdelay_change;
2515
2516	if (optlen != sizeof(struct sctp_paddrparams))
2517		return -EINVAL;
2518
2519	if (copy_from_user(&params, optval, optlen))
2520		return -EFAULT;
2521
2522	/* Validate flags and value parameters. */
2523	hb_change        = params.spp_flags & SPP_HB;
2524	pmtud_change     = params.spp_flags & SPP_PMTUD;
2525	sackdelay_change = params.spp_flags & SPP_SACKDELAY;
2526
2527	if (hb_change        == SPP_HB ||
2528	    pmtud_change     == SPP_PMTUD ||
2529	    sackdelay_change == SPP_SACKDELAY ||
2530	    params.spp_sackdelay > 500 ||
2531	    (params.spp_pathmtu &&
2532	     params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
2533		return -EINVAL;
2534
2535	/* If an address other than INADDR_ANY is specified, and
2536	 * no transport is found, then the request is invalid.
2537	 */
2538	if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
2539		trans = sctp_addr_id2transport(sk, &params.spp_address,
2540					       params.spp_assoc_id);
2541		if (!trans)
2542			return -EINVAL;
2543	}
2544
2545	/* Get association, if assoc_id != 0 and the socket is a one
2546	 * to many style socket, and an association was not found, then
2547	 * the id was invalid.
2548	 */
2549	asoc = sctp_id2assoc(sk, params.spp_assoc_id);
2550	if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP))
2551		return -EINVAL;
2552
2553	/* Heartbeat demand can only be sent on a transport or
2554	 * association, but not a socket.
2555	 */
2556	if (params.spp_flags & SPP_HB_DEMAND && !trans && !asoc)
2557		return -EINVAL;
2558
2559	/* Process parameters. */
2560	error = sctp_apply_peer_addr_params(&params, trans, asoc, sp,
2561					    hb_change, pmtud_change,
2562					    sackdelay_change);
2563
2564	if (error)
2565		return error;
2566
2567	/* If changes are for association, also apply parameters to each
2568	 * transport.
2569	 */
2570	if (!trans && asoc) {
2571		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2572				transports) {
2573			sctp_apply_peer_addr_params(&params, trans, asoc, sp,
2574						    hb_change, pmtud_change,
2575						    sackdelay_change);
2576		}
2577	}
2578
2579	return 0;
2580}
2581
2582static inline __u32 sctp_spp_sackdelay_enable(__u32 param_flags)
2583{
2584	return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_ENABLE;
2585}
2586
2587static inline __u32 sctp_spp_sackdelay_disable(__u32 param_flags)
2588{
2589	return (param_flags & ~SPP_SACKDELAY) | SPP_SACKDELAY_DISABLE;
2590}
2591
2592/*
2593 * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
2594 *
2595 * This option will effect the way delayed acks are performed.  This
2596 * option allows you to get or set the delayed ack time, in
2597 * milliseconds.  It also allows changing the delayed ack frequency.
2598 * Changing the frequency to 1 disables the delayed sack algorithm.  If
2599 * the assoc_id is 0, then this sets or gets the endpoints default
2600 * values.  If the assoc_id field is non-zero, then the set or get
2601 * effects the specified association for the one to many model (the
2602 * assoc_id field is ignored by the one to one model).  Note that if
2603 * sack_delay or sack_freq are 0 when setting this option, then the
2604 * current values will remain unchanged.
2605 *
2606 * struct sctp_sack_info {
2607 *     sctp_assoc_t            sack_assoc_id;
2608 *     uint32_t                sack_delay;
2609 *     uint32_t                sack_freq;
2610 * };
2611 *
2612 * sack_assoc_id -  This parameter, indicates which association the user
2613 *    is performing an action upon.  Note that if this field's value is
2614 *    zero then the endpoints default value is changed (effecting future
2615 *    associations only).
2616 *
2617 * sack_delay -  This parameter contains the number of milliseconds that
2618 *    the user is requesting the delayed ACK timer be set to.  Note that
2619 *    this value is defined in the standard to be between 200 and 500
2620 *    milliseconds.
2621 *
2622 * sack_freq -  This parameter contains the number of packets that must
2623 *    be received before a sack is sent without waiting for the delay
2624 *    timer to expire.  The default value for this is 2, setting this
2625 *    value to 1 will disable the delayed sack algorithm.
2626 */
2627
2628static int sctp_setsockopt_delayed_ack(struct sock *sk,
2629				       char __user *optval, unsigned int optlen)
2630{
2631	struct sctp_sack_info    params;
2632	struct sctp_transport   *trans = NULL;
2633	struct sctp_association *asoc = NULL;
2634	struct sctp_sock        *sp = sctp_sk(sk);
2635
2636	if (optlen == sizeof(struct sctp_sack_info)) {
2637		if (copy_from_user(&params, optval, optlen))
2638			return -EFAULT;
2639
2640		if (params.sack_delay == 0 && params.sack_freq == 0)
2641			return 0;
2642	} else if (optlen == sizeof(struct sctp_assoc_value)) {
2643		pr_warn_ratelimited(DEPRECATED
2644				    "%s (pid %d) "
2645				    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
2646				    "Use struct sctp_sack_info instead\n",
2647				    current->comm, task_pid_nr(current));
2648		if (copy_from_user(&params, optval, optlen))
2649			return -EFAULT;
2650
2651		if (params.sack_delay == 0)
2652			params.sack_freq = 1;
2653		else
2654			params.sack_freq = 0;
2655	} else
2656		return -EINVAL;
2657
2658	/* Validate value parameter. */
2659	if (params.sack_delay > 500)
2660		return -EINVAL;
2661
2662	/* Get association, if sack_assoc_id != 0 and the socket is a one
2663	 * to many style socket, and an association was not found, then
2664	 * the id was invalid.
2665	 */
2666	asoc = sctp_id2assoc(sk, params.sack_assoc_id);
2667	if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
2668		return -EINVAL;
2669
2670	if (params.sack_delay) {
2671		if (asoc) {
2672			asoc->sackdelay =
2673				msecs_to_jiffies(params.sack_delay);
2674			asoc->param_flags =
2675				sctp_spp_sackdelay_enable(asoc->param_flags);
2676		} else {
2677			sp->sackdelay = params.sack_delay;
2678			sp->param_flags =
2679				sctp_spp_sackdelay_enable(sp->param_flags);
2680		}
2681	}
2682
2683	if (params.sack_freq == 1) {
2684		if (asoc) {
2685			asoc->param_flags =
2686				sctp_spp_sackdelay_disable(asoc->param_flags);
2687		} else {
2688			sp->param_flags =
2689				sctp_spp_sackdelay_disable(sp->param_flags);
2690		}
2691	} else if (params.sack_freq > 1) {
2692		if (asoc) {
2693			asoc->sackfreq = params.sack_freq;
2694			asoc->param_flags =
2695				sctp_spp_sackdelay_enable(asoc->param_flags);
2696		} else {
2697			sp->sackfreq = params.sack_freq;
2698			sp->param_flags =
2699				sctp_spp_sackdelay_enable(sp->param_flags);
2700		}
2701	}
2702
2703	/* If change is for association, also apply to each transport. */
2704	if (asoc) {
2705		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
2706				transports) {
2707			if (params.sack_delay) {
2708				trans->sackdelay =
2709					msecs_to_jiffies(params.sack_delay);
2710				trans->param_flags =
2711					sctp_spp_sackdelay_enable(trans->param_flags);
2712			}
2713			if (params.sack_freq == 1) {
2714				trans->param_flags =
2715					sctp_spp_sackdelay_disable(trans->param_flags);
2716			} else if (params.sack_freq > 1) {
2717				trans->sackfreq = params.sack_freq;
2718				trans->param_flags =
2719					sctp_spp_sackdelay_enable(trans->param_flags);
2720			}
2721		}
2722	}
2723
2724	return 0;
2725}
2726
2727/* 7.1.3 Initialization Parameters (SCTP_INITMSG)
2728 *
2729 * Applications can specify protocol parameters for the default association
2730 * initialization.  The option name argument to setsockopt() and getsockopt()
2731 * is SCTP_INITMSG.
2732 *
2733 * Setting initialization parameters is effective only on an unconnected
2734 * socket (for UDP-style sockets only future associations are effected
2735 * by the change).  With TCP-style sockets, this option is inherited by
2736 * sockets derived from a listener socket.
2737 */
2738static int sctp_setsockopt_initmsg(struct sock *sk, char __user *optval, unsigned int optlen)
2739{
2740	struct sctp_initmsg sinit;
2741	struct sctp_sock *sp = sctp_sk(sk);
2742
2743	if (optlen != sizeof(struct sctp_initmsg))
2744		return -EINVAL;
2745	if (copy_from_user(&sinit, optval, optlen))
2746		return -EFAULT;
2747
2748	if (sinit.sinit_num_ostreams)
2749		sp->initmsg.sinit_num_ostreams = sinit.sinit_num_ostreams;
2750	if (sinit.sinit_max_instreams)
2751		sp->initmsg.sinit_max_instreams = sinit.sinit_max_instreams;
2752	if (sinit.sinit_max_attempts)
2753		sp->initmsg.sinit_max_attempts = sinit.sinit_max_attempts;
2754	if (sinit.sinit_max_init_timeo)
2755		sp->initmsg.sinit_max_init_timeo = sinit.sinit_max_init_timeo;
2756
2757	return 0;
2758}
2759
2760/*
2761 * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
2762 *
2763 *   Applications that wish to use the sendto() system call may wish to
2764 *   specify a default set of parameters that would normally be supplied
2765 *   through the inclusion of ancillary data.  This socket option allows
2766 *   such an application to set the default sctp_sndrcvinfo structure.
2767 *   The application that wishes to use this socket option simply passes
2768 *   in to this call the sctp_sndrcvinfo structure defined in Section
2769 *   5.2.2) The input parameters accepted by this call include
2770 *   sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
2771 *   sinfo_timetolive.  The user must provide the sinfo_assoc_id field in
2772 *   to this call if the caller is using the UDP model.
2773 */
2774static int sctp_setsockopt_default_send_param(struct sock *sk,
2775					      char __user *optval,
2776					      unsigned int optlen)
2777{
2778	struct sctp_sock *sp = sctp_sk(sk);
2779	struct sctp_association *asoc;
2780	struct sctp_sndrcvinfo info;
2781
2782	if (optlen != sizeof(info))
2783		return -EINVAL;
2784	if (copy_from_user(&info, optval, optlen))
2785		return -EFAULT;
2786	if (info.sinfo_flags &
2787	    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2788	      SCTP_ABORT | SCTP_EOF))
2789		return -EINVAL;
2790
2791	asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
2792	if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
2793		return -EINVAL;
2794	if (asoc) {
2795		asoc->default_stream = info.sinfo_stream;
2796		asoc->default_flags = info.sinfo_flags;
2797		asoc->default_ppid = info.sinfo_ppid;
2798		asoc->default_context = info.sinfo_context;
2799		asoc->default_timetolive = info.sinfo_timetolive;
2800	} else {
2801		sp->default_stream = info.sinfo_stream;
2802		sp->default_flags = info.sinfo_flags;
2803		sp->default_ppid = info.sinfo_ppid;
2804		sp->default_context = info.sinfo_context;
2805		sp->default_timetolive = info.sinfo_timetolive;
2806	}
2807
2808	return 0;
2809}
2810
2811/* RFC6458, Section 8.1.31. Set/get Default Send Parameters
2812 * (SCTP_DEFAULT_SNDINFO)
2813 */
2814static int sctp_setsockopt_default_sndinfo(struct sock *sk,
2815					   char __user *optval,
2816					   unsigned int optlen)
2817{
2818	struct sctp_sock *sp = sctp_sk(sk);
2819	struct sctp_association *asoc;
2820	struct sctp_sndinfo info;
2821
2822	if (optlen != sizeof(info))
2823		return -EINVAL;
2824	if (copy_from_user(&info, optval, optlen))
2825		return -EFAULT;
2826	if (info.snd_flags &
2827	    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
2828	      SCTP_ABORT | SCTP_EOF))
2829		return -EINVAL;
2830
2831	asoc = sctp_id2assoc(sk, info.snd_assoc_id);
2832	if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
2833		return -EINVAL;
2834	if (asoc) {
2835		asoc->default_stream = info.snd_sid;
2836		asoc->default_flags = info.snd_flags;
2837		asoc->default_ppid = info.snd_ppid;
2838		asoc->default_context = info.snd_context;
2839	} else {
2840		sp->default_stream = info.snd_sid;
2841		sp->default_flags = info.snd_flags;
2842		sp->default_ppid = info.snd_ppid;
2843		sp->default_context = info.snd_context;
2844	}
2845
2846	return 0;
2847}
2848
2849/* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
2850 *
2851 * Requests that the local SCTP stack use the enclosed peer address as
2852 * the association primary.  The enclosed address must be one of the
2853 * association peer's addresses.
2854 */
2855static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
2856					unsigned int optlen)
2857{
2858	struct sctp_prim prim;
2859	struct sctp_transport *trans;
2860
2861	if (optlen != sizeof(struct sctp_prim))
2862		return -EINVAL;
2863
2864	if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
2865		return -EFAULT;
2866
2867	trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
2868	if (!trans)
2869		return -EINVAL;
2870
2871	sctp_assoc_set_primary(trans->asoc, trans);
2872
2873	return 0;
2874}
2875
2876/*
2877 * 7.1.5 SCTP_NODELAY
2878 *
2879 * Turn on/off any Nagle-like algorithm.  This means that packets are
2880 * generally sent as soon as possible and no unnecessary delays are
2881 * introduced, at the cost of more packets in the network.  Expects an
2882 *  integer boolean flag.
2883 */
2884static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval,
2885				   unsigned int optlen)
2886{
2887	int val;
2888
2889	if (optlen < sizeof(int))
2890		return -EINVAL;
2891	if (get_user(val, (int __user *)optval))
2892		return -EFAULT;
2893
2894	sctp_sk(sk)->nodelay = (val == 0) ? 0 : 1;
2895	return 0;
2896}
2897
2898/*
2899 *
2900 * 7.1.1 SCTP_RTOINFO
2901 *
2902 * The protocol parameters used to initialize and bound retransmission
2903 * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
2904 * and modify these parameters.
2905 * All parameters are time values, in milliseconds.  A value of 0, when
2906 * modifying the parameters, indicates that the current value should not
2907 * be changed.
2908 *
2909 */
2910static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigned int optlen)
2911{
2912	struct sctp_rtoinfo rtoinfo;
2913	struct sctp_association *asoc;
2914	unsigned long rto_min, rto_max;
2915	struct sctp_sock *sp = sctp_sk(sk);
2916
2917	if (optlen != sizeof (struct sctp_rtoinfo))
2918		return -EINVAL;
2919
2920	if (copy_from_user(&rtoinfo, optval, optlen))
2921		return -EFAULT;
2922
2923	asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
2924
2925	/* Set the values to the specific association */
2926	if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
2927		return -EINVAL;
2928
2929	rto_max = rtoinfo.srto_max;
2930	rto_min = rtoinfo.srto_min;
2931
2932	if (rto_max)
2933		rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
2934	else
2935		rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
2936
2937	if (rto_min)
2938		rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
2939	else
2940		rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
2941
2942	if (rto_min > rto_max)
2943		return -EINVAL;
2944
2945	if (asoc) {
2946		if (rtoinfo.srto_initial != 0)
2947			asoc->rto_initial =
2948				msecs_to_jiffies(rtoinfo.srto_initial);
2949		asoc->rto_max = rto_max;
2950		asoc->rto_min = rto_min;
2951	} else {
2952		/* If there is no association or the association-id = 0
2953		 * set the values to the endpoint.
2954		 */
2955		if (rtoinfo.srto_initial != 0)
2956			sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
2957		sp->rtoinfo.srto_max = rto_max;
2958		sp->rtoinfo.srto_min = rto_min;
2959	}
2960
2961	return 0;
2962}
2963
2964/*
2965 *
2966 * 7.1.2 SCTP_ASSOCINFO
2967 *
2968 * This option is used to tune the maximum retransmission attempts
2969 * of the association.
2970 * Returns an error if the new association retransmission value is
2971 * greater than the sum of the retransmission value  of the peer.
2972 * See [SCTP] for more information.
2973 *
2974 */
2975static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, unsigned int optlen)
2976{
2977
2978	struct sctp_assocparams assocparams;
2979	struct sctp_association *asoc;
2980
2981	if (optlen != sizeof(struct sctp_assocparams))
2982		return -EINVAL;
2983	if (copy_from_user(&assocparams, optval, optlen))
2984		return -EFAULT;
2985
2986	asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
2987
2988	if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
2989		return -EINVAL;
2990
2991	/* Set the values to the specific association */
2992	if (asoc) {
2993		if (assocparams.sasoc_asocmaxrxt != 0) {
2994			__u32 path_sum = 0;
2995			int   paths = 0;
2996			struct sctp_transport *peer_addr;
2997
2998			list_for_each_entry(peer_addr, &asoc->peer.transport_addr_list,
2999					transports) {
3000				path_sum += peer_addr->pathmaxrxt;
3001				paths++;
3002			}
3003
3004			/* Only validate asocmaxrxt if we have more than
3005			 * one path/transport.  We do this because path
3006			 * retransmissions are only counted when we have more
3007			 * then one path.
3008			 */
3009			if (paths > 1 &&
3010			    assocparams.sasoc_asocmaxrxt > path_sum)
3011				return -EINVAL;
3012
3013			asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
3014		}
3015
3016		if (assocparams.sasoc_cookie_life != 0)
3017			asoc->cookie_life = ms_to_ktime(assocparams.sasoc_cookie_life);
3018	} else {
3019		/* Set the values to the endpoint */
3020		struct sctp_sock *sp = sctp_sk(sk);
3021
3022		if (assocparams.sasoc_asocmaxrxt != 0)
3023			sp->assocparams.sasoc_asocmaxrxt =
3024						assocparams.sasoc_asocmaxrxt;
3025		if (assocparams.sasoc_cookie_life != 0)
3026			sp->assocparams.sasoc_cookie_life =
3027						assocparams.sasoc_cookie_life;
3028	}
3029	return 0;
3030}
3031
3032/*
3033 * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
3034 *
3035 * This socket option is a boolean flag which turns on or off mapped V4
3036 * addresses.  If this option is turned on and the socket is type
3037 * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
3038 * If this option is turned off, then no mapping will be done of V4
3039 * addresses and a user will receive both PF_INET6 and PF_INET type
3040 * addresses on the socket.
3041 */
3042static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsigned int optlen)
3043{
3044	int val;
3045	struct sctp_sock *sp = sctp_sk(sk);
3046
3047	if (optlen < sizeof(int))
3048		return -EINVAL;
3049	if (get_user(val, (int __user *)optval))
3050		return -EFAULT;
3051	if (val)
3052		sp->v4mapped = 1;
3053	else
3054		sp->v4mapped = 0;
3055
3056	return 0;
3057}
3058
3059/*
3060 * 8.1.16.  Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
3061 * This option will get or set the maximum size to put in any outgoing
3062 * SCTP DATA chunk.  If a message is larger than this size it will be
3063 * fragmented by SCTP into the specified size.  Note that the underlying
3064 * SCTP implementation may fragment into smaller sized chunks when the
3065 * PMTU of the underlying association is smaller than the value set by
3066 * the user.  The default value for this option is '0' which indicates
3067 * the user is NOT limiting fragmentation and only the PMTU will effect
3068 * SCTP's choice of DATA chunk size.  Note also that values set larger
3069 * than the maximum size of an IP datagram will effectively let SCTP
3070 * control fragmentation (i.e. the same as setting this option to 0).
3071 *
3072 * The following structure is used to access and modify this parameter:
3073 *
3074 * struct sctp_assoc_value {
3075 *   sctp_assoc_t assoc_id;
3076 *   uint32_t assoc_value;
3077 * };
3078 *
3079 * assoc_id:  This parameter is ignored for one-to-one style sockets.
3080 *    For one-to-many style sockets this parameter indicates which
3081 *    association the user is performing an action upon.  Note that if
3082 *    this field's value is zero then the endpoints default value is
3083 *    changed (effecting future associations only).
3084 * assoc_value:  This parameter specifies the maximum size in bytes.
3085 */
3086static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
3087{
3088	struct sctp_assoc_value params;
3089	struct sctp_association *asoc;
3090	struct sctp_sock *sp = sctp_sk(sk);
3091	int val;
3092
3093	if (optlen == sizeof(int)) {
3094		pr_warn_ratelimited(DEPRECATED
3095				    "%s (pid %d) "
3096				    "Use of int in maxseg socket option.\n"
3097				    "Use struct sctp_assoc_value instead\n",
3098				    current->comm, task_pid_nr(current));
3099		if (copy_from_user(&val, optval, optlen))
3100			return -EFAULT;
3101		params.assoc_id = 0;
3102	} else if (optlen == sizeof(struct sctp_assoc_value)) {
3103		if (copy_from_user(&params, optval, optlen))
3104			return -EFAULT;
3105		val = params.assoc_value;
3106	} else
3107		return -EINVAL;
3108
3109	if ((val != 0) && ((val < 8) || (val > SCTP_MAX_CHUNK_LEN)))
3110		return -EINVAL;
3111
3112	asoc = sctp_id2assoc(sk, params.assoc_id);
3113	if (!asoc && params.assoc_id && sctp_style(sk, UDP))
3114		return -EINVAL;
3115
3116	if (asoc) {
3117		if (val == 0) {
3118			val = asoc->pathmtu;
3119			val -= sp->pf->af->net_header_len;
3120			val -= sizeof(struct sctphdr) +
3121					sizeof(struct sctp_data_chunk);
3122		}
3123		asoc->user_frag = val;
3124		asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
3125	} else {
3126		sp->user_frag = val;
3127	}
3128
3129	return 0;
3130}
3131
3132
3133/*
3134 *  7.1.9 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
3135 *
3136 *   Requests that the peer mark the enclosed address as the association
3137 *   primary. The enclosed address must be one of the association's
3138 *   locally bound addresses. The following structure is used to make a
3139 *   set primary request:
3140 */
3141static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optval,
3142					     unsigned int optlen)
3143{
3144	struct net *net = sock_net(sk);
3145	struct sctp_sock	*sp;
3146	struct sctp_association	*asoc = NULL;
3147	struct sctp_setpeerprim	prim;
3148	struct sctp_chunk	*chunk;
3149	struct sctp_af		*af;
3150	int 			err;
3151
3152	sp = sctp_sk(sk);
3153
3154	if (!net->sctp.addip_enable)
3155		return -EPERM;
3156
3157	if (optlen != sizeof(struct sctp_setpeerprim))
3158		return -EINVAL;
3159
3160	if (copy_from_user(&prim, optval, optlen))
3161		return -EFAULT;
3162
3163	asoc = sctp_id2assoc(sk, prim.sspp_assoc_id);
3164	if (!asoc)
3165		return -EINVAL;
3166
3167	if (!asoc->peer.asconf_capable)
3168		return -EPERM;
3169
3170	if (asoc->peer.addip_disabled_mask & SCTP_PARAM_SET_PRIMARY)
3171		return -EPERM;
3172
3173	if (!sctp_state(asoc, ESTABLISHED))
3174		return -ENOTCONN;
3175
3176	af = sctp_get_af_specific(prim.sspp_addr.ss_family);
3177	if (!af)
3178		return -EINVAL;
3179
3180	if (!af->addr_valid((union sctp_addr *)&prim.sspp_addr, sp, NULL))
3181		return -EADDRNOTAVAIL;
3182
3183	if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
3184		return -EADDRNOTAVAIL;
3185
3186	/* Create an ASCONF chunk with SET_PRIMARY parameter	*/
3187	chunk = sctp_make_asconf_set_prim(asoc,
3188					  (union sctp_addr *)&prim.sspp_addr);
3189	if (!chunk)
3190		return -ENOMEM;
3191
3192	err = sctp_send_asconf(asoc, chunk);
3193
3194	pr_debug("%s: we set peer primary addr primitively\n", __func__);
3195
3196	return err;
3197}
3198
3199static int sctp_setsockopt_adaptation_layer(struct sock *sk, char __user *optval,
3200					    unsigned int optlen)
3201{
3202	struct sctp_setadaptation adaptation;
3203
3204	if (optlen != sizeof(struct sctp_setadaptation))
3205		return -EINVAL;
3206	if (copy_from_user(&adaptation, optval, optlen))
3207		return -EFAULT;
3208
3209	sctp_sk(sk)->adaptation_ind = adaptation.ssb_adaptation_ind;
3210
3211	return 0;
3212}
3213
3214/*
3215 * 7.1.29.  Set or Get the default context (SCTP_CONTEXT)
3216 *
3217 * The context field in the sctp_sndrcvinfo structure is normally only
3218 * used when a failed message is retrieved holding the value that was
3219 * sent down on the actual send call.  This option allows the setting of
3220 * a default context on an association basis that will be received on
3221 * reading messages from the peer.  This is especially helpful in the
3222 * one-2-many model for an application to keep some reference to an
3223 * internal state machine that is processing messages on the
3224 * association.  Note that the setting of this value only effects
3225 * received messages from the peer and does not effect the value that is
3226 * saved with outbound messages.
3227 */
3228static int sctp_setsockopt_context(struct sock *sk, char __user *optval,
3229				   unsigned int optlen)
3230{
3231	struct sctp_assoc_value params;
3232	struct sctp_sock *sp;
3233	struct sctp_association *asoc;
3234
3235	if (optlen != sizeof(struct sctp_assoc_value))
3236		return -EINVAL;
3237	if (copy_from_user(&params, optval, optlen))
3238		return -EFAULT;
3239
3240	sp = sctp_sk(sk);
3241
3242	if (params.assoc_id != 0) {
3243		asoc = sctp_id2assoc(sk, params.assoc_id);
3244		if (!asoc)
3245			return -EINVAL;
3246		asoc->default_rcv_context = params.assoc_value;
3247	} else {
3248		sp->default_rcv_context = params.assoc_value;
3249	}
3250
3251	return 0;
3252}
3253
3254/*
3255 * 7.1.24.  Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
3256 *
3257 * This options will at a minimum specify if the implementation is doing
3258 * fragmented interleave.  Fragmented interleave, for a one to many
3259 * socket, is when subsequent calls to receive a message may return
3260 * parts of messages from different associations.  Some implementations
3261 * may allow you to turn this value on or off.  If so, when turned off,
3262 * no fragment interleave will occur (which will cause a head of line
3263 * blocking amongst multiple associations sharing the same one to many
3264 * socket).  When this option is turned on, then each receive call may
3265 * come from a different association (thus the user must receive data
3266 * with the extended calls (e.g. sctp_recvmsg) to keep track of which
3267 * association each receive belongs to.
3268 *
3269 * This option takes a boolean value.  A non-zero value indicates that
3270 * fragmented interleave is on.  A value of zero indicates that
3271 * fragmented interleave is off.
3272 *
3273 * Note that it is important that an implementation that allows this
3274 * option to be turned on, have it off by default.  Otherwise an unaware
3275 * application using the one to many model may become confused and act
3276 * incorrectly.
3277 */
3278static int sctp_setsockopt_fragment_interleave(struct sock *sk,
3279					       char __user *optval,
3280					       unsigned int optlen)
3281{
3282	int val;
3283
3284	if (optlen != sizeof(int))
3285		return -EINVAL;
3286	if (get_user(val, (int __user *)optval))
3287		return -EFAULT;
3288
3289	sctp_sk(sk)->frag_interleave = (val == 0) ? 0 : 1;
3290
3291	return 0;
3292}
3293
3294/*
3295 * 8.1.21.  Set or Get the SCTP Partial Delivery Point
3296 *       (SCTP_PARTIAL_DELIVERY_POINT)
3297 *
3298 * This option will set or get the SCTP partial delivery point.  This
3299 * point is the size of a message where the partial delivery API will be
3300 * invoked to help free up rwnd space for the peer.  Setting this to a
3301 * lower value will cause partial deliveries to happen more often.  The
3302 * calls argument is an integer that sets or gets the partial delivery
3303 * point.  Note also that the call will fail if the user attempts to set
3304 * this value larger than the socket receive buffer size.
3305 *
3306 * Note that any single message having a length smaller than or equal to
3307 * the SCTP partial delivery point will be delivered in one single read
3308 * call as long as the user provided buffer is large enough to hold the
3309 * message.
3310 */
3311static int sctp_setsockopt_partial_delivery_point(struct sock *sk,
3312						  char __user *optval,
3313						  unsigned int optlen)
3314{
3315	u32 val;
3316
3317	if (optlen != sizeof(u32))
3318		return -EINVAL;
3319	if (get_user(val, (int __user *)optval))
3320		return -EFAULT;
3321
3322	/* Note: We double the receive buffer from what the user sets
3323	 * it to be, also initial rwnd is based on rcvbuf/2.
3324	 */
3325	if (val > (sk->sk_rcvbuf >> 1))
3326		return -EINVAL;
3327
3328	sctp_sk(sk)->pd_point = val;
3329
3330	return 0; /* is this the right error code? */
3331}
3332
3333/*
3334 * 7.1.28.  Set or Get the maximum burst (SCTP_MAX_BURST)
3335 *
3336 * This option will allow a user to change the maximum burst of packets
3337 * that can be emitted by this association.  Note that the default value
3338 * is 4, and some implementations may restrict this setting so that it
3339 * can only be lowered.
3340 *
3341 * NOTE: This text doesn't seem right.  Do this on a socket basis with
3342 * future associations inheriting the socket value.
3343 */
3344static int sctp_setsockopt_maxburst(struct sock *sk,
3345				    char __user *optval,
3346				    unsigned int optlen)
3347{
3348	struct sctp_assoc_value params;
3349	struct sctp_sock *sp;
3350	struct sctp_association *asoc;
3351	int val;
3352	int assoc_id = 0;
3353
3354	if (optlen == sizeof(int)) {
3355		pr_warn_ratelimited(DEPRECATED
3356				    "%s (pid %d) "
3357				    "Use of int in max_burst socket option deprecated.\n"
3358				    "Use struct sctp_assoc_value instead\n",
3359				    current->comm, task_pid_nr(current));
3360		if (copy_from_user(&val, optval, optlen))
3361			return -EFAULT;
3362	} else if (optlen == sizeof(struct sctp_assoc_value)) {
3363		if (copy_from_user(&params, optval, optlen))
3364			return -EFAULT;
3365		val = params.assoc_value;
3366		assoc_id = params.assoc_id;
3367	} else
3368		return -EINVAL;
3369
3370	sp = sctp_sk(sk);
3371
3372	if (assoc_id != 0) {
3373		asoc = sctp_id2assoc(sk, assoc_id);
3374		if (!asoc)
3375			return -EINVAL;
3376		asoc->max_burst = val;
3377	} else
3378		sp->max_burst = val;
3379
3380	return 0;
3381}
3382
3383/*
3384 * 7.1.18.  Add a chunk that must be authenticated (SCTP_AUTH_CHUNK)
3385 *
3386 * This set option adds a chunk type that the user is requesting to be
3387 * received only in an authenticated way.  Changes to the list of chunks
3388 * will only effect future associations on the socket.
3389 */
3390static int sctp_setsockopt_auth_chunk(struct sock *sk,
3391				      char __user *optval,
3392				      unsigned int optlen)
3393{
3394	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3395	struct sctp_authchunk val;
3396
3397	if (!ep->auth_enable)
3398		return -EACCES;
3399
3400	if (optlen != sizeof(struct sctp_authchunk))
3401		return -EINVAL;
3402	if (copy_from_user(&val, optval, optlen))
3403		return -EFAULT;
3404
3405	switch (val.sauth_chunk) {
3406	case SCTP_CID_INIT:
3407	case SCTP_CID_INIT_ACK:
3408	case SCTP_CID_SHUTDOWN_COMPLETE:
3409	case SCTP_CID_AUTH:
3410		return -EINVAL;
3411	}
3412
3413	/* add this chunk id to the endpoint */
3414	return sctp_auth_ep_add_chunkid(ep, val.sauth_chunk);
3415}
3416
3417/*
3418 * 7.1.19.  Get or set the list of supported HMAC Identifiers (SCTP_HMAC_IDENT)
3419 *
3420 * This option gets or sets the list of HMAC algorithms that the local
3421 * endpoint requires the peer to use.
3422 */
3423static int sctp_setsockopt_hmac_ident(struct sock *sk,
3424				      char __user *optval,
3425				      unsigned int optlen)
3426{
3427	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3428	struct sctp_hmacalgo *hmacs;
3429	u32 idents;
3430	int err;
3431
3432	if (!ep->auth_enable)
3433		return -EACCES;
3434
3435	if (optlen < sizeof(struct sctp_hmacalgo))
3436		return -EINVAL;
3437
3438	hmacs = memdup_user(optval, optlen);
3439	if (IS_ERR(hmacs))
3440		return PTR_ERR(hmacs);
3441
3442	idents = hmacs->shmac_num_idents;
3443	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
3444	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
3445		err = -EINVAL;
3446		goto out;
3447	}
3448
3449	err = sctp_auth_ep_set_hmacs(ep, hmacs);
3450out:
3451	kfree(hmacs);
3452	return err;
3453}
3454
3455/*
3456 * 7.1.20.  Set a shared key (SCTP_AUTH_KEY)
3457 *
3458 * This option will set a shared secret key which is used to build an
3459 * association shared key.
3460 */
3461static int sctp_setsockopt_auth_key(struct sock *sk,
3462				    char __user *optval,
3463				    unsigned int optlen)
3464{
3465	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3466	struct sctp_authkey *authkey;
3467	struct sctp_association *asoc;
3468	int ret;
3469
3470	if (!ep->auth_enable)
3471		return -EACCES;
3472
3473	if (optlen <= sizeof(struct sctp_authkey))
3474		return -EINVAL;
3475
3476	authkey = memdup_user(optval, optlen);
3477	if (IS_ERR(authkey))
3478		return PTR_ERR(authkey);
3479
3480	if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
3481		ret = -EINVAL;
3482		goto out;
3483	}
3484
3485	asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
3486	if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
3487		ret = -EINVAL;
3488		goto out;
3489	}
3490
3491	ret = sctp_auth_set_key(ep, asoc, authkey);
3492out:
3493	kzfree(authkey);
3494	return ret;
3495}
3496
3497/*
3498 * 7.1.21.  Get or set the active shared key (SCTP_AUTH_ACTIVE_KEY)
3499 *
3500 * This option will get or set the active shared key to be used to build
3501 * the association shared key.
3502 */
3503static int sctp_setsockopt_active_key(struct sock *sk,
3504				      char __user *optval,
3505				      unsigned int optlen)
3506{
3507	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3508	struct sctp_authkeyid val;
3509	struct sctp_association *asoc;
3510
3511	if (!ep->auth_enable)
3512		return -EACCES;
3513
3514	if (optlen != sizeof(struct sctp_authkeyid))
3515		return -EINVAL;
3516	if (copy_from_user(&val, optval, optlen))
3517		return -EFAULT;
3518
3519	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3520	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3521		return -EINVAL;
3522
3523	return sctp_auth_set_active_key(ep, asoc, val.scact_keynumber);
3524}
3525
3526/*
3527 * 7.1.22.  Delete a shared key (SCTP_AUTH_DELETE_KEY)
3528 *
3529 * This set option will delete a shared secret key from use.
3530 */
3531static int sctp_setsockopt_del_key(struct sock *sk,
3532				   char __user *optval,
3533				   unsigned int optlen)
3534{
3535	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
3536	struct sctp_authkeyid val;
3537	struct sctp_association *asoc;
3538
3539	if (!ep->auth_enable)
3540		return -EACCES;
3541
3542	if (optlen != sizeof(struct sctp_authkeyid))
3543		return -EINVAL;
3544	if (copy_from_user(&val, optval, optlen))
3545		return -EFAULT;
3546
3547	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
3548	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
3549		return -EINVAL;
3550
3551	return sctp_auth_del_key_id(ep, asoc, val.scact_keynumber);
3552
3553}
3554
3555/*
3556 * 8.1.23 SCTP_AUTO_ASCONF
3557 *
3558 * This option will enable or disable the use of the automatic generation of
3559 * ASCONF chunks to add and delete addresses to an existing association.  Note
3560 * that this option has two caveats namely: a) it only affects sockets that
3561 * are bound to all addresses available to the SCTP stack, and b) the system
3562 * administrator may have an overriding control that turns the ASCONF feature
3563 * off no matter what setting the socket option may have.
3564 * This option expects an integer boolean flag, where a non-zero value turns on
3565 * the option, and a zero value turns off the option.
3566 * Note. In this implementation, socket operation overrides default parameter
3567 * being set by sysctl as well as FreeBSD implementation
3568 */
3569static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
3570					unsigned int optlen)
3571{
3572	int val;
3573	struct sctp_sock *sp = sctp_sk(sk);
3574
3575	if (optlen < sizeof(int))
3576		return -EINVAL;
3577	if (get_user(val, (int __user *)optval))
3578		return -EFAULT;
3579	if (!sctp_is_ep_boundall(sk) && val)
3580		return -EINVAL;
3581	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
3582		return 0;
3583
3584	spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
3585	if (val == 0 && sp->do_auto_asconf) {
3586		list_del(&sp->auto_asconf_list);
3587		sp->do_auto_asconf = 0;
3588	} else if (val && !sp->do_auto_asconf) {
3589		list_add_tail(&sp->auto_asconf_list,
3590		    &sock_net(sk)->sctp.auto_asconf_splist);
3591		sp->do_auto_asconf = 1;
3592	}
3593	spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
3594	return 0;
3595}
3596
3597/*
3598 * SCTP_PEER_ADDR_THLDS
3599 *
3600 * This option allows us to alter the partially failed threshold for one or all
3601 * transports in an association.  See Section 6.1 of:
3602 * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
3603 */
3604static int sctp_setsockopt_paddr_thresholds(struct sock *sk,
3605					    char __user *optval,
3606					    unsigned int optlen)
3607{
3608	struct sctp_paddrthlds val;
3609	struct sctp_transport *trans;
3610	struct sctp_association *asoc;
3611
3612	if (optlen < sizeof(struct sctp_paddrthlds))
3613		return -EINVAL;
3614	if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval,
3615			   sizeof(struct sctp_paddrthlds)))
3616		return -EFAULT;
3617
3618
3619	if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
3620		asoc = sctp_id2assoc(sk, val.spt_assoc_id);
3621		if (!asoc)
3622			return -ENOENT;
3623		list_for_each_entry(trans, &asoc->peer.transport_addr_list,
3624				    transports) {
3625			if (val.spt_pathmaxrxt)
3626				trans->pathmaxrxt = val.spt_pathmaxrxt;
3627			trans->pf_retrans = val.spt_pathpfthld;
3628		}
3629
3630		if (val.spt_pathmaxrxt)
3631			asoc->pathmaxrxt = val.spt_pathmaxrxt;
3632		asoc->pf_retrans = val.spt_pathpfthld;
3633	} else {
3634		trans = sctp_addr_id2transport(sk, &val.spt_address,
3635					       val.spt_assoc_id);
3636		if (!trans)
3637			return -ENOENT;
3638
3639		if (val.spt_pathmaxrxt)
3640			trans->pathmaxrxt = val.spt_pathmaxrxt;
3641		trans->pf_retrans = val.spt_pathpfthld;
3642	}
3643
3644	return 0;
3645}
3646
3647static int sctp_setsockopt_recvrcvinfo(struct sock *sk,
3648				       char __user *optval,
3649				       unsigned int optlen)
3650{
3651	int val;
3652
3653	if (optlen < sizeof(int))
3654		return -EINVAL;
3655	if (get_user(val, (int __user *) optval))
3656		return -EFAULT;
3657
3658	sctp_sk(sk)->recvrcvinfo = (val == 0) ? 0 : 1;
3659
3660	return 0;
3661}
3662
3663static int sctp_setsockopt_recvnxtinfo(struct sock *sk,
3664				       char __user *optval,
3665				       unsigned int optlen)
3666{
3667	int val;
3668
3669	if (optlen < sizeof(int))
3670		return -EINVAL;
3671	if (get_user(val, (int __user *) optval))
3672		return -EFAULT;
3673
3674	sctp_sk(sk)->recvnxtinfo = (val == 0) ? 0 : 1;
3675
3676	return 0;
3677}
3678
3679/* API 6.2 setsockopt(), getsockopt()
3680 *
3681 * Applications use setsockopt() and getsockopt() to set or retrieve
3682 * socket options.  Socket options are used to change the default
3683 * behavior of sockets calls.  They are described in Section 7.
3684 *
3685 * The syntax is:
3686 *
3687 *   ret = getsockopt(int sd, int level, int optname, void __user *optval,
3688 *                    int __user *optlen);
3689 *   ret = setsockopt(int sd, int level, int optname, const void __user *optval,
3690 *                    int optlen);
3691 *
3692 *   sd      - the socket descript.
3693 *   level   - set to IPPROTO_SCTP for all SCTP options.
3694 *   optname - the option name.
3695 *   optval  - the buffer to store the value of the option.
3696 *   optlen  - the size of the buffer.
3697 */
3698static int sctp_setsockopt(struct sock *sk, int level, int optname,
3699			   char __user *optval, unsigned int optlen)
3700{
3701	int retval = 0;
3702
3703	pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
3704
3705	/* I can hardly begin to describe how wrong this is.  This is
3706	 * so broken as to be worse than useless.  The API draft
3707	 * REALLY is NOT helpful here...  I am not convinced that the
3708	 * semantics of setsockopt() with a level OTHER THAN SOL_SCTP
3709	 * are at all well-founded.
3710	 */
3711	if (level != SOL_SCTP) {
3712		struct sctp_af *af = sctp_sk(sk)->pf->af;
3713		retval = af->setsockopt(sk, level, optname, optval, optlen);
3714		goto out_nounlock;
3715	}
3716
3717	lock_sock(sk);
3718
3719	switch (optname) {
3720	case SCTP_SOCKOPT_BINDX_ADD:
3721		/* 'optlen' is the size of the addresses buffer. */
3722		retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
3723					       optlen, SCTP_BINDX_ADD_ADDR);
3724		break;
3725
3726	case SCTP_SOCKOPT_BINDX_REM:
3727		/* 'optlen' is the size of the addresses buffer. */
3728		retval = sctp_setsockopt_bindx(sk, (struct sockaddr __user *)optval,
3729					       optlen, SCTP_BINDX_REM_ADDR);
3730		break;
3731
3732	case SCTP_SOCKOPT_CONNECTX_OLD:
3733		/* 'optlen' is the size of the addresses buffer. */
3734		retval = sctp_setsockopt_connectx_old(sk,
3735					    (struct sockaddr __user *)optval,
3736					    optlen);
3737		break;
3738
3739	case SCTP_SOCKOPT_CONNECTX:
3740		/* 'optlen' is the size of the addresses buffer. */
3741		retval = sctp_setsockopt_connectx(sk,
3742					    (struct sockaddr __user *)optval,
3743					    optlen);
3744		break;
3745
3746	case SCTP_DISABLE_FRAGMENTS:
3747		retval = sctp_setsockopt_disable_fragments(sk, optval, optlen);
3748		break;
3749
3750	case SCTP_EVENTS:
3751		retval = sctp_setsockopt_events(sk, optval, optlen);
3752		break;
3753
3754	case SCTP_AUTOCLOSE:
3755		retval = sctp_setsockopt_autoclose(sk, optval, optlen);
3756		break;
3757
3758	case SCTP_PEER_ADDR_PARAMS:
3759		retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
3760		break;
3761
3762	case SCTP_DELAYED_SACK:
3763		retval = sctp_setsockopt_delayed_ack(sk, optval, optlen);
3764		break;
3765	case SCTP_PARTIAL_DELIVERY_POINT:
3766		retval = sctp_setsockopt_partial_delivery_point(sk, optval, optlen);
3767		break;
3768
3769	case SCTP_INITMSG:
3770		retval = sctp_setsockopt_initmsg(sk, optval, optlen);
3771		break;
3772	case SCTP_DEFAULT_SEND_PARAM:
3773		retval = sctp_setsockopt_default_send_param(sk, optval,
3774							    optlen);
3775		break;
3776	case SCTP_DEFAULT_SNDINFO:
3777		retval = sctp_setsockopt_default_sndinfo(sk, optval, optlen);
3778		break;
3779	case SCTP_PRIMARY_ADDR:
3780		retval = sctp_setsockopt_primary_addr(sk, optval, optlen);
3781		break;
3782	case SCTP_SET_PEER_PRIMARY_ADDR:
3783		retval = sctp_setsockopt_peer_primary_addr(sk, optval, optlen);
3784		break;
3785	case SCTP_NODELAY:
3786		retval = sctp_setsockopt_nodelay(sk, optval, optlen);
3787		break;
3788	case SCTP_RTOINFO:
3789		retval = sctp_setsockopt_rtoinfo(sk, optval, optlen);
3790		break;
3791	case SCTP_ASSOCINFO:
3792		retval = sctp_setsockopt_associnfo(sk, optval, optlen);
3793		break;
3794	case SCTP_I_WANT_MAPPED_V4_ADDR:
3795		retval = sctp_setsockopt_mappedv4(sk, optval, optlen);
3796		break;
3797	case SCTP_MAXSEG:
3798		retval = sctp_setsockopt_maxseg(sk, optval, optlen);
3799		break;
3800	case SCTP_ADAPTATION_LAYER:
3801		retval = sctp_setsockopt_adaptation_layer(sk, optval, optlen);
3802		break;
3803	case SCTP_CONTEXT:
3804		retval = sctp_setsockopt_context(sk, optval, optlen);
3805		break;
3806	case SCTP_FRAGMENT_INTERLEAVE:
3807		retval = sctp_setsockopt_fragment_interleave(sk, optval, optlen);
3808		break;
3809	case SCTP_MAX_BURST:
3810		retval = sctp_setsockopt_maxburst(sk, optval, optlen);
3811		break;
3812	case SCTP_AUTH_CHUNK:
3813		retval = sctp_setsockopt_auth_chunk(sk, optval, optlen);
3814		break;
3815	case SCTP_HMAC_IDENT:
3816		retval = sctp_setsockopt_hmac_ident(sk, optval, optlen);
3817		break;
3818	case SCTP_AUTH_KEY:
3819		retval = sctp_setsockopt_auth_key(sk, optval, optlen);
3820		break;
3821	case SCTP_AUTH_ACTIVE_KEY:
3822		retval = sctp_setsockopt_active_key(sk, optval, optlen);
3823		break;
3824	case SCTP_AUTH_DELETE_KEY:
3825		retval = sctp_setsockopt_del_key(sk, optval, optlen);
3826		break;
3827	case SCTP_AUTO_ASCONF:
3828		retval = sctp_setsockopt_auto_asconf(sk, optval, optlen);
3829		break;
3830	case SCTP_PEER_ADDR_THLDS:
3831		retval = sctp_setsockopt_paddr_thresholds(sk, optval, optlen);
3832		break;
3833	case SCTP_RECVRCVINFO:
3834		retval = sctp_setsockopt_recvrcvinfo(sk, optval, optlen);
3835		break;
3836	case SCTP_RECVNXTINFO:
3837		retval = sctp_setsockopt_recvnxtinfo(sk, optval, optlen);
3838		break;
3839	default:
3840		retval = -ENOPROTOOPT;
3841		break;
3842	}
3843
3844	release_sock(sk);
3845
3846out_nounlock:
3847	return retval;
3848}
3849
3850/* API 3.1.6 connect() - UDP Style Syntax
3851 *
3852 * An application may use the connect() call in the UDP model to initiate an
3853 * association without sending data.
3854 *
3855 * The syntax is:
3856 *
3857 * ret = connect(int sd, const struct sockaddr *nam, socklen_t len);
3858 *
3859 * sd: the socket descriptor to have a new association added to.
3860 *
3861 * nam: the address structure (either struct sockaddr_in or struct
3862 *    sockaddr_in6 defined in RFC2553 [7]).
3863 *
3864 * len: the size of the address.
3865 */
3866static int sctp_connect(struct sock *sk, struct sockaddr *addr,
3867			int addr_len)
3868{
3869	int err = 0;
3870	struct sctp_af *af;
3871
3872	lock_sock(sk);
3873
3874	pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
3875		 addr, addr_len);
3876
3877	/* Validate addr_len before calling common connect/connectx routine. */
3878	af = sctp_get_af_specific(addr->sa_family);
3879	if (!af || addr_len < af->sockaddr_len) {
3880		err = -EINVAL;
3881	} else {
3882		/* Pass correct addr len to common routine (so it knows there
3883		 * is only one address being passed.
3884		 */
3885		err = __sctp_connect(sk, addr, af->sockaddr_len, NULL);
3886	}
3887
3888	release_sock(sk);
3889	return err;
3890}
3891
3892/* FIXME: Write comments. */
3893static int sctp_disconnect(struct sock *sk, int flags)
3894{
3895	return -EOPNOTSUPP; /* STUB */
3896}
3897
3898/* 4.1.4 accept() - TCP Style Syntax
3899 *
3900 * Applications use accept() call to remove an established SCTP
3901 * association from the accept queue of the endpoint.  A new socket
3902 * descriptor will be returned from accept() to represent the newly
3903 * formed association.
3904 */
3905static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
3906{
3907	struct sctp_sock *sp;
3908	struct sctp_endpoint *ep;
3909	struct sock *newsk = NULL;
3910	struct sctp_association *asoc;
3911	long timeo;
3912	int error = 0;
3913
3914	lock_sock(sk);
3915
3916	sp = sctp_sk(sk);
3917	ep = sp->ep;
3918
3919	if (!sctp_style(sk, TCP)) {
3920		error = -EOPNOTSUPP;
3921		goto out;
3922	}
3923
3924	if (!sctp_sstate(sk, LISTENING)) {
3925		error = -EINVAL;
3926		goto out;
3927	}
3928
3929	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
3930
3931	error = sctp_wait_for_accept(sk, timeo);
3932	if (error)
3933		goto out;
3934
3935	/* We treat the list of associations on the endpoint as the accept
3936	 * queue and pick the first association on the list.
3937	 */
3938	asoc = list_entry(ep->asocs.next, struct sctp_association, asocs);
3939
3940	newsk = sp->pf->create_accept_sk(sk, asoc);
3941	if (!newsk) {
3942		error = -ENOMEM;
3943		goto out;
3944	}
3945
3946	/* Populate the fields of the newsk from the oldsk and migrate the
3947	 * asoc to the newsk.
3948	 */
3949	sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
3950
3951out:
3952	release_sock(sk);
3953	*err = error;
3954	return newsk;
3955}
3956
3957/* The SCTP ioctl handler. */
3958static int sctp_ioctl(struct sock *sk, int cmd, unsigned long arg)
3959{
3960	int rc = -ENOTCONN;
3961
3962	lock_sock(sk);
3963
3964	/*
3965	 * SEQPACKET-style sockets in LISTENING state are valid, for
3966	 * SCTP, so only discard TCP-style sockets in LISTENING state.
3967	 */
3968	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
3969		goto out;
3970
3971	switch (cmd) {
3972	case SIOCINQ: {
3973		struct sk_buff *skb;
3974		unsigned int amount = 0;
3975
3976		skb = skb_peek(&sk->sk_receive_queue);
3977		if (skb != NULL) {
3978			/*
3979			 * We will only return the amount of this packet since
3980			 * that is all that will be read.
3981			 */
3982			amount = skb->len;
3983		}
3984		rc = put_user(amount, (int __user *)arg);
3985		break;
3986	}
3987	default:
3988		rc = -ENOIOCTLCMD;
3989		break;
3990	}
3991out:
3992	release_sock(sk);
3993	return rc;
3994}
3995
3996/* This is the function which gets called during socket creation to
3997 * initialized the SCTP-specific portion of the sock.
3998 * The sock structure should already be zero-filled memory.
3999 */
4000static int sctp_init_sock(struct sock *sk)
4001{
4002	struct net *net = sock_net(sk);
4003	struct sctp_sock *sp;
4004
4005	pr_debug("%s: sk:%p\n", __func__, sk);
4006
4007	sp = sctp_sk(sk);
4008
4009	/* Initialize the SCTP per socket area.  */
4010	switch (sk->sk_type) {
4011	case SOCK_SEQPACKET:
4012		sp->type = SCTP_SOCKET_UDP;
4013		break;
4014	case SOCK_STREAM:
4015		sp->type = SCTP_SOCKET_TCP;
4016		break;
4017	default:
4018		return -ESOCKTNOSUPPORT;
4019	}
4020
4021	/* Initialize default send parameters. These parameters can be
4022	 * modified with the SCTP_DEFAULT_SEND_PARAM socket option.
4023	 */
4024	sp->default_stream = 0;
4025	sp->default_ppid = 0;
4026	sp->default_flags = 0;
4027	sp->default_context = 0;
4028	sp->default_timetolive = 0;
4029
4030	sp->default_rcv_context = 0;
4031	sp->max_burst = net->sctp.max_burst;
4032
4033	sp->sctp_hmac_alg = net->sctp.sctp_hmac_alg;
4034
4035	/* Initialize default setup parameters. These parameters
4036	 * can be modified with the SCTP_INITMSG socket option or
4037	 * overridden by the SCTP_INIT CMSG.
4038	 */
4039	sp->initmsg.sinit_num_ostreams   = sctp_max_outstreams;
4040	sp->initmsg.sinit_max_instreams  = sctp_max_instreams;
4041	sp->initmsg.sinit_max_attempts   = net->sctp.max_retrans_init;
4042	sp->initmsg.sinit_max_init_timeo = net->sctp.rto_max;
4043
4044	/* Initialize default RTO related parameters.  These parameters can
4045	 * be modified for with the SCTP_RTOINFO socket option.
4046	 */
4047	sp->rtoinfo.srto_initial = net->sctp.rto_initial;
4048	sp->rtoinfo.srto_max     = net->sctp.rto_max;
4049	sp->rtoinfo.srto_min     = net->sctp.rto_min;
4050
4051	/* Initialize default association related parameters. These parameters
4052	 * can be modified with the SCTP_ASSOCINFO socket option.
4053	 */
4054	sp->assocparams.sasoc_asocmaxrxt = net->sctp.max_retrans_association;
4055	sp->assocparams.sasoc_number_peer_destinations = 0;
4056	sp->assocparams.sasoc_peer_rwnd = 0;
4057	sp->assocparams.sasoc_local_rwnd = 0;
4058	sp->assocparams.sasoc_cookie_life = net->sctp.valid_cookie_life;
4059
4060	/* Initialize default event subscriptions. By default, all the
4061	 * options are off.
4062	 */
4063	memset(&sp->subscribe, 0, sizeof(struct sctp_event_subscribe));
4064
4065	/* Default Peer Address Parameters.  These defaults can
4066	 * be modified via SCTP_PEER_ADDR_PARAMS
4067	 */
4068	sp->hbinterval  = net->sctp.hb_interval;
4069	sp->pathmaxrxt  = net->sctp.max_retrans_path;
4070	sp->pathmtu     = 0; /* allow default discovery */
4071	sp->sackdelay   = net->sctp.sack_timeout;
4072	sp->sackfreq	= 2;
4073	sp->param_flags = SPP_HB_ENABLE |
4074			  SPP_PMTUD_ENABLE |
4075			  SPP_SACKDELAY_ENABLE;
4076
4077	/* If enabled no SCTP message fragmentation will be performed.
4078	 * Configure through SCTP_DISABLE_FRAGMENTS socket option.
4079	 */
4080	sp->disable_fragments = 0;
4081
4082	/* Enable Nagle algorithm by default.  */
4083	sp->nodelay           = 0;
4084
4085	sp->recvrcvinfo = 0;
4086	sp->recvnxtinfo = 0;
4087
4088	/* Enable by default. */
4089	sp->v4mapped          = 1;
4090
4091	/* Auto-close idle associations after the configured
4092	 * number of seconds.  A value of 0 disables this
4093	 * feature.  Configure through the SCTP_AUTOCLOSE socket option,
4094	 * for UDP-style sockets only.
4095	 */
4096	sp->autoclose         = 0;
4097
4098	/* User specified fragmentation limit. */
4099	sp->user_frag         = 0;
4100
4101	sp->adaptation_ind = 0;
4102
4103	sp->pf = sctp_get_pf_specific(sk->sk_family);
4104
4105	/* Control variables for partial data delivery. */
4106	atomic_set(&sp->pd_mode, 0);
4107	skb_queue_head_init(&sp->pd_lobby);
4108	sp->frag_interleave = 0;
4109
4110	/* Create a per socket endpoint structure.  Even if we
4111	 * change the data structure relationships, this may still
4112	 * be useful for storing pre-connect address information.
4113	 */
4114	sp->ep = sctp_endpoint_new(sk, GFP_KERNEL);
4115	if (!sp->ep)
4116		return -ENOMEM;
4117
4118	sp->hmac = NULL;
4119
4120	sk->sk_destruct = sctp_destruct_sock;
4121
4122	SCTP_DBG_OBJCNT_INC(sock);
4123
4124	local_bh_disable();
4125	percpu_counter_inc(&sctp_sockets_allocated);
4126	sock_prot_inuse_add(net, sk->sk_prot, 1);
4127
4128	/* Nothing can fail after this block, otherwise
4129	 * sctp_destroy_sock() will be called without addr_wq_lock held
4130	 */
4131	if (net->sctp.default_auto_asconf) {
4132		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
4133		list_add_tail(&sp->auto_asconf_list,
4134		    &net->sctp.auto_asconf_splist);
4135		sp->do_auto_asconf = 1;
4136		spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
4137	} else {
4138		sp->do_auto_asconf = 0;
4139	}
4140
4141	local_bh_enable();
4142
4143	return 0;
4144}
4145
4146/* Cleanup any SCTP per socket resources. Must be called with
4147 * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
4148 */
4149static void sctp_destroy_sock(struct sock *sk)
4150{
4151	struct sctp_sock *sp;
4152
4153	pr_debug("%s: sk:%p\n", __func__, sk);
4154
4155	/* Release our hold on the endpoint. */
4156	sp = sctp_sk(sk);
4157	/* This could happen during socket init, thus we bail out
4158	 * early, since the rest of the below is not setup either.
4159	 */
4160	if (sp->ep == NULL)
4161		return;
4162
4163	if (sp->do_auto_asconf) {
4164		sp->do_auto_asconf = 0;
4165		list_del(&sp->auto_asconf_list);
4166	}
4167	sctp_endpoint_free(sp->ep);
4168	local_bh_disable();
4169	percpu_counter_dec(&sctp_sockets_allocated);
4170	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
4171	local_bh_enable();
4172}
4173
4174/* Triggered when there are no references on the socket anymore */
4175static void sctp_destruct_sock(struct sock *sk)
4176{
4177	struct sctp_sock *sp = sctp_sk(sk);
4178
4179	/* Free up the HMAC transform. */
4180	crypto_free_hash(sp->hmac);
4181
4182	inet_sock_destruct(sk);
4183}
4184
4185/* API 4.1.7 shutdown() - TCP Style Syntax
4186 *     int shutdown(int socket, int how);
4187 *
4188 *     sd      - the socket descriptor of the association to be closed.
4189 *     how     - Specifies the type of shutdown.  The  values  are
4190 *               as follows:
4191 *               SHUT_RD
4192 *                     Disables further receive operations. No SCTP
4193 *                     protocol action is taken.
4194 *               SHUT_WR
4195 *                     Disables further send operations, and initiates
4196 *                     the SCTP shutdown sequence.
4197 *               SHUT_RDWR
4198 *                     Disables further send  and  receive  operations
4199 *                     and initiates the SCTP shutdown sequence.
4200 */
4201static void sctp_shutdown(struct sock *sk, int how)
4202{
4203	struct net *net = sock_net(sk);
4204	struct sctp_endpoint *ep;
4205	struct sctp_association *asoc;
4206
4207	if (!sctp_style(sk, TCP))
4208		return;
4209
4210	if (how & SEND_SHUTDOWN) {
4211		ep = sctp_sk(sk)->ep;
4212		if (!list_empty(&ep->asocs)) {
4213			asoc = list_entry(ep->asocs.next,
4214					  struct sctp_association, asocs);
4215			sctp_primitive_SHUTDOWN(net, asoc, NULL);
4216		}
4217	}
4218}
4219
4220/* 7.2.1 Association Status (SCTP_STATUS)
4221
4222 * Applications can retrieve current status information about an
4223 * association, including association state, peer receiver window size,
4224 * number of unacked data chunks, and number of data chunks pending
4225 * receipt.  This information is read-only.
4226 */
4227static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
4228				       char __user *optval,
4229				       int __user *optlen)
4230{
4231	struct sctp_status status;
4232	struct sctp_association *asoc = NULL;
4233	struct sctp_transport *transport;
4234	sctp_assoc_t associd;
4235	int retval = 0;
4236
4237	if (len < sizeof(status)) {
4238		retval = -EINVAL;
4239		goto out;
4240	}
4241
4242	len = sizeof(status);
4243	if (copy_from_user(&status, optval, len)) {
4244		retval = -EFAULT;
4245		goto out;
4246	}
4247
4248	associd = status.sstat_assoc_id;
4249	asoc = sctp_id2assoc(sk, associd);
4250	if (!asoc) {
4251		retval = -EINVAL;
4252		goto out;
4253	}
4254
4255	transport = asoc->peer.primary_path;
4256
4257	status.sstat_assoc_id = sctp_assoc2id(asoc);
4258	status.sstat_state = sctp_assoc_to_state(asoc);
4259	status.sstat_rwnd =  asoc->peer.rwnd;
4260	status.sstat_unackdata = asoc->unack_data;
4261
4262	status.sstat_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
4263	status.sstat_instrms = asoc->c.sinit_max_instreams;
4264	status.sstat_outstrms = asoc->c.sinit_num_ostreams;
4265	status.sstat_fragmentation_point = asoc->frag_point;
4266	status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4267	memcpy(&status.sstat_primary.spinfo_address, &transport->ipaddr,
4268			transport->af_specific->sockaddr_len);
4269	/* Map ipv4 address into v4-mapped-on-v6 address.  */
4270	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sctp_sk(sk),
4271		(union sctp_addr *)&status.sstat_primary.spinfo_address);
4272	status.sstat_primary.spinfo_state = transport->state;
4273	status.sstat_primary.spinfo_cwnd = transport->cwnd;
4274	status.sstat_primary.spinfo_srtt = transport->srtt;
4275	status.sstat_primary.spinfo_rto = jiffies_to_msecs(transport->rto);
4276	status.sstat_primary.spinfo_mtu = transport->pathmtu;
4277
4278	if (status.sstat_primary.spinfo_state == SCTP_UNKNOWN)
4279		status.sstat_primary.spinfo_state = SCTP_ACTIVE;
4280
4281	if (put_user(len, optlen)) {
4282		retval = -EFAULT;
4283		goto out;
4284	}
4285
4286	pr_debug("%s: len:%d, state:%d, rwnd:%d, assoc_id:%d\n",
4287		 __func__, len, status.sstat_state, status.sstat_rwnd,
4288		 status.sstat_assoc_id);
4289
4290	if (copy_to_user(optval, &status, len)) {
4291		retval = -EFAULT;
4292		goto out;
4293	}
4294
4295out:
4296	return retval;
4297}
4298
4299
4300/* 7.2.2 Peer Address Information (SCTP_GET_PEER_ADDR_INFO)
4301 *
4302 * Applications can retrieve information about a specific peer address
4303 * of an association, including its reachability state, congestion
4304 * window, and retransmission timer values.  This information is
4305 * read-only.
4306 */
4307static int sctp_getsockopt_peer_addr_info(struct sock *sk, int len,
4308					  char __user *optval,
4309					  int __user *optlen)
4310{
4311	struct sctp_paddrinfo pinfo;
4312	struct sctp_transport *transport;
4313	int retval = 0;
4314
4315	if (len < sizeof(pinfo)) {
4316		retval = -EINVAL;
4317		goto out;
4318	}
4319
4320	len = sizeof(pinfo);
4321	if (copy_from_user(&pinfo, optval, len)) {
4322		retval = -EFAULT;
4323		goto out;
4324	}
4325
4326	transport = sctp_addr_id2transport(sk, &pinfo.spinfo_address,
4327					   pinfo.spinfo_assoc_id);
4328	if (!transport)
4329		return -EINVAL;
4330
4331	pinfo.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
4332	pinfo.spinfo_state = transport->state;
4333	pinfo.spinfo_cwnd = transport->cwnd;
4334	pinfo.spinfo_srtt = transport->srtt;
4335	pinfo.spinfo_rto = jiffies_to_msecs(transport->rto);
4336	pinfo.spinfo_mtu = transport->pathmtu;
4337
4338	if (pinfo.spinfo_state == SCTP_UNKNOWN)
4339		pinfo.spinfo_state = SCTP_ACTIVE;
4340
4341	if (put_user(len, optlen)) {
4342		retval = -EFAULT;
4343		goto out;
4344	}
4345
4346	if (copy_to_user(optval, &pinfo, len)) {
4347		retval = -EFAULT;
4348		goto out;
4349	}
4350
4351out:
4352	return retval;
4353}
4354
4355/* 7.1.12 Enable/Disable message fragmentation (SCTP_DISABLE_FRAGMENTS)
4356 *
4357 * This option is a on/off flag.  If enabled no SCTP message
4358 * fragmentation will be performed.  Instead if a message being sent
4359 * exceeds the current PMTU size, the message will NOT be sent and
4360 * instead a error will be indicated to the user.
4361 */
4362static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
4363					char __user *optval, int __user *optlen)
4364{
4365	int val;
4366
4367	if (len < sizeof(int))
4368		return -EINVAL;
4369
4370	len = sizeof(int);
4371	val = (sctp_sk(sk)->disable_fragments == 1);
4372	if (put_user(len, optlen))
4373		return -EFAULT;
4374	if (copy_to_user(optval, &val, len))
4375		return -EFAULT;
4376	return 0;
4377}
4378
4379/* 7.1.15 Set notification and ancillary events (SCTP_EVENTS)
4380 *
4381 * This socket option is used to specify various notifications and
4382 * ancillary data the user wishes to receive.
4383 */
4384static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
4385				  int __user *optlen)
4386{
4387	if (len <= 0)
4388		return -EINVAL;
4389	if (len > sizeof(struct sctp_event_subscribe))
4390		len = sizeof(struct sctp_event_subscribe);
4391	if (put_user(len, optlen))
4392		return -EFAULT;
4393	if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
4394		return -EFAULT;
4395	return 0;
4396}
4397
4398/* 7.1.8 Automatic Close of associations (SCTP_AUTOCLOSE)
4399 *
4400 * This socket option is applicable to the UDP-style socket only.  When
4401 * set it will cause associations that are idle for more than the
4402 * specified number of seconds to automatically close.  An association
4403 * being idle is defined an association that has NOT sent or received
4404 * user data.  The special value of '0' indicates that no automatic
4405 * close of any associations should be performed.  The option expects an
4406 * integer defining the number of seconds of idle time before an
4407 * association is closed.
4408 */
4409static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
4410{
4411	/* Applicable to UDP-style socket only */
4412	if (sctp_style(sk, TCP))
4413		return -EOPNOTSUPP;
4414	if (len < sizeof(int))
4415		return -EINVAL;
4416	len = sizeof(int);
4417	if (put_user(len, optlen))
4418		return -EFAULT;
4419	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
4420		return -EFAULT;
4421	return 0;
4422}
4423
4424/* Helper routine to branch off an association to a new socket.  */
4425int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
4426{
4427	struct sctp_association *asoc = sctp_id2assoc(sk, id);
4428	struct sctp_sock *sp = sctp_sk(sk);
4429	struct socket *sock;
4430	int err = 0;
4431
4432	if (!asoc)
4433		return -EINVAL;
4434
4435	/* An association cannot be branched off from an already peeled-off
4436	 * socket, nor is this supported for tcp style sockets.
4437	 */
4438	if (!sctp_style(sk, UDP))
4439		return -EINVAL;
4440
4441	/* Create a new socket.  */
4442	err = sock_create(sk->sk_family, SOCK_SEQPACKET, IPPROTO_SCTP, &sock);
4443	if (err < 0)
4444		return err;
4445
4446	sctp_copy_sock(sock->sk, sk, asoc);
4447
4448	/* Make peeled-off sockets more like 1-1 accepted sockets.
4449	 * Set the daddr and initialize id to something more random
4450	 */
4451	sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk);
4452
4453	/* Populate the fields of the newsk from the oldsk and migrate the
4454	 * asoc to the newsk.
4455	 */
4456	sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
4457
4458	*sockp = sock;
4459
4460	return err;
4461}
4462EXPORT_SYMBOL(sctp_do_peeloff);
4463
4464static int sctp_getsockopt_peeloff(struct sock *sk, int len, char __user *optval, int __user *optlen)
4465{
4466	sctp_peeloff_arg_t peeloff;
4467	struct socket *newsock;
4468	struct file *newfile;
4469	int retval = 0;
4470
4471	if (len < sizeof(sctp_peeloff_arg_t))
4472		return -EINVAL;
4473	len = sizeof(sctp_peeloff_arg_t);
4474	if (copy_from_user(&peeloff, optval, len))
4475		return -EFAULT;
4476
4477	retval = sctp_do_peeloff(sk, peeloff.associd, &newsock);
4478	if (retval < 0)
4479		goto out;
4480
4481	/* Map the socket to an unused fd that can be returned to the user.  */
4482	retval = get_unused_fd_flags(0);
4483	if (retval < 0) {
4484		sock_release(newsock);
4485		goto out;
4486	}
4487
4488	newfile = sock_alloc_file(newsock, 0, NULL);
4489	if (unlikely(IS_ERR(newfile))) {
4490		put_unused_fd(retval);
4491		sock_release(newsock);
4492		return PTR_ERR(newfile);
4493	}
4494
4495	pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
4496		 retval);
4497
4498	/* Return the fd mapped to the new socket.  */
4499	if (put_user(len, optlen)) {
4500		fput(newfile);
4501		put_unused_fd(retval);
4502		return -EFAULT;
4503	}
4504	peeloff.sd = retval;
4505	if (copy_to_user(optval, &peeloff, len)) {
4506		fput(newfile);
4507		put_unused_fd(retval);
4508		return -EFAULT;
4509	}
4510	fd_install(retval, newfile);
4511out:
4512	return retval;
4513}
4514
4515/* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
4516 *
4517 * Applications can enable or disable heartbeats for any peer address of
4518 * an association, modify an address's heartbeat interval, force a
4519 * heartbeat to be sent immediately, and adjust the address's maximum
4520 * number of retransmissions sent before an address is considered
4521 * unreachable.  The following structure is used to access and modify an
4522 * address's parameters:
4523 *
4524 *  struct sctp_paddrparams {
4525 *     sctp_assoc_t            spp_assoc_id;
4526 *     struct sockaddr_storage spp_address;
4527 *     uint32_t                spp_hbinterval;
4528 *     uint16_t                spp_pathmaxrxt;
4529 *     uint32_t                spp_pathmtu;
4530 *     uint32_t                spp_sackdelay;
4531 *     uint32_t                spp_flags;
4532 * };
4533 *
4534 *   spp_assoc_id    - (one-to-many style socket) This is filled in the
4535 *                     application, and identifies the association for
4536 *                     this query.
4537 *   spp_address     - This specifies which address is of interest.
4538 *   spp_hbinterval  - This contains the value of the heartbeat interval,
4539 *                     in milliseconds.  If a  value of zero
4540 *                     is present in this field then no changes are to
4541 *                     be made to this parameter.
4542 *   spp_pathmaxrxt  - This contains the maximum number of
4543 *                     retransmissions before this address shall be
4544 *                     considered unreachable. If a  value of zero
4545 *                     is present in this field then no changes are to
4546 *                     be made to this parameter.
4547 *   spp_pathmtu     - When Path MTU discovery is disabled the value
4548 *                     specified here will be the "fixed" path mtu.
4549 *                     Note that if the spp_address field is empty
4550 *                     then all associations on this address will
4551 *                     have this fixed path mtu set upon them.
4552 *
4553 *   spp_sackdelay   - When delayed sack is enabled, this value specifies
4554 *                     the number of milliseconds that sacks will be delayed
4555 *                     for. This value will apply to all addresses of an
4556 *                     association if the spp_address field is empty. Note
4557 *                     also, that if delayed sack is enabled and this
4558 *                     value is set to 0, no change is made to the last
4559 *                     recorded delayed sack timer value.
4560 *
4561 *   spp_flags       - These flags are used to control various features
4562 *                     on an association. The flag field may contain
4563 *                     zero or more of the following options.
4564 *
4565 *                     SPP_HB_ENABLE  - Enable heartbeats on the
4566 *                     specified address. Note that if the address
4567 *                     field is empty all addresses for the association
4568 *                     have heartbeats enabled upon them.
4569 *
4570 *                     SPP_HB_DISABLE - Disable heartbeats on the
4571 *                     speicifed address. Note that if the address
4572 *                     field is empty all addresses for the association
4573 *                     will have their heartbeats disabled. Note also
4574 *                     that SPP_HB_ENABLE and SPP_HB_DISABLE are
4575 *                     mutually exclusive, only one of these two should
4576 *                     be specified. Enabling both fields will have
4577 *                     undetermined results.
4578 *
4579 *                     SPP_HB_DEMAND - Request a user initiated heartbeat
4580 *                     to be made immediately.
4581 *
4582 *                     SPP_PMTUD_ENABLE - This field will enable PMTU
4583 *                     discovery upon the specified address. Note that
4584 *                     if the address feild is empty then all addresses
4585 *                     on the association are effected.
4586 *
4587 *                     SPP_PMTUD_DISABLE - This field will disable PMTU
4588 *                     discovery upon the specified address. Note that
4589 *                     if the address feild is empty then all addresses
4590 *                     on the association are effected. Not also that
4591 *                     SPP_PMTUD_ENABLE and SPP_PMTUD_DISABLE are mutually
4592 *                     exclusive. Enabling both will have undetermined
4593 *                     results.
4594 *
4595 *                     SPP_SACKDELAY_ENABLE - Setting this flag turns
4596 *                     on delayed sack. The time specified in spp_sackdelay
4597 *                     is used to specify the sack delay for this address. Note
4598 *                     that if spp_address is empty then all addresses will
4599 *                     enable delayed sack and take on the sack delay
4600 *                     value specified in spp_sackdelay.
4601 *                     SPP_SACKDELAY_DISABLE - Setting this flag turns
4602 *                     off delayed sack. If the spp_address field is blank then
4603 *                     delayed sack is disabled for the entire association. Note
4604 *                     also that this field is mutually exclusive to
4605 *                     SPP_SACKDELAY_ENABLE, setting both will have undefined
4606 *                     results.
4607 */
4608static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
4609					    char __user *optval, int __user *optlen)
4610{
4611	struct sctp_paddrparams  params;
4612	struct sctp_transport   *trans = NULL;
4613	struct sctp_association *asoc = NULL;
4614	struct sctp_sock        *sp = sctp_sk(sk);
4615
4616	if (len < sizeof(struct sctp_paddrparams))
4617		return -EINVAL;
4618	len = sizeof(struct sctp_paddrparams);
4619	if (copy_from_user(&params, optval, len))
4620		return -EFAULT;
4621
4622	/* If an address other than INADDR_ANY is specified, and
4623	 * no transport is found, then the request is invalid.
4624	 */
4625	if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
4626		trans = sctp_addr_id2transport(sk, &params.spp_address,
4627					       params.spp_assoc_id);
4628		if (!trans) {
4629			pr_debug("%s: failed no transport\n", __func__);
4630			return -EINVAL;
4631		}
4632	}
4633
4634	/* Get association, if assoc_id != 0 and the socket is a one
4635	 * to many style socket, and an association was not found, then
4636	 * the id was invalid.
4637	 */
4638	asoc = sctp_id2assoc(sk, params.spp_assoc_id);
4639	if (!asoc && params.spp_assoc_id && sctp_style(sk, UDP)) {
4640		pr_debug("%s: failed no association\n", __func__);
4641		return -EINVAL;
4642	}
4643
4644	if (trans) {
4645		/* Fetch transport values. */
4646		params.spp_hbinterval = jiffies_to_msecs(trans->hbinterval);
4647		params.spp_pathmtu    = trans->pathmtu;
4648		params.spp_pathmaxrxt = trans->pathmaxrxt;
4649		params.spp_sackdelay  = jiffies_to_msecs(trans->sackdelay);
4650
4651		/*draft-11 doesn't say what to return in spp_flags*/
4652		params.spp_flags      = trans->param_flags;
4653	} else if (asoc) {
4654		/* Fetch association values. */
4655		params.spp_hbinterval = jiffies_to_msecs(asoc->hbinterval);
4656		params.spp_pathmtu    = asoc->pathmtu;
4657		params.spp_pathmaxrxt = asoc->pathmaxrxt;
4658		params.spp_sackdelay  = jiffies_to_msecs(asoc->sackdelay);
4659
4660		/*draft-11 doesn't say what to return in spp_flags*/
4661		params.spp_flags      = asoc->param_flags;
4662	} else {
4663		/* Fetch socket values. */
4664		params.spp_hbinterval = sp->hbinterval;
4665		params.spp_pathmtu    = sp->pathmtu;
4666		params.spp_sackdelay  = sp->sackdelay;
4667		params.spp_pathmaxrxt = sp->pathmaxrxt;
4668
4669		/*draft-11 doesn't say what to return in spp_flags*/
4670		params.spp_flags      = sp->param_flags;
4671	}
4672
4673	if (copy_to_user(optval, &params, len))
4674		return -EFAULT;
4675
4676	if (put_user(len, optlen))
4677		return -EFAULT;
4678
4679	return 0;
4680}
4681
4682/*
4683 * 7.1.23.  Get or set delayed ack timer (SCTP_DELAYED_SACK)
4684 *
4685 * This option will effect the way delayed acks are performed.  This
4686 * option allows you to get or set the delayed ack time, in
4687 * milliseconds.  It also allows changing the delayed ack frequency.
4688 * Changing the frequency to 1 disables the delayed sack algorithm.  If
4689 * the assoc_id is 0, then this sets or gets the endpoints default
4690 * values.  If the assoc_id field is non-zero, then the set or get
4691 * effects the specified association for the one to many model (the
4692 * assoc_id field is ignored by the one to one model).  Note that if
4693 * sack_delay or sack_freq are 0 when setting this option, then the
4694 * current values will remain unchanged.
4695 *
4696 * struct sctp_sack_info {
4697 *     sctp_assoc_t            sack_assoc_id;
4698 *     uint32_t                sack_delay;
4699 *     uint32_t                sack_freq;
4700 * };
4701 *
4702 * sack_assoc_id -  This parameter, indicates which association the user
4703 *    is performing an action upon.  Note that if this field's value is
4704 *    zero then the endpoints default value is changed (effecting future
4705 *    associations only).
4706 *
4707 * sack_delay -  This parameter contains the number of milliseconds that
4708 *    the user is requesting the delayed ACK timer be set to.  Note that
4709 *    this value is defined in the standard to be between 200 and 500
4710 *    milliseconds.
4711 *
4712 * sack_freq -  This parameter contains the number of packets that must
4713 *    be received before a sack is sent without waiting for the delay
4714 *    timer to expire.  The default value for this is 2, setting this
4715 *    value to 1 will disable the delayed sack algorithm.
4716 */
4717static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
4718					    char __user *optval,
4719					    int __user *optlen)
4720{
4721	struct sctp_sack_info    params;
4722	struct sctp_association *asoc = NULL;
4723	struct sctp_sock        *sp = sctp_sk(sk);
4724
4725	if (len >= sizeof(struct sctp_sack_info)) {
4726		len = sizeof(struct sctp_sack_info);
4727
4728		if (copy_from_user(&params, optval, len))
4729			return -EFAULT;
4730	} else if (len == sizeof(struct sctp_assoc_value)) {
4731		pr_warn_ratelimited(DEPRECATED
4732				    "%s (pid %d) "
4733				    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
4734				    "Use struct sctp_sack_info instead\n",
4735				    current->comm, task_pid_nr(current));
4736		if (copy_from_user(&params, optval, len))
4737			return -EFAULT;
4738	} else
4739		return -EINVAL;
4740
4741	/* Get association, if sack_assoc_id != 0 and the socket is a one
4742	 * to many style socket, and an association was not found, then
4743	 * the id was invalid.
4744	 */
4745	asoc = sctp_id2assoc(sk, params.sack_assoc_id);
4746	if (!asoc && params.sack_assoc_id && sctp_style(sk, UDP))
4747		return -EINVAL;
4748
4749	if (asoc) {
4750		/* Fetch association values. */
4751		if (asoc->param_flags & SPP_SACKDELAY_ENABLE) {
4752			params.sack_delay = jiffies_to_msecs(
4753				asoc->sackdelay);
4754			params.sack_freq = asoc->sackfreq;
4755
4756		} else {
4757			params.sack_delay = 0;
4758			params.sack_freq = 1;
4759		}
4760	} else {
4761		/* Fetch socket values. */
4762		if (sp->param_flags & SPP_SACKDELAY_ENABLE) {
4763			params.sack_delay  = sp->sackdelay;
4764			params.sack_freq = sp->sackfreq;
4765		} else {
4766			params.sack_delay  = 0;
4767			params.sack_freq = 1;
4768		}
4769	}
4770
4771	if (copy_to_user(optval, &params, len))
4772		return -EFAULT;
4773
4774	if (put_user(len, optlen))
4775		return -EFAULT;
4776
4777	return 0;
4778}
4779
4780/* 7.1.3 Initialization Parameters (SCTP_INITMSG)
4781 *
4782 * Applications can specify protocol parameters for the default association
4783 * initialization.  The option name argument to setsockopt() and getsockopt()
4784 * is SCTP_INITMSG.
4785 *
4786 * Setting initialization parameters is effective only on an unconnected
4787 * socket (for UDP-style sockets only future associations are effected
4788 * by the change).  With TCP-style sockets, this option is inherited by
4789 * sockets derived from a listener socket.
4790 */
4791static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
4792{
4793	if (len < sizeof(struct sctp_initmsg))
4794		return -EINVAL;
4795	len = sizeof(struct sctp_initmsg);
4796	if (put_user(len, optlen))
4797		return -EFAULT;
4798	if (copy_to_user(optval, &sctp_sk(sk)->initmsg, len))
4799		return -EFAULT;
4800	return 0;
4801}
4802
4803
4804static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
4805				      char __user *optval, int __user *optlen)
4806{
4807	struct sctp_association *asoc;
4808	int cnt = 0;
4809	struct sctp_getaddrs getaddrs;
4810	struct sctp_transport *from;
4811	void __user *to;
4812	union sctp_addr temp;
4813	struct sctp_sock *sp = sctp_sk(sk);
4814	int addrlen;
4815	size_t space_left;
4816	int bytes_copied;
4817
4818	if (len < sizeof(struct sctp_getaddrs))
4819		return -EINVAL;
4820
4821	if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
4822		return -EFAULT;
4823
4824	/* For UDP-style sockets, id specifies the association to query.  */
4825	asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
4826	if (!asoc)
4827		return -EINVAL;
4828
4829	to = optval + offsetof(struct sctp_getaddrs, addrs);
4830	space_left = len - offsetof(struct sctp_getaddrs, addrs);
4831
4832	list_for_each_entry(from, &asoc->peer.transport_addr_list,
4833				transports) {
4834		memcpy(&temp, &from->ipaddr, sizeof(temp));
4835		addrlen = sctp_get_pf_specific(sk->sk_family)
4836			      ->addr_to_user(sp, &temp);
4837		if (space_left < addrlen)
4838			return -ENOMEM;
4839		if (copy_to_user(to, &temp, addrlen))
4840			return -EFAULT;
4841		to += addrlen;
4842		cnt++;
4843		space_left -= addrlen;
4844	}
4845
4846	if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num))
4847		return -EFAULT;
4848	bytes_copied = ((char __user *)to) - optval;
4849	if (put_user(bytes_copied, optlen))
4850		return -EFAULT;
4851
4852	return 0;
4853}
4854
4855static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
4856			    size_t space_left, int *bytes_copied)
4857{
4858	struct sctp_sockaddr_entry *addr;
4859	union sctp_addr temp;
4860	int cnt = 0;
4861	int addrlen;
4862	struct net *net = sock_net(sk);
4863
4864	rcu_read_lock();
4865	list_for_each_entry_rcu(addr, &net->sctp.local_addr_list, list) {
4866		if (!addr->valid)
4867			continue;
4868
4869		if ((PF_INET == sk->sk_family) &&
4870		    (AF_INET6 == addr->a.sa.sa_family))
4871			continue;
4872		if ((PF_INET6 == sk->sk_family) &&
4873		    inet_v6_ipv6only(sk) &&
4874		    (AF_INET == addr->a.sa.sa_family))
4875			continue;
4876		memcpy(&temp, &addr->a, sizeof(temp));
4877		if (!temp.v4.sin_port)
4878			temp.v4.sin_port = htons(port);
4879
4880		addrlen = sctp_get_pf_specific(sk->sk_family)
4881			      ->addr_to_user(sctp_sk(sk), &temp);
4882
4883		if (space_left < addrlen) {
4884			cnt =  -ENOMEM;
4885			break;
4886		}
4887		memcpy(to, &temp, addrlen);
4888
4889		to += addrlen;
4890		cnt++;
4891		space_left -= addrlen;
4892		*bytes_copied += addrlen;
4893	}
4894	rcu_read_unlock();
4895
4896	return cnt;
4897}
4898
4899
4900static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
4901				       char __user *optval, int __user *optlen)
4902{
4903	struct sctp_bind_addr *bp;
4904	struct sctp_association *asoc;
4905	int cnt = 0;
4906	struct sctp_getaddrs getaddrs;
4907	struct sctp_sockaddr_entry *addr;
4908	void __user *to;
4909	union sctp_addr temp;
4910	struct sctp_sock *sp = sctp_sk(sk);
4911	int addrlen;
4912	int err = 0;
4913	size_t space_left;
4914	int bytes_copied = 0;
4915	void *addrs;
4916	void *buf;
4917
4918	if (len < sizeof(struct sctp_getaddrs))
4919		return -EINVAL;
4920
4921	if (copy_from_user(&getaddrs, optval, sizeof(struct sctp_getaddrs)))
4922		return -EFAULT;
4923
4924	/*
4925	 *  For UDP-style sockets, id specifies the association to query.
4926	 *  If the id field is set to the value '0' then the locally bound
4927	 *  addresses are returned without regard to any particular
4928	 *  association.
4929	 */
4930	if (0 == getaddrs.assoc_id) {
4931		bp = &sctp_sk(sk)->ep->base.bind_addr;
4932	} else {
4933		asoc = sctp_id2assoc(sk, getaddrs.assoc_id);
4934		if (!asoc)
4935			return -EINVAL;
4936		bp = &asoc->base.bind_addr;
4937	}
4938
4939	to = optval + offsetof(struct sctp_getaddrs, addrs);
4940	space_left = len - offsetof(struct sctp_getaddrs, addrs);
4941
4942	addrs = kmalloc(space_left, GFP_KERNEL);
4943	if (!addrs)
4944		return -ENOMEM;
4945
4946	/* If the endpoint is bound to 0.0.0.0 or ::0, get the valid
4947	 * addresses from the global local address list.
4948	 */
4949	if (sctp_list_single_entry(&bp->address_list)) {
4950		addr = list_entry(bp->address_list.next,
4951				  struct sctp_sockaddr_entry, list);
4952		if (sctp_is_any(sk, &addr->a)) {
4953			cnt = sctp_copy_laddrs(sk, bp->port, addrs,
4954						space_left, &bytes_copied);
4955			if (cnt < 0) {
4956				err = cnt;
4957				goto out;
4958			}
4959			goto copy_getaddrs;
4960		}
4961	}
4962
4963	buf = addrs;
4964	/* Protection on the bound address list is not needed since
4965	 * in the socket option context we hold a socket lock and
4966	 * thus the bound address list can't change.
4967	 */
4968	list_for_each_entry(addr, &bp->address_list, list) {
4969		memcpy(&temp, &addr->a, sizeof(temp));
4970		addrlen = sctp_get_pf_specific(sk->sk_family)
4971			      ->addr_to_user(sp, &temp);
4972		if (space_left < addrlen) {
4973			err =  -ENOMEM; /*fixme: right error?*/
4974			goto out;
4975		}
4976		memcpy(buf, &temp, addrlen);
4977		buf += addrlen;
4978		bytes_copied += addrlen;
4979		cnt++;
4980		space_left -= addrlen;
4981	}
4982
4983copy_getaddrs:
4984	if (copy_to_user(to, addrs, bytes_copied)) {
4985		err = -EFAULT;
4986		goto out;
4987	}
4988	if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num)) {
4989		err = -EFAULT;
4990		goto out;
4991	}
4992	if (put_user(bytes_copied, optlen))
4993		err = -EFAULT;
4994out:
4995	kfree(addrs);
4996	return err;
4997}
4998
4999/* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
5000 *
5001 * Requests that the local SCTP stack use the enclosed peer address as
5002 * the association primary.  The enclosed address must be one of the
5003 * association peer's addresses.
5004 */
5005static int sctp_getsockopt_primary_addr(struct sock *sk, int len,
5006					char __user *optval, int __user *optlen)
5007{
5008	struct sctp_prim prim;
5009	struct sctp_association *asoc;
5010	struct sctp_sock *sp = sctp_sk(sk);
5011
5012	if (len < sizeof(struct sctp_prim))
5013		return -EINVAL;
5014
5015	len = sizeof(struct sctp_prim);
5016
5017	if (copy_from_user(&prim, optval, len))
5018		return -EFAULT;
5019
5020	asoc = sctp_id2assoc(sk, prim.ssp_assoc_id);
5021	if (!asoc)
5022		return -EINVAL;
5023
5024	if (!asoc->peer.primary_path)
5025		return -ENOTCONN;
5026
5027	memcpy(&prim.ssp_addr, &asoc->peer.primary_path->ipaddr,
5028		asoc->peer.primary_path->af_specific->sockaddr_len);
5029
5030	sctp_get_pf_specific(sk->sk_family)->addr_to_user(sp,
5031			(union sctp_addr *)&prim.ssp_addr);
5032
5033	if (put_user(len, optlen))
5034		return -EFAULT;
5035	if (copy_to_user(optval, &prim, len))
5036		return -EFAULT;
5037
5038	return 0;
5039}
5040
5041/*
5042 * 7.1.11  Set Adaptation Layer Indicator (SCTP_ADAPTATION_LAYER)
5043 *
5044 * Requests that the local endpoint set the specified Adaptation Layer
5045 * Indication parameter for all future INIT and INIT-ACK exchanges.
5046 */
5047static int sctp_getsockopt_adaptation_layer(struct sock *sk, int len,
5048				  char __user *optval, int __user *optlen)
5049{
5050	struct sctp_setadaptation adaptation;
5051
5052	if (len < sizeof(struct sctp_setadaptation))
5053		return -EINVAL;
5054
5055	len = sizeof(struct sctp_setadaptation);
5056
5057	adaptation.ssb_adaptation_ind = sctp_sk(sk)->adaptation_ind;
5058
5059	if (put_user(len, optlen))
5060		return -EFAULT;
5061	if (copy_to_user(optval, &adaptation, len))
5062		return -EFAULT;
5063
5064	return 0;
5065}
5066
5067/*
5068 *
5069 * 7.1.14 Set default send parameters (SCTP_DEFAULT_SEND_PARAM)
5070 *
5071 *   Applications that wish to use the sendto() system call may wish to
5072 *   specify a default set of parameters that would normally be supplied
5073 *   through the inclusion of ancillary data.  This socket option allows
5074 *   such an application to set the default sctp_sndrcvinfo structure.
5075
5076
5077 *   The application that wishes to use this socket option simply passes
5078 *   in to this call the sctp_sndrcvinfo structure defined in Section
5079 *   5.2.2) The input parameters accepted by this call include
5080 *   sinfo_stream, sinfo_flags, sinfo_ppid, sinfo_context,
5081 *   sinfo_timetolive.  The user must provide the sinfo_assoc_id field in
5082 *   to this call if the caller is using the UDP model.
5083 *
5084 *   For getsockopt, it get the default sctp_sndrcvinfo structure.
5085 */
5086static int sctp_getsockopt_default_send_param(struct sock *sk,
5087					int len, char __user *optval,
5088					int __user *optlen)
5089{
5090	struct sctp_sock *sp = sctp_sk(sk);
5091	struct sctp_association *asoc;
5092	struct sctp_sndrcvinfo info;
5093
5094	if (len < sizeof(info))
5095		return -EINVAL;
5096
5097	len = sizeof(info);
5098
5099	if (copy_from_user(&info, optval, len))
5100		return -EFAULT;
5101
5102	asoc = sctp_id2assoc(sk, info.sinfo_assoc_id);
5103	if (!asoc && info.sinfo_assoc_id && sctp_style(sk, UDP))
5104		return -EINVAL;
5105	if (asoc) {
5106		info.sinfo_stream = asoc->default_stream;
5107		info.sinfo_flags = asoc->default_flags;
5108		info.sinfo_ppid = asoc->default_ppid;
5109		info.sinfo_context = asoc->default_context;
5110		info.sinfo_timetolive = asoc->default_timetolive;
5111	} else {
5112		info.sinfo_stream = sp->default_stream;
5113		info.sinfo_flags = sp->default_flags;
5114		info.sinfo_ppid = sp->default_ppid;
5115		info.sinfo_context = sp->default_context;
5116		info.sinfo_timetolive = sp->default_timetolive;
5117	}
5118
5119	if (put_user(len, optlen))
5120		return -EFAULT;
5121	if (copy_to_user(optval, &info, len))
5122		return -EFAULT;
5123
5124	return 0;
5125}
5126
5127/* RFC6458, Section 8.1.31. Set/get Default Send Parameters
5128 * (SCTP_DEFAULT_SNDINFO)
5129 */
5130static int sctp_getsockopt_default_sndinfo(struct sock *sk, int len,
5131					   char __user *optval,
5132					   int __user *optlen)
5133{
5134	struct sctp_sock *sp = sctp_sk(sk);
5135	struct sctp_association *asoc;
5136	struct sctp_sndinfo info;
5137
5138	if (len < sizeof(info))
5139		return -EINVAL;
5140
5141	len = sizeof(info);
5142
5143	if (copy_from_user(&info, optval, len))
5144		return -EFAULT;
5145
5146	asoc = sctp_id2assoc(sk, info.snd_assoc_id);
5147	if (!asoc && info.snd_assoc_id && sctp_style(sk, UDP))
5148		return -EINVAL;
5149	if (asoc) {
5150		info.snd_sid = asoc->default_stream;
5151		info.snd_flags = asoc->default_flags;
5152		info.snd_ppid = asoc->default_ppid;
5153		info.snd_context = asoc->default_context;
5154	} else {
5155		info.snd_sid = sp->default_stream;
5156		info.snd_flags = sp->default_flags;
5157		info.snd_ppid = sp->default_ppid;
5158		info.snd_context = sp->default_context;
5159	}
5160
5161	if (put_user(len, optlen))
5162		return -EFAULT;
5163	if (copy_to_user(optval, &info, len))
5164		return -EFAULT;
5165
5166	return 0;
5167}
5168
5169/*
5170 *
5171 * 7.1.5 SCTP_NODELAY
5172 *
5173 * Turn on/off any Nagle-like algorithm.  This means that packets are
5174 * generally sent as soon as possible and no unnecessary delays are
5175 * introduced, at the cost of more packets in the network.  Expects an
5176 * integer boolean flag.
5177 */
5178
5179static int sctp_getsockopt_nodelay(struct sock *sk, int len,
5180				   char __user *optval, int __user *optlen)
5181{
5182	int val;
5183
5184	if (len < sizeof(int))
5185		return -EINVAL;
5186
5187	len = sizeof(int);
5188	val = (sctp_sk(sk)->nodelay == 1);
5189	if (put_user(len, optlen))
5190		return -EFAULT;
5191	if (copy_to_user(optval, &val, len))
5192		return -EFAULT;
5193	return 0;
5194}
5195
5196/*
5197 *
5198 * 7.1.1 SCTP_RTOINFO
5199 *
5200 * The protocol parameters used to initialize and bound retransmission
5201 * timeout (RTO) are tunable. sctp_rtoinfo structure is used to access
5202 * and modify these parameters.
5203 * All parameters are time values, in milliseconds.  A value of 0, when
5204 * modifying the parameters, indicates that the current value should not
5205 * be changed.
5206 *
5207 */
5208static int sctp_getsockopt_rtoinfo(struct sock *sk, int len,
5209				char __user *optval,
5210				int __user *optlen) {
5211	struct sctp_rtoinfo rtoinfo;
5212	struct sctp_association *asoc;
5213
5214	if (len < sizeof (struct sctp_rtoinfo))
5215		return -EINVAL;
5216
5217	len = sizeof(struct sctp_rtoinfo);
5218
5219	if (copy_from_user(&rtoinfo, optval, len))
5220		return -EFAULT;
5221
5222	asoc = sctp_id2assoc(sk, rtoinfo.srto_assoc_id);
5223
5224	if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
5225		return -EINVAL;
5226
5227	/* Values corresponding to the specific association. */
5228	if (asoc) {
5229		rtoinfo.srto_initial = jiffies_to_msecs(asoc->rto_initial);
5230		rtoinfo.srto_max = jiffies_to_msecs(asoc->rto_max);
5231		rtoinfo.srto_min = jiffies_to_msecs(asoc->rto_min);
5232	} else {
5233		/* Values corresponding to the endpoint. */
5234		struct sctp_sock *sp = sctp_sk(sk);
5235
5236		rtoinfo.srto_initial = sp->rtoinfo.srto_initial;
5237		rtoinfo.srto_max = sp->rtoinfo.srto_max;
5238		rtoinfo.srto_min = sp->rtoinfo.srto_min;
5239	}
5240
5241	if (put_user(len, optlen))
5242		return -EFAULT;
5243
5244	if (copy_to_user(optval, &rtoinfo, len))
5245		return -EFAULT;
5246
5247	return 0;
5248}
5249
5250/*
5251 *
5252 * 7.1.2 SCTP_ASSOCINFO
5253 *
5254 * This option is used to tune the maximum retransmission attempts
5255 * of the association.
5256 * Returns an error if the new association retransmission value is
5257 * greater than the sum of the retransmission value  of the peer.
5258 * See [SCTP] for more information.
5259 *
5260 */
5261static int sctp_getsockopt_associnfo(struct sock *sk, int len,
5262				     char __user *optval,
5263				     int __user *optlen)
5264{
5265
5266	struct sctp_assocparams assocparams;
5267	struct sctp_association *asoc;
5268	struct list_head *pos;
5269	int cnt = 0;
5270
5271	if (len < sizeof (struct sctp_assocparams))
5272		return -EINVAL;
5273
5274	len = sizeof(struct sctp_assocparams);
5275
5276	if (copy_from_user(&assocparams, optval, len))
5277		return -EFAULT;
5278
5279	asoc = sctp_id2assoc(sk, assocparams.sasoc_assoc_id);
5280
5281	if (!asoc && assocparams.sasoc_assoc_id && sctp_style(sk, UDP))
5282		return -EINVAL;
5283
5284	/* Values correspoinding to the specific association */
5285	if (asoc) {
5286		assocparams.sasoc_asocmaxrxt = asoc->max_retrans;
5287		assocparams.sasoc_peer_rwnd = asoc->peer.rwnd;
5288		assocparams.sasoc_local_rwnd = asoc->a_rwnd;
5289		assocparams.sasoc_cookie_life = ktime_to_ms(asoc->cookie_life);
5290
5291		list_for_each(pos, &asoc->peer.transport_addr_list) {
5292			cnt++;
5293		}
5294
5295		assocparams.sasoc_number_peer_destinations = cnt;
5296	} else {
5297		/* Values corresponding to the endpoint */
5298		struct sctp_sock *sp = sctp_sk(sk);
5299
5300		assocparams.sasoc_asocmaxrxt = sp->assocparams.sasoc_asocmaxrxt;
5301		assocparams.sasoc_peer_rwnd = sp->assocparams.sasoc_peer_rwnd;
5302		assocparams.sasoc_local_rwnd = sp->assocparams.sasoc_local_rwnd;
5303		assocparams.sasoc_cookie_life =
5304					sp->assocparams.sasoc_cookie_life;
5305		assocparams.sasoc_number_peer_destinations =
5306					sp->assocparams.
5307					sasoc_number_peer_destinations;
5308	}
5309
5310	if (put_user(len, optlen))
5311		return -EFAULT;
5312
5313	if (copy_to_user(optval, &assocparams, len))
5314		return -EFAULT;
5315
5316	return 0;
5317}
5318
5319/*
5320 * 7.1.16 Set/clear IPv4 mapped addresses (SCTP_I_WANT_MAPPED_V4_ADDR)
5321 *
5322 * This socket option is a boolean flag which turns on or off mapped V4
5323 * addresses.  If this option is turned on and the socket is type
5324 * PF_INET6, then IPv4 addresses will be mapped to V6 representation.
5325 * If this option is turned off, then no mapping will be done of V4
5326 * addresses and a user will receive both PF_INET6 and PF_INET type
5327 * addresses on the socket.
5328 */
5329static int sctp_getsockopt_mappedv4(struct sock *sk, int len,
5330				    char __user *optval, int __user *optlen)
5331{
5332	int val;
5333	struct sctp_sock *sp = sctp_sk(sk);
5334
5335	if (len < sizeof(int))
5336		return -EINVAL;
5337
5338	len = sizeof(int);
5339	val = sp->v4mapped;
5340	if (put_user(len, optlen))
5341		return -EFAULT;
5342	if (copy_to_user(optval, &val, len))
5343		return -EFAULT;
5344
5345	return 0;
5346}
5347
5348/*
5349 * 7.1.29.  Set or Get the default context (SCTP_CONTEXT)
5350 * (chapter and verse is quoted at sctp_setsockopt_context())
5351 */
5352static int sctp_getsockopt_context(struct sock *sk, int len,
5353				   char __user *optval, int __user *optlen)
5354{
5355	struct sctp_assoc_value params;
5356	struct sctp_sock *sp;
5357	struct sctp_association *asoc;
5358
5359	if (len < sizeof(struct sctp_assoc_value))
5360		return -EINVAL;
5361
5362	len = sizeof(struct sctp_assoc_value);
5363
5364	if (copy_from_user(&params, optval, len))
5365		return -EFAULT;
5366
5367	sp = sctp_sk(sk);
5368
5369	if (params.assoc_id != 0) {
5370		asoc = sctp_id2assoc(sk, params.assoc_id);
5371		if (!asoc)
5372			return -EINVAL;
5373		params.assoc_value = asoc->default_rcv_context;
5374	} else {
5375		params.assoc_value = sp->default_rcv_context;
5376	}
5377
5378	if (put_user(len, optlen))
5379		return -EFAULT;
5380	if (copy_to_user(optval, &params, len))
5381		return -EFAULT;
5382
5383	return 0;
5384}
5385
5386/*
5387 * 8.1.16.  Get or Set the Maximum Fragmentation Size (SCTP_MAXSEG)
5388 * This option will get or set the maximum size to put in any outgoing
5389 * SCTP DATA chunk.  If a message is larger than this size it will be
5390 * fragmented by SCTP into the specified size.  Note that the underlying
5391 * SCTP implementation may fragment into smaller sized chunks when the
5392 * PMTU of the underlying association is smaller than the value set by
5393 * the user.  The default value for this option is '0' which indicates
5394 * the user is NOT limiting fragmentation and only the PMTU will effect
5395 * SCTP's choice of DATA chunk size.  Note also that values set larger
5396 * than the maximum size of an IP datagram will effectively let SCTP
5397 * control fragmentation (i.e. the same as setting this option to 0).
5398 *
5399 * The following structure is used to access and modify this parameter:
5400 *
5401 * struct sctp_assoc_value {
5402 *   sctp_assoc_t assoc_id;
5403 *   uint32_t assoc_value;
5404 * };
5405 *
5406 * assoc_id:  This parameter is ignored for one-to-one style sockets.
5407 *    For one-to-many style sockets this parameter indicates which
5408 *    association the user is performing an action upon.  Note that if
5409 *    this field's value is zero then the endpoints default value is
5410 *    changed (effecting future associations only).
5411 * assoc_value:  This parameter specifies the maximum size in bytes.
5412 */
5413static int sctp_getsockopt_maxseg(struct sock *sk, int len,
5414				  char __user *optval, int __user *optlen)
5415{
5416	struct sctp_assoc_value params;
5417	struct sctp_association *asoc;
5418
5419	if (len == sizeof(int)) {
5420		pr_warn_ratelimited(DEPRECATED
5421				    "%s (pid %d) "
5422				    "Use of int in maxseg socket option.\n"
5423				    "Use struct sctp_assoc_value instead\n",
5424				    current->comm, task_pid_nr(current));
5425		params.assoc_id = 0;
5426	} else if (len >= sizeof(struct sctp_assoc_value)) {
5427		len = sizeof(struct sctp_assoc_value);
5428		if (copy_from_user(&params, optval, sizeof(params)))
5429			return -EFAULT;
5430	} else
5431		return -EINVAL;
5432
5433	asoc = sctp_id2assoc(sk, params.assoc_id);
5434	if (!asoc && params.assoc_id && sctp_style(sk, UDP))
5435		return -EINVAL;
5436
5437	if (asoc)
5438		params.assoc_value = asoc->frag_point;
5439	else
5440		params.assoc_value = sctp_sk(sk)->user_frag;
5441
5442	if (put_user(len, optlen))
5443		return -EFAULT;
5444	if (len == sizeof(int)) {
5445		if (copy_to_user(optval, &params.assoc_value, len))
5446			return -EFAULT;
5447	} else {
5448		if (copy_to_user(optval, &params, len))
5449			return -EFAULT;
5450	}
5451
5452	return 0;
5453}
5454
5455/*
5456 * 7.1.24.  Get or set fragmented interleave (SCTP_FRAGMENT_INTERLEAVE)
5457 * (chapter and verse is quoted at sctp_setsockopt_fragment_interleave())
5458 */
5459static int sctp_getsockopt_fragment_interleave(struct sock *sk, int len,
5460					       char __user *optval, int __user *optlen)
5461{
5462	int val;
5463
5464	if (len < sizeof(int))
5465		return -EINVAL;
5466
5467	len = sizeof(int);
5468
5469	val = sctp_sk(sk)->frag_interleave;
5470	if (put_user(len, optlen))
5471		return -EFAULT;
5472	if (copy_to_user(optval, &val, len))
5473		return -EFAULT;
5474
5475	return 0;
5476}
5477
5478/*
5479 * 7.1.25.  Set or Get the sctp partial delivery point
5480 * (chapter and verse is quoted at sctp_setsockopt_partial_delivery_point())
5481 */
5482static int sctp_getsockopt_partial_delivery_point(struct sock *sk, int len,
5483						  char __user *optval,
5484						  int __user *optlen)
5485{
5486	u32 val;
5487
5488	if (len < sizeof(u32))
5489		return -EINVAL;
5490
5491	len = sizeof(u32);
5492
5493	val = sctp_sk(sk)->pd_point;
5494	if (put_user(len, optlen))
5495		return -EFAULT;
5496	if (copy_to_user(optval, &val, len))
5497		return -EFAULT;
5498
5499	return 0;
5500}
5501
5502/*
5503 * 7.1.28.  Set or Get the maximum burst (SCTP_MAX_BURST)
5504 * (chapter and verse is quoted at sctp_setsockopt_maxburst())
5505 */
5506static int sctp_getsockopt_maxburst(struct sock *sk, int len,
5507				    char __user *optval,
5508				    int __user *optlen)
5509{
5510	struct sctp_assoc_value params;
5511	struct sctp_sock *sp;
5512	struct sctp_association *asoc;
5513
5514	if (len == sizeof(int)) {
5515		pr_warn_ratelimited(DEPRECATED
5516				    "%s (pid %d) "
5517				    "Use of int in max_burst socket option.\n"
5518				    "Use struct sctp_assoc_value instead\n",
5519				    current->comm, task_pid_nr(current));
5520		params.assoc_id = 0;
5521	} else if (len >= sizeof(struct sctp_assoc_value)) {
5522		len = sizeof(struct sctp_assoc_value);
5523		if (copy_from_user(&params, optval, len))
5524			return -EFAULT;
5525	} else
5526		return -EINVAL;
5527
5528	sp = sctp_sk(sk);
5529
5530	if (params.assoc_id != 0) {
5531		asoc = sctp_id2assoc(sk, params.assoc_id);
5532		if (!asoc)
5533			return -EINVAL;
5534		params.assoc_value = asoc->max_burst;
5535	} else
5536		params.assoc_value = sp->max_burst;
5537
5538	if (len == sizeof(int)) {
5539		if (copy_to_user(optval, &params.assoc_value, len))
5540			return -EFAULT;
5541	} else {
5542		if (copy_to_user(optval, &params, len))
5543			return -EFAULT;
5544	}
5545
5546	return 0;
5547
5548}
5549
5550static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
5551				    char __user *optval, int __user *optlen)
5552{
5553	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5554	struct sctp_hmacalgo  __user *p = (void __user *)optval;
5555	struct sctp_hmac_algo_param *hmacs;
5556	__u16 data_len = 0;
5557	u32 num_idents;
5558	int i;
5559
5560	if (!ep->auth_enable)
5561		return -EACCES;
5562
5563	hmacs = ep->auth_hmacs_list;
5564	data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
5565
5566	if (len < sizeof(struct sctp_hmacalgo) + data_len)
5567		return -EINVAL;
5568
5569	len = sizeof(struct sctp_hmacalgo) + data_len;
5570	num_idents = data_len / sizeof(u16);
5571
5572	if (put_user(len, optlen))
5573		return -EFAULT;
5574	if (put_user(num_idents, &p->shmac_num_idents))
5575		return -EFAULT;
5576	for (i = 0; i < num_idents; i++) {
5577		__u16 hmacid = ntohs(hmacs->hmac_ids[i]);
5578
5579		if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
5580			return -EFAULT;
5581	}
5582	return 0;
5583}
5584
5585static int sctp_getsockopt_active_key(struct sock *sk, int len,
5586				    char __user *optval, int __user *optlen)
5587{
5588	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5589	struct sctp_authkeyid val;
5590	struct sctp_association *asoc;
5591
5592	if (!ep->auth_enable)
5593		return -EACCES;
5594
5595	if (len < sizeof(struct sctp_authkeyid))
5596		return -EINVAL;
5597	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
5598		return -EFAULT;
5599
5600	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
5601	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
5602		return -EINVAL;
5603
5604	if (asoc)
5605		val.scact_keynumber = asoc->active_key_id;
5606	else
5607		val.scact_keynumber = ep->active_key_id;
5608
5609	len = sizeof(struct sctp_authkeyid);
5610	if (put_user(len, optlen))
5611		return -EFAULT;
5612	if (copy_to_user(optval, &val, len))
5613		return -EFAULT;
5614
5615	return 0;
5616}
5617
5618static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5619				    char __user *optval, int __user *optlen)
5620{
5621	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5622	struct sctp_authchunks __user *p = (void __user *)optval;
5623	struct sctp_authchunks val;
5624	struct sctp_association *asoc;
5625	struct sctp_chunks_param *ch;
5626	u32    num_chunks = 0;
5627	char __user *to;
5628
5629	if (!ep->auth_enable)
5630		return -EACCES;
5631
5632	if (len < sizeof(struct sctp_authchunks))
5633		return -EINVAL;
5634
5635	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5636		return -EFAULT;
5637
5638	to = p->gauth_chunks;
5639	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
5640	if (!asoc)
5641		return -EINVAL;
5642
5643	ch = asoc->peer.peer_chunks;
5644	if (!ch)
5645		goto num;
5646
5647	/* See if the user provided enough room for all the data */
5648	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5649	if (len < num_chunks)
5650		return -EINVAL;
5651
5652	if (copy_to_user(to, ch->chunks, num_chunks))
5653		return -EFAULT;
5654num:
5655	len = sizeof(struct sctp_authchunks) + num_chunks;
5656	if (put_user(len, optlen))
5657		return -EFAULT;
5658	if (put_user(num_chunks, &p->gauth_number_of_chunks))
5659		return -EFAULT;
5660	return 0;
5661}
5662
5663static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5664				    char __user *optval, int __user *optlen)
5665{
5666	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
5667	struct sctp_authchunks __user *p = (void __user *)optval;
5668	struct sctp_authchunks val;
5669	struct sctp_association *asoc;
5670	struct sctp_chunks_param *ch;
5671	u32    num_chunks = 0;
5672	char __user *to;
5673
5674	if (!ep->auth_enable)
5675		return -EACCES;
5676
5677	if (len < sizeof(struct sctp_authchunks))
5678		return -EINVAL;
5679
5680	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5681		return -EFAULT;
5682
5683	to = p->gauth_chunks;
5684	asoc = sctp_id2assoc(sk, val.gauth_assoc_id);
5685	if (!asoc && val.gauth_assoc_id && sctp_style(sk, UDP))
5686		return -EINVAL;
5687
5688	if (asoc)
5689		ch = (struct sctp_chunks_param *)asoc->c.auth_chunks;
5690	else
5691		ch = ep->auth_chunk_list;
5692
5693	if (!ch)
5694		goto num;
5695
5696	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5697	if (len < sizeof(struct sctp_authchunks) + num_chunks)
5698		return -EINVAL;
5699
5700	if (copy_to_user(to, ch->chunks, num_chunks))
5701		return -EFAULT;
5702num:
5703	len = sizeof(struct sctp_authchunks) + num_chunks;
5704	if (put_user(len, optlen))
5705		return -EFAULT;
5706	if (put_user(num_chunks, &p->gauth_number_of_chunks))
5707		return -EFAULT;
5708
5709	return 0;
5710}
5711
5712/*
5713 * 8.2.5.  Get the Current Number of Associations (SCTP_GET_ASSOC_NUMBER)
5714 * This option gets the current number of associations that are attached
5715 * to a one-to-many style socket.  The option value is an uint32_t.
5716 */
5717static int sctp_getsockopt_assoc_number(struct sock *sk, int len,
5718				    char __user *optval, int __user *optlen)
5719{
5720	struct sctp_sock *sp = sctp_sk(sk);
5721	struct sctp_association *asoc;
5722	u32 val = 0;
5723
5724	if (sctp_style(sk, TCP))
5725		return -EOPNOTSUPP;
5726
5727	if (len < sizeof(u32))
5728		return -EINVAL;
5729
5730	len = sizeof(u32);
5731
5732	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5733		val++;
5734	}
5735
5736	if (put_user(len, optlen))
5737		return -EFAULT;
5738	if (copy_to_user(optval, &val, len))
5739		return -EFAULT;
5740
5741	return 0;
5742}
5743
5744/*
5745 * 8.1.23 SCTP_AUTO_ASCONF
5746 * See the corresponding setsockopt entry as description
5747 */
5748static int sctp_getsockopt_auto_asconf(struct sock *sk, int len,
5749				   char __user *optval, int __user *optlen)
5750{
5751	int val = 0;
5752
5753	if (len < sizeof(int))
5754		return -EINVAL;
5755
5756	len = sizeof(int);
5757	if (sctp_sk(sk)->do_auto_asconf && sctp_is_ep_boundall(sk))
5758		val = 1;
5759	if (put_user(len, optlen))
5760		return -EFAULT;
5761	if (copy_to_user(optval, &val, len))
5762		return -EFAULT;
5763	return 0;
5764}
5765
5766/*
5767 * 8.2.6. Get the Current Identifiers of Associations
5768 *        (SCTP_GET_ASSOC_ID_LIST)
5769 *
5770 * This option gets the current list of SCTP association identifiers of
5771 * the SCTP associations handled by a one-to-many style socket.
5772 */
5773static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
5774				    char __user *optval, int __user *optlen)
5775{
5776	struct sctp_sock *sp = sctp_sk(sk);
5777	struct sctp_association *asoc;
5778	struct sctp_assoc_ids *ids;
5779	u32 num = 0;
5780
5781	if (sctp_style(sk, TCP))
5782		return -EOPNOTSUPP;
5783
5784	if (len < sizeof(struct sctp_assoc_ids))
5785		return -EINVAL;
5786
5787	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5788		num++;
5789	}
5790
5791	if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
5792		return -EINVAL;
5793
5794	len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
5795
5796	ids = kmalloc(len, GFP_KERNEL);
5797	if (unlikely(!ids))
5798		return -ENOMEM;
5799
5800	ids->gaids_number_of_ids = num;
5801	num = 0;
5802	list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
5803		ids->gaids_assoc_id[num++] = asoc->assoc_id;
5804	}
5805
5806	if (put_user(len, optlen) || copy_to_user(optval, ids, len)) {
5807		kfree(ids);
5808		return -EFAULT;
5809	}
5810
5811	kfree(ids);
5812	return 0;
5813}
5814
5815/*
5816 * SCTP_PEER_ADDR_THLDS
5817 *
5818 * This option allows us to fetch the partially failed threshold for one or all
5819 * transports in an association.  See Section 6.1 of:
5820 * http://www.ietf.org/id/draft-nishida-tsvwg-sctp-failover-05.txt
5821 */
5822static int sctp_getsockopt_paddr_thresholds(struct sock *sk,
5823					    char __user *optval,
5824					    int len,
5825					    int __user *optlen)
5826{
5827	struct sctp_paddrthlds val;
5828	struct sctp_transport *trans;
5829	struct sctp_association *asoc;
5830
5831	if (len < sizeof(struct sctp_paddrthlds))
5832		return -EINVAL;
5833	len = sizeof(struct sctp_paddrthlds);
5834	if (copy_from_user(&val, (struct sctp_paddrthlds __user *)optval, len))
5835		return -EFAULT;
5836
5837	if (sctp_is_any(sk, (const union sctp_addr *)&val.spt_address)) {
5838		asoc = sctp_id2assoc(sk, val.spt_assoc_id);
5839		if (!asoc)
5840			return -ENOENT;
5841
5842		val.spt_pathpfthld = asoc->pf_retrans;
5843		val.spt_pathmaxrxt = asoc->pathmaxrxt;
5844	} else {
5845		trans = sctp_addr_id2transport(sk, &val.spt_address,
5846					       val.spt_assoc_id);
5847		if (!trans)
5848			return -ENOENT;
5849
5850		val.spt_pathmaxrxt = trans->pathmaxrxt;
5851		val.spt_pathpfthld = trans->pf_retrans;
5852	}
5853
5854	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
5855		return -EFAULT;
5856
5857	return 0;
5858}
5859
5860/*
5861 * SCTP_GET_ASSOC_STATS
5862 *
5863 * This option retrieves local per endpoint statistics. It is modeled
5864 * after OpenSolaris' implementation
5865 */
5866static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
5867				       char __user *optval,
5868				       int __user *optlen)
5869{
5870	struct sctp_assoc_stats sas;
5871	struct sctp_association *asoc = NULL;
5872
5873	/* User must provide at least the assoc id */
5874	if (len < sizeof(sctp_assoc_t))
5875		return -EINVAL;
5876
5877	/* Allow the struct to grow and fill in as much as possible */
5878	len = min_t(size_t, len, sizeof(sas));
5879
5880	if (copy_from_user(&sas, optval, len))
5881		return -EFAULT;
5882
5883	asoc = sctp_id2assoc(sk, sas.sas_assoc_id);
5884	if (!asoc)
5885		return -EINVAL;
5886
5887	sas.sas_rtxchunks = asoc->stats.rtxchunks;
5888	sas.sas_gapcnt = asoc->stats.gapcnt;
5889	sas.sas_outofseqtsns = asoc->stats.outofseqtsns;
5890	sas.sas_osacks = asoc->stats.osacks;
5891	sas.sas_isacks = asoc->stats.isacks;
5892	sas.sas_octrlchunks = asoc->stats.octrlchunks;
5893	sas.sas_ictrlchunks = asoc->stats.ictrlchunks;
5894	sas.sas_oodchunks = asoc->stats.oodchunks;
5895	sas.sas_iodchunks = asoc->stats.iodchunks;
5896	sas.sas_ouodchunks = asoc->stats.ouodchunks;
5897	sas.sas_iuodchunks = asoc->stats.iuodchunks;
5898	sas.sas_idupchunks = asoc->stats.idupchunks;
5899	sas.sas_opackets = asoc->stats.opackets;
5900	sas.sas_ipackets = asoc->stats.ipackets;
5901
5902	/* New high max rto observed, will return 0 if not a single
5903	 * RTO update took place. obs_rto_ipaddr will be bogus
5904	 * in such a case
5905	 */
5906	sas.sas_maxrto = asoc->stats.max_obs_rto;
5907	memcpy(&sas.sas_obs_rto_ipaddr, &asoc->stats.obs_rto_ipaddr,
5908		sizeof(struct sockaddr_storage));
5909
5910	/* Mark beginning of a new observation period */
5911	asoc->stats.max_obs_rto = asoc->rto_min;
5912
5913	if (put_user(len, optlen))
5914		return -EFAULT;
5915
5916	pr_debug("%s: len:%d, assoc_id:%d\n", __func__, len, sas.sas_assoc_id);
5917
5918	if (copy_to_user(optval, &sas, len))
5919		return -EFAULT;
5920
5921	return 0;
5922}
5923
5924static int sctp_getsockopt_recvrcvinfo(struct sock *sk,	int len,
5925				       char __user *optval,
5926				       int __user *optlen)
5927{
5928	int val = 0;
5929
5930	if (len < sizeof(int))
5931		return -EINVAL;
5932
5933	len = sizeof(int);
5934	if (sctp_sk(sk)->recvrcvinfo)
5935		val = 1;
5936	if (put_user(len, optlen))
5937		return -EFAULT;
5938	if (copy_to_user(optval, &val, len))
5939		return -EFAULT;
5940
5941	return 0;
5942}
5943
5944static int sctp_getsockopt_recvnxtinfo(struct sock *sk,	int len,
5945				       char __user *optval,
5946				       int __user *optlen)
5947{
5948	int val = 0;
5949
5950	if (len < sizeof(int))
5951		return -EINVAL;
5952
5953	len = sizeof(int);
5954	if (sctp_sk(sk)->recvnxtinfo)
5955		val = 1;
5956	if (put_user(len, optlen))
5957		return -EFAULT;
5958	if (copy_to_user(optval, &val, len))
5959		return -EFAULT;
5960
5961	return 0;
5962}
5963
5964static int sctp_getsockopt(struct sock *sk, int level, int optname,
5965			   char __user *optval, int __user *optlen)
5966{
5967	int retval = 0;
5968	int len;
5969
5970	pr_debug("%s: sk:%p, optname:%d\n", __func__, sk, optname);
5971
5972	/* I can hardly begin to describe how wrong this is.  This is
5973	 * so broken as to be worse than useless.  The API draft
5974	 * REALLY is NOT helpful here...  I am not convinced that the
5975	 * semantics of getsockopt() with a level OTHER THAN SOL_SCTP
5976	 * are at all well-founded.
5977	 */
5978	if (level != SOL_SCTP) {
5979		struct sctp_af *af = sctp_sk(sk)->pf->af;
5980
5981		retval = af->getsockopt(sk, level, optname, optval, optlen);
5982		return retval;
5983	}
5984
5985	if (get_user(len, optlen))
5986		return -EFAULT;
5987
5988	lock_sock(sk);
5989
5990	switch (optname) {
5991	case SCTP_STATUS:
5992		retval = sctp_getsockopt_sctp_status(sk, len, optval, optlen);
5993		break;
5994	case SCTP_DISABLE_FRAGMENTS:
5995		retval = sctp_getsockopt_disable_fragments(sk, len, optval,
5996							   optlen);
5997		break;
5998	case SCTP_EVENTS:
5999		retval = sctp_getsockopt_events(sk, len, optval, optlen);
6000		break;
6001	case SCTP_AUTOCLOSE:
6002		retval = sctp_getsockopt_autoclose(sk, len, optval, optlen);
6003		break;
6004	case SCTP_SOCKOPT_PEELOFF:
6005		retval = sctp_getsockopt_peeloff(sk, len, optval, optlen);
6006		break;
6007	case SCTP_PEER_ADDR_PARAMS:
6008		retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
6009							  optlen);
6010		break;
6011	case SCTP_DELAYED_SACK:
6012		retval = sctp_getsockopt_delayed_ack(sk, len, optval,
6013							  optlen);
6014		break;
6015	case SCTP_INITMSG:
6016		retval = sctp_getsockopt_initmsg(sk, len, optval, optlen);
6017		break;
6018	case SCTP_GET_PEER_ADDRS:
6019		retval = sctp_getsockopt_peer_addrs(sk, len, optval,
6020						    optlen);
6021		break;
6022	case SCTP_GET_LOCAL_ADDRS:
6023		retval = sctp_getsockopt_local_addrs(sk, len, optval,
6024						     optlen);
6025		break;
6026	case SCTP_SOCKOPT_CONNECTX3:
6027		retval = sctp_getsockopt_connectx3(sk, len, optval, optlen);
6028		break;
6029	case SCTP_DEFAULT_SEND_PARAM:
6030		retval = sctp_getsockopt_default_send_param(sk, len,
6031							    optval, optlen);
6032		break;
6033	case SCTP_DEFAULT_SNDINFO:
6034		retval = sctp_getsockopt_default_sndinfo(sk, len,
6035							 optval, optlen);
6036		break;
6037	case SCTP_PRIMARY_ADDR:
6038		retval = sctp_getsockopt_primary_addr(sk, len, optval, optlen);
6039		break;
6040	case SCTP_NODELAY:
6041		retval = sctp_getsockopt_nodelay(sk, len, optval, optlen);
6042		break;
6043	case SCTP_RTOINFO:
6044		retval = sctp_getsockopt_rtoinfo(sk, len, optval, optlen);
6045		break;
6046	case SCTP_ASSOCINFO:
6047		retval = sctp_getsockopt_associnfo(sk, len, optval, optlen);
6048		break;
6049	case SCTP_I_WANT_MAPPED_V4_ADDR:
6050		retval = sctp_getsockopt_mappedv4(sk, len, optval, optlen);
6051		break;
6052	case SCTP_MAXSEG:
6053		retval = sctp_getsockopt_maxseg(sk, len, optval, optlen);
6054		break;
6055	case SCTP_GET_PEER_ADDR_INFO:
6056		retval = sctp_getsockopt_peer_addr_info(sk, len, optval,
6057							optlen);
6058		break;
6059	case SCTP_ADAPTATION_LAYER:
6060		retval = sctp_getsockopt_adaptation_layer(sk, len, optval,
6061							optlen);
6062		break;
6063	case SCTP_CONTEXT:
6064		retval = sctp_getsockopt_context(sk, len, optval, optlen);
6065		break;
6066	case SCTP_FRAGMENT_INTERLEAVE:
6067		retval = sctp_getsockopt_fragment_interleave(sk, len, optval,
6068							     optlen);
6069		break;
6070	case SCTP_PARTIAL_DELIVERY_POINT:
6071		retval = sctp_getsockopt_partial_delivery_point(sk, len, optval,
6072								optlen);
6073		break;
6074	case SCTP_MAX_BURST:
6075		retval = sctp_getsockopt_maxburst(sk, len, optval, optlen);
6076		break;
6077	case SCTP_AUTH_KEY:
6078	case SCTP_AUTH_CHUNK:
6079	case SCTP_AUTH_DELETE_KEY:
6080		retval = -EOPNOTSUPP;
6081		break;
6082	case SCTP_HMAC_IDENT:
6083		retval = sctp_getsockopt_hmac_ident(sk, len, optval, optlen);
6084		break;
6085	case SCTP_AUTH_ACTIVE_KEY:
6086		retval = sctp_getsockopt_active_key(sk, len, optval, optlen);
6087		break;
6088	case SCTP_PEER_AUTH_CHUNKS:
6089		retval = sctp_getsockopt_peer_auth_chunks(sk, len, optval,
6090							optlen);
6091		break;
6092	case SCTP_LOCAL_AUTH_CHUNKS:
6093		retval = sctp_getsockopt_local_auth_chunks(sk, len, optval,
6094							optlen);
6095		break;
6096	case SCTP_GET_ASSOC_NUMBER:
6097		retval = sctp_getsockopt_assoc_number(sk, len, optval, optlen);
6098		break;
6099	case SCTP_GET_ASSOC_ID_LIST:
6100		retval = sctp_getsockopt_assoc_ids(sk, len, optval, optlen);
6101		break;
6102	case SCTP_AUTO_ASCONF:
6103		retval = sctp_getsockopt_auto_asconf(sk, len, optval, optlen);
6104		break;
6105	case SCTP_PEER_ADDR_THLDS:
6106		retval = sctp_getsockopt_paddr_thresholds(sk, optval, len, optlen);
6107		break;
6108	case SCTP_GET_ASSOC_STATS:
6109		retval = sctp_getsockopt_assoc_stats(sk, len, optval, optlen);
6110		break;
6111	case SCTP_RECVRCVINFO:
6112		retval = sctp_getsockopt_recvrcvinfo(sk, len, optval, optlen);
6113		break;
6114	case SCTP_RECVNXTINFO:
6115		retval = sctp_getsockopt_recvnxtinfo(sk, len, optval, optlen);
6116		break;
6117	default:
6118		retval = -ENOPROTOOPT;
6119		break;
6120	}
6121
6122	release_sock(sk);
6123	return retval;
6124}
6125
6126static void sctp_hash(struct sock *sk)
6127{
6128	/* STUB */
6129}
6130
6131static void sctp_unhash(struct sock *sk)
6132{
6133	/* STUB */
6134}
6135
6136/* Check if port is acceptable.  Possibly find first available port.
6137 *
6138 * The port hash table (contained in the 'global' SCTP protocol storage
6139 * returned by struct sctp_protocol *sctp_get_protocol()). The hash
6140 * table is an array of 4096 lists (sctp_bind_hashbucket). Each
6141 * list (the list number is the port number hashed out, so as you
6142 * would expect from a hash function, all the ports in a given list have
6143 * such a number that hashes out to the same list number; you were
6144 * expecting that, right?); so each list has a set of ports, with a
6145 * link to the socket (struct sock) that uses it, the port number and
6146 * a fastreuse flag (FIXME: NPI ipg).
6147 */
6148static struct sctp_bind_bucket *sctp_bucket_create(
6149	struct sctp_bind_hashbucket *head, struct net *, unsigned short snum);
6150
6151static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
6152{
6153	struct sctp_bind_hashbucket *head; /* hash list */
6154	struct sctp_bind_bucket *pp;
6155	unsigned short snum;
6156	int ret;
6157
6158	snum = ntohs(addr->v4.sin_port);
6159
6160	pr_debug("%s: begins, snum:%d\n", __func__, snum);
6161
6162	local_bh_disable();
6163
6164	if (snum == 0) {
6165		/* Search for an available port. */
6166		int low, high, remaining, index;
6167		unsigned int rover;
6168		struct net *net = sock_net(sk);
6169
6170		inet_get_local_port_range(net, &low, &high);
6171		remaining = (high - low) + 1;
6172		rover = prandom_u32() % remaining + low;
6173
6174		do {
6175			rover++;
6176			if ((rover < low) || (rover > high))
6177				rover = low;
6178			if (inet_is_local_reserved_port(net, rover))
6179				continue;
6180			index = sctp_phashfn(sock_net(sk), rover);
6181			head = &sctp_port_hashtable[index];
6182			spin_lock(&head->lock);
6183			sctp_for_each_hentry(pp, &head->chain)
6184				if ((pp->port == rover) &&
6185				    net_eq(sock_net(sk), pp->net))
6186					goto next;
6187			break;
6188		next:
6189			spin_unlock(&head->lock);
6190		} while (--remaining > 0);
6191
6192		/* Exhausted local port range during search? */
6193		ret = 1;
6194		if (remaining <= 0)
6195			goto fail;
6196
6197		/* OK, here is the one we will use.  HEAD (the port
6198		 * hash table list entry) is non-NULL and we hold it's
6199		 * mutex.
6200		 */
6201		snum = rover;
6202	} else {
6203		/* We are given an specific port number; we verify
6204		 * that it is not being used. If it is used, we will
6205		 * exahust the search in the hash list corresponding
6206		 * to the port number (snum) - we detect that with the
6207		 * port iterator, pp being NULL.
6208		 */
6209		head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
6210		spin_lock(&head->lock);
6211		sctp_for_each_hentry(pp, &head->chain) {
6212			if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
6213				goto pp_found;
6214		}
6215	}
6216	pp = NULL;
6217	goto pp_not_found;
6218pp_found:
6219	if (!hlist_empty(&pp->owner)) {
6220		/* We had a port hash table hit - there is an
6221		 * available port (pp != NULL) and it is being
6222		 * used by other socket (pp->owner not empty); that other
6223		 * socket is going to be sk2.
6224		 */
6225		int reuse = sk->sk_reuse;
6226		struct sock *sk2;
6227
6228		pr_debug("%s: found a possible match\n", __func__);
6229
6230		if (pp->fastreuse && sk->sk_reuse &&
6231			sk->sk_state != SCTP_SS_LISTENING)
6232			goto success;
6233
6234		/* Run through the list of sockets bound to the port
6235		 * (pp->port) [via the pointers bind_next and
6236		 * bind_pprev in the struct sock *sk2 (pp->sk)]. On each one,
6237		 * we get the endpoint they describe and run through
6238		 * the endpoint's list of IP (v4 or v6) addresses,
6239		 * comparing each of the addresses with the address of
6240		 * the socket sk. If we find a match, then that means
6241		 * that this port/socket (sk) combination are already
6242		 * in an endpoint.
6243		 */
6244		sk_for_each_bound(sk2, &pp->owner) {
6245			struct sctp_endpoint *ep2;
6246			ep2 = sctp_sk(sk2)->ep;
6247
6248			if (sk == sk2 ||
6249			    (reuse && sk2->sk_reuse &&
6250			     sk2->sk_state != SCTP_SS_LISTENING))
6251				continue;
6252
6253			if (sctp_bind_addr_conflict(&ep2->base.bind_addr, addr,
6254						 sctp_sk(sk2), sctp_sk(sk))) {
6255				ret = (long)sk2;
6256				goto fail_unlock;
6257			}
6258		}
6259
6260		pr_debug("%s: found a match\n", __func__);
6261	}
6262pp_not_found:
6263	/* If there was a hash table miss, create a new port.  */
6264	ret = 1;
6265	if (!pp && !(pp = sctp_bucket_create(head, sock_net(sk), snum)))
6266		goto fail_unlock;
6267
6268	/* In either case (hit or miss), make sure fastreuse is 1 only
6269	 * if sk->sk_reuse is too (that is, if the caller requested
6270	 * SO_REUSEADDR on this socket -sk-).
6271	 */
6272	if (hlist_empty(&pp->owner)) {
6273		if (sk->sk_reuse && sk->sk_state != SCTP_SS_LISTENING)
6274			pp->fastreuse = 1;
6275		else
6276			pp->fastreuse = 0;
6277	} else if (pp->fastreuse &&
6278		(!sk->sk_reuse || sk->sk_state == SCTP_SS_LISTENING))
6279		pp->fastreuse = 0;
6280
6281	/* We are set, so fill up all the data in the hash table
6282	 * entry, tie the socket list information with the rest of the
6283	 * sockets FIXME: Blurry, NPI (ipg).
6284	 */
6285success:
6286	if (!sctp_sk(sk)->bind_hash) {
6287		inet_sk(sk)->inet_num = snum;
6288		sk_add_bind_node(sk, &pp->owner);
6289		sctp_sk(sk)->bind_hash = pp;
6290	}
6291	ret = 0;
6292
6293fail_unlock:
6294	spin_unlock(&head->lock);
6295
6296fail:
6297	local_bh_enable();
6298	return ret;
6299}
6300
6301/* Assign a 'snum' port to the socket.  If snum == 0, an ephemeral
6302 * port is requested.
6303 */
6304static int sctp_get_port(struct sock *sk, unsigned short snum)
6305{
6306	union sctp_addr addr;
6307	struct sctp_af *af = sctp_sk(sk)->pf->af;
6308
6309	/* Set up a dummy address struct from the sk. */
6310	af->from_sk(&addr, sk);
6311	addr.v4.sin_port = htons(snum);
6312
6313	/* Note: sk->sk_num gets filled in if ephemeral port request. */
6314	return !!sctp_get_port_local(sk, &addr);
6315}
6316
6317/*
6318 *  Move a socket to LISTENING state.
6319 */
6320static int sctp_listen_start(struct sock *sk, int backlog)
6321{
6322	struct sctp_sock *sp = sctp_sk(sk);
6323	struct sctp_endpoint *ep = sp->ep;
6324	struct crypto_hash *tfm = NULL;
6325	char alg[32];
6326
6327	/* Allocate HMAC for generating cookie. */
6328	if (!sp->hmac && sp->sctp_hmac_alg) {
6329		sprintf(alg, "hmac(%s)", sp->sctp_hmac_alg);
6330		tfm = crypto_alloc_hash(alg, 0, CRYPTO_ALG_ASYNC);
6331		if (IS_ERR(tfm)) {
6332			net_info_ratelimited("failed to load transform for %s: %ld\n",
6333					     sp->sctp_hmac_alg, PTR_ERR(tfm));
6334			return -ENOSYS;
6335		}
6336		sctp_sk(sk)->hmac = tfm;
6337	}
6338
6339	/*
6340	 * If a bind() or sctp_bindx() is not called prior to a listen()
6341	 * call that allows new associations to be accepted, the system
6342	 * picks an ephemeral port and will choose an address set equivalent
6343	 * to binding with a wildcard address.
6344	 *
6345	 * This is not currently spelled out in the SCTP sockets
6346	 * extensions draft, but follows the practice as seen in TCP
6347	 * sockets.
6348	 *
6349	 */
6350	sk->sk_state = SCTP_SS_LISTENING;
6351	if (!ep->base.bind_addr.port) {
6352		if (sctp_autobind(sk))
6353			return -EAGAIN;
6354	} else {
6355		if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
6356			sk->sk_state = SCTP_SS_CLOSED;
6357			return -EADDRINUSE;
6358		}
6359	}
6360
6361	sk->sk_max_ack_backlog = backlog;
6362	sctp_hash_endpoint(ep);
6363	return 0;
6364}
6365
6366/*
6367 * 4.1.3 / 5.1.3 listen()
6368 *
6369 *   By default, new associations are not accepted for UDP style sockets.
6370 *   An application uses listen() to mark a socket as being able to
6371 *   accept new associations.
6372 *
6373 *   On TCP style sockets, applications use listen() to ready the SCTP
6374 *   endpoint for accepting inbound associations.
6375 *
6376 *   On both types of endpoints a backlog of '0' disables listening.
6377 *
6378 *  Move a socket to LISTENING state.
6379 */
6380int sctp_inet_listen(struct socket *sock, int backlog)
6381{
6382	struct sock *sk = sock->sk;
6383	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
6384	int err = -EINVAL;
6385
6386	if (unlikely(backlog < 0))
6387		return err;
6388
6389	lock_sock(sk);
6390
6391	/* Peeled-off sockets are not allowed to listen().  */
6392	if (sctp_style(sk, UDP_HIGH_BANDWIDTH))
6393		goto out;
6394
6395	if (sock->state != SS_UNCONNECTED)
6396		goto out;
6397
6398	/* If backlog is zero, disable listening. */
6399	if (!backlog) {
6400		if (sctp_sstate(sk, CLOSED))
6401			goto out;
6402
6403		err = 0;
6404		sctp_unhash_endpoint(ep);
6405		sk->sk_state = SCTP_SS_CLOSED;
6406		if (sk->sk_reuse)
6407			sctp_sk(sk)->bind_hash->fastreuse = 1;
6408		goto out;
6409	}
6410
6411	/* If we are already listening, just update the backlog */
6412	if (sctp_sstate(sk, LISTENING))
6413		sk->sk_max_ack_backlog = backlog;
6414	else {
6415		err = sctp_listen_start(sk, backlog);
6416		if (err)
6417			goto out;
6418	}
6419
6420	err = 0;
6421out:
6422	release_sock(sk);
6423	return err;
6424}
6425
6426/*
6427 * This function is done by modeling the current datagram_poll() and the
6428 * tcp_poll().  Note that, based on these implementations, we don't
6429 * lock the socket in this function, even though it seems that,
6430 * ideally, locking or some other mechanisms can be used to ensure
6431 * the integrity of the counters (sndbuf and wmem_alloc) used
6432 * in this place.  We assume that we don't need locks either until proven
6433 * otherwise.
6434 *
6435 * Another thing to note is that we include the Async I/O support
6436 * here, again, by modeling the current TCP/UDP code.  We don't have
6437 * a good way to test with it yet.
6438 */
6439unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
6440{
6441	struct sock *sk = sock->sk;
6442	struct sctp_sock *sp = sctp_sk(sk);
6443	unsigned int mask;
6444
6445	poll_wait(file, sk_sleep(sk), wait);
6446
6447	/* A TCP-style listening socket becomes readable when the accept queue
6448	 * is not empty.
6449	 */
6450	if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
6451		return (!list_empty(&sp->ep->asocs)) ?
6452			(POLLIN | POLLRDNORM) : 0;
6453
6454	mask = 0;
6455
6456	/* Is there any exceptional events?  */
6457	if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
6458		mask |= POLLERR |
6459			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
6460	if (sk->sk_shutdown & RCV_SHUTDOWN)
6461		mask |= POLLRDHUP | POLLIN | POLLRDNORM;
6462	if (sk->sk_shutdown == SHUTDOWN_MASK)
6463		mask |= POLLHUP;
6464
6465	/* Is it readable?  Reconsider this code with TCP-style support.  */
6466	if (!skb_queue_empty(&sk->sk_receive_queue))
6467		mask |= POLLIN | POLLRDNORM;
6468
6469	/* The association is either gone or not ready.  */
6470	if (!sctp_style(sk, UDP) && sctp_sstate(sk, CLOSED))
6471		return mask;
6472
6473	/* Is it writable?  */
6474	if (sctp_writeable(sk)) {
6475		mask |= POLLOUT | POLLWRNORM;
6476	} else {
6477		set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
6478		/*
6479		 * Since the socket is not locked, the buffer
6480		 * might be made available after the writeable check and
6481		 * before the bit is set.  This could cause a lost I/O
6482		 * signal.  tcp_poll() has a race breaker for this race
6483		 * condition.  Based on their implementation, we put
6484		 * in the following code to cover it as well.
6485		 */
6486		if (sctp_writeable(sk))
6487			mask |= POLLOUT | POLLWRNORM;
6488	}
6489	return mask;
6490}
6491
6492/********************************************************************
6493 * 2nd Level Abstractions
6494 ********************************************************************/
6495
6496static struct sctp_bind_bucket *sctp_bucket_create(
6497	struct sctp_bind_hashbucket *head, struct net *net, unsigned short snum)
6498{
6499	struct sctp_bind_bucket *pp;
6500
6501	pp = kmem_cache_alloc(sctp_bucket_cachep, GFP_ATOMIC);
6502	if (pp) {
6503		SCTP_DBG_OBJCNT_INC(bind_bucket);
6504		pp->port = snum;
6505		pp->fastreuse = 0;
6506		INIT_HLIST_HEAD(&pp->owner);
6507		pp->net = net;
6508		hlist_add_head(&pp->node, &head->chain);
6509	}
6510	return pp;
6511}
6512
6513/* Caller must hold hashbucket lock for this tb with local BH disabled */
6514static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
6515{
6516	if (pp && hlist_empty(&pp->owner)) {
6517		__hlist_del(&pp->node);
6518		kmem_cache_free(sctp_bucket_cachep, pp);
6519		SCTP_DBG_OBJCNT_DEC(bind_bucket);
6520	}
6521}
6522
6523/* Release this socket's reference to a local port.  */
6524static inline void __sctp_put_port(struct sock *sk)
6525{
6526	struct sctp_bind_hashbucket *head =
6527		&sctp_port_hashtable[sctp_phashfn(sock_net(sk),
6528						  inet_sk(sk)->inet_num)];
6529	struct sctp_bind_bucket *pp;
6530
6531	spin_lock(&head->lock);
6532	pp = sctp_sk(sk)->bind_hash;
6533	__sk_del_bind_node(sk);
6534	sctp_sk(sk)->bind_hash = NULL;
6535	inet_sk(sk)->inet_num = 0;
6536	sctp_bucket_destroy(pp);
6537	spin_unlock(&head->lock);
6538}
6539
6540void sctp_put_port(struct sock *sk)
6541{
6542	local_bh_disable();
6543	__sctp_put_port(sk);
6544	local_bh_enable();
6545}
6546
6547/*
6548 * The system picks an ephemeral port and choose an address set equivalent
6549 * to binding with a wildcard address.
6550 * One of those addresses will be the primary address for the association.
6551 * This automatically enables the multihoming capability of SCTP.
6552 */
6553static int sctp_autobind(struct sock *sk)
6554{
6555	union sctp_addr autoaddr;
6556	struct sctp_af *af;
6557	__be16 port;
6558
6559	/* Initialize a local sockaddr structure to INADDR_ANY. */
6560	af = sctp_sk(sk)->pf->af;
6561
6562	port = htons(inet_sk(sk)->inet_num);
6563	af->inaddr_any(&autoaddr, port);
6564
6565	return sctp_do_bind(sk, &autoaddr, af->sockaddr_len);
6566}
6567
6568/* Parse out IPPROTO_SCTP CMSG headers.  Perform only minimal validation.
6569 *
6570 * From RFC 2292
6571 * 4.2 The cmsghdr Structure *
6572 *
6573 * When ancillary data is sent or received, any number of ancillary data
6574 * objects can be specified by the msg_control and msg_controllen members of
6575 * the msghdr structure, because each object is preceded by
6576 * a cmsghdr structure defining the object's length (the cmsg_len member).
6577 * Historically Berkeley-derived implementations have passed only one object
6578 * at a time, but this API allows multiple objects to be
6579 * passed in a single call to sendmsg() or recvmsg(). The following example
6580 * shows two ancillary data objects in a control buffer.
6581 *
6582 *   |<--------------------------- msg_controllen -------------------------->|
6583 *   |                                                                       |
6584 *
6585 *   |<----- ancillary data object ----->|<----- ancillary data object ----->|
6586 *
6587 *   |<---------- CMSG_SPACE() --------->|<---------- CMSG_SPACE() --------->|
6588 *   |                                   |                                   |
6589 *
6590 *   |<---------- cmsg_len ---------->|  |<--------- cmsg_len ----------->|  |
6591 *
6592 *   |<--------- CMSG_LEN() --------->|  |<-------- CMSG_LEN() ---------->|  |
6593 *   |                                |  |                                |  |
6594 *
6595 *   +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
6596 *   |cmsg_|cmsg_|cmsg_|XX|           |XX|cmsg_|cmsg_|cmsg_|XX|           |XX|
6597 *
6598 *   |len  |level|type |XX|cmsg_data[]|XX|len  |level|type |XX|cmsg_data[]|XX|
6599 *
6600 *   +-----+-----+-----+--+-----------+--+-----+-----+-----+--+-----------+--+
6601 *    ^
6602 *    |
6603 *
6604 * msg_control
6605 * points here
6606 */
6607static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
6608{
6609	struct cmsghdr *cmsg;
6610	struct msghdr *my_msg = (struct msghdr *)msg;
6611
6612	for_each_cmsghdr(cmsg, my_msg) {
6613		if (!CMSG_OK(my_msg, cmsg))
6614			return -EINVAL;
6615
6616		/* Should we parse this header or ignore?  */
6617		if (cmsg->cmsg_level != IPPROTO_SCTP)
6618			continue;
6619
6620		/* Strictly check lengths following example in SCM code.  */
6621		switch (cmsg->cmsg_type) {
6622		case SCTP_INIT:
6623			/* SCTP Socket API Extension
6624			 * 5.3.1 SCTP Initiation Structure (SCTP_INIT)
6625			 *
6626			 * This cmsghdr structure provides information for
6627			 * initializing new SCTP associations with sendmsg().
6628			 * The SCTP_INITMSG socket option uses this same data
6629			 * structure.  This structure is not used for
6630			 * recvmsg().
6631			 *
6632			 * cmsg_level    cmsg_type      cmsg_data[]
6633			 * ------------  ------------   ----------------------
6634			 * IPPROTO_SCTP  SCTP_INIT      struct sctp_initmsg
6635			 */
6636			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_initmsg)))
6637				return -EINVAL;
6638
6639			cmsgs->init = CMSG_DATA(cmsg);
6640			break;
6641
6642		case SCTP_SNDRCV:
6643			/* SCTP Socket API Extension
6644			 * 5.3.2 SCTP Header Information Structure(SCTP_SNDRCV)
6645			 *
6646			 * This cmsghdr structure specifies SCTP options for
6647			 * sendmsg() and describes SCTP header information
6648			 * about a received message through recvmsg().
6649			 *
6650			 * cmsg_level    cmsg_type      cmsg_data[]
6651			 * ------------  ------------   ----------------------
6652			 * IPPROTO_SCTP  SCTP_SNDRCV    struct sctp_sndrcvinfo
6653			 */
6654			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndrcvinfo)))
6655				return -EINVAL;
6656
6657			cmsgs->srinfo = CMSG_DATA(cmsg);
6658
6659			if (cmsgs->srinfo->sinfo_flags &
6660			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
6661			      SCTP_SACK_IMMEDIATELY |
6662			      SCTP_ABORT | SCTP_EOF))
6663				return -EINVAL;
6664			break;
6665
6666		case SCTP_SNDINFO:
6667			/* SCTP Socket API Extension
6668			 * 5.3.4 SCTP Send Information Structure (SCTP_SNDINFO)
6669			 *
6670			 * This cmsghdr structure specifies SCTP options for
6671			 * sendmsg(). This structure and SCTP_RCVINFO replaces
6672			 * SCTP_SNDRCV which has been deprecated.
6673			 *
6674			 * cmsg_level    cmsg_type      cmsg_data[]
6675			 * ------------  ------------   ---------------------
6676			 * IPPROTO_SCTP  SCTP_SNDINFO    struct sctp_sndinfo
6677			 */
6678			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct sctp_sndinfo)))
6679				return -EINVAL;
6680
6681			cmsgs->sinfo = CMSG_DATA(cmsg);
6682
6683			if (cmsgs->sinfo->snd_flags &
6684			    ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
6685			      SCTP_SACK_IMMEDIATELY |
6686			      SCTP_ABORT | SCTP_EOF))
6687				return -EINVAL;
6688			break;
6689		default:
6690			return -EINVAL;
6691		}
6692	}
6693
6694	return 0;
6695}
6696
6697/*
6698 * Wait for a packet..
6699 * Note: This function is the same function as in core/datagram.c
6700 * with a few modifications to make lksctp work.
6701 */
6702static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p)
6703{
6704	int error;
6705	DEFINE_WAIT(wait);
6706
6707	prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
6708
6709	/* Socket errors? */
6710	error = sock_error(sk);
6711	if (error)
6712		goto out;
6713
6714	if (!skb_queue_empty(&sk->sk_receive_queue))
6715		goto ready;
6716
6717	/* Socket shut down?  */
6718	if (sk->sk_shutdown & RCV_SHUTDOWN)
6719		goto out;
6720
6721	/* Sequenced packets can come disconnected.  If so we report the
6722	 * problem.
6723	 */
6724	error = -ENOTCONN;
6725
6726	/* Is there a good reason to think that we may receive some data?  */
6727	if (list_empty(&sctp_sk(sk)->ep->asocs) && !sctp_sstate(sk, LISTENING))
6728		goto out;
6729
6730	/* Handle signals.  */
6731	if (signal_pending(current))
6732		goto interrupted;
6733
6734	/* Let another process have a go.  Since we are going to sleep
6735	 * anyway.  Note: This may cause odd behaviors if the message
6736	 * does not fit in the user's buffer, but this seems to be the
6737	 * only way to honor MSG_DONTWAIT realistically.
6738	 */
6739	release_sock(sk);
6740	*timeo_p = schedule_timeout(*timeo_p);
6741	lock_sock(sk);
6742
6743ready:
6744	finish_wait(sk_sleep(sk), &wait);
6745	return 0;
6746
6747interrupted:
6748	error = sock_intr_errno(*timeo_p);
6749
6750out:
6751	finish_wait(sk_sleep(sk), &wait);
6752	*err = error;
6753	return error;
6754}
6755
6756/* Receive a datagram.
6757 * Note: This is pretty much the same routine as in core/datagram.c
6758 * with a few changes to make lksctp work.
6759 */
6760struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
6761				       int noblock, int *err)
6762{
6763	int error;
6764	struct sk_buff *skb;
6765	long timeo;
6766
6767	timeo = sock_rcvtimeo(sk, noblock);
6768
6769	pr_debug("%s: timeo:%ld, max:%ld\n", __func__, timeo,
6770		 MAX_SCHEDULE_TIMEOUT);
6771
6772	do {
6773		/* Again only user level code calls this function,
6774		 * so nothing interrupt level
6775		 * will suddenly eat the receive_queue.
6776		 *
6777		 *  Look at current nfs client by the way...
6778		 *  However, this function was correct in any case. 8)
6779		 */
6780		if (flags & MSG_PEEK) {
6781			spin_lock_bh(&sk->sk_receive_queue.lock);
6782			skb = skb_peek(&sk->sk_receive_queue);
6783			if (skb)
6784				atomic_inc(&skb->users);
6785			spin_unlock_bh(&sk->sk_receive_queue.lock);
6786		} else {
6787			skb = skb_dequeue(&sk->sk_receive_queue);
6788		}
6789
6790		if (skb)
6791			return skb;
6792
6793		/* Caller is allowed not to check sk->sk_err before calling. */
6794		error = sock_error(sk);
6795		if (error)
6796			goto no_packet;
6797
6798		if (sk->sk_shutdown & RCV_SHUTDOWN)
6799			break;
6800
6801		if (sk_can_busy_loop(sk) &&
6802		    sk_busy_loop(sk, noblock))
6803			continue;
6804
6805		/* User doesn't want to wait.  */
6806		error = -EAGAIN;
6807		if (!timeo)
6808			goto no_packet;
6809	} while (sctp_wait_for_packet(sk, err, &timeo) == 0);
6810
6811	return NULL;
6812
6813no_packet:
6814	*err = error;
6815	return NULL;
6816}
6817
6818/* If sndbuf has changed, wake up per association sndbuf waiters.  */
6819static void __sctp_write_space(struct sctp_association *asoc)
6820{
6821	struct sock *sk = asoc->base.sk;
6822	struct socket *sock = sk->sk_socket;
6823
6824	if ((sctp_wspace(asoc) > 0) && sock) {
6825		if (waitqueue_active(&asoc->wait))
6826			wake_up_interruptible(&asoc->wait);
6827
6828		if (sctp_writeable(sk)) {
6829			wait_queue_head_t *wq = sk_sleep(sk);
6830
6831			if (wq && waitqueue_active(wq))
6832				wake_up_interruptible(wq);
6833
6834			/* Note that we try to include the Async I/O support
6835			 * here by modeling from the current TCP/UDP code.
6836			 * We have not tested with it yet.
6837			 */
6838			if (!(sk->sk_shutdown & SEND_SHUTDOWN))
6839				sock_wake_async(sock,
6840						SOCK_WAKE_SPACE, POLL_OUT);
6841		}
6842	}
6843}
6844
6845static void sctp_wake_up_waiters(struct sock *sk,
6846				 struct sctp_association *asoc)
6847{
6848	struct sctp_association *tmp = asoc;
6849
6850	/* We do accounting for the sndbuf space per association,
6851	 * so we only need to wake our own association.
6852	 */
6853	if (asoc->ep->sndbuf_policy)
6854		return __sctp_write_space(asoc);
6855
6856	/* If association goes down and is just flushing its
6857	 * outq, then just normally notify others.
6858	 */
6859	if (asoc->base.dead)
6860		return sctp_write_space(sk);
6861
6862	/* Accounting for the sndbuf space is per socket, so we
6863	 * need to wake up others, try to be fair and in case of
6864	 * other associations, let them have a go first instead
6865	 * of just doing a sctp_write_space() call.
6866	 *
6867	 * Note that we reach sctp_wake_up_waiters() only when
6868	 * associations free up queued chunks, thus we are under
6869	 * lock and the list of associations on a socket is
6870	 * guaranteed not to change.
6871	 */
6872	for (tmp = list_next_entry(tmp, asocs); 1;
6873	     tmp = list_next_entry(tmp, asocs)) {
6874		/* Manually skip the head element. */
6875		if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
6876			continue;
6877		/* Wake up association. */
6878		__sctp_write_space(tmp);
6879		/* We've reached the end. */
6880		if (tmp == asoc)
6881			break;
6882	}
6883}
6884
6885/* Do accounting for the sndbuf space.
6886 * Decrement the used sndbuf space of the corresponding association by the
6887 * data size which was just transmitted(freed).
6888 */
6889static void sctp_wfree(struct sk_buff *skb)
6890{
6891	struct sctp_chunk *chunk = skb_shinfo(skb)->destructor_arg;
6892	struct sctp_association *asoc = chunk->asoc;
6893	struct sock *sk = asoc->base.sk;
6894
6895	asoc->sndbuf_used -= SCTP_DATA_SNDSIZE(chunk) +
6896				sizeof(struct sk_buff) +
6897				sizeof(struct sctp_chunk);
6898
6899	atomic_sub(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
6900
6901	/*
6902	 * This undoes what is done via sctp_set_owner_w and sk_mem_charge
6903	 */
6904	sk->sk_wmem_queued   -= skb->truesize;
6905	sk_mem_uncharge(sk, skb->truesize);
6906
6907	sock_wfree(skb);
6908	sctp_wake_up_waiters(sk, asoc);
6909
6910	sctp_association_put(asoc);
6911}
6912
6913/* Do accounting for the receive space on the socket.
6914 * Accounting for the association is done in ulpevent.c
6915 * We set this as a destructor for the cloned data skbs so that
6916 * accounting is done at the correct time.
6917 */
6918void sctp_sock_rfree(struct sk_buff *skb)
6919{
6920	struct sock *sk = skb->sk;
6921	struct sctp_ulpevent *event = sctp_skb2event(skb);
6922
6923	atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
6924
6925	/*
6926	 * Mimic the behavior of sock_rfree
6927	 */
6928	sk_mem_uncharge(sk, event->rmem_len);
6929}
6930
6931
6932/* Helper function to wait for space in the sndbuf.  */
6933static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
6934				size_t msg_len)
6935{
6936	struct sock *sk = asoc->base.sk;
6937	int err = 0;
6938	long current_timeo = *timeo_p;
6939	DEFINE_WAIT(wait);
6940
6941	pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
6942		 *timeo_p, msg_len);
6943
6944	/* Increment the association's refcnt.  */
6945	sctp_association_hold(asoc);
6946
6947	/* Wait on the association specific sndbuf space. */
6948	for (;;) {
6949		prepare_to_wait_exclusive(&asoc->wait, &wait,
6950					  TASK_INTERRUPTIBLE);
6951		if (!*timeo_p)
6952			goto do_nonblock;
6953		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
6954		    asoc->base.dead)
6955			goto do_error;
6956		if (signal_pending(current))
6957			goto do_interrupted;
6958		if (msg_len <= sctp_wspace(asoc))
6959			break;
6960
6961		/* Let another process have a go.  Since we are going
6962		 * to sleep anyway.
6963		 */
6964		release_sock(sk);
6965		current_timeo = schedule_timeout(current_timeo);
6966		BUG_ON(sk != asoc->base.sk);
6967		lock_sock(sk);
6968
6969		*timeo_p = current_timeo;
6970	}
6971
6972out:
6973	finish_wait(&asoc->wait, &wait);
6974
6975	/* Release the association's refcnt.  */
6976	sctp_association_put(asoc);
6977
6978	return err;
6979
6980do_error:
6981	err = -EPIPE;
6982	goto out;
6983
6984do_interrupted:
6985	err = sock_intr_errno(*timeo_p);
6986	goto out;
6987
6988do_nonblock:
6989	err = -EAGAIN;
6990	goto out;
6991}
6992
6993void sctp_data_ready(struct sock *sk)
6994{
6995	struct socket_wq *wq;
6996
6997	rcu_read_lock();
6998	wq = rcu_dereference(sk->sk_wq);
6999	if (wq_has_sleeper(wq))
7000		wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
7001						POLLRDNORM | POLLRDBAND);
7002	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
7003	rcu_read_unlock();
7004}
7005
7006/* If socket sndbuf has changed, wake up all per association waiters.  */
7007void sctp_write_space(struct sock *sk)
7008{
7009	struct sctp_association *asoc;
7010
7011	/* Wake up the tasks in each wait queue.  */
7012	list_for_each_entry(asoc, &((sctp_sk(sk))->ep->asocs), asocs) {
7013		__sctp_write_space(asoc);
7014	}
7015}
7016
7017/* Is there any sndbuf space available on the socket?
7018 *
7019 * Note that sk_wmem_alloc is the sum of the send buffers on all of the
7020 * associations on the same socket.  For a UDP-style socket with
7021 * multiple associations, it is possible for it to be "unwriteable"
7022 * prematurely.  I assume that this is acceptable because
7023 * a premature "unwriteable" is better than an accidental "writeable" which
7024 * would cause an unwanted block under certain circumstances.  For the 1-1
7025 * UDP-style sockets or TCP-style sockets, this code should work.
7026 *  - Daisy
7027 */
7028static int sctp_writeable(struct sock *sk)
7029{
7030	int amt = 0;
7031
7032	amt = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
7033	if (amt < 0)
7034		amt = 0;
7035	return amt;
7036}
7037
7038/* Wait for an association to go into ESTABLISHED state. If timeout is 0,
7039 * returns immediately with EINPROGRESS.
7040 */
7041static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p)
7042{
7043	struct sock *sk = asoc->base.sk;
7044	int err = 0;
7045	long current_timeo = *timeo_p;
7046	DEFINE_WAIT(wait);
7047
7048	pr_debug("%s: asoc:%p, timeo:%ld\n", __func__, asoc, *timeo_p);
7049
7050	/* Increment the association's refcnt.  */
7051	sctp_association_hold(asoc);
7052
7053	for (;;) {
7054		prepare_to_wait_exclusive(&asoc->wait, &wait,
7055					  TASK_INTERRUPTIBLE);
7056		if (!*timeo_p)
7057			goto do_nonblock;
7058		if (sk->sk_shutdown & RCV_SHUTDOWN)
7059			break;
7060		if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
7061		    asoc->base.dead)
7062			goto do_error;
7063		if (signal_pending(current))
7064			goto do_interrupted;
7065
7066		if (sctp_state(asoc, ESTABLISHED))
7067			break;
7068
7069		/* Let another process have a go.  Since we are going
7070		 * to sleep anyway.
7071		 */
7072		release_sock(sk);
7073		current_timeo = schedule_timeout(current_timeo);
7074		lock_sock(sk);
7075
7076		*timeo_p = current_timeo;
7077	}
7078
7079out:
7080	finish_wait(&asoc->wait, &wait);
7081
7082	/* Release the association's refcnt.  */
7083	sctp_association_put(asoc);
7084
7085	return err;
7086
7087do_error:
7088	if (asoc->init_err_counter + 1 > asoc->max_init_attempts)
7089		err = -ETIMEDOUT;
7090	else
7091		err = -ECONNREFUSED;
7092	goto out;
7093
7094do_interrupted:
7095	err = sock_intr_errno(*timeo_p);
7096	goto out;
7097
7098do_nonblock:
7099	err = -EINPROGRESS;
7100	goto out;
7101}
7102
7103static int sctp_wait_for_accept(struct sock *sk, long timeo)
7104{
7105	struct sctp_endpoint *ep;
7106	int err = 0;
7107	DEFINE_WAIT(wait);
7108
7109	ep = sctp_sk(sk)->ep;
7110
7111
7112	for (;;) {
7113		prepare_to_wait_exclusive(sk_sleep(sk), &wait,
7114					  TASK_INTERRUPTIBLE);
7115
7116		if (list_empty(&ep->asocs)) {
7117			release_sock(sk);
7118			timeo = schedule_timeout(timeo);
7119			lock_sock(sk);
7120		}
7121
7122		err = -EINVAL;
7123		if (!sctp_sstate(sk, LISTENING))
7124			break;
7125
7126		err = 0;
7127		if (!list_empty(&ep->asocs))
7128			break;
7129
7130		err = sock_intr_errno(timeo);
7131		if (signal_pending(current))
7132			break;
7133
7134		err = -EAGAIN;
7135		if (!timeo)
7136			break;
7137	}
7138
7139	finish_wait(sk_sleep(sk), &wait);
7140
7141	return err;
7142}
7143
7144static void sctp_wait_for_close(struct sock *sk, long timeout)
7145{
7146	DEFINE_WAIT(wait);
7147
7148	do {
7149		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
7150		if (list_empty(&sctp_sk(sk)->ep->asocs))
7151			break;
7152		release_sock(sk);
7153		timeout = schedule_timeout(timeout);
7154		lock_sock(sk);
7155	} while (!signal_pending(current) && timeout);
7156
7157	finish_wait(sk_sleep(sk), &wait);
7158}
7159
7160static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
7161{
7162	struct sk_buff *frag;
7163
7164	if (!skb->data_len)
7165		goto done;
7166
7167	/* Don't forget the fragments. */
7168	skb_walk_frags(skb, frag)
7169		sctp_skb_set_owner_r_frag(frag, sk);
7170
7171done:
7172	sctp_skb_set_owner_r(skb, sk);
7173}
7174
7175void sctp_copy_sock(struct sock *newsk, struct sock *sk,
7176		    struct sctp_association *asoc)
7177{
7178	struct inet_sock *inet = inet_sk(sk);
7179	struct inet_sock *newinet;
7180
7181	newsk->sk_type = sk->sk_type;
7182	newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
7183	newsk->sk_flags = sk->sk_flags;
7184	newsk->sk_tsflags = sk->sk_tsflags;
7185	newsk->sk_no_check_tx = sk->sk_no_check_tx;
7186	newsk->sk_no_check_rx = sk->sk_no_check_rx;
7187	newsk->sk_reuse = sk->sk_reuse;
7188
7189	newsk->sk_shutdown = sk->sk_shutdown;
7190	newsk->sk_destruct = sctp_destruct_sock;
7191	newsk->sk_family = sk->sk_family;
7192	newsk->sk_protocol = IPPROTO_SCTP;
7193	newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
7194	newsk->sk_sndbuf = sk->sk_sndbuf;
7195	newsk->sk_rcvbuf = sk->sk_rcvbuf;
7196	newsk->sk_lingertime = sk->sk_lingertime;
7197	newsk->sk_rcvtimeo = sk->sk_rcvtimeo;
7198	newsk->sk_sndtimeo = sk->sk_sndtimeo;
7199
7200	newinet = inet_sk(newsk);
7201
7202	/* Initialize sk's sport, dport, rcv_saddr and daddr for
7203	 * getsockname() and getpeername()
7204	 */
7205	newinet->inet_sport = inet->inet_sport;
7206	newinet->inet_saddr = inet->inet_saddr;
7207	newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
7208	newinet->inet_dport = htons(asoc->peer.port);
7209	newinet->pmtudisc = inet->pmtudisc;
7210	newinet->inet_id = asoc->next_tsn ^ jiffies;
7211
7212	newinet->uc_ttl = inet->uc_ttl;
7213	newinet->mc_loop = 1;
7214	newinet->mc_ttl = 1;
7215	newinet->mc_index = 0;
7216	newinet->mc_list = NULL;
7217
7218	if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
7219		net_enable_timestamp();
7220}
7221
7222static inline void sctp_copy_descendant(struct sock *sk_to,
7223					const struct sock *sk_from)
7224{
7225	int ancestor_size = sizeof(struct inet_sock) +
7226			    sizeof(struct sctp_sock) -
7227			    offsetof(struct sctp_sock, auto_asconf_list);
7228
7229	if (sk_from->sk_family == PF_INET6)
7230		ancestor_size += sizeof(struct ipv6_pinfo);
7231
7232	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
7233}
7234
7235/* Populate the fields of the newsk from the oldsk and migrate the assoc
7236 * and its messages to the newsk.
7237 */
7238static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
7239			      struct sctp_association *assoc,
7240			      sctp_socket_type_t type)
7241{
7242	struct sctp_sock *oldsp = sctp_sk(oldsk);
7243	struct sctp_sock *newsp = sctp_sk(newsk);
7244	struct sctp_bind_bucket *pp; /* hash list port iterator */
7245	struct sctp_endpoint *newep = newsp->ep;
7246	struct sk_buff *skb, *tmp;
7247	struct sctp_ulpevent *event;
7248	struct sctp_bind_hashbucket *head;
7249
7250	/* Migrate socket buffer sizes and all the socket level options to the
7251	 * new socket.
7252	 */
7253	newsk->sk_sndbuf = oldsk->sk_sndbuf;
7254	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
7255	/* Brute force copy old sctp opt. */
7256	sctp_copy_descendant(newsk, oldsk);
7257
7258	/* Restore the ep value that was overwritten with the above structure
7259	 * copy.
7260	 */
7261	newsp->ep = newep;
7262	newsp->hmac = NULL;
7263
7264	/* Hook this new socket in to the bind_hash list. */
7265	head = &sctp_port_hashtable[sctp_phashfn(sock_net(oldsk),
7266						 inet_sk(oldsk)->inet_num)];
7267	local_bh_disable();
7268	spin_lock(&head->lock);
7269	pp = sctp_sk(oldsk)->bind_hash;
7270	sk_add_bind_node(newsk, &pp->owner);
7271	sctp_sk(newsk)->bind_hash = pp;
7272	inet_sk(newsk)->inet_num = inet_sk(oldsk)->inet_num;
7273	spin_unlock(&head->lock);
7274	local_bh_enable();
7275
7276	/* Copy the bind_addr list from the original endpoint to the new
7277	 * endpoint so that we can handle restarts properly
7278	 */
7279	sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
7280				&oldsp->ep->base.bind_addr, GFP_KERNEL);
7281
7282	/* Move any messages in the old socket's receive queue that are for the
7283	 * peeled off association to the new socket's receive queue.
7284	 */
7285	sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
7286		event = sctp_skb2event(skb);
7287		if (event->asoc == assoc) {
7288			__skb_unlink(skb, &oldsk->sk_receive_queue);
7289			__skb_queue_tail(&newsk->sk_receive_queue, skb);
7290			sctp_skb_set_owner_r_frag(skb, newsk);
7291		}
7292	}
7293
7294	/* Clean up any messages pending delivery due to partial
7295	 * delivery.   Three cases:
7296	 * 1) No partial deliver;  no work.
7297	 * 2) Peeling off partial delivery; keep pd_lobby in new pd_lobby.
7298	 * 3) Peeling off non-partial delivery; move pd_lobby to receive_queue.
7299	 */
7300	skb_queue_head_init(&newsp->pd_lobby);
7301	atomic_set(&sctp_sk(newsk)->pd_mode, assoc->ulpq.pd_mode);
7302
7303	if (atomic_read(&sctp_sk(oldsk)->pd_mode)) {
7304		struct sk_buff_head *queue;
7305
7306		/* Decide which queue to move pd_lobby skbs to. */
7307		if (assoc->ulpq.pd_mode) {
7308			queue = &newsp->pd_lobby;
7309		} else
7310			queue = &newsk->sk_receive_queue;
7311
7312		/* Walk through the pd_lobby, looking for skbs that
7313		 * need moved to the new socket.
7314		 */
7315		sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
7316			event = sctp_skb2event(skb);
7317			if (event->asoc == assoc) {
7318				__skb_unlink(skb, &oldsp->pd_lobby);
7319				__skb_queue_tail(queue, skb);
7320				sctp_skb_set_owner_r_frag(skb, newsk);
7321			}
7322		}
7323
7324		/* Clear up any skbs waiting for the partial
7325		 * delivery to finish.
7326		 */
7327		if (assoc->ulpq.pd_mode)
7328			sctp_clear_pd(oldsk, NULL);
7329
7330	}
7331
7332	sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
7333		sctp_skb_set_owner_r_frag(skb, newsk);
7334
7335	sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
7336		sctp_skb_set_owner_r_frag(skb, newsk);
7337
7338	/* Set the type of socket to indicate that it is peeled off from the
7339	 * original UDP-style socket or created with the accept() call on a
7340	 * TCP-style socket..
7341	 */
7342	newsp->type = type;
7343
7344	/* Mark the new socket "in-use" by the user so that any packets
7345	 * that may arrive on the association after we've moved it are
7346	 * queued to the backlog.  This prevents a potential race between
7347	 * backlog processing on the old socket and new-packet processing
7348	 * on the new socket.
7349	 *
7350	 * The caller has just allocated newsk so we can guarantee that other
7351	 * paths won't try to lock it and then oldsk.
7352	 */
7353	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
7354	sctp_assoc_migrate(assoc, newsk);
7355
7356	/* If the association on the newsk is already closed before accept()
7357	 * is called, set RCV_SHUTDOWN flag.
7358	 */
7359	if (sctp_state(assoc, CLOSED) && sctp_style(newsk, TCP))
7360		newsk->sk_shutdown |= RCV_SHUTDOWN;
7361
7362	newsk->sk_state = SCTP_SS_ESTABLISHED;
7363	release_sock(newsk);
7364}
7365
7366
7367/* This proto struct describes the ULP interface for SCTP.  */
7368struct proto sctp_prot = {
7369	.name        =	"SCTP",
7370	.owner       =	THIS_MODULE,
7371	.close       =	sctp_close,
7372	.connect     =	sctp_connect,
7373	.disconnect  =	sctp_disconnect,
7374	.accept      =	sctp_accept,
7375	.ioctl       =	sctp_ioctl,
7376	.init        =	sctp_init_sock,
7377	.destroy     =	sctp_destroy_sock,
7378	.shutdown    =	sctp_shutdown,
7379	.setsockopt  =	sctp_setsockopt,
7380	.getsockopt  =	sctp_getsockopt,
7381	.sendmsg     =	sctp_sendmsg,
7382	.recvmsg     =	sctp_recvmsg,
7383	.bind        =	sctp_bind,
7384	.backlog_rcv =	sctp_backlog_rcv,
7385	.hash        =	sctp_hash,
7386	.unhash      =	sctp_unhash,
7387	.get_port    =	sctp_get_port,
7388	.obj_size    =  sizeof(struct sctp_sock),
7389	.sysctl_mem  =  sysctl_sctp_mem,
7390	.sysctl_rmem =  sysctl_sctp_rmem,
7391	.sysctl_wmem =  sysctl_sctp_wmem,
7392	.memory_pressure = &sctp_memory_pressure,
7393	.enter_memory_pressure = sctp_enter_memory_pressure,
7394	.memory_allocated = &sctp_memory_allocated,
7395	.sockets_allocated = &sctp_sockets_allocated,
7396};
7397
7398#if IS_ENABLED(CONFIG_IPV6)
7399
7400#include <net/transp_v6.h>
7401static void sctp_v6_destroy_sock(struct sock *sk)
7402{
7403	sctp_destroy_sock(sk);
7404	inet6_destroy_sock(sk);
7405}
7406
7407struct proto sctpv6_prot = {
7408	.name		= "SCTPv6",
7409	.owner		= THIS_MODULE,
7410	.close		= sctp_close,
7411	.connect	= sctp_connect,
7412	.disconnect	= sctp_disconnect,
7413	.accept		= sctp_accept,
7414	.ioctl		= sctp_ioctl,
7415	.init		= sctp_init_sock,
7416	.destroy	= sctp_v6_destroy_sock,
7417	.shutdown	= sctp_shutdown,
7418	.setsockopt	= sctp_setsockopt,
7419	.getsockopt	= sctp_getsockopt,
7420	.sendmsg	= sctp_sendmsg,
7421	.recvmsg	= sctp_recvmsg,
7422	.bind		= sctp_bind,
7423	.backlog_rcv	= sctp_backlog_rcv,
7424	.hash		= sctp_hash,
7425	.unhash		= sctp_unhash,
7426	.get_port	= sctp_get_port,
7427	.obj_size	= sizeof(struct sctp6_sock),
7428	.sysctl_mem	= sysctl_sctp_mem,
7429	.sysctl_rmem	= sysctl_sctp_rmem,
7430	.sysctl_wmem	= sysctl_sctp_wmem,
7431	.memory_pressure = &sctp_memory_pressure,
7432	.enter_memory_pressure = sctp_enter_memory_pressure,
7433	.memory_allocated = &sctp_memory_allocated,
7434	.sockets_allocated = &sctp_sockets_allocated,
7435};
7436#endif /* IS_ENABLED(CONFIG_IPV6) */
7437