1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* INET An implementation of the TCP/IP protocol suite for the LINUX
4	* operating system. INET is implemented using the BSD Socket
5	* interface as the means of communication with the user level.
6	*
7	* The IP to API glue.
8	*
9	* Authors: see ip.c
10	*
11	* Fixes:
12	* Many : Split from ip.c , see ip.c for history.
13	* Martin Mares : TOS setting fixed.
14	* Alan Cox : Fixed a couple of oopses in Martin's
15	* TOS tweaks.
16	* Mike McLagan : Routing by source
17	*/
18
19	#include <linux/module.h>
20	#include <linux/types.h>
21	#include <linux/mm.h>
22	#include <linux/skbuff.h>
23	#include <linux/ip.h>
24	#include <linux/icmp.h>
25	#include <linux/inetdevice.h>
26	#include <linux/netdevice.h>
27	#include <linux/slab.h>
28	#include <net/sock.h>
29	#include <net/ip.h>
30	#include <net/icmp.h>
31	#include <net/tcp_states.h>
32	#include <linux/udp.h>
33	#include <linux/igmp.h>
34	#include <linux/netfilter.h>
35	#include <linux/route.h>
36	#include <linux/mroute.h>
37	#include <net/inet_ecn.h>
38	#include <net/route.h>
39	#include <net/xfrm.h>
40	#include <net/compat.h>
41	#include <net/checksum.h>
42	#if IS_ENABLED(CONFIG_IPV6)
43	#include <net/transp_v6.h>
44	#endif
45	#include <net/ip_fib.h>
46
47	#include <linux/errqueue.h>
48	#include <linux/uaccess.h>
49
50	#include <linux/bpfilter.h>
51
52	/*
53	* SOL_IP control messages.
54	*/
55
56	static void ip_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
57	{
58	struct in_pktinfo info = *PKTINFO_SKB_CB(skb);
59
60	info.ipi_addr.s_addr = ip_hdr(skb)->daddr;
61
62	put_cmsg(msg, SOL_IP, IP_PKTINFO, len: sizeof(info), data: &info);
63	}
64
65	static void ip_cmsg_recv_ttl(struct msghdr *msg, struct sk_buff *skb)
66	{
67	int ttl = ip_hdr(skb)->ttl;
68	put_cmsg(msg, SOL_IP, IP_TTL, len: sizeof(int), data: &ttl);
69	}
70
71	static void ip_cmsg_recv_tos(struct msghdr *msg, struct sk_buff *skb)
72	{
73	put_cmsg(msg, SOL_IP, IP_TOS, len: 1, data: &ip_hdr(skb)->tos);
74	}
75
76	static void ip_cmsg_recv_opts(struct msghdr *msg, struct sk_buff *skb)
77	{
78	if (IPCB(skb)->opt.optlen == 0)
79	return;
80
81	put_cmsg(msg, SOL_IP, IP_RECVOPTS, IPCB(skb)->opt.optlen,
82	data: ip_hdr(skb) + 1);
83	}
84
85
86	static void ip_cmsg_recv_retopts(struct net *net, struct msghdr *msg,
87	struct sk_buff *skb)
88	{
89	unsigned char optbuf[sizeof(struct ip_options) + 40];
90	struct ip_options *opt = (struct ip_options *)optbuf;
91
92	if (IPCB(skb)->opt.optlen == 0)
93	return;
94
95	if (ip_options_echo(net, dopt: opt, skb)) {
96	msg->msg_flags |= MSG_CTRUNC;
97	return;
98	}
99	ip_options_undo(opt);
100
101	put_cmsg(msg, SOL_IP, IP_RETOPTS, len: opt->optlen, data: opt->__data);
102	}
103
104	static void ip_cmsg_recv_fragsize(struct msghdr *msg, struct sk_buff *skb)
105	{
106	int val;
107
108	if (IPCB(skb)->frag_max_size == 0)
109	return;
110
111	val = IPCB(skb)->frag_max_size;
112	put_cmsg(msg, SOL_IP, IP_RECVFRAGSIZE, len: sizeof(val), data: &val);
113	}
114
115	static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,
116	int tlen, int offset)
117	{
118	__wsum csum = skb->csum;
119
120	if (skb->ip_summed != CHECKSUM_COMPLETE)
121	return;
122
123	if (offset != 0) {
124	int tend_off = skb_transport_offset(skb) + tlen;
125	csum = csum_sub(csum, addend: skb_checksum(skb, offset: tend_off, len: offset, csum: 0));
126	}
127
128	put_cmsg(msg, SOL_IP, IP_CHECKSUM, len: sizeof(__wsum), data: &csum);
129	}
130
131	static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
132	{
133	char *secdata;
134	u32 seclen, secid;
135	int err;
136
137	err = security_socket_getpeersec_dgram(NULL, skb, secid: &secid);
138	if (err)
139	return;
140
141	err = security_secid_to_secctx(secid, secdata: &secdata, seclen: &seclen);
142	if (err)
143	return;
144
145	put_cmsg(msg, SOL_IP, SCM_SECURITY, len: seclen, data: secdata);
146	security_release_secctx(secdata, seclen);
147	}
148
149	static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
150	{
151	__be16 _ports[2], *ports;
152	struct sockaddr_in sin;
153
154	/* All current transport protocols have the port numbers in the
155	* first four bytes of the transport header and this function is
156	* written with this assumption in mind.
157	*/
158	ports = skb_header_pointer(skb, offset: skb_transport_offset(skb),
159	len: sizeof(_ports), buffer: &_ports);
160	if (!ports)
161	return;
162
163	sin.sin_family = AF_INET;
164	sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
165	sin.sin_port = ports[1];
166	memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
167
168	put_cmsg(msg, SOL_IP, IP_ORIGDSTADDR, len: sizeof(sin), data: &sin);
169	}
170
171	void ip_cmsg_recv_offset(struct msghdr *msg, struct sock *sk,
172	struct sk_buff *skb, int tlen, int offset)
173	{
174	unsigned long flags = inet_cmsg_flags(inet_sk(sk));
175
176	if (!flags)
177	return;
178
179	/* Ordered by supposed usage frequency */
180	if (flags & IP_CMSG_PKTINFO) {
181	ip_cmsg_recv_pktinfo(msg, skb);
182
183	flags &= ~IP_CMSG_PKTINFO;
184	if (!flags)
185	return;
186	}
187
188	if (flags & IP_CMSG_TTL) {
189	ip_cmsg_recv_ttl(msg, skb);
190
191	flags &= ~IP_CMSG_TTL;
192	if (!flags)
193	return;
194	}
195
196	if (flags & IP_CMSG_TOS) {
197	ip_cmsg_recv_tos(msg, skb);
198
199	flags &= ~IP_CMSG_TOS;
200	if (!flags)
201	return;
202	}
203
204	if (flags & IP_CMSG_RECVOPTS) {
205	ip_cmsg_recv_opts(msg, skb);
206
207	flags &= ~IP_CMSG_RECVOPTS;
208	if (!flags)
209	return;
210	}
211
212	if (flags & IP_CMSG_RETOPTS) {
213	ip_cmsg_recv_retopts(net: sock_net(sk), msg, skb);
214
215	flags &= ~IP_CMSG_RETOPTS;
216	if (!flags)
217	return;
218	}
219
220	if (flags & IP_CMSG_PASSSEC) {
221	ip_cmsg_recv_security(msg, skb);
222
223	flags &= ~IP_CMSG_PASSSEC;
224	if (!flags)
225	return;
226	}
227
228	if (flags & IP_CMSG_ORIGDSTADDR) {
229	ip_cmsg_recv_dstaddr(msg, skb);
230
231	flags &= ~IP_CMSG_ORIGDSTADDR;
232	if (!flags)
233	return;
234	}
235
236	if (flags & IP_CMSG_CHECKSUM)
237	ip_cmsg_recv_checksum(msg, skb, tlen, offset);
238
239	if (flags & IP_CMSG_RECVFRAGSIZE)
240	ip_cmsg_recv_fragsize(msg, skb);
241	}
242	EXPORT_SYMBOL(ip_cmsg_recv_offset);
243
244	int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
245	bool allow_ipv6)
246	{
247	int err, val;
248	struct cmsghdr *cmsg;
249	struct net *net = sock_net(sk);
250
251	for_each_cmsghdr(cmsg, msg) {
252	if (!CMSG_OK(msg, cmsg))
253	return -EINVAL;
254	#if IS_ENABLED(CONFIG_IPV6)
255	if (allow_ipv6 &&
256	cmsg->cmsg_level == SOL_IPV6 &&
257	cmsg->cmsg_type == IPV6_PKTINFO) {
258	struct in6_pktinfo *src_info;
259
260	if (cmsg->cmsg_len < CMSG_LEN(sizeof(*src_info)))
261	return -EINVAL;
262	src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
263	if (!ipv6_addr_v4mapped(a: &src_info->ipi6_addr))
264	return -EINVAL;
265	if (src_info->ipi6_ifindex)
266	ipc->oif = src_info->ipi6_ifindex;
267	ipc->addr = src_info->ipi6_addr.s6_addr32[3];
268	continue;
269	}
270	#endif
271	if (cmsg->cmsg_level == SOL_SOCKET) {
272	err = __sock_cmsg_send(sk, cmsg, sockc: &ipc->sockc);
273	if (err)
274	return err;
275	continue;
276	}
277
278	if (cmsg->cmsg_level != SOL_IP)
279	continue;
280	switch (cmsg->cmsg_type) {
281	case IP_RETOPTS:
282	err = cmsg->cmsg_len - sizeof(struct cmsghdr);
283
284	/* Our caller is responsible for freeing ipc->opt */
285	err = ip_options_get(net, optp: &ipc->opt,
286	data: KERNEL_SOCKPTR(CMSG_DATA(cmsg)),
287	optlen: err < 40 ? err : 40);
288	if (err)
289	return err;
290	break;
291	case IP_PKTINFO:
292	{
293	struct in_pktinfo *info;
294	if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo)))
295	return -EINVAL;
296	info = (struct in_pktinfo *)CMSG_DATA(cmsg);
297	if (info->ipi_ifindex)
298	ipc->oif = info->ipi_ifindex;
299	ipc->addr = info->ipi_spec_dst.s_addr;
300	break;
301	}
302	case IP_TTL:
303	if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
304	return -EINVAL;
305	val = *(int *)CMSG_DATA(cmsg);
306	if (val < 1 || val > 255)
307	return -EINVAL;
308	ipc->ttl = val;
309	break;
310	case IP_TOS:
311	if (cmsg->cmsg_len == CMSG_LEN(sizeof(int)))
312	val = *(int *)CMSG_DATA(cmsg);
313	else if (cmsg->cmsg_len == CMSG_LEN(sizeof(u8)))
314	val = *(u8 *)CMSG_DATA(cmsg);
315	else
316	return -EINVAL;
317	if (val < 0 || val > 255)
318	return -EINVAL;
319	ipc->tos = val;
320	ipc->priority = rt_tos2priority(tos: ipc->tos);
321	break;
322	case IP_PROTOCOL:
323	if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
324	return -EINVAL;
325	val = *(int *)CMSG_DATA(cmsg);
326	if (val < 1 || val > 255)
327	return -EINVAL;
328	ipc->protocol = val;
329	break;
330	default:
331	return -EINVAL;
332	}
333	}
334	return 0;
335	}
336
337	static void ip_ra_destroy_rcu(struct rcu_head *head)
338	{
339	struct ip_ra_chain *ra = container_of(head, struct ip_ra_chain, rcu);
340
341	sock_put(sk: ra->saved_sk);
342	kfree(objp: ra);
343	}
344
345	int ip_ra_control(struct sock *sk, unsigned char on,
346	void (*destructor)(struct sock *))
347	{
348	struct ip_ra_chain *ra, *new_ra;
349	struct ip_ra_chain __rcu **rap;
350	struct net *net = sock_net(sk);
351
352	if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num == IPPROTO_RAW)
353	return -EINVAL;
354
355	new_ra = on ? kmalloc(size: sizeof(*new_ra), GFP_KERNEL) : NULL;
356	if (on && !new_ra)
357	return -ENOMEM;
358
359	mutex_lock(&net->ipv4.ra_mutex);
360	for (rap = &net->ipv4.ra_chain;
361	(ra = rcu_dereference_protected(*rap,
362	lockdep_is_held(&net->ipv4.ra_mutex))) != NULL;
363	rap = &ra->next) {
364	if (ra->sk == sk) {
365	if (on) {
366	mutex_unlock(lock: &net->ipv4.ra_mutex);
367	kfree(objp: new_ra);
368	return -EADDRINUSE;
369	}
370	/* dont let ip_call_ra_chain() use sk again */
371	ra->sk = NULL;
372	RCU_INIT_POINTER(*rap, ra->next);
373	mutex_unlock(lock: &net->ipv4.ra_mutex);
374
375	if (ra->destructor)
376	ra->destructor(sk);
377	/*
378	* Delay sock_put(sk) and kfree(ra) after one rcu grace
379	* period. This guarantee ip_call_ra_chain() dont need
380	* to mess with socket refcounts.
381	*/
382	ra->saved_sk = sk;
383	call_rcu(head: &ra->rcu, func: ip_ra_destroy_rcu);
384	return 0;
385	}
386	}
387	if (!new_ra) {
388	mutex_unlock(lock: &net->ipv4.ra_mutex);
389	return -ENOBUFS;
390	}
391	new_ra->sk = sk;
392	new_ra->destructor = destructor;
393
394	RCU_INIT_POINTER(new_ra->next, ra);
395	rcu_assign_pointer(*rap, new_ra);
396	sock_hold(sk);
397	mutex_unlock(lock: &net->ipv4.ra_mutex);
398
399	return 0;
400	}
401
402	static void ipv4_icmp_error_rfc4884(const struct sk_buff *skb,
403	struct sock_ee_data_rfc4884 *out)
404	{
405	switch (icmp_hdr(skb)->type) {
406	case ICMP_DEST_UNREACH:
407	case ICMP_TIME_EXCEEDED:
408	case ICMP_PARAMETERPROB:
409	ip_icmp_error_rfc4884(skb, out, thlen: sizeof(struct icmphdr),
410	off: icmp_hdr(skb)->un.reserved[1] * 4);
411	}
412	}
413
414	void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
415	__be16 port, u32 info, u8 *payload)
416	{
417	struct sock_exterr_skb *serr;
418
419	skb = skb_clone(skb, GFP_ATOMIC);
420	if (!skb)
421	return;
422
423	serr = SKB_EXT_ERR(skb);
424	serr->ee.ee_errno = err;
425	serr->ee.ee_origin = SO_EE_ORIGIN_ICMP;
426	serr->ee.ee_type = icmp_hdr(skb)->type;
427	serr->ee.ee_code = icmp_hdr(skb)->code;
428	serr->ee.ee_pad = 0;
429	serr->ee.ee_info = info;
430	serr->ee.ee_data = 0;
431	serr->addr_offset = (u8 *)&(((struct iphdr *)(icmp_hdr(skb) + 1))->daddr) -
432	skb_network_header(skb);
433	serr->port = port;
434
435	if (skb_pull(skb, len: payload - skb->data)) {
436	if (inet_test_bit(RECVERR_RFC4884, sk))
437	ipv4_icmp_error_rfc4884(skb, out: &serr->ee.ee_rfc4884);
438
439	skb_reset_transport_header(skb);
440	if (sock_queue_err_skb(sk, skb) == 0)
441	return;
442	}
443	kfree_skb(skb);
444	}
445	EXPORT_SYMBOL_GPL(ip_icmp_error);
446
447	void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 info)
448	{
449	struct sock_exterr_skb *serr;
450	struct iphdr *iph;
451	struct sk_buff *skb;
452
453	if (!inet_test_bit(RECVERR, sk))
454	return;
455
456	skb = alloc_skb(size: sizeof(struct iphdr), GFP_ATOMIC);
457	if (!skb)
458	return;
459
460	skb_put(skb, len: sizeof(struct iphdr));
461	skb_reset_network_header(skb);
462	iph = ip_hdr(skb);
463	iph->daddr = daddr;
464
465	serr = SKB_EXT_ERR(skb);
466	serr->ee.ee_errno = err;
467	serr->ee.ee_origin = SO_EE_ORIGIN_LOCAL;
468	serr->ee.ee_type = 0;
469	serr->ee.ee_code = 0;
470	serr->ee.ee_pad = 0;
471	serr->ee.ee_info = info;
472	serr->ee.ee_data = 0;
473	serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
474	serr->port = port;
475
476	__skb_pull(skb, len: skb_tail_pointer(skb) - skb->data);
477	skb_reset_transport_header(skb);
478
479	if (sock_queue_err_skb(sk, skb))
480	kfree_skb(skb);
481	}
482
483	/* For some errors we have valid addr_offset even with zero payload and
484	* zero port. Also, addr_offset should be supported if port is set.
485	*/
486	static inline bool ipv4_datagram_support_addr(struct sock_exterr_skb *serr)
487	{
488	return serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
489	serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL || serr->port;
490	}
491
492	/* IPv4 supports cmsg on all imcp errors and some timestamps
493	*
494	* Timestamp code paths do not initialize the fields expected by cmsg:
495	* the PKTINFO fields in skb->cb[]. Fill those in here.
496	*/
497	static bool ipv4_datagram_support_cmsg(const struct sock *sk,
498	struct sk_buff *skb,
499	int ee_origin)
500	{
501	struct in_pktinfo *info;
502
503	if (ee_origin == SO_EE_ORIGIN_ICMP)
504	return true;
505
506	if (ee_origin == SO_EE_ORIGIN_LOCAL)
507	return false;
508
509	/* Support IP_PKTINFO on tstamp packets if requested, to correlate
510	* timestamp with egress dev. Not possible for packets without iif
511	* or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
512	*/
513	info = PKTINFO_SKB_CB(skb);
514	if (!(READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_OPT_CMSG) ||
515	!info->ipi_ifindex)
516	return false;
517
518	info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
519	return true;
520	}
521
522	/*
523	* Handle MSG_ERRQUEUE
524	*/
525	int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
526	{
527	struct sock_exterr_skb *serr;
528	struct sk_buff *skb;
529	DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
530	struct {
531	struct sock_extended_err ee;
532	struct sockaddr_in offender;
533	} errhdr;
534	int err;
535	int copied;
536
537	err = -EAGAIN;
538	skb = sock_dequeue_err_skb(sk);
539	if (!skb)
540	goto out;
541
542	copied = skb->len;
543	if (copied > len) {
544	msg->msg_flags |= MSG_TRUNC;
545	copied = len;
546	}
547	err = skb_copy_datagram_msg(from: skb, offset: 0, msg, size: copied);
548	if (unlikely(err)) {
549	kfree_skb(skb);
550	return err;
551	}
552	sock_recv_timestamp(msg, sk, skb);
553
554	serr = SKB_EXT_ERR(skb);
555
556	if (sin && ipv4_datagram_support_addr(serr)) {
557	sin->sin_family = AF_INET;
558	sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
559	serr->addr_offset);
560	sin->sin_port = serr->port;
561	memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
562	*addr_len = sizeof(*sin);
563	}
564
565	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
566	sin = &errhdr.offender;
567	memset(sin, 0, sizeof(*sin));
568
569	if (ipv4_datagram_support_cmsg(sk, skb, ee_origin: serr->ee.ee_origin)) {
570	sin->sin_family = AF_INET;
571	sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
572	if (inet_cmsg_flags(inet_sk(sk)))
573	ip_cmsg_recv(msg, skb);
574	}
575
576	put_cmsg(msg, SOL_IP, IP_RECVERR, len: sizeof(errhdr), data: &errhdr);
577
578	/* Now we could try to dump offended packet options */
579
580	msg->msg_flags |= MSG_ERRQUEUE;
581	err = copied;
582
583	consume_skb(skb);
584	out:
585	return err;
586	}
587
588	void __ip_sock_set_tos(struct sock *sk, int val)
589	{
590	u8 old_tos = inet_sk(sk)->tos;
591
592	if (sk->sk_type == SOCK_STREAM) {
593	val &= ~INET_ECN_MASK;
594	val |= old_tos & INET_ECN_MASK;
595	}
596	if (old_tos != val) {
597	WRITE_ONCE(inet_sk(sk)->tos, val);
598	WRITE_ONCE(sk->sk_priority, rt_tos2priority(val));
599	sk_dst_reset(sk);
600	}
601	}
602
603	void ip_sock_set_tos(struct sock *sk, int val)
604	{
605	sockopt_lock_sock(sk);
606	__ip_sock_set_tos(sk, val);
607	sockopt_release_sock(sk);
608	}
609	EXPORT_SYMBOL(ip_sock_set_tos);
610
611	void ip_sock_set_freebind(struct sock *sk)
612	{
613	inet_set_bit(FREEBIND, sk);
614	}
615	EXPORT_SYMBOL(ip_sock_set_freebind);
616
617	void ip_sock_set_recverr(struct sock *sk)
618	{
619	inet_set_bit(RECVERR, sk);
620	}
621	EXPORT_SYMBOL(ip_sock_set_recverr);
622
623	int ip_sock_set_mtu_discover(struct sock *sk, int val)
624	{
625	if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_OMIT)
626	return -EINVAL;
627	WRITE_ONCE(inet_sk(sk)->pmtudisc, val);
628	return 0;
629	}
630	EXPORT_SYMBOL(ip_sock_set_mtu_discover);
631
632	void ip_sock_set_pktinfo(struct sock *sk)
633	{
634	inet_set_bit(PKTINFO, sk);
635	}
636	EXPORT_SYMBOL(ip_sock_set_pktinfo);
637
638	/*
639	* Socket option code for IP. This is the end of the line after any
640	* TCP,UDP etc options on an IP socket.
641	*/
642	static bool setsockopt_needs_rtnl(int optname)
643	{
644	switch (optname) {
645	case IP_ADD_MEMBERSHIP:
646	case IP_ADD_SOURCE_MEMBERSHIP:
647	case IP_BLOCK_SOURCE:
648	case IP_DROP_MEMBERSHIP:
649	case IP_DROP_SOURCE_MEMBERSHIP:
650	case IP_MSFILTER:
651	case IP_UNBLOCK_SOURCE:
652	case MCAST_BLOCK_SOURCE:
653	case MCAST_MSFILTER:
654	case MCAST_JOIN_GROUP:
655	case MCAST_JOIN_SOURCE_GROUP:
656	case MCAST_LEAVE_GROUP:
657	case MCAST_LEAVE_SOURCE_GROUP:
658	case MCAST_UNBLOCK_SOURCE:
659	return true;
660	}
661	return false;
662	}
663
664	static int set_mcast_msfilter(struct sock *sk, int ifindex,
665	int numsrc, int fmode,
666	struct sockaddr_storage *group,
667	struct sockaddr_storage *list)
668	{
669	struct ip_msfilter *msf;
670	struct sockaddr_in *psin;
671	int err, i;
672
673	msf = kmalloc(IP_MSFILTER_SIZE(numsrc), GFP_KERNEL);
674	if (!msf)
675	return -ENOBUFS;
676
677	psin = (struct sockaddr_in *)group;
678	if (psin->sin_family != AF_INET)
679	goto Eaddrnotavail;
680	msf->imsf_multiaddr = psin->sin_addr.s_addr;
681	msf->imsf_interface = 0;
682	msf->imsf_fmode = fmode;
683	msf->imsf_numsrc = numsrc;
684	for (i = 0; i < numsrc; ++i) {
685	psin = (struct sockaddr_in *)&list[i];
686
687	if (psin->sin_family != AF_INET)
688	goto Eaddrnotavail;
689	msf->imsf_slist_flex[i] = psin->sin_addr.s_addr;
690	}
691	err = ip_mc_msfilter(sk, msf, ifindex);
692	kfree(objp: msf);
693	return err;
694
695	Eaddrnotavail:
696	kfree(objp: msf);
697	return -EADDRNOTAVAIL;
698	}
699
700	static int copy_group_source_from_sockptr(struct group_source_req *greqs,
701	sockptr_t optval, int optlen)
702	{
703	if (in_compat_syscall()) {
704	struct compat_group_source_req gr32;
705
706	if (optlen != sizeof(gr32))
707	return -EINVAL;
708	if (copy_from_sockptr(dst: &gr32, src: optval, size: sizeof(gr32)))
709	return -EFAULT;
710	greqs->gsr_interface = gr32.gsr_interface;
711	greqs->gsr_group = gr32.gsr_group;
712	greqs->gsr_source = gr32.gsr_source;
713	} else {
714	if (optlen != sizeof(*greqs))
715	return -EINVAL;
716	if (copy_from_sockptr(dst: greqs, src: optval, size: sizeof(*greqs)))
717	return -EFAULT;
718	}
719
720	return 0;
721	}
722
723	static int do_mcast_group_source(struct sock *sk, int optname,
724	sockptr_t optval, int optlen)
725	{
726	struct group_source_req greqs;
727	struct ip_mreq_source mreqs;
728	struct sockaddr_in *psin;
729	int omode, add, err;
730
731	err = copy_group_source_from_sockptr(greqs: &greqs, optval, optlen);
732	if (err)
733	return err;
734
735	if (greqs.gsr_group.ss_family != AF_INET ||
736	greqs.gsr_source.ss_family != AF_INET)
737	return -EADDRNOTAVAIL;
738
739	psin = (struct sockaddr_in *)&greqs.gsr_group;
740	mreqs.imr_multiaddr = psin->sin_addr.s_addr;
741	psin = (struct sockaddr_in *)&greqs.gsr_source;
742	mreqs.imr_sourceaddr = psin->sin_addr.s_addr;
743	mreqs.imr_interface = 0; /* use index for mc_source */
744
745	if (optname == MCAST_BLOCK_SOURCE) {
746	omode = MCAST_EXCLUDE;
747	add = 1;
748	} else if (optname == MCAST_UNBLOCK_SOURCE) {
749	omode = MCAST_EXCLUDE;
750	add = 0;
751	} else if (optname == MCAST_JOIN_SOURCE_GROUP) {
752	struct ip_mreqn mreq;
753
754	psin = (struct sockaddr_in *)&greqs.gsr_group;
755	mreq.imr_multiaddr = psin->sin_addr;
756	mreq.imr_address.s_addr = 0;
757	mreq.imr_ifindex = greqs.gsr_interface;
758	err = ip_mc_join_group_ssm(sk, imr: &mreq, MCAST_INCLUDE);
759	if (err && err != -EADDRINUSE)
760	return err;
761	greqs.gsr_interface = mreq.imr_ifindex;
762	omode = MCAST_INCLUDE;
763	add = 1;
764	} else /* MCAST_LEAVE_SOURCE_GROUP */ {
765	omode = MCAST_INCLUDE;
766	add = 0;
767	}
768	return ip_mc_source(add, omode, sk, mreqs: &mreqs, ifindex: greqs.gsr_interface);
769	}
770
771	static int ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval, int optlen)
772	{
773	struct group_filter *gsf = NULL;
774	int err;
775
776	if (optlen < GROUP_FILTER_SIZE(0))
777	return -EINVAL;
778	if (optlen > READ_ONCE(sysctl_optmem_max))
779	return -ENOBUFS;
780
781	gsf = memdup_sockptr(src: optval, len: optlen);
782	if (IS_ERR(ptr: gsf))
783	return PTR_ERR(ptr: gsf);
784
785	/* numsrc >= (4G-140)/128 overflow in 32 bits */
786	err = -ENOBUFS;
787	if (gsf->gf_numsrc >= 0x1ffffff ||
788	gsf->gf_numsrc > READ_ONCE(sock_net(sk)->ipv4.sysctl_igmp_max_msf))
789	goto out_free_gsf;
790
791	err = -EINVAL;
792	if (GROUP_FILTER_SIZE(gsf->gf_numsrc) > optlen)
793	goto out_free_gsf;
794
795	err = set_mcast_msfilter(sk, ifindex: gsf->gf_interface, numsrc: gsf->gf_numsrc,
796	fmode: gsf->gf_fmode, group: &gsf->gf_group,
797	list: gsf->gf_slist_flex);
798	out_free_gsf:
799	kfree(objp: gsf);
800	return err;
801	}
802
803	static int compat_ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval,
804	int optlen)
805	{
806	const int size0 = offsetof(struct compat_group_filter, gf_slist_flex);
807	struct compat_group_filter *gf32;
808	unsigned int n;
809	void *p;
810	int err;
811
812	if (optlen < size0)
813	return -EINVAL;
814	if (optlen > READ_ONCE(sysctl_optmem_max) - 4)
815	return -ENOBUFS;
816
817	p = kmalloc(size: optlen + 4, GFP_KERNEL);
818	if (!p)
819	return -ENOMEM;
820	gf32 = p + 4; /* we want ->gf_group and ->gf_slist_flex aligned */
821
822	err = -EFAULT;
823	if (copy_from_sockptr(dst: gf32, src: optval, size: optlen))
824	goto out_free_gsf;
825
826	/* numsrc >= (4G-140)/128 overflow in 32 bits */
827	n = gf32->gf_numsrc;
828	err = -ENOBUFS;
829	if (n >= 0x1ffffff)
830	goto out_free_gsf;
831
832	err = -EINVAL;
833	if (offsetof(struct compat_group_filter, gf_slist_flex[n]) > optlen)
834	goto out_free_gsf;
835
836	/* numsrc >= (4G-140)/128 overflow in 32 bits */
837	err = -ENOBUFS;
838	if (n > READ_ONCE(sock_net(sk)->ipv4.sysctl_igmp_max_msf))
839	goto out_free_gsf;
840	err = set_mcast_msfilter(sk, ifindex: gf32->gf_interface, numsrc: n, fmode: gf32->gf_fmode,
841	group: &gf32->gf_group, list: gf32->gf_slist_flex);
842	out_free_gsf:
843	kfree(objp: p);
844	return err;
845	}
846
847	static int ip_mcast_join_leave(struct sock *sk, int optname,
848	sockptr_t optval, int optlen)
849	{
850	struct ip_mreqn mreq = { };
851	struct sockaddr_in *psin;
852	struct group_req greq;
853
854	if (optlen < sizeof(struct group_req))
855	return -EINVAL;
856	if (copy_from_sockptr(dst: &greq, src: optval, size: sizeof(greq)))
857	return -EFAULT;
858
859	psin = (struct sockaddr_in *)&greq.gr_group;
860	if (psin->sin_family != AF_INET)
861	return -EINVAL;
862	mreq.imr_multiaddr = psin->sin_addr;
863	mreq.imr_ifindex = greq.gr_interface;
864	if (optname == MCAST_JOIN_GROUP)
865	return ip_mc_join_group(sk, imr: &mreq);
866	return ip_mc_leave_group(sk, imr: &mreq);
867	}
868
869	static int compat_ip_mcast_join_leave(struct sock *sk, int optname,
870	sockptr_t optval, int optlen)
871	{
872	struct compat_group_req greq;
873	struct ip_mreqn mreq = { };
874	struct sockaddr_in *psin;
875
876	if (optlen < sizeof(struct compat_group_req))
877	return -EINVAL;
878	if (copy_from_sockptr(dst: &greq, src: optval, size: sizeof(greq)))
879	return -EFAULT;
880
881	psin = (struct sockaddr_in *)&greq.gr_group;
882	if (psin->sin_family != AF_INET)
883	return -EINVAL;
884	mreq.imr_multiaddr = psin->sin_addr;
885	mreq.imr_ifindex = greq.gr_interface;
886
887	if (optname == MCAST_JOIN_GROUP)
888	return ip_mc_join_group(sk, imr: &mreq);
889	return ip_mc_leave_group(sk, imr: &mreq);
890	}
891
892	DEFINE_STATIC_KEY_FALSE(ip4_min_ttl);
893
894	int do_ip_setsockopt(struct sock *sk, int level, int optname,
895	sockptr_t optval, unsigned int optlen)
896	{
897	struct inet_sock *inet = inet_sk(sk);
898	struct net *net = sock_net(sk);
899	int val = 0, err;
900	bool needs_rtnl = setsockopt_needs_rtnl(optname);
901
902	switch (optname) {
903	case IP_PKTINFO:
904	case IP_RECVTTL:
905	case IP_RECVOPTS:
906	case IP_RECVTOS:
907	case IP_RETOPTS:
908	case IP_TOS:
909	case IP_TTL:
910	case IP_HDRINCL:
911	case IP_MTU_DISCOVER:
912	case IP_RECVERR:
913	case IP_ROUTER_ALERT:
914	case IP_FREEBIND:
915	case IP_PASSSEC:
916	case IP_TRANSPARENT:
917	case IP_MINTTL:
918	case IP_NODEFRAG:
919	case IP_BIND_ADDRESS_NO_PORT:
920	case IP_UNICAST_IF:
921	case IP_MULTICAST_TTL:
922	case IP_MULTICAST_ALL:
923	case IP_MULTICAST_LOOP:
924	case IP_RECVORIGDSTADDR:
925	case IP_CHECKSUM:
926	case IP_RECVFRAGSIZE:
927	case IP_RECVERR_RFC4884:
928	case IP_LOCAL_PORT_RANGE:
929	if (optlen >= sizeof(int)) {
930	if (copy_from_sockptr(dst: &val, src: optval, size: sizeof(val)))
931	return -EFAULT;
932	} else if (optlen >= sizeof(char)) {
933	unsigned char ucval;
934
935	if (copy_from_sockptr(dst: &ucval, src: optval, size: sizeof(ucval)))
936	return -EFAULT;
937	val = (int) ucval;
938	}
939	}
940
941	/* If optlen==0, it is equivalent to val == 0 */
942
943	if (optname == IP_ROUTER_ALERT)
944	return ip_ra_control(sk, on: val ? 1 : 0, NULL);
945	if (ip_mroute_opt(opt: optname))
946	return ip_mroute_setsockopt(sk, optname, optval, optlen);
947
948	/* Handle options that can be set without locking the socket. */
949	switch (optname) {
950	case IP_PKTINFO:
951	inet_assign_bit(PKTINFO, sk, val);
952	return 0;
953	case IP_RECVTTL:
954	inet_assign_bit(TTL, sk, val);
955	return 0;
956	case IP_RECVTOS:
957	inet_assign_bit(TOS, sk, val);
958	return 0;
959	case IP_RECVOPTS:
960	inet_assign_bit(RECVOPTS, sk, val);
961	return 0;
962	case IP_RETOPTS:
963	inet_assign_bit(RETOPTS, sk, val);
964	return 0;
965	case IP_PASSSEC:
966	inet_assign_bit(PASSSEC, sk, val);
967	return 0;
968	case IP_RECVORIGDSTADDR:
969	inet_assign_bit(ORIGDSTADDR, sk, val);
970	return 0;
971	case IP_RECVFRAGSIZE:
972	if (sk->sk_type != SOCK_RAW && sk->sk_type != SOCK_DGRAM)
973	return -EINVAL;
974	inet_assign_bit(RECVFRAGSIZE, sk, val);
975	return 0;
976	case IP_RECVERR:
977	inet_assign_bit(RECVERR, sk, val);
978	if (!val)
979	skb_errqueue_purge(list: &sk->sk_error_queue);
980	return 0;
981	case IP_RECVERR_RFC4884:
982	if (val < 0 || val > 1)
983	return -EINVAL;
984	inet_assign_bit(RECVERR_RFC4884, sk, val);
985	return 0;
986	case IP_FREEBIND:
987	if (optlen < 1)
988	return -EINVAL;
989	inet_assign_bit(FREEBIND, sk, val);
990	return 0;
991	case IP_HDRINCL:
992	if (sk->sk_type != SOCK_RAW)
993	return -ENOPROTOOPT;
994	inet_assign_bit(HDRINCL, sk, val);
995	return 0;
996	case IP_MULTICAST_LOOP:
997	if (optlen < 1)
998	return -EINVAL;
999	inet_assign_bit(MC_LOOP, sk, val);
1000	return 0;
1001	case IP_MULTICAST_ALL:
1002	if (optlen < 1)
1003	return -EINVAL;
1004	if (val != 0 && val != 1)
1005	return -EINVAL;
1006	inet_assign_bit(MC_ALL, sk, val);
1007	return 0;
1008	case IP_TRANSPARENT:
1009	if (!!val && !sockopt_ns_capable(ns: sock_net(sk)->user_ns, CAP_NET_RAW) &&
1010	!sockopt_ns_capable(ns: sock_net(sk)->user_ns, CAP_NET_ADMIN))
1011	return -EPERM;
1012	if (optlen < 1)
1013	return -EINVAL;
1014	inet_assign_bit(TRANSPARENT, sk, val);
1015	return 0;
1016	case IP_NODEFRAG:
1017	if (sk->sk_type != SOCK_RAW)
1018	return -ENOPROTOOPT;
1019	inet_assign_bit(NODEFRAG, sk, val);
1020	return 0;
1021	case IP_BIND_ADDRESS_NO_PORT:
1022	inet_assign_bit(BIND_ADDRESS_NO_PORT, sk, val);
1023	return 0;
1024	case IP_TTL:
1025	if (optlen < 1)
1026	return -EINVAL;
1027	if (val != -1 && (val < 1 || val > 255))
1028	return -EINVAL;
1029	WRITE_ONCE(inet->uc_ttl, val);
1030	return 0;
1031	case IP_MINTTL:
1032	if (optlen < 1)
1033	return -EINVAL;
1034	if (val < 0 || val > 255)
1035	return -EINVAL;
1036
1037	if (val)
1038	static_branch_enable(&ip4_min_ttl);
1039
1040	WRITE_ONCE(inet->min_ttl, val);
1041	return 0;
1042	case IP_MULTICAST_TTL:
1043	if (sk->sk_type == SOCK_STREAM)
1044	return -EINVAL;
1045	if (optlen < 1)
1046	return -EINVAL;
1047	if (val == -1)
1048	val = 1;
1049	if (val < 0 || val > 255)
1050	return -EINVAL;
1051	WRITE_ONCE(inet->mc_ttl, val);
1052	return 0;
1053	case IP_MTU_DISCOVER:
1054	return ip_sock_set_mtu_discover(sk, val);
1055	case IP_TOS: /* This sets both TOS and Precedence */
1056	ip_sock_set_tos(sk, val);
1057	return 0;
1058	}
1059
1060	err = 0;
1061	if (needs_rtnl)
1062	rtnl_lock();
1063	sockopt_lock_sock(sk);
1064
1065	switch (optname) {
1066	case IP_OPTIONS:
1067	{
1068	struct ip_options_rcu *old, *opt = NULL;
1069
1070	if (optlen > 40)
1071	goto e_inval;
1072	err = ip_options_get(net: sock_net(sk), optp: &opt, data: optval, optlen);
1073	if (err)
1074	break;
1075	old = rcu_dereference_protected(inet->inet_opt,
1076	lockdep_sock_is_held(sk));
1077	if (inet_test_bit(IS_ICSK, sk)) {
1078	struct inet_connection_sock *icsk = inet_csk(sk);
1079	#if IS_ENABLED(CONFIG_IPV6)
1080	if (sk->sk_family == PF_INET ||
1081	(!((1 << sk->sk_state) &
1082	(TCPF_LISTEN | TCPF_CLOSE)) &&
1083	inet->inet_daddr != LOOPBACK4_IPV6)) {
1084	#endif
1085	if (old)
1086	icsk->icsk_ext_hdr_len -= old->opt.optlen;
1087	if (opt)
1088	icsk->icsk_ext_hdr_len += opt->opt.optlen;
1089	icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
1090	#if IS_ENABLED(CONFIG_IPV6)
1091	}
1092	#endif
1093	}
1094	rcu_assign_pointer(inet->inet_opt, opt);
1095	if (old)
1096	kfree_rcu(old, rcu);
1097	break;
1098	}
1099	case IP_CHECKSUM:
1100	if (val) {
1101	if (!(inet_test_bit(CHECKSUM, sk))) {
1102	inet_inc_convert_csum(sk);
1103	inet_set_bit(CHECKSUM, sk);
1104	}
1105	} else {
1106	if (inet_test_bit(CHECKSUM, sk)) {
1107	inet_dec_convert_csum(sk);
1108	inet_clear_bit(CHECKSUM, sk);
1109	}
1110	}
1111	break;
1112	case IP_UNICAST_IF:
1113	{
1114	struct net_device *dev = NULL;
1115	int ifindex;
1116	int midx;
1117
1118	if (optlen != sizeof(int))
1119	goto e_inval;
1120
1121	ifindex = (__force int)ntohl((__force __be32)val);
1122	if (ifindex == 0) {
1123	WRITE_ONCE(inet->uc_index, 0);
1124	err = 0;
1125	break;
1126	}
1127
1128	dev = dev_get_by_index(net: sock_net(sk), ifindex);
1129	err = -EADDRNOTAVAIL;
1130	if (!dev)
1131	break;
1132
1133	midx = l3mdev_master_ifindex(dev);
1134	dev_put(dev);
1135
1136	err = -EINVAL;
1137	if (sk->sk_bound_dev_if && midx != sk->sk_bound_dev_if)
1138	break;
1139
1140	WRITE_ONCE(inet->uc_index, ifindex);
1141	err = 0;
1142	break;
1143	}
1144	case IP_MULTICAST_IF:
1145	{
1146	struct ip_mreqn mreq;
1147	struct net_device *dev = NULL;
1148	int midx;
1149
1150	if (sk->sk_type == SOCK_STREAM)
1151	goto e_inval;
1152	/*
1153	* Check the arguments are allowable
1154	*/
1155
1156	if (optlen < sizeof(struct in_addr))
1157	goto e_inval;
1158
1159	err = -EFAULT;
1160	if (optlen >= sizeof(struct ip_mreqn)) {
1161	if (copy_from_sockptr(dst: &mreq, src: optval, size: sizeof(mreq)))
1162	break;
1163	} else {
1164	memset(&mreq, 0, sizeof(mreq));
1165	if (optlen >= sizeof(struct ip_mreq)) {
1166	if (copy_from_sockptr(dst: &mreq, src: optval,
1167	size: sizeof(struct ip_mreq)))
1168	break;
1169	} else if (optlen >= sizeof(struct in_addr)) {
1170	if (copy_from_sockptr(dst: &mreq.imr_address, src: optval,
1171	size: sizeof(struct in_addr)))
1172	break;
1173	}
1174	}
1175
1176	if (!mreq.imr_ifindex) {
1177	if (mreq.imr_address.s_addr == htonl(INADDR_ANY)) {
1178	WRITE_ONCE(inet->mc_index, 0);
1179	WRITE_ONCE(inet->mc_addr, 0);
1180	err = 0;
1181	break;
1182	}
1183	dev = ip_dev_find(net: sock_net(sk), addr: mreq.imr_address.s_addr);
1184	if (dev)
1185	mreq.imr_ifindex = dev->ifindex;
1186	} else
1187	dev = dev_get_by_index(net: sock_net(sk), ifindex: mreq.imr_ifindex);
1188
1189
1190	err = -EADDRNOTAVAIL;
1191	if (!dev)
1192	break;
1193
1194	midx = l3mdev_master_ifindex(dev);
1195
1196	dev_put(dev);
1197
1198	err = -EINVAL;
1199	if (sk->sk_bound_dev_if &&
1200	mreq.imr_ifindex != sk->sk_bound_dev_if &&
1201	midx != sk->sk_bound_dev_if)
1202	break;
1203
1204	WRITE_ONCE(inet->mc_index, mreq.imr_ifindex);
1205	WRITE_ONCE(inet->mc_addr, mreq.imr_address.s_addr);
1206	err = 0;
1207	break;
1208	}
1209
1210	case IP_ADD_MEMBERSHIP:
1211	case IP_DROP_MEMBERSHIP:
1212	{
1213	struct ip_mreqn mreq;
1214
1215	err = -EPROTO;
1216	if (inet_test_bit(IS_ICSK, sk))
1217	break;
1218
1219	if (optlen < sizeof(struct ip_mreq))
1220	goto e_inval;
1221	err = -EFAULT;
1222	if (optlen >= sizeof(struct ip_mreqn)) {
1223	if (copy_from_sockptr(dst: &mreq, src: optval, size: sizeof(mreq)))
1224	break;
1225	} else {
1226	memset(&mreq, 0, sizeof(mreq));
1227	if (copy_from_sockptr(dst: &mreq, src: optval,
1228	size: sizeof(struct ip_mreq)))
1229	break;
1230	}
1231
1232	if (optname == IP_ADD_MEMBERSHIP)
1233	err = ip_mc_join_group(sk, imr: &mreq);
1234	else
1235	err = ip_mc_leave_group(sk, imr: &mreq);
1236	break;
1237	}
1238	case IP_MSFILTER:
1239	{
1240	struct ip_msfilter *msf;
1241
1242	if (optlen < IP_MSFILTER_SIZE(0))
1243	goto e_inval;
1244	if (optlen > READ_ONCE(sysctl_optmem_max)) {
1245	err = -ENOBUFS;
1246	break;
1247	}
1248	msf = memdup_sockptr(src: optval, len: optlen);
1249	if (IS_ERR(ptr: msf)) {
1250	err = PTR_ERR(ptr: msf);
1251	break;
1252	}
1253	/* numsrc >= (1G-4) overflow in 32 bits */
1254	if (msf->imsf_numsrc >= 0x3ffffffcU ||
1255	msf->imsf_numsrc > READ_ONCE(net->ipv4.sysctl_igmp_max_msf)) {
1256	kfree(objp: msf);
1257	err = -ENOBUFS;
1258	break;
1259	}
1260	if (IP_MSFILTER_SIZE(msf->imsf_numsrc) > optlen) {
1261	kfree(objp: msf);
1262	err = -EINVAL;
1263	break;
1264	}
1265	err = ip_mc_msfilter(sk, msf, ifindex: 0);
1266	kfree(objp: msf);
1267	break;
1268	}
1269	case IP_BLOCK_SOURCE:
1270	case IP_UNBLOCK_SOURCE:
1271	case IP_ADD_SOURCE_MEMBERSHIP:
1272	case IP_DROP_SOURCE_MEMBERSHIP:
1273	{
1274	struct ip_mreq_source mreqs;
1275	int omode, add;
1276
1277	if (optlen != sizeof(struct ip_mreq_source))
1278	goto e_inval;
1279	if (copy_from_sockptr(dst: &mreqs, src: optval, size: sizeof(mreqs))) {
1280	err = -EFAULT;
1281	break;
1282	}
1283	if (optname == IP_BLOCK_SOURCE) {
1284	omode = MCAST_EXCLUDE;
1285	add = 1;
1286	} else if (optname == IP_UNBLOCK_SOURCE) {
1287	omode = MCAST_EXCLUDE;
1288	add = 0;
1289	} else if (optname == IP_ADD_SOURCE_MEMBERSHIP) {
1290	struct ip_mreqn mreq;
1291
1292	mreq.imr_multiaddr.s_addr = mreqs.imr_multiaddr;
1293	mreq.imr_address.s_addr = mreqs.imr_interface;
1294	mreq.imr_ifindex = 0;
1295	err = ip_mc_join_group_ssm(sk, imr: &mreq, MCAST_INCLUDE);
1296	if (err && err != -EADDRINUSE)
1297	break;
1298	omode = MCAST_INCLUDE;
1299	add = 1;
1300	} else /* IP_DROP_SOURCE_MEMBERSHIP */ {
1301	omode = MCAST_INCLUDE;
1302	add = 0;
1303	}
1304	err = ip_mc_source(add, omode, sk, mreqs: &mreqs, ifindex: 0);
1305	break;
1306	}
1307	case MCAST_JOIN_GROUP:
1308	case MCAST_LEAVE_GROUP:
1309	if (in_compat_syscall())
1310	err = compat_ip_mcast_join_leave(sk, optname, optval,
1311	optlen);
1312	else
1313	err = ip_mcast_join_leave(sk, optname, optval, optlen);
1314	break;
1315	case MCAST_JOIN_SOURCE_GROUP:
1316	case MCAST_LEAVE_SOURCE_GROUP:
1317	case MCAST_BLOCK_SOURCE:
1318	case MCAST_UNBLOCK_SOURCE:
1319	err = do_mcast_group_source(sk, optname, optval, optlen);
1320	break;
1321	case MCAST_MSFILTER:
1322	if (in_compat_syscall())
1323	err = compat_ip_set_mcast_msfilter(sk, optval, optlen);
1324	else
1325	err = ip_set_mcast_msfilter(sk, optval, optlen);
1326	break;
1327	case IP_IPSEC_POLICY:
1328	case IP_XFRM_POLICY:
1329	err = -EPERM;
1330	if (!sockopt_ns_capable(ns: sock_net(sk)->user_ns, CAP_NET_ADMIN))
1331	break;
1332	err = xfrm_user_policy(sk, optname, optval, optlen);
1333	break;
1334
1335	case IP_LOCAL_PORT_RANGE:
1336	{
1337	const __u16 lo = val;
1338	const __u16 hi = val >> 16;
1339
1340	if (optlen != sizeof(__u32))
1341	goto e_inval;
1342	if (lo != 0 && hi != 0 && lo > hi)
1343	goto e_inval;
1344
1345	inet->local_port_range.lo = lo;
1346	inet->local_port_range.hi = hi;
1347	break;
1348	}
1349	default:
1350	err = -ENOPROTOOPT;
1351	break;
1352	}
1353	sockopt_release_sock(sk);
1354	if (needs_rtnl)
1355	rtnl_unlock();
1356	return err;
1357
1358	e_inval:
1359	sockopt_release_sock(sk);
1360	if (needs_rtnl)
1361	rtnl_unlock();
1362	return -EINVAL;
1363	}
1364
1365	/**
1366	* ipv4_pktinfo_prepare - transfer some info from rtable to skb
1367	* @sk: socket
1368	* @skb: buffer
1369	*
1370	* To support IP_CMSG_PKTINFO option, we store rt_iif and specific
1371	* destination in skb->cb[] before dst drop.
1372	* This way, receiver doesn't make cache line misses to read rtable.
1373	*/
1374	void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
1375	{
1376	struct in_pktinfo *pktinfo = PKTINFO_SKB_CB(skb);
1377	bool prepare = inet_test_bit(PKTINFO, sk) ||
1378	ipv6_sk_rxinfo(sk);
1379
1380	if (prepare && skb_rtable(skb)) {
1381	/* skb->cb is overloaded: prior to this point it is IP{6}CB
1382	* which has interface index (iif) as the first member of the
1383	* underlying inet{6}_skb_parm struct. This code then overlays
1384	* PKTINFO_SKB_CB and in_pktinfo also has iif as the first
1385	* element so the iif is picked up from the prior IPCB. If iif
1386	* is the loopback interface, then return the sending interface
1387	* (e.g., process binds socket to eth0 for Tx which is
1388	* redirected to loopback in the rtable/dst).
1389	*/
1390	struct rtable *rt = skb_rtable(skb);
1391	bool l3slave = ipv4_l3mdev_skb(IPCB(skb)->flags);
1392
1393	if (pktinfo->ipi_ifindex == LOOPBACK_IFINDEX)
1394	pktinfo->ipi_ifindex = inet_iif(skb);
1395	else if (l3slave && rt && rt->rt_iif)
1396	pktinfo->ipi_ifindex = rt->rt_iif;
1397
1398	pktinfo->ipi_spec_dst.s_addr = fib_compute_spec_dst(skb);
1399	} else {
1400	pktinfo->ipi_ifindex = 0;
1401	pktinfo->ipi_spec_dst.s_addr = 0;
1402	}
1403	skb_dst_drop(skb);
1404	}
1405
1406	int ip_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
1407	unsigned int optlen)
1408	{
1409	int err;
1410
1411	if (level != SOL_IP)
1412	return -ENOPROTOOPT;
1413
1414	err = do_ip_setsockopt(sk, level, optname, optval, optlen);
1415	#if IS_ENABLED(CONFIG_BPFILTER_UMH)
1416	if (optname >= BPFILTER_IPT_SO_SET_REPLACE &&
1417	optname < BPFILTER_IPT_SET_MAX)
1418	err = bpfilter_ip_set_sockopt(sk, optname, optval, optlen);
1419	#endif
1420	#ifdef CONFIG_NETFILTER
1421	/* we need to exclude all possible ENOPROTOOPTs except default case */
1422	if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
1423	optname != IP_IPSEC_POLICY &&
1424	optname != IP_XFRM_POLICY &&
1425	!ip_mroute_opt(opt: optname))
1426	err = nf_setsockopt(sk, PF_INET, optval: optname, opt: optval, len: optlen);
1427	#endif
1428	return err;
1429	}
1430	EXPORT_SYMBOL(ip_setsockopt);
1431
1432	/*
1433	* Get the options. Note for future reference. The GET of IP options gets
1434	* the _received_ ones. The set sets the _sent_ ones.
1435	*/
1436
1437	static bool getsockopt_needs_rtnl(int optname)
1438	{
1439	switch (optname) {
1440	case IP_MSFILTER:
1441	case MCAST_MSFILTER:
1442	return true;
1443	}
1444	return false;
1445	}
1446
1447	static int ip_get_mcast_msfilter(struct sock *sk, sockptr_t optval,
1448	sockptr_t optlen, int len)
1449	{
1450	const int size0 = offsetof(struct group_filter, gf_slist_flex);
1451	struct group_filter gsf;
1452	int num, gsf_size;
1453	int err;
1454
1455	if (len < size0)
1456	return -EINVAL;
1457	if (copy_from_sockptr(dst: &gsf, src: optval, size: size0))
1458	return -EFAULT;
1459
1460	num = gsf.gf_numsrc;
1461	err = ip_mc_gsfget(sk, gsf: &gsf, optval,
1462	offsetof(struct group_filter, gf_slist_flex));
1463	if (err)
1464	return err;
1465	if (gsf.gf_numsrc < num)
1466	num = gsf.gf_numsrc;
1467	gsf_size = GROUP_FILTER_SIZE(num);
1468	if (copy_to_sockptr(dst: optlen, src: &gsf_size, size: sizeof(int)) ||
1469	copy_to_sockptr(dst: optval, src: &gsf, size: size0))
1470	return -EFAULT;
1471	return 0;
1472	}
1473
1474	static int compat_ip_get_mcast_msfilter(struct sock *sk, sockptr_t optval,
1475	sockptr_t optlen, int len)
1476	{
1477	const int size0 = offsetof(struct compat_group_filter, gf_slist_flex);
1478	struct compat_group_filter gf32;
1479	struct group_filter gf;
1480	int num;
1481	int err;
1482
1483	if (len < size0)
1484	return -EINVAL;
1485	if (copy_from_sockptr(dst: &gf32, src: optval, size: size0))
1486	return -EFAULT;
1487
1488	gf.gf_interface = gf32.gf_interface;
1489	gf.gf_fmode = gf32.gf_fmode;
1490	num = gf.gf_numsrc = gf32.gf_numsrc;
1491	gf.gf_group = gf32.gf_group;
1492
1493	err = ip_mc_gsfget(sk, gsf: &gf, optval,
1494	offsetof(struct compat_group_filter, gf_slist_flex));
1495	if (err)
1496	return err;
1497	if (gf.gf_numsrc < num)
1498	num = gf.gf_numsrc;
1499	len = GROUP_FILTER_SIZE(num) - (sizeof(gf) - sizeof(gf32));
1500	if (copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int)) ||
1501	copy_to_sockptr_offset(dst: optval, offsetof(struct compat_group_filter, gf_fmode),
1502	src: &gf.gf_fmode, size: sizeof(gf.gf_fmode)) ||
1503	copy_to_sockptr_offset(dst: optval, offsetof(struct compat_group_filter, gf_numsrc),
1504	src: &gf.gf_numsrc, size: sizeof(gf.gf_numsrc)))
1505	return -EFAULT;
1506	return 0;
1507	}
1508
1509	int do_ip_getsockopt(struct sock *sk, int level, int optname,
1510	sockptr_t optval, sockptr_t optlen)
1511	{
1512	struct inet_sock *inet = inet_sk(sk);
1513	bool needs_rtnl = getsockopt_needs_rtnl(optname);
1514	int val, err = 0;
1515	int len;
1516
1517	if (level != SOL_IP)
1518	return -EOPNOTSUPP;
1519
1520	if (ip_mroute_opt(opt: optname))
1521	return ip_mroute_getsockopt(sk, optname, optval, optlen);
1522
1523	if (copy_from_sockptr(dst: &len, src: optlen, size: sizeof(int)))
1524	return -EFAULT;
1525	if (len < 0)
1526	return -EINVAL;
1527
1528	/* Handle options that can be read without locking the socket. */
1529	switch (optname) {
1530	case IP_PKTINFO:
1531	val = inet_test_bit(PKTINFO, sk);
1532	goto copyval;
1533	case IP_RECVTTL:
1534	val = inet_test_bit(TTL, sk);
1535	goto copyval;
1536	case IP_RECVTOS:
1537	val = inet_test_bit(TOS, sk);
1538	goto copyval;
1539	case IP_RECVOPTS:
1540	val = inet_test_bit(RECVOPTS, sk);
1541	goto copyval;
1542	case IP_RETOPTS:
1543	val = inet_test_bit(RETOPTS, sk);
1544	goto copyval;
1545	case IP_PASSSEC:
1546	val = inet_test_bit(PASSSEC, sk);
1547	goto copyval;
1548	case IP_RECVORIGDSTADDR:
1549	val = inet_test_bit(ORIGDSTADDR, sk);
1550	goto copyval;
1551	case IP_CHECKSUM:
1552	val = inet_test_bit(CHECKSUM, sk);
1553	goto copyval;
1554	case IP_RECVFRAGSIZE:
1555	val = inet_test_bit(RECVFRAGSIZE, sk);
1556	goto copyval;
1557	case IP_RECVERR:
1558	val = inet_test_bit(RECVERR, sk);
1559	goto copyval;
1560	case IP_RECVERR_RFC4884:
1561	val = inet_test_bit(RECVERR_RFC4884, sk);
1562	goto copyval;
1563	case IP_FREEBIND:
1564	val = inet_test_bit(FREEBIND, sk);
1565	goto copyval;
1566	case IP_HDRINCL:
1567	val = inet_test_bit(HDRINCL, sk);
1568	goto copyval;
1569	case IP_MULTICAST_LOOP:
1570	val = inet_test_bit(MC_LOOP, sk);
1571	goto copyval;
1572	case IP_MULTICAST_ALL:
1573	val = inet_test_bit(MC_ALL, sk);
1574	goto copyval;
1575	case IP_TRANSPARENT:
1576	val = inet_test_bit(TRANSPARENT, sk);
1577	goto copyval;
1578	case IP_NODEFRAG:
1579	val = inet_test_bit(NODEFRAG, sk);
1580	goto copyval;
1581	case IP_BIND_ADDRESS_NO_PORT:
1582	val = inet_test_bit(BIND_ADDRESS_NO_PORT, sk);
1583	goto copyval;
1584	case IP_TTL:
1585	val = READ_ONCE(inet->uc_ttl);
1586	if (val < 0)
1587	val = READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_default_ttl);
1588	goto copyval;
1589	case IP_MINTTL:
1590	val = READ_ONCE(inet->min_ttl);
1591	goto copyval;
1592	case IP_MULTICAST_TTL:
1593	val = READ_ONCE(inet->mc_ttl);
1594	goto copyval;
1595	case IP_MTU_DISCOVER:
1596	val = READ_ONCE(inet->pmtudisc);
1597	goto copyval;
1598	case IP_TOS:
1599	val = READ_ONCE(inet->tos);
1600	goto copyval;
1601	case IP_OPTIONS:
1602	{
1603	unsigned char optbuf[sizeof(struct ip_options)+40];
1604	struct ip_options *opt = (struct ip_options *)optbuf;
1605	struct ip_options_rcu *inet_opt;
1606
1607	rcu_read_lock();
1608	inet_opt = rcu_dereference(inet->inet_opt);
1609	opt->optlen = 0;
1610	if (inet_opt)
1611	memcpy(optbuf, &inet_opt->opt,
1612	sizeof(struct ip_options) +
1613	inet_opt->opt.optlen);
1614	rcu_read_unlock();
1615
1616	if (opt->optlen == 0) {
1617	len = 0;
1618	return copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int));
1619	}
1620
1621	ip_options_undo(opt);
1622
1623	len = min_t(unsigned int, len, opt->optlen);
1624	if (copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int)))
1625	return -EFAULT;
1626	if (copy_to_sockptr(dst: optval, src: opt->__data, size: len))
1627	return -EFAULT;
1628	return 0;
1629	}
1630	case IP_MTU:
1631	{
1632	struct dst_entry *dst;
1633	val = 0;
1634	dst = sk_dst_get(sk);
1635	if (dst) {
1636	val = dst_mtu(dst);
1637	dst_release(dst);
1638	}
1639	if (!val)
1640	return -ENOTCONN;
1641	goto copyval;
1642	}
1643	case IP_PKTOPTIONS:
1644	{
1645	struct msghdr msg;
1646
1647	if (sk->sk_type != SOCK_STREAM)
1648	return -ENOPROTOOPT;
1649
1650	if (optval.is_kernel) {
1651	msg.msg_control_is_user = false;
1652	msg.msg_control = optval.kernel;
1653	} else {
1654	msg.msg_control_is_user = true;
1655	msg.msg_control_user = optval.user;
1656	}
1657	msg.msg_controllen = len;
1658	msg.msg_flags = in_compat_syscall() ? MSG_CMSG_COMPAT : 0;
1659
1660	if (inet_test_bit(PKTINFO, sk)) {
1661	struct in_pktinfo info;
1662
1663	info.ipi_addr.s_addr = READ_ONCE(inet->inet_rcv_saddr);
1664	info.ipi_spec_dst.s_addr = READ_ONCE(inet->inet_rcv_saddr);
1665	info.ipi_ifindex = READ_ONCE(inet->mc_index);
1666	put_cmsg(&msg, SOL_IP, IP_PKTINFO, len: sizeof(info), data: &info);
1667	}
1668	if (inet_test_bit(TTL, sk)) {
1669	int hlim = READ_ONCE(inet->mc_ttl);
1670
1671	put_cmsg(&msg, SOL_IP, IP_TTL, len: sizeof(hlim), data: &hlim);
1672	}
1673	if (inet_test_bit(TOS, sk)) {
1674	int tos = READ_ONCE(inet->rcv_tos);
1675	put_cmsg(&msg, SOL_IP, IP_TOS, len: sizeof(tos), data: &tos);
1676	}
1677	len -= msg.msg_controllen;
1678	return copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int));
1679	}
1680	case IP_UNICAST_IF:
1681	val = (__force int)htonl((__u32) READ_ONCE(inet->uc_index));
1682	goto copyval;
1683	case IP_MULTICAST_IF:
1684	{
1685	struct in_addr addr;
1686	len = min_t(unsigned int, len, sizeof(struct in_addr));
1687	addr.s_addr = READ_ONCE(inet->mc_addr);
1688
1689	if (copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int)))
1690	return -EFAULT;
1691	if (copy_to_sockptr(dst: optval, src: &addr, size: len))
1692	return -EFAULT;
1693	return 0;
1694	}
1695	}
1696
1697	if (needs_rtnl)
1698	rtnl_lock();
1699	sockopt_lock_sock(sk);
1700
1701	switch (optname) {
1702	case IP_MSFILTER:
1703	{
1704	struct ip_msfilter msf;
1705
1706	if (len < IP_MSFILTER_SIZE(0)) {
1707	err = -EINVAL;
1708	goto out;
1709	}
1710	if (copy_from_sockptr(dst: &msf, src: optval, IP_MSFILTER_SIZE(0))) {
1711	err = -EFAULT;
1712	goto out;
1713	}
1714	err = ip_mc_msfget(sk, msf: &msf, optval, optlen);
1715	goto out;
1716	}
1717	case MCAST_MSFILTER:
1718	if (in_compat_syscall())
1719	err = compat_ip_get_mcast_msfilter(sk, optval, optlen,
1720	len);
1721	else
1722	err = ip_get_mcast_msfilter(sk, optval, optlen, len);
1723	goto out;
1724	case IP_LOCAL_PORT_RANGE:
1725	val = inet->local_port_range.hi << 16 | inet->local_port_range.lo;
1726	break;
1727	case IP_PROTOCOL:
1728	val = inet_sk(sk)->inet_num;
1729	break;
1730	default:
1731	sockopt_release_sock(sk);
1732	return -ENOPROTOOPT;
1733	}
1734	sockopt_release_sock(sk);
1735	copyval:
1736	if (len < sizeof(int) && len > 0 && val >= 0 && val <= 255) {
1737	unsigned char ucval = (unsigned char)val;
1738	len = 1;
1739	if (copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int)))
1740	return -EFAULT;
1741	if (copy_to_sockptr(dst: optval, src: &ucval, size: 1))
1742	return -EFAULT;
1743	} else {
1744	len = min_t(unsigned int, sizeof(int), len);
1745	if (copy_to_sockptr(dst: optlen, src: &len, size: sizeof(int)))
1746	return -EFAULT;
1747	if (copy_to_sockptr(dst: optval, src: &val, size: len))
1748	return -EFAULT;
1749	}
1750	return 0;
1751
1752	out:
1753	sockopt_release_sock(sk);
1754	if (needs_rtnl)
1755	rtnl_unlock();
1756	return err;
1757	}
1758
1759	int ip_getsockopt(struct sock *sk, int level,
1760	int optname, char __user *optval, int __user *optlen)
1761	{
1762	int err;
1763
1764	err = do_ip_getsockopt(sk, level, optname,
1765	optval: USER_SOCKPTR(p: optval), optlen: USER_SOCKPTR(p: optlen));
1766
1767	#if IS_ENABLED(CONFIG_BPFILTER_UMH)
1768	if (optname >= BPFILTER_IPT_SO_GET_INFO &&
1769	optname < BPFILTER_IPT_GET_MAX)
1770	err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);
1771	#endif
1772	#ifdef CONFIG_NETFILTER
1773	/* we need to exclude all possible ENOPROTOOPTs except default case */
1774	if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
1775	!ip_mroute_opt(opt: optname)) {
1776	int len;
1777
1778	if (get_user(len, optlen))
1779	return -EFAULT;
1780
1781	err = nf_getsockopt(sk, PF_INET, optval: optname, opt: optval, len: &len);
1782	if (err >= 0)
1783	err = put_user(len, optlen);
1784	return err;
1785	}
1786	#endif
1787	return err;
1788	}
1789	EXPORT_SYMBOL(ip_getsockopt);
1790