1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* scm.c - Socket level control messages processing.
50 	kuid_t uid = make_kuid(cred->user_ns, creds->uid);  in scm_check_creds()
51 	kgid_t gid = make_kgid(cred->user_ns, creds->gid);  in scm_check_creds()
54 		return -EINVAL;  in scm_check_creds()
56 	if ((creds->pid == task_tgid_vnr(current) ||  in scm_check_creds()
57 	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&  in scm_check_creds()
58 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||  in scm_check_creds()
59 	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&  in scm_check_creds()
60 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||  in scm_check_creds()
61 	      gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {  in scm_check_creds()
64 	return -EPERM;  in scm_check_creds()
74 	num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);  in scm_fp_copy()
80 		return -EINVAL;  in scm_fp_copy()
86 			return -ENOMEM;  in scm_fp_copy()
88 		fpl->count = 0;  in scm_fp_copy()
89 		fpl->count_unix = 0;  in scm_fp_copy()
90 		fpl->max = SCM_MAX_FD;  in scm_fp_copy()
91 		fpl->user = NULL;  in scm_fp_copy()
93 		fpl->inflight = false;  in scm_fp_copy()
94 		fpl->dead = false;  in scm_fp_copy()
95 		fpl->edges = NULL;  in scm_fp_copy()
96 		INIT_LIST_HEAD(&fpl->vertices);  in scm_fp_copy()
99 	fpp = &fpl->fp[fpl->count];  in scm_fp_copy()
101 	if (fpl->count + num > fpl->max)  in scm_fp_copy()
102 		return -EINVAL;  in scm_fp_copy()
114 			return -EBADF;  in scm_fp_copy()
118 			return -EINVAL;  in scm_fp_copy()
121 			fpl->count_unix++;  in scm_fp_copy()
124 		fpl->count++;  in scm_fp_copy()
127 	if (!fpl->user)  in scm_fp_copy()
128 		fpl->user = get_uid(current_user());  in scm_fp_copy()
135 	struct scm_fp_list *fpl = scm->fp;  in __scm_destroy()
139 		scm->fp = NULL;  in __scm_destroy()
140 		for (i=fpl->count-1; i>=0; i--)  in __scm_destroy()
141 			fput(fpl->fp[i]);  in __scm_destroy()
142 		free_uid(fpl->user);  in __scm_destroy()
148 int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)  in __scm_send()  argument
150 	const struct proto_ops *ops = READ_ONCE(sock->ops);  in __scm_send()
154 	for_each_cmsghdr(cmsg, msg) {  in __scm_send()
155 		err = -EINVAL;  in __scm_send()
165 		if (!CMSG_OK(msg, cmsg))  in __scm_send()
168 		if (cmsg->cmsg_level != SOL_SOCKET)  in __scm_send()
171 		switch (cmsg->cmsg_type)  in __scm_send()
174 			if (!ops || ops->family != PF_UNIX)  in __scm_send()
176 			err=scm_fp_copy(cmsg, &p->fp);  in __scm_send()
185 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))  in __scm_send()
192 			p->creds.pid = creds.pid;  in __scm_send()
193 			if (!p->pid || pid_vnr(p->pid) != creds.pid) {  in __scm_send()
195 				err = -ESRCH;  in __scm_send()
199 				put_pid(p->pid);  in __scm_send()
200 				p->pid = pid;  in __scm_send()
203 			err = -EINVAL;  in __scm_send()
209 			p->creds.uid = uid;  in __scm_send()
210 			p->creds.gid = gid;  in __scm_send()
218 	if (p->fp && !p->fp->count)  in __scm_send()
220 		kfree(p->fp);  in __scm_send()
221 		p->fp = NULL;  in __scm_send()
231 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)  in put_cmsg()  argument
235 	if (msg->msg_flags & MSG_CMSG_COMPAT)  in put_cmsg()
236 		return put_cmsg_compat(msg, level, type, len, data);  in put_cmsg()
238 	if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) {  in put_cmsg()
239 		msg->msg_flags |= MSG_CTRUNC;  in put_cmsg()
242 	if (msg->msg_controllen < cmlen) {  in put_cmsg()
243 		msg->msg_flags |= MSG_CTRUNC;  in put_cmsg()
244 		cmlen = msg->msg_controllen;  in put_cmsg()
247 	if (msg->msg_control_is_user) {  in put_cmsg()
248 		struct cmsghdr __user *cm = msg->msg_control_user;  in put_cmsg()
250 		check_object_size(data, cmlen - sizeof(*cm), true);  in put_cmsg()
255 		unsafe_put_user(cmlen, &cm->cmsg_len, efault_end);  in put_cmsg()
256 		unsafe_put_user(level, &cm->cmsg_level, efault_end);  in put_cmsg()
257 		unsafe_put_user(type, &cm->cmsg_type, efault_end);  in put_cmsg()
259 				    cmlen - sizeof(*cm), efault_end);  in put_cmsg()
262 		struct cmsghdr *cm = msg->msg_control;  in put_cmsg()
264 		cm->cmsg_level = level;  in put_cmsg()
265 		cm->cmsg_type = type;  in put_cmsg()
266 		cm->cmsg_len = cmlen;  in put_cmsg()
267 		memcpy(CMSG_DATA(cm), data, cmlen - sizeof(*cm));  in put_cmsg()
270 	cmlen = min(CMSG_SPACE(len), msg->msg_controllen);  in put_cmsg()
271 	if (msg->msg_control_is_user)  in put_cmsg()
272 		msg->msg_control_user += cmlen;  in put_cmsg()
274 		msg->msg_control += cmlen;  in put_cmsg()
275 	msg->msg_controllen -= cmlen;  in put_cmsg()
281 	return -EFAULT;  in put_cmsg()
285 int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len,  in put_cmsg_notrunc()  argument
289 	if (!msg->msg_control || msg->msg_controllen < CMSG_LEN(len))  in put_cmsg_notrunc()
290 		return -ETOOSMALL;  in put_cmsg_notrunc()
292 	return put_cmsg(msg, level, type, len, data);  in put_cmsg_notrunc()
295 void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)  in put_cmsg_scm_timestamping64()  argument
301 		tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;  in put_cmsg_scm_timestamping64()
302 		tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;  in put_cmsg_scm_timestamping64()
305 	put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss);  in put_cmsg_scm_timestamping64()
309 void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)  in put_cmsg_scm_timestamping()  argument
315 		tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;  in put_cmsg_scm_timestamping()
316 		tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;  in put_cmsg_scm_timestamping()
319 	put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss);  in put_cmsg_scm_timestamping()
323 static int scm_max_fds(struct msghdr *msg)  in scm_max_fds()  argument
325 	if (msg->msg_controllen <= sizeof(struct cmsghdr))  in scm_max_fds()
327 	return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);  in scm_max_fds()
330 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)  in scm_detach_fds()  argument
333 		(__force struct cmsghdr __user *)msg->msg_control_user;  in scm_detach_fds()
334 	unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;  in scm_detach_fds()
335 	int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count);  in scm_detach_fds()
340 	if (WARN_ON_ONCE(!msg->msg_control_is_user))  in scm_detach_fds()
343 	if (msg->msg_flags & MSG_CMSG_COMPAT) {  in scm_detach_fds()
344 		scm_detach_fds_compat(msg, scm);  in scm_detach_fds()
349 		err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags);  in scm_detach_fds()
357 		err = put_user(SOL_SOCKET, &cm->cmsg_level);  in scm_detach_fds()
359 			err = put_user(SCM_RIGHTS, &cm->cmsg_type);  in scm_detach_fds()
361 			err = put_user(cmlen, &cm->cmsg_len);  in scm_detach_fds()
364 			if (msg->msg_controllen < cmlen)  in scm_detach_fds()
365 				cmlen = msg->msg_controllen;  in scm_detach_fds()
366 			msg->msg_control_user += cmlen;  in scm_detach_fds()
367 			msg->msg_controllen -= cmlen;  in scm_detach_fds()
371 	if (i < scm->fp->count || (scm->fp->count && fdmax <= 0))  in scm_detach_fds()
372 		msg->msg_flags |= MSG_CTRUNC;  in scm_detach_fds()
390 	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),  in scm_fp_dup()
393 		for (i = 0; i < fpl->count; i++)  in scm_fp_dup()
394 			get_file(fpl->fp[i]);  in scm_fp_dup()
396 		new_fpl->max = new_fpl->count;  in scm_fp_dup()
397 		new_fpl->user = get_uid(fpl->user);  in scm_fp_dup()
399 		new_fpl->inflight = false;  in scm_fp_dup()
400 		new_fpl->edges = NULL;  in scm_fp_dup()
401 		INIT_LIST_HEAD(&new_fpl->vertices);  in scm_fp_dup()