自学教程：C++ sock_alloc_send_skb函数代码示例

struct sk_buff *ndisc_build_skb(struct net_device *dev,				const struct in6_addr *daddr,				const struct in6_addr *saddr,				struct icmp6hdr *icmp6h,				const struct in6_addr *target,				int llinfo){	struct net *net = dev_net(dev);	struct sock *sk = net->ipv6.ndisc_sk;	struct sk_buff *skb;	struct icmp6hdr *hdr;	int hlen = LL_RESERVED_SPACE(dev);	int tlen = dev->needed_tailroom;	int len;	int err;	u8 *opt;	if (!dev->addr_len)		llinfo = 0;	len = sizeof(struct icmp6hdr) + (target ? sizeof(*target) : 0);	if (llinfo)		len += ndisc_opt_addr_space(dev);	skb = sock_alloc_send_skb(sk,				  (MAX_HEADER + sizeof(struct ipv6hdr) +				   len + hlen + tlen),				  1, &err);	if (!skb) {		ND_PRINTK(0, err, "ND: %s failed to allocate an skb, err=%d/n",			  __func__, err);		return NULL;	}	skb_reserve(skb, hlen);	ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);	skb->transport_header = skb->tail;	skb_put(skb, len);	hdr = (struct icmp6hdr *)skb_transport_header(skb);	memcpy(hdr, icmp6h, sizeof(*hdr));	opt = skb_transport_header(skb) + sizeof(struct icmp6hdr);	if (target) {		*(struct in6_addr *)opt = *target;		opt += sizeof(*target);	}	if (llinfo)		ndisc_fill_addr_option(opt, llinfo, dev->dev_addr,				       dev->addr_len, dev->type);	hdr->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len,					   IPPROTO_ICMPV6,					   csum_partial(hdr,							len, 0));	return skb;}

static inline int ip6_ufo_append_data(struct sock *sk,			struct sk_buff_head *queue,			int getfrag(void *from, char *to, int offset, int len,			int odd, struct sk_buff *skb),			void *from, int length, int hh_len, int fragheaderlen,			int exthdrlen, int transhdrlen, int mtu,			unsigned int flags, const struct flowi6 *fl6){	struct sk_buff *skb;	int err;	/* There is support for UDP large send offload by network	 * device, so create one single skb packet containing complete	 * udp datagram	 */	skb = skb_peek_tail(queue);	if (!skb) {		skb = sock_alloc_send_skb(sk,			hh_len + fragheaderlen + transhdrlen + 20,			(flags & MSG_DONTWAIT), &err);		if (!skb)			return err;		/* reserve space for Hardware header */		skb_reserve(skb, hh_len);		/* create space for UDP/IP header */		skb_put(skb, fragheaderlen + transhdrlen);		/* initialize network header pointer */		skb_set_network_header(skb, exthdrlen);		/* initialize protocol header pointer */		skb->transport_header = skb->network_header + fragheaderlen;		skb->protocol = htons(ETH_P_IPV6);		skb->csum = 0;		__skb_queue_tail(queue, skb);	} else if (skb_is_gso(skb)) {		goto append;	}	skb->ip_summed = CHECKSUM_PARTIAL;	/* Specify the length of each IPv6 datagram fragment.	 * It has to be a multiple of 8.	 */	skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -				     sizeof(struct frag_hdr)) & ~7;	skb_shinfo(skb)->gso_type = SKB_GSO_UDP;	skb_shinfo(skb)->ip6_frag_id = ipv6_select_ident(sock_net(sk),							 &fl6->daddr,							 &fl6->saddr);append:	return skb_append_datato_frags(sk, skb, getfrag, from,				       (length - transhdrlen));}

int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,		 size_t len){	const struct dccp_sock *dp = dccp_sk(sk);	const int flags = msg->msg_flags;	const int noblock = flags & MSG_DONTWAIT;	struct sk_buff *skb;	int rc, size;	long timeo;	if (len > dp->dccps_mss_cache)		return -EMSGSIZE;	lock_sock(sk);	if (sysctl_dccp_tx_qlen &&	    (sk->sk_write_queue.qlen >= sysctl_dccp_tx_qlen)) {		rc = -EAGAIN;		goto out_release;	}	timeo = sock_sndtimeo(sk, noblock);	/*	 * We have to use sk_stream_wait_connect here to set sk_write_pending,	 * so that the trick in dccp_rcv_request_sent_state_process.	 */	/* Wait for a connection to finish. */	if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN))		if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)			goto out_release;	size = sk->sk_prot->max_header + len;	release_sock(sk);	skb = sock_alloc_send_skb(sk, size, noblock, &rc);	lock_sock(sk);	if (skb == NULL)		goto out_release;	skb_reserve(skb, sk->sk_prot->max_header);	rc = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);	if (rc != 0)		goto out_discard;	skb_queue_tail(&sk->sk_write_queue, skb);	/*	 * The xmit_timer is set if the TX CCID is rate-based and will expire	 * when congestion control permits to release further packets into the	 * network. Window-based CCIDs do not use this timer.	 */	if (!timer_pending(&dp->dccps_xmit_timer))		dccp_write_xmit(sk);out_release:	release_sock(sk);	return rc ? : len;out_discard:	kfree_skb(skb);	goto out_release;}

static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,		       struct msghdr *msg, size_t size){	struct sock *sk = sock->sk;	struct raw_sock *ro = raw_sk(sk);	struct sk_buff *skb;	struct net_device *dev;	int ifindex;	int err;	if (msg->msg_name) {		struct sockaddr_can *addr =			(struct sockaddr_can *)msg->msg_name;		if (addr->can_family != AF_CAN)			return -EINVAL;		ifindex = addr->can_ifindex;	} else		ifindex = ro->ifindex;	if (size != sizeof(struct can_frame))		return -EINVAL;	dev = dev_get_by_index(&init_net, ifindex);	if (!dev)		return -ENXIO;	skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT,				  &err);	if (!skb)		goto put_dev;	err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);	if (err < 0)		goto free_skb;	err = sock_tx_timestamp(msg, sk, skb_tx(skb));	if (err < 0)		goto free_skb;	skb->dev = dev;	skb->sk  = sk;	err = can_send(skb, ro->loopback);	dev_put(dev);	if (err)		goto send_failed;	return size;free_skb:	kfree_skb(skb);put_dev:	dev_put(dev);send_failed:	return err;}

/* *	This is where all X.25 information frames pass. * *      Returns the amount of user data bytes sent on success *      or a negative error code on failure. */int x25_output(struct sock *sk, struct sk_buff *skb){	struct sk_buff *skbn;	unsigned char header[X25_EXT_MIN_LEN];	int err, frontlen, len, header_len, max_len;	int sent=0, noblock = X25_SKB_CB(skb)->flags & MSG_DONTWAIT;	header_len = (sk->protinfo.x25->neighbour->extended) ? X25_EXT_MIN_LEN : X25_STD_MIN_LEN;	max_len    = x25_pacsize_to_bytes(sk->protinfo.x25->facilities.pacsize_out);	if (skb->len - header_len > max_len) {		/* Save a copy of the Header */		memcpy(header, skb->data, header_len);		skb_pull(skb, header_len);		frontlen = skb_headroom(skb);		while (skb->len > 0) {			if ((skbn = sock_alloc_send_skb(sk, frontlen + max_len, noblock, &err)) == NULL){				if(err == -EWOULDBLOCK && noblock){					kfree_skb(skb);					return sent;				}				SOCK_DEBUG(sk, "x25_output: fragment allocation failed, err=%d, %d bytes sent/n", err, sent);				return err;			}							skb_reserve(skbn, frontlen);			len = (max_len > skb->len) ? skb->len : max_len;			/* Copy the user data */			memcpy(skb_put(skbn, len), skb->data, len);			skb_pull(skb, len);			/* Duplicate the Header */			skb_push(skbn, header_len);			memcpy(skbn->data, header, header_len);			if (skb->len > 0) {				if (sk->protinfo.x25->neighbour->extended)					skbn->data[3] |= X25_EXT_M_BIT;				else					skbn->data[2] |= X25_STD_M_BIT;			}			skb_queue_tail(&sk->write_queue, skbn);			sent += len;		}				kfree_skb(skb);	} else {		skb_queue_tail(&sk->write_queue, skb);		sent = skb->len - header_len;	}	return sent;}

int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,		 size_t len){	const struct dccp_sock *dp = dccp_sk(sk);	const int flags = msg->msg_flags;	const int noblock = flags & MSG_DONTWAIT;	struct sk_buff *skb;	int rc, size;	long timeo;	if (len > dp->dccps_mss_cache)		return -EMSGSIZE;	lock_sock(sk);	timeo = sock_sndtimeo(sk, noblock);	/*	 * We have to use sk_stream_wait_connect here to set sk_write_pending,	 * so that the trick in dccp_rcv_request_sent_state_process.	 */	/* Wait for a connection to finish. */	if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN | DCCPF_CLOSING))		if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)			goto out_release;	size = sk->sk_prot->max_header + len;	release_sock(sk);	skb = sock_alloc_send_skb(sk, size, noblock, &rc);	lock_sock(sk);	if (skb == NULL)		goto out_release;	skb_reserve(skb, sk->sk_prot->max_header);	rc = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);	if (rc != 0)		goto out_discard;	rc = dccp_write_xmit(sk, skb, &timeo);	/*	 * XXX we don't use sk_write_queue, so just discard the packet.	 *     Current plan however is to _use_ sk_write_queue with	 *     an algorith similar to tcp_sendmsg, where the main difference	 *     is that in DCCP we have to respect packet boundaries, so	 *     no coalescing of skbs.	 *	 *     This bug was _quickly_ found & fixed by just looking at an OSTRA	 *     generated callgraph 8) -acme	 */out_release:	release_sock(sk);	return rc ? : len;out_discard:	kfree_skb(skb);	goto out_release;}

static inline int ip6_ufo_append_data(struct sock *sk,			int getfrag(void *from, char *to, int offset, int len,			int odd, struct sk_buff *skb),			void *from, int length, int hh_len, int fragheaderlen,			int transhdrlen, int mtu,unsigned int flags,			struct rt6_info *rt){	struct sk_buff *skb;	int err;	/* There is support for UDP large send offload by network	 * device, so create one single skb packet containing complete	 * udp datagram	 */	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {		struct frag_hdr fhdr;		skb = sock_alloc_send_skb(sk,			hh_len + fragheaderlen + transhdrlen + 20,			(flags & MSG_DONTWAIT), &err);		if (skb == NULL)			return err;		/* reserve space for Hardware header */		skb_reserve(skb, hh_len);		/* create space for UDP/IP header */		skb_put(skb,fragheaderlen + transhdrlen);		/* initialize network header pointer */		skb_reset_network_header(skb);		/* initialize protocol header pointer */		skb->transport_header = skb->network_header + fragheaderlen;		skb->ip_summed = CHECKSUM_PARTIAL;		skb->csum = 0;		/* Specify the length of each IPv6 datagram fragment.		 * It has to be a multiple of 8.		 */		skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -					     sizeof(struct frag_hdr)) & ~7;		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;		ipv6_select_ident(&fhdr, rt);		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;		__skb_queue_tail(&sk->sk_write_queue, skb);	}	return skb_append_datato_frags(sk, skb, getfrag, from,				       (length - transhdrlen));}

static struct sk_buff *__xip_start_skb(struct sock *sk, struct xip_dst *xdst,	const struct xia_addr *src, int src_n, const struct xia_addr *dest,	int dest_n, u8 dest_last_node, int transhdrlen, int noblock){	struct net_device *dev = xdst->dst.dev;	struct sk_buff *skb;	u32 mtu, alloclen;	int hh_len, xh_len, rc;	if (!dev) {		net_warn_ratelimited("XIP %s: there is a bug somewhere, tried to send a datagram, but dst.dev is NULL/n",				     __func__);		return ERR_PTR(-ENODEV);	}	mtu = dst_mtu(&xdst->dst);	if (mtu < XIP_MIN_MTU) {		net_warn_ratelimited("XIP %s: cannot send datagram out because mtu (= %u) of dev %s is less than minimum MTU (= %u)/n",				     __func__, mtu, dev->name, XIP_MIN_MTU);		return ERR_PTR(-EMSGSIZE);	}	hh_len = LL_RESERVED_SPACE(dev);	alloclen = hh_len + mtu;	skb = sock_alloc_send_skb(sk, alloclen, noblock, &rc);	if (unlikely(!skb))		return ERR_PTR(rc);	/* Fill in the control structures. */	/* Reserve space for the link layer header */	skb_reserve(skb, hh_len);	/* Fill XIP header. */	skb_reset_network_header(skb);	xh_len = xip_hdr_size(dest_n, src_n);	skb_put(skb, xh_len);	xip_fill_in_hdr(skb, xdst, src->s_row, src_n,			dest->s_row, dest_n, dest_last_node);	skb_set_transport_header(skb, xh_len);	skb_put(skb, transhdrlen);	/* XXX Does we need to set skb_shinfo(skb)->tx_flags? */	skb->priority = sk->sk_priority;	skb->mark = sk->sk_mark;	xdst_hold(xdst);	skb_dst_set(skb, &xdst->dst);	return skb;}

/* *	This is where all X.25 information frames pass. * *      Returns the amount of user data bytes sent on success *      or a negative error code on failure. */int x25_output(struct sock *sk, struct sk_buff *skb){	struct sk_buff *skbn;	unsigned char header[X25_EXT_MIN_LEN];	int err, frontlen, len;	int sent=0, noblock = X25_SKB_CB(skb)->flags & MSG_DONTWAIT;	struct x25_sock *x25 = x25_sk(sk);	int header_len = x25->neighbour->extended ? X25_EXT_MIN_LEN :						    X25_STD_MIN_LEN;	int max_len = x25_pacsize_to_bytes(x25->facilities.pacsize_out);	if (skb->len - header_len > max_len) {		/* Save a copy of the Header */		skb_copy_from_linear_data(skb, header, header_len);		skb_pull(skb, header_len);		frontlen = skb_headroom(skb);		while (skb->len > 0) {<<<<<<< HEAD			release_sock(sk);			skbn = sock_alloc_send_skb(sk, frontlen + max_len,						   noblock, &err);			lock_sock(sk);			if (!skbn) {=======			if ((skbn = sock_alloc_send_skb(sk, frontlen + max_len,							noblock, &err)) == NULL){>>>>>>> 296c66da8a02d52243f45b80521febece5ed498a				if (err == -EWOULDBLOCK && noblock){					kfree_skb(skb);					return sent;				}				SOCK_DEBUG(sk, "x25_output: fragment alloc"					       " failed, err=%d, %d bytes "					       "sent/n", err, sent);				return err;			}

void nr_output(struct sock *sk, struct sk_buff *skb){	struct sk_buff *skbn;	unsigned char transport[NR_TRANSPORT_LEN];	int err, frontlen, len;	if (skb->len - NR_TRANSPORT_LEN > NR_MAX_PACKET_SIZE) {		/* Save a copy of the Transport Header */		skb_copy_from_linear_data(skb, transport, NR_TRANSPORT_LEN);		skb_pull(skb, NR_TRANSPORT_LEN);		frontlen = skb_headroom(skb);		while (skb->len > 0) {			if ((skbn = sock_alloc_send_skb(sk, frontlen + NR_MAX_PACKET_SIZE, 0, &err)) == NULL)				return;			skb_reserve(skbn, frontlen);			len = (NR_MAX_PACKET_SIZE > skb->len) ? skb->len : NR_MAX_PACKET_SIZE;			/* Copy the user data */			skb_copy_from_linear_data(skb, skb_put(skbn, len), len);			skb_pull(skb, len);			/* Duplicate the Transport Header */			skb_push(skbn, NR_TRANSPORT_LEN);			skb_copy_to_linear_data(skbn, transport,						NR_TRANSPORT_LEN);			if (skb->len > 0)				skbn->data[4] |= NR_MORE_FLAG;			skb_queue_tail(&sk->sk_write_queue, skbn); /* Throw it on the queue */		}		kfree_skb(skb);	} else {		skb_queue_tail(&sk->sk_write_queue, skb);		/* Throw it on the queue */	}	nr_kick(sk);}

static int rawsock_sendmsg(struct kiocb *iocb, struct socket *sock,					struct msghdr *msg, size_t len){	struct sock *sk = sock->sk;	struct nfc_dev *dev = nfc_rawsock(sk)->dev;	struct sk_buff *skb;	int rc;	nfc_dbg("sock=%p sk=%p len=%zu", sock, sk, len);	if (msg->msg_namelen)		return -EOPNOTSUPP;	if (sock->state != SS_CONNECTED)		return -ENOTCONN;	skb = sock_alloc_send_skb(sk, len + dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE,					msg->msg_flags & MSG_DONTWAIT, &rc);	if (!skb)		return rc;	skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);	rc = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);	if (rc < 0) {		kfree_skb(skb);		return rc;	}	spin_lock_bh(&sk->sk_write_queue.lock);	__skb_queue_tail(&sk->sk_write_queue, skb);	if (!nfc_rawsock(sk)->tx_work_scheduled) {		schedule_work(&nfc_rawsock(sk)->tx_work);		nfc_rawsock(sk)->tx_work_scheduled = true;	}	spin_unlock_bh(&sk->sk_write_queue.lock);	return len;}

static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,			   void *from, size_t length,			   struct rtable **rtp,			   unsigned int flags){	struct inet_sock *inet = inet_sk(sk);	struct net *net = sock_net(sk);	struct iphdr *iph;	struct sk_buff *skb;	unsigned int iphlen;	int err;	struct rtable *rt = *rtp;	int hlen, tlen;	if (length > rt->dst.dev->mtu) {		ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,			       rt->dst.dev->mtu);		return -EMSGSIZE;	}	if (flags&MSG_PROBE)		goto out;	hlen = LL_RESERVED_SPACE(rt->dst.dev);	tlen = rt->dst.dev->needed_tailroom;	skb = sock_alloc_send_skb(sk,				  length + hlen + tlen + 15,				  flags & MSG_DONTWAIT, &err);	if (skb == NULL)		goto error;	skb_reserve(skb, hlen);	skb->priority = sk->sk_priority;	skb->mark = sk->sk_mark;	skb_dst_set(skb, &rt->dst);	*rtp = NULL;	skb_reset_network_header(skb);	iph = ip_hdr(skb);	skb_put(skb,sizeof(*iph));	skb->ip_summed = CHECKSUM_NONE;	skb->transport_header = skb->network_header;	err = -EFAULT;	if (!memcpy_fromiovecend2((void *)iph, from, 0, length))		goto error_free;	iphlen = iph->ihl * 4;	/*	 * We don't want to modify the ip header, but we do need to	 * be sure that it won't cause problems later along the network	 * stack.  Specifically we want to make sure that iph->ihl is a	 * sane value.  If ihl points beyond the length of the buffer passed	 * in, reject the frame as invalid	 */	err = -EINVAL;	if (iphlen > length)		goto error_free;	if (iphlen >= sizeof(*iph)) {		if (!iph->saddr)			iph->saddr = fl4->saddr;		iph->check   = 0;		iph->tot_len = htons(length);		if (!iph->id)			ip_select_ident(skb, &rt->dst, NULL);		iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);	}	if (iph->protocol == IPPROTO_ICMP)		icmp_out_count(net, ((struct icmphdr *)			skb_transport_header(skb))->type);	err = NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, skb, NULL,		      rt->dst.dev, dst_output);	if (err > 0)		err = net_xmit_errno(err);	if (err)		goto error;out:	return 0;error_free:	kfree_skb(skb);error:	IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS);	if (err == -ENOBUFS && !inet->recverr)		err = 0;	return err;}

static int CVE_2010_3848_linux2_6_23_econet_sendmsg(struct kiocb *iocb, struct socket *sock,			  struct msghdr *msg, size_t len){	struct sock *sk = sock->sk;	struct sockaddr_ec *saddr=(struct sockaddr_ec *)msg->msg_name;	struct net_device *dev;	struct ec_addr addr;	int err;	unsigned char port, cb;#if defined(CONFIG_ECONET_AUNUDP) || defined(CONFIG_ECONET_NATIVE)	struct sk_buff *skb;	struct ec_cb *eb;#endif#ifdef CONFIG_ECONET_AUNUDP	struct msghdr udpmsg;	struct iovec iov[msg->msg_iovlen+1];	struct aunhdr ah;	struct sockaddr_in udpdest;	__kernel_size_t size;	int i;	mm_segment_t oldfs;#endif	/*	 *	Check the flags.	 */	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))		return -EINVAL;	/*	 *	Get and verify the address.	 */	mutex_lock(&econet_mutex);	if (saddr == NULL) {		struct econet_sock *eo = ec_sk(sk);		addr.station = eo->station;		addr.net     = eo->net;		port	     = eo->port;		cb	     = eo->cb;	} else {		if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {			mutex_unlock(&econet_mutex);			return -EINVAL;		}		addr.station = saddr->addr.station;		addr.net = saddr->addr.net;		port = saddr->port;		cb = saddr->cb;	}	/* Look for a device with the right network number. */	dev = net2dev_map[addr.net];	/* If not directly reachable, use some default */	if (dev == NULL) {		dev = net2dev_map[0];		/* No interfaces at all? */		if (dev == NULL) {			mutex_unlock(&econet_mutex);			return -ENETDOWN;		}	}	if (len + 15 > dev->mtu) {		mutex_unlock(&econet_mutex);		return -EMSGSIZE;	}	if (dev->type == ARPHRD_ECONET) {		/* Real hardware Econet.  We're not worthy etc. */#ifdef CONFIG_ECONET_NATIVE		unsigned short proto = 0;		dev_hold(dev);		skb = sock_alloc_send_skb(sk, len+LL_RESERVED_SPACE(dev),					  msg->msg_flags & MSG_DONTWAIT, &err);		if (skb==NULL)			goto out_unlock;		skb_reserve(skb, LL_RESERVED_SPACE(dev));		skb_reset_network_header(skb);		eb = (struct ec_cb *)&skb->cb;		/* BUG: saddr may be NULL */		eb->cookie = saddr->cookie;		eb->sec = *saddr;		eb->sent = ec_tx_done;		if (dev->hard_header) {			int res;			struct ec_framehdr *fh;			err = -EINVAL;			res = dev->hard_header(skb, dev, ntohs(proto),					       &addr, NULL, len);//.........这里部分代码省略.........

static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,		       struct msghdr *msg, size_t size){	struct sock *sk = sock->sk;	struct raw_sock *ro = raw_sk(sk);	struct sk_buff *skb;	struct net_device *dev;	int ifindex;	int err;	if (msg->msg_name) {		struct sockaddr_can *addr =			(struct sockaddr_can *)msg->msg_name;		if (msg->msg_namelen < sizeof(*addr))			return -EINVAL;		if (addr->can_family != AF_CAN)			return -EINVAL;		ifindex = addr->can_ifindex;	} else		ifindex = ro->ifindex;	if (size != sizeof(struct can_frame))		return -EINVAL;	dev = dev_get_by_index(&init_net, ifindex);	if (!dev)		return -ENXIO;	skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT,				  &err);	if (!skb)		goto put_dev;	err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);	if (err < 0)		goto free_skb;	err = sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);	if (err < 0)		goto free_skb;	/* to be able to check the received tx sock reference in raw_rcv() */	skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;	skb->dev = dev;	skb->sk  = sk;	err = can_send(skb, ro->loopback);	dev_put(dev);	if (err)		goto send_failed;	return size;free_skb:	kfree_skb(skb);put_dev:	dev_put(dev);send_failed:	return err;}

//.........这里部分代码省略.........		if (pktlength > 0xFFFF + sizeof(struct ipv6hdr)) {			/* Jumbo datagram.			   It is assumed, that in the case of hdrincl			   jumbo option is supplied by user.			 */			pktlength += 8;			jumbolen = pktlength - sizeof(struct ipv6hdr);		}	}	mtu = dst->pmtu;	if (np->frag_size < mtu) {		if (np->frag_size)			mtu = np->frag_size;		else if (np->pmtudisc == IPV6_PMTUDISC_DONT)			mtu = IPV6_MIN_MTU;	}	/* Critical arithmetic overflow check.	   FIXME: may gcc optimize it out? --ANK (980726)	 */	if (pktlength < length) {		ipv6_local_error(sk, EMSGSIZE, fl, mtu);		err = -EMSGSIZE;		goto out;	}	if (flags&MSG_CONFIRM)		dst_confirm(dst);	if (pktlength <= mtu) {		struct sk_buff *skb;		struct ipv6hdr *hdr;		struct net_device *dev = dst->dev;		err = 0;		if (flags&MSG_PROBE)			goto out;		skb = sock_alloc_send_skb(sk, pktlength + 15 +					  dev->hard_header_len,					  flags & MSG_DONTWAIT, &err);		if (skb == NULL) {			IP6_INC_STATS(Ip6OutDiscards);			goto out;		}		skb->dst = dst_clone(dst);		skb_reserve(skb, (dev->hard_header_len + 15) & ~15);		hdr = (struct ipv6hdr *) skb->tail;		skb->nh.ipv6h = hdr;		if (!sk->protinfo.af_inet.hdrincl) {			ip6_bld_1(sk, skb, fl, hlimit,				  jumbolen ? sizeof(struct ipv6hdr) : pktlength);			if (opt || jumbolen) {				u8 *prev_hdr = &hdr->nexthdr;				prev_hdr = ipv6_build_nfrag_opts(skb, prev_hdr, opt, final_dst, jumbolen);				if (opt && opt->opt_flen)					ipv6_build_frag_opts(skb, prev_hdr, opt);			}		}		skb_put(skb, length);		err = getfrag(data, &hdr->saddr,			      ((char *) hdr) + (pktlength - length),			      0, length);		if (!err) {			IP6_INC_STATS(Ip6OutRequests);			err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, ip6_maybe_reroute);		} else {			err = -EFAULT;			kfree_skb(skb);		}	} else {		if (sk->protinfo.af_inet.hdrincl || jumbolen ||		    np->pmtudisc == IPV6_PMTUDISC_DO) {			ipv6_local_error(sk, EMSGSIZE, fl, mtu);			err = -EMSGSIZE;			goto out;		}		err = ip6_frag_xmit(sk, getfrag, data, dst, fl, opt, final_dst, hlimit,				    flags, length, mtu);	}	/*	 *	cleanup	 */out:	ip6_dst_store(sk, dst, fl->nl_u.ip6_u.daddr == &np->daddr ? &np->daddr : NULL);	if (err > 0)		err = np->recverr ? net_xmit_errno(err) : 0;	return err;}

static int ip6_frag_xmit(struct sock *sk, inet_getfrag_t getfrag,			 const void *data, struct dst_entry *dst,			 struct flowi *fl, struct ipv6_txoptions *opt,			 struct in6_addr *final_dst,			 int hlimit, int flags, unsigned length, int mtu){	struct ipv6hdr *hdr;	struct sk_buff *last_skb;	u8 *prev_hdr;	int unfrag_len;	int frag_len;	int last_len;	int nfrags;	int fhdr_dist;	int frag_off;	int data_off;	int err;	/*	 *	Fragmentation	 *	 *	Extension header order:	 *	Hop-by-hop -> Dest0 -> Routing -> Fragment -> Auth -> Dest1 -> rest (...)	 *		 *	We must build the non-fragmented part that	 *	will be in every packet... this also means	 *	that other extension headers (Dest, Auth, etc)	 *	must be considered in the data to be fragmented	 */	unfrag_len = sizeof(struct ipv6hdr) + sizeof(struct frag_hdr);	last_len = length;	if (opt) {		unfrag_len += opt->opt_nflen;		last_len += opt->opt_flen;	}	/*	 *	Length of fragmented part on every packet but 	 *	the last must be an:	 *	"integer multiple of 8 octects".	 */	frag_len = (mtu - unfrag_len) & ~0x7;	/* Unfragmentable part exceeds mtu. */	if (frag_len <= 0) {		ipv6_local_error(sk, EMSGSIZE, fl, mtu);		return -EMSGSIZE;	}	nfrags = last_len / frag_len;	/*	 *	We must send from end to start because of 	 *	UDP/ICMP checksums. We do a funny trick:	 *	fill the last skb first with the fixed	 *	header (and its data) and then use it	 *	to create the following segments and send it	 *	in the end. If the peer is checking the M_flag	 *	to trigger the reassembly code then this 	 *	might be a good idea.	 */	frag_off = nfrags * frag_len;	last_len -= frag_off;	if (last_len == 0) {		last_len = frag_len;		frag_off -= frag_len;		nfrags--;	}	data_off = frag_off;	/* And it is implementation problem: for now we assume, that	   all the exthdrs will fit to the first fragment.	 */	if (opt) {		if (frag_len < opt->opt_flen) {			ipv6_local_error(sk, EMSGSIZE, fl, mtu);			return -EMSGSIZE;		}		data_off = frag_off - opt->opt_flen;	}	if (flags&MSG_PROBE)		return 0;	last_skb = sock_alloc_send_skb(sk, unfrag_len + frag_len +				       dst->dev->hard_header_len + 15,				       flags & MSG_DONTWAIT, &err);	if (last_skb == NULL)		return err;	last_skb->dst = dst_clone(dst);	skb_reserve(last_skb, (dst->dev->hard_header_len + 15) & ~15);//.........这里部分代码省略.........

//.........这里部分代码省略.........			 * we know we need more fragment(s).			 */			datalen = length + fraggap;			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;			if ((flags & MSG_MORE) &&			    !(rt->dst.dev->features&NETIF_F_SG))				alloclen = mtu;			else				alloclen = datalen + fragheaderlen;			alloclen += dst_exthdrlen;			if (datalen != length + fraggap) {				/*				 * this is not the last fragment, the trailer				 * space is regarded as data space.				 */				datalen += rt->dst.trailer_len;			}			alloclen += rt->dst.trailer_len;			fraglen = datalen + fragheaderlen;			/*			 * We just reserve space for fragment header.			 * Note: this may be overallocation if the message			 * (without MSG_MORE) fits into the MTU.			 */			alloclen += sizeof(struct frag_hdr);			if (transhdrlen) {				skb = sock_alloc_send_skb(sk,						alloclen + hh_len,						(flags & MSG_DONTWAIT), &err);			} else {				skb = NULL;				if (atomic_read(&sk->sk_wmem_alloc) <=				    2 * sk->sk_sndbuf)					skb = sock_wmalloc(sk,							   alloclen + hh_len, 1,							   sk->sk_allocation);				if (unlikely(!skb))					err = -ENOBUFS;			}			if (!skb)				goto error;			/*			 *	Fill in the control structures			 */			skb->protocol = htons(ETH_P_IPV6);			skb->ip_summed = csummode;			skb->csum = 0;			/* reserve for fragmentation and ipsec header */			skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +				    dst_exthdrlen);			/* Only the initial fragment is time stamped */			skb_shinfo(skb)->tx_flags = tx_flags;			tx_flags = 0;			skb_shinfo(skb)->tskey = tskey;			tskey = 0;			/*			 *	Find where to start putting bytes

static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,			struct msghdr *msg, size_t len){	struct pep_sock *pn = pep_sk(sk);	struct sk_buff *skb;	long timeo;	int flags = msg->msg_flags;	int err, done;	if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|				MSG_CMSG_COMPAT)) ||			!(msg->msg_flags & MSG_EOR))		return -EOPNOTSUPP;	skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,					flags & MSG_DONTWAIT, &err);	if (!skb)		return -ENOBUFS;	skb_reserve(skb, MAX_PHONET_HEADER + 3);	err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);	if (err < 0)		goto outfree;	lock_sock(sk);	timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);	if ((1 << sk->sk_state) & (TCPF_LISTEN|TCPF_CLOSE)) {		err = -ENOTCONN;		goto out;	}	if (sk->sk_state != TCP_ESTABLISHED) {		/* Wait until the pipe gets to enabled state */disabled:		err = sk_stream_wait_connect(sk, &timeo);		if (err)			goto out;		if (sk->sk_state == TCP_CLOSE_WAIT) {			err = -ECONNRESET;			goto out;		}	}	BUG_ON(sk->sk_state != TCP_ESTABLISHED);	/* Wait until flow control allows TX */	done = atomic_read(&pn->tx_credits);	while (!done) {		DEFINE_WAIT(wait);		if (!timeo) {			err = -EAGAIN;			goto out;		}		if (signal_pending(current)) {			err = sock_intr_errno(timeo);			goto out;		}		prepare_to_wait(sk_sleep(sk), &wait,				TASK_INTERRUPTIBLE);		done = sk_wait_event(sk, &timeo, atomic_read(&pn->tx_credits));		finish_wait(sk_sleep(sk), &wait);		if (sk->sk_state != TCP_ESTABLISHED)			goto disabled;	}	err = pipe_skb_send(sk, skb);	if (err >= 0)		err = len; /* success! */	skb = NULL;out:	release_sock(sk);outfree:	kfree_skb(skb);	return err;}

/* * Route an outgoing frame from a socket. */int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,			struct iovec *iov, size_t len, int noblock){	struct sk_buff *skb;	struct ipx_sock *ipxs = ipx_sk(sk);	struct ipx_interface *intrfc;	struct ipxhdr *ipx;	size_t size;	int ipx_offset;	struct ipx_route *rt = NULL;	int rc;	/* Find the appropriate interface on which to send packet */	if (!usipx->sipx_network && ipx_primary_net) {		usipx->sipx_network = ipx_primary_net->if_netnum;		intrfc = ipx_primary_net;	} else {		rt = ipxrtr_lookup(usipx->sipx_network);		rc = -ENETUNREACH;		if (!rt)			goto out;		intrfc = rt->ir_intrfc;	}	ipxitf_hold(intrfc);	ipx_offset = intrfc->if_ipx_offset;	size = sizeof(struct ipxhdr) + len + ipx_offset;	skb = sock_alloc_send_skb(sk, size, noblock, &rc);	if (!skb)		goto out_put;	skb_reserve(skb, ipx_offset);	skb->sk = sk;	/* Fill in IPX header */	skb_reset_network_header(skb);	skb_reset_transport_header(skb);	skb_put(skb, sizeof(struct ipxhdr));	ipx = ipx_hdr(skb);	ipx->ipx_pktsize = htons(len + sizeof(struct ipxhdr));	IPX_SKB_CB(skb)->ipx_tctrl = 0;	ipx->ipx_type 	 = usipx->sipx_type;	IPX_SKB_CB(skb)->last_hop.index = -1;#ifdef CONFIG_IPX_INTERN	IPX_SKB_CB(skb)->ipx_source_net = ipxs->intrfc->if_netnum;	memcpy(ipx->ipx_source.node, ipxs->node, IPX_NODE_LEN);#else	rc = ntohs(ipxs->port);	if (rc == 0x453 || rc == 0x452) {		/* RIP/SAP special handling for mars_nwe */		IPX_SKB_CB(skb)->ipx_source_net = intrfc->if_netnum;		memcpy(ipx->ipx_source.node, intrfc->if_node, IPX_NODE_LEN);	} else {		IPX_SKB_CB(skb)->ipx_source_net = ipxs->intrfc->if_netnum;		memcpy(ipx->ipx_source.node, ipxs->intrfc->if_node,			IPX_NODE_LEN);	}#endif	/* CONFIG_IPX_INTERN */	ipx->ipx_source.sock		= ipxs->port;	IPX_SKB_CB(skb)->ipx_dest_net	= usipx->sipx_network;	memcpy(ipx->ipx_dest.node, usipx->sipx_node, IPX_NODE_LEN);	ipx->ipx_dest.sock		= usipx->sipx_port;	rc = memcpy_fromiovec(skb_put(skb, len), iov, len);	if (rc) {		kfree_skb(skb);		goto out_put;	}	/* Apply checksum. Not allowed on 802.3 links. */	if (sk->sk_no_check || intrfc->if_dlink_type == htons(IPX_FRAME_8023))		ipx->ipx_checksum = htons(0xFFFF);	else		ipx->ipx_checksum = ipx_cksum(ipx, len + sizeof(struct ipxhdr));	rc = ipxitf_send(intrfc, skb, (rt && rt->ir_routed) ?			 rt->ir_router_node : ipx->ipx_dest.node);out_put:	ipxitf_put(intrfc);	if (rt)		ipxrtr_put(rt);out:	return rc;}

//.........这里部分代码省略.........			/*			 * If remaining data exceeds the mtu,			 * we know we need more fragment(s).			 */			datalen = length + fraggap;			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;			if ((flags & MSG_MORE) &&			    !(rt->dst.dev->features&NETIF_F_SG))				alloclen = mtu;			else				alloclen = datalen + fragheaderlen;			if (datalen != length + fraggap) {				/*				 * this is not the last fragment, the trailer				 * space is regarded as data space.				 */				datalen += rt->dst.trailer_len;			}			alloclen += rt->dst.trailer_len;			fraglen = datalen + fragheaderlen;			/*			 * We just reserve space for fragment header.			 * Note: this may be overallocation if the message			 * (without MSG_MORE) fits into the MTU.			 */			alloclen += sizeof(struct frag_hdr);			if (transhdrlen) {				skb = sock_alloc_send_skb(sk,						alloclen + hh_len,						(flags & MSG_DONTWAIT), &err);			} else {				skb = NULL;				if (atomic_read(&sk->sk_wmem_alloc) <=				    2 * sk->sk_sndbuf)					skb = sock_wmalloc(sk,							   alloclen + hh_len, 1,							   sk->sk_allocation);				if (unlikely(skb == NULL))					err = -ENOBUFS;				else {					/* Only the initial fragment					 * is time stamped.					 */					tx_flags = 0;				}			}			if (skb == NULL)				goto error;			/*			 *	Fill in the control structures			 */			skb->ip_summed = csummode;			skb->csum = 0;			/* reserve for fragmentation */			skb_reserve(skb, hh_len+sizeof(struct frag_hdr));			if (sk->sk_type == SOCK_DGRAM)				skb_shinfo(skb)->tx_flags = tx_flags;			/*