1 files changed, 11 insertions, 44 deletions

diff --git a/net/socket.c b/net/socket.c
index 8a109012608a..8c24d5dc4bc8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -89,6 +89,7 @@
 #include <linux/magic.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -117,10 +118,8 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
 
 static int sock_close(struct inode *inode, struct file *file);
-static struct wait_queue_head *sock_get_poll_head(struct file *file,
-                __poll_t events);
-static __poll_t sock_poll_mask(struct file *file, __poll_t);
-static __poll_t sock_poll(struct file *file, struct poll_table_struct *wait);
+static __poll_t sock_poll(struct file *file,
+                              struct poll_table_struct *wait);
 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_COMPAT
 static long compat_sock_ioctl(struct file *file,
@@ -143,8 +142,6 @@ static const struct file_operations socket_file_ops = {
         .llseek =       no_llseek,
         .read_iter =    sock_read_iter,
         .write_iter =   sock_write_iter,
-        .get_poll_head = sock_get_poll_head,
-        .poll_mask =    sock_poll_mask,
         .poll =         sock_poll,
         .unlocked_ioctl = sock_ioctl,
 #ifdef CONFIG_COMPAT
@@ -1130,48 +1127,16 @@ out_release:
 }
 EXPORT_SYMBOL(sock_create_lite);
 
-static struct wait_queue_head *sock_get_poll_head(struct file *file,
-                __poll_t events)
-{
-        struct socket *sock = file->private_data;
-
-        if (!sock->ops->poll_mask)
-                return NULL;
-        sock_poll_busy_loop(sock, events);
-        return sk_sleep(sock->sk);
-}
-
-static __poll_t sock_poll_mask(struct file *file, __poll_t events)
-{
-        struct socket *sock = file->private_data;
-
-        /*
-         * We need to be sure we are in sync with the socket flags modification.
-         *
-         * This memory barrier is paired in the wq_has_sleeper.
-         */
-        smp_mb();
-
-        /* this socket can poll_ll so tell the system call */
-        return sock->ops->poll_mask(sock, events) |
-                (sk_can_busy_loop(sock->sk) ? POLL_BUSY_LOOP : 0);
-}
-
 /* No kernel lock held - perfect */
 static __poll_t sock_poll(struct file *file, poll_table *wait)
 {
         struct socket *sock = file->private_data;
-        __poll_t events = poll_requested_events(wait), mask = 0;
-
-        if (sock->ops->poll) {
-                sock_poll_busy_loop(sock, events);
-                mask = sock->ops->poll(file, sock, wait);
-        } else if (sock->ops->poll_mask) {
-                sock_poll_wait(file, sock_get_poll_head(file, events), wait);
-                mask = sock->ops->poll_mask(sock, events);
-        }
+        __poll_t events = poll_requested_events(wait);
 
-        return mask | sock_poll_busy_flag(sock);
+        sock_poll_busy_loop(sock, events);
+        if (!sock->ops->poll)
+                return 0;
+        return sock->ops->poll(file, sock, wait) | sock_poll_busy_flag(sock);
 }
 
 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
@@ -2558,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 
         if (call < 1 || call > SYS_SENDMMSG)
                 return -EINVAL;
+        call = array_index_nospec(call, SYS_SENDMMSG + 1);
 
         len = nargs[call];
         if (len > sizeof(a))
@@ -2724,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister);
 
 bool sock_is_registered(int family)
 {
-        return family < NPROTO && rcu_access_pointer(net_families[family]);
+        return family < NPROTO &&
+                rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
 }
 
 static int __init sock_init(void)