1 /*-
2 * Copyright (c) 1982, 1986, 1989, 1991, 1993
3 * The Regents of the University of California.
4 * Copyright (c) 2004-2009 Robert N. M. Watson
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 4. Neither the name of the University nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
32 */
33
34 /*
35 * UNIX Domain (Local) Sockets
36 *
37 * This is an implementation of UNIX (local) domain sockets. Each socket has
38 * an associated struct unpcb (UNIX protocol control block). Stream sockets
39 * may be connected to 0 or 1 other socket. Datagram sockets may be
40 * connected to 0, 1, or many other sockets. Sockets may be created and
41 * connected in pairs (socketpair(2)), or bound/connected to using the file
42 * system name space. For most purposes, only the receive socket buffer is
43 * used, as sending on one socket delivers directly to the receive socket
44 * buffer of a second socket.
45 *
46 * The implementation is substantially complicated by the fact that
47 * "ancillary data", such as file descriptors or credentials, may be passed
48 * across UNIX domain sockets. The potential for passing UNIX domain sockets
49 * over other UNIX domain sockets requires the implementation of a simple
50 * garbage collector to find and tear down cycles of disconnected sockets.
51 *
52 * TODO:
53 * RDM
54 * distinguish datagram size limits from flow control limits in SEQPACKET
55 * rethink name space problems
56 * need a proper out-of-band
57 */
58
59 #include <sys/cdefs.h>
60 __FBSDID("$FreeBSD: stable/9/sys/kern/uipc_usrreq.c 269789 2014-08-10 21:17:19Z gavin $");
61
62 #include "opt_ddb.h"
63
64 #include <sys/param.h>
65 #include <sys/domain.h>
66 #include <sys/fcntl.h>
67 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */
68 #include <sys/eventhandler.h>
69 #include <sys/file.h>
70 #include <sys/filedesc.h>
71 #include <sys/kernel.h>
72 #include <sys/lock.h>
73 #include <sys/mbuf.h>
74 #include <sys/mount.h>
75 #include <sys/mutex.h>
76 #include <sys/namei.h>
77 #include <sys/proc.h>
78 #include <sys/protosw.h>
79 #include <sys/queue.h>
80 #include <sys/resourcevar.h>
81 #include <sys/rwlock.h>
82 #include <sys/socket.h>
83 #include <sys/socketvar.h>
84 #include <sys/signalvar.h>
85 #include <sys/stat.h>
86 #include <sys/sx.h>
87 #include <sys/sysctl.h>
88 #include <sys/systm.h>
89 #include <sys/taskqueue.h>
90 #include <sys/un.h>
91 #include <sys/unpcb.h>
92 #include <sys/vnode.h>
93
94 #include <net/vnet.h>
95
96 #ifdef DDB
97 #include <ddb/ddb.h>
98 #endif
99
100 #include <security/mac/mac_framework.h>
101
102 #include <vm/uma.h>
103
104 /*
105 * Locking key:
106 * (l) Locked using list lock
107 * (g) Locked using linkage lock
108 */
109
110 static uma_zone_t unp_zone;
111 static unp_gen_t unp_gencnt; /* (l) */
112 static u_int unp_count; /* (l) Count of local sockets. */
113 static ino_t unp_ino; /* Prototype for fake inode numbers. */
114 static int unp_rights; /* (g) File descriptors in flight. */
115 static struct unp_head unp_shead; /* (l) List of stream sockets. */
116 static struct unp_head unp_dhead; /* (l) List of datagram sockets. */
117 static struct unp_head unp_sphead; /* (l) List of seqpacket sockets. */
118
119 struct unp_defer {
120 SLIST_ENTRY(unp_defer) ud_link;
121 struct file *ud_fp;
122 };
123 static SLIST_HEAD(, unp_defer) unp_defers;
124 static int unp_defers_count;
125
126 static const struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL };
127
128 /*
129 * Garbage collection of cyclic file descriptor/socket references occurs
130 * asynchronously in a taskqueue context in order to avoid recursion and
131 * reentrance in the UNIX domain socket, file descriptor, and socket layer
132 * code. See unp_gc() for a full description.
133 */
134 static struct timeout_task unp_gc_task;
135
136 /*
137 * The close of unix domain sockets attached as SCM_RIGHTS is
138 * postponed to the taskqueue, to avoid arbitrary recursion depth.
139 * The attached sockets might have another sockets attached.
140 */
141 static struct task unp_defer_task;
142
143 /*
144 * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
145 * stream sockets, although the total for sender and receiver is actually
146 * only PIPSIZ.
147 *
148 * Datagram sockets really use the sendspace as the maximum datagram size,
149 * and don't really want to reserve the sendspace. Their recvspace should be
150 * large enough for at least one max-size datagram plus address.
151 */
152 #ifndef PIPSIZ
153 #define PIPSIZ 8192
154 #endif
155 static u_long unpst_sendspace = PIPSIZ;
156 static u_long unpst_recvspace = PIPSIZ;
157 static u_long unpdg_sendspace = 2*1024; /* really max datagram size */
158 static u_long unpdg_recvspace = 4*1024;
159 static u_long unpsp_sendspace = PIPSIZ; /* really max datagram size */
160 static u_long unpsp_recvspace = PIPSIZ;
161
162 static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW, 0, "Local domain");
163 static SYSCTL_NODE(_net_local, SOCK_STREAM, stream, CTLFLAG_RW, 0,
164 "SOCK_STREAM");
165 static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, CTLFLAG_RW, 0, "SOCK_DGRAM");
166 static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket, CTLFLAG_RW, 0,
167 "SOCK_SEQPACKET");
168
169 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
170 &unpst_sendspace, 0, "Default stream send space.");
171 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
172 &unpst_recvspace, 0, "Default stream receive space.");
173 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
174 &unpdg_sendspace, 0, "Default datagram send space.");
175 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
176 &unpdg_recvspace, 0, "Default datagram receive space.");
177 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
178 &unpsp_sendspace, 0, "Default seqpacket send space.");
179 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
180 &unpsp_recvspace, 0, "Default seqpacket receive space.");
181 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
182 "File descriptors in flight.");
183 SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
184 &unp_defers_count, 0,
185 "File descriptors deferred to taskqueue for close.");
186
187 /*
188 * Locking and synchronization:
189 *
190 * Three types of locks exit in the local domain socket implementation: a
191 * global list mutex, a global linkage rwlock, and per-unpcb mutexes. Of the
192 * global locks, the list lock protects the socket count, global generation
193 * number, and stream/datagram global lists. The linkage lock protects the
194 * interconnection of unpcbs, the v_socket and unp_vnode pointers, and can be
195 * held exclusively over the acquisition of multiple unpcb locks to prevent
196 * deadlock.
197 *
198 * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
199 * allocated in pru_attach() and freed in pru_detach(). The validity of that
200 * pointer is an invariant, so no lock is required to dereference the so_pcb
201 * pointer if a valid socket reference is held by the caller. In practice,
202 * this is always true during operations performed on a socket. Each unpcb
203 * has a back-pointer to its socket, unp_socket, which will be stable under
204 * the same circumstances.
205 *
206 * This pointer may only be safely dereferenced as long as a valid reference
207 * to the unpcb is held. Typically, this reference will be from the socket,
208 * or from another unpcb when the referring unpcb's lock is held (in order
209 * that the reference not be invalidated during use). For example, to follow
210 * unp->unp_conn->unp_socket, you need unlock the lock on unp, not unp_conn,
211 * as unp_socket remains valid as long as the reference to unp_conn is valid.
212 *
213 * Fields of unpcbss are locked using a per-unpcb lock, unp_mtx. Individual
214 * atomic reads without the lock may be performed "lockless", but more
215 * complex reads and read-modify-writes require the mutex to be held. No
216 * lock order is defined between unpcb locks -- multiple unpcb locks may be
217 * acquired at the same time only when holding the linkage rwlock
218 * exclusively, which prevents deadlocks.
219 *
220 * Blocking with UNIX domain sockets is a tricky issue: unlike most network
221 * protocols, bind() is a non-atomic operation, and connect() requires
222 * potential sleeping in the protocol, due to potentially waiting on local or
223 * distributed file systems. We try to separate "lookup" operations, which
224 * may sleep, and the IPC operations themselves, which typically can occur
225 * with relative atomicity as locks can be held over the entire operation.
226 *
227 * Another tricky issue is simultaneous multi-threaded or multi-process
228 * access to a single UNIX domain socket. These are handled by the flags
229 * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
230 * binding, both of which involve dropping UNIX domain socket locks in order
231 * to perform namei() and other file system operations.
232 */
233 static struct rwlock unp_link_rwlock;
234 static struct mtx unp_list_lock;
235 static struct mtx unp_defers_lock;
236
237 #define UNP_LINK_LOCK_INIT() rw_init(&unp_link_rwlock, \
238 "unp_link_rwlock")
239
240 #define UNP_LINK_LOCK_ASSERT() rw_assert(&unp_link_rwlock, \
241 RA_LOCKED)
242 #define UNP_LINK_UNLOCK_ASSERT() rw_assert(&unp_link_rwlock, \
243 RA_UNLOCKED)
244
245 #define UNP_LINK_RLOCK() rw_rlock(&unp_link_rwlock)
246 #define UNP_LINK_RUNLOCK() rw_runlock(&unp_link_rwlock)
247 #define UNP_LINK_WLOCK() rw_wlock(&unp_link_rwlock)
248 #define UNP_LINK_WUNLOCK() rw_wunlock(&unp_link_rwlock)
249 #define UNP_LINK_WLOCK_ASSERT() rw_assert(&unp_link_rwlock, \
250 RA_WLOCKED)
251
252 #define UNP_LIST_LOCK_INIT() mtx_init(&unp_list_lock, \
253 "unp_list_lock", NULL, MTX_DEF)
254 #define UNP_LIST_LOCK() mtx_lock(&unp_list_lock)
255 #define UNP_LIST_UNLOCK() mtx_unlock(&unp_list_lock)
256
257 #define UNP_DEFERRED_LOCK_INIT() mtx_init(&unp_defers_lock, \
258 "unp_defer", NULL, MTX_DEF)
259 #define UNP_DEFERRED_LOCK() mtx_lock(&unp_defers_lock)
260 #define UNP_DEFERRED_UNLOCK() mtx_unlock(&unp_defers_lock)
261
262 #define UNP_PCB_LOCK_INIT(unp) mtx_init(&(unp)->unp_mtx, \
263 "unp_mtx", "unp_mtx", \
264 MTX_DUPOK|MTX_DEF|MTX_RECURSE)
265 #define UNP_PCB_LOCK_DESTROY(unp) mtx_destroy(&(unp)->unp_mtx)
266 #define UNP_PCB_LOCK(unp) mtx_lock(&(unp)->unp_mtx)
267 #define UNP_PCB_UNLOCK(unp) mtx_unlock(&(unp)->unp_mtx)
268 #define UNP_PCB_LOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_OWNED)
269
270 static int uipc_connect2(struct socket *, struct socket *);
271 static int uipc_ctloutput(struct socket *, struct sockopt *);
272 static int unp_connect(struct socket *, struct sockaddr *,
273 struct thread *);
274 static int unp_connect2(struct socket *so, struct socket *so2, int);
275 static void unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
276 static void unp_dispose(struct mbuf *);
277 static void unp_shutdown(struct unpcb *);
278 static void unp_drop(struct unpcb *, int);
279 static void unp_gc(__unused void *, int);
280 static void unp_scan(struct mbuf *, void (*)(struct file *));
281 static void unp_discard(struct file *);
282 static void unp_freerights(struct file **, int);
283 static void unp_init(void);
284 static int unp_internalize(struct mbuf **, struct thread *);
285 static void unp_internalize_fp(struct file *);
286 static int unp_externalize(struct mbuf *, struct mbuf **);
287 static int unp_externalize_fp(struct file *);
288 static struct mbuf *unp_addsockcred(struct thread *, struct mbuf *);
289 static void unp_process_defers(void * __unused, int);
290
291 /*
292 * Definitions of protocols supported in the LOCAL domain.
293 */
294 static struct domain localdomain;
295 static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream;
296 static struct pr_usrreqs uipc_usrreqs_seqpacket;
297 static struct protosw localsw[] = {
298 {
299 .pr_type = SOCK_STREAM,
300 .pr_domain = &localdomain,
301 .pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS,
302 .pr_ctloutput = &uipc_ctloutput,
303 .pr_usrreqs = &uipc_usrreqs_stream
304 },
305 {
306 .pr_type = SOCK_DGRAM,
307 .pr_domain = &localdomain,
308 .pr_flags = PR_ATOMIC|PR_ADDR|PR_RIGHTS,
309 .pr_ctloutput = &uipc_ctloutput,
310 .pr_usrreqs = &uipc_usrreqs_dgram
311 },
312 {
313 .pr_type = SOCK_SEQPACKET,
314 .pr_domain = &localdomain,
315
316 /*
317 * XXXRW: For now, PR_ADDR because soreceive will bump into them
318 * due to our use of sbappendaddr. A new sbappend variants is needed
319 * that supports both atomic record writes and control data.
320 */
321 .pr_flags = PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|PR_WANTRCVD|
322 PR_RIGHTS,
323 .pr_ctloutput = &uipc_ctloutput,
324 .pr_usrreqs = &uipc_usrreqs_seqpacket,
325 },
326 };
327
328 static struct domain localdomain = {
329 .dom_family = AF_LOCAL,
330 .dom_name = "local",
331 .dom_init = unp_init,
332 .dom_externalize = unp_externalize,
333 .dom_dispose = unp_dispose,
334 .dom_protosw = localsw,
335 .dom_protoswNPROTOSW = &localsw[sizeof(localsw)/sizeof(localsw[0])]
336 };
337 DOMAIN_SET(local);
338
339 static void
uipc_abort(struct socket * so)340 uipc_abort(struct socket *so)
341 {
342 struct unpcb *unp, *unp2;
343
344 unp = sotounpcb(so);
345 KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
346
347 UNP_LINK_WLOCK();
348 UNP_PCB_LOCK(unp);
349 unp2 = unp->unp_conn;
350 if (unp2 != NULL) {
351 UNP_PCB_LOCK(unp2);
352 unp_drop(unp2, ECONNABORTED);
353 UNP_PCB_UNLOCK(unp2);
354 }
355 UNP_PCB_UNLOCK(unp);
356 UNP_LINK_WUNLOCK();
357 }
358
359 static int
uipc_accept(struct socket * so,struct sockaddr ** nam)360 uipc_accept(struct socket *so, struct sockaddr **nam)
361 {
362 struct unpcb *unp, *unp2;
363 const struct sockaddr *sa;
364
365 /*
366 * Pass back name of connected socket, if it was bound and we are
367 * still connected (our peer may have closed already!).
368 */
369 unp = sotounpcb(so);
370 KASSERT(unp != NULL, ("uipc_accept: unp == NULL"));
371
372 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
373 UNP_LINK_RLOCK();
374 unp2 = unp->unp_conn;
375 if (unp2 != NULL && unp2->unp_addr != NULL) {
376 UNP_PCB_LOCK(unp2);
377 sa = (struct sockaddr *) unp2->unp_addr;
378 bcopy(sa, *nam, sa->sa_len);
379 UNP_PCB_UNLOCK(unp2);
380 } else {
381 sa = &sun_noname;
382 bcopy(sa, *nam, sa->sa_len);
383 }
384 UNP_LINK_RUNLOCK();
385 return (0);
386 }
387
388 static int
uipc_attach(struct socket * so,int proto,struct thread * td)389 uipc_attach(struct socket *so, int proto, struct thread *td)
390 {
391 u_long sendspace, recvspace;
392 struct unpcb *unp;
393 int error;
394
395 KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
396 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
397 switch (so->so_type) {
398 case SOCK_STREAM:
399 sendspace = unpst_sendspace;
400 recvspace = unpst_recvspace;
401 break;
402
403 case SOCK_DGRAM:
404 sendspace = unpdg_sendspace;
405 recvspace = unpdg_recvspace;
406 break;
407
408 case SOCK_SEQPACKET:
409 sendspace = unpsp_sendspace;
410 recvspace = unpsp_recvspace;
411 break;
412
413 default:
414 panic("uipc_attach");
415 }
416 error = soreserve(so, sendspace, recvspace);
417 if (error)
418 return (error);
419 }
420 unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
421 if (unp == NULL)
422 return (ENOBUFS);
423 LIST_INIT(&unp->unp_refs);
424 UNP_PCB_LOCK_INIT(unp);
425 unp->unp_socket = so;
426 so->so_pcb = unp;
427 unp->unp_refcount = 1;
428
429 UNP_LIST_LOCK();
430 unp->unp_gencnt = ++unp_gencnt;
431 unp_count++;
432 switch (so->so_type) {
433 case SOCK_STREAM:
434 LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
435 break;
436
437 case SOCK_DGRAM:
438 LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
439 break;
440
441 case SOCK_SEQPACKET:
442 LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
443 break;
444
445 default:
446 panic("uipc_attach");
447 }
448 UNP_LIST_UNLOCK();
449
450 return (0);
451 }
452
453 static int
uipc_bind(struct socket * so,struct sockaddr * nam,struct thread * td)454 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
455 {
456 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
457 struct vattr vattr;
458 int error, namelen, vfslocked;
459 struct nameidata nd;
460 struct unpcb *unp;
461 struct vnode *vp;
462 struct mount *mp;
463 char *buf;
464
465 unp = sotounpcb(so);
466 KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
467
468 if (soun->sun_len > sizeof(struct sockaddr_un))
469 return (EINVAL);
470 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
471 if (namelen <= 0)
472 return (EINVAL);
473
474 /*
475 * We don't allow simultaneous bind() calls on a single UNIX domain
476 * socket, so flag in-progress operations, and return an error if an
477 * operation is already in progress.
478 *
479 * Historically, we have not allowed a socket to be rebound, so this
480 * also returns an error. Not allowing re-binding simplifies the
481 * implementation and avoids a great many possible failure modes.
482 */
483 UNP_PCB_LOCK(unp);
484 if (unp->unp_vnode != NULL) {
485 UNP_PCB_UNLOCK(unp);
486 return (EINVAL);
487 }
488 if (unp->unp_flags & UNP_BINDING) {
489 UNP_PCB_UNLOCK(unp);
490 return (EALREADY);
491 }
492 unp->unp_flags |= UNP_BINDING;
493 UNP_PCB_UNLOCK(unp);
494
495 buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
496 bcopy(soun->sun_path, buf, namelen);
497 buf[namelen] = 0;
498
499 restart:
500 vfslocked = 0;
501 NDINIT(&nd, CREATE, MPSAFE | NOFOLLOW | LOCKPARENT | SAVENAME,
502 UIO_SYSSPACE, buf, td);
503 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
504 error = namei(&nd);
505 if (error)
506 goto error;
507 vp = nd.ni_vp;
508 vfslocked = NDHASGIANT(&nd);
509 if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
510 NDFREE(&nd, NDF_ONLY_PNBUF);
511 if (nd.ni_dvp == vp)
512 vrele(nd.ni_dvp);
513 else
514 vput(nd.ni_dvp);
515 if (vp != NULL) {
516 vrele(vp);
517 error = EADDRINUSE;
518 goto error;
519 }
520 error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH);
521 if (error)
522 goto error;
523 VFS_UNLOCK_GIANT(vfslocked);
524 goto restart;
525 }
526 VATTR_NULL(&vattr);
527 vattr.va_type = VSOCK;
528 vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask);
529 #ifdef MAC
530 error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
531 &vattr);
532 #endif
533 if (error == 0)
534 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
535 NDFREE(&nd, NDF_ONLY_PNBUF);
536 vput(nd.ni_dvp);
537 if (error) {
538 vn_finished_write(mp);
539 goto error;
540 }
541 vp = nd.ni_vp;
542 ASSERT_VOP_ELOCKED(vp, "uipc_bind");
543 soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
544
545 UNP_LINK_WLOCK();
546 UNP_PCB_LOCK(unp);
547 VOP_UNP_BIND(vp, unp->unp_socket);
548 unp->unp_vnode = vp;
549 unp->unp_addr = soun;
550 unp->unp_flags &= ~UNP_BINDING;
551 UNP_PCB_UNLOCK(unp);
552 UNP_LINK_WUNLOCK();
553 VOP_UNLOCK(vp, 0);
554 vn_finished_write(mp);
555 VFS_UNLOCK_GIANT(vfslocked);
556 free(buf, M_TEMP);
557 return (0);
558
559 error:
560 VFS_UNLOCK_GIANT(vfslocked);
561 UNP_PCB_LOCK(unp);
562 unp->unp_flags &= ~UNP_BINDING;
563 UNP_PCB_UNLOCK(unp);
564 free(buf, M_TEMP);
565 return (error);
566 }
567
568 static int
uipc_connect(struct socket * so,struct sockaddr * nam,struct thread * td)569 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
570 {
571 int error;
572
573 KASSERT(td == curthread, ("uipc_connect: td != curthread"));
574 UNP_LINK_WLOCK();
575 error = unp_connect(so, nam, td);
576 UNP_LINK_WUNLOCK();
577 return (error);
578 }
579
580 static void
uipc_close(struct socket * so)581 uipc_close(struct socket *so)
582 {
583 struct unpcb *unp, *unp2;
584
585 unp = sotounpcb(so);
586 KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
587
588 UNP_LINK_WLOCK();
589 UNP_PCB_LOCK(unp);
590 unp2 = unp->unp_conn;
591 if (unp2 != NULL) {
592 UNP_PCB_LOCK(unp2);
593 unp_disconnect(unp, unp2);
594 UNP_PCB_UNLOCK(unp2);
595 }
596 UNP_PCB_UNLOCK(unp);
597 UNP_LINK_WUNLOCK();
598 }
599
600 static int
uipc_connect2(struct socket * so1,struct socket * so2)601 uipc_connect2(struct socket *so1, struct socket *so2)
602 {
603 struct unpcb *unp, *unp2;
604 int error;
605
606 UNP_LINK_WLOCK();
607 unp = so1->so_pcb;
608 KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
609 UNP_PCB_LOCK(unp);
610 unp2 = so2->so_pcb;
611 KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
612 UNP_PCB_LOCK(unp2);
613 error = unp_connect2(so1, so2, PRU_CONNECT2);
614 UNP_PCB_UNLOCK(unp2);
615 UNP_PCB_UNLOCK(unp);
616 UNP_LINK_WUNLOCK();
617 return (error);
618 }
619
620 static void
uipc_detach(struct socket * so)621 uipc_detach(struct socket *so)
622 {
623 struct unpcb *unp, *unp2;
624 struct sockaddr_un *saved_unp_addr;
625 struct vnode *vp;
626 int freeunp, local_unp_rights;
627
628 unp = sotounpcb(so);
629 KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
630
631 UNP_LINK_WLOCK();
632 UNP_LIST_LOCK();
633 UNP_PCB_LOCK(unp);
634 LIST_REMOVE(unp, unp_link);
635 unp->unp_gencnt = ++unp_gencnt;
636 --unp_count;
637 UNP_LIST_UNLOCK();
638
639 /*
640 * XXXRW: Should assert vp->v_socket == so.
641 */
642 if ((vp = unp->unp_vnode) != NULL) {
643 VOP_UNP_DETACH(vp);
644 unp->unp_vnode = NULL;
645 }
646 unp2 = unp->unp_conn;
647 if (unp2 != NULL) {
648 UNP_PCB_LOCK(unp2);
649 unp_disconnect(unp, unp2);
650 UNP_PCB_UNLOCK(unp2);
651 }
652
653 /*
654 * We hold the linkage lock exclusively, so it's OK to acquire
655 * multiple pcb locks at a time.
656 */
657 while (!LIST_EMPTY(&unp->unp_refs)) {
658 struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
659
660 UNP_PCB_LOCK(ref);
661 unp_drop(ref, ECONNRESET);
662 UNP_PCB_UNLOCK(ref);
663 }
664 local_unp_rights = unp_rights;
665 UNP_LINK_WUNLOCK();
666 unp->unp_socket->so_pcb = NULL;
667 saved_unp_addr = unp->unp_addr;
668 unp->unp_addr = NULL;
669 unp->unp_refcount--;
670 freeunp = (unp->unp_refcount == 0);
671 if (saved_unp_addr != NULL)
672 free(saved_unp_addr, M_SONAME);
673 if (freeunp) {
674 UNP_PCB_LOCK_DESTROY(unp);
675 uma_zfree(unp_zone, unp);
676 } else
677 UNP_PCB_UNLOCK(unp);
678 if (vp) {
679 int vfslocked;
680
681 vfslocked = VFS_LOCK_GIANT(vp->v_mount);
682 vrele(vp);
683 VFS_UNLOCK_GIANT(vfslocked);
684 }
685 if (local_unp_rights)
686 taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
687 }
688
689 static int
uipc_disconnect(struct socket * so)690 uipc_disconnect(struct socket *so)
691 {
692 struct unpcb *unp, *unp2;
693
694 unp = sotounpcb(so);
695 KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
696
697 UNP_LINK_WLOCK();
698 UNP_PCB_LOCK(unp);
699 unp2 = unp->unp_conn;
700 if (unp2 != NULL) {
701 UNP_PCB_LOCK(unp2);
702 unp_disconnect(unp, unp2);
703 UNP_PCB_UNLOCK(unp2);
704 }
705 UNP_PCB_UNLOCK(unp);
706 UNP_LINK_WUNLOCK();
707 return (0);
708 }
709
710 static int
uipc_listen(struct socket * so,int backlog,struct thread * td)711 uipc_listen(struct socket *so, int backlog, struct thread *td)
712 {
713 struct unpcb *unp;
714 int error;
715
716 unp = sotounpcb(so);
717 KASSERT(unp != NULL, ("uipc_listen: unp == NULL"));
718
719 UNP_PCB_LOCK(unp);
720 if (unp->unp_vnode == NULL) {
721 UNP_PCB_UNLOCK(unp);
722 return (EINVAL);
723 }
724
725 SOCK_LOCK(so);
726 error = solisten_proto_check(so);
727 if (error == 0) {
728 cru2x(td->td_ucred, &unp->unp_peercred);
729 unp->unp_flags |= UNP_HAVEPCCACHED;
730 solisten_proto(so, backlog);
731 }
732 SOCK_UNLOCK(so);
733 UNP_PCB_UNLOCK(unp);
734 return (error);
735 }
736
737 static int
uipc_peeraddr(struct socket * so,struct sockaddr ** nam)738 uipc_peeraddr(struct socket *so, struct sockaddr **nam)
739 {
740 struct unpcb *unp, *unp2;
741 const struct sockaddr *sa;
742
743 unp = sotounpcb(so);
744 KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
745
746 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
747 UNP_LINK_RLOCK();
748 /*
749 * XXX: It seems that this test always fails even when connection is
750 * established. So, this else clause is added as workaround to
751 * return PF_LOCAL sockaddr.
752 */
753 unp2 = unp->unp_conn;
754 if (unp2 != NULL) {
755 UNP_PCB_LOCK(unp2);
756 if (unp2->unp_addr != NULL)
757 sa = (struct sockaddr *) unp2->unp_addr;
758 else
759 sa = &sun_noname;
760 bcopy(sa, *nam, sa->sa_len);
761 UNP_PCB_UNLOCK(unp2);
762 } else {
763 sa = &sun_noname;
764 bcopy(sa, *nam, sa->sa_len);
765 }
766 UNP_LINK_RUNLOCK();
767 return (0);
768 }
769
770 static int
uipc_rcvd(struct socket * so,int flags)771 uipc_rcvd(struct socket *so, int flags)
772 {
773 struct unpcb *unp, *unp2;
774 struct socket *so2;
775 u_int mbcnt, sbcc;
776 u_long newhiwat;
777
778 unp = sotounpcb(so);
779 KASSERT(unp != NULL, ("uipc_rcvd: unp == NULL"));
780
781 if (so->so_type != SOCK_STREAM && so->so_type != SOCK_SEQPACKET)
782 panic("uipc_rcvd socktype %d", so->so_type);
783
784 /*
785 * Adjust backpressure on sender and wakeup any waiting to write.
786 *
787 * The unp lock is acquired to maintain the validity of the unp_conn
788 * pointer; no lock on unp2 is required as unp2->unp_socket will be
789 * static as long as we don't permit unp2 to disconnect from unp,
790 * which is prevented by the lock on unp. We cache values from
791 * so_rcv to avoid holding the so_rcv lock over the entire
792 * transaction on the remote so_snd.
793 */
794 SOCKBUF_LOCK(&so->so_rcv);
795 mbcnt = so->so_rcv.sb_mbcnt;
796 sbcc = so->so_rcv.sb_cc;
797 SOCKBUF_UNLOCK(&so->so_rcv);
798 UNP_PCB_LOCK(unp);
799 unp2 = unp->unp_conn;
800 if (unp2 == NULL) {
801 UNP_PCB_UNLOCK(unp);
802 return (0);
803 }
804 so2 = unp2->unp_socket;
805 SOCKBUF_LOCK(&so2->so_snd);
806 so2->so_snd.sb_mbmax += unp->unp_mbcnt - mbcnt;
807 newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc - sbcc;
808 (void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat,
809 newhiwat, RLIM_INFINITY);
810 sowwakeup_locked(so2);
811 unp->unp_mbcnt = mbcnt;
812 unp->unp_cc = sbcc;
813 UNP_PCB_UNLOCK(unp);
814 return (0);
815 }
816
817 static int
uipc_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct thread * td)818 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
819 struct mbuf *control, struct thread *td)
820 {
821 struct unpcb *unp, *unp2;
822 struct socket *so2;
823 u_int mbcnt_delta, sbcc;
824 u_int newhiwat;
825 int error = 0;
826
827 unp = sotounpcb(so);
828 KASSERT(unp != NULL, ("uipc_send: unp == NULL"));
829
830 if (flags & PRUS_OOB) {
831 error = EOPNOTSUPP;
832 goto release;
833 }
834 if (control != NULL && (error = unp_internalize(&control, td)))
835 goto release;
836 if ((nam != NULL) || (flags & PRUS_EOF))
837 UNP_LINK_WLOCK();
838 else
839 UNP_LINK_RLOCK();
840 switch (so->so_type) {
841 case SOCK_DGRAM:
842 {
843 const struct sockaddr *from;
844
845 unp2 = unp->unp_conn;
846 if (nam != NULL) {
847 UNP_LINK_WLOCK_ASSERT();
848 if (unp2 != NULL) {
849 error = EISCONN;
850 break;
851 }
852 error = unp_connect(so, nam, td);
853 if (error)
854 break;
855 unp2 = unp->unp_conn;
856 }
857
858 /*
859 * Because connect() and send() are non-atomic in a sendto()
860 * with a target address, it's possible that the socket will
861 * have disconnected before the send() can run. In that case
862 * return the slightly counter-intuitive but otherwise
863 * correct error that the socket is not connected.
864 */
865 if (unp2 == NULL) {
866 error = ENOTCONN;
867 break;
868 }
869 /* Lockless read. */
870 if (unp2->unp_flags & UNP_WANTCRED)
871 control = unp_addsockcred(td, control);
872 UNP_PCB_LOCK(unp);
873 if (unp->unp_addr != NULL)
874 from = (struct sockaddr *)unp->unp_addr;
875 else
876 from = &sun_noname;
877 so2 = unp2->unp_socket;
878 SOCKBUF_LOCK(&so2->so_rcv);
879 if (sbappendaddr_locked(&so2->so_rcv, from, m,
880 control)) {
881 sorwakeup_locked(so2);
882 m = NULL;
883 control = NULL;
884 } else {
885 SOCKBUF_UNLOCK(&so2->so_rcv);
886 error = ENOBUFS;
887 }
888 if (nam != NULL) {
889 UNP_LINK_WLOCK_ASSERT();
890 UNP_PCB_LOCK(unp2);
891 unp_disconnect(unp, unp2);
892 UNP_PCB_UNLOCK(unp2);
893 }
894 UNP_PCB_UNLOCK(unp);
895 break;
896 }
897
898 case SOCK_SEQPACKET:
899 case SOCK_STREAM:
900 if ((so->so_state & SS_ISCONNECTED) == 0) {
901 if (nam != NULL) {
902 UNP_LINK_WLOCK_ASSERT();
903 error = unp_connect(so, nam, td);
904 if (error)
905 break; /* XXX */
906 } else {
907 error = ENOTCONN;
908 break;
909 }
910 }
911
912 /* Lockless read. */
913 if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
914 error = EPIPE;
915 break;
916 }
917
918 /*
919 * Because connect() and send() are non-atomic in a sendto()
920 * with a target address, it's possible that the socket will
921 * have disconnected before the send() can run. In that case
922 * return the slightly counter-intuitive but otherwise
923 * correct error that the socket is not connected.
924 *
925 * Locking here must be done carefully: the linkage lock
926 * prevents interconnections between unpcbs from changing, so
927 * we can traverse from unp to unp2 without acquiring unp's
928 * lock. Socket buffer locks follow unpcb locks, so we can
929 * acquire both remote and lock socket buffer locks.
930 */
931 unp2 = unp->unp_conn;
932 if (unp2 == NULL) {
933 error = ENOTCONN;
934 break;
935 }
936 so2 = unp2->unp_socket;
937 UNP_PCB_LOCK(unp2);
938 SOCKBUF_LOCK(&so2->so_rcv);
939 if (unp2->unp_flags & UNP_WANTCRED) {
940 /*
941 * Credentials are passed only once on SOCK_STREAM
942 * and SOCK_SEQPACKET.
943 */
944 unp2->unp_flags &= ~UNP_WANTCRED;
945 control = unp_addsockcred(td, control);
946 }
947 /*
948 * Send to paired receive port, and then reduce send buffer
949 * hiwater marks to maintain backpressure. Wake up readers.
950 */
951 switch (so->so_type) {
952 case SOCK_STREAM:
953 if (control != NULL) {
954 if (sbappendcontrol_locked(&so2->so_rcv, m,
955 control))
956 control = NULL;
957 } else
958 sbappend_locked(&so2->so_rcv, m);
959 break;
960
961 case SOCK_SEQPACKET: {
962 const struct sockaddr *from;
963
964 from = &sun_noname;
965 /*
966 * Don't check for space available in so2->so_rcv.
967 * Unix domain sockets only check for space in the
968 * sending sockbuf, and that check is performed one
969 * level up the stack.
970 */
971 if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
972 from, m, control))
973 control = NULL;
974 break;
975 }
976 }
977
978 /*
979 * XXXRW: While fine for SOCK_STREAM, this conflates maximum
980 * datagram size and back-pressure for SOCK_SEQPACKET, which
981 * can lead to undesired return of EMSGSIZE on send instead
982 * of more desirable blocking.
983 */
984 mbcnt_delta = so2->so_rcv.sb_mbcnt - unp2->unp_mbcnt;
985 unp2->unp_mbcnt = so2->so_rcv.sb_mbcnt;
986 sbcc = so2->so_rcv.sb_cc;
987 sorwakeup_locked(so2);
988
989 SOCKBUF_LOCK(&so->so_snd);
990 if ((int)so->so_snd.sb_hiwat >= (int)(sbcc - unp2->unp_cc))
991 newhiwat = so->so_snd.sb_hiwat - (sbcc - unp2->unp_cc);
992 else
993 newhiwat = 0;
994 (void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat,
995 newhiwat, RLIM_INFINITY);
996 so->so_snd.sb_mbmax -= mbcnt_delta;
997 SOCKBUF_UNLOCK(&so->so_snd);
998 unp2->unp_cc = sbcc;
999 UNP_PCB_UNLOCK(unp2);
1000 m = NULL;
1001 break;
1002
1003 default:
1004 panic("uipc_send unknown socktype");
1005 }
1006
1007 /*
1008 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown.
1009 */
1010 if (flags & PRUS_EOF) {
1011 UNP_PCB_LOCK(unp);
1012 socantsendmore(so);
1013 unp_shutdown(unp);
1014 UNP_PCB_UNLOCK(unp);
1015 }
1016
1017 if ((nam != NULL) || (flags & PRUS_EOF))
1018 UNP_LINK_WUNLOCK();
1019 else
1020 UNP_LINK_RUNLOCK();
1021
1022 if (control != NULL && error != 0)
1023 unp_dispose(control);
1024
1025 release:
1026 if (control != NULL)
1027 m_freem(control);
1028 if (m != NULL)
1029 m_freem(m);
1030 return (error);
1031 }
1032
1033 static int
uipc_sense(struct socket * so,struct stat * sb)1034 uipc_sense(struct socket *so, struct stat *sb)
1035 {
1036 struct unpcb *unp, *unp2;
1037 struct socket *so2;
1038
1039 unp = sotounpcb(so);
1040 KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1041
1042 sb->st_blksize = so->so_snd.sb_hiwat;
1043 UNP_LINK_RLOCK();
1044 UNP_PCB_LOCK(unp);
1045 unp2 = unp->unp_conn;
1046 if ((so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET) &&
1047 unp2 != NULL) {
1048 so2 = unp2->unp_socket;
1049 sb->st_blksize += so2->so_rcv.sb_cc;
1050 }
1051 sb->st_dev = NODEV;
1052 if (unp->unp_ino == 0)
1053 unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino;
1054 sb->st_ino = unp->unp_ino;
1055 UNP_PCB_UNLOCK(unp);
1056 UNP_LINK_RUNLOCK();
1057 return (0);
1058 }
1059
1060 static int
uipc_shutdown(struct socket * so)1061 uipc_shutdown(struct socket *so)
1062 {
1063 struct unpcb *unp;
1064
1065 unp = sotounpcb(so);
1066 KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
1067
1068 UNP_LINK_WLOCK();
1069 UNP_PCB_LOCK(unp);
1070 socantsendmore(so);
1071 unp_shutdown(unp);
1072 UNP_PCB_UNLOCK(unp);
1073 UNP_LINK_WUNLOCK();
1074 return (0);
1075 }
1076
1077 static int
uipc_sockaddr(struct socket * so,struct sockaddr ** nam)1078 uipc_sockaddr(struct socket *so, struct sockaddr **nam)
1079 {
1080 struct unpcb *unp;
1081 const struct sockaddr *sa;
1082
1083 unp = sotounpcb(so);
1084 KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1085
1086 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1087 UNP_PCB_LOCK(unp);
1088 if (unp->unp_addr != NULL)
1089 sa = (struct sockaddr *) unp->unp_addr;
1090 else
1091 sa = &sun_noname;
1092 bcopy(sa, *nam, sa->sa_len);
1093 UNP_PCB_UNLOCK(unp);
1094 return (0);
1095 }
1096
1097 static struct pr_usrreqs uipc_usrreqs_dgram = {
1098 .pru_abort = uipc_abort,
1099 .pru_accept = uipc_accept,
1100 .pru_attach = uipc_attach,
1101 .pru_bind = uipc_bind,
1102 .pru_connect = uipc_connect,
1103 .pru_connect2 = uipc_connect2,
1104 .pru_detach = uipc_detach,
1105 .pru_disconnect = uipc_disconnect,
1106 .pru_listen = uipc_listen,
1107 .pru_peeraddr = uipc_peeraddr,
1108 .pru_rcvd = uipc_rcvd,
1109 .pru_send = uipc_send,
1110 .pru_sense = uipc_sense,
1111 .pru_shutdown = uipc_shutdown,
1112 .pru_sockaddr = uipc_sockaddr,
1113 .pru_soreceive = soreceive_dgram,
1114 .pru_close = uipc_close,
1115 };
1116
1117 static struct pr_usrreqs uipc_usrreqs_seqpacket = {
1118 .pru_abort = uipc_abort,
1119 .pru_accept = uipc_accept,
1120 .pru_attach = uipc_attach,
1121 .pru_bind = uipc_bind,
1122 .pru_connect = uipc_connect,
1123 .pru_connect2 = uipc_connect2,
1124 .pru_detach = uipc_detach,
1125 .pru_disconnect = uipc_disconnect,
1126 .pru_listen = uipc_listen,
1127 .pru_peeraddr = uipc_peeraddr,
1128 .pru_rcvd = uipc_rcvd,
1129 .pru_send = uipc_send,
1130 .pru_sense = uipc_sense,
1131 .pru_shutdown = uipc_shutdown,
1132 .pru_sockaddr = uipc_sockaddr,
1133 .pru_soreceive = soreceive_generic, /* XXX: or...? */
1134 .pru_close = uipc_close,
1135 };
1136
1137 static struct pr_usrreqs uipc_usrreqs_stream = {
1138 .pru_abort = uipc_abort,
1139 .pru_accept = uipc_accept,
1140 .pru_attach = uipc_attach,
1141 .pru_bind = uipc_bind,
1142 .pru_connect = uipc_connect,
1143 .pru_connect2 = uipc_connect2,
1144 .pru_detach = uipc_detach,
1145 .pru_disconnect = uipc_disconnect,
1146 .pru_listen = uipc_listen,
1147 .pru_peeraddr = uipc_peeraddr,
1148 .pru_rcvd = uipc_rcvd,
1149 .pru_send = uipc_send,
1150 .pru_sense = uipc_sense,
1151 .pru_shutdown = uipc_shutdown,
1152 .pru_sockaddr = uipc_sockaddr,
1153 .pru_soreceive = soreceive_generic,
1154 .pru_close = uipc_close,
1155 };
1156
1157 static int
uipc_ctloutput(struct socket * so,struct sockopt * sopt)1158 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
1159 {
1160 struct unpcb *unp;
1161 struct xucred xu;
1162 int error, optval;
1163
1164 if (sopt->sopt_level != 0)
1165 return (EINVAL);
1166
1167 unp = sotounpcb(so);
1168 KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
1169 error = 0;
1170 switch (sopt->sopt_dir) {
1171 case SOPT_GET:
1172 switch (sopt->sopt_name) {
1173 case LOCAL_PEERCRED:
1174 UNP_PCB_LOCK(unp);
1175 if (unp->unp_flags & UNP_HAVEPC)
1176 xu = unp->unp_peercred;
1177 else {
1178 if (so->so_type == SOCK_STREAM)
1179 error = ENOTCONN;
1180 else
1181 error = EINVAL;
1182 }
1183 UNP_PCB_UNLOCK(unp);
1184 if (error == 0)
1185 error = sooptcopyout(sopt, &xu, sizeof(xu));
1186 break;
1187
1188 case LOCAL_CREDS:
1189 /* Unlocked read. */
1190 optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0;
1191 error = sooptcopyout(sopt, &optval, sizeof(optval));
1192 break;
1193
1194 case LOCAL_CONNWAIT:
1195 /* Unlocked read. */
1196 optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0;
1197 error = sooptcopyout(sopt, &optval, sizeof(optval));
1198 break;
1199
1200 default:
1201 error = EOPNOTSUPP;
1202 break;
1203 }
1204 break;
1205
1206 case SOPT_SET:
1207 switch (sopt->sopt_name) {
1208 case LOCAL_CREDS:
1209 case LOCAL_CONNWAIT:
1210 error = sooptcopyin(sopt, &optval, sizeof(optval),
1211 sizeof(optval));
1212 if (error)
1213 break;
1214
1215 #define OPTSET(bit) do { \
1216 UNP_PCB_LOCK(unp); \
1217 if (optval) \
1218 unp->unp_flags |= bit; \
1219 else \
1220 unp->unp_flags &= ~bit; \
1221 UNP_PCB_UNLOCK(unp); \
1222 } while (0)
1223
1224 switch (sopt->sopt_name) {
1225 case LOCAL_CREDS:
1226 OPTSET(UNP_WANTCRED);
1227 break;
1228
1229 case LOCAL_CONNWAIT:
1230 OPTSET(UNP_CONNWAIT);
1231 break;
1232
1233 default:
1234 break;
1235 }
1236 break;
1237 #undef OPTSET
1238 default:
1239 error = ENOPROTOOPT;
1240 break;
1241 }
1242 break;
1243
1244 default:
1245 error = EOPNOTSUPP;
1246 break;
1247 }
1248 return (error);
1249 }
1250
1251 static int
unp_connect(struct socket * so,struct sockaddr * nam,struct thread * td)1252 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1253 {
1254 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
1255 struct vnode *vp;
1256 struct socket *so2, *so3;
1257 struct unpcb *unp, *unp2, *unp3;
1258 int error, len, vfslocked;
1259 struct nameidata nd;
1260 char buf[SOCK_MAXADDRLEN];
1261 struct sockaddr *sa;
1262
1263 UNP_LINK_WLOCK_ASSERT();
1264
1265 unp = sotounpcb(so);
1266 KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1267
1268 if (nam->sa_len > sizeof(struct sockaddr_un))
1269 return (EINVAL);
1270 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
1271 if (len <= 0)
1272 return (EINVAL);
1273 bcopy(soun->sun_path, buf, len);
1274 buf[len] = 0;
1275
1276 UNP_PCB_LOCK(unp);
1277 if (unp->unp_flags & UNP_CONNECTING) {
1278 UNP_PCB_UNLOCK(unp);
1279 return (EALREADY);
1280 }
1281 UNP_LINK_WUNLOCK();
1282 unp->unp_flags |= UNP_CONNECTING;
1283 UNP_PCB_UNLOCK(unp);
1284
1285 sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1286 NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | LOCKSHARED | LOCKLEAF,
1287 UIO_SYSSPACE, buf, td);
1288 error = namei(&nd);
1289 if (error)
1290 vp = NULL;
1291 else
1292 vp = nd.ni_vp;
1293 ASSERT_VOP_LOCKED(vp, "unp_connect");
1294 vfslocked = NDHASGIANT(&nd);
1295 NDFREE(&nd, NDF_ONLY_PNBUF);
1296 if (error)
1297 goto bad;
1298
1299 if (vp->v_type != VSOCK) {
1300 error = ENOTSOCK;
1301 goto bad;
1302 }
1303 #ifdef MAC
1304 error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
1305 if (error)
1306 goto bad;
1307 #endif
1308 error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1309 if (error)
1310 goto bad;
1311 VFS_UNLOCK_GIANT(vfslocked);
1312
1313 unp = sotounpcb(so);
1314 KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1315
1316 /*
1317 * Lock linkage lock for two reasons: make sure v_socket is stable,
1318 * and to protect simultaneous locking of multiple pcbs.
1319 */
1320 UNP_LINK_WLOCK();
1321 VOP_UNP_CONNECT(vp, &so2);
1322 if (so2 == NULL) {
1323 error = ECONNREFUSED;
1324 goto bad2;
1325 }
1326 if (so->so_type != so2->so_type) {
1327 error = EPROTOTYPE;
1328 goto bad2;
1329 }
1330 if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1331 if (so2->so_options & SO_ACCEPTCONN) {
1332 CURVNET_SET(so2->so_vnet);
1333 so3 = sonewconn(so2, 0);
1334 CURVNET_RESTORE();
1335 } else
1336 so3 = NULL;
1337 if (so3 == NULL) {
1338 error = ECONNREFUSED;
1339 goto bad2;
1340 }
1341 unp = sotounpcb(so);
1342 unp2 = sotounpcb(so2);
1343 unp3 = sotounpcb(so3);
1344 UNP_PCB_LOCK(unp);
1345 UNP_PCB_LOCK(unp2);
1346 UNP_PCB_LOCK(unp3);
1347 if (unp2->unp_addr != NULL) {
1348 bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
1349 unp3->unp_addr = (struct sockaddr_un *) sa;
1350 sa = NULL;
1351 }
1352
1353 /*
1354 * The connector's (client's) credentials are copied from its
1355 * process structure at the time of connect() (which is now).
1356 */
1357 cru2x(td->td_ucred, &unp3->unp_peercred);
1358 unp3->unp_flags |= UNP_HAVEPC;
1359
1360 /*
1361 * The receiver's (server's) credentials are copied from the
1362 * unp_peercred member of socket on which the former called
1363 * listen(); uipc_listen() cached that process's credentials
1364 * at that time so we can use them now.
1365 */
1366 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1367 ("unp_connect: listener without cached peercred"));
1368 memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1369 sizeof(unp->unp_peercred));
1370 unp->unp_flags |= UNP_HAVEPC;
1371 if (unp2->unp_flags & UNP_WANTCRED)
1372 unp3->unp_flags |= UNP_WANTCRED;
1373 UNP_PCB_UNLOCK(unp3);
1374 UNP_PCB_UNLOCK(unp2);
1375 UNP_PCB_UNLOCK(unp);
1376 #ifdef MAC
1377 mac_socketpeer_set_from_socket(so, so3);
1378 mac_socketpeer_set_from_socket(so3, so);
1379 #endif
1380
1381 so2 = so3;
1382 }
1383 unp = sotounpcb(so);
1384 KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1385 unp2 = sotounpcb(so2);
1386 KASSERT(unp2 != NULL, ("unp_connect: unp2 == NULL"));
1387 UNP_PCB_LOCK(unp);
1388 UNP_PCB_LOCK(unp2);
1389 error = unp_connect2(so, so2, PRU_CONNECT);
1390 UNP_PCB_UNLOCK(unp2);
1391 UNP_PCB_UNLOCK(unp);
1392 bad2:
1393 UNP_LINK_WUNLOCK();
1394 if (vfslocked)
1395 /*
1396 * Giant has been previously acquired. This means filesystem
1397 * isn't MPSAFE. Do it once again.
1398 */
1399 mtx_lock(&Giant);
1400 bad:
1401 if (vp != NULL)
1402 vput(vp);
1403 VFS_UNLOCK_GIANT(vfslocked);
1404 free(sa, M_SONAME);
1405 UNP_LINK_WLOCK();
1406 UNP_PCB_LOCK(unp);
1407 unp->unp_flags &= ~UNP_CONNECTING;
1408 UNP_PCB_UNLOCK(unp);
1409 return (error);
1410 }
1411
1412 static int
unp_connect2(struct socket * so,struct socket * so2,int req)1413 unp_connect2(struct socket *so, struct socket *so2, int req)
1414 {
1415 struct unpcb *unp;
1416 struct unpcb *unp2;
1417
1418 unp = sotounpcb(so);
1419 KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
1420 unp2 = sotounpcb(so2);
1421 KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
1422
1423 UNP_LINK_WLOCK_ASSERT();
1424 UNP_PCB_LOCK_ASSERT(unp);
1425 UNP_PCB_LOCK_ASSERT(unp2);
1426
1427 if (so2->so_type != so->so_type)
1428 return (EPROTOTYPE);
1429 unp->unp_conn = unp2;
1430
1431 switch (so->so_type) {
1432 case SOCK_DGRAM:
1433 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1434 soisconnected(so);
1435 break;
1436
1437 case SOCK_STREAM:
1438 case SOCK_SEQPACKET:
1439 unp2->unp_conn = unp;
1440 if (req == PRU_CONNECT &&
1441 ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
1442 soisconnecting(so);
1443 else
1444 soisconnected(so);
1445 soisconnected(so2);
1446 break;
1447
1448 default:
1449 panic("unp_connect2");
1450 }
1451 return (0);
1452 }
1453
1454 static void
unp_disconnect(struct unpcb * unp,struct unpcb * unp2)1455 unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
1456 {
1457 struct socket *so;
1458
1459 KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL"));
1460
1461 UNP_LINK_WLOCK_ASSERT();
1462 UNP_PCB_LOCK_ASSERT(unp);
1463 UNP_PCB_LOCK_ASSERT(unp2);
1464
1465 unp->unp_conn = NULL;
1466 switch (unp->unp_socket->so_type) {
1467 case SOCK_DGRAM:
1468 LIST_REMOVE(unp, unp_reflink);
1469 so = unp->unp_socket;
1470 SOCK_LOCK(so);
1471 so->so_state &= ~SS_ISCONNECTED;
1472 SOCK_UNLOCK(so);
1473 break;
1474
1475 case SOCK_STREAM:
1476 case SOCK_SEQPACKET:
1477 soisdisconnected(unp->unp_socket);
1478 unp2->unp_conn = NULL;
1479 soisdisconnected(unp2->unp_socket);
1480 break;
1481 }
1482 }
1483
1484 /*
1485 * unp_pcblist() walks the global list of struct unpcb's to generate a
1486 * pointer list, bumping the refcount on each unpcb. It then copies them out
1487 * sequentially, validating the generation number on each to see if it has
1488 * been detached. All of this is necessary because copyout() may sleep on
1489 * disk I/O.
1490 */
1491 static int
unp_pcblist(SYSCTL_HANDLER_ARGS)1492 unp_pcblist(SYSCTL_HANDLER_ARGS)
1493 {
1494 int error, i, n;
1495 int freeunp;
1496 struct unpcb *unp, **unp_list;
1497 unp_gen_t gencnt;
1498 struct xunpgen *xug;
1499 struct unp_head *head;
1500 struct xunpcb *xu;
1501
1502 switch ((intptr_t)arg1) {
1503 case SOCK_STREAM:
1504 head = &unp_shead;
1505 break;
1506
1507 case SOCK_DGRAM:
1508 head = &unp_dhead;
1509 break;
1510
1511 case SOCK_SEQPACKET:
1512 head = &unp_sphead;
1513 break;
1514
1515 default:
1516 panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
1517 }
1518
1519 /*
1520 * The process of preparing the PCB list is too time-consuming and
1521 * resource-intensive to repeat twice on every request.
1522 */
1523 if (req->oldptr == NULL) {
1524 n = unp_count;
1525 req->oldidx = 2 * (sizeof *xug)
1526 + (n + n/8) * sizeof(struct xunpcb);
1527 return (0);
1528 }
1529
1530 if (req->newptr != NULL)
1531 return (EPERM);
1532
1533 /*
1534 * OK, now we're committed to doing something.
1535 */
1536 xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK);
1537 UNP_LIST_LOCK();
1538 gencnt = unp_gencnt;
1539 n = unp_count;
1540 UNP_LIST_UNLOCK();
1541
1542 xug->xug_len = sizeof *xug;
1543 xug->xug_count = n;
1544 xug->xug_gen = gencnt;
1545 xug->xug_sogen = so_gencnt;
1546 error = SYSCTL_OUT(req, xug, sizeof *xug);
1547 if (error) {
1548 free(xug, M_TEMP);
1549 return (error);
1550 }
1551
1552 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
1553
1554 UNP_LIST_LOCK();
1555 for (unp = LIST_FIRST(head), i = 0; unp && i < n;
1556 unp = LIST_NEXT(unp, unp_link)) {
1557 UNP_PCB_LOCK(unp);
1558 if (unp->unp_gencnt <= gencnt) {
1559 if (cr_cansee(req->td->td_ucred,
1560 unp->unp_socket->so_cred)) {
1561 UNP_PCB_UNLOCK(unp);
1562 continue;
1563 }
1564 unp_list[i++] = unp;
1565 unp->unp_refcount++;
1566 }
1567 UNP_PCB_UNLOCK(unp);
1568 }
1569 UNP_LIST_UNLOCK();
1570 n = i; /* In case we lost some during malloc. */
1571
1572 error = 0;
1573 xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
1574 for (i = 0; i < n; i++) {
1575 unp = unp_list[i];
1576 UNP_PCB_LOCK(unp);
1577 unp->unp_refcount--;
1578 if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) {
1579 xu->xu_len = sizeof *xu;
1580 xu->xu_unpp = unp;
1581 /*
1582 * XXX - need more locking here to protect against
1583 * connect/disconnect races for SMP.
1584 */
1585 if (unp->unp_addr != NULL)
1586 bcopy(unp->unp_addr, &xu->xu_addr,
1587 unp->unp_addr->sun_len);
1588 if (unp->unp_conn != NULL &&
1589 unp->unp_conn->unp_addr != NULL)
1590 bcopy(unp->unp_conn->unp_addr,
1591 &xu->xu_caddr,
1592 unp->unp_conn->unp_addr->sun_len);
1593 bcopy(unp, &xu->xu_unp, sizeof *unp);
1594 sotoxsocket(unp->unp_socket, &xu->xu_socket);
1595 UNP_PCB_UNLOCK(unp);
1596 error = SYSCTL_OUT(req, xu, sizeof *xu);
1597 } else {
1598 freeunp = (unp->unp_refcount == 0);
1599 UNP_PCB_UNLOCK(unp);
1600 if (freeunp) {
1601 UNP_PCB_LOCK_DESTROY(unp);
1602 uma_zfree(unp_zone, unp);
1603 }
1604 }
1605 }
1606 free(xu, M_TEMP);
1607 if (!error) {
1608 /*
1609 * Give the user an updated idea of our state. If the
1610 * generation differs from what we told her before, she knows
1611 * that something happened while we were processing this
1612 * request, and it might be necessary to retry.
1613 */
1614 xug->xug_gen = unp_gencnt;
1615 xug->xug_sogen = so_gencnt;
1616 xug->xug_count = unp_count;
1617 error = SYSCTL_OUT(req, xug, sizeof *xug);
1618 }
1619 free(unp_list, M_TEMP);
1620 free(xug, M_TEMP);
1621 return (error);
1622 }
1623
1624 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
1625 (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
1626 "List of active local datagram sockets");
1627 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
1628 (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
1629 "List of active local stream sockets");
1630 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
1631 CTLTYPE_OPAQUE | CTLFLAG_RD,
1632 (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
1633 "List of active local seqpacket sockets");
1634
1635 static void
unp_shutdown(struct unpcb * unp)1636 unp_shutdown(struct unpcb *unp)
1637 {
1638 struct unpcb *unp2;
1639 struct socket *so;
1640
1641 UNP_LINK_WLOCK_ASSERT();
1642 UNP_PCB_LOCK_ASSERT(unp);
1643
1644 unp2 = unp->unp_conn;
1645 if ((unp->unp_socket->so_type == SOCK_STREAM ||
1646 (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
1647 so = unp2->unp_socket;
1648 if (so != NULL)
1649 socantrcvmore(so);
1650 }
1651 }
1652
1653 static void
unp_drop(struct unpcb * unp,int errno)1654 unp_drop(struct unpcb *unp, int errno)
1655 {
1656 struct socket *so = unp->unp_socket;
1657 struct unpcb *unp2;
1658
1659 UNP_LINK_WLOCK_ASSERT();
1660 UNP_PCB_LOCK_ASSERT(unp);
1661
1662 so->so_error = errno;
1663 unp2 = unp->unp_conn;
1664 if (unp2 == NULL)
1665 return;
1666 UNP_PCB_LOCK(unp2);
1667 unp_disconnect(unp, unp2);
1668 UNP_PCB_UNLOCK(unp2);
1669 }
1670
1671 static void
unp_freerights(struct file ** rp,int fdcount)1672 unp_freerights(struct file **rp, int fdcount)
1673 {
1674 int i;
1675 struct file *fp;
1676
1677 for (i = 0; i < fdcount; i++) {
1678 fp = *rp;
1679 *rp++ = NULL;
1680 unp_discard(fp);
1681 }
1682 }
1683
1684 static int
unp_externalize(struct mbuf * control,struct mbuf ** controlp)1685 unp_externalize(struct mbuf *control, struct mbuf **controlp)
1686 {
1687 struct thread *td = curthread; /* XXX */
1688 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1689 int i;
1690 int *fdp;
1691 struct file **rp;
1692 struct file *fp;
1693 void *data;
1694 socklen_t clen = control->m_len, datalen;
1695 int error, newfds;
1696 u_int newlen;
1697
1698 UNP_LINK_UNLOCK_ASSERT();
1699
1700 error = 0;
1701 if (controlp != NULL) /* controlp == NULL => free control messages */
1702 *controlp = NULL;
1703 while (cm != NULL) {
1704 if (sizeof(*cm) > clen || cm->cmsg_len > clen) {
1705 error = EINVAL;
1706 break;
1707 }
1708 data = CMSG_DATA(cm);
1709 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
1710 if (cm->cmsg_level == SOL_SOCKET
1711 && cm->cmsg_type == SCM_RIGHTS) {
1712 newfds = datalen / sizeof(struct file *);
1713 rp = data;
1714
1715 /* If we're not outputting the descriptors free them. */
1716 if (error || controlp == NULL) {
1717 unp_freerights(rp, newfds);
1718 goto next;
1719 }
1720 FILEDESC_XLOCK(td->td_proc->p_fd);
1721 /*
1722 * Now change each pointer to an fd in the global
1723 * table to an integer that is the index to the local
1724 * fd table entry that we set up to point to the
1725 * global one we are transferring.
1726 */
1727 newlen = newfds * sizeof(int);
1728 *controlp = sbcreatecontrol(NULL, newlen,
1729 SCM_RIGHTS, SOL_SOCKET);
1730 if (*controlp == NULL) {
1731 FILEDESC_XUNLOCK(td->td_proc->p_fd);
1732 error = E2BIG;
1733 unp_freerights(rp, newfds);
1734 goto next;
1735 }
1736
1737 fdp = (int *)
1738 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1739 if (fdallocn(td, 0, fdp, newfds) != 0) {
1740 FILEDESC_XUNLOCK(td->td_proc->p_fd);
1741 error = EMSGSIZE;
1742 unp_freerights(rp, newfds);
1743 m_freem(*controlp);
1744 *controlp = NULL;
1745 goto next;
1746 }
1747 for (i = 0; i < newfds; i++) {
1748 fp = *rp++;
1749 td->td_proc->p_fd->fd_ofiles[fdp[i]] = fp;
1750 unp_externalize_fp(fp);
1751 }
1752 FILEDESC_XUNLOCK(td->td_proc->p_fd);
1753 } else {
1754 /* We can just copy anything else across. */
1755 if (error || controlp == NULL)
1756 goto next;
1757 *controlp = sbcreatecontrol(NULL, datalen,
1758 cm->cmsg_type, cm->cmsg_level);
1759 if (*controlp == NULL) {
1760 error = ENOBUFS;
1761 goto next;
1762 }
1763 bcopy(data,
1764 CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
1765 datalen);
1766 }
1767 controlp = &(*controlp)->m_next;
1768
1769 next:
1770 if (CMSG_SPACE(datalen) < clen) {
1771 clen -= CMSG_SPACE(datalen);
1772 cm = (struct cmsghdr *)
1773 ((caddr_t)cm + CMSG_SPACE(datalen));
1774 } else {
1775 clen = 0;
1776 cm = NULL;
1777 }
1778 }
1779
1780 m_freem(control);
1781 return (error);
1782 }
1783
1784 static void
unp_zone_change(void * tag)1785 unp_zone_change(void *tag)
1786 {
1787
1788 uma_zone_set_max(unp_zone, maxsockets);
1789 }
1790
1791 static void
unp_init(void)1792 unp_init(void)
1793 {
1794
1795 #ifdef VIMAGE
1796 if (!IS_DEFAULT_VNET(curvnet))
1797 return;
1798 #endif
1799 unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, NULL,
1800 NULL, NULL, UMA_ALIGN_PTR, 0);
1801 if (unp_zone == NULL)
1802 panic("unp_init");
1803 uma_zone_set_max(unp_zone, maxsockets);
1804 EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
1805 NULL, EVENTHANDLER_PRI_ANY);
1806 LIST_INIT(&unp_dhead);
1807 LIST_INIT(&unp_shead);
1808 LIST_INIT(&unp_sphead);
1809 SLIST_INIT(&unp_defers);
1810 TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
1811 TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
1812 UNP_LINK_LOCK_INIT();
1813 UNP_LIST_LOCK_INIT();
1814 UNP_DEFERRED_LOCK_INIT();
1815 }
1816
1817 static int
unp_internalize(struct mbuf ** controlp,struct thread * td)1818 unp_internalize(struct mbuf **controlp, struct thread *td)
1819 {
1820 struct mbuf *control = *controlp;
1821 struct proc *p = td->td_proc;
1822 struct filedesc *fdescp = p->p_fd;
1823 struct bintime *bt;
1824 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1825 struct cmsgcred *cmcred;
1826 struct file **rp;
1827 struct file *fp;
1828 struct timeval *tv;
1829 int i, fd, *fdp;
1830 void *data;
1831 socklen_t clen = control->m_len, datalen;
1832 int error, oldfds;
1833 u_int newlen;
1834
1835 UNP_LINK_UNLOCK_ASSERT();
1836
1837 error = 0;
1838 *controlp = NULL;
1839 while (cm != NULL) {
1840 if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
1841 || cm->cmsg_len > clen) {
1842 error = EINVAL;
1843 goto out;
1844 }
1845 data = CMSG_DATA(cm);
1846 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
1847
1848 switch (cm->cmsg_type) {
1849 /*
1850 * Fill in credential information.
1851 */
1852 case SCM_CREDS:
1853 *controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
1854 SCM_CREDS, SOL_SOCKET);
1855 if (*controlp == NULL) {
1856 error = ENOBUFS;
1857 goto out;
1858 }
1859 cmcred = (struct cmsgcred *)
1860 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1861 cmcred->cmcred_pid = p->p_pid;
1862 cmcred->cmcred_uid = td->td_ucred->cr_ruid;
1863 cmcred->cmcred_gid = td->td_ucred->cr_rgid;
1864 cmcred->cmcred_euid = td->td_ucred->cr_uid;
1865 cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
1866 CMGROUP_MAX);
1867 for (i = 0; i < cmcred->cmcred_ngroups; i++)
1868 cmcred->cmcred_groups[i] =
1869 td->td_ucred->cr_groups[i];
1870 break;
1871
1872 case SCM_RIGHTS:
1873 oldfds = datalen / sizeof (int);
1874 /*
1875 * Check that all the FDs passed in refer to legal
1876 * files. If not, reject the entire operation.
1877 */
1878 fdp = data;
1879 FILEDESC_SLOCK(fdescp);
1880 for (i = 0; i < oldfds; i++) {
1881 fd = *fdp++;
1882 if ((unsigned)fd >= fdescp->fd_nfiles ||
1883 fdescp->fd_ofiles[fd] == NULL) {
1884 FILEDESC_SUNLOCK(fdescp);
1885 error = EBADF;
1886 goto out;
1887 }
1888 fp = fdescp->fd_ofiles[fd];
1889 if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
1890 FILEDESC_SUNLOCK(fdescp);
1891 error = EOPNOTSUPP;
1892 goto out;
1893 }
1894
1895 }
1896
1897 /*
1898 * Now replace the integer FDs with pointers to the
1899 * associated global file table entry..
1900 */
1901 newlen = oldfds * sizeof(struct file *);
1902 *controlp = sbcreatecontrol(NULL, newlen,
1903 SCM_RIGHTS, SOL_SOCKET);
1904 if (*controlp == NULL) {
1905 FILEDESC_SUNLOCK(fdescp);
1906 error = E2BIG;
1907 goto out;
1908 }
1909 fdp = data;
1910 rp = (struct file **)
1911 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1912 for (i = 0; i < oldfds; i++) {
1913 fp = fdescp->fd_ofiles[*fdp++];
1914 *rp++ = fp;
1915 unp_internalize_fp(fp);
1916 }
1917 FILEDESC_SUNLOCK(fdescp);
1918 break;
1919
1920 case SCM_TIMESTAMP:
1921 *controlp = sbcreatecontrol(NULL, sizeof(*tv),
1922 SCM_TIMESTAMP, SOL_SOCKET);
1923 if (*controlp == NULL) {
1924 error = ENOBUFS;
1925 goto out;
1926 }
1927 tv = (struct timeval *)
1928 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1929 microtime(tv);
1930 break;
1931
1932 case SCM_BINTIME:
1933 *controlp = sbcreatecontrol(NULL, sizeof(*bt),
1934 SCM_BINTIME, SOL_SOCKET);
1935 if (*controlp == NULL) {
1936 error = ENOBUFS;
1937 goto out;
1938 }
1939 bt = (struct bintime *)
1940 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1941 bintime(bt);
1942 break;
1943
1944 default:
1945 error = EINVAL;
1946 goto out;
1947 }
1948
1949 controlp = &(*controlp)->m_next;
1950 if (CMSG_SPACE(datalen) < clen) {
1951 clen -= CMSG_SPACE(datalen);
1952 cm = (struct cmsghdr *)
1953 ((caddr_t)cm + CMSG_SPACE(datalen));
1954 } else {
1955 clen = 0;
1956 cm = NULL;
1957 }
1958 }
1959
1960 out:
1961 m_freem(control);
1962 return (error);
1963 }
1964
1965 static struct mbuf *
unp_addsockcred(struct thread * td,struct mbuf * control)1966 unp_addsockcred(struct thread *td, struct mbuf *control)
1967 {
1968 struct mbuf *m, *n, *n_prev;
1969 struct sockcred *sc;
1970 const struct cmsghdr *cm;
1971 int ngroups;
1972 int i;
1973
1974 ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
1975 m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET);
1976 if (m == NULL)
1977 return (control);
1978
1979 sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *));
1980 sc->sc_uid = td->td_ucred->cr_ruid;
1981 sc->sc_euid = td->td_ucred->cr_uid;
1982 sc->sc_gid = td->td_ucred->cr_rgid;
1983 sc->sc_egid = td->td_ucred->cr_gid;
1984 sc->sc_ngroups = ngroups;
1985 for (i = 0; i < sc->sc_ngroups; i++)
1986 sc->sc_groups[i] = td->td_ucred->cr_groups[i];
1987
1988 /*
1989 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
1990 * created SCM_CREDS control message (struct sockcred) has another
1991 * format.
1992 */
1993 if (control != NULL)
1994 for (n = control, n_prev = NULL; n != NULL;) {
1995 cm = mtod(n, struct cmsghdr *);
1996 if (cm->cmsg_level == SOL_SOCKET &&
1997 cm->cmsg_type == SCM_CREDS) {
1998 if (n_prev == NULL)
1999 control = n->m_next;
2000 else
2001 n_prev->m_next = n->m_next;
2002 n = m_free(n);
2003 } else {
2004 n_prev = n;
2005 n = n->m_next;
2006 }
2007 }
2008
2009 /* Prepend it to the head. */
2010 m->m_next = control;
2011 return (m);
2012 }
2013
2014 static struct unpcb *
fptounp(struct file * fp)2015 fptounp(struct file *fp)
2016 {
2017 struct socket *so;
2018
2019 if (fp->f_type != DTYPE_SOCKET)
2020 return (NULL);
2021 if ((so = fp->f_data) == NULL)
2022 return (NULL);
2023 if (so->so_proto->pr_domain != &localdomain)
2024 return (NULL);
2025 return sotounpcb(so);
2026 }
2027
2028 static void
unp_discard(struct file * fp)2029 unp_discard(struct file *fp)
2030 {
2031 struct unp_defer *dr;
2032
2033 if (unp_externalize_fp(fp)) {
2034 dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
2035 dr->ud_fp = fp;
2036 UNP_DEFERRED_LOCK();
2037 SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
2038 UNP_DEFERRED_UNLOCK();
2039 atomic_add_int(&unp_defers_count, 1);
2040 taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
2041 } else
2042 (void) closef(fp, (struct thread *)NULL);
2043 }
2044
2045 static void
unp_process_defers(void * arg __unused,int pending)2046 unp_process_defers(void *arg __unused, int pending)
2047 {
2048 struct unp_defer *dr;
2049 SLIST_HEAD(, unp_defer) drl;
2050 int count;
2051
2052 SLIST_INIT(&drl);
2053 for (;;) {
2054 UNP_DEFERRED_LOCK();
2055 if (SLIST_FIRST(&unp_defers) == NULL) {
2056 UNP_DEFERRED_UNLOCK();
2057 break;
2058 }
2059 SLIST_SWAP(&unp_defers, &drl, unp_defer);
2060 UNP_DEFERRED_UNLOCK();
2061 count = 0;
2062 while ((dr = SLIST_FIRST(&drl)) != NULL) {
2063 SLIST_REMOVE_HEAD(&drl, ud_link);
2064 closef(dr->ud_fp, NULL);
2065 free(dr, M_TEMP);
2066 count++;
2067 }
2068 atomic_add_int(&unp_defers_count, -count);
2069 }
2070 }
2071
2072 static void
unp_internalize_fp(struct file * fp)2073 unp_internalize_fp(struct file *fp)
2074 {
2075 struct unpcb *unp;
2076
2077 UNP_LINK_WLOCK();
2078 if ((unp = fptounp(fp)) != NULL) {
2079 unp->unp_file = fp;
2080 unp->unp_msgcount++;
2081 }
2082 fhold(fp);
2083 unp_rights++;
2084 UNP_LINK_WUNLOCK();
2085 }
2086
2087 static int
unp_externalize_fp(struct file * fp)2088 unp_externalize_fp(struct file *fp)
2089 {
2090 struct unpcb *unp;
2091 int ret;
2092
2093 UNP_LINK_WLOCK();
2094 if ((unp = fptounp(fp)) != NULL) {
2095 unp->unp_msgcount--;
2096 ret = 1;
2097 } else
2098 ret = 0;
2099 unp_rights--;
2100 UNP_LINK_WUNLOCK();
2101 return (ret);
2102 }
2103
2104 /*
2105 * unp_defer indicates whether additional work has been defered for a future
2106 * pass through unp_gc(). It is thread local and does not require explicit
2107 * synchronization.
2108 */
2109 static int unp_marked;
2110 static int unp_unreachable;
2111
2112 static void
unp_accessable(struct file * fp)2113 unp_accessable(struct file *fp)
2114 {
2115 struct unpcb *unp;
2116
2117 if ((unp = fptounp(fp)) == NULL)
2118 return;
2119 if (unp->unp_gcflag & UNPGC_REF)
2120 return;
2121 unp->unp_gcflag &= ~UNPGC_DEAD;
2122 unp->unp_gcflag |= UNPGC_REF;
2123 unp_marked++;
2124 }
2125
2126 static void
unp_gc_process(struct unpcb * unp)2127 unp_gc_process(struct unpcb *unp)
2128 {
2129 struct socket *soa;
2130 struct socket *so;
2131 struct file *fp;
2132
2133 /* Already processed. */
2134 if (unp->unp_gcflag & UNPGC_SCANNED)
2135 return;
2136 fp = unp->unp_file;
2137
2138 /*
2139 * Check for a socket potentially in a cycle. It must be in a
2140 * queue as indicated by msgcount, and this must equal the file
2141 * reference count. Note that when msgcount is 0 the file is NULL.
2142 */
2143 if ((unp->unp_gcflag & UNPGC_REF) == 0 && fp &&
2144 unp->unp_msgcount != 0 && fp->f_count == unp->unp_msgcount) {
2145 unp->unp_gcflag |= UNPGC_DEAD;
2146 unp_unreachable++;
2147 return;
2148 }
2149
2150 /*
2151 * Mark all sockets we reference with RIGHTS.
2152 */
2153 so = unp->unp_socket;
2154 SOCKBUF_LOCK(&so->so_rcv);
2155 unp_scan(so->so_rcv.sb_mb, unp_accessable);
2156 SOCKBUF_UNLOCK(&so->so_rcv);
2157
2158 /*
2159 * Mark all sockets in our accept queue.
2160 */
2161 ACCEPT_LOCK();
2162 TAILQ_FOREACH(soa, &so->so_comp, so_list) {
2163 SOCKBUF_LOCK(&soa->so_rcv);
2164 unp_scan(soa->so_rcv.sb_mb, unp_accessable);
2165 SOCKBUF_UNLOCK(&soa->so_rcv);
2166 }
2167 ACCEPT_UNLOCK();
2168 unp->unp_gcflag |= UNPGC_SCANNED;
2169 }
2170
2171 static int unp_recycled;
2172 SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
2173 "Number of unreachable sockets claimed by the garbage collector.");
2174
2175 static int unp_taskcount;
2176 SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
2177 "Number of times the garbage collector has run.");
2178
2179 static void
unp_gc(__unused void * arg,int pending)2180 unp_gc(__unused void *arg, int pending)
2181 {
2182 struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
2183 NULL };
2184 struct unp_head **head;
2185 struct file *f, **unref;
2186 struct unpcb *unp;
2187 int i, total;
2188
2189 unp_taskcount++;
2190 UNP_LIST_LOCK();
2191 /*
2192 * First clear all gc flags from previous runs.
2193 */
2194 for (head = heads; *head != NULL; head++)
2195 LIST_FOREACH(unp, *head, unp_link)
2196 unp->unp_gcflag = 0;
2197
2198 /*
2199 * Scan marking all reachable sockets with UNPGC_REF. Once a socket
2200 * is reachable all of the sockets it references are reachable.
2201 * Stop the scan once we do a complete loop without discovering
2202 * a new reachable socket.
2203 */
2204 do {
2205 unp_unreachable = 0;
2206 unp_marked = 0;
2207 for (head = heads; *head != NULL; head++)
2208 LIST_FOREACH(unp, *head, unp_link)
2209 unp_gc_process(unp);
2210 } while (unp_marked);
2211 UNP_LIST_UNLOCK();
2212 if (unp_unreachable == 0)
2213 return;
2214
2215 /*
2216 * Allocate space for a local list of dead unpcbs.
2217 */
2218 unref = malloc(unp_unreachable * sizeof(struct file *),
2219 M_TEMP, M_WAITOK);
2220
2221 /*
2222 * Iterate looking for sockets which have been specifically marked
2223 * as as unreachable and store them locally.
2224 */
2225 UNP_LINK_RLOCK();
2226 UNP_LIST_LOCK();
2227 for (total = 0, head = heads; *head != NULL; head++)
2228 LIST_FOREACH(unp, *head, unp_link)
2229 if ((unp->unp_gcflag & UNPGC_DEAD) != 0) {
2230 f = unp->unp_file;
2231 if (unp->unp_msgcount == 0 || f == NULL ||
2232 f->f_count != unp->unp_msgcount)
2233 continue;
2234 unref[total++] = f;
2235 fhold(f);
2236 KASSERT(total <= unp_unreachable,
2237 ("unp_gc: incorrect unreachable count."));
2238 }
2239 UNP_LIST_UNLOCK();
2240 UNP_LINK_RUNLOCK();
2241
2242 /*
2243 * Now flush all sockets, free'ing rights. This will free the
2244 * struct files associated with these sockets but leave each socket
2245 * with one remaining ref.
2246 */
2247 for (i = 0; i < total; i++) {
2248 struct socket *so;
2249
2250 so = unref[i]->f_data;
2251 CURVNET_SET(so->so_vnet);
2252 sorflush(so);
2253 CURVNET_RESTORE();
2254 }
2255
2256 /*
2257 * And finally release the sockets so they can be reclaimed.
2258 */
2259 for (i = 0; i < total; i++)
2260 fdrop(unref[i], NULL);
2261 unp_recycled += total;
2262 free(unref, M_TEMP);
2263 }
2264
2265 static void
unp_dispose(struct mbuf * m)2266 unp_dispose(struct mbuf *m)
2267 {
2268
2269 if (m)
2270 unp_scan(m, unp_discard);
2271 }
2272
2273 static void
unp_scan(struct mbuf * m0,void (* op)(struct file *))2274 unp_scan(struct mbuf *m0, void (*op)(struct file *))
2275 {
2276 struct mbuf *m;
2277 struct file **rp;
2278 struct cmsghdr *cm;
2279 void *data;
2280 int i;
2281 socklen_t clen, datalen;
2282 int qfds;
2283
2284 while (m0 != NULL) {
2285 for (m = m0; m; m = m->m_next) {
2286 if (m->m_type != MT_CONTROL)
2287 continue;
2288
2289 cm = mtod(m, struct cmsghdr *);
2290 clen = m->m_len;
2291
2292 while (cm != NULL) {
2293 if (sizeof(*cm) > clen || cm->cmsg_len > clen)
2294 break;
2295
2296 data = CMSG_DATA(cm);
2297 datalen = (caddr_t)cm + cm->cmsg_len
2298 - (caddr_t)data;
2299
2300 if (cm->cmsg_level == SOL_SOCKET &&
2301 cm->cmsg_type == SCM_RIGHTS) {
2302 qfds = datalen / sizeof (struct file *);
2303 rp = data;
2304 for (i = 0; i < qfds; i++)
2305 (*op)(*rp++);
2306 }
2307
2308 if (CMSG_SPACE(datalen) < clen) {
2309 clen -= CMSG_SPACE(datalen);
2310 cm = (struct cmsghdr *)
2311 ((caddr_t)cm + CMSG_SPACE(datalen));
2312 } else {
2313 clen = 0;
2314 cm = NULL;
2315 }
2316 }
2317 }
2318 m0 = m0->m_act;
2319 }
2320 }
2321
2322 /*
2323 * A helper function called by VFS before socket-type vnode reclamation.
2324 * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
2325 * use count.
2326 */
2327 void
vfs_unp_reclaim(struct vnode * vp)2328 vfs_unp_reclaim(struct vnode *vp)
2329 {
2330 struct socket *so;
2331 struct unpcb *unp;
2332 int active;
2333
2334 ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
2335 KASSERT(vp->v_type == VSOCK,
2336 ("vfs_unp_reclaim: vp->v_type != VSOCK"));
2337
2338 active = 0;
2339 UNP_LINK_WLOCK();
2340 VOP_UNP_CONNECT(vp, &so);
2341 if (so == NULL)
2342 goto done;
2343 unp = sotounpcb(so);
2344 if (unp == NULL)
2345 goto done;
2346 UNP_PCB_LOCK(unp);
2347 if (unp->unp_vnode == vp) {
2348 VOP_UNP_DETACH(vp);
2349 unp->unp_vnode = NULL;
2350 active = 1;
2351 }
2352 UNP_PCB_UNLOCK(unp);
2353 done:
2354 UNP_LINK_WUNLOCK();
2355 if (active)
2356 vunref(vp);
2357 }
2358
2359 #ifdef DDB
2360 static void
db_print_indent(int indent)2361 db_print_indent(int indent)
2362 {
2363 int i;
2364
2365 for (i = 0; i < indent; i++)
2366 db_printf(" ");
2367 }
2368
2369 static void
db_print_unpflags(int unp_flags)2370 db_print_unpflags(int unp_flags)
2371 {
2372 int comma;
2373
2374 comma = 0;
2375 if (unp_flags & UNP_HAVEPC) {
2376 db_printf("%sUNP_HAVEPC", comma ? ", " : "");
2377 comma = 1;
2378 }
2379 if (unp_flags & UNP_HAVEPCCACHED) {
2380 db_printf("%sUNP_HAVEPCCACHED", comma ? ", " : "");
2381 comma = 1;
2382 }
2383 if (unp_flags & UNP_WANTCRED) {
2384 db_printf("%sUNP_WANTCRED", comma ? ", " : "");
2385 comma = 1;
2386 }
2387 if (unp_flags & UNP_CONNWAIT) {
2388 db_printf("%sUNP_CONNWAIT", comma ? ", " : "");
2389 comma = 1;
2390 }
2391 if (unp_flags & UNP_CONNECTING) {
2392 db_printf("%sUNP_CONNECTING", comma ? ", " : "");
2393 comma = 1;
2394 }
2395 if (unp_flags & UNP_BINDING) {
2396 db_printf("%sUNP_BINDING", comma ? ", " : "");
2397 comma = 1;
2398 }
2399 }
2400
2401 static void
db_print_xucred(int indent,struct xucred * xu)2402 db_print_xucred(int indent, struct xucred *xu)
2403 {
2404 int comma, i;
2405
2406 db_print_indent(indent);
2407 db_printf("cr_version: %u cr_uid: %u cr_ngroups: %d\n",
2408 xu->cr_version, xu->cr_uid, xu->cr_ngroups);
2409 db_print_indent(indent);
2410 db_printf("cr_groups: ");
2411 comma = 0;
2412 for (i = 0; i < xu->cr_ngroups; i++) {
2413 db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
2414 comma = 1;
2415 }
2416 db_printf("\n");
2417 }
2418
2419 static void
db_print_unprefs(int indent,struct unp_head * uh)2420 db_print_unprefs(int indent, struct unp_head *uh)
2421 {
2422 struct unpcb *unp;
2423 int counter;
2424
2425 counter = 0;
2426 LIST_FOREACH(unp, uh, unp_reflink) {
2427 if (counter % 4 == 0)
2428 db_print_indent(indent);
2429 db_printf("%p ", unp);
2430 if (counter % 4 == 3)
2431 db_printf("\n");
2432 counter++;
2433 }
2434 if (counter != 0 && counter % 4 != 0)
2435 db_printf("\n");
2436 }
2437
DB_SHOW_COMMAND(unpcb,db_show_unpcb)2438 DB_SHOW_COMMAND(unpcb, db_show_unpcb)
2439 {
2440 struct unpcb *unp;
2441
2442 if (!have_addr) {
2443 db_printf("usage: show unpcb <addr>\n");
2444 return;
2445 }
2446 unp = (struct unpcb *)addr;
2447
2448 db_printf("unp_socket: %p unp_vnode: %p\n", unp->unp_socket,
2449 unp->unp_vnode);
2450
2451 db_printf("unp_ino: %d unp_conn: %p\n", unp->unp_ino,
2452 unp->unp_conn);
2453
2454 db_printf("unp_refs:\n");
2455 db_print_unprefs(2, &unp->unp_refs);
2456
2457 /* XXXRW: Would be nice to print the full address, if any. */
2458 db_printf("unp_addr: %p\n", unp->unp_addr);
2459
2460 db_printf("unp_cc: %d unp_mbcnt: %d unp_gencnt: %llu\n",
2461 unp->unp_cc, unp->unp_mbcnt,
2462 (unsigned long long)unp->unp_gencnt);
2463
2464 db_printf("unp_flags: %x (", unp->unp_flags);
2465 db_print_unpflags(unp->unp_flags);
2466 db_printf(")\n");
2467
2468 db_printf("unp_peercred:\n");
2469 db_print_xucred(2, &unp->unp_peercred);
2470
2471 db_printf("unp_refcount: %u\n", unp->unp_refcount);
2472 }
2473 #endif
2474