xref: /netbsd/sys/kern/sys_generic.c (revision a6b242c3)
1 /*	$NetBSD: sys_generic.c,v 1.134 2022/07/10 23:12:12 riastradh Exp $	*/
2 
3 /*-
4  * Copyright (c) 2007, 2008, 2009 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1982, 1986, 1989, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  * (c) UNIX System Laboratories, Inc.
36  * All or some portions of this file are derived from material licensed
37  * to the University of California by American Telephone and Telegraph
38  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
39  * the permission of UNIX System Laboratories, Inc.
40  *
41  * Redistribution and use in source and binary forms, with or without
42  * modification, are permitted provided that the following conditions
43  * are met:
44  * 1. Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  * 2. Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in the
48  *    documentation and/or other materials provided with the distribution.
49  * 3. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)sys_generic.c	8.9 (Berkeley) 2/14/95
66  */
67 
68 /*
69  * System calls relating to files.
70  */
71 
72 #include <sys/cdefs.h>
73 __KERNEL_RCSID(0, "$NetBSD: sys_generic.c,v 1.134 2022/07/10 23:12:12 riastradh Exp $");
74 
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/filedesc.h>
78 #include <sys/ioctl.h>
79 #include <sys/file.h>
80 #include <sys/proc.h>
81 #include <sys/socketvar.h>
82 #include <sys/signalvar.h>
83 #include <sys/uio.h>
84 #include <sys/kernel.h>
85 #include <sys/stat.h>
86 #include <sys/kmem.h>
87 #include <sys/poll.h>
88 #include <sys/vnode.h>
89 #include <sys/mount.h>
90 #include <sys/syscallargs.h>
91 #include <sys/ktrace.h>
92 #include <sys/atomic.h>
93 #include <sys/disklabel.h>
94 
95 /*
96  * Read system call.
97  */
98 /* ARGSUSED */
99 int
sys_read(struct lwp * l,const struct sys_read_args * uap,register_t * retval)100 sys_read(struct lwp *l, const struct sys_read_args *uap, register_t *retval)
101 {
102 	/* {
103 		syscallarg(int)		fd;
104 		syscallarg(void *)	buf;
105 		syscallarg(size_t)	nbyte;
106 	} */
107 	file_t *fp;
108 	int fd;
109 
110 	fd = SCARG(uap, fd);
111 
112 	if ((fp = fd_getfile(fd)) == NULL)
113 		return (EBADF);
114 
115 	if ((fp->f_flag & FREAD) == 0) {
116 		fd_putfile(fd);
117 		return (EBADF);
118 	}
119 
120 	/* dofileread() will unuse the descriptor for us */
121 	return (dofileread(fd, fp, SCARG(uap, buf), SCARG(uap, nbyte),
122 	    &fp->f_offset, FOF_UPDATE_OFFSET, retval));
123 }
124 
125 int
dofileread(int fd,struct file * fp,void * buf,size_t nbyte,off_t * offset,int flags,register_t * retval)126 dofileread(int fd, struct file *fp, void *buf, size_t nbyte,
127 	off_t *offset, int flags, register_t *retval)
128 {
129 	struct iovec aiov;
130 	struct uio auio;
131 	size_t cnt;
132 	int error;
133 	lwp_t *l;
134 
135 	l = curlwp;
136 
137 	aiov.iov_base = (void *)buf;
138 	aiov.iov_len = nbyte;
139 	auio.uio_iov = &aiov;
140 	auio.uio_iovcnt = 1;
141 	auio.uio_resid = nbyte;
142 	auio.uio_rw = UIO_READ;
143 	auio.uio_vmspace = l->l_proc->p_vmspace;
144 
145 	/*
146 	 * Reads return ssize_t because -1 is returned on error.  Therefore
147 	 * we must restrict the length to SSIZE_MAX to avoid garbage return
148 	 * values.
149 	 */
150 	if (auio.uio_resid > SSIZE_MAX) {
151 		error = EINVAL;
152 		goto out;
153 	}
154 
155 	cnt = auio.uio_resid;
156 	error = (*fp->f_ops->fo_read)(fp, offset, &auio, fp->f_cred, flags);
157 	if (error)
158 		if (auio.uio_resid != cnt && (error == ERESTART ||
159 		    error == EINTR || error == EWOULDBLOCK))
160 			error = 0;
161 	cnt -= auio.uio_resid;
162 	ktrgenio(fd, UIO_READ, buf, cnt, error);
163 	*retval = cnt;
164  out:
165 	fd_putfile(fd);
166 	return (error);
167 }
168 
169 /*
170  * Scatter read system call.
171  */
172 int
sys_readv(struct lwp * l,const struct sys_readv_args * uap,register_t * retval)173 sys_readv(struct lwp *l, const struct sys_readv_args *uap, register_t *retval)
174 {
175 	/* {
176 		syscallarg(int)				fd;
177 		syscallarg(const struct iovec *)	iovp;
178 		syscallarg(int)				iovcnt;
179 	} */
180 
181 	return do_filereadv(SCARG(uap, fd), SCARG(uap, iovp),
182 	    SCARG(uap, iovcnt), NULL, FOF_UPDATE_OFFSET, retval);
183 }
184 
185 int
do_filereadv(int fd,const struct iovec * iovp,int iovcnt,off_t * offset,int flags,register_t * retval)186 do_filereadv(int fd, const struct iovec *iovp, int iovcnt,
187     off_t *offset, int flags, register_t *retval)
188 {
189 	struct uio	auio;
190 	struct iovec	*iov, *needfree = NULL, aiov[UIO_SMALLIOV];
191 	int		i, error;
192 	size_t		cnt;
193 	u_int		iovlen;
194 	struct file	*fp;
195 	struct iovec	*ktriov = NULL;
196 
197 	if (iovcnt == 0)
198 		return EINVAL;
199 
200 	if ((fp = fd_getfile(fd)) == NULL)
201 		return EBADF;
202 
203 	if ((fp->f_flag & FREAD) == 0) {
204 		fd_putfile(fd);
205 		return EBADF;
206 	}
207 
208 	if (offset == NULL)
209 		offset = &fp->f_offset;
210 	else {
211 		/*
212 		 * Caller must not specify &fp->f_offset -- we can't
213 		 * safely dereference it for the call to fo_seek
214 		 * without holding some underlying object lock.
215 		 */
216 		KASSERT(offset != &fp->f_offset);
217 		if (fp->f_ops->fo_seek == NULL) {
218 			error = ESPIPE;
219 			goto out;
220 		}
221 		error = (*fp->f_ops->fo_seek)(fp, *offset, SEEK_SET, NULL,
222 		    0);
223 		if (error != 0)
224 			goto out;
225 	}
226 
227 	iovlen = iovcnt * sizeof(struct iovec);
228 	if (flags & FOF_IOV_SYSSPACE)
229 		iov = __UNCONST(iovp);
230 	else {
231 		iov = aiov;
232 		if ((u_int)iovcnt > UIO_SMALLIOV) {
233 			if ((u_int)iovcnt > IOV_MAX) {
234 				error = EINVAL;
235 				goto out;
236 			}
237 			iov = kmem_alloc(iovlen, KM_SLEEP);
238 			needfree = iov;
239 		}
240 		error = copyin(iovp, iov, iovlen);
241 		if (error)
242 			goto done;
243 	}
244 
245 	auio.uio_iov = iov;
246 	auio.uio_iovcnt = iovcnt;
247 	auio.uio_rw = UIO_READ;
248 	auio.uio_vmspace = curproc->p_vmspace;
249 
250 	auio.uio_resid = 0;
251 	for (i = 0; i < iovcnt; i++, iov++) {
252 		auio.uio_resid += iov->iov_len;
253 		/*
254 		 * Reads return ssize_t because -1 is returned on error.
255 		 * Therefore we must restrict the length to SSIZE_MAX to
256 		 * avoid garbage return values.
257 		 */
258 		if (iov->iov_len > SSIZE_MAX ||
259 		    auio.uio_resid > SSIZE_MAX - iov->iov_len) {
260 			error = EINVAL;
261 			goto done;
262 		}
263 	}
264 
265 	/*
266 	 * if tracing, save a copy of iovec
267 	 */
268 	if (ktrpoint(KTR_GENIO))  {
269 		ktriov = kmem_alloc(iovlen, KM_SLEEP);
270 		memcpy(ktriov, auio.uio_iov, iovlen);
271 	}
272 
273 	cnt = auio.uio_resid;
274 	error = (*fp->f_ops->fo_read)(fp, offset, &auio, fp->f_cred, flags);
275 	if (error)
276 		if (auio.uio_resid != cnt && (error == ERESTART ||
277 		    error == EINTR || error == EWOULDBLOCK))
278 			error = 0;
279 	cnt -= auio.uio_resid;
280 	*retval = cnt;
281 
282 	if (ktriov != NULL) {
283 		ktrgeniov(fd, UIO_READ, ktriov, cnt, error);
284 		kmem_free(ktriov, iovlen);
285 	}
286 
287  done:
288 	if (needfree)
289 		kmem_free(needfree, iovlen);
290  out:
291 	fd_putfile(fd);
292 	return (error);
293 }
294 
295 /*
296  * Write system call
297  */
298 int
sys_write(struct lwp * l,const struct sys_write_args * uap,register_t * retval)299 sys_write(struct lwp *l, const struct sys_write_args *uap, register_t *retval)
300 {
301 	/* {
302 		syscallarg(int)			fd;
303 		syscallarg(const void *)	buf;
304 		syscallarg(size_t)		nbyte;
305 	} */
306 	file_t *fp;
307 	int fd;
308 
309 	fd = SCARG(uap, fd);
310 
311 	if ((fp = fd_getfile(fd)) == NULL)
312 		return (EBADF);
313 
314 	if ((fp->f_flag & FWRITE) == 0) {
315 		fd_putfile(fd);
316 		return (EBADF);
317 	}
318 
319 	/* dofilewrite() will unuse the descriptor for us */
320 	return (dofilewrite(fd, fp, SCARG(uap, buf), SCARG(uap, nbyte),
321 	    &fp->f_offset, FOF_UPDATE_OFFSET, retval));
322 }
323 
324 int
dofilewrite(int fd,struct file * fp,const void * buf,size_t nbyte,off_t * offset,int flags,register_t * retval)325 dofilewrite(int fd, struct file *fp, const void *buf,
326 	size_t nbyte, off_t *offset, int flags, register_t *retval)
327 {
328 	struct iovec aiov;
329 	struct uio auio;
330 	size_t cnt;
331 	int error;
332 
333 	aiov.iov_base = __UNCONST(buf);		/* XXXUNCONST kills const */
334 	aiov.iov_len = nbyte;
335 	auio.uio_iov = &aiov;
336 	auio.uio_iovcnt = 1;
337 	auio.uio_resid = nbyte;
338 	auio.uio_rw = UIO_WRITE;
339 	auio.uio_vmspace = curproc->p_vmspace;
340 
341 	/*
342 	 * Writes return ssize_t because -1 is returned on error.  Therefore
343 	 * we must restrict the length to SSIZE_MAX to avoid garbage return
344 	 * values.
345 	 */
346 	if (auio.uio_resid > SSIZE_MAX) {
347 		error = EINVAL;
348 		goto out;
349 	}
350 
351 	cnt = auio.uio_resid;
352 	error = (*fp->f_ops->fo_write)(fp, offset, &auio, fp->f_cred, flags);
353 	if (error) {
354 		if (auio.uio_resid != cnt && (error == ERESTART ||
355 		    error == EINTR || error == EWOULDBLOCK))
356 			error = 0;
357 		if (error == EPIPE && !(fp->f_flag & FNOSIGPIPE)) {
358 			mutex_enter(&proc_lock);
359 			psignal(curproc, SIGPIPE);
360 			mutex_exit(&proc_lock);
361 		}
362 	}
363 	cnt -= auio.uio_resid;
364 	ktrgenio(fd, UIO_WRITE, buf, cnt, error);
365 	*retval = cnt;
366  out:
367 	fd_putfile(fd);
368 	return (error);
369 }
370 
371 /*
372  * Gather write system call
373  */
374 int
sys_writev(struct lwp * l,const struct sys_writev_args * uap,register_t * retval)375 sys_writev(struct lwp *l, const struct sys_writev_args *uap, register_t *retval)
376 {
377 	/* {
378 		syscallarg(int)				fd;
379 		syscallarg(const struct iovec *)	iovp;
380 		syscallarg(int)				iovcnt;
381 	} */
382 
383 	return do_filewritev(SCARG(uap, fd), SCARG(uap, iovp),
384 	    SCARG(uap, iovcnt), NULL, FOF_UPDATE_OFFSET, retval);
385 }
386 
387 int
do_filewritev(int fd,const struct iovec * iovp,int iovcnt,off_t * offset,int flags,register_t * retval)388 do_filewritev(int fd, const struct iovec *iovp, int iovcnt,
389     off_t *offset, int flags, register_t *retval)
390 {
391 	struct uio	auio;
392 	struct iovec	*iov, *needfree = NULL, aiov[UIO_SMALLIOV];
393 	int		i, error;
394 	size_t		cnt;
395 	u_int		iovlen;
396 	struct file	*fp;
397 	struct iovec	*ktriov = NULL;
398 
399 	if (iovcnt == 0)
400 		return EINVAL;
401 
402 	if ((fp = fd_getfile(fd)) == NULL)
403 		return EBADF;
404 
405 	if ((fp->f_flag & FWRITE) == 0) {
406 		fd_putfile(fd);
407 		return EBADF;
408 	}
409 
410 	if (offset == NULL)
411 		offset = &fp->f_offset;
412 	else {
413 		/*
414 		 * Caller must not specify &fp->f_offset -- we can't
415 		 * safely dereference it for the call to fo_seek
416 		 * without holding some underlying object lock.
417 		 */
418 		KASSERT(offset != &fp->f_offset);
419 		if (fp->f_ops->fo_seek == NULL) {
420 			error = ESPIPE;
421 			goto out;
422 		}
423 		error = (*fp->f_ops->fo_seek)(fp, *offset, SEEK_SET, NULL,
424 		    0);
425 		if (error != 0)
426 			goto out;
427 	}
428 
429 	iovlen = iovcnt * sizeof(struct iovec);
430 	if (flags & FOF_IOV_SYSSPACE)
431 		iov = __UNCONST(iovp);
432 	else {
433 		iov = aiov;
434 		if ((u_int)iovcnt > UIO_SMALLIOV) {
435 			if ((u_int)iovcnt > IOV_MAX) {
436 				error = EINVAL;
437 				goto out;
438 			}
439 			iov = kmem_alloc(iovlen, KM_SLEEP);
440 			needfree = iov;
441 		}
442 		error = copyin(iovp, iov, iovlen);
443 		if (error)
444 			goto done;
445 	}
446 
447 	auio.uio_iov = iov;
448 	auio.uio_iovcnt = iovcnt;
449 	auio.uio_rw = UIO_WRITE;
450 	auio.uio_vmspace = curproc->p_vmspace;
451 
452 	auio.uio_resid = 0;
453 	for (i = 0; i < iovcnt; i++, iov++) {
454 		auio.uio_resid += iov->iov_len;
455 		/*
456 		 * Writes return ssize_t because -1 is returned on error.
457 		 * Therefore we must restrict the length to SSIZE_MAX to
458 		 * avoid garbage return values.
459 		 */
460 		if (iov->iov_len > SSIZE_MAX ||
461 		    auio.uio_resid > SSIZE_MAX - iov->iov_len) {
462 			error = EINVAL;
463 			goto done;
464 		}
465 	}
466 
467 	/*
468 	 * if tracing, save a copy of iovec
469 	 */
470 	if (ktrpoint(KTR_GENIO))  {
471 		ktriov = kmem_alloc(iovlen, KM_SLEEP);
472 		memcpy(ktriov, auio.uio_iov, iovlen);
473 	}
474 
475 	cnt = auio.uio_resid;
476 	error = (*fp->f_ops->fo_write)(fp, offset, &auio, fp->f_cred, flags);
477 	if (error) {
478 		if (auio.uio_resid != cnt && (error == ERESTART ||
479 		    error == EINTR || error == EWOULDBLOCK))
480 			error = 0;
481 		if (error == EPIPE && !(fp->f_flag & FNOSIGPIPE)) {
482 			mutex_enter(&proc_lock);
483 			psignal(curproc, SIGPIPE);
484 			mutex_exit(&proc_lock);
485 		}
486 	}
487 	cnt -= auio.uio_resid;
488 	*retval = cnt;
489 
490 	if (ktriov != NULL) {
491 		ktrgeniov(fd, UIO_WRITE, ktriov, cnt, error);
492 		kmem_free(ktriov, iovlen);
493 	}
494 
495  done:
496 	if (needfree)
497 		kmem_free(needfree, iovlen);
498  out:
499 	fd_putfile(fd);
500 	return (error);
501 }
502 
503 /*
504  * Ioctl system call
505  */
506 /* ARGSUSED */
507 int
sys_ioctl(struct lwp * l,const struct sys_ioctl_args * uap,register_t * retval)508 sys_ioctl(struct lwp *l, const struct sys_ioctl_args *uap, register_t *retval)
509 {
510 	/* {
511 		syscallarg(int)		fd;
512 		syscallarg(u_long)	com;
513 		syscallarg(void *)	data;
514 	} */
515 	struct file	*fp;
516 	proc_t		*p;
517 	u_long		com;
518 	int		error;
519 	size_t		size, alloc_size;
520 	void 		*data, *memp;
521 #define	STK_PARAMS	128
522 	u_long		stkbuf[STK_PARAMS/sizeof(u_long)];
523 #if  __TMPBIGMAXPARTITIONS > MAXPARTITIONS
524 	size_t		zero_last = 0;
525 #define	zero_size(SZ)	((SZ)+zero_last)
526 #else
527 #define	zero_size(SZ)	(SZ)
528 #endif
529 
530 	memp = NULL;
531 	alloc_size = 0;
532 	error = 0;
533 	p = l->l_proc;
534 
535 	if ((fp = fd_getfile(SCARG(uap, fd))) == NULL)
536 		return (EBADF);
537 
538 	if ((fp->f_flag & (FREAD | FWRITE)) == 0) {
539 		error = EBADF;
540 		com = 0;
541 		goto out;
542 	}
543 
544 	switch (com = SCARG(uap, com)) {
545 	case FIONCLEX:
546 	case FIOCLEX:
547 		fd_set_exclose(l, SCARG(uap, fd), com == FIOCLEX);
548 		goto out;
549 	}
550 
551 	/*
552 	 * Interpret high order word to find amount of data to be
553 	 * copied to/from the user's address space.
554 	 */
555 	size = IOCPARM_LEN(com);
556 	alloc_size = size;
557 
558 	/*
559 	 * The disklabel is now padded to a multiple of 8 bytes however the old
560 	 * disklabel on 32bit platforms wasn't.  This leaves a difference in
561 	 * size of 4 bytes between the two but are otherwise identical.
562 	 * To deal with this, we allocate enough space for the new disklabel
563 	 * but only copyin/out the smaller amount.
564 	 */
565 	if (IOCGROUP(com) == 'd') {
566 #if  __TMPBIGMAXPARTITIONS > MAXPARTITIONS
567 		u_long ocom = com;
568 #endif
569 		u_long ncom = com ^ (DIOCGDINFO ^ DIOCGDINFO32);
570 
571 #if  __TMPBIGMAXPARTITIONS > MAXPARTITIONS
572 	/*
573 	 * Userland might use struct disklabel that is bigger than the
574 	 * the kernel version (historic accident) - alloc userland
575 	 * size and zero unused part on copyout.
576 	 */
577 #define	DISKLABELLENDIFF	(sizeof(struct partition)	\
578 				       *(__TMPBIGMAXPARTITIONS-MAXPARTITIONS))
579 #define	IOCFIXUP(NIOC)	((NIOC&~(IOCPARM_MASK<<IOCPARM_SHIFT))	| \
580 			   (IOCPARM_LEN(NIOC)-DISKLABELLENDIFF)<<IOCPARM_SHIFT)
581 
582 		switch (IOCFIXUP(ocom)) {
583 		case DIOCGDINFO:
584 		case DIOCWDINFO:
585 		case DIOCSDINFO:
586 		case DIOCGDEFLABEL:
587 			com = ncom = IOCFIXUP(ocom);
588 			zero_last = DISKLABELLENDIFF;
589 			size -= DISKLABELLENDIFF;
590 			goto done;
591 		}
592 #endif
593 
594 		switch (ncom) {
595 		case DIOCGDINFO:
596 		case DIOCWDINFO:
597 		case DIOCSDINFO:
598 		case DIOCGDEFLABEL:
599 			com = ncom;
600 			if (IOCPARM_LEN(DIOCGDINFO32) < IOCPARM_LEN(DIOCGDINFO))
601 				alloc_size = IOCPARM_LEN(DIOCGDINFO);
602 			break;
603 		}
604 #if  __TMPBIGMAXPARTITIONS > MAXPARTITIONS
605 		done: ;
606 #endif
607 	}
608 	if (size > IOCPARM_MAX) {
609 		error = ENOTTY;
610 		goto out;
611 	}
612 	memp = NULL;
613 	if ((com >> IOCPARM_SHIFT) == 0)  {
614 		/* UNIX-style ioctl. */
615 		data = SCARG(uap, data);
616 	} else {
617 		if (alloc_size > sizeof(stkbuf)) {
618 			memp = kmem_alloc(alloc_size, KM_SLEEP);
619 			data = memp;
620 		} else {
621 			data = (void *)stkbuf;
622 		}
623 		if (com&IOC_IN) {
624 			if (size) {
625 				error = copyin(SCARG(uap, data), data, size);
626 				if (error) {
627 					goto out;
628 				}
629 				/*
630 				 * The data between size and alloc_size has
631 				 * not been overwritten.  It shouldn't matter
632 				 * but let's clear that anyway.
633 				 */
634 				if (__predict_false(size < alloc_size)) {
635 					memset((char *)data+size, 0,
636 					    alloc_size - size);
637 				}
638 				ktrgenio(SCARG(uap, fd), UIO_WRITE,
639 				    SCARG(uap, data), size, 0);
640 			} else {
641 				*(void **)data = SCARG(uap, data);
642 			}
643 		} else if ((com&IOC_OUT) && size) {
644 			/*
645 			 * Zero the buffer so the user always
646 			 * gets back something deterministic.
647 			 */
648 			memset(data, 0, zero_size(size));
649 		} else if (com&IOC_VOID) {
650 			*(void **)data = SCARG(uap, data);
651 		}
652 	}
653 
654 	switch (com) {
655 
656 	case FIONBIO:
657 		/* XXX Code block is not atomic */
658 		if (*(int *)data != 0)
659 			atomic_or_uint(&fp->f_flag, FNONBLOCK);
660 		else
661 			atomic_and_uint(&fp->f_flag, ~FNONBLOCK);
662 		error = (*fp->f_ops->fo_ioctl)(fp, FIONBIO, data);
663 		break;
664 
665 	case FIOASYNC:
666 		/* XXX Code block is not atomic */
667 		if (*(int *)data != 0)
668 			atomic_or_uint(&fp->f_flag, FASYNC);
669 		else
670 			atomic_and_uint(&fp->f_flag, ~FASYNC);
671 		error = (*fp->f_ops->fo_ioctl)(fp, FIOASYNC, data);
672 		break;
673 
674 	default:
675 		error = (*fp->f_ops->fo_ioctl)(fp, com, data);
676 		/*
677 		 * Copy any data to user, size was
678 		 * already set and checked above.
679 		 */
680 		if (error == 0 && (com&IOC_OUT) && size) {
681 			error = copyout(data, SCARG(uap, data),
682 			    zero_size(size));
683 			ktrgenio(SCARG(uap, fd), UIO_READ, SCARG(uap, data),
684 			    size, error);
685 		}
686 		break;
687 	}
688  out:
689 	if (memp)
690 		kmem_free(memp, alloc_size);
691 	fd_putfile(SCARG(uap, fd));
692 	switch (error) {
693 	case -1:
694 		printf("sys_ioctl: _IO%s%s('%c', %lu, %lu) returned -1: "
695 		    "pid=%d comm=%s\n",
696 		    (com & IOC_IN) ? "W" : "", (com & IOC_OUT) ? "R" : "",
697 		    (char)IOCGROUP(com), (com & 0xff), IOCPARM_LEN(com),
698 		    p->p_pid, p->p_comm);
699 		/* FALLTHROUGH */
700 	case EPASSTHROUGH:
701 		error = ENOTTY;
702 		/* FALLTHROUGH */
703 	default:
704 		return (error);
705 	}
706 }
707