1 /*
2 * Copyright (c) 1982, 1986, 1989, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
30 * $FreeBSD: src/sys/kern/uipc_usrreq.c,v 1.54.2.10 2003/03/04 17:28:09 nectar Exp $
31 */
32
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/kernel.h>
36 #include <sys/domain.h>
37 #include <sys/fcntl.h>
38 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */
39 #include <sys/proc.h>
40 #include <sys/file.h>
41 #include <sys/filedesc.h>
42 #include <sys/mbuf.h>
43 #include <sys/nlookup.h>
44 #include <sys/protosw.h>
45 #include <sys/socket.h>
46 #include <sys/socketvar.h>
47 #include <sys/resourcevar.h>
48 #include <sys/stat.h>
49 #include <sys/mount.h>
50 #include <sys/sysctl.h>
51 #include <sys/un.h>
52 #include <sys/unpcb.h>
53 #include <sys/vnode.h>
54 #include <sys/kern_syscall.h>
55 #include <sys/taskqueue.h>
56
57 #include <sys/file2.h>
58 #include <sys/spinlock2.h>
59 #include <sys/socketvar2.h>
60 #include <sys/msgport2.h>
61
62 /*
63 * Unix communications domain.
64 *
65 * TODO:
66 * RDM
67 * rethink name space problems
68 * need a proper out-of-band
69 * lock pushdown
70 *
71 *
72 * Unix domain sockets GC.
73 *
74 * It was originally designed to address following three cases:
75 * 1) Receiving unix domain socket can not accept the rights, e.g.
76 * when the so_rcv is full.
77 * 2) Caller of recvmsg(2) does not pass buffer to receive rights.
78 * 3) Unix domain sockets loop reference, e.g. s1 is on s2.so_rcv,
79 * while s2 on s1.so_rcv.
80 *
81 * Code under UNP_GC_ALLFILES is intended to address all above three
82 * cases. However, 1) was addressed a long time ago in uipc_send()
83 * (we inheritted the fix from FreeBSD when DragonFly forked). 2)
84 * was addressed in soreceive() by git-e62cfe62. 3) is the only
85 * case that needs GC. The new code (!UNP_GC_ALLFILES) addresses
86 * case 3) in the following way:
87 * - Record the struct file in unpcb, if the Unix domain socket is
88 * passed as one of the rights.
89 * - At GC time, only unpcbs are scanned, and only Unix domain sockets
90 * that are still used as rights are potential GC targets.
91 */
92
93 #define UNP_DETACHED UNP_PRIVATE1
94 #define UNP_CONNECTING UNP_PRIVATE2
95 #define UNP_DROPPED UNP_PRIVATE3
96 #define UNP_MARKER UNP_PRIVATE4
97
98 #define UNPGC_REF 0x1 /* unpcb has external ref. */
99 #define UNPGC_DEAD 0x2 /* unpcb might be dead. */
100 #define UNPGC_SCANNED 0x4 /* Has been scanned. */
101
102 #define UNP_GCFILE_MAX 256
103
104 /* For unp_internalize() and unp_externalize() */
105 CTASSERT(sizeof(struct file *) >= sizeof(int));
106
107 #define UNP_ISATTACHED(unp) \
108 ((unp) != NULL && ((unp)->unp_flags & UNP_DETACHED) == 0)
109
110 #ifdef INVARIANTS
111 #define UNP_ASSERT_TOKEN_HELD(unp) \
112 ASSERT_LWKT_TOKEN_HELD(lwkt_token_pool_lookup((unp)))
113 #else /* !INVARIANTS */
114 #define UNP_ASSERT_TOKEN_HELD(unp)
115 #endif /* INVARIANTS */
116
117 struct unp_defdiscard {
118 SLIST_ENTRY(unp_defdiscard) next;
119 struct file *fp;
120 };
121 SLIST_HEAD(unp_defdiscard_list, unp_defdiscard);
122
123 TAILQ_HEAD(unpcb_qhead, unpcb);
124 struct unp_global_head {
125 struct unpcb_qhead list;
126 int count;
127 };
128
129 static MALLOC_DEFINE(M_UNPCB, "unpcb", "unpcb struct");
130 static unp_gen_t unp_gencnt;
131
132 static struct unp_global_head unp_stream_head;
133 static struct unp_global_head unp_dgram_head;
134 static struct unp_global_head unp_seqpkt_head;
135
136 static struct unp_global_head * const unp_heads[] =
137 { &unp_stream_head, &unp_dgram_head, &unp_seqpkt_head, NULL };
138
139 static struct lwkt_token unp_token = LWKT_TOKEN_INITIALIZER(unp_token);
140 static struct taskqueue *unp_taskqueue;
141
142 static struct unp_defdiscard_list unp_defdiscard_head;
143 static struct spinlock unp_defdiscard_spin;
144 static struct task unp_defdiscard_task;
145
146 static struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL };
147
148 static int unp_attach (struct socket *, struct pru_attach_info *);
149 static void unp_detach (struct unpcb *);
150 static int unp_bind (struct unpcb *,struct sockaddr *, struct thread *);
151 static int unp_connect (struct socket *,struct sockaddr *,
152 struct thread *);
153 static void unp_disconnect(struct unpcb *, int);
154 static void unp_shutdown (struct unpcb *);
155 static void unp_gc(void *, int);
156 #ifdef UNP_GC_ALLFILES
157 static int unp_gc_clearmarks(struct file *, void *);
158 static int unp_gc_checkmarks(struct file *, void *);
159 static int unp_gc_checkrefs(struct file *, void *);
160 static void unp_mark(struct file *, void *data);
161 #endif
162 static void unp_scan (struct mbuf *, void (*)(struct file *, void *),
163 void *data);
164 static void unp_discard (struct file *, void *);
165 static int unp_internalize (struct mbuf *, struct thread *);
166 static int unp_listen (struct unpcb *, struct thread *);
167 static void unp_fp_externalize(struct lwp *lp, struct file *fp, int fd,
168 int flags);
169 static int unp_find_lockref(struct sockaddr *nam, struct thread *td,
170 short type, struct unpcb **unp_ret);
171 static int unp_connect_pair(struct unpcb *unp, struct unpcb *unp2);
172 static void unp_drop(struct unpcb *unp, int error);
173 static void unp_defdiscard_taskfunc(void *, int);
174
175 static int unp_rights; /* file descriptors in flight */
176 static struct lwkt_token unp_rights_token =
177 LWKT_TOKEN_INITIALIZER(unp_rights_token);
178 static struct task unp_gc_task;
179 static struct unpcb *unp_gc_marker;
180
181 SYSCTL_DECL(_net_local);
182 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
183 "File descriptors in flight");
184
185 /*
186 * SMP Considerations:
187 *
188 * Since unp_token will be automaticly released upon execution of
189 * blocking code, we need to reference unp_conn before any possible
190 * blocking code to prevent it from being ripped behind our back.
191 *
192 * Any adjustment to unp->unp_conn requires both the global unp_token
193 * AND the per-unp token (lwkt_token_pool_lookup(unp)) to be held.
194 *
195 * Any access to so_pcb to obtain unp requires the pool token for
196 * unp to be held.
197 */
198
199 static __inline void
unp_reference(struct unpcb * unp)200 unp_reference(struct unpcb *unp)
201 {
202 /* 0->1 transition will not work */
203 KKASSERT(unp->unp_refcnt > 0);
204 atomic_add_int(&unp->unp_refcnt, 1);
205 }
206
207 static __inline void
unp_free(struct unpcb * unp)208 unp_free(struct unpcb *unp)
209 {
210 KKASSERT(unp->unp_refcnt > 0);
211 if (atomic_fetchadd_int(&unp->unp_refcnt, -1) == 1)
212 unp_detach(unp);
213 }
214
215 static __inline struct unpcb *
unp_getsocktoken(struct socket * so)216 unp_getsocktoken(struct socket *so)
217 {
218 struct unpcb *unp;
219
220 /*
221 * The unp pointer is invalid until we verify that it is
222 * good by re-checking so_pcb AFTER obtaining the token.
223 */
224 while ((unp = so->so_pcb) != NULL) {
225 lwkt_getpooltoken(unp);
226 if (unp == so->so_pcb)
227 break;
228 lwkt_relpooltoken(unp);
229 }
230 return unp;
231 }
232
233 static __inline void
unp_reltoken(struct unpcb * unp)234 unp_reltoken(struct unpcb *unp)
235 {
236 if (unp != NULL)
237 lwkt_relpooltoken(unp);
238 }
239
240 static __inline void
unp_setflags(struct unpcb * unp,int flags)241 unp_setflags(struct unpcb *unp, int flags)
242 {
243 atomic_set_int(&unp->unp_flags, flags);
244 }
245
246 static __inline void
unp_clrflags(struct unpcb * unp,int flags)247 unp_clrflags(struct unpcb *unp, int flags)
248 {
249 atomic_clear_int(&unp->unp_flags, flags);
250 }
251
252 static __inline struct unp_global_head *
unp_globalhead(short type)253 unp_globalhead(short type)
254 {
255 switch (type) {
256 case SOCK_STREAM:
257 return &unp_stream_head;
258 case SOCK_DGRAM:
259 return &unp_dgram_head;
260 case SOCK_SEQPACKET:
261 return &unp_seqpkt_head;
262 default:
263 panic("unknown socket type %d", type);
264 }
265 }
266
267 static __inline struct unpcb *
unp_fp2unpcb(struct file * fp)268 unp_fp2unpcb(struct file *fp)
269 {
270 struct socket *so;
271
272 if (fp->f_type != DTYPE_SOCKET)
273 return NULL;
274
275 so = fp->f_data;
276 if (so == NULL)
277 return NULL;
278
279 if (so->so_proto->pr_domain != &localdomain)
280 return NULL;
281
282 return so->so_pcb;
283 }
284
285 static __inline void
unp_add_right(struct file * fp)286 unp_add_right(struct file *fp)
287 {
288 struct unpcb *unp;
289
290 ASSERT_LWKT_TOKEN_HELD(&unp_rights_token);
291 KASSERT(fp->f_count > 0, ("invalid f_count %d", fp->f_count));
292
293 unp = unp_fp2unpcb(fp);
294 if (unp != NULL) {
295 unp->unp_fp = fp;
296 unp->unp_msgcount++;
297 }
298 fp->f_msgcount++;
299 unp_rights++;
300 }
301
302 static __inline void
unp_del_right(struct file * fp)303 unp_del_right(struct file *fp)
304 {
305 struct unpcb *unp;
306
307 ASSERT_LWKT_TOKEN_HELD(&unp_rights_token);
308 KASSERT(fp->f_count > 0, ("invalid f_count %d", fp->f_count));
309
310 unp = unp_fp2unpcb(fp);
311 if (unp != NULL) {
312 KASSERT(unp->unp_msgcount > 0,
313 ("invalid unp msgcount %d", unp->unp_msgcount));
314 unp->unp_msgcount--;
315 if (unp->unp_msgcount == 0)
316 unp->unp_fp = NULL;
317 }
318 fp->f_msgcount--;
319 unp_rights--;
320 }
321
322 /*
323 * NOTE: (so) is referenced from soabort*() and netmsg_pru_abort()
324 * will sofree() it when we return.
325 */
326 static void
uipc_abort(netmsg_t msg)327 uipc_abort(netmsg_t msg)
328 {
329 struct unpcb *unp;
330 int error;
331
332 lwkt_gettoken(&unp_token);
333 unp = unp_getsocktoken(msg->base.nm_so);
334
335 if (UNP_ISATTACHED(unp)) {
336 unp_drop(unp, ECONNABORTED);
337 error = 0;
338 } else {
339 error = EINVAL;
340 }
341
342 unp_reltoken(unp);
343 lwkt_reltoken(&unp_token);
344
345 lwkt_replymsg(&msg->lmsg, error);
346 }
347
348 static void
uipc_accept(netmsg_t msg)349 uipc_accept(netmsg_t msg)
350 {
351 struct unpcb *unp;
352 int error;
353
354 lwkt_gettoken(&unp_token);
355 unp = unp_getsocktoken(msg->base.nm_so);
356
357 if (!UNP_ISATTACHED(unp)) {
358 error = EINVAL;
359 } else {
360 struct unpcb *unp2 = unp->unp_conn;
361
362 /*
363 * Pass back name of connected socket,
364 * if it was bound and we are still connected
365 * (our peer may have closed already!).
366 */
367 if (unp2 && unp2->unp_addr) {
368 unp_reference(unp2);
369 *msg->accept.nm_nam = dup_sockaddr(
370 (struct sockaddr *)unp2->unp_addr);
371 unp_free(unp2);
372 } else {
373 *msg->accept.nm_nam = dup_sockaddr(&sun_noname);
374 }
375 error = 0;
376 }
377
378 unp_reltoken(unp);
379 lwkt_reltoken(&unp_token);
380
381 lwkt_replymsg(&msg->lmsg, error);
382 }
383
384 static void
uipc_attach(netmsg_t msg)385 uipc_attach(netmsg_t msg)
386 {
387 int error;
388
389 lwkt_gettoken(&unp_token);
390
391 KASSERT(msg->base.nm_so->so_pcb == NULL, ("double unp attach"));
392 error = unp_attach(msg->base.nm_so, msg->attach.nm_ai);
393
394 lwkt_reltoken(&unp_token);
395 lwkt_replymsg(&msg->lmsg, error);
396 }
397
398 static void
uipc_bind(netmsg_t msg)399 uipc_bind(netmsg_t msg)
400 {
401 struct unpcb *unp;
402 int error;
403
404 lwkt_gettoken(&unp_token);
405 unp = unp_getsocktoken(msg->base.nm_so);
406
407 if (UNP_ISATTACHED(unp))
408 error = unp_bind(unp, msg->bind.nm_nam, msg->bind.nm_td);
409 else
410 error = EINVAL;
411
412 unp_reltoken(unp);
413 lwkt_reltoken(&unp_token);
414
415 lwkt_replymsg(&msg->lmsg, error);
416 }
417
418 static void
uipc_connect(netmsg_t msg)419 uipc_connect(netmsg_t msg)
420 {
421 int error;
422
423 error = unp_connect(msg->base.nm_so, msg->connect.nm_nam,
424 msg->connect.nm_td);
425 lwkt_replymsg(&msg->lmsg, error);
426 }
427
428 static void
uipc_connect2(netmsg_t msg)429 uipc_connect2(netmsg_t msg)
430 {
431 int error;
432
433 error = unp_connect2(msg->connect2.nm_so1, msg->connect2.nm_so2,
434 msg->connect2.nm_cred);
435 lwkt_replymsg(&msg->lmsg, error);
436 }
437
438 /* control is EOPNOTSUPP */
439
440 static void
uipc_detach(netmsg_t msg)441 uipc_detach(netmsg_t msg)
442 {
443 struct unpcb *unp;
444 int error;
445
446 lwkt_gettoken(&unp_token);
447 unp = unp_getsocktoken(msg->base.nm_so);
448
449 if (UNP_ISATTACHED(unp)) {
450 unp_drop(unp, 0);
451 error = 0;
452 } else {
453 error = EINVAL;
454 }
455
456 unp_reltoken(unp);
457 lwkt_reltoken(&unp_token);
458
459 lwkt_replymsg(&msg->lmsg, error);
460 }
461
462 static void
uipc_disconnect(netmsg_t msg)463 uipc_disconnect(netmsg_t msg)
464 {
465 struct unpcb *unp;
466 int error;
467
468 lwkt_gettoken(&unp_token);
469 unp = unp_getsocktoken(msg->base.nm_so);
470
471 if (UNP_ISATTACHED(unp)) {
472 unp_disconnect(unp, 0);
473 error = 0;
474 } else {
475 error = EINVAL;
476 }
477
478 unp_reltoken(unp);
479 lwkt_reltoken(&unp_token);
480
481 lwkt_replymsg(&msg->lmsg, error);
482 }
483
484 static void
uipc_listen(netmsg_t msg)485 uipc_listen(netmsg_t msg)
486 {
487 struct unpcb *unp;
488 int error;
489
490 lwkt_gettoken(&unp_token);
491 unp = unp_getsocktoken(msg->base.nm_so);
492
493 if (!UNP_ISATTACHED(unp) || unp->unp_vnode == NULL)
494 error = EINVAL;
495 else
496 error = unp_listen(unp, msg->listen.nm_td);
497
498 unp_reltoken(unp);
499 lwkt_reltoken(&unp_token);
500
501 lwkt_replymsg(&msg->lmsg, error);
502 }
503
504 static void
uipc_peeraddr(netmsg_t msg)505 uipc_peeraddr(netmsg_t msg)
506 {
507 struct unpcb *unp;
508 int error;
509
510 lwkt_gettoken(&unp_token);
511 unp = unp_getsocktoken(msg->base.nm_so);
512
513 if (!UNP_ISATTACHED(unp)) {
514 error = EINVAL;
515 } else if (unp->unp_conn && unp->unp_conn->unp_addr) {
516 struct unpcb *unp2 = unp->unp_conn;
517
518 unp_reference(unp2);
519 *msg->peeraddr.nm_nam = dup_sockaddr(
520 (struct sockaddr *)unp2->unp_addr);
521 unp_free(unp2);
522 error = 0;
523 } else {
524 /*
525 * XXX: It seems that this test always fails even when
526 * connection is established. So, this else clause is
527 * added as workaround to return PF_LOCAL sockaddr.
528 */
529 *msg->peeraddr.nm_nam = dup_sockaddr(&sun_noname);
530 error = 0;
531 }
532
533 unp_reltoken(unp);
534 lwkt_reltoken(&unp_token);
535
536 lwkt_replymsg(&msg->lmsg, error);
537 }
538
539 static void
uipc_rcvd(netmsg_t msg)540 uipc_rcvd(netmsg_t msg)
541 {
542 struct unpcb *unp, *unp2;
543 struct socket *so;
544 struct socket *so2;
545 int error;
546
547 /*
548 * so_pcb is only modified with both the global and the unp
549 * pool token held.
550 */
551 so = msg->base.nm_so;
552 unp = unp_getsocktoken(so);
553
554 if (!UNP_ISATTACHED(unp)) {
555 error = EINVAL;
556 goto done;
557 }
558
559 switch (so->so_type) {
560 case SOCK_DGRAM:
561 panic("uipc_rcvd DGRAM?");
562 /*NOTREACHED*/
563 case SOCK_STREAM:
564 case SOCK_SEQPACKET:
565 if (unp->unp_conn == NULL)
566 break;
567 unp2 = unp->unp_conn; /* protected by pool token */
568
569 /*
570 * Because we are transfering mbufs directly to the
571 * peer socket we have to use SSB_STOP on the sender
572 * to prevent it from building up infinite mbufs.
573 *
574 * As in several places in this module w ehave to ref unp2
575 * to ensure that it does not get ripped out from under us
576 * if we block on the so2 token or in sowwakeup().
577 */
578 so2 = unp2->unp_socket;
579 unp_reference(unp2);
580 lwkt_gettoken(&so2->so_rcv.ssb_token);
581 if (so->so_rcv.ssb_cc < so2->so_snd.ssb_hiwat &&
582 so->so_rcv.ssb_mbcnt < so2->so_snd.ssb_mbmax
583 ) {
584 atomic_clear_int(&so2->so_snd.ssb_flags, SSB_STOP);
585
586 sowwakeup(so2);
587 }
588 lwkt_reltoken(&so2->so_rcv.ssb_token);
589 unp_free(unp2);
590 break;
591 default:
592 panic("uipc_rcvd unknown socktype");
593 /*NOTREACHED*/
594 }
595 error = 0;
596 done:
597 unp_reltoken(unp);
598 lwkt_replymsg(&msg->lmsg, error);
599 }
600
601 /* pru_rcvoob is EOPNOTSUPP */
602
603 static void
uipc_send(netmsg_t msg)604 uipc_send(netmsg_t msg)
605 {
606 struct unpcb *unp, *unp2;
607 struct socket *so;
608 struct socket *so2;
609 struct mbuf *control;
610 struct mbuf *m;
611 int error = 0;
612
613 so = msg->base.nm_so;
614 control = msg->send.nm_control;
615 m = msg->send.nm_m;
616
617 /*
618 * so_pcb is only modified with both the global and the unp
619 * pool token held.
620 */
621 so = msg->base.nm_so;
622 unp = unp_getsocktoken(so);
623
624 if (!UNP_ISATTACHED(unp)) {
625 error = EINVAL;
626 goto release;
627 }
628
629 if (msg->send.nm_flags & PRUS_OOB) {
630 error = EOPNOTSUPP;
631 goto release;
632 }
633
634 wakeup_start_delayed();
635
636 if (control && (error = unp_internalize(control, msg->send.nm_td)))
637 goto release;
638
639 switch (so->so_type) {
640 case SOCK_DGRAM:
641 {
642 struct sockaddr *from;
643
644 if (msg->send.nm_addr) {
645 if (unp->unp_conn) {
646 error = EISCONN;
647 break;
648 }
649 lwkt_gettoken(&unp_token);
650 error = unp_find_lockref(msg->send.nm_addr,
651 msg->send.nm_td, so->so_type, &unp2);
652 if (error) {
653 lwkt_reltoken(&unp_token);
654 break;
655 }
656 /*
657 * NOTE:
658 * unp2 is locked and referenced.
659 *
660 * We could unlock unp2 now, since it was checked
661 * and referenced.
662 */
663 unp_reltoken(unp2);
664 lwkt_reltoken(&unp_token);
665 } else {
666 if (unp->unp_conn == NULL) {
667 error = ENOTCONN;
668 break;
669 }
670 unp2 = unp->unp_conn;
671 unp_reference(unp2);
672 }
673 /* NOTE: unp2 is referenced. */
674 so2 = unp2->unp_socket;
675
676 /*
677 * Include creds if the receive side wants them, even if
678 * the send side did not send them.
679 */
680 if (so2->so_options & SO_PASSCRED) {
681 struct mbuf **mp;
682 struct cmsghdr *cm;
683 struct cmsgcred cred;
684 struct mbuf *ncon;
685
686 mp = &control;
687 while ((ncon = *mp) != NULL) {
688 cm = mtod(ncon, struct cmsghdr *);
689 if (cm->cmsg_type == SCM_CREDS &&
690 cm->cmsg_level == SOL_SOCKET)
691 break;
692 mp = &ncon->m_next;
693 }
694 if (ncon == NULL) {
695 ncon = sbcreatecontrol(&cred, sizeof(cred),
696 SCM_CREDS, SOL_SOCKET);
697 unp_internalize(ncon, msg->send.nm_td);
698 *mp = ncon;
699 }
700 }
701
702 if (unp->unp_addr)
703 from = (struct sockaddr *)unp->unp_addr;
704 else
705 from = &sun_noname;
706
707 lwkt_gettoken(&so2->so_rcv.ssb_token);
708 if (ssb_appendaddr(&so2->so_rcv, from, m, control)) {
709 sorwakeup(so2);
710 m = NULL;
711 control = NULL;
712 } else {
713 error = ENOBUFS;
714 }
715 lwkt_reltoken(&so2->so_rcv.ssb_token);
716
717 unp_free(unp2);
718 break;
719 }
720
721 case SOCK_STREAM:
722 case SOCK_SEQPACKET:
723 /* Connect if not connected yet. */
724 /*
725 * Note: A better implementation would complain
726 * if not equal to the peer's address.
727 */
728 if (unp->unp_conn == NULL) {
729 if (msg->send.nm_addr) {
730 error = unp_connect(so,
731 msg->send.nm_addr,
732 msg->send.nm_td);
733 if (error)
734 break; /* XXX */
735 }
736 /*
737 * NOTE:
738 * unp_conn still could be NULL, even if the
739 * above unp_connect() succeeds; since the
740 * current unp's token could be released due
741 * to blocking operations after unp_conn is
742 * assigned.
743 */
744 if (unp->unp_conn == NULL) {
745 error = ENOTCONN;
746 break;
747 }
748 }
749 if (so->so_state & SS_CANTSENDMORE) {
750 error = EPIPE;
751 break;
752 }
753
754 unp2 = unp->unp_conn;
755 KASSERT(unp2 != NULL, ("unp is not connected"));
756 so2 = unp2->unp_socket;
757
758 unp_reference(unp2);
759
760 /*
761 * Send to paired receive port, and then reduce
762 * send buffer hiwater marks to maintain backpressure.
763 * Wake up readers.
764 */
765 lwkt_gettoken(&so2->so_rcv.ssb_token);
766 if (control) {
767 if (ssb_appendcontrol(&so2->so_rcv, m, control)) {
768 control = NULL;
769 m = NULL;
770 }
771 } else if (so->so_type == SOCK_SEQPACKET) {
772 sbappendrecord(&so2->so_rcv.sb, m);
773 m = NULL;
774 } else {
775 sbappend(&so2->so_rcv.sb, m);
776 m = NULL;
777 }
778
779 /*
780 * Because we are transfering mbufs directly to the
781 * peer socket we have to use SSB_STOP on the sender
782 * to prevent it from building up infinite mbufs.
783 */
784 if (so2->so_rcv.ssb_cc >= so->so_snd.ssb_hiwat ||
785 so2->so_rcv.ssb_mbcnt >= so->so_snd.ssb_mbmax
786 ) {
787 atomic_set_int(&so->so_snd.ssb_flags, SSB_STOP);
788 }
789 lwkt_reltoken(&so2->so_rcv.ssb_token);
790 sorwakeup(so2);
791
792 unp_free(unp2);
793 break;
794
795 default:
796 panic("uipc_send unknown socktype");
797 }
798
799 /*
800 * SEND_EOF is equivalent to a SEND followed by a SHUTDOWN.
801 */
802 if (msg->send.nm_flags & PRUS_EOF) {
803 socantsendmore(so);
804 unp_shutdown(unp);
805 }
806
807 if (control && error != 0)
808 unp_dispose(control);
809 release:
810 unp_reltoken(unp);
811 wakeup_end_delayed();
812
813 if (control)
814 m_freem(control);
815 if (m)
816 m_freem(m);
817 lwkt_replymsg(&msg->lmsg, error);
818 }
819
820 /*
821 * MPSAFE
822 */
823 static void
uipc_sense(netmsg_t msg)824 uipc_sense(netmsg_t msg)
825 {
826 struct unpcb *unp;
827 struct socket *so;
828 struct stat *sb;
829 int error;
830
831 so = msg->base.nm_so;
832 sb = msg->sense.nm_stat;
833
834 /*
835 * so_pcb is only modified with both the global and the unp
836 * pool token held.
837 */
838 unp = unp_getsocktoken(so);
839
840 if (!UNP_ISATTACHED(unp)) {
841 error = EINVAL;
842 goto done;
843 }
844
845 sb->st_blksize = so->so_snd.ssb_hiwat;
846 sb->st_dev = NOUDEV;
847 error = 0;
848 done:
849 unp_reltoken(unp);
850 lwkt_replymsg(&msg->lmsg, error);
851 }
852
853 static void
uipc_shutdown(netmsg_t msg)854 uipc_shutdown(netmsg_t msg)
855 {
856 struct socket *so;
857 struct unpcb *unp;
858 int error;
859
860 /*
861 * so_pcb is only modified with both the global and the unp
862 * pool token held.
863 */
864 so = msg->base.nm_so;
865 unp = unp_getsocktoken(so);
866
867 if (UNP_ISATTACHED(unp)) {
868 socantsendmore(so);
869 unp_shutdown(unp);
870 error = 0;
871 } else {
872 error = EINVAL;
873 }
874
875 unp_reltoken(unp);
876 lwkt_replymsg(&msg->lmsg, error);
877 }
878
879 static void
uipc_sockaddr(netmsg_t msg)880 uipc_sockaddr(netmsg_t msg)
881 {
882 struct unpcb *unp;
883 int error;
884
885 /*
886 * so_pcb is only modified with both the global and the unp
887 * pool token held.
888 */
889 unp = unp_getsocktoken(msg->base.nm_so);
890
891 if (UNP_ISATTACHED(unp)) {
892 if (unp->unp_addr) {
893 *msg->sockaddr.nm_nam =
894 dup_sockaddr((struct sockaddr *)unp->unp_addr);
895 }
896 error = 0;
897 } else {
898 error = EINVAL;
899 }
900
901 unp_reltoken(unp);
902 lwkt_replymsg(&msg->lmsg, error);
903 }
904
905 struct pr_usrreqs uipc_usrreqs = {
906 .pru_abort = uipc_abort,
907 .pru_accept = uipc_accept,
908 .pru_attach = uipc_attach,
909 .pru_bind = uipc_bind,
910 .pru_connect = uipc_connect,
911 .pru_connect2 = uipc_connect2,
912 .pru_control = pr_generic_notsupp,
913 .pru_detach = uipc_detach,
914 .pru_disconnect = uipc_disconnect,
915 .pru_listen = uipc_listen,
916 .pru_peeraddr = uipc_peeraddr,
917 .pru_rcvd = uipc_rcvd,
918 .pru_rcvoob = pr_generic_notsupp,
919 .pru_send = uipc_send,
920 .pru_sense = uipc_sense,
921 .pru_shutdown = uipc_shutdown,
922 .pru_sockaddr = uipc_sockaddr,
923 .pru_sosend = sosend,
924 .pru_soreceive = soreceive
925 };
926
927 void
uipc_ctloutput(netmsg_t msg)928 uipc_ctloutput(netmsg_t msg)
929 {
930 struct socket *so;
931 struct sockopt *sopt;
932 struct unpcb *unp;
933 int error = 0;
934
935 so = msg->base.nm_so;
936 sopt = msg->ctloutput.nm_sopt;
937
938 lwkt_gettoken(&unp_token);
939 unp = unp_getsocktoken(so);
940
941 if (!UNP_ISATTACHED(unp)) {
942 error = EINVAL;
943 goto done;
944 }
945
946 switch (sopt->sopt_dir) {
947 case SOPT_GET:
948 switch (sopt->sopt_name) {
949 case LOCAL_PEERCRED:
950 if (unp->unp_flags & UNP_HAVEPC)
951 soopt_from_kbuf(sopt, &unp->unp_peercred,
952 sizeof(unp->unp_peercred));
953 else {
954 if (so->so_type == SOCK_STREAM)
955 error = ENOTCONN;
956 else if (so->so_type == SOCK_SEQPACKET)
957 error = ENOTCONN;
958 else
959 error = EINVAL;
960 }
961 break;
962 default:
963 error = EOPNOTSUPP;
964 break;
965 }
966 break;
967 case SOPT_SET:
968 default:
969 error = EOPNOTSUPP;
970 break;
971 }
972
973 done:
974 unp_reltoken(unp);
975 lwkt_reltoken(&unp_token);
976
977 lwkt_replymsg(&msg->lmsg, error);
978 }
979
980 /*
981 * Both send and receive buffers are allocated PIPSIZ bytes of buffering
982 * for stream sockets, although the total for sender and receiver is
983 * actually only PIPSIZ.
984 *
985 * Datagram sockets really use the sendspace as the maximum datagram size,
986 * and don't really want to reserve the sendspace. Their recvspace should
987 * be large enough for at least one max-size datagram plus address.
988 *
989 * We want the local send/recv space to be significant larger then lo0's
990 * mtu of 16384.
991 *
992 * We no longer need to worry about avoiding the windows scaling option.
993 * Programs which use unix domain sockets expect larger defaults these days.
994 */
995 #ifndef PIPSIZ
996 #define PIPSIZ 65536
997 #endif
998 static u_long unpst_sendspace = PIPSIZ;
999 static u_long unpst_recvspace = PIPSIZ;
1000 static u_long unpdg_sendspace = PIPSIZ; /* really max datagram size */
1001 static u_long unpdg_recvspace = PIPSIZ;
1002 static u_long unpsp_sendspace = PIPSIZ; /* really max datagram size */
1003 static u_long unpsp_recvspace = PIPSIZ;
1004
1005 SYSCTL_DECL(_net_local_stream);
1006 SYSCTL_DECL(_net_local_dgram);
1007 SYSCTL_DECL(_net_local_seqpacket);
1008
1009 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
1010 &unpst_sendspace, 0, "Size of stream socket send buffer");
1011 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
1012 &unpst_recvspace, 0, "Size of stream socket receive buffer");
1013
1014 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
1015 &unpdg_sendspace, 0, "Max datagram socket size");
1016 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
1017 &unpdg_recvspace, 0, "Size of datagram socket receive buffer");
1018
1019 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
1020 &unpsp_sendspace, 0, "Default seqpacket send space.");
1021 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
1022 &unpsp_recvspace, 0, "Default seqpacket receive space.");
1023
1024
1025 static int
unp_attach(struct socket * so,struct pru_attach_info * ai)1026 unp_attach(struct socket *so, struct pru_attach_info *ai)
1027 {
1028 struct unp_global_head *head;
1029 struct unpcb *unp;
1030 int error;
1031
1032 lwkt_gettoken(&unp_token);
1033
1034 if (so->so_snd.ssb_hiwat == 0 || so->so_rcv.ssb_hiwat == 0) {
1035 switch (so->so_type) {
1036 case SOCK_STREAM:
1037 error = soreserve(so, unpst_sendspace, unpst_recvspace,
1038 ai->sb_rlimit);
1039 break;
1040 case SOCK_DGRAM:
1041 error = soreserve(so, unpdg_sendspace, unpdg_recvspace,
1042 ai->sb_rlimit);
1043 break;
1044 case SOCK_SEQPACKET:
1045 error = soreserve(so, unpsp_sendspace, unpsp_recvspace,
1046 ai->sb_rlimit);
1047 break;
1048 default:
1049 panic("unp_attach");
1050 }
1051 if (error)
1052 goto failed;
1053 }
1054
1055 /*
1056 * In order to support sendfile we have to set either SSB_STOPSUPP
1057 * or SSB_PREALLOC. Unix domain sockets use the SSB_STOP flow
1058 * control mechanism.
1059 */
1060 if (so->so_type == SOCK_STREAM) {
1061 atomic_set_int(&so->so_rcv.ssb_flags, SSB_STOPSUPP);
1062 atomic_set_int(&so->so_snd.ssb_flags, SSB_STOPSUPP);
1063 }
1064
1065 unp = kmalloc(sizeof(*unp), M_UNPCB, M_WAITOK | M_ZERO | M_NULLOK);
1066 if (unp == NULL) {
1067 error = ENOBUFS;
1068 goto failed;
1069 }
1070 unp->unp_refcnt = 1;
1071 unp->unp_gencnt = ++unp_gencnt;
1072 LIST_INIT(&unp->unp_refs);
1073 unp->unp_socket = so;
1074 unp->unp_rvnode = ai->fd_rdir; /* jail cruft XXX JH */
1075 so->so_pcb = (caddr_t)unp;
1076 soreference(so);
1077
1078 head = unp_globalhead(so->so_type);
1079 TAILQ_INSERT_TAIL(&head->list, unp, unp_link);
1080 head->count++;
1081 error = 0;
1082 failed:
1083 lwkt_reltoken(&unp_token);
1084 return error;
1085 }
1086
1087 static void
unp_detach(struct unpcb * unp)1088 unp_detach(struct unpcb *unp)
1089 {
1090 struct socket *so;
1091
1092 lwkt_gettoken(&unp_token);
1093 lwkt_getpooltoken(unp);
1094
1095 so = unp->unp_socket;
1096
1097 unp->unp_gencnt = ++unp_gencnt;
1098 if (unp->unp_vnode) {
1099 unp->unp_vnode->v_socket = NULL;
1100 vrele(unp->unp_vnode);
1101 unp->unp_vnode = NULL;
1102 }
1103 soisdisconnected(so);
1104 KKASSERT(so->so_pcb == unp);
1105 so->so_pcb = NULL; /* both tokens required */
1106 unp->unp_socket = NULL;
1107
1108 lwkt_relpooltoken(unp);
1109 lwkt_reltoken(&unp_token);
1110
1111 sofree(so);
1112
1113 KASSERT(unp->unp_conn == NULL, ("unp is still connected"));
1114 KASSERT(LIST_EMPTY(&unp->unp_refs), ("unp still has references"));
1115
1116 if (unp->unp_addr)
1117 kfree(unp->unp_addr, M_SONAME);
1118 kfree(unp, M_UNPCB);
1119
1120 if (unp_rights)
1121 taskqueue_enqueue(unp_taskqueue, &unp_gc_task);
1122 }
1123
1124 static int
unp_bind(struct unpcb * unp,struct sockaddr * nam,struct thread * td)1125 unp_bind(struct unpcb *unp, struct sockaddr *nam, struct thread *td)
1126 {
1127 struct proc *p = td->td_proc;
1128 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
1129 struct vnode *vp;
1130 struct vattr vattr;
1131 int error, namelen;
1132 struct nlookupdata nd;
1133 char buf[SOCK_MAXADDRLEN];
1134
1135 ASSERT_LWKT_TOKEN_HELD(&unp_token);
1136 UNP_ASSERT_TOKEN_HELD(unp);
1137
1138 if (unp->unp_vnode != NULL)
1139 return EINVAL;
1140
1141 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
1142 if (namelen <= 0)
1143 return EINVAL;
1144 strncpy(buf, soun->sun_path, namelen);
1145 buf[namelen] = 0; /* null-terminate the string */
1146 error = nlookup_init(&nd, buf, UIO_SYSSPACE,
1147 NLC_LOCKVP | NLC_CREATE | NLC_REFDVP);
1148 if (error == 0)
1149 error = nlookup(&nd);
1150 if (error == 0 && nd.nl_nch.ncp->nc_vp != NULL)
1151 error = EADDRINUSE;
1152 if (error == 0 && nd.nl_dvp == NULL) /* e.g. bind <mountpt> */
1153 error = EINVAL;
1154 if (error)
1155 goto done;
1156
1157 VATTR_NULL(&vattr);
1158 vattr.va_type = VSOCK;
1159 vattr.va_mode = (ACCESSPERMS & ~p->p_fd->fd_cmask);
1160 error = VOP_NCREATE(&nd.nl_nch, nd.nl_dvp, &vp, nd.nl_cred, &vattr);
1161 if (error == 0) {
1162 if (unp->unp_vnode == NULL) {
1163 vp->v_socket = unp->unp_socket;
1164 unp->unp_vnode = vp;
1165 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam);
1166 vn_unlock(vp);
1167 } else {
1168 vput(vp); /* late race */
1169 error = EINVAL;
1170 }
1171 }
1172 done:
1173 nlookup_done(&nd);
1174 return (error);
1175 }
1176
1177 static int
unp_connect(struct socket * so,struct sockaddr * nam,struct thread * td)1178 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1179 {
1180 struct unpcb *unp, *unp2;
1181 int error, flags = 0;
1182
1183 lwkt_gettoken(&unp_token);
1184
1185 unp = unp_getsocktoken(so);
1186 if (!UNP_ISATTACHED(unp)) {
1187 error = EINVAL;
1188 goto failed;
1189 }
1190
1191 if ((unp->unp_flags & UNP_CONNECTING) || unp->unp_conn != NULL) {
1192 error = EISCONN;
1193 goto failed;
1194 }
1195
1196 flags = UNP_CONNECTING;
1197 unp_setflags(unp, flags);
1198
1199 error = unp_find_lockref(nam, td, so->so_type, &unp2);
1200 if (error)
1201 goto failed;
1202 /*
1203 * NOTE:
1204 * unp2 is locked and referenced.
1205 */
1206
1207 if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1208 struct socket *so2, *so3;
1209 struct unpcb *unp3;
1210
1211 so2 = unp2->unp_socket;
1212 if (!(so2->so_options & SO_ACCEPTCONN) ||
1213 /* listen is not completed yet */
1214 !(unp2->unp_flags & UNP_HAVEPCCACHED) ||
1215 (so3 = sonewconn_faddr(so2, 0, NULL,
1216 TRUE /* keep ref */)) == NULL) {
1217 error = ECONNREFUSED;
1218 goto done;
1219 }
1220 /* so3 has a socket reference. */
1221
1222 unp3 = unp_getsocktoken(so3);
1223 if (!UNP_ISATTACHED(unp3)) {
1224 unp_reltoken(unp3);
1225 /*
1226 * Already aborted; we only need to drop the
1227 * socket reference held by sonewconn_faddr().
1228 */
1229 sofree(so3);
1230 error = ECONNREFUSED;
1231 goto done;
1232 }
1233 unp_reference(unp3);
1234 /*
1235 * NOTE:
1236 * unp3 is locked and referenced.
1237 */
1238
1239 /*
1240 * Release so3 socket reference held by sonewconn_faddr().
1241 * Since we have referenced unp3, neither unp3 nor so3 will
1242 * be destroyed here.
1243 */
1244 sofree(so3);
1245
1246 if (unp2->unp_addr != NULL) {
1247 unp3->unp_addr = (struct sockaddr_un *)
1248 dup_sockaddr((struct sockaddr *)unp2->unp_addr);
1249 }
1250
1251 /*
1252 * unp_peercred management:
1253 *
1254 * The connecter's (client's) credentials are copied
1255 * from its process structure at the time of connect()
1256 * (which is now).
1257 */
1258 cru2x(td->td_proc->p_ucred, &unp3->unp_peercred);
1259 unp_setflags(unp3, UNP_HAVEPC);
1260 /*
1261 * The receiver's (server's) credentials are copied
1262 * from the unp_peercred member of socket on which the
1263 * former called listen(); unp_listen() cached that
1264 * process's credentials at that time so we can use
1265 * them now.
1266 */
1267 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1268 ("unp_connect: listener without cached peercred"));
1269 memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1270 sizeof(unp->unp_peercred));
1271 unp_setflags(unp, UNP_HAVEPC);
1272
1273 error = unp_connect_pair(unp, unp3);
1274 if (error)
1275 soabort_direct(so3);
1276
1277 /* Done with unp3 */
1278 unp_free(unp3);
1279 unp_reltoken(unp3);
1280 } else {
1281 error = unp_connect_pair(unp, unp2);
1282 }
1283 done:
1284 unp_free(unp2);
1285 unp_reltoken(unp2);
1286 failed:
1287 if (flags)
1288 unp_clrflags(unp, flags);
1289 unp_reltoken(unp);
1290
1291 lwkt_reltoken(&unp_token);
1292 return (error);
1293 }
1294
1295 /*
1296 * Connect two unix domain sockets together.
1297 *
1298 * NOTE: Semantics for any change to unp_conn requires that the per-unp
1299 * pool token also be held.
1300 */
1301 int
unp_connect2(struct socket * so,struct socket * so2,struct ucred * cred)1302 unp_connect2(struct socket *so, struct socket *so2, struct ucred *cred)
1303 {
1304 struct unpcb *unp, *unp2;
1305 int error;
1306
1307 lwkt_gettoken(&unp_token);
1308 if (so2->so_type != so->so_type) {
1309 lwkt_reltoken(&unp_token);
1310 return (EPROTOTYPE);
1311 }
1312 unp = unp_getsocktoken(so);
1313 unp2 = unp_getsocktoken(so2);
1314
1315 cru2x(cred, &unp->unp_peercred);
1316 cru2x(cred, &unp2->unp_peercred);
1317 unp_setflags(unp, UNP_HAVEPC);
1318 unp_setflags(unp2, UNP_HAVEPC);
1319
1320 if (!UNP_ISATTACHED(unp)) {
1321 error = EINVAL;
1322 goto done;
1323 }
1324 if (!UNP_ISATTACHED(unp2)) {
1325 error = ECONNREFUSED;
1326 goto done;
1327 }
1328
1329 if (unp->unp_conn != NULL) {
1330 error = EISCONN;
1331 goto done;
1332 }
1333 if ((so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET) &&
1334 unp2->unp_conn != NULL) {
1335 error = EISCONN;
1336 goto done;
1337 }
1338
1339 error = unp_connect_pair(unp, unp2);
1340 done:
1341 unp_reltoken(unp2);
1342 unp_reltoken(unp);
1343 lwkt_reltoken(&unp_token);
1344 return (error);
1345 }
1346
1347 /*
1348 * Disconnect a unix domain socket pair.
1349 *
1350 * NOTE: Semantics for any change to unp_conn requires that the per-unp
1351 * pool token also be held.
1352 */
1353 static void
unp_disconnect(struct unpcb * unp,int error)1354 unp_disconnect(struct unpcb *unp, int error)
1355 {
1356 struct socket *so = unp->unp_socket;
1357 struct unpcb *unp2;
1358
1359 ASSERT_LWKT_TOKEN_HELD(&unp_token);
1360 UNP_ASSERT_TOKEN_HELD(unp);
1361
1362 if (error)
1363 so->so_error = error;
1364
1365 while ((unp2 = unp->unp_conn) != NULL) {
1366 lwkt_getpooltoken(unp2);
1367 if (unp2 == unp->unp_conn)
1368 break;
1369 lwkt_relpooltoken(unp2);
1370 }
1371 if (unp2 == NULL)
1372 return;
1373 /* unp2 is locked. */
1374
1375 KASSERT((unp2->unp_flags & UNP_DROPPED) == 0, ("unp2 was dropped"));
1376
1377 unp->unp_conn = NULL;
1378
1379 switch (so->so_type) {
1380 case SOCK_DGRAM:
1381 LIST_REMOVE(unp, unp_reflink);
1382 soclrstate(so, SS_ISCONNECTED);
1383 break;
1384
1385 case SOCK_STREAM:
1386 case SOCK_SEQPACKET:
1387 /*
1388 * Keep a reference before clearing the unp_conn
1389 * to avoid racing uipc_detach()/uipc_abort() in
1390 * other thread.
1391 */
1392 unp_reference(unp2);
1393 KASSERT(unp2->unp_conn == unp, ("unp_conn mismatch"));
1394 unp2->unp_conn = NULL;
1395
1396 soisdisconnected(so);
1397 soisdisconnected(unp2->unp_socket);
1398
1399 unp_free(unp2);
1400 break;
1401 }
1402
1403 lwkt_relpooltoken(unp2);
1404 }
1405
1406 #ifdef notdef
1407 void
unp_abort(struct unpcb * unp)1408 unp_abort(struct unpcb *unp)
1409 {
1410 lwkt_gettoken(&unp_token);
1411 unp_free(unp);
1412 lwkt_reltoken(&unp_token);
1413 }
1414 #endif
1415
1416 static int
prison_unpcb(struct thread * td,struct unpcb * unp)1417 prison_unpcb(struct thread *td, struct unpcb *unp)
1418 {
1419 struct proc *p;
1420
1421 if (td == NULL)
1422 return (0);
1423 if ((p = td->td_proc) == NULL)
1424 return (0);
1425 if (!p->p_ucred->cr_prison)
1426 return (0);
1427 if (p->p_fd->fd_rdir == unp->unp_rvnode)
1428 return (0);
1429 return (1);
1430 }
1431
1432 static int
unp_pcblist(SYSCTL_HANDLER_ARGS)1433 unp_pcblist(SYSCTL_HANDLER_ARGS)
1434 {
1435 struct unp_global_head *head = arg1;
1436 int error, i, n;
1437 struct unpcb *unp, *marker;
1438
1439 KKASSERT(curproc != NULL);
1440
1441 /*
1442 * The process of preparing the PCB list is too time-consuming and
1443 * resource-intensive to repeat twice on every request.
1444 */
1445 if (req->oldptr == NULL) {
1446 n = head->count;
1447 req->oldidx = (n + n/8) * sizeof(struct xunpcb);
1448 return 0;
1449 }
1450
1451 if (req->newptr != NULL)
1452 return EPERM;
1453
1454 marker = kmalloc(sizeof(*marker), M_UNPCB, M_WAITOK | M_ZERO);
1455 marker->unp_flags |= UNP_MARKER;
1456
1457 lwkt_gettoken(&unp_token);
1458
1459 n = head->count;
1460 i = 0;
1461 error = 0;
1462
1463 TAILQ_INSERT_HEAD(&head->list, marker, unp_link);
1464 while ((unp = TAILQ_NEXT(marker, unp_link)) != NULL && i < n) {
1465 struct xunpcb xu;
1466
1467 TAILQ_REMOVE(&head->list, marker, unp_link);
1468 TAILQ_INSERT_AFTER(&head->list, unp, marker, unp_link);
1469
1470 if (unp->unp_flags & UNP_MARKER)
1471 continue;
1472 if (prison_unpcb(req->td, unp))
1473 continue;
1474
1475 xu.xu_len = sizeof(xu);
1476 xu.xu_unpp = unp;
1477
1478 /*
1479 * NOTE:
1480 * unp->unp_addr and unp->unp_conn are protected by
1481 * unp_token. So if we want to get rid of unp_token
1482 * or reduce the coverage of unp_token, care must be
1483 * taken.
1484 */
1485 if (unp->unp_addr) {
1486 bcopy(unp->unp_addr, &xu.xu_addr,
1487 unp->unp_addr->sun_len);
1488 }
1489 if (unp->unp_conn && unp->unp_conn->unp_addr) {
1490 bcopy(unp->unp_conn->unp_addr,
1491 &xu.xu_caddr,
1492 unp->unp_conn->unp_addr->sun_len);
1493 }
1494 bcopy(unp, &xu.xu_unp, sizeof(*unp));
1495 sotoxsocket(unp->unp_socket, &xu.xu_socket);
1496
1497 /* NOTE: This could block and temporarily release unp_token */
1498 error = SYSCTL_OUT(req, &xu, sizeof(xu));
1499 if (error)
1500 break;
1501 ++i;
1502 }
1503 TAILQ_REMOVE(&head->list, marker, unp_link);
1504
1505 lwkt_reltoken(&unp_token);
1506
1507 kfree(marker, M_UNPCB);
1508 return error;
1509 }
1510
1511 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD,
1512 &unp_dgram_head, 0, unp_pcblist, "S,xunpcb",
1513 "List of active local datagram sockets");
1514 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD,
1515 &unp_stream_head, 0, unp_pcblist, "S,xunpcb",
1516 "List of active local stream sockets");
1517 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist, CTLFLAG_RD,
1518 &unp_seqpkt_head, 0, unp_pcblist, "S,xunpcb",
1519 "List of active local seqpacket sockets");
1520
1521 static void
unp_shutdown(struct unpcb * unp)1522 unp_shutdown(struct unpcb *unp)
1523 {
1524 struct socket *so;
1525
1526 if ((unp->unp_socket->so_type == SOCK_STREAM ||
1527 unp->unp_socket->so_type == SOCK_SEQPACKET) &&
1528 unp->unp_conn != NULL && (so = unp->unp_conn->unp_socket)) {
1529 socantrcvmore(so);
1530 }
1531 }
1532
1533 #ifdef notdef
1534 void
unp_drain(void)1535 unp_drain(void)
1536 {
1537 lwkt_gettoken(&unp_token);
1538 lwkt_reltoken(&unp_token);
1539 }
1540 #endif
1541
1542 int
unp_externalize(struct mbuf * rights,int flags)1543 unp_externalize(struct mbuf *rights, int flags)
1544 {
1545 struct thread *td = curthread;
1546 struct proc *p = td->td_proc; /* XXX */
1547 struct lwp *lp = td->td_lwp;
1548 struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
1549 int *fdp;
1550 int i;
1551 struct file **rp;
1552 struct file *fp;
1553 int newfds = (cm->cmsg_len - (CMSG_DATA(cm) - (u_char *)cm))
1554 / sizeof(struct file *);
1555 int f;
1556
1557 lwkt_gettoken(&unp_rights_token);
1558
1559 /*
1560 * if the new FD's will not fit, then we free them all
1561 */
1562 if (!fdavail(p, newfds)) {
1563 rp = (struct file **)CMSG_DATA(cm);
1564 for (i = 0; i < newfds; i++) {
1565 fp = *rp;
1566 /*
1567 * zero the pointer before calling unp_discard,
1568 * since it may end up in unp_gc()..
1569 */
1570 *rp++ = NULL;
1571 unp_discard(fp, NULL);
1572 }
1573 lwkt_reltoken(&unp_rights_token);
1574 return (EMSGSIZE);
1575 }
1576
1577 /*
1578 * now change each pointer to an fd in the global table to
1579 * an integer that is the index to the local fd table entry
1580 * that we set up to point to the global one we are transferring.
1581 * Since the sizeof(struct file *) is bigger than or equal to
1582 * the sizeof(int), we do it in forward order. In that case,
1583 * an integer will always come in the same place or before its
1584 * corresponding struct file pointer.
1585 *
1586 * Hold revoke_token in 'shared' mode, so that we won't miss
1587 * the FREVOKED update on fps being externalized (fsetfd).
1588 */
1589 lwkt_gettoken_shared(&revoke_token);
1590 fdp = (int *)CMSG_DATA(cm);
1591 rp = (struct file **)CMSG_DATA(cm);
1592 for (i = 0; i < newfds; i++) {
1593 if (fdalloc(p, 0, &f)) {
1594 int j;
1595
1596 /*
1597 * Previous fdavail() can't garantee
1598 * fdalloc() success due to SMP race.
1599 * Just clean up and return the same
1600 * error value as if fdavail() failed.
1601 */
1602 lwkt_reltoken(&revoke_token);
1603
1604 /* Close externalized files */
1605 for (j = 0; j < i; j++)
1606 kern_close(fdp[j]);
1607 /* Discard the rest of internal files */
1608 for (; i < newfds; i++)
1609 unp_discard(rp[i], NULL);
1610 /* Wipe out the control message */
1611 for (i = 0; i < newfds; i++)
1612 rp[i] = NULL;
1613
1614 lwkt_reltoken(&unp_rights_token);
1615 return (EMSGSIZE);
1616 }
1617 fp = rp[i];
1618 unp_fp_externalize(lp, fp, f, flags);
1619 fdp[i] = f;
1620 }
1621 lwkt_reltoken(&revoke_token);
1622
1623 lwkt_reltoken(&unp_rights_token);
1624
1625 /*
1626 * Adjust length, in case sizeof(struct file *) and sizeof(int)
1627 * differs.
1628 */
1629 cm->cmsg_len = CMSG_LEN(newfds * sizeof(int));
1630 rights->m_len = cm->cmsg_len;
1631
1632 return (0);
1633 }
1634
1635 static void
unp_fp_externalize(struct lwp * lp,struct file * fp,int fd,int flags)1636 unp_fp_externalize(struct lwp *lp, struct file *fp, int fd, int flags)
1637 {
1638 if (lp) {
1639 struct filedesc *fdp = lp->lwp_proc->p_fd;
1640
1641 KKASSERT(fd >= 0);
1642 if (fp->f_flag & FREVOKED) {
1643 struct file *fx;
1644 int error;
1645
1646 kprintf("Warning: revoked fp exiting unix socket\n");
1647 error = falloc(lp, &fx, NULL);
1648 if (error == 0) {
1649 if (flags & MSG_CMSG_CLOEXEC)
1650 fdp->fd_files[fd].fileflags |= UF_EXCLOSE;
1651 fsetfd(fdp, fx, fd);
1652 fdrop(fx);
1653 } else {
1654 fsetfd(fdp, NULL, fd);
1655 }
1656 } else {
1657 if (flags & MSG_CMSG_CLOEXEC)
1658 fdp->fd_files[fd].fileflags |= UF_EXCLOSE;
1659 fsetfd(fdp, fp, fd);
1660 }
1661 }
1662 unp_del_right(fp);
1663 fdrop(fp);
1664 }
1665
1666 void
unp_init(void)1667 unp_init(void)
1668 {
1669 TAILQ_INIT(&unp_stream_head.list);
1670 TAILQ_INIT(&unp_dgram_head.list);
1671 TAILQ_INIT(&unp_seqpkt_head.list);
1672
1673 SLIST_INIT(&unp_defdiscard_head);
1674 spin_init(&unp_defdiscard_spin, "unpdisc");
1675 TASK_INIT(&unp_defdiscard_task, 0, unp_defdiscard_taskfunc, NULL);
1676
1677 /*
1678 * This implies that only one gc can be in-progress at any
1679 * given moment.
1680 */
1681 TASK_INIT(&unp_gc_task, 0, unp_gc, NULL);
1682
1683 unp_gc_marker = kmalloc(sizeof(*unp_gc_marker), M_UNPCB,
1684 M_WAITOK | M_ZERO);
1685 unp_gc_marker->unp_flags |= UNP_MARKER;
1686
1687 /*
1688 * Create taskqueue for defered discard, and stick it to
1689 * the last CPU.
1690 */
1691 unp_taskqueue = taskqueue_create("unp_taskq", M_WAITOK,
1692 taskqueue_thread_enqueue, &unp_taskqueue);
1693 taskqueue_start_threads(&unp_taskqueue, 1, TDPRI_KERN_DAEMON,
1694 ncpus - 1, "unp taskq");
1695 }
1696
1697 static int
unp_internalize(struct mbuf * control,struct thread * td)1698 unp_internalize(struct mbuf *control, struct thread *td)
1699 {
1700 struct proc *p = td->td_proc;
1701 struct filedesc *fdescp;
1702 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1703 struct file **rp;
1704 struct file *fp;
1705 int i, fd, *fdp;
1706 struct cmsgcred *cmcred;
1707 int oldfds;
1708 u_int newlen;
1709 int error;
1710
1711 KKASSERT(p);
1712
1713 /*
1714 * Make sure the message is reasonable, and either CREDS or RIGHTS.
1715 *
1716 * NOTE: overall message length does not have to be aligned, but the
1717 * data start does.
1718 */
1719 if ((cm->cmsg_type != SCM_RIGHTS && cm->cmsg_type != SCM_CREDS) ||
1720 cm->cmsg_level != SOL_SOCKET ||
1721 control->m_len < sizeof(*cm) || /* control too small */
1722 cm->cmsg_len < sizeof(*cm) || /* cmsg_len too small */
1723 cm->cmsg_len > control->m_len) { /* cmsg_len too big */
1724 return EINVAL;
1725 }
1726
1727 /*
1728 * Fill in credential information.
1729 */
1730 if (cm->cmsg_type == SCM_CREDS) {
1731 cmcred = (struct cmsgcred *)CMSG_DATA(cm);
1732 cmcred->cmcred_pid = p->p_pid;
1733 cmcred->cmcred_uid = p->p_ucred->cr_ruid;
1734 cmcred->cmcred_gid = p->p_ucred->cr_rgid;
1735 cmcred->cmcred_euid = p->p_ucred->cr_uid;
1736 cmcred->cmcred_ngroups = MIN(p->p_ucred->cr_ngroups,
1737 CMGROUP_MAX);
1738 for (i = 0; i < cmcred->cmcred_ngroups; i++)
1739 cmcred->cmcred_groups[i] = p->p_ucred->cr_groups[i];
1740 return 0;
1741 }
1742
1743 /*
1744 * cmsghdr may not be aligned, do not allow calculation(s) to
1745 * go negative.
1746 *
1747 * Data must be aligned but the data length does not have to be.
1748 *
1749 * If there are multiple headers (XXX not supported) then the
1750 * next header will be aligned after the end of the possibly
1751 * unaligned data.
1752 */
1753 if (cm->cmsg_len < CMSG_LEN(0)) {
1754 return EINVAL;
1755 }
1756
1757 oldfds = (cm->cmsg_len - CMSG_LEN(0)) / sizeof(int);
1758
1759 /*
1760 * Now replace the integer FDs with pointers to
1761 * the associated global file table entry..
1762 * Allocate a bigger buffer as necessary. But if an cluster is not
1763 * enough, return E2BIG.
1764 */
1765 newlen = CMSG_LEN(oldfds * sizeof(struct file *));
1766 if (newlen > MCLBYTES)
1767 return E2BIG;
1768 if (newlen - control->m_len > M_TRAILINGSPACE(control)) {
1769 if (control->m_flags & M_EXT)
1770 return E2BIG;
1771 MCLGET(control, M_WAITOK);
1772
1773 /* copy the data to the cluster */
1774 memcpy(mtod(control, char *), cm, cm->cmsg_len);
1775 cm = mtod(control, struct cmsghdr *);
1776 }
1777
1778 lwkt_gettoken(&unp_rights_token);
1779
1780 fdescp = p->p_fd;
1781 spin_lock_shared(&fdescp->fd_spin);
1782
1783 /*
1784 * check that all the FDs passed in refer to legal OPEN files
1785 * If not, reject the entire operation.
1786 */
1787 fdp = (int *)CMSG_DATA(cm);
1788 for (i = 0; i < oldfds; i++) {
1789 fd = *fdp++;
1790 if ((unsigned)fd >= fdescp->fd_nfiles ||
1791 fdescp->fd_files[fd].fp == NULL) {
1792 error = EBADF;
1793 goto done;
1794 }
1795 if (fdescp->fd_files[fd].fp->f_type == DTYPE_KQUEUE) {
1796 error = EOPNOTSUPP;
1797 goto done;
1798 }
1799 }
1800
1801 /*
1802 * Adjust length, in case sizeof(struct file *) and sizeof(int)
1803 * differs.
1804 */
1805 cm->cmsg_len = newlen;
1806 control->m_len = CMSG_ALIGN(newlen);
1807
1808 /*
1809 * Transform the file descriptors into struct file pointers.
1810 * Since the sizeof(struct file *) is bigger than or equal to
1811 * the sizeof(int), we do it in reverse order so that the int
1812 * won't get trashed until we're done.
1813 */
1814 fdp = (int *)CMSG_DATA(cm) + oldfds - 1;
1815 rp = (struct file **)CMSG_DATA(cm) + oldfds - 1;
1816 for (i = 0; i < oldfds; i++) {
1817 fp = fdescp->fd_files[*fdp--].fp;
1818 *rp-- = fp;
1819 fhold(fp);
1820 unp_add_right(fp);
1821 }
1822 error = 0;
1823 done:
1824 spin_unlock_shared(&fdescp->fd_spin);
1825 lwkt_reltoken(&unp_rights_token);
1826 return error;
1827 }
1828
1829 #ifdef UNP_GC_ALLFILES
1830
1831 /*
1832 * Garbage collect in-transit file descriptors that get lost due to
1833 * loops (i.e. when a socket is sent to another process over itself,
1834 * and more complex situations).
1835 *
1836 * NOT MPSAFE - TODO socket flush code and maybe fdrop. Rest is MPSAFE.
1837 */
1838
1839 struct unp_gc_info {
1840 struct file **extra_ref;
1841 struct file *locked_fp;
1842 int defer;
1843 int index;
1844 int maxindex;
1845 };
1846
1847 static void
unp_gc(void * arg __unused,int pending __unused)1848 unp_gc(void *arg __unused, int pending __unused)
1849 {
1850 struct unp_gc_info info;
1851 struct file **fpp;
1852 int i;
1853
1854 lwkt_gettoken(&unp_rights_token);
1855
1856 /*
1857 * Before going through all this, set all FDs to be NOT defered
1858 * and NOT externally accessible (not marked). During the scan
1859 * a fd can be marked externally accessible but we may or may not
1860 * be able to immediately process it (controlled by FDEFER).
1861 *
1862 * If we loop sleep a bit. The complexity of the topology can cause
1863 * multiple loops. Also failure to acquire the socket's so_rcv
1864 * token can cause us to loop.
1865 */
1866 allfiles_scan_exclusive(unp_gc_clearmarks, NULL);
1867 do {
1868 info.defer = 0;
1869 allfiles_scan_exclusive(unp_gc_checkmarks, &info);
1870 if (info.defer)
1871 tsleep(&info, 0, "gcagain", 1);
1872 } while (info.defer);
1873
1874 /*
1875 * We grab an extra reference to each of the file table entries
1876 * that are not otherwise accessible and then free the rights
1877 * that are stored in messages on them.
1878 *
1879 * The bug in the orginal code is a little tricky, so I'll describe
1880 * what's wrong with it here.
1881 *
1882 * It is incorrect to simply unp_discard each entry for f_msgcount
1883 * times -- consider the case of sockets A and B that contain
1884 * references to each other. On a last close of some other socket,
1885 * we trigger a gc since the number of outstanding rights (unp_rights)
1886 * is non-zero. If during the sweep phase the gc code unp_discards,
1887 * we end up doing a (full) fdrop on the descriptor. A fdrop on A
1888 * results in the following chain. Closef calls soo_close, which
1889 * calls soclose. Soclose calls first (through the switch
1890 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
1891 * returns because the previous instance had set unp_gcing, and
1892 * we return all the way back to soclose, which marks the socket
1893 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
1894 * to free up the rights that are queued in messages on the socket A,
1895 * i.e., the reference on B. The sorflush calls via the dom_dispose
1896 * switch unp_dispose, which unp_scans with unp_discard. This second
1897 * instance of unp_discard just calls fdrop on B.
1898 *
1899 * Well, a similar chain occurs on B, resulting in a sorflush on B,
1900 * which results in another fdrop on A. Unfortunately, A is already
1901 * being closed, and the descriptor has already been marked with
1902 * SS_NOFDREF, and soclose panics at this point.
1903 *
1904 * Here, we first take an extra reference to each inaccessible
1905 * descriptor. Then, we call sorflush ourself, since we know
1906 * it is a Unix domain socket anyhow. After we destroy all the
1907 * rights carried in messages, we do a last fdrop to get rid
1908 * of our extra reference. This is the last close, and the
1909 * unp_detach etc will shut down the socket.
1910 *
1911 * 91/09/19, bsy@cs.cmu.edu
1912 */
1913 info.extra_ref = kmalloc(256 * sizeof(struct file *), M_FILE, M_WAITOK);
1914 info.maxindex = 256;
1915
1916 do {
1917 /*
1918 * Look for matches
1919 */
1920 info.index = 0;
1921 allfiles_scan_exclusive(unp_gc_checkrefs, &info);
1922
1923 /*
1924 * For each FD on our hit list, do the following two things
1925 */
1926 for (i = info.index, fpp = info.extra_ref; --i >= 0; ++fpp) {
1927 struct file *tfp = *fpp;
1928 if (tfp->f_type == DTYPE_SOCKET && tfp->f_data != NULL)
1929 sorflush((struct socket *)(tfp->f_data));
1930 }
1931 for (i = info.index, fpp = info.extra_ref; --i >= 0; ++fpp)
1932 fdrop(*fpp);
1933 } while (info.index == info.maxindex);
1934
1935 kfree((caddr_t)info.extra_ref, M_FILE);
1936
1937 lwkt_reltoken(&unp_rights_token);
1938 }
1939
1940 /*
1941 * MPSAFE - NOTE: filehead list and file pointer spinlocked on entry
1942 */
1943 static int
unp_gc_checkrefs(struct file * fp,void * data)1944 unp_gc_checkrefs(struct file *fp, void *data)
1945 {
1946 struct unp_gc_info *info = data;
1947
1948 if (fp->f_count == 0)
1949 return(0);
1950 if (info->index == info->maxindex)
1951 return(-1);
1952
1953 /*
1954 * If all refs are from msgs, and it's not marked accessible
1955 * then it must be referenced from some unreachable cycle
1956 * of (shut-down) FDs, so include it in our
1957 * list of FDs to remove
1958 */
1959 if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
1960 info->extra_ref[info->index++] = fp;
1961 fhold(fp);
1962 }
1963 return(0);
1964 }
1965
1966 /*
1967 * MPSAFE - NOTE: filehead list and file pointer spinlocked on entry
1968 */
1969 static int
unp_gc_clearmarks(struct file * fp,void * data __unused)1970 unp_gc_clearmarks(struct file *fp, void *data __unused)
1971 {
1972 atomic_clear_int(&fp->f_flag, FMARK | FDEFER);
1973 return(0);
1974 }
1975
1976 /*
1977 * MPSAFE - NOTE: filehead list and file pointer spinlocked on entry
1978 */
1979 static int
unp_gc_checkmarks(struct file * fp,void * data)1980 unp_gc_checkmarks(struct file *fp, void *data)
1981 {
1982 struct unp_gc_info *info = data;
1983 struct socket *so;
1984
1985 /*
1986 * If the file is not open, skip it. Make sure it isn't marked
1987 * defered or we could loop forever, in case we somehow race
1988 * something.
1989 */
1990 if (fp->f_count == 0) {
1991 if (fp->f_flag & FDEFER)
1992 atomic_clear_int(&fp->f_flag, FDEFER);
1993 return(0);
1994 }
1995 /*
1996 * If we already marked it as 'defer' in a
1997 * previous pass, then try process it this time
1998 * and un-mark it
1999 */
2000 if (fp->f_flag & FDEFER) {
2001 atomic_clear_int(&fp->f_flag, FDEFER);
2002 } else {
2003 /*
2004 * if it's not defered, then check if it's
2005 * already marked.. if so skip it
2006 */
2007 if (fp->f_flag & FMARK)
2008 return(0);
2009 /*
2010 * If all references are from messages
2011 * in transit, then skip it. it's not
2012 * externally accessible.
2013 */
2014 if (fp->f_count == fp->f_msgcount)
2015 return(0);
2016 /*
2017 * If it got this far then it must be
2018 * externally accessible.
2019 */
2020 atomic_set_int(&fp->f_flag, FMARK);
2021 }
2022
2023 /*
2024 * either it was defered, or it is externally
2025 * accessible and not already marked so.
2026 * Now check if it is possibly one of OUR sockets.
2027 */
2028 if (fp->f_type != DTYPE_SOCKET ||
2029 (so = (struct socket *)fp->f_data) == NULL) {
2030 return(0);
2031 }
2032 if (so->so_proto->pr_domain != &localdomain ||
2033 !(so->so_proto->pr_flags & PR_RIGHTS)) {
2034 return(0);
2035 }
2036
2037 /*
2038 * So, Ok, it's one of our sockets and it IS externally accessible
2039 * (or was defered). Now we look to see if we hold any file
2040 * descriptors in its message buffers. Follow those links and mark
2041 * them as accessible too.
2042 *
2043 * We are holding multiple spinlocks here, if we cannot get the
2044 * token non-blocking defer until the next loop.
2045 */
2046 info->locked_fp = fp;
2047 if (lwkt_trytoken(&so->so_rcv.ssb_token)) {
2048 unp_scan(so->so_rcv.ssb_mb, unp_mark, info);
2049 lwkt_reltoken(&so->so_rcv.ssb_token);
2050 } else {
2051 atomic_set_int(&fp->f_flag, FDEFER);
2052 ++info->defer;
2053 }
2054 return (0);
2055 }
2056
2057 /*
2058 * Mark visibility. info->defer is recalculated on every pass.
2059 */
2060 static void
unp_mark(struct file * fp,void * data)2061 unp_mark(struct file *fp, void *data)
2062 {
2063 struct unp_gc_info *info = data;
2064
2065 if ((fp->f_flag & FMARK) == 0) {
2066 ++info->defer;
2067 atomic_set_int(&fp->f_flag, FMARK | FDEFER);
2068 } else if (fp->f_flag & FDEFER) {
2069 ++info->defer;
2070 }
2071 }
2072
2073 #else /* !UNP_GC_ALLFILES */
2074
2075 /*
2076 * They are thread local and do not require explicit synchronization.
2077 */
2078 static int unp_marked;
2079 static int unp_unreachable;
2080
2081 static void
unp_accessable(struct file * fp,void * data __unused)2082 unp_accessable(struct file *fp, void *data __unused)
2083 {
2084 struct unpcb *unp;
2085
2086 if ((unp = unp_fp2unpcb(fp)) == NULL)
2087 return;
2088 if (unp->unp_gcflags & UNPGC_REF)
2089 return;
2090 unp->unp_gcflags &= ~UNPGC_DEAD;
2091 unp->unp_gcflags |= UNPGC_REF;
2092 unp_marked++;
2093 }
2094
2095 static void
unp_gc_process(struct unpcb * unp)2096 unp_gc_process(struct unpcb *unp)
2097 {
2098 struct file *fp;
2099
2100 /* Already processed. */
2101 if (unp->unp_gcflags & UNPGC_SCANNED)
2102 return;
2103 fp = unp->unp_fp;
2104
2105 /*
2106 * Check for a socket potentially in a cycle. It must be in a
2107 * queue as indicated by msgcount, and this must equal the file
2108 * reference count. Note that when msgcount is 0 the file is NULL.
2109 */
2110 if ((unp->unp_gcflags & UNPGC_REF) == 0 && fp &&
2111 unp->unp_msgcount != 0 && fp->f_count == unp->unp_msgcount) {
2112 unp->unp_gcflags |= UNPGC_DEAD;
2113 unp_unreachable++;
2114 return;
2115 }
2116
2117 /*
2118 * Mark all sockets we reference with RIGHTS.
2119 */
2120 if (UNP_ISATTACHED(unp)) {
2121 struct signalsockbuf *ssb = &unp->unp_socket->so_rcv;
2122
2123 unp_reference(unp);
2124 lwkt_gettoken(&ssb->ssb_token);
2125 /*
2126 * unp_token would be temporarily dropped, if getting
2127 * so_rcv token blocks, so we need to check unp state
2128 * here again.
2129 */
2130 if (UNP_ISATTACHED(unp))
2131 unp_scan(ssb->ssb_mb, unp_accessable, NULL);
2132 lwkt_reltoken(&ssb->ssb_token);
2133 unp->unp_gcflags |= UNPGC_SCANNED;
2134 unp_free(unp);
2135 } else {
2136 unp->unp_gcflags |= UNPGC_SCANNED;
2137 }
2138 }
2139
2140 static void
unp_gc(void * arg __unused,int pending __unused)2141 unp_gc(void *arg __unused, int pending __unused)
2142 {
2143 struct unp_global_head *head;
2144 int h, filemax, fileidx, filetot;
2145 struct file **unref;
2146 struct unpcb *unp;
2147
2148 lwkt_gettoken(&unp_rights_token);
2149 lwkt_gettoken(&unp_token);
2150
2151 /*
2152 * First clear all gc flags from previous runs.
2153 */
2154 for (h = 0; unp_heads[h] != NULL; ++h) {
2155 /*
2156 * NOTE: This loop does not block, so it is safe
2157 * to use TAILQ_FOREACH here.
2158 */
2159 head = unp_heads[h];
2160 TAILQ_FOREACH(unp, &head->list, unp_link)
2161 unp->unp_gcflags = 0;
2162 }
2163
2164 /*
2165 * Scan marking all reachable sockets with UNPGC_REF. Once a socket
2166 * is reachable all of the sockets it references are reachable.
2167 * Stop the scan once we do a complete loop without discovering
2168 * a new reachable socket.
2169 */
2170 do {
2171 unp_unreachable = 0;
2172 unp_marked = 0;
2173 for (h = 0; unp_heads[h] != NULL; ++h) {
2174 head = unp_heads[h];
2175 TAILQ_INSERT_HEAD(&head->list, unp_gc_marker, unp_link);
2176 while ((unp = TAILQ_NEXT(unp_gc_marker, unp_link))
2177 != NULL) {
2178 TAILQ_REMOVE(&head->list, unp_gc_marker,
2179 unp_link);
2180 TAILQ_INSERT_AFTER(&head->list, unp,
2181 unp_gc_marker, unp_link);
2182
2183 if (unp->unp_flags & UNP_MARKER)
2184 continue;
2185 unp_gc_process(unp);
2186 }
2187 TAILQ_REMOVE(&head->list, unp_gc_marker, unp_link);
2188 }
2189 } while (unp_marked);
2190
2191 if (unp_unreachable == 0)
2192 goto done;
2193
2194 /*
2195 * We grab an extra reference to each of the file table entries
2196 * that are not otherwise accessible and then free the rights
2197 * that are stored in messages on them.
2198 *
2199 * The bug in the orginal code is a little tricky, so I'll describe
2200 * what's wrong with it here.
2201 *
2202 * It is incorrect to simply unp_discard each entry for f_msgcount
2203 * times -- consider the case of sockets A and B that contain
2204 * references to each other. On a last close of some other socket,
2205 * we trigger a gc since the number of outstanding rights (unp_rights)
2206 * is non-zero. If during the sweep phase the gc code unp_discards,
2207 * we end up doing a (full) fdrop on the descriptor. A fdrop on A
2208 * results in the following chain. Closef calls soo_close, which
2209 * calls soclose. Soclose calls first (through the switch
2210 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
2211 * returns because the previous instance had set unp_gcing, and
2212 * we return all the way back to soclose, which marks the socket
2213 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
2214 * to free up the rights that are queued in messages on the socket A,
2215 * i.e., the reference on B. The sorflush calls via the dom_dispose
2216 * switch unp_dispose, which unp_scans with unp_discard. This second
2217 * instance of unp_discard just calls fdrop on B.
2218 *
2219 * Well, a similar chain occurs on B, resulting in a sorflush on B,
2220 * which results in another fdrop on A. Unfortunately, A is already
2221 * being closed, and the descriptor has already been marked with
2222 * SS_NOFDREF, and soclose panics at this point.
2223 *
2224 * Here, we first take an extra reference to each inaccessible
2225 * descriptor. Then, we call sorflush ourself, since we know
2226 * it is a Unix domain socket anyhow. After we destroy all the
2227 * rights carried in messages, we do a last fdrop to get rid
2228 * of our extra reference. This is the last close, and the
2229 * unp_detach etc will shut down the socket.
2230 *
2231 * 91/09/19, bsy@cs.cmu.edu
2232 */
2233
2234 filemax = unp_unreachable;
2235 if (filemax > UNP_GCFILE_MAX)
2236 filemax = UNP_GCFILE_MAX;
2237 unref = kmalloc(filemax * sizeof(struct file *), M_TEMP, M_WAITOK);
2238
2239 filetot = 0;
2240 do {
2241 int i;
2242
2243 /*
2244 * Iterate looking for sockets which have been specifically
2245 * marked as as unreachable and store them locally.
2246 */
2247 fileidx = 0;
2248 for (h = 0; unp_heads[h] != NULL; ++h) {
2249 /*
2250 * NOTE: This loop does not block, so it is safe
2251 * to use TAILQ_FOREACH here.
2252 */
2253 head = unp_heads[h];
2254 TAILQ_FOREACH(unp, &head->list, unp_link) {
2255 struct file *fp;
2256
2257 if ((unp->unp_gcflags & UNPGC_DEAD) == 0)
2258 continue;
2259 unp->unp_gcflags &= ~UNPGC_DEAD;
2260
2261 fp = unp->unp_fp;
2262 if (unp->unp_msgcount == 0 || fp == NULL ||
2263 fp->f_count != unp->unp_msgcount)
2264 continue;
2265 fhold(fp);
2266
2267 KASSERT(fileidx < filemax,
2268 ("invalid fileidx %d, filemax %d",
2269 fileidx, filemax));
2270 unref[fileidx++] = fp;
2271
2272 KASSERT(filetot < unp_unreachable,
2273 ("invalid filetot %d and "
2274 "unp_unreachable %d",
2275 filetot, unp_unreachable));
2276 ++filetot;
2277
2278 if (fileidx == filemax ||
2279 filetot == unp_unreachable)
2280 goto dogc;
2281 }
2282 }
2283 dogc:
2284 /*
2285 * For each Unix domain socket on our hit list, do the
2286 * following two things.
2287 */
2288 for (i = 0; i < fileidx; ++i)
2289 sorflush(unref[i]->f_data);
2290 for (i = 0; i < fileidx; ++i)
2291 fdrop(unref[i]);
2292 } while (fileidx == filemax && filetot < unp_unreachable);
2293 kfree(unref, M_TEMP);
2294 done:
2295 lwkt_reltoken(&unp_token);
2296 lwkt_reltoken(&unp_rights_token);
2297 }
2298
2299 #endif /* UNP_GC_ALLFILES */
2300
2301 /*
2302 * Dispose of the fp's stored in a mbuf.
2303 *
2304 * The dds loop can cause additional fps to be entered onto the
2305 * list while it is running, flattening out the operation and avoiding
2306 * a deep kernel stack recursion.
2307 */
2308 void
unp_dispose(struct mbuf * m)2309 unp_dispose(struct mbuf *m)
2310 {
2311 lwkt_gettoken(&unp_rights_token);
2312 if (m)
2313 unp_scan(m, unp_discard, NULL);
2314 lwkt_reltoken(&unp_rights_token);
2315 }
2316
2317 static int
unp_listen(struct unpcb * unp,struct thread * td)2318 unp_listen(struct unpcb *unp, struct thread *td)
2319 {
2320 struct proc *p = td->td_proc;
2321
2322 ASSERT_LWKT_TOKEN_HELD(&unp_token);
2323 UNP_ASSERT_TOKEN_HELD(unp);
2324
2325 KKASSERT(p);
2326 cru2x(p->p_ucred, &unp->unp_peercred);
2327 unp_setflags(unp, UNP_HAVEPCCACHED);
2328 return (0);
2329 }
2330
2331 static void
unp_scan(struct mbuf * m0,void (* op)(struct file *,void *),void * data)2332 unp_scan(struct mbuf *m0, void (*op)(struct file *, void *), void *data)
2333 {
2334 struct mbuf *m;
2335 struct file **rp;
2336 struct cmsghdr *cm;
2337 int i;
2338 int qfds;
2339
2340 while (m0) {
2341 for (m = m0; m; m = m->m_next) {
2342 if (m->m_type == MT_CONTROL &&
2343 m->m_len >= sizeof(*cm)) {
2344 cm = mtod(m, struct cmsghdr *);
2345 if (cm->cmsg_level != SOL_SOCKET ||
2346 cm->cmsg_type != SCM_RIGHTS)
2347 continue;
2348 qfds = (cm->cmsg_len - CMSG_LEN(0)) /
2349 sizeof(void *);
2350 rp = (struct file **)CMSG_DATA(cm);
2351 for (i = 0; i < qfds; i++)
2352 (*op)(*rp++, data);
2353 break; /* XXX, but saves time */
2354 }
2355 }
2356 m0 = m0->m_nextpkt;
2357 }
2358 }
2359
2360 /*
2361 * Discard a fp previously held in a unix domain socket mbuf. To
2362 * avoid blowing out the kernel stack due to contrived chain-reactions
2363 * we may have to defer the operation to a dedicated taskqueue.
2364 *
2365 * Caller holds unp_rights_token.
2366 */
2367 static void
unp_discard(struct file * fp,void * data __unused)2368 unp_discard(struct file *fp, void *data __unused)
2369 {
2370 unp_del_right(fp);
2371 if (unp_fp2unpcb(fp) != NULL) {
2372 struct unp_defdiscard *d;
2373
2374 /*
2375 * This fp is a Unix domain socket itself and fdrop()
2376 * it here directly may cause deep unp_discard()
2377 * recursion, so the fdrop() is defered to the
2378 * dedicated taskqueue.
2379 */
2380 d = kmalloc(sizeof(*d), M_UNPCB, M_WAITOK);
2381 d->fp = fp;
2382
2383 spin_lock(&unp_defdiscard_spin);
2384 SLIST_INSERT_HEAD(&unp_defdiscard_head, d, next);
2385 spin_unlock(&unp_defdiscard_spin);
2386
2387 taskqueue_enqueue(unp_taskqueue, &unp_defdiscard_task);
2388 } else {
2389 /* This fp is not a Unix domain socket */
2390 fdrop(fp);
2391 }
2392 }
2393
2394 /*
2395 * NOTE:
2396 * unp_token must be held before calling this function to avoid name
2397 * resolution and v_socket accessing races, especially racing against
2398 * the unp_detach().
2399 *
2400 * NOTE:
2401 * For anyone caring about unconnected Unix domain socket sending
2402 * performance, other approach could be taken...
2403 */
2404 static int
unp_find_lockref(struct sockaddr * nam,struct thread * td,short type,struct unpcb ** unp_ret)2405 unp_find_lockref(struct sockaddr *nam, struct thread *td, short type,
2406 struct unpcb **unp_ret)
2407 {
2408 struct proc *p = td->td_proc;
2409 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
2410 struct vnode *vp = NULL;
2411 struct socket *so;
2412 struct unpcb *unp;
2413 int error, len;
2414 struct nlookupdata nd;
2415 char buf[SOCK_MAXADDRLEN];
2416
2417 ASSERT_LWKT_TOKEN_HELD(&unp_token);
2418
2419 *unp_ret = NULL;
2420
2421 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
2422 if (len <= 0) {
2423 error = EINVAL;
2424 goto failed;
2425 }
2426 strncpy(buf, soun->sun_path, len);
2427 buf[len] = 0;
2428
2429 error = nlookup_init(&nd, buf, UIO_SYSSPACE, NLC_FOLLOW);
2430 if (error == 0)
2431 error = nlookup(&nd);
2432 if (error == 0)
2433 error = cache_vget(&nd.nl_nch, nd.nl_cred, LK_EXCLUSIVE, &vp);
2434 nlookup_done(&nd);
2435 if (error) {
2436 vp = NULL;
2437 goto failed;
2438 }
2439
2440 if (vp->v_type != VSOCK) {
2441 error = ENOTSOCK;
2442 goto failed;
2443 }
2444 error = VOP_EACCESS(vp, VWRITE, p->p_ucred);
2445 if (error)
2446 goto failed;
2447 so = vp->v_socket;
2448 if (so == NULL) {
2449 error = ECONNREFUSED;
2450 goto failed;
2451 }
2452 if (so->so_type != type) {
2453 error = EPROTOTYPE;
2454 goto failed;
2455 }
2456
2457 /* Lock this unp. */
2458 unp = unp_getsocktoken(so);
2459 if (!UNP_ISATTACHED(unp)) {
2460 unp_reltoken(unp);
2461 error = ECONNREFUSED;
2462 goto failed;
2463 }
2464 /* And keep this unp referenced. */
2465 unp_reference(unp);
2466
2467 /* Done! */
2468 *unp_ret = unp;
2469 error = 0;
2470 failed:
2471 if (vp != NULL)
2472 vput(vp);
2473 return error;
2474 }
2475
2476 static int
unp_connect_pair(struct unpcb * unp,struct unpcb * unp2)2477 unp_connect_pair(struct unpcb *unp, struct unpcb *unp2)
2478 {
2479 struct socket *so = unp->unp_socket;
2480 struct socket *so2 = unp2->unp_socket;
2481
2482 ASSERT_LWKT_TOKEN_HELD(&unp_token);
2483 UNP_ASSERT_TOKEN_HELD(unp);
2484 UNP_ASSERT_TOKEN_HELD(unp2);
2485
2486 KASSERT(so->so_type == so2->so_type,
2487 ("socket type mismatch, so %d, so2 %d", so->so_type, so2->so_type));
2488
2489 if (!UNP_ISATTACHED(unp))
2490 return EINVAL;
2491 if (!UNP_ISATTACHED(unp2))
2492 return ECONNREFUSED;
2493
2494 KASSERT(unp->unp_conn == NULL, ("unp is already connected"));
2495 unp->unp_conn = unp2;
2496
2497 switch (so->so_type) {
2498 case SOCK_DGRAM:
2499 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
2500 soisconnected(so);
2501 break;
2502
2503 case SOCK_STREAM:
2504 case SOCK_SEQPACKET:
2505 KASSERT(unp2->unp_conn == NULL, ("unp2 is already connected"));
2506 unp2->unp_conn = unp;
2507 soisconnected(so);
2508 soisconnected(so2);
2509 break;
2510
2511 default:
2512 panic("unp_connect_pair: unknown socket type %d", so->so_type);
2513 }
2514 return 0;
2515 }
2516
2517 static void
unp_drop(struct unpcb * unp,int error)2518 unp_drop(struct unpcb *unp, int error)
2519 {
2520 struct unp_global_head *head;
2521 struct unpcb *unp2;
2522
2523 ASSERT_LWKT_TOKEN_HELD(&unp_token);
2524 UNP_ASSERT_TOKEN_HELD(unp);
2525
2526 KASSERT((unp->unp_flags & (UNP_DETACHED | UNP_DROPPED)) == 0,
2527 ("unp is dropped"));
2528
2529 /* Mark this unp as detached. */
2530 unp_setflags(unp, UNP_DETACHED);
2531
2532 /* Remove this unp from the global unp list. */
2533 head = unp_globalhead(unp->unp_socket->so_type);
2534 KASSERT(head->count > 0, ("invalid unp count"));
2535 TAILQ_REMOVE(&head->list, unp, unp_link);
2536 head->count--;
2537
2538 /* Disconnect all. */
2539 unp_disconnect(unp, error);
2540 while ((unp2 = LIST_FIRST(&unp->unp_refs)) != NULL) {
2541 lwkt_getpooltoken(unp2);
2542 unp_disconnect(unp2, ECONNRESET);
2543 lwkt_relpooltoken(unp2);
2544 }
2545 unp_setflags(unp, UNP_DROPPED);
2546
2547 /* Try freeing this unp. */
2548 unp_free(unp);
2549 }
2550
2551 static void
unp_defdiscard_taskfunc(void * arg __unused,int pending __unused)2552 unp_defdiscard_taskfunc(void *arg __unused, int pending __unused)
2553 {
2554 struct unp_defdiscard *d;
2555
2556 spin_lock(&unp_defdiscard_spin);
2557 while ((d = SLIST_FIRST(&unp_defdiscard_head)) != NULL) {
2558 SLIST_REMOVE_HEAD(&unp_defdiscard_head, next);
2559 spin_unlock(&unp_defdiscard_spin);
2560
2561 fdrop(d->fp);
2562 kfree(d, M_UNPCB);
2563
2564 spin_lock(&unp_defdiscard_spin);
2565 }
2566 spin_unlock(&unp_defdiscard_spin);
2567 }
2568