1 /* 2 * Copyright (c) 1982, 1986, 1989, 1991, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 34 * $FreeBSD: src/sys/kern/uipc_usrreq.c,v 1.54.2.10 2003/03/04 17:28:09 nectar Exp $ 35 */ 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/kernel.h> 40 #include <sys/domain.h> 41 #include <sys/fcntl.h> 42 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */ 43 #include <sys/proc.h> 44 #include <sys/file.h> 45 #include <sys/filedesc.h> 46 #include <sys/mbuf.h> 47 #include <sys/nlookup.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/resourcevar.h> 52 #include <sys/stat.h> 53 #include <sys/mount.h> 54 #include <sys/sysctl.h> 55 #include <sys/un.h> 56 #include <sys/unpcb.h> 57 #include <sys/vnode.h> 58 59 #include <sys/file2.h> 60 #include <sys/spinlock2.h> 61 #include <sys/socketvar2.h> 62 #include <sys/msgport2.h> 63 64 typedef struct unp_defdiscard { 65 struct unp_defdiscard *next; 66 struct file *fp; 67 } *unp_defdiscard_t; 68 69 static MALLOC_DEFINE(M_UNPCB, "unpcb", "unpcb struct"); 70 static unp_gen_t unp_gencnt; 71 static u_int unp_count; 72 73 static struct unp_head unp_shead, unp_dhead; 74 75 static struct lwkt_token unp_token = LWKT_TOKEN_INITIALIZER(unp_token); 76 static int unp_defdiscard_nest; 77 static unp_defdiscard_t unp_defdiscard_base; 78 79 /* 80 * Unix communications domain. 81 * 82 * TODO: 83 * RDM 84 * rethink name space problems 85 * need a proper out-of-band 86 * lock pushdown 87 */ 88 static struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL }; 89 static ino_t unp_ino = 1; /* prototype for fake inode numbers */ 90 static struct spinlock unp_ino_spin = SPINLOCK_INITIALIZER(&unp_ino_spin); 91 92 static int unp_attach (struct socket *, struct pru_attach_info *); 93 static void unp_detach (struct unpcb *); 94 static int unp_bind (struct unpcb *,struct sockaddr *, struct thread *); 95 static int unp_connect (struct socket *,struct sockaddr *, 96 struct thread *); 97 static void unp_disconnect (struct unpcb *); 98 static void unp_shutdown (struct unpcb *); 99 static void unp_drop (struct unpcb *, int); 100 static void unp_gc (void); 101 static int unp_gc_clearmarks(struct file *, void *); 102 static int unp_gc_checkmarks(struct file *, void *); 103 static int unp_gc_checkrefs(struct file *, void *); 104 static int unp_revoke_gc_check(struct file *, void *); 105 static void unp_scan (struct mbuf *, void (*)(struct file *, void *), 106 void *data); 107 static void unp_mark (struct file *, void *data); 108 static void unp_discard (struct file *, void *); 109 static int unp_internalize (struct mbuf *, struct thread *); 110 static int unp_listen (struct unpcb *, struct thread *); 111 static void unp_fp_externalize(struct lwp *lp, struct file *fp, int fd); 112 113 /* 114 * SMP Considerations: 115 * 116 * Since unp_token will be automaticly released upon execution of 117 * blocking code, we need to reference unp_conn before any possible 118 * blocking code to prevent it from being ripped behind our back. 119 * 120 * Any adjustment to unp->unp_conn requires both the global unp_token 121 * AND the per-unp token (lwkt_token_pool_lookup(unp)) to be held. 122 * 123 * Any access to so_pcb to obtain unp requires the pool token for 124 * unp to be held. 125 */ 126 127 /* NOTE: unp_token MUST be held */ 128 static __inline void 129 unp_reference(struct unpcb *unp) 130 { 131 atomic_add_int(&unp->unp_refcnt, 1); 132 } 133 134 /* NOTE: unp_token MUST be held */ 135 static __inline void 136 unp_free(struct unpcb *unp) 137 { 138 KKASSERT(unp->unp_refcnt > 0); 139 if (atomic_fetchadd_int(&unp->unp_refcnt, -1) == 1) 140 unp_detach(unp); 141 } 142 143 /* 144 * NOTE: (so) is referenced from soabort*() and netmsg_pru_abort() 145 * will sofree() it when we return. 146 */ 147 static void 148 uipc_abort(netmsg_t msg) 149 { 150 struct unpcb *unp; 151 int error; 152 153 lwkt_gettoken(&unp_token); 154 unp = msg->base.nm_so->so_pcb; 155 if (unp) { 156 unp_drop(unp, ECONNABORTED); 157 unp_free(unp); 158 error = 0; 159 } else { 160 error = EINVAL; 161 } 162 lwkt_reltoken(&unp_token); 163 164 lwkt_replymsg(&msg->lmsg, error); 165 } 166 167 static void 168 uipc_accept(netmsg_t msg) 169 { 170 struct unpcb *unp; 171 int error; 172 173 lwkt_gettoken(&unp_token); 174 unp = msg->base.nm_so->so_pcb; 175 if (unp == NULL) { 176 error = EINVAL; 177 } else { 178 struct unpcb *unp2 = unp->unp_conn; 179 180 /* 181 * Pass back name of connected socket, 182 * if it was bound and we are still connected 183 * (our peer may have closed already!). 184 */ 185 if (unp2 && unp2->unp_addr) { 186 unp_reference(unp2); 187 *msg->accept.nm_nam = dup_sockaddr( 188 (struct sockaddr *)unp2->unp_addr); 189 unp_free(unp2); 190 } else { 191 *msg->accept.nm_nam = dup_sockaddr(&sun_noname); 192 } 193 error = 0; 194 } 195 lwkt_reltoken(&unp_token); 196 lwkt_replymsg(&msg->lmsg, error); 197 } 198 199 static void 200 uipc_attach(netmsg_t msg) 201 { 202 struct unpcb *unp; 203 int error; 204 205 lwkt_gettoken(&unp_token); 206 unp = msg->base.nm_so->so_pcb; 207 if (unp) 208 error = EISCONN; 209 else 210 error = unp_attach(msg->base.nm_so, msg->attach.nm_ai); 211 lwkt_reltoken(&unp_token); 212 lwkt_replymsg(&msg->lmsg, error); 213 } 214 215 static void 216 uipc_bind(netmsg_t msg) 217 { 218 struct unpcb *unp; 219 int error; 220 221 lwkt_gettoken(&unp_token); 222 unp = msg->base.nm_so->so_pcb; 223 if (unp) 224 error = unp_bind(unp, msg->bind.nm_nam, msg->bind.nm_td); 225 else 226 error = EINVAL; 227 lwkt_reltoken(&unp_token); 228 lwkt_replymsg(&msg->lmsg, error); 229 } 230 231 static void 232 uipc_connect(netmsg_t msg) 233 { 234 struct unpcb *unp; 235 int error; 236 237 unp = msg->base.nm_so->so_pcb; 238 if (unp) { 239 error = unp_connect(msg->base.nm_so, 240 msg->connect.nm_nam, 241 msg->connect.nm_td); 242 } else { 243 error = EINVAL; 244 } 245 lwkt_replymsg(&msg->lmsg, error); 246 } 247 248 static void 249 uipc_connect2(netmsg_t msg) 250 { 251 struct unpcb *unp; 252 int error; 253 254 unp = msg->connect2.nm_so1->so_pcb; 255 if (unp) { 256 error = unp_connect2(msg->connect2.nm_so1, 257 msg->connect2.nm_so2); 258 } else { 259 error = EINVAL; 260 } 261 lwkt_replymsg(&msg->lmsg, error); 262 } 263 264 /* control is EOPNOTSUPP */ 265 266 static void 267 uipc_detach(netmsg_t msg) 268 { 269 struct unpcb *unp; 270 int error; 271 272 lwkt_gettoken(&unp_token); 273 unp = msg->base.nm_so->so_pcb; 274 if (unp) { 275 unp_free(unp); 276 error = 0; 277 } else { 278 error = EINVAL; 279 } 280 lwkt_reltoken(&unp_token); 281 lwkt_replymsg(&msg->lmsg, error); 282 } 283 284 static void 285 uipc_disconnect(netmsg_t msg) 286 { 287 struct unpcb *unp; 288 int error; 289 290 lwkt_gettoken(&unp_token); 291 unp = msg->base.nm_so->so_pcb; 292 if (unp) { 293 unp_disconnect(unp); 294 error = 0; 295 } else { 296 error = EINVAL; 297 } 298 lwkt_reltoken(&unp_token); 299 lwkt_replymsg(&msg->lmsg, error); 300 } 301 302 static void 303 uipc_listen(netmsg_t msg) 304 { 305 struct unpcb *unp; 306 int error; 307 308 lwkt_gettoken(&unp_token); 309 unp = msg->base.nm_so->so_pcb; 310 if (unp == NULL || unp->unp_vnode == NULL) 311 error = EINVAL; 312 else 313 error = unp_listen(unp, msg->listen.nm_td); 314 lwkt_reltoken(&unp_token); 315 lwkt_replymsg(&msg->lmsg, error); 316 } 317 318 static void 319 uipc_peeraddr(netmsg_t msg) 320 { 321 struct unpcb *unp; 322 int error; 323 324 lwkt_gettoken(&unp_token); 325 unp = msg->base.nm_so->so_pcb; 326 if (unp == NULL) { 327 error = EINVAL; 328 } else if (unp->unp_conn && unp->unp_conn->unp_addr) { 329 struct unpcb *unp2 = unp->unp_conn; 330 331 unp_reference(unp2); 332 *msg->peeraddr.nm_nam = dup_sockaddr( 333 (struct sockaddr *)unp2->unp_addr); 334 unp_free(unp2); 335 error = 0; 336 } else { 337 /* 338 * XXX: It seems that this test always fails even when 339 * connection is established. So, this else clause is 340 * added as workaround to return PF_LOCAL sockaddr. 341 */ 342 *msg->peeraddr.nm_nam = dup_sockaddr(&sun_noname); 343 error = 0; 344 } 345 lwkt_reltoken(&unp_token); 346 lwkt_replymsg(&msg->lmsg, error); 347 } 348 349 static void 350 uipc_rcvd(netmsg_t msg) 351 { 352 struct unpcb *unp, *unp2; 353 struct socket *so; 354 struct socket *so2; 355 int error; 356 357 /* 358 * so_pcb is only modified with both the global and the unp 359 * pool token held. The unp pointer is invalid until we verify 360 * that it is good by re-checking so_pcb AFTER obtaining the token. 361 */ 362 so = msg->base.nm_so; 363 while ((unp = so->so_pcb) != NULL) { 364 lwkt_getpooltoken(unp); 365 if (unp == so->so_pcb) 366 break; 367 lwkt_relpooltoken(unp); 368 } 369 if (unp == NULL) { 370 error = EINVAL; 371 goto done; 372 } 373 /* pool token held */ 374 375 switch (so->so_type) { 376 case SOCK_DGRAM: 377 panic("uipc_rcvd DGRAM?"); 378 /*NOTREACHED*/ 379 case SOCK_STREAM: 380 case SOCK_SEQPACKET: 381 if (unp->unp_conn == NULL) 382 break; 383 unp2 = unp->unp_conn; /* protected by pool token */ 384 385 /* 386 * Because we are transfering mbufs directly to the 387 * peer socket we have to use SSB_STOP on the sender 388 * to prevent it from building up infinite mbufs. 389 * 390 * As in several places in this module w ehave to ref unp2 391 * to ensure that it does not get ripped out from under us 392 * if we block on the so2 token or in sowwakeup(). 393 */ 394 so2 = unp2->unp_socket; 395 unp_reference(unp2); 396 lwkt_gettoken(&so2->so_rcv.ssb_token); 397 if (so->so_rcv.ssb_cc < so2->so_snd.ssb_hiwat && 398 so->so_rcv.ssb_mbcnt < so2->so_snd.ssb_mbmax 399 ) { 400 atomic_clear_int(&so2->so_snd.ssb_flags, SSB_STOP); 401 402 sowwakeup(so2); 403 } 404 lwkt_reltoken(&so2->so_rcv.ssb_token); 405 unp_free(unp2); 406 break; 407 default: 408 panic("uipc_rcvd unknown socktype"); 409 /*NOTREACHED*/ 410 } 411 error = 0; 412 lwkt_relpooltoken(unp); 413 done: 414 lwkt_replymsg(&msg->lmsg, error); 415 } 416 417 /* pru_rcvoob is EOPNOTSUPP */ 418 419 static void 420 uipc_send(netmsg_t msg) 421 { 422 struct unpcb *unp, *unp2; 423 struct socket *so; 424 struct socket *so2; 425 struct mbuf *control; 426 struct mbuf *m; 427 int error = 0; 428 429 so = msg->base.nm_so; 430 control = msg->send.nm_control; 431 m = msg->send.nm_m; 432 433 /* 434 * so_pcb is only modified with both the global and the unp 435 * pool token held. The unp pointer is invalid until we verify 436 * that it is good by re-checking so_pcb AFTER obtaining the token. 437 */ 438 so = msg->base.nm_so; 439 while ((unp = so->so_pcb) != NULL) { 440 lwkt_getpooltoken(unp); 441 if (unp == so->so_pcb) 442 break; 443 lwkt_relpooltoken(unp); 444 } 445 if (unp == NULL) { 446 error = EINVAL; 447 goto done; 448 } 449 /* pool token held */ 450 451 if (msg->send.nm_flags & PRUS_OOB) { 452 error = EOPNOTSUPP; 453 goto release; 454 } 455 456 wakeup_start_delayed(); 457 458 if (control && (error = unp_internalize(control, msg->send.nm_td))) 459 goto release; 460 461 switch (so->so_type) { 462 case SOCK_DGRAM: 463 { 464 struct sockaddr *from; 465 466 if (msg->send.nm_addr) { 467 if (unp->unp_conn) { 468 error = EISCONN; 469 break; 470 } 471 error = unp_connect(so, 472 msg->send.nm_addr, 473 msg->send.nm_td); 474 if (error) 475 break; 476 } else { 477 if (unp->unp_conn == NULL) { 478 error = ENOTCONN; 479 break; 480 } 481 } 482 unp2 = unp->unp_conn; 483 so2 = unp2->unp_socket; 484 if (unp->unp_addr) 485 from = (struct sockaddr *)unp->unp_addr; 486 else 487 from = &sun_noname; 488 489 unp_reference(unp2); 490 491 lwkt_gettoken(&so2->so_rcv.ssb_token); 492 if (ssb_appendaddr(&so2->so_rcv, from, m, control)) { 493 sorwakeup(so2); 494 m = NULL; 495 control = NULL; 496 } else { 497 error = ENOBUFS; 498 } 499 if (msg->send.nm_addr) 500 unp_disconnect(unp); 501 lwkt_reltoken(&so2->so_rcv.ssb_token); 502 503 unp_free(unp2); 504 break; 505 } 506 507 case SOCK_STREAM: 508 case SOCK_SEQPACKET: 509 /* Connect if not connected yet. */ 510 /* 511 * Note: A better implementation would complain 512 * if not equal to the peer's address. 513 */ 514 if (!(so->so_state & SS_ISCONNECTED)) { 515 if (msg->send.nm_addr) { 516 error = unp_connect(so, 517 msg->send.nm_addr, 518 msg->send.nm_td); 519 if (error) 520 break; /* XXX */ 521 } else { 522 error = ENOTCONN; 523 break; 524 } 525 } 526 527 if (so->so_state & SS_CANTSENDMORE) { 528 error = EPIPE; 529 break; 530 } 531 if (unp->unp_conn == NULL) 532 panic("uipc_send connected but no connection?"); 533 unp2 = unp->unp_conn; 534 so2 = unp2->unp_socket; 535 536 unp_reference(unp2); 537 538 /* 539 * Send to paired receive port, and then reduce 540 * send buffer hiwater marks to maintain backpressure. 541 * Wake up readers. 542 */ 543 lwkt_gettoken(&so2->so_rcv.ssb_token); 544 if (control) { 545 if (ssb_appendcontrol(&so2->so_rcv, m, control)) { 546 control = NULL; 547 m = NULL; 548 } 549 } else if (so->so_type == SOCK_SEQPACKET) { 550 sbappendrecord(&so2->so_rcv.sb, m); 551 m = NULL; 552 } else { 553 sbappend(&so2->so_rcv.sb, m); 554 m = NULL; 555 } 556 557 /* 558 * Because we are transfering mbufs directly to the 559 * peer socket we have to use SSB_STOP on the sender 560 * to prevent it from building up infinite mbufs. 561 */ 562 if (so2->so_rcv.ssb_cc >= so->so_snd.ssb_hiwat || 563 so2->so_rcv.ssb_mbcnt >= so->so_snd.ssb_mbmax 564 ) { 565 atomic_set_int(&so->so_snd.ssb_flags, SSB_STOP); 566 } 567 lwkt_reltoken(&so2->so_rcv.ssb_token); 568 sorwakeup(so2); 569 570 unp_free(unp2); 571 break; 572 573 default: 574 panic("uipc_send unknown socktype"); 575 } 576 577 /* 578 * SEND_EOF is equivalent to a SEND followed by a SHUTDOWN. 579 */ 580 if (msg->send.nm_flags & PRUS_EOF) { 581 socantsendmore(so); 582 unp_shutdown(unp); 583 } 584 585 if (control && error != 0) 586 unp_dispose(control); 587 release: 588 lwkt_relpooltoken(unp); 589 wakeup_end_delayed(); 590 done: 591 592 if (control) 593 m_freem(control); 594 if (m) 595 m_freem(m); 596 lwkt_replymsg(&msg->lmsg, error); 597 } 598 599 /* 600 * MPSAFE 601 */ 602 static void 603 uipc_sense(netmsg_t msg) 604 { 605 struct unpcb *unp; 606 struct socket *so; 607 struct stat *sb; 608 int error; 609 610 so = msg->base.nm_so; 611 sb = msg->sense.nm_stat; 612 613 /* 614 * so_pcb is only modified with both the global and the unp 615 * pool token held. The unp pointer is invalid until we verify 616 * that it is good by re-checking so_pcb AFTER obtaining the token. 617 */ 618 while ((unp = so->so_pcb) != NULL) { 619 lwkt_getpooltoken(unp); 620 if (unp == so->so_pcb) 621 break; 622 lwkt_relpooltoken(unp); 623 } 624 if (unp == NULL) { 625 error = EINVAL; 626 goto done; 627 } 628 /* pool token held */ 629 630 sb->st_blksize = so->so_snd.ssb_hiwat; 631 sb->st_dev = NOUDEV; 632 if (unp->unp_ino == 0) { /* make up a non-zero inode number */ 633 spin_lock(&unp_ino_spin); 634 unp->unp_ino = unp_ino++; 635 spin_unlock(&unp_ino_spin); 636 } 637 sb->st_ino = unp->unp_ino; 638 error = 0; 639 lwkt_relpooltoken(unp); 640 done: 641 lwkt_replymsg(&msg->lmsg, error); 642 } 643 644 static void 645 uipc_shutdown(netmsg_t msg) 646 { 647 struct socket *so; 648 struct unpcb *unp; 649 int error; 650 651 /* 652 * so_pcb is only modified with both the global and the unp 653 * pool token held. The unp pointer is invalid until we verify 654 * that it is good by re-checking so_pcb AFTER obtaining the token. 655 */ 656 so = msg->base.nm_so; 657 while ((unp = so->so_pcb) != NULL) { 658 lwkt_getpooltoken(unp); 659 if (unp == so->so_pcb) 660 break; 661 lwkt_relpooltoken(unp); 662 } 663 if (unp) { 664 /* pool token held */ 665 socantsendmore(so); 666 unp_shutdown(unp); 667 lwkt_relpooltoken(unp); 668 error = 0; 669 } else { 670 error = EINVAL; 671 } 672 lwkt_replymsg(&msg->lmsg, error); 673 } 674 675 static void 676 uipc_sockaddr(netmsg_t msg) 677 { 678 struct socket *so; 679 struct unpcb *unp; 680 int error; 681 682 /* 683 * so_pcb is only modified with both the global and the unp 684 * pool token held. The unp pointer is invalid until we verify 685 * that it is good by re-checking so_pcb AFTER obtaining the token. 686 */ 687 so = msg->base.nm_so; 688 while ((unp = so->so_pcb) != NULL) { 689 lwkt_getpooltoken(unp); 690 if (unp == so->so_pcb) 691 break; 692 lwkt_relpooltoken(unp); 693 } 694 if (unp) { 695 /* pool token held */ 696 if (unp->unp_addr) { 697 *msg->sockaddr.nm_nam = 698 dup_sockaddr((struct sockaddr *)unp->unp_addr); 699 } 700 lwkt_relpooltoken(unp); 701 error = 0; 702 } else { 703 error = EINVAL; 704 } 705 lwkt_replymsg(&msg->lmsg, error); 706 } 707 708 struct pr_usrreqs uipc_usrreqs = { 709 .pru_abort = uipc_abort, 710 .pru_accept = uipc_accept, 711 .pru_attach = uipc_attach, 712 .pru_bind = uipc_bind, 713 .pru_connect = uipc_connect, 714 .pru_connect2 = uipc_connect2, 715 .pru_control = pr_generic_notsupp, 716 .pru_detach = uipc_detach, 717 .pru_disconnect = uipc_disconnect, 718 .pru_listen = uipc_listen, 719 .pru_peeraddr = uipc_peeraddr, 720 .pru_rcvd = uipc_rcvd, 721 .pru_rcvoob = pr_generic_notsupp, 722 .pru_send = uipc_send, 723 .pru_sense = uipc_sense, 724 .pru_shutdown = uipc_shutdown, 725 .pru_sockaddr = uipc_sockaddr, 726 .pru_sosend = sosend, 727 .pru_soreceive = soreceive 728 }; 729 730 void 731 uipc_ctloutput(netmsg_t msg) 732 { 733 struct socket *so; 734 struct sockopt *sopt; 735 struct unpcb *unp; 736 int error = 0; 737 738 lwkt_gettoken(&unp_token); 739 so = msg->base.nm_so; 740 sopt = msg->ctloutput.nm_sopt; 741 unp = so->so_pcb; 742 743 switch (sopt->sopt_dir) { 744 case SOPT_GET: 745 switch (sopt->sopt_name) { 746 case LOCAL_PEERCRED: 747 if (unp->unp_flags & UNP_HAVEPC) 748 soopt_from_kbuf(sopt, &unp->unp_peercred, 749 sizeof(unp->unp_peercred)); 750 else { 751 if (so->so_type == SOCK_STREAM) 752 error = ENOTCONN; 753 else if (so->so_type == SOCK_SEQPACKET) 754 error = ENOTCONN; 755 else 756 error = EINVAL; 757 } 758 break; 759 default: 760 error = EOPNOTSUPP; 761 break; 762 } 763 break; 764 case SOPT_SET: 765 default: 766 error = EOPNOTSUPP; 767 break; 768 } 769 lwkt_reltoken(&unp_token); 770 lwkt_replymsg(&msg->lmsg, error); 771 } 772 773 /* 774 * Both send and receive buffers are allocated PIPSIZ bytes of buffering 775 * for stream sockets, although the total for sender and receiver is 776 * actually only PIPSIZ. 777 * 778 * Datagram sockets really use the sendspace as the maximum datagram size, 779 * and don't really want to reserve the sendspace. Their recvspace should 780 * be large enough for at least one max-size datagram plus address. 781 * 782 * We want the local send/recv space to be significant larger then lo0's 783 * mtu of 16384. 784 */ 785 #ifndef PIPSIZ 786 #define PIPSIZ 57344 787 #endif 788 static u_long unpst_sendspace = PIPSIZ; 789 static u_long unpst_recvspace = PIPSIZ; 790 static u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 791 static u_long unpdg_recvspace = 4*1024; 792 793 static int unp_rights; /* file descriptors in flight */ 794 static struct spinlock unp_spin = SPINLOCK_INITIALIZER(&unp_spin); 795 796 SYSCTL_DECL(_net_local_seqpacket); 797 SYSCTL_DECL(_net_local_stream); 798 SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW, 799 &unpst_sendspace, 0, "Size of stream socket send buffer"); 800 SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW, 801 &unpst_recvspace, 0, "Size of stream socket receive buffer"); 802 803 SYSCTL_DECL(_net_local_dgram); 804 SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW, 805 &unpdg_sendspace, 0, "Max datagram socket size"); 806 SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW, 807 &unpdg_recvspace, 0, "Size of datagram socket receive buffer"); 808 809 SYSCTL_DECL(_net_local); 810 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, 811 "File descriptors in flight"); 812 813 static int 814 unp_attach(struct socket *so, struct pru_attach_info *ai) 815 { 816 struct unpcb *unp; 817 int error; 818 819 lwkt_gettoken(&unp_token); 820 821 if (so->so_snd.ssb_hiwat == 0 || so->so_rcv.ssb_hiwat == 0) { 822 switch (so->so_type) { 823 824 case SOCK_STREAM: 825 case SOCK_SEQPACKET: 826 error = soreserve(so, unpst_sendspace, unpst_recvspace, 827 ai->sb_rlimit); 828 break; 829 830 case SOCK_DGRAM: 831 error = soreserve(so, unpdg_sendspace, unpdg_recvspace, 832 ai->sb_rlimit); 833 break; 834 835 default: 836 panic("unp_attach"); 837 } 838 if (error) 839 goto failed; 840 } 841 unp = kmalloc(sizeof(*unp), M_UNPCB, M_WAITOK | M_ZERO | M_NULLOK); 842 if (unp == NULL) { 843 error = ENOBUFS; 844 goto failed; 845 } 846 unp->unp_refcnt = 1; 847 unp->unp_gencnt = ++unp_gencnt; 848 unp_count++; 849 LIST_INIT(&unp->unp_refs); 850 unp->unp_socket = so; 851 unp->unp_rvnode = ai->fd_rdir; /* jail cruft XXX JH */ 852 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ? &unp_dhead 853 : &unp_shead, unp, unp_link); 854 so->so_pcb = (caddr_t)unp; 855 soreference(so); 856 error = 0; 857 failed: 858 lwkt_reltoken(&unp_token); 859 return error; 860 } 861 862 static void 863 unp_detach(struct unpcb *unp) 864 { 865 struct socket *so; 866 867 lwkt_gettoken(&unp_token); 868 lwkt_getpooltoken(unp); 869 870 LIST_REMOVE(unp, unp_link); /* both tokens required */ 871 unp->unp_gencnt = ++unp_gencnt; 872 --unp_count; 873 if (unp->unp_vnode) { 874 unp->unp_vnode->v_socket = NULL; 875 vrele(unp->unp_vnode); 876 unp->unp_vnode = NULL; 877 } 878 if (unp->unp_conn) 879 unp_disconnect(unp); 880 while (!LIST_EMPTY(&unp->unp_refs)) 881 unp_drop(LIST_FIRST(&unp->unp_refs), ECONNRESET); 882 soisdisconnected(unp->unp_socket); 883 so = unp->unp_socket; 884 soreference(so); /* for delayed sorflush */ 885 KKASSERT(so->so_pcb == unp); 886 so->so_pcb = NULL; /* both tokens required */ 887 unp->unp_socket = NULL; 888 sofree(so); /* remove pcb ref */ 889 890 if (unp_rights) { 891 /* 892 * Normally the receive buffer is flushed later, 893 * in sofree, but if our receive buffer holds references 894 * to descriptors that are now garbage, we will dispose 895 * of those descriptor references after the garbage collector 896 * gets them (resulting in a "panic: closef: count < 0"). 897 */ 898 sorflush(so); 899 unp_gc(); 900 } 901 sofree(so); 902 lwkt_relpooltoken(unp); 903 lwkt_reltoken(&unp_token); 904 905 if (unp->unp_addr) 906 kfree(unp->unp_addr, M_SONAME); 907 kfree(unp, M_UNPCB); 908 } 909 910 static int 911 unp_bind(struct unpcb *unp, struct sockaddr *nam, struct thread *td) 912 { 913 struct proc *p = td->td_proc; 914 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 915 struct vnode *vp; 916 struct vattr vattr; 917 int error, namelen; 918 struct nlookupdata nd; 919 char buf[SOCK_MAXADDRLEN]; 920 921 lwkt_gettoken(&unp_token); 922 if (unp->unp_vnode != NULL) { 923 error = EINVAL; 924 goto failed; 925 } 926 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 927 if (namelen <= 0) { 928 error = EINVAL; 929 goto failed; 930 } 931 strncpy(buf, soun->sun_path, namelen); 932 buf[namelen] = 0; /* null-terminate the string */ 933 error = nlookup_init(&nd, buf, UIO_SYSSPACE, 934 NLC_LOCKVP | NLC_CREATE | NLC_REFDVP); 935 if (error == 0) 936 error = nlookup(&nd); 937 if (error == 0 && nd.nl_nch.ncp->nc_vp != NULL) 938 error = EADDRINUSE; 939 if (error) 940 goto done; 941 942 VATTR_NULL(&vattr); 943 vattr.va_type = VSOCK; 944 vattr.va_mode = (ACCESSPERMS & ~p->p_fd->fd_cmask); 945 error = VOP_NCREATE(&nd.nl_nch, nd.nl_dvp, &vp, nd.nl_cred, &vattr); 946 if (error == 0) { 947 if (unp->unp_vnode == NULL) { 948 vp->v_socket = unp->unp_socket; 949 unp->unp_vnode = vp; 950 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam); 951 vn_unlock(vp); 952 } else { 953 vput(vp); /* late race */ 954 error = EINVAL; 955 } 956 } 957 done: 958 nlookup_done(&nd); 959 failed: 960 lwkt_reltoken(&unp_token); 961 return (error); 962 } 963 964 static int 965 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 966 { 967 struct proc *p = td->td_proc; 968 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 969 struct vnode *vp; 970 struct socket *so2, *so3; 971 struct unpcb *unp, *unp2, *unp3; 972 int error, len; 973 struct nlookupdata nd; 974 char buf[SOCK_MAXADDRLEN]; 975 976 lwkt_gettoken(&unp_token); 977 978 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); 979 if (len <= 0) { 980 error = EINVAL; 981 goto failed; 982 } 983 strncpy(buf, soun->sun_path, len); 984 buf[len] = 0; 985 986 vp = NULL; 987 error = nlookup_init(&nd, buf, UIO_SYSSPACE, NLC_FOLLOW); 988 if (error == 0) 989 error = nlookup(&nd); 990 if (error == 0) 991 error = cache_vget(&nd.nl_nch, nd.nl_cred, LK_EXCLUSIVE, &vp); 992 nlookup_done(&nd); 993 if (error) 994 goto failed; 995 996 if (vp->v_type != VSOCK) { 997 error = ENOTSOCK; 998 goto bad; 999 } 1000 error = VOP_EACCESS(vp, VWRITE, p->p_ucred); 1001 if (error) 1002 goto bad; 1003 so2 = vp->v_socket; 1004 if (so2 == NULL) { 1005 error = ECONNREFUSED; 1006 goto bad; 1007 } 1008 if (so->so_type != so2->so_type) { 1009 error = EPROTOTYPE; 1010 goto bad; 1011 } 1012 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 1013 if (!(so2->so_options & SO_ACCEPTCONN) || 1014 (so3 = sonewconn(so2, 0)) == NULL) { 1015 error = ECONNREFUSED; 1016 goto bad; 1017 } 1018 unp = so->so_pcb; 1019 if (unp->unp_conn) { /* race, already connected! */ 1020 error = EISCONN; 1021 sofree(so3); 1022 goto bad; 1023 } 1024 unp2 = so2->so_pcb; 1025 unp3 = so3->so_pcb; 1026 if (unp2->unp_addr) 1027 unp3->unp_addr = (struct sockaddr_un *) 1028 dup_sockaddr((struct sockaddr *)unp2->unp_addr); 1029 1030 /* 1031 * unp_peercred management: 1032 * 1033 * The connecter's (client's) credentials are copied 1034 * from its process structure at the time of connect() 1035 * (which is now). 1036 */ 1037 cru2x(p->p_ucred, &unp3->unp_peercred); 1038 unp3->unp_flags |= UNP_HAVEPC; 1039 /* 1040 * The receiver's (server's) credentials are copied 1041 * from the unp_peercred member of socket on which the 1042 * former called listen(); unp_listen() cached that 1043 * process's credentials at that time so we can use 1044 * them now. 1045 */ 1046 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED, 1047 ("unp_connect: listener without cached peercred")); 1048 memcpy(&unp->unp_peercred, &unp2->unp_peercred, 1049 sizeof(unp->unp_peercred)); 1050 unp->unp_flags |= UNP_HAVEPC; 1051 1052 so2 = so3; 1053 } 1054 error = unp_connect2(so, so2); 1055 bad: 1056 vput(vp); 1057 failed: 1058 lwkt_reltoken(&unp_token); 1059 return (error); 1060 } 1061 1062 /* 1063 * Connect two unix domain sockets together. 1064 * 1065 * NOTE: Semantics for any change to unp_conn requires that the per-unp 1066 * pool token also be held. 1067 */ 1068 int 1069 unp_connect2(struct socket *so, struct socket *so2) 1070 { 1071 struct unpcb *unp; 1072 struct unpcb *unp2; 1073 1074 lwkt_gettoken(&unp_token); 1075 unp = so->so_pcb; 1076 if (so2->so_type != so->so_type) { 1077 lwkt_reltoken(&unp_token); 1078 return (EPROTOTYPE); 1079 } 1080 unp2 = so2->so_pcb; 1081 lwkt_getpooltoken(unp); 1082 lwkt_getpooltoken(unp2); 1083 1084 unp->unp_conn = unp2; 1085 1086 switch (so->so_type) { 1087 case SOCK_DGRAM: 1088 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink); 1089 soisconnected(so); 1090 break; 1091 1092 case SOCK_STREAM: 1093 case SOCK_SEQPACKET: 1094 unp2->unp_conn = unp; 1095 soisconnected(so); 1096 soisconnected(so2); 1097 break; 1098 1099 default: 1100 panic("unp_connect2"); 1101 } 1102 lwkt_relpooltoken(unp2); 1103 lwkt_relpooltoken(unp); 1104 lwkt_reltoken(&unp_token); 1105 return (0); 1106 } 1107 1108 /* 1109 * Disconnect a unix domain socket pair. 1110 * 1111 * NOTE: Semantics for any change to unp_conn requires that the per-unp 1112 * pool token also be held. 1113 */ 1114 static void 1115 unp_disconnect(struct unpcb *unp) 1116 { 1117 struct unpcb *unp2; 1118 1119 lwkt_gettoken(&unp_token); 1120 lwkt_getpooltoken(unp); 1121 1122 while ((unp2 = unp->unp_conn) != NULL) { 1123 lwkt_getpooltoken(unp2); 1124 if (unp2 == unp->unp_conn) 1125 break; 1126 lwkt_relpooltoken(unp2); 1127 } 1128 if (unp2 == NULL) 1129 goto done; 1130 1131 unp->unp_conn = NULL; 1132 1133 switch (unp->unp_socket->so_type) { 1134 case SOCK_DGRAM: 1135 LIST_REMOVE(unp, unp_reflink); 1136 soclrstate(unp->unp_socket, SS_ISCONNECTED); 1137 break; 1138 1139 case SOCK_STREAM: 1140 case SOCK_SEQPACKET: 1141 unp_reference(unp2); 1142 unp2->unp_conn = NULL; 1143 1144 soisdisconnected(unp->unp_socket); 1145 soisdisconnected(unp2->unp_socket); 1146 1147 unp_free(unp2); 1148 break; 1149 } 1150 lwkt_relpooltoken(unp2); 1151 done: 1152 lwkt_relpooltoken(unp); 1153 lwkt_reltoken(&unp_token); 1154 } 1155 1156 #ifdef notdef 1157 void 1158 unp_abort(struct unpcb *unp) 1159 { 1160 lwkt_gettoken(&unp_token); 1161 unp_free(unp); 1162 lwkt_reltoken(&unp_token); 1163 } 1164 #endif 1165 1166 static int 1167 prison_unpcb(struct thread *td, struct unpcb *unp) 1168 { 1169 struct proc *p; 1170 1171 if (td == NULL) 1172 return (0); 1173 if ((p = td->td_proc) == NULL) 1174 return (0); 1175 if (!p->p_ucred->cr_prison) 1176 return (0); 1177 if (p->p_fd->fd_rdir == unp->unp_rvnode) 1178 return (0); 1179 return (1); 1180 } 1181 1182 static int 1183 unp_pcblist(SYSCTL_HANDLER_ARGS) 1184 { 1185 int error, i, n; 1186 struct unpcb *unp, **unp_list; 1187 unp_gen_t gencnt; 1188 struct unp_head *head; 1189 1190 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead); 1191 1192 KKASSERT(curproc != NULL); 1193 1194 /* 1195 * The process of preparing the PCB list is too time-consuming and 1196 * resource-intensive to repeat twice on every request. 1197 */ 1198 if (req->oldptr == NULL) { 1199 n = unp_count; 1200 req->oldidx = (n + n/8) * sizeof(struct xunpcb); 1201 return 0; 1202 } 1203 1204 if (req->newptr != NULL) 1205 return EPERM; 1206 1207 lwkt_gettoken(&unp_token); 1208 1209 /* 1210 * OK, now we're committed to doing something. 1211 */ 1212 gencnt = unp_gencnt; 1213 n = unp_count; 1214 1215 unp_list = kmalloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); 1216 1217 for (unp = LIST_FIRST(head), i = 0; unp && i < n; 1218 unp = LIST_NEXT(unp, unp_link)) { 1219 if (unp->unp_gencnt <= gencnt && !prison_unpcb(req->td, unp)) 1220 unp_list[i++] = unp; 1221 } 1222 n = i; /* in case we lost some during malloc */ 1223 1224 error = 0; 1225 for (i = 0; i < n; i++) { 1226 unp = unp_list[i]; 1227 if (unp->unp_gencnt <= gencnt) { 1228 struct xunpcb xu; 1229 xu.xu_len = sizeof xu; 1230 xu.xu_unpp = unp; 1231 /* 1232 * XXX - need more locking here to protect against 1233 * connect/disconnect races for SMP. 1234 */ 1235 if (unp->unp_addr) 1236 bcopy(unp->unp_addr, &xu.xu_addr, 1237 unp->unp_addr->sun_len); 1238 if (unp->unp_conn && unp->unp_conn->unp_addr) 1239 bcopy(unp->unp_conn->unp_addr, 1240 &xu.xu_caddr, 1241 unp->unp_conn->unp_addr->sun_len); 1242 bcopy(unp, &xu.xu_unp, sizeof *unp); 1243 sotoxsocket(unp->unp_socket, &xu.xu_socket); 1244 error = SYSCTL_OUT(req, &xu, sizeof xu); 1245 } 1246 } 1247 lwkt_reltoken(&unp_token); 1248 kfree(unp_list, M_TEMP); 1249 1250 return error; 1251 } 1252 1253 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD, 1254 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb", 1255 "List of active local datagram sockets"); 1256 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD, 1257 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb", 1258 "List of active local stream sockets"); 1259 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist, CTLFLAG_RD, 1260 (caddr_t)(long)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb", 1261 "List of active local seqpacket stream sockets"); 1262 1263 static void 1264 unp_shutdown(struct unpcb *unp) 1265 { 1266 struct socket *so; 1267 1268 if ((unp->unp_socket->so_type == SOCK_STREAM || 1269 unp->unp_socket->so_type == SOCK_SEQPACKET) && 1270 unp->unp_conn != NULL && (so = unp->unp_conn->unp_socket)) { 1271 socantrcvmore(so); 1272 } 1273 } 1274 1275 static void 1276 unp_drop(struct unpcb *unp, int err) 1277 { 1278 struct socket *so = unp->unp_socket; 1279 1280 so->so_error = err; 1281 unp_disconnect(unp); 1282 } 1283 1284 #ifdef notdef 1285 void 1286 unp_drain(void) 1287 { 1288 lwkt_gettoken(&unp_token); 1289 lwkt_reltoken(&unp_token); 1290 } 1291 #endif 1292 1293 int 1294 unp_externalize(struct mbuf *rights) 1295 { 1296 struct thread *td = curthread; 1297 struct proc *p = td->td_proc; /* XXX */ 1298 struct lwp *lp = td->td_lwp; 1299 struct cmsghdr *cm = mtod(rights, struct cmsghdr *); 1300 int *fdp; 1301 int i; 1302 struct file **rp; 1303 struct file *fp; 1304 int newfds = (cm->cmsg_len - (CMSG_DATA(cm) - (u_char *)cm)) 1305 / sizeof (struct file *); 1306 int f; 1307 1308 lwkt_gettoken(&unp_token); 1309 1310 /* 1311 * if the new FD's will not fit, then we free them all 1312 */ 1313 if (!fdavail(p, newfds)) { 1314 rp = (struct file **)CMSG_DATA(cm); 1315 for (i = 0; i < newfds; i++) { 1316 fp = *rp; 1317 /* 1318 * zero the pointer before calling unp_discard, 1319 * since it may end up in unp_gc().. 1320 */ 1321 *rp++ = NULL; 1322 unp_discard(fp, NULL); 1323 } 1324 lwkt_reltoken(&unp_token); 1325 return (EMSGSIZE); 1326 } 1327 1328 /* 1329 * now change each pointer to an fd in the global table to 1330 * an integer that is the index to the local fd table entry 1331 * that we set up to point to the global one we are transferring. 1332 * If sizeof (struct file *) is bigger than or equal to sizeof int, 1333 * then do it in forward order. In that case, an integer will 1334 * always come in the same place or before its corresponding 1335 * struct file pointer. 1336 * If sizeof (struct file *) is smaller than sizeof int, then 1337 * do it in reverse order. 1338 */ 1339 if (sizeof (struct file *) >= sizeof (int)) { 1340 fdp = (int *)CMSG_DATA(cm); 1341 rp = (struct file **)CMSG_DATA(cm); 1342 for (i = 0; i < newfds; i++) { 1343 if (fdalloc(p, 0, &f)) 1344 panic("unp_externalize"); 1345 fp = *rp++; 1346 unp_fp_externalize(lp, fp, f); 1347 *fdp++ = f; 1348 } 1349 } else { 1350 fdp = (int *)CMSG_DATA(cm) + newfds - 1; 1351 rp = (struct file **)CMSG_DATA(cm) + newfds - 1; 1352 for (i = 0; i < newfds; i++) { 1353 if (fdalloc(p, 0, &f)) 1354 panic("unp_externalize"); 1355 fp = *rp--; 1356 unp_fp_externalize(lp, fp, f); 1357 *fdp-- = f; 1358 } 1359 } 1360 1361 /* 1362 * Adjust length, in case sizeof(struct file *) and sizeof(int) 1363 * differs. 1364 */ 1365 cm->cmsg_len = CMSG_LEN(newfds * sizeof(int)); 1366 rights->m_len = cm->cmsg_len; 1367 1368 lwkt_reltoken(&unp_token); 1369 return (0); 1370 } 1371 1372 static void 1373 unp_fp_externalize(struct lwp *lp, struct file *fp, int fd) 1374 { 1375 struct file *fx; 1376 int error; 1377 1378 lwkt_gettoken(&unp_token); 1379 1380 if (lp) { 1381 KKASSERT(fd >= 0); 1382 if (fp->f_flag & FREVOKED) { 1383 kprintf("Warning: revoked fp exiting unix socket\n"); 1384 fx = NULL; 1385 error = falloc(lp, &fx, NULL); 1386 if (error == 0) 1387 fsetfd(lp->lwp_proc->p_fd, fx, fd); 1388 else 1389 fsetfd(lp->lwp_proc->p_fd, NULL, fd); 1390 fdrop(fx); 1391 } else { 1392 fsetfd(lp->lwp_proc->p_fd, fp, fd); 1393 } 1394 } 1395 spin_lock(&unp_spin); 1396 fp->f_msgcount--; 1397 unp_rights--; 1398 spin_unlock(&unp_spin); 1399 fdrop(fp); 1400 1401 lwkt_reltoken(&unp_token); 1402 } 1403 1404 1405 void 1406 unp_init(void) 1407 { 1408 LIST_INIT(&unp_dhead); 1409 LIST_INIT(&unp_shead); 1410 spin_init(&unp_spin); 1411 } 1412 1413 static int 1414 unp_internalize(struct mbuf *control, struct thread *td) 1415 { 1416 struct proc *p = td->td_proc; 1417 struct filedesc *fdescp; 1418 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1419 struct file **rp; 1420 struct file *fp; 1421 int i, fd, *fdp; 1422 struct cmsgcred *cmcred; 1423 int oldfds; 1424 u_int newlen; 1425 int error; 1426 1427 KKASSERT(p); 1428 lwkt_gettoken(&unp_token); 1429 1430 fdescp = p->p_fd; 1431 if ((cm->cmsg_type != SCM_RIGHTS && cm->cmsg_type != SCM_CREDS) || 1432 cm->cmsg_level != SOL_SOCKET || 1433 CMSG_ALIGN(cm->cmsg_len) != control->m_len) { 1434 error = EINVAL; 1435 goto done; 1436 } 1437 1438 /* 1439 * Fill in credential information. 1440 */ 1441 if (cm->cmsg_type == SCM_CREDS) { 1442 cmcred = (struct cmsgcred *)CMSG_DATA(cm); 1443 cmcred->cmcred_pid = p->p_pid; 1444 cmcred->cmcred_uid = p->p_ucred->cr_ruid; 1445 cmcred->cmcred_gid = p->p_ucred->cr_rgid; 1446 cmcred->cmcred_euid = p->p_ucred->cr_uid; 1447 cmcred->cmcred_ngroups = MIN(p->p_ucred->cr_ngroups, 1448 CMGROUP_MAX); 1449 for (i = 0; i < cmcred->cmcred_ngroups; i++) 1450 cmcred->cmcred_groups[i] = p->p_ucred->cr_groups[i]; 1451 error = 0; 1452 goto done; 1453 } 1454 1455 /* 1456 * cmsghdr may not be aligned, do not allow calculation(s) to 1457 * go negative. 1458 */ 1459 if (cm->cmsg_len < CMSG_LEN(0)) { 1460 error = EINVAL; 1461 goto done; 1462 } 1463 1464 oldfds = (cm->cmsg_len - CMSG_LEN(0)) / sizeof (int); 1465 1466 /* 1467 * check that all the FDs passed in refer to legal OPEN files 1468 * If not, reject the entire operation. 1469 */ 1470 fdp = (int *)CMSG_DATA(cm); 1471 for (i = 0; i < oldfds; i++) { 1472 fd = *fdp++; 1473 if ((unsigned)fd >= fdescp->fd_nfiles || 1474 fdescp->fd_files[fd].fp == NULL) { 1475 error = EBADF; 1476 goto done; 1477 } 1478 if (fdescp->fd_files[fd].fp->f_type == DTYPE_KQUEUE) { 1479 error = EOPNOTSUPP; 1480 goto done; 1481 } 1482 } 1483 /* 1484 * Now replace the integer FDs with pointers to 1485 * the associated global file table entry.. 1486 * Allocate a bigger buffer as necessary. But if an cluster is not 1487 * enough, return E2BIG. 1488 */ 1489 newlen = CMSG_LEN(oldfds * sizeof(struct file *)); 1490 if (newlen > MCLBYTES) { 1491 error = E2BIG; 1492 goto done; 1493 } 1494 if (newlen - control->m_len > M_TRAILINGSPACE(control)) { 1495 if (control->m_flags & M_EXT) { 1496 error = E2BIG; 1497 goto done; 1498 } 1499 MCLGET(control, MB_WAIT); 1500 if (!(control->m_flags & M_EXT)) { 1501 error = ENOBUFS; 1502 goto done; 1503 } 1504 1505 /* copy the data to the cluster */ 1506 memcpy(mtod(control, char *), cm, cm->cmsg_len); 1507 cm = mtod(control, struct cmsghdr *); 1508 } 1509 1510 /* 1511 * Adjust length, in case sizeof(struct file *) and sizeof(int) 1512 * differs. 1513 */ 1514 cm->cmsg_len = newlen; 1515 control->m_len = CMSG_ALIGN(newlen); 1516 1517 /* 1518 * Transform the file descriptors into struct file pointers. 1519 * If sizeof (struct file *) is bigger than or equal to sizeof int, 1520 * then do it in reverse order so that the int won't get until 1521 * we're done. 1522 * If sizeof (struct file *) is smaller than sizeof int, then 1523 * do it in forward order. 1524 */ 1525 if (sizeof (struct file *) >= sizeof (int)) { 1526 fdp = (int *)CMSG_DATA(cm) + oldfds - 1; 1527 rp = (struct file **)CMSG_DATA(cm) + oldfds - 1; 1528 for (i = 0; i < oldfds; i++) { 1529 fp = fdescp->fd_files[*fdp--].fp; 1530 *rp-- = fp; 1531 fhold(fp); 1532 spin_lock(&unp_spin); 1533 fp->f_msgcount++; 1534 unp_rights++; 1535 spin_unlock(&unp_spin); 1536 } 1537 } else { 1538 fdp = (int *)CMSG_DATA(cm); 1539 rp = (struct file **)CMSG_DATA(cm); 1540 for (i = 0; i < oldfds; i++) { 1541 fp = fdescp->fd_files[*fdp++].fp; 1542 *rp++ = fp; 1543 fhold(fp); 1544 spin_lock(&unp_spin); 1545 fp->f_msgcount++; 1546 unp_rights++; 1547 spin_unlock(&unp_spin); 1548 } 1549 } 1550 error = 0; 1551 done: 1552 lwkt_reltoken(&unp_token); 1553 return error; 1554 } 1555 1556 /* 1557 * Garbage collect in-transit file descriptors that get lost due to 1558 * loops (i.e. when a socket is sent to another process over itself, 1559 * and more complex situations). 1560 * 1561 * NOT MPSAFE - TODO socket flush code and maybe closef. Rest is MPSAFE. 1562 */ 1563 1564 struct unp_gc_info { 1565 struct file **extra_ref; 1566 struct file *locked_fp; 1567 int defer; 1568 int index; 1569 int maxindex; 1570 }; 1571 1572 static void 1573 unp_gc(void) 1574 { 1575 struct unp_gc_info info; 1576 static boolean_t unp_gcing; 1577 struct file **fpp; 1578 int i; 1579 1580 /* 1581 * Only one gc can be in-progress at any given moment 1582 */ 1583 spin_lock(&unp_spin); 1584 if (unp_gcing) { 1585 spin_unlock(&unp_spin); 1586 return; 1587 } 1588 unp_gcing = TRUE; 1589 spin_unlock(&unp_spin); 1590 1591 lwkt_gettoken(&unp_token); 1592 1593 /* 1594 * Before going through all this, set all FDs to be NOT defered 1595 * and NOT externally accessible (not marked). During the scan 1596 * a fd can be marked externally accessible but we may or may not 1597 * be able to immediately process it (controlled by FDEFER). 1598 * 1599 * If we loop sleep a bit. The complexity of the topology can cause 1600 * multiple loops. Also failure to acquire the socket's so_rcv 1601 * token can cause us to loop. 1602 */ 1603 allfiles_scan_exclusive(unp_gc_clearmarks, NULL); 1604 do { 1605 info.defer = 0; 1606 allfiles_scan_exclusive(unp_gc_checkmarks, &info); 1607 if (info.defer) 1608 tsleep(&info, 0, "gcagain", 1); 1609 } while (info.defer); 1610 1611 /* 1612 * We grab an extra reference to each of the file table entries 1613 * that are not otherwise accessible and then free the rights 1614 * that are stored in messages on them. 1615 * 1616 * The bug in the orginal code is a little tricky, so I'll describe 1617 * what's wrong with it here. 1618 * 1619 * It is incorrect to simply unp_discard each entry for f_msgcount 1620 * times -- consider the case of sockets A and B that contain 1621 * references to each other. On a last close of some other socket, 1622 * we trigger a gc since the number of outstanding rights (unp_rights) 1623 * is non-zero. If during the sweep phase the gc code un_discards, 1624 * we end up doing a (full) closef on the descriptor. A closef on A 1625 * results in the following chain. Closef calls soo_close, which 1626 * calls soclose. Soclose calls first (through the switch 1627 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply 1628 * returns because the previous instance had set unp_gcing, and 1629 * we return all the way back to soclose, which marks the socket 1630 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush 1631 * to free up the rights that are queued in messages on the socket A, 1632 * i.e., the reference on B. The sorflush calls via the dom_dispose 1633 * switch unp_dispose, which unp_scans with unp_discard. This second 1634 * instance of unp_discard just calls closef on B. 1635 * 1636 * Well, a similar chain occurs on B, resulting in a sorflush on B, 1637 * which results in another closef on A. Unfortunately, A is already 1638 * being closed, and the descriptor has already been marked with 1639 * SS_NOFDREF, and soclose panics at this point. 1640 * 1641 * Here, we first take an extra reference to each inaccessible 1642 * descriptor. Then, we call sorflush ourself, since we know 1643 * it is a Unix domain socket anyhow. After we destroy all the 1644 * rights carried in messages, we do a last closef to get rid 1645 * of our extra reference. This is the last close, and the 1646 * unp_detach etc will shut down the socket. 1647 * 1648 * 91/09/19, bsy@cs.cmu.edu 1649 */ 1650 info.extra_ref = kmalloc(256 * sizeof(struct file *), M_FILE, M_WAITOK); 1651 info.maxindex = 256; 1652 1653 do { 1654 /* 1655 * Look for matches 1656 */ 1657 info.index = 0; 1658 allfiles_scan_exclusive(unp_gc_checkrefs, &info); 1659 1660 /* 1661 * For each FD on our hit list, do the following two things 1662 */ 1663 for (i = info.index, fpp = info.extra_ref; --i >= 0; ++fpp) { 1664 struct file *tfp = *fpp; 1665 if (tfp->f_type == DTYPE_SOCKET && tfp->f_data != NULL) 1666 sorflush((struct socket *)(tfp->f_data)); 1667 } 1668 for (i = info.index, fpp = info.extra_ref; --i >= 0; ++fpp) 1669 closef(*fpp, NULL); 1670 } while (info.index == info.maxindex); 1671 1672 lwkt_reltoken(&unp_token); 1673 1674 kfree((caddr_t)info.extra_ref, M_FILE); 1675 unp_gcing = FALSE; 1676 } 1677 1678 /* 1679 * MPSAFE - NOTE: filehead list and file pointer spinlocked on entry 1680 */ 1681 static int 1682 unp_gc_checkrefs(struct file *fp, void *data) 1683 { 1684 struct unp_gc_info *info = data; 1685 1686 if (fp->f_count == 0) 1687 return(0); 1688 if (info->index == info->maxindex) 1689 return(-1); 1690 1691 /* 1692 * If all refs are from msgs, and it's not marked accessible 1693 * then it must be referenced from some unreachable cycle 1694 * of (shut-down) FDs, so include it in our 1695 * list of FDs to remove 1696 */ 1697 if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) { 1698 info->extra_ref[info->index++] = fp; 1699 fhold(fp); 1700 } 1701 return(0); 1702 } 1703 1704 /* 1705 * MPSAFE - NOTE: filehead list and file pointer spinlocked on entry 1706 */ 1707 static int 1708 unp_gc_clearmarks(struct file *fp, void *data __unused) 1709 { 1710 atomic_clear_int(&fp->f_flag, FMARK | FDEFER); 1711 return(0); 1712 } 1713 1714 /* 1715 * MPSAFE - NOTE: filehead list and file pointer spinlocked on entry 1716 */ 1717 static int 1718 unp_gc_checkmarks(struct file *fp, void *data) 1719 { 1720 struct unp_gc_info *info = data; 1721 struct socket *so; 1722 1723 /* 1724 * If the file is not open, skip it. Make sure it isn't marked 1725 * defered or we could loop forever, in case we somehow race 1726 * something. 1727 */ 1728 if (fp->f_count == 0) { 1729 if (fp->f_flag & FDEFER) 1730 atomic_clear_int(&fp->f_flag, FDEFER); 1731 return(0); 1732 } 1733 /* 1734 * If we already marked it as 'defer' in a 1735 * previous pass, then try process it this time 1736 * and un-mark it 1737 */ 1738 if (fp->f_flag & FDEFER) { 1739 atomic_clear_int(&fp->f_flag, FDEFER); 1740 } else { 1741 /* 1742 * if it's not defered, then check if it's 1743 * already marked.. if so skip it 1744 */ 1745 if (fp->f_flag & FMARK) 1746 return(0); 1747 /* 1748 * If all references are from messages 1749 * in transit, then skip it. it's not 1750 * externally accessible. 1751 */ 1752 if (fp->f_count == fp->f_msgcount) 1753 return(0); 1754 /* 1755 * If it got this far then it must be 1756 * externally accessible. 1757 */ 1758 atomic_set_int(&fp->f_flag, FMARK); 1759 } 1760 1761 /* 1762 * either it was defered, or it is externally 1763 * accessible and not already marked so. 1764 * Now check if it is possibly one of OUR sockets. 1765 */ 1766 if (fp->f_type != DTYPE_SOCKET || 1767 (so = (struct socket *)fp->f_data) == NULL) { 1768 return(0); 1769 } 1770 if (so->so_proto->pr_domain != &localdomain || 1771 !(so->so_proto->pr_flags & PR_RIGHTS)) { 1772 return(0); 1773 } 1774 1775 /* 1776 * So, Ok, it's one of our sockets and it IS externally accessible 1777 * (or was defered). Now we look to see if we hold any file 1778 * descriptors in its message buffers. Follow those links and mark 1779 * them as accessible too. 1780 * 1781 * We are holding multiple spinlocks here, if we cannot get the 1782 * token non-blocking defer until the next loop. 1783 */ 1784 info->locked_fp = fp; 1785 if (lwkt_trytoken(&so->so_rcv.ssb_token)) { 1786 unp_scan(so->so_rcv.ssb_mb, unp_mark, info); 1787 lwkt_reltoken(&so->so_rcv.ssb_token); 1788 } else { 1789 atomic_set_int(&fp->f_flag, FDEFER); 1790 ++info->defer; 1791 } 1792 return (0); 1793 } 1794 1795 /* 1796 * Scan all unix domain sockets and replace any revoked file pointers 1797 * found with the dummy file pointer fx. We don't worry about races 1798 * against file pointers being read out as those are handled in the 1799 * externalize code. 1800 */ 1801 1802 #define REVOKE_GC_MAXFILES 32 1803 1804 struct unp_revoke_gc_info { 1805 struct file *fx; 1806 struct file *fary[REVOKE_GC_MAXFILES]; 1807 int fcount; 1808 }; 1809 1810 void 1811 unp_revoke_gc(struct file *fx) 1812 { 1813 struct unp_revoke_gc_info info; 1814 int i; 1815 1816 lwkt_gettoken(&unp_token); 1817 info.fx = fx; 1818 do { 1819 info.fcount = 0; 1820 allfiles_scan_exclusive(unp_revoke_gc_check, &info); 1821 for (i = 0; i < info.fcount; ++i) 1822 unp_fp_externalize(NULL, info.fary[i], -1); 1823 } while (info.fcount == REVOKE_GC_MAXFILES); 1824 lwkt_reltoken(&unp_token); 1825 } 1826 1827 /* 1828 * Check for and replace revoked descriptors. 1829 * 1830 * WARNING: This routine is not allowed to block. 1831 */ 1832 static int 1833 unp_revoke_gc_check(struct file *fps, void *vinfo) 1834 { 1835 struct unp_revoke_gc_info *info = vinfo; 1836 struct file *fp; 1837 struct socket *so; 1838 struct mbuf *m0; 1839 struct mbuf *m; 1840 struct file **rp; 1841 struct cmsghdr *cm; 1842 int i; 1843 int qfds; 1844 1845 /* 1846 * Is this a unix domain socket with rights-passing abilities? 1847 */ 1848 if (fps->f_type != DTYPE_SOCKET) 1849 return (0); 1850 if ((so = (struct socket *)fps->f_data) == NULL) 1851 return(0); 1852 if (so->so_proto->pr_domain != &localdomain) 1853 return(0); 1854 if ((so->so_proto->pr_flags & PR_RIGHTS) == 0) 1855 return(0); 1856 1857 /* 1858 * Scan the mbufs for control messages and replace any revoked 1859 * descriptors we find. 1860 */ 1861 lwkt_gettoken(&so->so_rcv.ssb_token); 1862 m0 = so->so_rcv.ssb_mb; 1863 while (m0) { 1864 for (m = m0; m; m = m->m_next) { 1865 if (m->m_type != MT_CONTROL) 1866 continue; 1867 if (m->m_len < sizeof(*cm)) 1868 continue; 1869 cm = mtod(m, struct cmsghdr *); 1870 if (cm->cmsg_level != SOL_SOCKET || 1871 cm->cmsg_type != SCM_RIGHTS) { 1872 continue; 1873 } 1874 qfds = (cm->cmsg_len - CMSG_LEN(0)) / sizeof(void *); 1875 rp = (struct file **)CMSG_DATA(cm); 1876 for (i = 0; i < qfds; i++) { 1877 fp = rp[i]; 1878 if (fp->f_flag & FREVOKED) { 1879 kprintf("Warning: Removing revoked fp from unix domain socket queue\n"); 1880 fhold(info->fx); 1881 info->fx->f_msgcount++; 1882 unp_rights++; 1883 rp[i] = info->fx; 1884 info->fary[info->fcount++] = fp; 1885 } 1886 if (info->fcount == REVOKE_GC_MAXFILES) 1887 break; 1888 } 1889 if (info->fcount == REVOKE_GC_MAXFILES) 1890 break; 1891 } 1892 m0 = m0->m_nextpkt; 1893 if (info->fcount == REVOKE_GC_MAXFILES) 1894 break; 1895 } 1896 lwkt_reltoken(&so->so_rcv.ssb_token); 1897 1898 /* 1899 * Stop the scan if we filled up our array. 1900 */ 1901 if (info->fcount == REVOKE_GC_MAXFILES) 1902 return(-1); 1903 return(0); 1904 } 1905 1906 /* 1907 * Dispose of the fp's stored in a mbuf. 1908 * 1909 * The dds loop can cause additional fps to be entered onto the 1910 * list while it is running, flattening out the operation and avoiding 1911 * a deep kernel stack recursion. 1912 */ 1913 void 1914 unp_dispose(struct mbuf *m) 1915 { 1916 unp_defdiscard_t dds; 1917 1918 lwkt_gettoken(&unp_token); 1919 ++unp_defdiscard_nest; 1920 if (m) { 1921 unp_scan(m, unp_discard, NULL); 1922 } 1923 if (unp_defdiscard_nest == 1) { 1924 while ((dds = unp_defdiscard_base) != NULL) { 1925 unp_defdiscard_base = dds->next; 1926 closef(dds->fp, NULL); 1927 kfree(dds, M_UNPCB); 1928 } 1929 } 1930 --unp_defdiscard_nest; 1931 lwkt_reltoken(&unp_token); 1932 } 1933 1934 static int 1935 unp_listen(struct unpcb *unp, struct thread *td) 1936 { 1937 struct proc *p = td->td_proc; 1938 1939 KKASSERT(p); 1940 lwkt_gettoken(&unp_token); 1941 cru2x(p->p_ucred, &unp->unp_peercred); 1942 unp->unp_flags |= UNP_HAVEPCCACHED; 1943 lwkt_reltoken(&unp_token); 1944 return (0); 1945 } 1946 1947 static void 1948 unp_scan(struct mbuf *m0, void (*op)(struct file *, void *), void *data) 1949 { 1950 struct mbuf *m; 1951 struct file **rp; 1952 struct cmsghdr *cm; 1953 int i; 1954 int qfds; 1955 1956 while (m0) { 1957 for (m = m0; m; m = m->m_next) { 1958 if (m->m_type == MT_CONTROL && 1959 m->m_len >= sizeof(*cm)) { 1960 cm = mtod(m, struct cmsghdr *); 1961 if (cm->cmsg_level != SOL_SOCKET || 1962 cm->cmsg_type != SCM_RIGHTS) 1963 continue; 1964 qfds = (cm->cmsg_len - CMSG_LEN(0)) / 1965 sizeof(void *); 1966 rp = (struct file **)CMSG_DATA(cm); 1967 for (i = 0; i < qfds; i++) 1968 (*op)(*rp++, data); 1969 break; /* XXX, but saves time */ 1970 } 1971 } 1972 m0 = m0->m_nextpkt; 1973 } 1974 } 1975 1976 /* 1977 * Mark visibility. info->defer is recalculated on every pass. 1978 */ 1979 static void 1980 unp_mark(struct file *fp, void *data) 1981 { 1982 struct unp_gc_info *info = data; 1983 1984 if ((fp->f_flag & FMARK) == 0) { 1985 ++info->defer; 1986 atomic_set_int(&fp->f_flag, FMARK | FDEFER); 1987 } else if (fp->f_flag & FDEFER) { 1988 ++info->defer; 1989 } 1990 } 1991 1992 /* 1993 * Discard a fp previously held in a unix domain socket mbuf. To 1994 * avoid blowing out the kernel stack due to contrived chain-reactions 1995 * we may have to defer the operation to a higher procedural level. 1996 * 1997 * Caller holds unp_token 1998 */ 1999 static void 2000 unp_discard(struct file *fp, void *data __unused) 2001 { 2002 unp_defdiscard_t dds; 2003 2004 spin_lock(&unp_spin); 2005 fp->f_msgcount--; 2006 unp_rights--; 2007 spin_unlock(&unp_spin); 2008 2009 if (unp_defdiscard_nest) { 2010 dds = kmalloc(sizeof(*dds), M_UNPCB, M_WAITOK|M_ZERO); 2011 dds->fp = fp; 2012 dds->next = unp_defdiscard_base; 2013 unp_defdiscard_base = dds; 2014 } else { 2015 closef(fp, NULL); 2016 } 2017 } 2018 2019