1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * NET4: Implementation of BSD Unix domain sockets. 4 * 5 * Authors: Alan Cox, <alan@lxorguk.ukuu.org.uk> 6 * 7 * Fixes: 8 * Linus Torvalds : Assorted bug cures. 9 * Niibe Yutaka : async I/O support. 10 * Carsten Paeth : PF_UNIX check, address fixes. 11 * Alan Cox : Limit size of allocated blocks. 12 * Alan Cox : Fixed the stupid socketpair bug. 13 * Alan Cox : BSD compatibility fine tuning. 14 * Alan Cox : Fixed a bug in connect when interrupted. 15 * Alan Cox : Sorted out a proper draft version of 16 * file descriptor passing hacked up from 17 * Mike Shaver's work. 18 * Marty Leisner : Fixes to fd passing 19 * Nick Nevin : recvmsg bugfix. 20 * Alan Cox : Started proper garbage collector 21 * Heiko EiBfeldt : Missing verify_area check 22 * Alan Cox : Started POSIXisms 23 * Andreas Schwab : Replace inode by dentry for proper 24 * reference counting 25 * Kirk Petersen : Made this a module 26 * Christoph Rohland : Elegant non-blocking accept/connect algorithm. 27 * Lots of bug fixes. 28 * Alexey Kuznetosv : Repaired (I hope) bugs introduces 29 * by above two patches. 30 * Andrea Arcangeli : If possible we block in connect(2) 31 * if the max backlog of the listen socket 32 * is been reached. This won't break 33 * old apps and it will avoid huge amount 34 * of socks hashed (this for unix_gc() 35 * performances reasons). 36 * Security fix that limits the max 37 * number of socks to 2*max_files and 38 * the number of skb queueable in the 39 * dgram receiver. 40 * Artur Skawina : Hash function optimizations 41 * Alexey Kuznetsov : Full scale SMP. Lot of bugs are introduced 8) 42 * Malcolm Beattie : Set peercred for socketpair 43 * Michal Ostrowski : Module initialization cleanup. 44 * Arnaldo C. Melo : Remove MOD_{INC,DEC}_USE_COUNT, 45 * the core infrastructure is doing that 46 * for all net proto families now (2.5.69+) 47 * 48 * Known differences from reference BSD that was tested: 49 * 50 * [TO FIX] 51 * ECONNREFUSED is not returned from one end of a connected() socket to the 52 * other the moment one end closes. 53 * fstat() doesn't return st_dev=0, and give the blksize as high water mark 54 * and a fake inode identifier (nor the BSD first socket fstat twice bug). 55 * [NOT TO FIX] 56 * accept() returns a path name even if the connecting socket has closed 57 * in the meantime (BSD loses the path and gives up). 58 * accept() returns 0 length path for an unbound connector. BSD returns 16 59 * and a null first byte in the path (but not for gethost/peername - BSD bug ??) 60 * socketpair(...SOCK_RAW..) doesn't panic the kernel. 61 * BSD af_unix apparently has connect forgetting to block properly. 62 * (need to check this with the POSIX spec in detail) 63 * 64 * Differences from 2.0.0-11-... (ANK) 65 * Bug fixes and improvements. 66 * - client shutdown killed server socket. 67 * - removed all useless cli/sti pairs. 68 * 69 * Semantic changes/extensions. 70 * - generic control message passing. 71 * - SCM_CREDENTIALS control message. 72 * - "Abstract" (not FS based) socket bindings. 73 * Abstract names are sequences of bytes (not zero terminated) 74 * started by 0, so that this name space does not intersect 75 * with BSD names. 76 */ 77 78 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 79 80 #include <linux/bpf-cgroup.h> 81 #include <linux/btf_ids.h> 82 #include <linux/dcache.h> 83 #include <linux/errno.h> 84 #include <linux/fcntl.h> 85 #include <linux/file.h> 86 #include <linux/filter.h> 87 #include <linux/fs.h> 88 #include <linux/fs_struct.h> 89 #include <linux/init.h> 90 #include <linux/kernel.h> 91 #include <linux/mount.h> 92 #include <linux/namei.h> 93 #include <linux/net.h> 94 #include <linux/pidfs.h> 95 #include <linux/poll.h> 96 #include <linux/proc_fs.h> 97 #include <linux/sched/signal.h> 98 #include <linux/security.h> 99 #include <linux/seq_file.h> 100 #include <linux/skbuff.h> 101 #include <linux/slab.h> 102 #include <linux/socket.h> 103 #include <linux/splice.h> 104 #include <linux/string.h> 105 #include <linux/uaccess.h> 106 #include <net/af_unix.h> 107 #include <net/net_namespace.h> 108 #include <net/scm.h> 109 #include <net/tcp_states.h> 110 #include <uapi/linux/sockios.h> 111 #include <uapi/linux/termios.h> 112 113 #include "af_unix.h" 114 115 static atomic_long_t unix_nr_socks; 116 static struct hlist_head bsd_socket_buckets[UNIX_HASH_SIZE / 2]; 117 static spinlock_t bsd_socket_locks[UNIX_HASH_SIZE / 2]; 118 119 /* SMP locking strategy: 120 * hash table is protected with spinlock. 121 * each socket state is protected by separate spinlock. 122 */ 123 #ifdef CONFIG_PROVE_LOCKING 124 #define cmp_ptr(l, r) (((l) > (r)) - ((l) < (r))) 125 126 static int unix_table_lock_cmp_fn(const struct lockdep_map *a, 127 const struct lockdep_map *b) 128 { 129 return cmp_ptr(a, b); 130 } 131 132 static int unix_state_lock_cmp_fn(const struct lockdep_map *_a, 133 const struct lockdep_map *_b) 134 { 135 const struct unix_sock *a, *b; 136 137 a = container_of(_a, struct unix_sock, lock.dep_map); 138 b = container_of(_b, struct unix_sock, lock.dep_map); 139 140 if (a->sk.sk_state == TCP_LISTEN) { 141 /* unix_stream_connect(): Before the 2nd unix_state_lock(), 142 * 143 * 1. a is TCP_LISTEN. 144 * 2. b is not a. 145 * 3. concurrent connect(b -> a) must fail. 146 * 147 * Except for 2. & 3., the b's state can be any possible 148 * value due to concurrent connect() or listen(). 149 * 150 * 2. is detected in debug_spin_lock_before(), and 3. cannot 151 * be expressed as lock_cmp_fn. 152 */ 153 switch (b->sk.sk_state) { 154 case TCP_CLOSE: 155 case TCP_ESTABLISHED: 156 case TCP_LISTEN: 157 return -1; 158 default: 159 /* Invalid case. */ 160 return 0; 161 } 162 } 163 164 /* Should never happen. Just to be symmetric. */ 165 if (b->sk.sk_state == TCP_LISTEN) { 166 switch (b->sk.sk_state) { 167 case TCP_CLOSE: 168 case TCP_ESTABLISHED: 169 return 1; 170 default: 171 return 0; 172 } 173 } 174 175 /* unix_state_double_lock(): ascending address order. */ 176 return cmp_ptr(a, b); 177 } 178 179 static int unix_recvq_lock_cmp_fn(const struct lockdep_map *_a, 180 const struct lockdep_map *_b) 181 { 182 const struct sock *a, *b; 183 184 a = container_of(_a, struct sock, sk_receive_queue.lock.dep_map); 185 b = container_of(_b, struct sock, sk_receive_queue.lock.dep_map); 186 187 /* unix_collect_skb(): listener -> embryo order. */ 188 if (a->sk_state == TCP_LISTEN && unix_sk(b)->listener == a) 189 return -1; 190 191 /* Should never happen. Just to be symmetric. */ 192 if (b->sk_state == TCP_LISTEN && unix_sk(a)->listener == b) 193 return 1; 194 195 return 0; 196 } 197 #endif 198 199 static unsigned int unix_unbound_hash(struct sock *sk) 200 { 201 unsigned long hash = (unsigned long)sk; 202 203 hash ^= hash >> 16; 204 hash ^= hash >> 8; 205 hash ^= sk->sk_type; 206 207 return hash & UNIX_HASH_MOD; 208 } 209 210 static unsigned int unix_bsd_hash(struct inode *i) 211 { 212 return i->i_ino & UNIX_HASH_MOD; 213 } 214 215 static unsigned int unix_abstract_hash(struct sockaddr_un *sunaddr, 216 int addr_len, int type) 217 { 218 __wsum csum = csum_partial(sunaddr, addr_len, 0); 219 unsigned int hash; 220 221 hash = (__force unsigned int)csum_fold(csum); 222 hash ^= hash >> 8; 223 hash ^= type; 224 225 return UNIX_HASH_MOD + 1 + (hash & UNIX_HASH_MOD); 226 } 227 228 static void unix_table_double_lock(struct net *net, 229 unsigned int hash1, unsigned int hash2) 230 { 231 if (hash1 == hash2) { 232 spin_lock(&net->unx.table.locks[hash1]); 233 return; 234 } 235 236 if (hash1 > hash2) 237 swap(hash1, hash2); 238 239 spin_lock(&net->unx.table.locks[hash1]); 240 spin_lock(&net->unx.table.locks[hash2]); 241 } 242 243 static void unix_table_double_unlock(struct net *net, 244 unsigned int hash1, unsigned int hash2) 245 { 246 if (hash1 == hash2) { 247 spin_unlock(&net->unx.table.locks[hash1]); 248 return; 249 } 250 251 spin_unlock(&net->unx.table.locks[hash1]); 252 spin_unlock(&net->unx.table.locks[hash2]); 253 } 254 255 #ifdef CONFIG_SECURITY_NETWORK 256 static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb) 257 { 258 UNIXCB(skb).secid = scm->secid; 259 } 260 261 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) 262 { 263 scm->secid = UNIXCB(skb).secid; 264 } 265 266 static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb) 267 { 268 return (scm->secid == UNIXCB(skb).secid); 269 } 270 #else 271 static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb) 272 { } 273 274 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) 275 { } 276 277 static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb) 278 { 279 return true; 280 } 281 #endif /* CONFIG_SECURITY_NETWORK */ 282 283 static inline int unix_may_send(struct sock *sk, struct sock *osk) 284 { 285 return !unix_peer(osk) || unix_peer(osk) == sk; 286 } 287 288 static inline int unix_recvq_full_lockless(const struct sock *sk) 289 { 290 return skb_queue_len_lockless(&sk->sk_receive_queue) > sk->sk_max_ack_backlog; 291 } 292 293 struct sock *unix_peer_get(struct sock *s) 294 { 295 struct sock *peer; 296 297 unix_state_lock(s); 298 peer = unix_peer(s); 299 if (peer) 300 sock_hold(peer); 301 unix_state_unlock(s); 302 return peer; 303 } 304 EXPORT_SYMBOL_GPL(unix_peer_get); 305 306 static struct unix_address *unix_create_addr(struct sockaddr_un *sunaddr, 307 int addr_len) 308 { 309 struct unix_address *addr; 310 311 addr = kmalloc(sizeof(*addr) + addr_len, GFP_KERNEL); 312 if (!addr) 313 return NULL; 314 315 refcount_set(&addr->refcnt, 1); 316 addr->len = addr_len; 317 memcpy(addr->name, sunaddr, addr_len); 318 319 return addr; 320 } 321 322 static inline void unix_release_addr(struct unix_address *addr) 323 { 324 if (refcount_dec_and_test(&addr->refcnt)) 325 kfree(addr); 326 } 327 328 /* 329 * Check unix socket name: 330 * - should be not zero length. 331 * - if started by not zero, should be NULL terminated (FS object) 332 * - if started by zero, it is abstract name. 333 */ 334 335 static int unix_validate_addr(struct sockaddr_un *sunaddr, int addr_len) 336 { 337 if (addr_len <= offsetof(struct sockaddr_un, sun_path) || 338 addr_len > sizeof(*sunaddr)) 339 return -EINVAL; 340 341 if (sunaddr->sun_family != AF_UNIX) 342 return -EINVAL; 343 344 return 0; 345 } 346 347 static int unix_mkname_bsd(struct sockaddr_un *sunaddr, int addr_len) 348 { 349 struct sockaddr_storage *addr = (struct sockaddr_storage *)sunaddr; 350 short offset = offsetof(struct sockaddr_storage, __data); 351 352 BUILD_BUG_ON(offset != offsetof(struct sockaddr_un, sun_path)); 353 354 /* This may look like an off by one error but it is a bit more 355 * subtle. 108 is the longest valid AF_UNIX path for a binding. 356 * sun_path[108] doesn't as such exist. However in kernel space 357 * we are guaranteed that it is a valid memory location in our 358 * kernel address buffer because syscall functions always pass 359 * a pointer of struct sockaddr_storage which has a bigger buffer 360 * than 108. Also, we must terminate sun_path for strlen() in 361 * getname_kernel(). 362 */ 363 addr->__data[addr_len - offset] = 0; 364 365 /* Don't pass sunaddr->sun_path to strlen(). Otherwise, 108 will 366 * cause panic if CONFIG_FORTIFY_SOURCE=y. Let __fortify_strlen() 367 * know the actual buffer. 368 */ 369 return strlen(addr->__data) + offset + 1; 370 } 371 372 static void __unix_remove_socket(struct sock *sk) 373 { 374 sk_del_node_init(sk); 375 } 376 377 static void __unix_insert_socket(struct net *net, struct sock *sk) 378 { 379 DEBUG_NET_WARN_ON_ONCE(!sk_unhashed(sk)); 380 sk_add_node(sk, &net->unx.table.buckets[sk->sk_hash]); 381 } 382 383 static void __unix_set_addr_hash(struct net *net, struct sock *sk, 384 struct unix_address *addr, unsigned int hash) 385 { 386 __unix_remove_socket(sk); 387 smp_store_release(&unix_sk(sk)->addr, addr); 388 389 sk->sk_hash = hash; 390 __unix_insert_socket(net, sk); 391 } 392 393 static void unix_remove_socket(struct net *net, struct sock *sk) 394 { 395 spin_lock(&net->unx.table.locks[sk->sk_hash]); 396 __unix_remove_socket(sk); 397 spin_unlock(&net->unx.table.locks[sk->sk_hash]); 398 } 399 400 static void unix_insert_unbound_socket(struct net *net, struct sock *sk) 401 { 402 spin_lock(&net->unx.table.locks[sk->sk_hash]); 403 __unix_insert_socket(net, sk); 404 spin_unlock(&net->unx.table.locks[sk->sk_hash]); 405 } 406 407 static void unix_insert_bsd_socket(struct sock *sk) 408 { 409 spin_lock(&bsd_socket_locks[sk->sk_hash]); 410 sk_add_bind_node(sk, &bsd_socket_buckets[sk->sk_hash]); 411 spin_unlock(&bsd_socket_locks[sk->sk_hash]); 412 } 413 414 static void unix_remove_bsd_socket(struct sock *sk) 415 { 416 if (!hlist_unhashed(&sk->sk_bind_node)) { 417 spin_lock(&bsd_socket_locks[sk->sk_hash]); 418 __sk_del_bind_node(sk); 419 spin_unlock(&bsd_socket_locks[sk->sk_hash]); 420 421 sk_node_init(&sk->sk_bind_node); 422 } 423 } 424 425 static struct sock *__unix_find_socket_byname(struct net *net, 426 struct sockaddr_un *sunname, 427 int len, unsigned int hash) 428 { 429 struct sock *s; 430 431 sk_for_each(s, &net->unx.table.buckets[hash]) { 432 struct unix_sock *u = unix_sk(s); 433 434 if (u->addr->len == len && 435 !memcmp(u->addr->name, sunname, len)) 436 return s; 437 } 438 return NULL; 439 } 440 441 static inline struct sock *unix_find_socket_byname(struct net *net, 442 struct sockaddr_un *sunname, 443 int len, unsigned int hash) 444 { 445 struct sock *s; 446 447 spin_lock(&net->unx.table.locks[hash]); 448 s = __unix_find_socket_byname(net, sunname, len, hash); 449 if (s) 450 sock_hold(s); 451 spin_unlock(&net->unx.table.locks[hash]); 452 return s; 453 } 454 455 static struct sock *unix_find_socket_byinode(struct inode *i) 456 { 457 unsigned int hash = unix_bsd_hash(i); 458 struct sock *s; 459 460 spin_lock(&bsd_socket_locks[hash]); 461 sk_for_each_bound(s, &bsd_socket_buckets[hash]) { 462 struct dentry *dentry = unix_sk(s)->path.dentry; 463 464 if (dentry && d_backing_inode(dentry) == i) { 465 sock_hold(s); 466 spin_unlock(&bsd_socket_locks[hash]); 467 return s; 468 } 469 } 470 spin_unlock(&bsd_socket_locks[hash]); 471 return NULL; 472 } 473 474 /* Support code for asymmetrically connected dgram sockets 475 * 476 * If a datagram socket is connected to a socket not itself connected 477 * to the first socket (eg, /dev/log), clients may only enqueue more 478 * messages if the present receive queue of the server socket is not 479 * "too large". This means there's a second writeability condition 480 * poll and sendmsg need to test. The dgram recv code will do a wake 481 * up on the peer_wait wait queue of a socket upon reception of a 482 * datagram which needs to be propagated to sleeping would-be writers 483 * since these might not have sent anything so far. This can't be 484 * accomplished via poll_wait because the lifetime of the server 485 * socket might be less than that of its clients if these break their 486 * association with it or if the server socket is closed while clients 487 * are still connected to it and there's no way to inform "a polling 488 * implementation" that it should let go of a certain wait queue 489 * 490 * In order to propagate a wake up, a wait_queue_entry_t of the client 491 * socket is enqueued on the peer_wait queue of the server socket 492 * whose wake function does a wake_up on the ordinary client socket 493 * wait queue. This connection is established whenever a write (or 494 * poll for write) hit the flow control condition and broken when the 495 * association to the server socket is dissolved or after a wake up 496 * was relayed. 497 */ 498 499 static int unix_dgram_peer_wake_relay(wait_queue_entry_t *q, unsigned mode, int flags, 500 void *key) 501 { 502 struct unix_sock *u; 503 wait_queue_head_t *u_sleep; 504 505 u = container_of(q, struct unix_sock, peer_wake); 506 507 __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait, 508 q); 509 u->peer_wake.private = NULL; 510 511 /* relaying can only happen while the wq still exists */ 512 u_sleep = sk_sleep(&u->sk); 513 if (u_sleep) 514 wake_up_interruptible_poll(u_sleep, key_to_poll(key)); 515 516 return 0; 517 } 518 519 static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other) 520 { 521 struct unix_sock *u, *u_other; 522 int rc; 523 524 u = unix_sk(sk); 525 u_other = unix_sk(other); 526 rc = 0; 527 spin_lock(&u_other->peer_wait.lock); 528 529 if (!u->peer_wake.private) { 530 u->peer_wake.private = other; 531 __add_wait_queue(&u_other->peer_wait, &u->peer_wake); 532 533 rc = 1; 534 } 535 536 spin_unlock(&u_other->peer_wait.lock); 537 return rc; 538 } 539 540 static void unix_dgram_peer_wake_disconnect(struct sock *sk, 541 struct sock *other) 542 { 543 struct unix_sock *u, *u_other; 544 545 u = unix_sk(sk); 546 u_other = unix_sk(other); 547 spin_lock(&u_other->peer_wait.lock); 548 549 if (u->peer_wake.private == other) { 550 __remove_wait_queue(&u_other->peer_wait, &u->peer_wake); 551 u->peer_wake.private = NULL; 552 } 553 554 spin_unlock(&u_other->peer_wait.lock); 555 } 556 557 static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk, 558 struct sock *other) 559 { 560 unix_dgram_peer_wake_disconnect(sk, other); 561 wake_up_interruptible_poll(sk_sleep(sk), 562 EPOLLOUT | 563 EPOLLWRNORM | 564 EPOLLWRBAND); 565 } 566 567 /* preconditions: 568 * - unix_peer(sk) == other 569 * - association is stable 570 */ 571 static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other) 572 { 573 int connected; 574 575 connected = unix_dgram_peer_wake_connect(sk, other); 576 577 /* If other is SOCK_DEAD, we want to make sure we signal 578 * POLLOUT, such that a subsequent write() can get a 579 * -ECONNREFUSED. Otherwise, if we haven't queued any skbs 580 * to other and its full, we will hang waiting for POLLOUT. 581 */ 582 if (unix_recvq_full_lockless(other) && !sock_flag(other, SOCK_DEAD)) 583 return 1; 584 585 if (connected) 586 unix_dgram_peer_wake_disconnect(sk, other); 587 588 return 0; 589 } 590 591 static int unix_writable(const struct sock *sk, unsigned char state) 592 { 593 return state != TCP_LISTEN && 594 (refcount_read(&sk->sk_wmem_alloc) << 2) <= READ_ONCE(sk->sk_sndbuf); 595 } 596 597 static void unix_write_space(struct sock *sk) 598 { 599 struct socket_wq *wq; 600 601 rcu_read_lock(); 602 if (unix_writable(sk, READ_ONCE(sk->sk_state))) { 603 wq = rcu_dereference(sk->sk_wq); 604 if (skwq_has_sleeper(wq)) 605 wake_up_interruptible_sync_poll(&wq->wait, 606 EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND); 607 sk_wake_async_rcu(sk, SOCK_WAKE_SPACE, POLL_OUT); 608 } 609 rcu_read_unlock(); 610 } 611 612 /* When dgram socket disconnects (or changes its peer), we clear its receive 613 * queue of packets arrived from previous peer. First, it allows to do 614 * flow control based only on wmem_alloc; second, sk connected to peer 615 * may receive messages only from that peer. */ 616 static void unix_dgram_disconnected(struct sock *sk, struct sock *other) 617 { 618 if (!skb_queue_empty(&sk->sk_receive_queue)) { 619 skb_queue_purge_reason(&sk->sk_receive_queue, 620 SKB_DROP_REASON_UNIX_DISCONNECT); 621 622 wake_up_interruptible_all(&unix_sk(sk)->peer_wait); 623 624 /* If one link of bidirectional dgram pipe is disconnected, 625 * we signal error. Messages are lost. Do not make this, 626 * when peer was not connected to us. 627 */ 628 if (!sock_flag(other, SOCK_DEAD) && unix_peer(other) == sk) { 629 WRITE_ONCE(other->sk_err, ECONNRESET); 630 sk_error_report(other); 631 } 632 } 633 } 634 635 static void unix_sock_destructor(struct sock *sk) 636 { 637 struct unix_sock *u = unix_sk(sk); 638 639 skb_queue_purge_reason(&sk->sk_receive_queue, SKB_DROP_REASON_SOCKET_CLOSE); 640 641 DEBUG_NET_WARN_ON_ONCE(refcount_read(&sk->sk_wmem_alloc)); 642 DEBUG_NET_WARN_ON_ONCE(!sk_unhashed(sk)); 643 DEBUG_NET_WARN_ON_ONCE(sk->sk_socket); 644 if (!sock_flag(sk, SOCK_DEAD)) { 645 pr_info("Attempt to release alive unix socket: %p\n", sk); 646 return; 647 } 648 649 if (u->addr) 650 unix_release_addr(u->addr); 651 652 atomic_long_dec(&unix_nr_socks); 653 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); 654 #ifdef UNIX_REFCNT_DEBUG 655 pr_debug("UNIX %p is destroyed, %ld are still alive.\n", sk, 656 atomic_long_read(&unix_nr_socks)); 657 #endif 658 } 659 660 static unsigned int unix_skb_len(const struct sk_buff *skb) 661 { 662 return skb->len - UNIXCB(skb).consumed; 663 } 664 665 static void unix_release_sock(struct sock *sk, int embrion) 666 { 667 struct unix_sock *u = unix_sk(sk); 668 struct sock *skpair; 669 struct sk_buff *skb; 670 struct path path; 671 int state; 672 673 unix_remove_socket(sock_net(sk), sk); 674 unix_remove_bsd_socket(sk); 675 676 /* Clear state */ 677 unix_state_lock(sk); 678 sock_orphan(sk); 679 WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK); 680 path = u->path; 681 u->path.dentry = NULL; 682 u->path.mnt = NULL; 683 state = sk->sk_state; 684 WRITE_ONCE(sk->sk_state, TCP_CLOSE); 685 686 skpair = unix_peer(sk); 687 unix_peer(sk) = NULL; 688 689 unix_state_unlock(sk); 690 691 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 692 u->oob_skb = NULL; 693 #endif 694 695 wake_up_interruptible_all(&u->peer_wait); 696 697 if (skpair != NULL) { 698 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { 699 struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); 700 701 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 702 if (skb && !unix_skb_len(skb)) 703 skb = skb_peek_next(skb, &sk->sk_receive_queue); 704 #endif 705 unix_state_lock(skpair); 706 /* No more writes */ 707 WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK); 708 if (skb || embrion) 709 WRITE_ONCE(skpair->sk_err, ECONNRESET); 710 unix_state_unlock(skpair); 711 skpair->sk_state_change(skpair); 712 sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP); 713 } 714 715 unix_dgram_peer_wake_disconnect(sk, skpair); 716 sock_put(skpair); /* It may now die */ 717 } 718 719 /* Try to flush out this socket. Throw out buffers at least */ 720 721 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) { 722 if (state == TCP_LISTEN) 723 unix_release_sock(skb->sk, 1); 724 725 /* passed fds are erased in the kfree_skb hook */ 726 kfree_skb_reason(skb, SKB_DROP_REASON_SOCKET_CLOSE); 727 } 728 729 if (path.dentry) 730 path_put(&path); 731 732 sock_put(sk); 733 734 /* ---- Socket is dead now and most probably destroyed ---- */ 735 736 unix_schedule_gc(NULL); 737 } 738 739 struct unix_peercred { 740 struct pid *peer_pid; 741 const struct cred *peer_cred; 742 }; 743 744 static inline int prepare_peercred(struct unix_peercred *peercred) 745 { 746 struct pid *pid; 747 int err; 748 749 pid = task_tgid(current); 750 err = pidfs_register_pid(pid); 751 if (likely(!err)) { 752 peercred->peer_pid = get_pid(pid); 753 peercred->peer_cred = get_current_cred(); 754 } 755 return err; 756 } 757 758 static void drop_peercred(struct unix_peercred *peercred) 759 { 760 const struct cred *cred = NULL; 761 struct pid *pid = NULL; 762 763 might_sleep(); 764 765 swap(peercred->peer_pid, pid); 766 swap(peercred->peer_cred, cred); 767 768 put_pid(pid); 769 put_cred(cred); 770 } 771 772 static inline void init_peercred(struct sock *sk, 773 const struct unix_peercred *peercred) 774 { 775 sk->sk_peer_pid = peercred->peer_pid; 776 sk->sk_peer_cred = peercred->peer_cred; 777 } 778 779 static void update_peercred(struct sock *sk, struct unix_peercred *peercred) 780 { 781 const struct cred *old_cred; 782 struct pid *old_pid; 783 784 spin_lock(&sk->sk_peer_lock); 785 old_pid = sk->sk_peer_pid; 786 old_cred = sk->sk_peer_cred; 787 init_peercred(sk, peercred); 788 spin_unlock(&sk->sk_peer_lock); 789 790 peercred->peer_pid = old_pid; 791 peercred->peer_cred = old_cred; 792 } 793 794 static void copy_peercred(struct sock *sk, struct sock *peersk) 795 { 796 lockdep_assert_held(&unix_sk(peersk)->lock); 797 798 spin_lock(&sk->sk_peer_lock); 799 sk->sk_peer_pid = get_pid(peersk->sk_peer_pid); 800 sk->sk_peer_cred = get_cred(peersk->sk_peer_cred); 801 spin_unlock(&sk->sk_peer_lock); 802 } 803 804 static bool unix_may_passcred(const struct sock *sk) 805 { 806 return sk->sk_scm_credentials || sk->sk_scm_pidfd; 807 } 808 809 static int unix_listen(struct socket *sock, int backlog) 810 { 811 int err; 812 struct sock *sk = sock->sk; 813 struct unix_sock *u = unix_sk(sk); 814 struct unix_peercred peercred = {}; 815 816 err = -EOPNOTSUPP; 817 if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET) 818 goto out; /* Only stream/seqpacket sockets accept */ 819 err = -EINVAL; 820 if (!READ_ONCE(u->addr)) 821 goto out; /* No listens on an unbound socket */ 822 err = prepare_peercred(&peercred); 823 if (err) 824 goto out; 825 unix_state_lock(sk); 826 err = -EINVAL; 827 if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN) 828 goto out_unlock; 829 if (backlog > sk->sk_max_ack_backlog) 830 wake_up_interruptible_all(&u->peer_wait); 831 sk->sk_max_ack_backlog = backlog; 832 WRITE_ONCE(sk->sk_state, TCP_LISTEN); 833 834 /* set credentials so connect can copy them */ 835 update_peercred(sk, &peercred); 836 err = 0; 837 838 out_unlock: 839 unix_state_unlock(sk); 840 drop_peercred(&peercred); 841 out: 842 return err; 843 } 844 845 static int unix_release(struct socket *); 846 static int unix_bind(struct socket *, struct sockaddr_unsized *, int); 847 static int unix_stream_connect(struct socket *, struct sockaddr_unsized *, 848 int addr_len, int flags); 849 static int unix_socketpair(struct socket *, struct socket *); 850 static int unix_accept(struct socket *, struct socket *, struct proto_accept_arg *arg); 851 static int unix_getname(struct socket *, struct sockaddr *, int); 852 static __poll_t unix_poll(struct file *, struct socket *, poll_table *); 853 static __poll_t unix_dgram_poll(struct file *, struct socket *, 854 poll_table *); 855 static int unix_ioctl(struct socket *, unsigned int, unsigned long); 856 #ifdef CONFIG_COMPAT 857 static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); 858 #endif 859 static int unix_shutdown(struct socket *, int); 860 static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t); 861 static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int); 862 static ssize_t unix_stream_splice_read(struct socket *, loff_t *ppos, 863 struct pipe_inode_info *, size_t size, 864 unsigned int flags); 865 static int unix_dgram_sendmsg(struct socket *, struct msghdr *, size_t); 866 static int unix_dgram_recvmsg(struct socket *, struct msghdr *, size_t, int); 867 static int unix_read_skb(struct sock *sk, skb_read_actor_t recv_actor); 868 static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor); 869 static int unix_dgram_connect(struct socket *, struct sockaddr_unsized *, 870 int, int); 871 static int unix_seqpacket_sendmsg(struct socket *, struct msghdr *, size_t); 872 static int unix_seqpacket_recvmsg(struct socket *, struct msghdr *, size_t, 873 int); 874 875 #ifdef CONFIG_PROC_FS 876 static int unix_count_nr_fds(struct sock *sk) 877 { 878 struct sk_buff *skb; 879 struct unix_sock *u; 880 int nr_fds = 0; 881 882 spin_lock(&sk->sk_receive_queue.lock); 883 skb = skb_peek(&sk->sk_receive_queue); 884 while (skb) { 885 u = unix_sk(skb->sk); 886 nr_fds += atomic_read(&u->scm_stat.nr_fds); 887 skb = skb_peek_next(skb, &sk->sk_receive_queue); 888 } 889 spin_unlock(&sk->sk_receive_queue.lock); 890 891 return nr_fds; 892 } 893 894 static void unix_show_fdinfo(struct seq_file *m, struct socket *sock) 895 { 896 struct sock *sk = sock->sk; 897 unsigned char s_state; 898 struct unix_sock *u; 899 int nr_fds = 0; 900 901 if (sk) { 902 s_state = READ_ONCE(sk->sk_state); 903 u = unix_sk(sk); 904 905 /* SOCK_STREAM and SOCK_SEQPACKET sockets never change their 906 * sk_state after switching to TCP_ESTABLISHED or TCP_LISTEN. 907 * SOCK_DGRAM is ordinary. So, no lock is needed. 908 */ 909 if (sock->type == SOCK_DGRAM || s_state == TCP_ESTABLISHED) 910 nr_fds = atomic_read(&u->scm_stat.nr_fds); 911 else if (s_state == TCP_LISTEN) 912 nr_fds = unix_count_nr_fds(sk); 913 914 seq_printf(m, "scm_fds: %u\n", nr_fds); 915 } 916 } 917 #else 918 #define unix_show_fdinfo NULL 919 #endif 920 921 static bool unix_custom_sockopt(int optname) 922 { 923 switch (optname) { 924 case SO_INQ: 925 case SO_RIGHTS_NOTRUNC: 926 return true; 927 default: 928 return false; 929 } 930 } 931 932 static int unix_setsockopt(struct socket *sock, int level, int optname, 933 sockptr_t optval, unsigned int optlen) 934 { 935 struct unix_sock *u = unix_sk(sock->sk); 936 struct sock *sk = sock->sk; 937 int val; 938 939 if (level != SOL_SOCKET) 940 return -EOPNOTSUPP; 941 942 if (!unix_custom_sockopt(optname)) 943 return sock_setsockopt(sock, level, optname, optval, optlen); 944 945 if (optlen != sizeof(int)) 946 return -EINVAL; 947 948 if (copy_from_sockptr(&val, optval, sizeof(val))) 949 return -EFAULT; 950 951 switch (optname) { 952 case SO_INQ: 953 if (sk->sk_type != SOCK_STREAM) 954 return -ENOPROTOOPT; 955 956 if (val > 1 || val < 0) 957 return -EINVAL; 958 959 WRITE_ONCE(u->recvmsg_inq, val); 960 break; 961 962 case SO_RIGHTS_NOTRUNC: 963 if (val > 1 || val < 0) 964 return -EINVAL; 965 966 WRITE_ONCE(u->scm_rights_notrunc, val); 967 break; 968 969 default: 970 return -ENOPROTOOPT; 971 } 972 973 return 0; 974 } 975 976 static const struct proto_ops unix_stream_ops = { 977 .family = PF_UNIX, 978 .owner = THIS_MODULE, 979 .release = unix_release, 980 .bind = unix_bind, 981 .connect = unix_stream_connect, 982 .socketpair = unix_socketpair, 983 .accept = unix_accept, 984 .getname = unix_getname, 985 .poll = unix_poll, 986 .ioctl = unix_ioctl, 987 #ifdef CONFIG_COMPAT 988 .compat_ioctl = unix_compat_ioctl, 989 #endif 990 .listen = unix_listen, 991 .shutdown = unix_shutdown, 992 .setsockopt = unix_setsockopt, 993 .sendmsg = unix_stream_sendmsg, 994 .recvmsg = unix_stream_recvmsg, 995 .read_skb = unix_stream_read_skb, 996 .mmap = sock_no_mmap, 997 .splice_read = unix_stream_splice_read, 998 .set_peek_off = sk_set_peek_off, 999 .show_fdinfo = unix_show_fdinfo, 1000 }; 1001 1002 static const struct proto_ops unix_dgram_ops = { 1003 .family = PF_UNIX, 1004 .owner = THIS_MODULE, 1005 .release = unix_release, 1006 .bind = unix_bind, 1007 .connect = unix_dgram_connect, 1008 .socketpair = unix_socketpair, 1009 .accept = sock_no_accept, 1010 .getname = unix_getname, 1011 .poll = unix_dgram_poll, 1012 .ioctl = unix_ioctl, 1013 #ifdef CONFIG_COMPAT 1014 .compat_ioctl = unix_compat_ioctl, 1015 #endif 1016 .listen = sock_no_listen, 1017 .shutdown = unix_shutdown, 1018 .setsockopt = unix_setsockopt, 1019 .sendmsg = unix_dgram_sendmsg, 1020 .read_skb = unix_read_skb, 1021 .recvmsg = unix_dgram_recvmsg, 1022 .mmap = sock_no_mmap, 1023 .set_peek_off = sk_set_peek_off, 1024 .show_fdinfo = unix_show_fdinfo, 1025 }; 1026 1027 static const struct proto_ops unix_seqpacket_ops = { 1028 .family = PF_UNIX, 1029 .owner = THIS_MODULE, 1030 .release = unix_release, 1031 .bind = unix_bind, 1032 .connect = unix_stream_connect, 1033 .socketpair = unix_socketpair, 1034 .accept = unix_accept, 1035 .getname = unix_getname, 1036 .poll = unix_dgram_poll, 1037 .ioctl = unix_ioctl, 1038 #ifdef CONFIG_COMPAT 1039 .compat_ioctl = unix_compat_ioctl, 1040 #endif 1041 .listen = unix_listen, 1042 .shutdown = unix_shutdown, 1043 .setsockopt = unix_setsockopt, 1044 .sendmsg = unix_seqpacket_sendmsg, 1045 .recvmsg = unix_seqpacket_recvmsg, 1046 .mmap = sock_no_mmap, 1047 .set_peek_off = sk_set_peek_off, 1048 .show_fdinfo = unix_show_fdinfo, 1049 }; 1050 1051 static void unix_close(struct sock *sk, long timeout) 1052 { 1053 /* Nothing to do here, unix socket does not need a ->close(). 1054 * This is merely for sockmap. 1055 */ 1056 } 1057 1058 static bool unix_bpf_bypass_getsockopt(int level, int optname) 1059 { 1060 if (level == SOL_SOCKET) { 1061 switch (optname) { 1062 case SO_PEERPIDFD: 1063 return true; 1064 default: 1065 return false; 1066 } 1067 } 1068 1069 return false; 1070 } 1071 1072 struct proto unix_dgram_proto = { 1073 .name = "UNIX", 1074 .owner = THIS_MODULE, 1075 .obj_size = sizeof(struct unix_sock), 1076 .close = unix_close, 1077 .bpf_bypass_getsockopt = unix_bpf_bypass_getsockopt, 1078 #ifdef CONFIG_BPF_SYSCALL 1079 .psock_update_sk_prot = unix_dgram_bpf_update_proto, 1080 #endif 1081 }; 1082 1083 struct proto unix_stream_proto = { 1084 .name = "UNIX-STREAM", 1085 .owner = THIS_MODULE, 1086 .obj_size = sizeof(struct unix_sock), 1087 .close = unix_close, 1088 .bpf_bypass_getsockopt = unix_bpf_bypass_getsockopt, 1089 #ifdef CONFIG_BPF_SYSCALL 1090 .psock_update_sk_prot = unix_stream_bpf_update_proto, 1091 #endif 1092 }; 1093 1094 static struct sock *unix_create1(struct net *net, struct socket *sock, int kern, int type) 1095 { 1096 struct unix_sock *u; 1097 struct sock *sk; 1098 int err; 1099 1100 atomic_long_inc(&unix_nr_socks); 1101 if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files()) { 1102 err = -ENFILE; 1103 goto err; 1104 } 1105 1106 if (type == SOCK_STREAM) 1107 sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_stream_proto, kern); 1108 else /*dgram and seqpacket */ 1109 sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_dgram_proto, kern); 1110 1111 if (!sk) { 1112 err = -ENOMEM; 1113 goto err; 1114 } 1115 1116 sock_init_data(sock, sk); 1117 1118 sk->sk_scm_rights = 1; 1119 sk->sk_hash = unix_unbound_hash(sk); 1120 sk->sk_allocation = GFP_KERNEL_ACCOUNT; 1121 sk->sk_write_space = unix_write_space; 1122 sk->sk_max_ack_backlog = READ_ONCE(net->unx.sysctl_max_dgram_qlen); 1123 sk->sk_destruct = unix_sock_destructor; 1124 lock_set_cmp_fn(&sk->sk_receive_queue.lock, unix_recvq_lock_cmp_fn, NULL); 1125 1126 u = unix_sk(sk); 1127 u->listener = NULL; 1128 u->vertex = NULL; 1129 u->path.dentry = NULL; 1130 u->path.mnt = NULL; 1131 spin_lock_init(&u->lock); 1132 lock_set_cmp_fn(&u->lock, unix_state_lock_cmp_fn, NULL); 1133 mutex_init(&u->iolock); /* single task reading lock */ 1134 mutex_init(&u->bindlock); /* single task binding lock */ 1135 init_waitqueue_head(&u->peer_wait); 1136 init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay); 1137 memset(&u->scm_stat, 0, sizeof(struct scm_stat)); 1138 unix_insert_unbound_socket(net, sk); 1139 1140 sock_prot_inuse_add(net, sk->sk_prot, 1); 1141 1142 return sk; 1143 1144 err: 1145 atomic_long_dec(&unix_nr_socks); 1146 return ERR_PTR(err); 1147 } 1148 1149 static int unix_create(struct net *net, struct socket *sock, int protocol, 1150 int kern) 1151 { 1152 struct sock *sk; 1153 1154 if (protocol && protocol != PF_UNIX) 1155 return -EPROTONOSUPPORT; 1156 1157 set_bit(SOCK_CUSTOM_SOCKOPT, &sock->flags); 1158 1159 switch (sock->type) { 1160 case SOCK_STREAM: 1161 sock->ops = &unix_stream_ops; 1162 break; 1163 /* 1164 * Believe it or not BSD has AF_UNIX, SOCK_RAW though 1165 * nothing uses it. 1166 */ 1167 case SOCK_RAW: 1168 sock->type = SOCK_DGRAM; 1169 fallthrough; 1170 case SOCK_DGRAM: 1171 sock->ops = &unix_dgram_ops; 1172 break; 1173 case SOCK_SEQPACKET: 1174 sock->ops = &unix_seqpacket_ops; 1175 break; 1176 default: 1177 return -ESOCKTNOSUPPORT; 1178 } 1179 1180 sk = unix_create1(net, sock, kern, sock->type); 1181 if (IS_ERR(sk)) 1182 return PTR_ERR(sk); 1183 1184 return 0; 1185 } 1186 1187 static int unix_release(struct socket *sock) 1188 { 1189 struct sock *sk = sock->sk; 1190 1191 if (!sk) 1192 return 0; 1193 1194 sk->sk_prot->close(sk, 0); 1195 unix_release_sock(sk, 0); 1196 sock->sk = NULL; 1197 1198 return 0; 1199 } 1200 1201 static struct sock *unix_find_bsd(struct sockaddr_un *sunaddr, int addr_len, 1202 int type, int flags) 1203 { 1204 struct inode *inode; 1205 struct path path; 1206 struct sock *sk; 1207 int err; 1208 1209 unix_mkname_bsd(sunaddr, addr_len); 1210 1211 if (flags & SOCK_COREDUMP) { 1212 scoped_with_init_fs() { 1213 scoped_with_kernel_creds() 1214 err = kern_path(sunaddr->sun_path, 1215 LOOKUP_NO_SYMLINKS | 1216 LOOKUP_NO_MAGICLINKS, &path); 1217 } 1218 if (err) 1219 goto fail; 1220 } else { 1221 err = kern_path(sunaddr->sun_path, LOOKUP_FOLLOW, &path); 1222 if (err) 1223 goto fail; 1224 1225 err = path_permission(&path, MAY_WRITE); 1226 if (err) 1227 goto path_put; 1228 } 1229 1230 err = -ECONNREFUSED; 1231 inode = d_backing_inode(path.dentry); 1232 if (!S_ISSOCK(inode->i_mode)) 1233 goto path_put; 1234 1235 sk = unix_find_socket_byinode(inode); 1236 if (!sk) 1237 goto path_put; 1238 1239 err = -EPROTOTYPE; 1240 if (sk->sk_type != type) 1241 goto sock_put; 1242 1243 err = security_unix_find(&path, sk, flags); 1244 if (err) 1245 goto sock_put; 1246 1247 touch_atime(&path); 1248 1249 path_put(&path); 1250 1251 return sk; 1252 1253 sock_put: 1254 sock_put(sk); 1255 path_put: 1256 path_put(&path); 1257 fail: 1258 return ERR_PTR(err); 1259 } 1260 1261 static struct sock *unix_find_abstract(struct net *net, 1262 struct sockaddr_un *sunaddr, 1263 int addr_len, int type) 1264 { 1265 unsigned int hash = unix_abstract_hash(sunaddr, addr_len, type); 1266 struct dentry *dentry; 1267 struct sock *sk; 1268 1269 sk = unix_find_socket_byname(net, sunaddr, addr_len, hash); 1270 if (!sk) 1271 return ERR_PTR(-ECONNREFUSED); 1272 1273 dentry = unix_sk(sk)->path.dentry; 1274 if (dentry) 1275 touch_atime(&unix_sk(sk)->path); 1276 1277 return sk; 1278 } 1279 1280 static struct sock *unix_find_other(struct net *net, 1281 struct sockaddr_un *sunaddr, 1282 int addr_len, int type, int flags) 1283 { 1284 struct sock *sk; 1285 1286 if (sunaddr->sun_path[0]) 1287 sk = unix_find_bsd(sunaddr, addr_len, type, flags); 1288 else 1289 sk = unix_find_abstract(net, sunaddr, addr_len, type); 1290 1291 return sk; 1292 } 1293 1294 static int unix_autobind(struct sock *sk) 1295 { 1296 struct unix_sock *u = unix_sk(sk); 1297 unsigned int new_hash, old_hash; 1298 struct net *net = sock_net(sk); 1299 struct unix_address *addr; 1300 u32 lastnum, ordernum; 1301 int err; 1302 1303 err = mutex_lock_interruptible(&u->bindlock); 1304 if (err) 1305 return err; 1306 1307 if (u->addr) 1308 goto out; 1309 1310 err = -ENOMEM; 1311 addr = kzalloc(sizeof(*addr) + 1312 offsetof(struct sockaddr_un, sun_path) + 16, GFP_KERNEL); 1313 if (!addr) 1314 goto out; 1315 1316 addr->len = offsetof(struct sockaddr_un, sun_path) + 6; 1317 addr->name->sun_family = AF_UNIX; 1318 refcount_set(&addr->refcnt, 1); 1319 1320 old_hash = sk->sk_hash; 1321 ordernum = get_random_u32(); 1322 lastnum = ordernum & 0xFFFFF; 1323 retry: 1324 ordernum = (ordernum + 1) & 0xFFFFF; 1325 sprintf(addr->name->sun_path + 1, "%05x", ordernum); 1326 1327 new_hash = unix_abstract_hash(addr->name, addr->len, sk->sk_type); 1328 unix_table_double_lock(net, old_hash, new_hash); 1329 1330 if (__unix_find_socket_byname(net, addr->name, addr->len, new_hash)) { 1331 unix_table_double_unlock(net, old_hash, new_hash); 1332 1333 /* __unix_find_socket_byname() may take long time if many names 1334 * are already in use. 1335 */ 1336 cond_resched(); 1337 1338 if (ordernum == lastnum) { 1339 /* Give up if all names seems to be in use. */ 1340 err = -ENOSPC; 1341 unix_release_addr(addr); 1342 goto out; 1343 } 1344 1345 goto retry; 1346 } 1347 1348 __unix_set_addr_hash(net, sk, addr, new_hash); 1349 unix_table_double_unlock(net, old_hash, new_hash); 1350 err = 0; 1351 1352 out: mutex_unlock(&u->bindlock); 1353 return err; 1354 } 1355 1356 static int unix_bind_bsd(struct sock *sk, struct sockaddr_un *sunaddr, 1357 int addr_len) 1358 { 1359 umode_t mode = S_IFSOCK | 1360 (SOCK_INODE(sk->sk_socket)->i_mode & ~current_umask()); 1361 struct unix_sock *u = unix_sk(sk); 1362 unsigned int new_hash, old_hash; 1363 struct net *net = sock_net(sk); 1364 struct mnt_idmap *idmap; 1365 struct unix_address *addr; 1366 struct dentry *dentry; 1367 struct path parent; 1368 int err; 1369 1370 addr_len = unix_mkname_bsd(sunaddr, addr_len); 1371 addr = unix_create_addr(sunaddr, addr_len); 1372 if (!addr) 1373 return -ENOMEM; 1374 1375 /* 1376 * Get the parent directory, calculate the hash for last 1377 * component. 1378 */ 1379 dentry = start_creating_path(AT_FDCWD, addr->name->sun_path, &parent, 0); 1380 if (IS_ERR(dentry)) { 1381 err = PTR_ERR(dentry); 1382 goto out; 1383 } 1384 1385 /* 1386 * All right, let's create it. 1387 */ 1388 idmap = mnt_idmap(parent.mnt); 1389 err = security_path_mknod(&parent, dentry, mode, 0); 1390 if (!err) 1391 err = vfs_mknod(idmap, d_inode(parent.dentry), dentry, mode, 0, NULL); 1392 if (err) 1393 goto out_path; 1394 err = mutex_lock_interruptible(&u->bindlock); 1395 if (err) 1396 goto out_unlink; 1397 if (u->addr) 1398 goto out_unlock; 1399 1400 old_hash = sk->sk_hash; 1401 new_hash = unix_bsd_hash(d_backing_inode(dentry)); 1402 unix_table_double_lock(net, old_hash, new_hash); 1403 u->path.mnt = mntget(parent.mnt); 1404 u->path.dentry = dget(dentry); 1405 __unix_set_addr_hash(net, sk, addr, new_hash); 1406 unix_table_double_unlock(net, old_hash, new_hash); 1407 unix_insert_bsd_socket(sk); 1408 mutex_unlock(&u->bindlock); 1409 end_creating_path(&parent, dentry); 1410 return 0; 1411 1412 out_unlock: 1413 mutex_unlock(&u->bindlock); 1414 err = -EINVAL; 1415 out_unlink: 1416 /* failed after successful mknod? unlink what we'd created... */ 1417 vfs_unlink(idmap, d_inode(parent.dentry), dentry, NULL); 1418 out_path: 1419 end_creating_path(&parent, dentry); 1420 out: 1421 unix_release_addr(addr); 1422 return err == -EEXIST ? -EADDRINUSE : err; 1423 } 1424 1425 static int unix_bind_abstract(struct sock *sk, struct sockaddr_un *sunaddr, 1426 int addr_len) 1427 { 1428 struct unix_sock *u = unix_sk(sk); 1429 unsigned int new_hash, old_hash; 1430 struct net *net = sock_net(sk); 1431 struct unix_address *addr; 1432 int err; 1433 1434 addr = unix_create_addr(sunaddr, addr_len); 1435 if (!addr) 1436 return -ENOMEM; 1437 1438 err = mutex_lock_interruptible(&u->bindlock); 1439 if (err) 1440 goto out; 1441 1442 if (u->addr) { 1443 err = -EINVAL; 1444 goto out_mutex; 1445 } 1446 1447 old_hash = sk->sk_hash; 1448 new_hash = unix_abstract_hash(addr->name, addr->len, sk->sk_type); 1449 unix_table_double_lock(net, old_hash, new_hash); 1450 1451 if (__unix_find_socket_byname(net, addr->name, addr->len, new_hash)) 1452 goto out_spin; 1453 1454 __unix_set_addr_hash(net, sk, addr, new_hash); 1455 unix_table_double_unlock(net, old_hash, new_hash); 1456 mutex_unlock(&u->bindlock); 1457 return 0; 1458 1459 out_spin: 1460 unix_table_double_unlock(net, old_hash, new_hash); 1461 err = -EADDRINUSE; 1462 out_mutex: 1463 mutex_unlock(&u->bindlock); 1464 out: 1465 unix_release_addr(addr); 1466 return err; 1467 } 1468 1469 static int unix_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int addr_len) 1470 { 1471 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr; 1472 struct sock *sk = sock->sk; 1473 int err; 1474 1475 if (addr_len == offsetof(struct sockaddr_un, sun_path) && 1476 sunaddr->sun_family == AF_UNIX) 1477 return unix_autobind(sk); 1478 1479 err = unix_validate_addr(sunaddr, addr_len); 1480 if (err) 1481 return err; 1482 1483 if (sunaddr->sun_path[0]) 1484 err = unix_bind_bsd(sk, sunaddr, addr_len); 1485 else 1486 err = unix_bind_abstract(sk, sunaddr, addr_len); 1487 1488 return err; 1489 } 1490 1491 static void unix_state_double_lock(struct sock *sk1, struct sock *sk2) 1492 { 1493 if (unlikely(sk1 == sk2) || !sk2) { 1494 unix_state_lock(sk1); 1495 return; 1496 } 1497 1498 if (sk1 > sk2) 1499 swap(sk1, sk2); 1500 1501 unix_state_lock(sk1); 1502 unix_state_lock(sk2); 1503 } 1504 1505 static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2) 1506 { 1507 if (unlikely(sk1 == sk2) || !sk2) { 1508 unix_state_unlock(sk1); 1509 return; 1510 } 1511 unix_state_unlock(sk1); 1512 unix_state_unlock(sk2); 1513 } 1514 1515 static int unix_dgram_connect(struct socket *sock, struct sockaddr_unsized *addr, 1516 int alen, int flags) 1517 { 1518 struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr; 1519 struct sock *sk = sock->sk; 1520 struct sock *other; 1521 int err; 1522 1523 err = -EINVAL; 1524 if (alen < offsetofend(struct sockaddr, sa_family)) 1525 goto out; 1526 1527 if (addr->sa_family != AF_UNSPEC) { 1528 err = unix_validate_addr(sunaddr, alen); 1529 if (err) 1530 goto out; 1531 1532 err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, addr, &alen); 1533 if (err) 1534 goto out; 1535 1536 if (unix_may_passcred(sk) && !READ_ONCE(unix_sk(sk)->addr)) { 1537 err = unix_autobind(sk); 1538 if (err) 1539 goto out; 1540 } 1541 1542 restart: 1543 other = unix_find_other(sock_net(sk), sunaddr, alen, sock->type, 0); 1544 if (IS_ERR(other)) { 1545 err = PTR_ERR(other); 1546 goto out; 1547 } 1548 1549 unix_state_double_lock(sk, other); 1550 1551 /* Apparently VFS overslept socket death. Retry. */ 1552 if (sock_flag(other, SOCK_DEAD)) { 1553 unix_state_double_unlock(sk, other); 1554 sock_put(other); 1555 goto restart; 1556 } 1557 1558 err = -EPERM; 1559 if (!unix_may_send(sk, other)) 1560 goto out_unlock; 1561 1562 err = security_unix_may_send(sk->sk_socket, other->sk_socket); 1563 if (err) 1564 goto out_unlock; 1565 1566 WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED); 1567 WRITE_ONCE(other->sk_state, TCP_ESTABLISHED); 1568 } else { 1569 /* 1570 * 1003.1g breaking connected state with AF_UNSPEC 1571 */ 1572 other = NULL; 1573 unix_state_double_lock(sk, other); 1574 } 1575 1576 /* 1577 * If it was connected, reconnect. 1578 */ 1579 if (unix_peer(sk)) { 1580 struct sock *old_peer = unix_peer(sk); 1581 1582 unix_peer(sk) = other; 1583 if (!other) 1584 WRITE_ONCE(sk->sk_state, TCP_CLOSE); 1585 unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer); 1586 1587 unix_state_double_unlock(sk, other); 1588 1589 if (other != old_peer) { 1590 unix_dgram_disconnected(sk, old_peer); 1591 1592 unix_state_lock(old_peer); 1593 if (!unix_peer(old_peer)) 1594 WRITE_ONCE(old_peer->sk_state, TCP_CLOSE); 1595 unix_state_unlock(old_peer); 1596 } 1597 1598 sock_put(old_peer); 1599 } else { 1600 unix_peer(sk) = other; 1601 unix_state_double_unlock(sk, other); 1602 } 1603 1604 return 0; 1605 1606 out_unlock: 1607 unix_state_double_unlock(sk, other); 1608 sock_put(other); 1609 out: 1610 return err; 1611 } 1612 1613 static long unix_wait_for_peer(struct sock *other, long timeo) 1614 { 1615 struct unix_sock *u = unix_sk(other); 1616 int sched; 1617 DEFINE_WAIT(wait); 1618 1619 prepare_to_wait_exclusive(&u->peer_wait, &wait, TASK_INTERRUPTIBLE); 1620 1621 sched = !sock_flag(other, SOCK_DEAD) && 1622 !(other->sk_shutdown & RCV_SHUTDOWN) && 1623 unix_recvq_full_lockless(other); 1624 1625 unix_state_unlock(other); 1626 1627 if (sched) 1628 timeo = schedule_timeout(timeo); 1629 1630 finish_wait(&u->peer_wait, &wait); 1631 return timeo; 1632 } 1633 1634 static int unix_stream_connect(struct socket *sock, struct sockaddr_unsized *uaddr, 1635 int addr_len, int flags) 1636 { 1637 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr; 1638 struct sock *sk = sock->sk, *newsk = NULL, *other = NULL; 1639 struct unix_sock *u = unix_sk(sk), *newu, *otheru; 1640 struct unix_peercred peercred = {}; 1641 struct net *net = sock_net(sk); 1642 struct sk_buff *skb = NULL; 1643 unsigned char state; 1644 long timeo; 1645 int err; 1646 1647 err = unix_validate_addr(sunaddr, addr_len); 1648 if (err) 1649 goto out; 1650 1651 err = BPF_CGROUP_RUN_PROG_UNIX_CONNECT_LOCK(sk, uaddr, &addr_len); 1652 if (err) 1653 goto out; 1654 1655 if (unix_may_passcred(sk) && !READ_ONCE(u->addr)) { 1656 err = unix_autobind(sk); 1657 if (err) 1658 goto out; 1659 } 1660 1661 timeo = sock_sndtimeo(sk, flags & O_NONBLOCK); 1662 1663 err = prepare_peercred(&peercred); 1664 if (err) 1665 goto out; 1666 1667 /* create new sock for complete connection */ 1668 newsk = unix_create1(net, NULL, 0, sock->type); 1669 if (IS_ERR(newsk)) { 1670 err = PTR_ERR(newsk); 1671 goto out; 1672 } 1673 1674 /* Allocate skb for sending to listening sock */ 1675 skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL); 1676 if (!skb) { 1677 err = -ENOMEM; 1678 goto out_free_sk; 1679 } 1680 1681 restart: 1682 /* Find listening sock. */ 1683 other = unix_find_other(net, sunaddr, addr_len, sk->sk_type, flags); 1684 if (IS_ERR(other)) { 1685 err = PTR_ERR(other); 1686 goto out_free_skb; 1687 } 1688 1689 unix_state_lock(other); 1690 1691 /* Apparently VFS overslept socket death. Retry. */ 1692 if (sock_flag(other, SOCK_DEAD)) { 1693 unix_state_unlock(other); 1694 sock_put(other); 1695 goto restart; 1696 } 1697 1698 if (other->sk_state != TCP_LISTEN || 1699 other->sk_shutdown & RCV_SHUTDOWN) { 1700 err = -ECONNREFUSED; 1701 goto out_unlock; 1702 } 1703 1704 if (unix_recvq_full_lockless(other)) { 1705 if (!timeo) { 1706 err = -EAGAIN; 1707 goto out_unlock; 1708 } 1709 1710 timeo = unix_wait_for_peer(other, timeo); 1711 sock_put(other); 1712 1713 err = sock_intr_errno(timeo); 1714 if (signal_pending(current)) 1715 goto out_free_skb; 1716 1717 goto restart; 1718 } 1719 1720 /* self connect and simultaneous connect are eliminated 1721 * by rejecting TCP_LISTEN socket to avoid deadlock. 1722 */ 1723 state = READ_ONCE(sk->sk_state); 1724 if (unlikely(state != TCP_CLOSE)) { 1725 err = state == TCP_ESTABLISHED ? -EISCONN : -EINVAL; 1726 goto out_unlock; 1727 } 1728 1729 unix_state_lock(sk); 1730 1731 if (unlikely(sk->sk_state != TCP_CLOSE)) { 1732 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EINVAL; 1733 unix_state_unlock(sk); 1734 goto out_unlock; 1735 } 1736 1737 err = security_unix_stream_connect(sk, other, newsk); 1738 if (err) { 1739 unix_state_unlock(sk); 1740 goto out_unlock; 1741 } 1742 1743 /* The way is open! Fastly set all the necessary fields... */ 1744 1745 sock_hold(sk); 1746 unix_peer(newsk) = sk; 1747 newsk->sk_state = TCP_ESTABLISHED; 1748 newsk->sk_type = sk->sk_type; 1749 newsk->sk_scm_recv_flags = other->sk_scm_recv_flags; 1750 init_peercred(newsk, &peercred); 1751 1752 newu = unix_sk(newsk); 1753 otheru = unix_sk(other); 1754 newu->listener = other; 1755 newu->scm_rights_notrunc = READ_ONCE(otheru->scm_rights_notrunc); 1756 RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq); 1757 1758 /* copy address information from listening to new sock 1759 * 1760 * The contents of *(otheru->addr) and otheru->path 1761 * are seen fully set up here, since we have found 1762 * otheru in hash under its lock. Insertion into the 1763 * hash chain we'd found it in had been done in an 1764 * earlier critical area protected by the chain's lock, 1765 * the same one where we'd set *(otheru->addr) contents, 1766 * as well as otheru->path and otheru->addr itself. 1767 * 1768 * Using smp_store_release() here to set newu->addr 1769 * is enough to make those stores, as well as stores 1770 * to newu->path visible to anyone who gets newu->addr 1771 * by smp_load_acquire(). IOW, the same warranties 1772 * as for unix_sock instances bound in unix_bind() or 1773 * in unix_autobind(). 1774 */ 1775 if (otheru->path.dentry) { 1776 path_get(&otheru->path); 1777 newu->path = otheru->path; 1778 } 1779 refcount_inc(&otheru->addr->refcnt); 1780 smp_store_release(&newu->addr, otheru->addr); 1781 1782 /* Set credentials */ 1783 copy_peercred(sk, other); 1784 1785 WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED); 1786 sock_hold(newsk); 1787 1788 smp_mb__after_atomic(); /* sock_hold() does an atomic_inc() */ 1789 unix_peer(sk) = newsk; 1790 1791 unix_state_unlock(sk); 1792 1793 /* take ten and send info to listening sock */ 1794 spin_lock(&other->sk_receive_queue.lock); 1795 __skb_queue_tail(&other->sk_receive_queue, skb); 1796 spin_unlock(&other->sk_receive_queue.lock); 1797 unix_state_unlock(other); 1798 READ_ONCE(other->sk_data_ready)(other); 1799 sock_put(other); 1800 return 0; 1801 1802 out_unlock: 1803 unix_state_unlock(other); 1804 sock_put(other); 1805 out_free_skb: 1806 consume_skb(skb); 1807 out_free_sk: 1808 unix_release_sock(newsk, 0); 1809 out: 1810 drop_peercred(&peercred); 1811 return err; 1812 } 1813 1814 static int unix_socketpair(struct socket *socka, struct socket *sockb) 1815 { 1816 struct unix_peercred ska_peercred = {}, skb_peercred = {}; 1817 struct sock *ska = socka->sk, *skb = sockb->sk; 1818 int err; 1819 1820 err = prepare_peercred(&ska_peercred); 1821 if (err) 1822 return err; 1823 1824 err = prepare_peercred(&skb_peercred); 1825 if (err) { 1826 drop_peercred(&ska_peercred); 1827 return err; 1828 } 1829 1830 /* Join our sockets back to back */ 1831 sock_hold(ska); 1832 sock_hold(skb); 1833 unix_peer(ska) = skb; 1834 unix_peer(skb) = ska; 1835 init_peercred(ska, &ska_peercred); 1836 init_peercred(skb, &skb_peercred); 1837 1838 ska->sk_state = TCP_ESTABLISHED; 1839 skb->sk_state = TCP_ESTABLISHED; 1840 1841 return 0; 1842 } 1843 1844 static int unix_accept(struct socket *sock, struct socket *newsock, 1845 struct proto_accept_arg *arg) 1846 { 1847 struct sock *sk = sock->sk; 1848 struct sk_buff *skb; 1849 struct sock *tsk; 1850 1851 arg->err = -EOPNOTSUPP; 1852 if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET) 1853 goto out; 1854 1855 arg->err = -EINVAL; 1856 if (READ_ONCE(sk->sk_state) != TCP_LISTEN) 1857 goto out; 1858 1859 /* If socket state is TCP_LISTEN it cannot change (for now...), 1860 * so that no locks are necessary. 1861 */ 1862 1863 skb = skb_recv_datagram(sk, (arg->flags & O_NONBLOCK) ? MSG_DONTWAIT : 0, 1864 &arg->err); 1865 if (!skb) { 1866 /* This means receive shutdown. */ 1867 if (arg->err == 0) 1868 arg->err = -EINVAL; 1869 goto out; 1870 } 1871 1872 tsk = skb->sk; 1873 skb_free_datagram(sk, skb); 1874 wake_up_interruptible(&unix_sk(sk)->peer_wait); 1875 1876 set_bit(SOCK_CUSTOM_SOCKOPT, &newsock->flags); 1877 1878 /* attach accepted sock to socket */ 1879 unix_state_lock(tsk); 1880 unix_update_edges(unix_sk(tsk)); 1881 sock_graft(tsk, newsock); 1882 unix_state_unlock(tsk); 1883 return 0; 1884 1885 out: 1886 return arg->err; 1887 } 1888 1889 1890 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer) 1891 { 1892 struct sock *sk = sock->sk; 1893 struct unix_address *addr; 1894 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr); 1895 int err = 0; 1896 1897 if (peer) { 1898 sk = unix_peer_get(sk); 1899 1900 err = -ENOTCONN; 1901 if (!sk) 1902 goto out; 1903 err = 0; 1904 } else { 1905 sock_hold(sk); 1906 } 1907 1908 addr = smp_load_acquire(&unix_sk(sk)->addr); 1909 if (!addr) { 1910 sunaddr->sun_family = AF_UNIX; 1911 sunaddr->sun_path[0] = 0; 1912 err = offsetof(struct sockaddr_un, sun_path); 1913 } else { 1914 err = addr->len; 1915 memcpy(sunaddr, addr->name, addr->len); 1916 1917 if (peer) 1918 BPF_CGROUP_RUN_SA_PROG(sk, uaddr, &err, 1919 CGROUP_UNIX_GETPEERNAME); 1920 else 1921 BPF_CGROUP_RUN_SA_PROG(sk, uaddr, &err, 1922 CGROUP_UNIX_GETSOCKNAME); 1923 } 1924 sock_put(sk); 1925 out: 1926 return err; 1927 } 1928 1929 /* The "user->unix_inflight" variable is protected by the garbage 1930 * collection lock, and we just read it locklessly here. If you go 1931 * over the limit, there might be a tiny race in actually noticing 1932 * it across threads. Tough. 1933 */ 1934 static inline bool too_many_unix_fds(struct task_struct *p) 1935 { 1936 struct user_struct *user = current_user(); 1937 1938 if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE))) 1939 return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); 1940 return false; 1941 } 1942 1943 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) 1944 { 1945 if (too_many_unix_fds(current)) 1946 return -ETOOMANYREFS; 1947 1948 UNIXCB(skb).fp = scm->fp; 1949 scm->fp = NULL; 1950 1951 if (unix_prepare_fpl(UNIXCB(skb).fp)) 1952 return -ENOMEM; 1953 1954 return 0; 1955 } 1956 1957 static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) 1958 { 1959 scm->fp = UNIXCB(skb).fp; 1960 UNIXCB(skb).fp = NULL; 1961 1962 unix_destroy_fpl(scm->fp); 1963 } 1964 1965 static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) 1966 { 1967 scm->fp = scm_fp_dup(UNIXCB(skb).fp); 1968 1969 unix_peek_fpl(scm->fp); 1970 } 1971 1972 static void unix_destruct_scm(struct sk_buff *skb) 1973 { 1974 struct scm_cookie scm = {}; 1975 1976 swap(scm.pid, UNIXCB(skb).pid); 1977 1978 if (UNIXCB(skb).fp) 1979 unix_detach_fds(&scm, skb); 1980 1981 scm_destroy(&scm); 1982 } 1983 1984 static void unix_wfree(struct sk_buff *skb) 1985 { 1986 unix_destruct_scm(skb); 1987 sock_wfree(skb); 1988 } 1989 1990 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) 1991 { 1992 int err = 0; 1993 1994 UNIXCB(skb).pid = get_pid(scm->pid); 1995 UNIXCB(skb).uid = scm->creds.uid; 1996 UNIXCB(skb).gid = scm->creds.gid; 1997 UNIXCB(skb).fp = NULL; 1998 unix_get_secdata(scm, skb); 1999 if (scm->fp && send_fds) 2000 err = unix_attach_fds(scm, skb); 2001 2002 skb->destructor = unix_wfree; 2003 return err; 2004 } 2005 2006 static void unix_skb_to_scm(struct sk_buff *skb, struct scm_cookie *scm) 2007 { 2008 scm_set_cred(scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid); 2009 unix_set_secdata(scm, skb); 2010 } 2011 2012 /** 2013 * unix_maybe_add_creds() - Adds current task uid/gid and struct pid to skb if needed. 2014 * @skb: skb to attach creds to. 2015 * @sk: Sender sock. 2016 * @other: Receiver sock. 2017 * 2018 * Some apps rely on write() giving SCM_CREDENTIALS 2019 * We include credentials if source or destination socket 2020 * asserted SOCK_PASSCRED. 2021 * 2022 * Context: May sleep. 2023 * Return: On success zero, on error a negative error code is returned. 2024 */ 2025 static int unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk, 2026 const struct sock *other) 2027 { 2028 if (UNIXCB(skb).pid) 2029 return 0; 2030 2031 if (unix_may_passcred(sk) || unix_may_passcred(other) || 2032 !other->sk_socket) { 2033 struct pid *pid; 2034 int err; 2035 2036 pid = task_tgid(current); 2037 err = pidfs_register_pid(pid); 2038 if (unlikely(err)) 2039 return err; 2040 2041 UNIXCB(skb).pid = get_pid(pid); 2042 current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid); 2043 } 2044 2045 return 0; 2046 } 2047 2048 static bool unix_skb_scm_eq(struct sk_buff *skb, 2049 struct scm_cookie *scm) 2050 { 2051 return UNIXCB(skb).pid == scm->pid && 2052 uid_eq(UNIXCB(skb).uid, scm->creds.uid) && 2053 gid_eq(UNIXCB(skb).gid, scm->creds.gid) && 2054 unix_secdata_eq(scm, skb); 2055 } 2056 2057 static void scm_stat_add(struct sock *sk, struct sk_buff *skb) 2058 { 2059 struct scm_fp_list *fp = UNIXCB(skb).fp; 2060 struct unix_sock *u = unix_sk(sk); 2061 2062 if (unlikely(fp && fp->count)) { 2063 atomic_add(fp->count, &u->scm_stat.nr_fds); 2064 unix_add_edges(fp, u); 2065 } 2066 } 2067 2068 static void scm_stat_del(struct sock *sk, struct sk_buff *skb) 2069 { 2070 struct scm_fp_list *fp = UNIXCB(skb).fp; 2071 struct unix_sock *u = unix_sk(sk); 2072 2073 if (unlikely(fp && fp->count)) { 2074 atomic_sub(fp->count, &u->scm_stat.nr_fds); 2075 unix_del_edges(fp); 2076 } 2077 } 2078 2079 static void unix_orphan_scm(struct sock *sk, struct sk_buff *skb) 2080 { 2081 scm_stat_del(sk, skb); 2082 unix_destruct_scm(skb); 2083 skb->destructor = sock_wfree; 2084 } 2085 2086 /* 2087 * Send AF_UNIX data. 2088 */ 2089 2090 static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, 2091 size_t len) 2092 { 2093 struct sock *sk = sock->sk, *other = NULL; 2094 struct unix_sock *u = unix_sk(sk); 2095 struct scm_cookie scm; 2096 struct sk_buff *skb; 2097 int data_len = 0; 2098 int sk_locked; 2099 long timeo; 2100 int err; 2101 2102 err = scm_send(sock, msg, &scm, false); 2103 if (err < 0) 2104 return err; 2105 2106 if (msg->msg_flags & MSG_OOB) { 2107 err = -EOPNOTSUPP; 2108 goto out; 2109 } 2110 2111 if (msg->msg_namelen) { 2112 err = unix_validate_addr(msg->msg_name, msg->msg_namelen); 2113 if (err) 2114 goto out; 2115 2116 err = BPF_CGROUP_RUN_PROG_UNIX_SENDMSG_LOCK(sk, 2117 msg->msg_name, 2118 &msg->msg_namelen, 2119 NULL); 2120 if (err) 2121 goto out; 2122 } 2123 2124 if (unix_may_passcred(sk) && !READ_ONCE(u->addr)) { 2125 err = unix_autobind(sk); 2126 if (err) 2127 goto out; 2128 } 2129 2130 if (len > READ_ONCE(sk->sk_sndbuf) - 32) { 2131 err = -EMSGSIZE; 2132 goto out; 2133 } 2134 2135 if (len > SKB_MAX_ALLOC) { 2136 data_len = min_t(size_t, 2137 len - SKB_MAX_ALLOC, 2138 MAX_SKB_FRAGS * PAGE_SIZE); 2139 data_len = PAGE_ALIGN(data_len); 2140 2141 BUILD_BUG_ON(SKB_MAX_ALLOC < PAGE_SIZE); 2142 } 2143 2144 skb = sock_alloc_send_pskb(sk, len - data_len, data_len, 2145 msg->msg_flags & MSG_DONTWAIT, &err, 2146 PAGE_ALLOC_COSTLY_ORDER); 2147 if (!skb) 2148 goto out; 2149 2150 err = unix_scm_to_skb(&scm, skb, true); 2151 if (err < 0) 2152 goto out_free; 2153 2154 skb_put(skb, len - data_len); 2155 skb->data_len = data_len; 2156 skb->len = len; 2157 err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, len); 2158 if (err) 2159 goto out_free; 2160 2161 timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 2162 2163 if (msg->msg_namelen) { 2164 lookup: 2165 other = unix_find_other(sock_net(sk), msg->msg_name, 2166 msg->msg_namelen, sk->sk_type, 0); 2167 if (IS_ERR(other)) { 2168 err = PTR_ERR(other); 2169 goto out_free; 2170 } 2171 } else { 2172 other = unix_peer_get(sk); 2173 if (!other) { 2174 err = -ENOTCONN; 2175 goto out_free; 2176 } 2177 } 2178 2179 if (sk_filter(other, skb) < 0) { 2180 /* Toss the packet but do not return any error to the sender */ 2181 err = len; 2182 goto out_sock_put; 2183 } 2184 2185 err = unix_maybe_add_creds(skb, sk, other); 2186 if (err) 2187 goto out_sock_put; 2188 2189 restart: 2190 sk_locked = 0; 2191 unix_state_lock(other); 2192 restart_locked: 2193 2194 if (!unix_may_send(sk, other)) { 2195 err = -EPERM; 2196 goto out_unlock; 2197 } 2198 2199 if (unlikely(sock_flag(other, SOCK_DEAD))) { 2200 /* Check with 1003.1g - what should datagram error */ 2201 2202 unix_state_unlock(other); 2203 2204 if (sk->sk_type == SOCK_SEQPACKET) { 2205 /* We are here only when racing with unix_release_sock() 2206 * is clearing @other. Never change state to TCP_CLOSE 2207 * unlike SOCK_DGRAM wants. 2208 */ 2209 err = -EPIPE; 2210 goto out_sock_put; 2211 } 2212 2213 if (!sk_locked) 2214 unix_state_lock(sk); 2215 2216 if (unix_peer(sk) == other) { 2217 unix_peer(sk) = NULL; 2218 unix_dgram_peer_wake_disconnect_wakeup(sk, other); 2219 2220 WRITE_ONCE(sk->sk_state, TCP_CLOSE); 2221 unix_state_unlock(sk); 2222 2223 unix_dgram_disconnected(sk, other); 2224 sock_put(other); 2225 err = -ECONNREFUSED; 2226 goto out_sock_put; 2227 } 2228 2229 unix_state_unlock(sk); 2230 2231 if (!msg->msg_namelen) { 2232 err = -ECONNRESET; 2233 goto out_sock_put; 2234 } 2235 2236 sock_put(other); 2237 goto lookup; 2238 } 2239 2240 if (other->sk_shutdown & RCV_SHUTDOWN) { 2241 err = -EPIPE; 2242 goto out_unlock; 2243 } 2244 2245 if (UNIXCB(skb).fp && !other->sk_scm_rights) { 2246 err = -EPERM; 2247 goto out_unlock; 2248 } 2249 2250 if (sk->sk_type != SOCK_SEQPACKET) { 2251 err = security_unix_may_send(sk->sk_socket, other->sk_socket); 2252 if (err) 2253 goto out_unlock; 2254 } 2255 2256 /* other == sk && unix_peer(other) != sk if 2257 * - unix_peer(sk) == NULL, destination address bound to sk 2258 * - unix_peer(sk) == sk by time of get but disconnected before lock 2259 */ 2260 if (other != sk && 2261 unlikely(unix_peer(other) != sk && 2262 unix_recvq_full_lockless(other))) { 2263 if (timeo) { 2264 timeo = unix_wait_for_peer(other, timeo); 2265 2266 err = sock_intr_errno(timeo); 2267 if (signal_pending(current)) 2268 goto out_sock_put; 2269 2270 goto restart; 2271 } 2272 2273 if (!sk_locked) { 2274 unix_state_unlock(other); 2275 unix_state_double_lock(sk, other); 2276 } 2277 2278 if (unix_peer(sk) != other || 2279 unix_dgram_peer_wake_me(sk, other)) { 2280 err = -EAGAIN; 2281 sk_locked = 1; 2282 goto out_unlock; 2283 } 2284 2285 if (!sk_locked) { 2286 sk_locked = 1; 2287 goto restart_locked; 2288 } 2289 } 2290 2291 if (unlikely(sk_locked)) 2292 unix_state_unlock(sk); 2293 2294 if (sock_flag(other, SOCK_RCVTSTAMP)) 2295 __net_timestamp(skb); 2296 2297 scm_stat_add(other, skb); 2298 skb_queue_tail(&other->sk_receive_queue, skb); 2299 unix_state_unlock(other); 2300 READ_ONCE(other->sk_data_ready)(other); 2301 sock_put(other); 2302 scm_destroy(&scm); 2303 return len; 2304 2305 out_unlock: 2306 if (sk_locked) 2307 unix_state_unlock(sk); 2308 unix_state_unlock(other); 2309 out_sock_put: 2310 sock_put(other); 2311 out_free: 2312 consume_skb(skb); 2313 out: 2314 scm_destroy(&scm); 2315 return err; 2316 } 2317 2318 /* We use paged skbs for stream sockets, and limit occupancy to 32768 2319 * bytes, and a minimum of a full page. 2320 */ 2321 #define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768)) 2322 2323 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2324 static int queue_oob(struct sock *sk, struct msghdr *msg, struct sock *other, 2325 struct scm_cookie *scm, bool fds_sent) 2326 { 2327 struct unix_sock *ousk = unix_sk(other); 2328 struct sk_buff *skb; 2329 int err; 2330 2331 skb = sock_alloc_send_skb(sk, 1, msg->msg_flags & MSG_DONTWAIT, &err); 2332 2333 if (!skb) 2334 return err; 2335 2336 err = unix_scm_to_skb(scm, skb, !fds_sent); 2337 if (err < 0) 2338 goto out; 2339 2340 err = unix_maybe_add_creds(skb, sk, other); 2341 if (err) 2342 goto out; 2343 2344 skb_put(skb, 1); 2345 err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, 1); 2346 2347 if (err) 2348 goto out; 2349 2350 unix_state_lock(other); 2351 2352 if (sock_flag(other, SOCK_DEAD) || 2353 (other->sk_shutdown & RCV_SHUTDOWN)) { 2354 err = -EPIPE; 2355 goto out_unlock; 2356 } 2357 2358 if (UNIXCB(skb).fp && !other->sk_scm_rights) { 2359 err = -EPERM; 2360 goto out_unlock; 2361 } 2362 2363 scm_stat_add(other, skb); 2364 2365 spin_lock(&other->sk_receive_queue.lock); 2366 WRITE_ONCE(ousk->oob_skb, skb); 2367 WRITE_ONCE(ousk->inq_len, ousk->inq_len + 1); 2368 __skb_queue_tail(&other->sk_receive_queue, skb); 2369 spin_unlock(&other->sk_receive_queue.lock); 2370 2371 sk_send_sigurg(other); 2372 unix_state_unlock(other); 2373 READ_ONCE(other->sk_data_ready)(other); 2374 2375 return 0; 2376 out_unlock: 2377 unix_state_unlock(other); 2378 out: 2379 consume_skb(skb); 2380 return err; 2381 } 2382 #endif 2383 2384 static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, 2385 size_t len) 2386 { 2387 struct sock *sk = sock->sk; 2388 struct sk_buff *skb = NULL; 2389 struct sock *other = NULL; 2390 struct unix_sock *otheru; 2391 struct scm_cookie scm; 2392 bool fds_sent = false; 2393 int err, sent = 0; 2394 2395 err = scm_send(sock, msg, &scm, false); 2396 if (err < 0) 2397 return err; 2398 2399 if (msg->msg_flags & MSG_OOB) { 2400 err = -EOPNOTSUPP; 2401 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2402 if (len) 2403 len--; 2404 else 2405 #endif 2406 goto out_err; 2407 } 2408 2409 if (msg->msg_namelen) { 2410 err = READ_ONCE(sk->sk_state) == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP; 2411 goto out_err; 2412 } 2413 2414 other = unix_peer(sk); 2415 if (!other) { 2416 err = -ENOTCONN; 2417 goto out_err; 2418 } 2419 2420 otheru = unix_sk(other); 2421 2422 if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) 2423 goto out_pipe; 2424 2425 while (sent < len) { 2426 int size = len - sent; 2427 int data_len; 2428 2429 if (unlikely(msg->msg_flags & MSG_SPLICE_PAGES)) { 2430 skb = sock_alloc_send_pskb(sk, 0, 0, 2431 msg->msg_flags & MSG_DONTWAIT, 2432 &err, 0); 2433 } else { 2434 /* Keep two messages in the pipe so it schedules better */ 2435 size = min_t(int, size, (READ_ONCE(sk->sk_sndbuf) >> 1) - 64); 2436 2437 /* allow fallback to order-0 allocations */ 2438 size = min_t(int, size, SKB_MAX_HEAD(0) + UNIX_SKB_FRAGS_SZ); 2439 2440 data_len = max_t(int, 0, size - SKB_MAX_HEAD(0)); 2441 2442 data_len = min_t(size_t, size, PAGE_ALIGN(data_len)); 2443 2444 skb = sock_alloc_send_pskb(sk, size - data_len, data_len, 2445 msg->msg_flags & MSG_DONTWAIT, &err, 2446 get_order(UNIX_SKB_FRAGS_SZ)); 2447 } 2448 if (!skb) 2449 goto out_err; 2450 2451 /* Only send the fds in the first buffer */ 2452 err = unix_scm_to_skb(&scm, skb, !fds_sent); 2453 if (err < 0) 2454 goto out_free; 2455 2456 fds_sent = true; 2457 2458 err = unix_maybe_add_creds(skb, sk, other); 2459 if (err) 2460 goto out_free; 2461 2462 if (unlikely(msg->msg_flags & MSG_SPLICE_PAGES)) { 2463 skb->ip_summed = CHECKSUM_UNNECESSARY; 2464 err = skb_splice_from_iter(skb, &msg->msg_iter, size); 2465 if (err < 0) 2466 goto out_free; 2467 2468 size = err; 2469 refcount_add(size, &sk->sk_wmem_alloc); 2470 } else { 2471 skb_put(skb, size - data_len); 2472 skb->data_len = data_len; 2473 skb->len = size; 2474 err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, size); 2475 if (err) 2476 goto out_free; 2477 } 2478 2479 unix_state_lock(other); 2480 2481 if (sock_flag(other, SOCK_DEAD) || 2482 (other->sk_shutdown & RCV_SHUTDOWN)) 2483 goto out_pipe_unlock; 2484 2485 if (UNIXCB(skb).fp && !other->sk_scm_rights) { 2486 unix_state_unlock(other); 2487 err = -EPERM; 2488 goto out_free; 2489 } 2490 2491 scm_stat_add(other, skb); 2492 2493 spin_lock(&other->sk_receive_queue.lock); 2494 WRITE_ONCE(otheru->inq_len, otheru->inq_len + skb->len); 2495 __skb_queue_tail(&other->sk_receive_queue, skb); 2496 spin_unlock(&other->sk_receive_queue.lock); 2497 2498 unix_state_unlock(other); 2499 READ_ONCE(other->sk_data_ready)(other); 2500 sent += size; 2501 } 2502 2503 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2504 if (msg->msg_flags & MSG_OOB) { 2505 err = queue_oob(sk, msg, other, &scm, fds_sent); 2506 if (err) 2507 goto out_err; 2508 sent++; 2509 } 2510 #endif 2511 2512 scm_destroy(&scm); 2513 2514 return sent; 2515 2516 out_pipe_unlock: 2517 unix_state_unlock(other); 2518 out_pipe: 2519 if (!sent && !(msg->msg_flags & MSG_NOSIGNAL)) 2520 send_sig(SIGPIPE, current, 0); 2521 err = -EPIPE; 2522 out_free: 2523 consume_skb(skb); 2524 out_err: 2525 scm_destroy(&scm); 2526 return sent ? : err; 2527 } 2528 2529 static int unix_seqpacket_sendmsg(struct socket *sock, struct msghdr *msg, 2530 size_t len) 2531 { 2532 int err; 2533 struct sock *sk = sock->sk; 2534 2535 err = sock_error(sk); 2536 if (err) 2537 return err; 2538 2539 if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED) 2540 return -ENOTCONN; 2541 2542 if (msg->msg_namelen) 2543 msg->msg_namelen = 0; 2544 2545 return unix_dgram_sendmsg(sock, msg, len); 2546 } 2547 2548 static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg, 2549 size_t size, int flags) 2550 { 2551 struct sock *sk = sock->sk; 2552 2553 if (READ_ONCE(sk->sk_state) != TCP_ESTABLISHED) 2554 return -ENOTCONN; 2555 2556 return unix_dgram_recvmsg(sock, msg, size, flags); 2557 } 2558 2559 static void unix_copy_addr(struct msghdr *msg, struct sock *sk) 2560 { 2561 struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); 2562 2563 if (addr) { 2564 msg->msg_namelen = addr->len; 2565 memcpy(msg->msg_name, addr->name, addr->len); 2566 } 2567 } 2568 2569 int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size, 2570 int flags) 2571 { 2572 struct scm_cookie scm; 2573 struct socket *sock = sk->sk_socket; 2574 struct unix_sock *u = unix_sk(sk); 2575 struct sk_buff *skb, *last; 2576 long timeo; 2577 int skip; 2578 int err; 2579 2580 err = -EOPNOTSUPP; 2581 if (flags&MSG_OOB) 2582 goto out; 2583 2584 timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); 2585 2586 do { 2587 mutex_lock(&u->iolock); 2588 2589 skip = sk_peek_offset(sk, flags); 2590 skb = __skb_try_recv_datagram(sk, &sk->sk_receive_queue, flags, 2591 &skip, &err, &last); 2592 if (skb) { 2593 if (!(flags & MSG_PEEK)) 2594 scm_stat_del(sk, skb); 2595 break; 2596 } 2597 2598 mutex_unlock(&u->iolock); 2599 2600 if (err != -EAGAIN) 2601 break; 2602 } while (timeo && 2603 !__skb_wait_for_more_packets(sk, &sk->sk_receive_queue, 2604 &err, &timeo, last)); 2605 2606 if (!skb) { /* implies iolock unlocked */ 2607 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */ 2608 if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN && 2609 (READ_ONCE(sk->sk_shutdown) & RCV_SHUTDOWN)) 2610 err = 0; 2611 goto out; 2612 } 2613 2614 if (wq_has_sleeper(&u->peer_wait)) 2615 wake_up_interruptible_sync_poll(&u->peer_wait, 2616 EPOLLOUT | EPOLLWRNORM | 2617 EPOLLWRBAND); 2618 2619 if (msg->msg_name) { 2620 unix_copy_addr(msg, skb->sk); 2621 2622 BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, 2623 msg->msg_name, 2624 &msg->msg_namelen); 2625 } 2626 2627 if (size > skb->len - skip) 2628 size = skb->len - skip; 2629 else if (size < skb->len - skip) 2630 msg->msg_flags |= MSG_TRUNC; 2631 2632 err = skb_copy_datagram_msg(skb, skip, msg, size); 2633 if (err) 2634 goto out_free; 2635 2636 if (sock_flag(sk, SOCK_RCVTSTAMP)) 2637 __sock_recv_timestamp(msg, sk, skb); 2638 2639 memset(&scm, 0, sizeof(scm)); 2640 2641 unix_skb_to_scm(skb, &scm); 2642 2643 if (!(flags & MSG_PEEK)) { 2644 if (UNIXCB(skb).fp) 2645 unix_detach_fds(&scm, skb); 2646 2647 sk_peek_offset_bwd(sk, skb->len); 2648 } else { 2649 /* It is questionable: on PEEK we could: 2650 - do not return fds - good, but too simple 8) 2651 - return fds, and do not return them on read (old strategy, 2652 apparently wrong) 2653 - clone fds (I chose it for now, it is the most universal 2654 solution) 2655 2656 POSIX 1003.1g does not actually define this clearly 2657 at all. POSIX 1003.1g doesn't define a lot of things 2658 clearly however! 2659 2660 */ 2661 2662 sk_peek_offset_fwd(sk, size); 2663 2664 if (UNIXCB(skb).fp) 2665 unix_peek_fds(&scm, skb); 2666 } 2667 err = (flags & MSG_TRUNC) ? skb->len - skip : size; 2668 2669 scm_recv_unix(sock, msg, &scm, flags); 2670 2671 out_free: 2672 skb_free_datagram(sk, skb); 2673 mutex_unlock(&u->iolock); 2674 out: 2675 return err; 2676 } 2677 2678 static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 2679 int flags) 2680 { 2681 struct sock *sk = sock->sk; 2682 2683 #ifdef CONFIG_BPF_SYSCALL 2684 const struct proto *prot = READ_ONCE(sk->sk_prot); 2685 2686 if (prot != &unix_dgram_proto) 2687 return prot->recvmsg(sk, msg, size, flags); 2688 #endif 2689 return __unix_dgram_recvmsg(sk, msg, size, flags); 2690 } 2691 2692 static int unix_read_skb(struct sock *sk, skb_read_actor_t recv_actor) 2693 { 2694 struct unix_sock *u = unix_sk(sk); 2695 struct sk_buff *skb; 2696 int err; 2697 2698 mutex_lock(&u->iolock); 2699 2700 skb = skb_recv_datagram(sk, MSG_DONTWAIT, &err); 2701 if (!skb) { 2702 mutex_unlock(&u->iolock); 2703 return err; 2704 } 2705 2706 unix_orphan_scm(sk, skb); 2707 2708 mutex_unlock(&u->iolock); 2709 2710 return recv_actor(sk, skb); 2711 } 2712 2713 /* 2714 * Sleep until more data has arrived. But check for races.. 2715 */ 2716 static long unix_stream_data_wait(struct sock *sk, long timeo, 2717 struct sk_buff *last, bool freezable) 2718 { 2719 unsigned int state = TASK_INTERRUPTIBLE | freezable * TASK_FREEZABLE; 2720 struct sk_buff *tail; 2721 DEFINE_WAIT(wait); 2722 2723 unix_state_lock(sk); 2724 2725 for (;;) { 2726 prepare_to_wait(sk_sleep(sk), &wait, state); 2727 2728 tail = skb_peek_tail(&sk->sk_receive_queue); 2729 if (tail != last || 2730 sk->sk_err || 2731 (sk->sk_shutdown & RCV_SHUTDOWN) || 2732 signal_pending(current) || 2733 !timeo) 2734 break; 2735 2736 sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk); 2737 unix_state_unlock(sk); 2738 timeo = schedule_timeout(timeo); 2739 unix_state_lock(sk); 2740 2741 if (sock_flag(sk, SOCK_DEAD)) 2742 break; 2743 2744 sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk); 2745 } 2746 2747 finish_wait(sk_sleep(sk), &wait); 2748 unix_state_unlock(sk); 2749 return timeo; 2750 } 2751 2752 struct unix_stream_read_state { 2753 int (*recv_actor)(struct sk_buff *, int, int, 2754 struct unix_stream_read_state *); 2755 struct socket *socket; 2756 struct msghdr *msg; 2757 struct pipe_inode_info *pipe; 2758 size_t size; 2759 int flags; 2760 unsigned int splice_flags; 2761 }; 2762 2763 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2764 static int unix_stream_recv_urg(struct unix_stream_read_state *state) 2765 { 2766 struct sk_buff *oob_skb, *read_skb = NULL; 2767 struct socket *sock = state->socket; 2768 struct sock *sk = sock->sk; 2769 struct unix_sock *u = unix_sk(sk); 2770 int chunk = 1; 2771 2772 mutex_lock(&u->iolock); 2773 unix_state_lock(sk); 2774 spin_lock(&sk->sk_receive_queue.lock); 2775 2776 if (sock_flag(sk, SOCK_URGINLINE) || !u->oob_skb) { 2777 spin_unlock(&sk->sk_receive_queue.lock); 2778 unix_state_unlock(sk); 2779 mutex_unlock(&u->iolock); 2780 return -EINVAL; 2781 } 2782 2783 oob_skb = u->oob_skb; 2784 2785 if (!(state->flags & MSG_PEEK)) { 2786 WRITE_ONCE(u->oob_skb, NULL); 2787 WRITE_ONCE(u->inq_len, u->inq_len - 1); 2788 2789 if (oob_skb->prev != (struct sk_buff *)&sk->sk_receive_queue && 2790 !unix_skb_len(oob_skb->prev)) { 2791 read_skb = oob_skb->prev; 2792 __skb_unlink(read_skb, &sk->sk_receive_queue); 2793 } 2794 } 2795 2796 spin_unlock(&sk->sk_receive_queue.lock); 2797 unix_state_unlock(sk); 2798 2799 chunk = state->recv_actor(oob_skb, 0, chunk, state); 2800 2801 if (!(state->flags & MSG_PEEK)) 2802 UNIXCB(oob_skb).consumed += 1; 2803 2804 mutex_unlock(&u->iolock); 2805 2806 consume_skb(read_skb); 2807 2808 if (chunk < 0) 2809 return -EFAULT; 2810 2811 state->msg->msg_flags |= MSG_OOB; 2812 return 1; 2813 } 2814 2815 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sk_buff **last, 2816 struct sock *sk, int flags, int copied) 2817 { 2818 struct sk_buff *read_skb = NULL, *unread_skb = NULL; 2819 struct unix_sock *u = unix_sk(sk); 2820 2821 if (likely(unix_skb_len(skb) && skb != READ_ONCE(u->oob_skb))) 2822 return skb; 2823 2824 spin_lock(&sk->sk_receive_queue.lock); 2825 2826 if (!unix_skb_len(skb)) { 2827 if (copied && (!u->oob_skb || skb == u->oob_skb)) { 2828 skb = NULL; 2829 } else if (flags & MSG_PEEK) { 2830 *last = skb; 2831 skb = skb_peek_next(skb, &sk->sk_receive_queue); 2832 } else { 2833 read_skb = skb; 2834 skb = skb_peek_next(skb, &sk->sk_receive_queue); 2835 __skb_unlink(read_skb, &sk->sk_receive_queue); 2836 *last = skb; 2837 } 2838 2839 if (!skb) 2840 goto unlock; 2841 } 2842 2843 if (skb != u->oob_skb) 2844 goto unlock; 2845 2846 if (copied) { 2847 skb = NULL; 2848 } else if (!(flags & MSG_PEEK)) { 2849 WRITE_ONCE(u->oob_skb, NULL); 2850 2851 if (!sock_flag(sk, SOCK_URGINLINE)) { 2852 __skb_unlink(skb, &sk->sk_receive_queue); 2853 unread_skb = skb; 2854 skb = skb_peek(&sk->sk_receive_queue); 2855 *last = skb; 2856 } 2857 } else if (!sock_flag(sk, SOCK_URGINLINE)) { 2858 *last = skb; 2859 skb = skb_peek_next(skb, &sk->sk_receive_queue); 2860 } 2861 2862 unlock: 2863 spin_unlock(&sk->sk_receive_queue.lock); 2864 2865 consume_skb(read_skb); 2866 kfree_skb_reason(unread_skb, SKB_DROP_REASON_UNIX_SKIP_OOB); 2867 2868 return skb; 2869 } 2870 #endif 2871 2872 static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor) 2873 { 2874 struct sk_buff_head *queue = &sk->sk_receive_queue; 2875 struct unix_sock *u = unix_sk(sk); 2876 struct sk_buff *skb; 2877 int err; 2878 2879 if (unlikely(READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)) 2880 return -ENOTCONN; 2881 2882 err = sock_error(sk); 2883 if (err) 2884 return err; 2885 2886 mutex_lock(&u->iolock); 2887 spin_lock(&queue->lock); 2888 2889 skb = __skb_dequeue(queue); 2890 if (!skb) { 2891 spin_unlock(&queue->lock); 2892 mutex_unlock(&u->iolock); 2893 return -EAGAIN; 2894 } 2895 2896 WRITE_ONCE(u->inq_len, u->inq_len - unix_skb_len(skb)); 2897 2898 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2899 if (skb == u->oob_skb) { 2900 WRITE_ONCE(u->oob_skb, NULL); 2901 spin_unlock(&queue->lock); 2902 mutex_unlock(&u->iolock); 2903 2904 kfree_skb_reason(skb, SKB_DROP_REASON_UNIX_SKIP_OOB); 2905 return -EAGAIN; 2906 } 2907 #endif 2908 2909 spin_unlock(&queue->lock); 2910 2911 unix_orphan_scm(sk, skb); 2912 2913 mutex_unlock(&u->iolock); 2914 2915 return recv_actor(sk, skb); 2916 } 2917 2918 static int unix_stream_read_generic(struct unix_stream_read_state *state, 2919 bool freezable) 2920 { 2921 int noblock = state->flags & MSG_DONTWAIT; 2922 struct socket *sock = state->socket; 2923 struct msghdr *msg = state->msg; 2924 struct sock *sk = sock->sk; 2925 size_t size = state->size; 2926 int flags = state->flags; 2927 bool check_creds = false; 2928 struct scm_cookie scm; 2929 struct unix_sock *u; 2930 int copied = 0; 2931 int err = 0; 2932 long timeo; 2933 int target; 2934 int skip; 2935 2936 if (unlikely(READ_ONCE(sk->sk_state) != TCP_ESTABLISHED)) { 2937 err = -EINVAL; 2938 goto out; 2939 } 2940 2941 if (unlikely(flags & MSG_OOB)) { 2942 err = -EOPNOTSUPP; 2943 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2944 err = unix_stream_recv_urg(state); 2945 #endif 2946 goto out; 2947 } 2948 2949 target = sock_rcvlowat(sk, flags & MSG_WAITALL, size); 2950 timeo = sock_rcvtimeo(sk, noblock); 2951 2952 memset(&scm, 0, sizeof(scm)); 2953 2954 u = unix_sk(sk); 2955 2956 redo: 2957 /* Lock the socket to prevent queue disordering 2958 * while sleeps in memcpy_tomsg 2959 */ 2960 mutex_lock(&u->iolock); 2961 2962 skip = max(sk_peek_offset(sk, flags), 0); 2963 2964 do { 2965 struct sk_buff *skb, *last; 2966 int chunk; 2967 2968 unix_state_lock(sk); 2969 if (sock_flag(sk, SOCK_DEAD)) { 2970 err = -ECONNRESET; 2971 goto unlock; 2972 } 2973 last = skb = skb_peek(&sk->sk_receive_queue); 2974 2975 again: 2976 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 2977 if (skb) { 2978 skb = manage_oob(skb, &last, sk, flags, copied); 2979 if (!skb && (copied || !state->size)) { 2980 unix_state_unlock(sk); 2981 break; 2982 } 2983 } 2984 #endif 2985 if (skb == NULL) { 2986 if (copied >= target) 2987 goto unlock; 2988 2989 /* 2990 * POSIX 1003.1g mandates this order. 2991 */ 2992 2993 err = sock_error(sk); 2994 if (err) 2995 goto unlock; 2996 if (sk->sk_shutdown & RCV_SHUTDOWN) 2997 goto unlock; 2998 2999 unix_state_unlock(sk); 3000 if (!timeo) { 3001 err = -EAGAIN; 3002 break; 3003 } 3004 3005 mutex_unlock(&u->iolock); 3006 3007 timeo = unix_stream_data_wait(sk, timeo, last, freezable); 3008 3009 if (signal_pending(current)) { 3010 err = sock_intr_errno(timeo); 3011 scm_destroy(&scm); 3012 goto out; 3013 } 3014 3015 goto redo; 3016 unlock: 3017 unix_state_unlock(sk); 3018 break; 3019 } 3020 3021 while (skip >= unix_skb_len(skb)) { 3022 skip -= unix_skb_len(skb); 3023 last = skb; 3024 skb = skb_peek_next(skb, &sk->sk_receive_queue); 3025 if (!skb) 3026 goto again; 3027 } 3028 3029 unix_state_unlock(sk); 3030 3031 if (check_creds) { 3032 /* Never glue messages from different writers */ 3033 if (!unix_skb_scm_eq(skb, &scm)) 3034 break; 3035 } else if (unix_may_passcred(sk)) { 3036 /* Copy credentials */ 3037 unix_skb_to_scm(skb, &scm); 3038 check_creds = true; 3039 } 3040 3041 /* Copy address just once */ 3042 if (msg && msg->msg_name) { 3043 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, msg->msg_name); 3044 3045 unix_copy_addr(msg, skb->sk); 3046 BPF_CGROUP_RUN_PROG_UNIX_RECVMSG_LOCK(sk, msg->msg_name, 3047 &msg->msg_namelen); 3048 3049 sunaddr = NULL; 3050 } 3051 3052 chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size); 3053 chunk = state->recv_actor(skb, skip, chunk, state); 3054 if (chunk < 0) { 3055 if (copied == 0) 3056 copied = -EFAULT; 3057 break; 3058 } 3059 copied += chunk; 3060 size -= chunk; 3061 3062 /* Mark read part of skb as used */ 3063 if (!(flags & MSG_PEEK)) { 3064 UNIXCB(skb).consumed += chunk; 3065 3066 sk_peek_offset_bwd(sk, chunk); 3067 3068 if (UNIXCB(skb).fp) { 3069 scm_stat_del(sk, skb); 3070 unix_detach_fds(&scm, skb); 3071 } 3072 3073 spin_lock(&sk->sk_receive_queue.lock); 3074 WRITE_ONCE(u->inq_len, u->inq_len - chunk); 3075 if (unix_skb_len(skb)) { 3076 spin_unlock(&sk->sk_receive_queue.lock); 3077 break; 3078 } 3079 __skb_unlink(skb, &sk->sk_receive_queue); 3080 spin_unlock(&sk->sk_receive_queue.lock); 3081 3082 consume_skb(skb); 3083 3084 if (scm.fp) 3085 break; 3086 } else { 3087 /* It is questionable, see note in unix_dgram_recvmsg. 3088 */ 3089 if (UNIXCB(skb).fp) 3090 unix_peek_fds(&scm, skb); 3091 3092 sk_peek_offset_fwd(sk, chunk); 3093 3094 if (UNIXCB(skb).fp) 3095 break; 3096 3097 skip = 0; 3098 last = skb; 3099 unix_state_lock(sk); 3100 skb = skb_peek_next(skb, &sk->sk_receive_queue); 3101 if (skb) 3102 goto again; 3103 unix_state_unlock(sk); 3104 break; 3105 } 3106 } while (size); 3107 3108 mutex_unlock(&u->iolock); 3109 if (msg) { 3110 bool do_cmsg = READ_ONCE(u->recvmsg_inq); 3111 3112 scm_recv_unix(sock, msg, &scm, flags); 3113 3114 if ((do_cmsg | msg->msg_get_inq) && (copied ?: err) >= 0) { 3115 msg->msg_inq = READ_ONCE(u->inq_len); 3116 if (do_cmsg) 3117 put_cmsg(msg, SOL_SOCKET, SCM_INQ, 3118 sizeof(msg->msg_inq), &msg->msg_inq); 3119 } 3120 } else { 3121 scm_destroy(&scm); 3122 } 3123 out: 3124 return copied ? : err; 3125 } 3126 3127 static int unix_stream_read_actor(struct sk_buff *skb, 3128 int skip, int chunk, 3129 struct unix_stream_read_state *state) 3130 { 3131 int ret; 3132 3133 ret = skb_copy_datagram_msg(skb, UNIXCB(skb).consumed + skip, 3134 state->msg, chunk); 3135 return ret ?: chunk; 3136 } 3137 3138 int __unix_stream_recvmsg(struct sock *sk, struct msghdr *msg, 3139 size_t size, int flags) 3140 { 3141 struct unix_stream_read_state state = { 3142 .recv_actor = unix_stream_read_actor, 3143 .socket = sk->sk_socket, 3144 .msg = msg, 3145 .size = size, 3146 .flags = flags 3147 }; 3148 3149 return unix_stream_read_generic(&state, true); 3150 } 3151 3152 static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg, 3153 size_t size, int flags) 3154 { 3155 struct unix_stream_read_state state = { 3156 .recv_actor = unix_stream_read_actor, 3157 .socket = sock, 3158 .msg = msg, 3159 .size = size, 3160 .flags = flags 3161 }; 3162 3163 #ifdef CONFIG_BPF_SYSCALL 3164 struct sock *sk = sock->sk; 3165 const struct proto *prot = READ_ONCE(sk->sk_prot); 3166 3167 if (prot != &unix_stream_proto) 3168 return prot->recvmsg(sk, msg, size, flags); 3169 #endif 3170 return unix_stream_read_generic(&state, true); 3171 } 3172 3173 static int unix_stream_splice_actor(struct sk_buff *skb, 3174 int skip, int chunk, 3175 struct unix_stream_read_state *state) 3176 { 3177 return skb_splice_bits(skb, state->socket->sk, 3178 UNIXCB(skb).consumed + skip, 3179 state->pipe, chunk, state->splice_flags); 3180 } 3181 3182 static ssize_t unix_stream_splice_read(struct socket *sock, loff_t *ppos, 3183 struct pipe_inode_info *pipe, 3184 size_t size, unsigned int flags) 3185 { 3186 struct unix_stream_read_state state = { 3187 .recv_actor = unix_stream_splice_actor, 3188 .socket = sock, 3189 .pipe = pipe, 3190 .size = size, 3191 .splice_flags = flags, 3192 }; 3193 3194 if (unlikely(*ppos)) 3195 return -ESPIPE; 3196 3197 if (sock->file->f_flags & O_NONBLOCK || 3198 flags & SPLICE_F_NONBLOCK) 3199 state.flags = MSG_DONTWAIT; 3200 3201 return unix_stream_read_generic(&state, false); 3202 } 3203 3204 static int unix_shutdown(struct socket *sock, int mode) 3205 { 3206 struct sock *sk = sock->sk; 3207 struct sock *other; 3208 3209 if (mode < SHUT_RD || mode > SHUT_RDWR) 3210 return -EINVAL; 3211 /* This maps: 3212 * SHUT_RD (0) -> RCV_SHUTDOWN (1) 3213 * SHUT_WR (1) -> SEND_SHUTDOWN (2) 3214 * SHUT_RDWR (2) -> SHUTDOWN_MASK (3) 3215 */ 3216 ++mode; 3217 3218 unix_state_lock(sk); 3219 WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | mode); 3220 other = unix_peer(sk); 3221 if (other) 3222 sock_hold(other); 3223 unix_state_unlock(sk); 3224 sk->sk_state_change(sk); 3225 3226 if (other && 3227 (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) { 3228 3229 int peer_mode = 0; 3230 const struct proto *prot = READ_ONCE(other->sk_prot); 3231 3232 if (prot->unhash) 3233 prot->unhash(other); 3234 if (mode&RCV_SHUTDOWN) 3235 peer_mode |= SEND_SHUTDOWN; 3236 if (mode&SEND_SHUTDOWN) 3237 peer_mode |= RCV_SHUTDOWN; 3238 unix_state_lock(other); 3239 WRITE_ONCE(other->sk_shutdown, other->sk_shutdown | peer_mode); 3240 unix_state_unlock(other); 3241 other->sk_state_change(other); 3242 if (peer_mode == SHUTDOWN_MASK) 3243 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP); 3244 else if (peer_mode & RCV_SHUTDOWN) 3245 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN); 3246 } 3247 if (other) 3248 sock_put(other); 3249 3250 return 0; 3251 } 3252 3253 long unix_inq_len(struct sock *sk) 3254 { 3255 struct sk_buff *skb; 3256 long amount = 0; 3257 3258 if (READ_ONCE(sk->sk_state) == TCP_LISTEN) 3259 return -EINVAL; 3260 3261 if (sk->sk_type == SOCK_STREAM) 3262 return READ_ONCE(unix_sk(sk)->inq_len); 3263 3264 spin_lock(&sk->sk_receive_queue.lock); 3265 if (sk->sk_type == SOCK_SEQPACKET) { 3266 skb_queue_walk(&sk->sk_receive_queue, skb) 3267 amount += unix_skb_len(skb); 3268 } else { 3269 skb = skb_peek(&sk->sk_receive_queue); 3270 if (skb) 3271 amount = skb->len; 3272 } 3273 spin_unlock(&sk->sk_receive_queue.lock); 3274 3275 return amount; 3276 } 3277 EXPORT_SYMBOL_GPL(unix_inq_len); 3278 3279 long unix_outq_len(struct sock *sk) 3280 { 3281 return sk_wmem_alloc_get(sk); 3282 } 3283 EXPORT_SYMBOL_GPL(unix_outq_len); 3284 3285 static int unix_open_file(struct sock *sk) 3286 { 3287 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) 3288 return -EPERM; 3289 3290 if (!smp_load_acquire(&unix_sk(sk)->addr)) 3291 return -ENOENT; 3292 3293 if (!unix_sk(sk)->path.dentry) 3294 return -ENOENT; 3295 3296 return FD_ADD(O_CLOEXEC, dentry_open(&unix_sk(sk)->path, O_PATH, current_cred())); 3297 } 3298 3299 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 3300 { 3301 struct sock *sk = sock->sk; 3302 long amount = 0; 3303 int err; 3304 3305 switch (cmd) { 3306 case SIOCOUTQ: 3307 amount = unix_outq_len(sk); 3308 err = put_user(amount, (int __user *)arg); 3309 break; 3310 case SIOCINQ: 3311 amount = unix_inq_len(sk); 3312 if (amount < 0) 3313 err = amount; 3314 else 3315 err = put_user(amount, (int __user *)arg); 3316 break; 3317 case SIOCUNIXFILE: 3318 err = unix_open_file(sk); 3319 break; 3320 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 3321 case SIOCATMARK: 3322 { 3323 struct unix_sock *u = unix_sk(sk); 3324 struct sk_buff *skb; 3325 int answ = 0; 3326 3327 if (sk->sk_type != SOCK_STREAM) 3328 return -EOPNOTSUPP; 3329 3330 mutex_lock(&u->iolock); 3331 3332 skb = skb_peek(&sk->sk_receive_queue); 3333 if (skb) { 3334 struct sk_buff *oob_skb = READ_ONCE(u->oob_skb); 3335 struct sk_buff *next_skb; 3336 3337 next_skb = skb_peek_next(skb, &sk->sk_receive_queue); 3338 3339 if (skb == oob_skb || 3340 (!unix_skb_len(skb) && 3341 (!oob_skb || next_skb == oob_skb))) 3342 answ = 1; 3343 } 3344 3345 mutex_unlock(&u->iolock); 3346 3347 err = put_user(answ, (int __user *)arg); 3348 } 3349 break; 3350 #endif 3351 default: 3352 err = -ENOIOCTLCMD; 3353 break; 3354 } 3355 return err; 3356 } 3357 3358 #ifdef CONFIG_COMPAT 3359 static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 3360 { 3361 return unix_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 3362 } 3363 #endif 3364 3365 static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait) 3366 { 3367 struct sock *sk = sock->sk; 3368 unsigned char state; 3369 __poll_t mask; 3370 u8 shutdown; 3371 3372 sock_poll_wait(file, sock, wait); 3373 mask = 0; 3374 shutdown = READ_ONCE(sk->sk_shutdown); 3375 state = READ_ONCE(sk->sk_state); 3376 3377 /* exceptional events? */ 3378 if (READ_ONCE(sk->sk_err)) 3379 mask |= EPOLLERR; 3380 if (shutdown == SHUTDOWN_MASK) 3381 mask |= EPOLLHUP; 3382 if (shutdown & RCV_SHUTDOWN) 3383 mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM; 3384 3385 /* readable? */ 3386 if (!skb_queue_empty_lockless(&sk->sk_receive_queue)) 3387 mask |= EPOLLIN | EPOLLRDNORM; 3388 if (sk_is_readable(sk)) 3389 mask |= EPOLLIN | EPOLLRDNORM; 3390 #if IS_ENABLED(CONFIG_AF_UNIX_OOB) 3391 if (READ_ONCE(unix_sk(sk)->oob_skb)) 3392 mask |= EPOLLPRI; 3393 #endif 3394 3395 /* Connection-based need to check for termination and startup */ 3396 if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) && 3397 state == TCP_CLOSE) 3398 mask |= EPOLLHUP; 3399 3400 /* 3401 * we set writable also when the other side has shut down the 3402 * connection. This prevents stuck sockets. 3403 */ 3404 if (unix_writable(sk, state)) 3405 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND; 3406 3407 return mask; 3408 } 3409 3410 static __poll_t unix_dgram_poll(struct file *file, struct socket *sock, 3411 poll_table *wait) 3412 { 3413 struct sock *sk = sock->sk, *other; 3414 unsigned int writable; 3415 unsigned char state; 3416 __poll_t mask; 3417 u8 shutdown; 3418 3419 sock_poll_wait(file, sock, wait); 3420 mask = 0; 3421 shutdown = READ_ONCE(sk->sk_shutdown); 3422 state = READ_ONCE(sk->sk_state); 3423 3424 /* exceptional events? */ 3425 if (READ_ONCE(sk->sk_err) || 3426 !skb_queue_empty_lockless(&sk->sk_error_queue)) 3427 mask |= EPOLLERR | 3428 (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0); 3429 3430 if (shutdown & RCV_SHUTDOWN) 3431 mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM; 3432 if (shutdown == SHUTDOWN_MASK) 3433 mask |= EPOLLHUP; 3434 3435 /* readable? */ 3436 if (!skb_queue_empty_lockless(&sk->sk_receive_queue)) 3437 mask |= EPOLLIN | EPOLLRDNORM; 3438 if (sk_is_readable(sk)) 3439 mask |= EPOLLIN | EPOLLRDNORM; 3440 3441 /* Connection-based need to check for termination and startup */ 3442 if (sk->sk_type == SOCK_SEQPACKET && state == TCP_CLOSE) 3443 mask |= EPOLLHUP; 3444 3445 /* No write status requested, avoid expensive OUT tests. */ 3446 if (!(poll_requested_events(wait) & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT))) 3447 return mask; 3448 3449 writable = unix_writable(sk, state); 3450 if (writable) { 3451 unix_state_lock(sk); 3452 3453 other = unix_peer(sk); 3454 if (other && unix_peer(other) != sk && 3455 unix_recvq_full_lockless(other) && 3456 unix_dgram_peer_wake_me(sk, other)) 3457 writable = 0; 3458 3459 unix_state_unlock(sk); 3460 } 3461 3462 if (writable) 3463 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND; 3464 else 3465 sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk); 3466 3467 return mask; 3468 } 3469 3470 #ifdef CONFIG_PROC_FS 3471 3472 #define BUCKET_SPACE (BITS_PER_LONG - (UNIX_HASH_BITS + 1) - 1) 3473 3474 #define get_bucket(x) ((x) >> BUCKET_SPACE) 3475 #define get_offset(x) ((x) & ((1UL << BUCKET_SPACE) - 1)) 3476 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o)) 3477 3478 static struct sock *unix_from_bucket(struct seq_file *seq, loff_t *pos) 3479 { 3480 unsigned long offset = get_offset(*pos); 3481 unsigned long bucket = get_bucket(*pos); 3482 unsigned long count = 0; 3483 struct sock *sk; 3484 3485 for (sk = sk_head(&seq_file_net(seq)->unx.table.buckets[bucket]); 3486 sk; sk = sk_next(sk)) { 3487 if (++count == offset) 3488 break; 3489 } 3490 3491 return sk; 3492 } 3493 3494 static struct sock *unix_get_first(struct seq_file *seq, loff_t *pos) 3495 { 3496 unsigned long bucket = get_bucket(*pos); 3497 struct net *net = seq_file_net(seq); 3498 struct sock *sk; 3499 3500 while (bucket < UNIX_HASH_SIZE) { 3501 spin_lock(&net->unx.table.locks[bucket]); 3502 3503 sk = unix_from_bucket(seq, pos); 3504 if (sk) 3505 return sk; 3506 3507 spin_unlock(&net->unx.table.locks[bucket]); 3508 3509 *pos = set_bucket_offset(++bucket, 1); 3510 } 3511 3512 return NULL; 3513 } 3514 3515 static struct sock *unix_get_next(struct seq_file *seq, struct sock *sk, 3516 loff_t *pos) 3517 { 3518 unsigned long bucket = get_bucket(*pos); 3519 3520 sk = sk_next(sk); 3521 if (sk) 3522 return sk; 3523 3524 3525 spin_unlock(&seq_file_net(seq)->unx.table.locks[bucket]); 3526 3527 *pos = set_bucket_offset(++bucket, 1); 3528 3529 return unix_get_first(seq, pos); 3530 } 3531 3532 static void *unix_seq_start(struct seq_file *seq, loff_t *pos) 3533 { 3534 if (!*pos) 3535 return SEQ_START_TOKEN; 3536 3537 return unix_get_first(seq, pos); 3538 } 3539 3540 static void *unix_seq_next(struct seq_file *seq, void *v, loff_t *pos) 3541 { 3542 ++*pos; 3543 3544 if (v == SEQ_START_TOKEN) 3545 return unix_get_first(seq, pos); 3546 3547 return unix_get_next(seq, v, pos); 3548 } 3549 3550 static void unix_seq_stop(struct seq_file *seq, void *v) 3551 { 3552 struct sock *sk = v; 3553 3554 if (sk) 3555 spin_unlock(&seq_file_net(seq)->unx.table.locks[sk->sk_hash]); 3556 } 3557 3558 static int unix_seq_show(struct seq_file *seq, void *v) 3559 { 3560 3561 if (v == SEQ_START_TOKEN) 3562 seq_puts(seq, "Num RefCount Protocol Flags Type St " 3563 "Inode Path\n"); 3564 else { 3565 struct sock *s = v; 3566 struct unix_sock *u = unix_sk(s); 3567 unix_state_lock(s); 3568 3569 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5llu", 3570 s, 3571 refcount_read(&s->sk_refcnt), 3572 0, 3573 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0, 3574 s->sk_type, 3575 s->sk_socket ? 3576 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) : 3577 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING), 3578 sock_i_ino(s)); 3579 3580 if (u->addr) { // under a hash table lock here 3581 int i, len; 3582 seq_putc(seq, ' '); 3583 3584 i = 0; 3585 len = u->addr->len - 3586 offsetof(struct sockaddr_un, sun_path); 3587 if (u->addr->name->sun_path[0]) { 3588 len--; 3589 } else { 3590 seq_putc(seq, '@'); 3591 i++; 3592 } 3593 for ( ; i < len; i++) 3594 seq_putc(seq, u->addr->name->sun_path[i] ?: 3595 '@'); 3596 } 3597 unix_state_unlock(s); 3598 seq_putc(seq, '\n'); 3599 } 3600 3601 return 0; 3602 } 3603 3604 static const struct seq_operations unix_seq_ops = { 3605 .start = unix_seq_start, 3606 .next = unix_seq_next, 3607 .stop = unix_seq_stop, 3608 .show = unix_seq_show, 3609 }; 3610 3611 #ifdef CONFIG_BPF_SYSCALL 3612 struct bpf_unix_iter_state { 3613 struct seq_net_private p; 3614 unsigned int cur_sk; 3615 unsigned int end_sk; 3616 unsigned int max_sk; 3617 struct sock **batch; 3618 bool st_bucket_done; 3619 }; 3620 3621 struct bpf_iter__unix { 3622 __bpf_md_ptr(struct bpf_iter_meta *, meta); 3623 __bpf_md_ptr(struct unix_sock *, unix_sk); 3624 uid_t uid __aligned(8); 3625 }; 3626 3627 static int unix_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta, 3628 struct unix_sock *unix_sk, uid_t uid) 3629 { 3630 struct bpf_iter__unix ctx; 3631 3632 meta->seq_num--; /* skip SEQ_START_TOKEN */ 3633 ctx.meta = meta; 3634 ctx.unix_sk = unix_sk; 3635 ctx.uid = uid; 3636 return bpf_iter_run_prog(prog, &ctx); 3637 } 3638 3639 static int bpf_iter_unix_hold_batch(struct seq_file *seq, struct sock *start_sk) 3640 3641 { 3642 struct bpf_unix_iter_state *iter = seq->private; 3643 unsigned int expected = 1; 3644 struct sock *sk; 3645 3646 sock_hold(start_sk); 3647 iter->batch[iter->end_sk++] = start_sk; 3648 3649 for (sk = sk_next(start_sk); sk; sk = sk_next(sk)) { 3650 if (iter->end_sk < iter->max_sk) { 3651 sock_hold(sk); 3652 iter->batch[iter->end_sk++] = sk; 3653 } 3654 3655 expected++; 3656 } 3657 3658 spin_unlock(&seq_file_net(seq)->unx.table.locks[start_sk->sk_hash]); 3659 3660 return expected; 3661 } 3662 3663 static void bpf_iter_unix_put_batch(struct bpf_unix_iter_state *iter) 3664 { 3665 while (iter->cur_sk < iter->end_sk) 3666 sock_put(iter->batch[iter->cur_sk++]); 3667 } 3668 3669 static int bpf_iter_unix_realloc_batch(struct bpf_unix_iter_state *iter, 3670 unsigned int new_batch_sz) 3671 { 3672 struct sock **new_batch; 3673 3674 new_batch = kvmalloc_objs(*new_batch, new_batch_sz, 3675 GFP_USER | __GFP_NOWARN); 3676 if (!new_batch) 3677 return -ENOMEM; 3678 3679 bpf_iter_unix_put_batch(iter); 3680 kvfree(iter->batch); 3681 iter->batch = new_batch; 3682 iter->max_sk = new_batch_sz; 3683 3684 return 0; 3685 } 3686 3687 static struct sock *bpf_iter_unix_batch(struct seq_file *seq, 3688 loff_t *pos) 3689 { 3690 struct bpf_unix_iter_state *iter = seq->private; 3691 unsigned int expected; 3692 bool resized = false; 3693 struct sock *sk; 3694 3695 if (iter->st_bucket_done) 3696 *pos = set_bucket_offset(get_bucket(*pos) + 1, 1); 3697 3698 again: 3699 /* Get a new batch */ 3700 iter->cur_sk = 0; 3701 iter->end_sk = 0; 3702 3703 sk = unix_get_first(seq, pos); 3704 if (!sk) 3705 return NULL; /* Done */ 3706 3707 expected = bpf_iter_unix_hold_batch(seq, sk); 3708 3709 if (iter->end_sk == expected) { 3710 iter->st_bucket_done = true; 3711 return sk; 3712 } 3713 3714 if (!resized && !bpf_iter_unix_realloc_batch(iter, expected * 3 / 2)) { 3715 resized = true; 3716 goto again; 3717 } 3718 3719 return sk; 3720 } 3721 3722 static void *bpf_iter_unix_seq_start(struct seq_file *seq, loff_t *pos) 3723 { 3724 if (!*pos) 3725 return SEQ_START_TOKEN; 3726 3727 /* bpf iter does not support lseek, so it always 3728 * continue from where it was stop()-ped. 3729 */ 3730 return bpf_iter_unix_batch(seq, pos); 3731 } 3732 3733 static void *bpf_iter_unix_seq_next(struct seq_file *seq, void *v, loff_t *pos) 3734 { 3735 struct bpf_unix_iter_state *iter = seq->private; 3736 struct sock *sk; 3737 3738 /* Whenever seq_next() is called, the iter->cur_sk is 3739 * done with seq_show(), so advance to the next sk in 3740 * the batch. 3741 */ 3742 if (iter->cur_sk < iter->end_sk) 3743 sock_put(iter->batch[iter->cur_sk++]); 3744 3745 ++*pos; 3746 3747 if (iter->cur_sk < iter->end_sk) 3748 sk = iter->batch[iter->cur_sk]; 3749 else 3750 sk = bpf_iter_unix_batch(seq, pos); 3751 3752 return sk; 3753 } 3754 3755 static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v) 3756 { 3757 struct bpf_iter_meta meta; 3758 struct bpf_prog *prog; 3759 struct sock *sk = v; 3760 uid_t uid; 3761 int ret; 3762 3763 if (v == SEQ_START_TOKEN) 3764 return 0; 3765 3766 lock_sock(sk); 3767 unix_state_lock(sk); 3768 3769 if (unlikely(sock_flag(sk, SOCK_DEAD))) { 3770 ret = SEQ_SKIP; 3771 goto unlock; 3772 } 3773 3774 uid = from_kuid_munged(seq_user_ns(seq), sk_uid(sk)); 3775 meta.seq = seq; 3776 prog = bpf_iter_get_info(&meta, false); 3777 ret = unix_prog_seq_show(prog, &meta, v, uid); 3778 unlock: 3779 unix_state_unlock(sk); 3780 release_sock(sk); 3781 return ret; 3782 } 3783 3784 static void bpf_iter_unix_seq_stop(struct seq_file *seq, void *v) 3785 { 3786 struct bpf_unix_iter_state *iter = seq->private; 3787 struct bpf_iter_meta meta; 3788 struct bpf_prog *prog; 3789 3790 if (!v) { 3791 meta.seq = seq; 3792 prog = bpf_iter_get_info(&meta, true); 3793 if (prog) 3794 (void)unix_prog_seq_show(prog, &meta, v, 0); 3795 } 3796 3797 if (iter->cur_sk < iter->end_sk) 3798 bpf_iter_unix_put_batch(iter); 3799 } 3800 3801 static const struct seq_operations bpf_iter_unix_seq_ops = { 3802 .start = bpf_iter_unix_seq_start, 3803 .next = bpf_iter_unix_seq_next, 3804 .stop = bpf_iter_unix_seq_stop, 3805 .show = bpf_iter_unix_seq_show, 3806 }; 3807 #endif 3808 #endif 3809 3810 static const struct net_proto_family unix_family_ops = { 3811 .family = PF_UNIX, 3812 .create = unix_create, 3813 .owner = THIS_MODULE, 3814 }; 3815 3816 3817 static int __net_init unix_net_init(struct net *net) 3818 { 3819 int i; 3820 3821 net->unx.sysctl_max_dgram_qlen = 10; 3822 if (unix_sysctl_register(net)) 3823 goto out; 3824 3825 #ifdef CONFIG_PROC_FS 3826 if (!proc_create_net("unix", 0, net->proc_net, &unix_seq_ops, 3827 sizeof(struct seq_net_private))) 3828 goto err_sysctl; 3829 #endif 3830 3831 net->unx.table.locks = kvmalloc_objs(spinlock_t, UNIX_HASH_SIZE); 3832 if (!net->unx.table.locks) 3833 goto err_proc; 3834 3835 net->unx.table.buckets = kvmalloc_objs(struct hlist_head, 3836 UNIX_HASH_SIZE); 3837 if (!net->unx.table.buckets) 3838 goto free_locks; 3839 3840 for (i = 0; i < UNIX_HASH_SIZE; i++) { 3841 spin_lock_init(&net->unx.table.locks[i]); 3842 lock_set_cmp_fn(&net->unx.table.locks[i], unix_table_lock_cmp_fn, NULL); 3843 INIT_HLIST_HEAD(&net->unx.table.buckets[i]); 3844 } 3845 3846 return 0; 3847 3848 free_locks: 3849 kvfree(net->unx.table.locks); 3850 err_proc: 3851 #ifdef CONFIG_PROC_FS 3852 remove_proc_entry("unix", net->proc_net); 3853 err_sysctl: 3854 #endif 3855 unix_sysctl_unregister(net); 3856 out: 3857 return -ENOMEM; 3858 } 3859 3860 static void __net_exit unix_net_exit(struct net *net) 3861 { 3862 kvfree(net->unx.table.buckets); 3863 kvfree(net->unx.table.locks); 3864 unix_sysctl_unregister(net); 3865 remove_proc_entry("unix", net->proc_net); 3866 } 3867 3868 static struct pernet_operations unix_net_ops = { 3869 .init = unix_net_init, 3870 .exit = unix_net_exit, 3871 }; 3872 3873 #if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS) 3874 DEFINE_BPF_ITER_FUNC(unix, struct bpf_iter_meta *meta, 3875 struct unix_sock *unix_sk, uid_t uid) 3876 3877 #define INIT_BATCH_SZ 16 3878 3879 static int bpf_iter_init_unix(void *priv_data, struct bpf_iter_aux_info *aux) 3880 { 3881 struct bpf_unix_iter_state *iter = priv_data; 3882 int err; 3883 3884 err = bpf_iter_init_seq_net(priv_data, aux); 3885 if (err) 3886 return err; 3887 3888 err = bpf_iter_unix_realloc_batch(iter, INIT_BATCH_SZ); 3889 if (err) { 3890 bpf_iter_fini_seq_net(priv_data); 3891 return err; 3892 } 3893 3894 return 0; 3895 } 3896 3897 static void bpf_iter_fini_unix(void *priv_data) 3898 { 3899 struct bpf_unix_iter_state *iter = priv_data; 3900 3901 bpf_iter_fini_seq_net(priv_data); 3902 kvfree(iter->batch); 3903 } 3904 3905 static const struct bpf_iter_seq_info unix_seq_info = { 3906 .seq_ops = &bpf_iter_unix_seq_ops, 3907 .init_seq_private = bpf_iter_init_unix, 3908 .fini_seq_private = bpf_iter_fini_unix, 3909 .seq_priv_size = sizeof(struct bpf_unix_iter_state), 3910 }; 3911 3912 static const struct bpf_func_proto * 3913 bpf_iter_unix_get_func_proto(enum bpf_func_id func_id, 3914 const struct bpf_prog *prog) 3915 { 3916 switch (func_id) { 3917 case BPF_FUNC_setsockopt: 3918 return &bpf_sk_setsockopt_proto; 3919 case BPF_FUNC_getsockopt: 3920 return &bpf_sk_getsockopt_proto; 3921 default: 3922 return NULL; 3923 } 3924 } 3925 3926 static struct bpf_iter_reg unix_reg_info = { 3927 .target = "unix", 3928 .ctx_arg_info_size = 1, 3929 .ctx_arg_info = { 3930 { offsetof(struct bpf_iter__unix, unix_sk), 3931 PTR_TO_BTF_ID_OR_NULL }, 3932 }, 3933 .get_func_proto = bpf_iter_unix_get_func_proto, 3934 .seq_info = &unix_seq_info, 3935 }; 3936 3937 static void __init bpf_iter_register(void) 3938 { 3939 unix_reg_info.ctx_arg_info[0].btf_id = btf_sock_ids[BTF_SOCK_TYPE_UNIX]; 3940 if (bpf_iter_reg_target(&unix_reg_info)) 3941 pr_warn("Warning: could not register bpf iterator unix\n"); 3942 } 3943 #endif 3944 3945 static int __init af_unix_init(void) 3946 { 3947 int i, rc = -1; 3948 3949 BUILD_BUG_ON(sizeof(struct unix_skb_parms) > sizeof_field(struct sk_buff, cb)); 3950 3951 for (i = 0; i < UNIX_HASH_SIZE / 2; i++) { 3952 spin_lock_init(&bsd_socket_locks[i]); 3953 INIT_HLIST_HEAD(&bsd_socket_buckets[i]); 3954 } 3955 3956 rc = proto_register(&unix_dgram_proto, 1); 3957 if (rc != 0) { 3958 pr_crit("%s: Cannot create unix_sock SLAB cache!\n", __func__); 3959 goto out; 3960 } 3961 3962 rc = proto_register(&unix_stream_proto, 1); 3963 if (rc != 0) { 3964 pr_crit("%s: Cannot create unix_sock SLAB cache!\n", __func__); 3965 proto_unregister(&unix_dgram_proto); 3966 goto out; 3967 } 3968 3969 sock_register(&unix_family_ops); 3970 register_pernet_subsys(&unix_net_ops); 3971 unix_bpf_build_proto(); 3972 3973 #if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS) 3974 bpf_iter_register(); 3975 #endif 3976 3977 out: 3978 return rc; 3979 } 3980 3981 /* Later than subsys_initcall() because we depend on stuff initialised there */ 3982 fs_initcall(af_unix_init); 3983