1 /*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1982, 1986, 1989, 1991, 1993
5 * The Regents of the University of California. All Rights Reserved.
6 * Copyright (c) 2004-2009 Robert N. M. Watson All Rights Reserved.
7 * Copyright (c) 2018 Matthew Macy
8 * Copyright (c) 2022 Gleb Smirnoff <glebius@FreeBSD.org>
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 */
34
35 /*
36 * UNIX Domain (Local) Sockets
37 *
38 * This is an implementation of UNIX (local) domain sockets. Each socket has
39 * an associated struct unpcb (UNIX protocol control block). Stream sockets
40 * may be connected to 0 or 1 other socket. Datagram sockets may be
41 * connected to 0, 1, or many other sockets. Sockets may be created and
42 * connected in pairs (socketpair(2)), or bound/connected to using the file
43 * system name space. For most purposes, only the receive socket buffer is
44 * used, as sending on one socket delivers directly to the receive socket
45 * buffer of a second socket.
46 *
47 * The implementation is substantially complicated by the fact that
48 * "ancillary data", such as file descriptors or credentials, may be passed
49 * across UNIX domain sockets. The potential for passing UNIX domain sockets
50 * over other UNIX domain sockets requires the implementation of a simple
51 * garbage collector to find and tear down cycles of disconnected sockets.
52 *
53 * TODO:
54 * RDM
55 * rethink name space problems
56 * need a proper out-of-band
57 */
58
59 #include <sys/cdefs.h>
60 #include "opt_ddb.h"
61
62 #include <sys/param.h>
63 #include <sys/capsicum.h>
64 #include <sys/domain.h>
65 #include <sys/eventhandler.h>
66 #include <sys/fcntl.h>
67 #include <sys/file.h>
68 #include <sys/filedesc.h>
69 #include <sys/kernel.h>
70 #include <sys/lock.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/mount.h>
74 #include <sys/mutex.h>
75 #include <sys/namei.h>
76 #include <sys/proc.h>
77 #include <sys/protosw.h>
78 #include <sys/queue.h>
79 #include <sys/resourcevar.h>
80 #include <sys/rwlock.h>
81 #include <sys/socket.h>
82 #include <sys/socketvar.h>
83 #include <sys/signalvar.h>
84 #include <sys/stat.h>
85 #include <sys/sx.h>
86 #include <sys/sysctl.h>
87 #include <sys/systm.h>
88 #include <sys/taskqueue.h>
89 #include <sys/un.h>
90 #include <sys/unpcb.h>
91 #include <sys/vnode.h>
92
93 #include <net/vnet.h>
94
95 #ifdef DDB
96 #include <ddb/ddb.h>
97 #endif
98
99 #include <security/mac/mac_framework.h>
100
101 #include <vm/uma.h>
102
103 MALLOC_DECLARE(M_FILECAPS);
104
105 static struct domain localdomain;
106
107 static uma_zone_t unp_zone;
108 static unp_gen_t unp_gencnt; /* (l) */
109 static u_int unp_count; /* (l) Count of local sockets. */
110 static ino_t unp_ino; /* Prototype for fake inode numbers. */
111 static int unp_rights; /* (g) File descriptors in flight. */
112 static struct unp_head unp_shead; /* (l) List of stream sockets. */
113 static struct unp_head unp_dhead; /* (l) List of datagram sockets. */
114 static struct unp_head unp_sphead; /* (l) List of seqpacket sockets. */
115 static struct mtx_pool *unp_vp_mtxpool;
116
117 struct unp_defer {
118 SLIST_ENTRY(unp_defer) ud_link;
119 struct file *ud_fp;
120 };
121 static SLIST_HEAD(, unp_defer) unp_defers;
122 static int unp_defers_count;
123
124 static const struct sockaddr sun_noname = {
125 .sa_len = sizeof(sun_noname),
126 .sa_family = AF_LOCAL,
127 };
128
129 /*
130 * Garbage collection of cyclic file descriptor/socket references occurs
131 * asynchronously in a taskqueue context in order to avoid recursion and
132 * reentrance in the UNIX domain socket, file descriptor, and socket layer
133 * code. See unp_gc() for a full description.
134 */
135 static struct timeout_task unp_gc_task;
136
137 /*
138 * The close of unix domain sockets attached as SCM_RIGHTS is
139 * postponed to the taskqueue, to avoid arbitrary recursion depth.
140 * The attached sockets might have another sockets attached.
141 */
142 static struct task unp_defer_task;
143
144 /*
145 * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
146 * stream sockets, although the total for sender and receiver is actually
147 * only PIPSIZ.
148 *
149 * Datagram sockets really use the sendspace as the maximum datagram size,
150 * and don't really want to reserve the sendspace. Their recvspace should be
151 * large enough for at least one max-size datagram plus address.
152 */
153 #ifndef PIPSIZ
154 #define PIPSIZ 8192
155 #endif
156 static u_long unpst_sendspace = PIPSIZ;
157 static u_long unpst_recvspace = PIPSIZ;
158 static u_long unpdg_maxdgram = 8*1024; /* support 8KB syslog msgs */
159 static u_long unpdg_recvspace = 16*1024;
160 static u_long unpsp_sendspace = PIPSIZ; /* really max datagram size */
161 static u_long unpsp_recvspace = PIPSIZ;
162
163 static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
164 "Local domain");
165 static SYSCTL_NODE(_net_local, SOCK_STREAM, stream,
166 CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
167 "SOCK_STREAM");
168 static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram,
169 CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
170 "SOCK_DGRAM");
171 static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket,
172 CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
173 "SOCK_SEQPACKET");
174
175 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
176 &unpst_sendspace, 0, "Default stream send space.");
177 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
178 &unpst_recvspace, 0, "Default stream receive space.");
179 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
180 &unpdg_maxdgram, 0, "Maximum datagram size.");
181 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
182 &unpdg_recvspace, 0, "Default datagram receive space.");
183 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
184 &unpsp_sendspace, 0, "Default seqpacket send space.");
185 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
186 &unpsp_recvspace, 0, "Default seqpacket receive space.");
187 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
188 "File descriptors in flight.");
189 SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
190 &unp_defers_count, 0,
191 "File descriptors deferred to taskqueue for close.");
192
193 /*
194 * Locking and synchronization:
195 *
196 * Several types of locks exist in the local domain socket implementation:
197 * - a global linkage lock
198 * - a global connection list lock
199 * - the mtxpool lock
200 * - per-unpcb mutexes
201 *
202 * The linkage lock protects the global socket lists, the generation number
203 * counter and garbage collector state.
204 *
205 * The connection list lock protects the list of referring sockets in a datagram
206 * socket PCB. This lock is also overloaded to protect a global list of
207 * sockets whose buffers contain socket references in the form of SCM_RIGHTS
208 * messages. To avoid recursion, such references are released by a dedicated
209 * thread.
210 *
211 * The mtxpool lock protects the vnode from being modified while referenced.
212 * Lock ordering rules require that it be acquired before any PCB locks.
213 *
214 * The unpcb lock (unp_mtx) protects the most commonly referenced fields in the
215 * unpcb. This includes the unp_conn field, which either links two connected
216 * PCBs together (for connected socket types) or points at the destination
217 * socket (for connectionless socket types). The operations of creating or
218 * destroying a connection therefore involve locking multiple PCBs. To avoid
219 * lock order reversals, in some cases this involves dropping a PCB lock and
220 * using a reference counter to maintain liveness.
221 *
222 * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
223 * allocated in pr_attach() and freed in pr_detach(). The validity of that
224 * pointer is an invariant, so no lock is required to dereference the so_pcb
225 * pointer if a valid socket reference is held by the caller. In practice,
226 * this is always true during operations performed on a socket. Each unpcb
227 * has a back-pointer to its socket, unp_socket, which will be stable under
228 * the same circumstances.
229 *
230 * This pointer may only be safely dereferenced as long as a valid reference
231 * to the unpcb is held. Typically, this reference will be from the socket,
232 * or from another unpcb when the referring unpcb's lock is held (in order
233 * that the reference not be invalidated during use). For example, to follow
234 * unp->unp_conn->unp_socket, you need to hold a lock on unp_conn to guarantee
235 * that detach is not run clearing unp_socket.
236 *
237 * Blocking with UNIX domain sockets is a tricky issue: unlike most network
238 * protocols, bind() is a non-atomic operation, and connect() requires
239 * potential sleeping in the protocol, due to potentially waiting on local or
240 * distributed file systems. We try to separate "lookup" operations, which
241 * may sleep, and the IPC operations themselves, which typically can occur
242 * with relative atomicity as locks can be held over the entire operation.
243 *
244 * Another tricky issue is simultaneous multi-threaded or multi-process
245 * access to a single UNIX domain socket. These are handled by the flags
246 * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
247 * binding, both of which involve dropping UNIX domain socket locks in order
248 * to perform namei() and other file system operations.
249 */
250 static struct rwlock unp_link_rwlock;
251 static struct mtx unp_defers_lock;
252
253 #define UNP_LINK_LOCK_INIT() rw_init(&unp_link_rwlock, \
254 "unp_link_rwlock")
255
256 #define UNP_LINK_LOCK_ASSERT() rw_assert(&unp_link_rwlock, \
257 RA_LOCKED)
258 #define UNP_LINK_UNLOCK_ASSERT() rw_assert(&unp_link_rwlock, \
259 RA_UNLOCKED)
260
261 #define UNP_LINK_RLOCK() rw_rlock(&unp_link_rwlock)
262 #define UNP_LINK_RUNLOCK() rw_runlock(&unp_link_rwlock)
263 #define UNP_LINK_WLOCK() rw_wlock(&unp_link_rwlock)
264 #define UNP_LINK_WUNLOCK() rw_wunlock(&unp_link_rwlock)
265 #define UNP_LINK_WLOCK_ASSERT() rw_assert(&unp_link_rwlock, \
266 RA_WLOCKED)
267 #define UNP_LINK_WOWNED() rw_wowned(&unp_link_rwlock)
268
269 #define UNP_DEFERRED_LOCK_INIT() mtx_init(&unp_defers_lock, \
270 "unp_defer", NULL, MTX_DEF)
271 #define UNP_DEFERRED_LOCK() mtx_lock(&unp_defers_lock)
272 #define UNP_DEFERRED_UNLOCK() mtx_unlock(&unp_defers_lock)
273
274 #define UNP_REF_LIST_LOCK() UNP_DEFERRED_LOCK();
275 #define UNP_REF_LIST_UNLOCK() UNP_DEFERRED_UNLOCK();
276
277 #define UNP_PCB_LOCK_INIT(unp) mtx_init(&(unp)->unp_mtx, \
278 "unp", "unp", \
279 MTX_DUPOK|MTX_DEF)
280 #define UNP_PCB_LOCK_DESTROY(unp) mtx_destroy(&(unp)->unp_mtx)
281 #define UNP_PCB_LOCKPTR(unp) (&(unp)->unp_mtx)
282 #define UNP_PCB_LOCK(unp) mtx_lock(&(unp)->unp_mtx)
283 #define UNP_PCB_TRYLOCK(unp) mtx_trylock(&(unp)->unp_mtx)
284 #define UNP_PCB_UNLOCK(unp) mtx_unlock(&(unp)->unp_mtx)
285 #define UNP_PCB_OWNED(unp) mtx_owned(&(unp)->unp_mtx)
286 #define UNP_PCB_LOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_OWNED)
287 #define UNP_PCB_UNLOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_NOTOWNED)
288
289 static int uipc_connect2(struct socket *, struct socket *);
290 static int uipc_ctloutput(struct socket *, struct sockopt *);
291 static int unp_connect(struct socket *, struct sockaddr *,
292 struct thread *);
293 static int unp_connectat(int, struct socket *, struct sockaddr *,
294 struct thread *, bool);
295 static void unp_connect2(struct socket *so, struct socket *so2);
296 static void unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
297 static void unp_dispose(struct socket *so);
298 static void unp_shutdown(struct unpcb *);
299 static void unp_drop(struct unpcb *);
300 static void unp_gc(__unused void *, int);
301 static void unp_scan(struct mbuf *, void (*)(struct filedescent **, int));
302 static void unp_discard(struct file *);
303 static void unp_freerights(struct filedescent **, int);
304 static int unp_internalize(struct mbuf **, struct thread *,
305 struct mbuf **, u_int *, u_int *);
306 static void unp_internalize_fp(struct file *);
307 static int unp_externalize(struct mbuf *, struct mbuf **, int);
308 static int unp_externalize_fp(struct file *);
309 static struct mbuf *unp_addsockcred(struct thread *, struct mbuf *,
310 int, struct mbuf **, u_int *, u_int *);
311 static void unp_process_defers(void * __unused, int);
312
313 static void
unp_pcb_hold(struct unpcb * unp)314 unp_pcb_hold(struct unpcb *unp)
315 {
316 u_int old __unused;
317
318 old = refcount_acquire(&unp->unp_refcount);
319 KASSERT(old > 0, ("%s: unpcb %p has no references", __func__, unp));
320 }
321
322 static __result_use_check bool
unp_pcb_rele(struct unpcb * unp)323 unp_pcb_rele(struct unpcb *unp)
324 {
325 bool ret;
326
327 UNP_PCB_LOCK_ASSERT(unp);
328
329 if ((ret = refcount_release(&unp->unp_refcount))) {
330 UNP_PCB_UNLOCK(unp);
331 UNP_PCB_LOCK_DESTROY(unp);
332 uma_zfree(unp_zone, unp);
333 }
334 return (ret);
335 }
336
337 static void
unp_pcb_rele_notlast(struct unpcb * unp)338 unp_pcb_rele_notlast(struct unpcb *unp)
339 {
340 bool ret __unused;
341
342 ret = refcount_release(&unp->unp_refcount);
343 KASSERT(!ret, ("%s: unpcb %p has no references", __func__, unp));
344 }
345
346 static void
unp_pcb_lock_pair(struct unpcb * unp,struct unpcb * unp2)347 unp_pcb_lock_pair(struct unpcb *unp, struct unpcb *unp2)
348 {
349 UNP_PCB_UNLOCK_ASSERT(unp);
350 UNP_PCB_UNLOCK_ASSERT(unp2);
351
352 if (unp == unp2) {
353 UNP_PCB_LOCK(unp);
354 } else if ((uintptr_t)unp2 > (uintptr_t)unp) {
355 UNP_PCB_LOCK(unp);
356 UNP_PCB_LOCK(unp2);
357 } else {
358 UNP_PCB_LOCK(unp2);
359 UNP_PCB_LOCK(unp);
360 }
361 }
362
363 static void
unp_pcb_unlock_pair(struct unpcb * unp,struct unpcb * unp2)364 unp_pcb_unlock_pair(struct unpcb *unp, struct unpcb *unp2)
365 {
366 UNP_PCB_UNLOCK(unp);
367 if (unp != unp2)
368 UNP_PCB_UNLOCK(unp2);
369 }
370
371 /*
372 * Try to lock the connected peer of an already locked socket. In some cases
373 * this requires that we unlock the current socket. The pairbusy counter is
374 * used to block concurrent connection attempts while the lock is dropped. The
375 * caller must be careful to revalidate PCB state.
376 */
377 static struct unpcb *
unp_pcb_lock_peer(struct unpcb * unp)378 unp_pcb_lock_peer(struct unpcb *unp)
379 {
380 struct unpcb *unp2;
381
382 UNP_PCB_LOCK_ASSERT(unp);
383 unp2 = unp->unp_conn;
384 if (unp2 == NULL)
385 return (NULL);
386 if (__predict_false(unp == unp2))
387 return (unp);
388
389 UNP_PCB_UNLOCK_ASSERT(unp2);
390
391 if (__predict_true(UNP_PCB_TRYLOCK(unp2)))
392 return (unp2);
393 if ((uintptr_t)unp2 > (uintptr_t)unp) {
394 UNP_PCB_LOCK(unp2);
395 return (unp2);
396 }
397 unp->unp_pairbusy++;
398 unp_pcb_hold(unp2);
399 UNP_PCB_UNLOCK(unp);
400
401 UNP_PCB_LOCK(unp2);
402 UNP_PCB_LOCK(unp);
403 KASSERT(unp->unp_conn == unp2 || unp->unp_conn == NULL,
404 ("%s: socket %p was reconnected", __func__, unp));
405 if (--unp->unp_pairbusy == 0 && (unp->unp_flags & UNP_WAITING) != 0) {
406 unp->unp_flags &= ~UNP_WAITING;
407 wakeup(unp);
408 }
409 if (unp_pcb_rele(unp2)) {
410 /* unp2 is unlocked. */
411 return (NULL);
412 }
413 if (unp->unp_conn == NULL) {
414 UNP_PCB_UNLOCK(unp2);
415 return (NULL);
416 }
417 return (unp2);
418 }
419
420 static void
uipc_abort(struct socket * so)421 uipc_abort(struct socket *so)
422 {
423 struct unpcb *unp, *unp2;
424
425 unp = sotounpcb(so);
426 KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
427 UNP_PCB_UNLOCK_ASSERT(unp);
428
429 UNP_PCB_LOCK(unp);
430 unp2 = unp->unp_conn;
431 if (unp2 != NULL) {
432 unp_pcb_hold(unp2);
433 UNP_PCB_UNLOCK(unp);
434 unp_drop(unp2);
435 } else
436 UNP_PCB_UNLOCK(unp);
437 }
438
439 static int
uipc_attach(struct socket * so,int proto,struct thread * td)440 uipc_attach(struct socket *so, int proto, struct thread *td)
441 {
442 u_long sendspace, recvspace;
443 struct unpcb *unp;
444 int error;
445 bool locked;
446
447 KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
448 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
449 switch (so->so_type) {
450 case SOCK_STREAM:
451 sendspace = unpst_sendspace;
452 recvspace = unpst_recvspace;
453 break;
454
455 case SOCK_DGRAM:
456 STAILQ_INIT(&so->so_rcv.uxdg_mb);
457 STAILQ_INIT(&so->so_snd.uxdg_mb);
458 TAILQ_INIT(&so->so_rcv.uxdg_conns);
459 /*
460 * Since send buffer is either bypassed or is a part
461 * of one-to-many receive buffer, we assign both space
462 * limits to unpdg_recvspace.
463 */
464 sendspace = recvspace = unpdg_recvspace;
465 break;
466
467 case SOCK_SEQPACKET:
468 sendspace = unpsp_sendspace;
469 recvspace = unpsp_recvspace;
470 break;
471
472 default:
473 panic("uipc_attach");
474 }
475 error = soreserve(so, sendspace, recvspace);
476 if (error)
477 return (error);
478 }
479 unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
480 if (unp == NULL)
481 return (ENOBUFS);
482 LIST_INIT(&unp->unp_refs);
483 UNP_PCB_LOCK_INIT(unp);
484 unp->unp_socket = so;
485 so->so_pcb = unp;
486 refcount_init(&unp->unp_refcount, 1);
487 unp->unp_mode = ACCESSPERMS;
488
489 if ((locked = UNP_LINK_WOWNED()) == false)
490 UNP_LINK_WLOCK();
491
492 unp->unp_gencnt = ++unp_gencnt;
493 unp->unp_ino = ++unp_ino;
494 unp_count++;
495 switch (so->so_type) {
496 case SOCK_STREAM:
497 LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
498 break;
499
500 case SOCK_DGRAM:
501 LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
502 break;
503
504 case SOCK_SEQPACKET:
505 LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
506 break;
507
508 default:
509 panic("uipc_attach");
510 }
511
512 if (locked == false)
513 UNP_LINK_WUNLOCK();
514
515 return (0);
516 }
517
518 static int
uipc_bindat(int fd,struct socket * so,struct sockaddr * nam,struct thread * td)519 uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
520 {
521 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
522 struct vattr vattr;
523 int error, namelen;
524 struct nameidata nd;
525 struct unpcb *unp;
526 struct vnode *vp;
527 struct mount *mp;
528 cap_rights_t rights;
529 char *buf;
530 mode_t mode;
531
532 if (nam->sa_family != AF_UNIX)
533 return (EAFNOSUPPORT);
534
535 unp = sotounpcb(so);
536 KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
537
538 if (soun->sun_len > sizeof(struct sockaddr_un))
539 return (EINVAL);
540 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
541 if (namelen <= 0)
542 return (EINVAL);
543
544 /*
545 * We don't allow simultaneous bind() calls on a single UNIX domain
546 * socket, so flag in-progress operations, and return an error if an
547 * operation is already in progress.
548 *
549 * Historically, we have not allowed a socket to be rebound, so this
550 * also returns an error. Not allowing re-binding simplifies the
551 * implementation and avoids a great many possible failure modes.
552 */
553 UNP_PCB_LOCK(unp);
554 if (unp->unp_vnode != NULL) {
555 UNP_PCB_UNLOCK(unp);
556 return (EINVAL);
557 }
558 if (unp->unp_flags & UNP_BINDING) {
559 UNP_PCB_UNLOCK(unp);
560 return (EALREADY);
561 }
562 unp->unp_flags |= UNP_BINDING;
563 mode = unp->unp_mode & ~td->td_proc->p_pd->pd_cmask;
564 UNP_PCB_UNLOCK(unp);
565
566 buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
567 bcopy(soun->sun_path, buf, namelen);
568 buf[namelen] = 0;
569
570 restart:
571 NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | NOCACHE,
572 UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_BINDAT));
573 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
574 error = namei(&nd);
575 if (error)
576 goto error;
577 vp = nd.ni_vp;
578 if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
579 NDFREE_PNBUF(&nd);
580 if (nd.ni_dvp == vp)
581 vrele(nd.ni_dvp);
582 else
583 vput(nd.ni_dvp);
584 if (vp != NULL) {
585 vrele(vp);
586 error = EADDRINUSE;
587 goto error;
588 }
589 error = vn_start_write(NULL, &mp, V_XSLEEP | V_PCATCH);
590 if (error)
591 goto error;
592 goto restart;
593 }
594 VATTR_NULL(&vattr);
595 vattr.va_type = VSOCK;
596 vattr.va_mode = mode;
597 #ifdef MAC
598 error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
599 &vattr);
600 #endif
601 if (error == 0) {
602 /*
603 * The prior lookup may have left LK_SHARED in cn_lkflags,
604 * and VOP_CREATE technically only requires the new vnode to
605 * be locked shared. Most filesystems will return the new vnode
606 * locked exclusive regardless, but we should explicitly
607 * specify that here since we require it and assert to that
608 * effect below.
609 */
610 nd.ni_cnd.cn_lkflags = (nd.ni_cnd.cn_lkflags & ~LK_SHARED) |
611 LK_EXCLUSIVE;
612 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
613 }
614 NDFREE_PNBUF(&nd);
615 if (error) {
616 VOP_VPUT_PAIR(nd.ni_dvp, NULL, true);
617 vn_finished_write(mp);
618 if (error == ERELOOKUP)
619 goto restart;
620 goto error;
621 }
622 vp = nd.ni_vp;
623 ASSERT_VOP_ELOCKED(vp, "uipc_bind");
624 soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
625
626 UNP_PCB_LOCK(unp);
627 VOP_UNP_BIND(vp, unp);
628 unp->unp_vnode = vp;
629 unp->unp_addr = soun;
630 unp->unp_flags &= ~UNP_BINDING;
631 UNP_PCB_UNLOCK(unp);
632 vref(vp);
633 VOP_VPUT_PAIR(nd.ni_dvp, &vp, true);
634 vn_finished_write(mp);
635 free(buf, M_TEMP);
636 return (0);
637
638 error:
639 UNP_PCB_LOCK(unp);
640 unp->unp_flags &= ~UNP_BINDING;
641 UNP_PCB_UNLOCK(unp);
642 free(buf, M_TEMP);
643 return (error);
644 }
645
646 static int
uipc_bind(struct socket * so,struct sockaddr * nam,struct thread * td)647 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
648 {
649
650 return (uipc_bindat(AT_FDCWD, so, nam, td));
651 }
652
653 static int
uipc_connect(struct socket * so,struct sockaddr * nam,struct thread * td)654 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
655 {
656 int error;
657
658 KASSERT(td == curthread, ("uipc_connect: td != curthread"));
659 error = unp_connect(so, nam, td);
660 return (error);
661 }
662
663 static int
uipc_connectat(int fd,struct socket * so,struct sockaddr * nam,struct thread * td)664 uipc_connectat(int fd, struct socket *so, struct sockaddr *nam,
665 struct thread *td)
666 {
667 int error;
668
669 KASSERT(td == curthread, ("uipc_connectat: td != curthread"));
670 error = unp_connectat(fd, so, nam, td, false);
671 return (error);
672 }
673
674 static void
uipc_close(struct socket * so)675 uipc_close(struct socket *so)
676 {
677 struct unpcb *unp, *unp2;
678 struct vnode *vp = NULL;
679 struct mtx *vplock;
680
681 unp = sotounpcb(so);
682 KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
683
684 vplock = NULL;
685 if ((vp = unp->unp_vnode) != NULL) {
686 vplock = mtx_pool_find(unp_vp_mtxpool, vp);
687 mtx_lock(vplock);
688 }
689 UNP_PCB_LOCK(unp);
690 if (vp && unp->unp_vnode == NULL) {
691 mtx_unlock(vplock);
692 vp = NULL;
693 }
694 if (vp != NULL) {
695 VOP_UNP_DETACH(vp);
696 unp->unp_vnode = NULL;
697 }
698 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
699 unp_disconnect(unp, unp2);
700 else
701 UNP_PCB_UNLOCK(unp);
702 if (vp) {
703 mtx_unlock(vplock);
704 vrele(vp);
705 }
706 }
707
708 static int
uipc_chmod(struct socket * so,mode_t mode,struct ucred * cred __unused,struct thread * td __unused)709 uipc_chmod(struct socket *so, mode_t mode, struct ucred *cred __unused,
710 struct thread *td __unused)
711 {
712 struct unpcb *unp;
713 int error;
714
715 if ((mode & ~ACCESSPERMS) != 0)
716 return (EINVAL);
717
718 error = 0;
719 unp = sotounpcb(so);
720 UNP_PCB_LOCK(unp);
721 if (unp->unp_vnode != NULL || (unp->unp_flags & UNP_BINDING) != 0)
722 error = EINVAL;
723 else
724 unp->unp_mode = mode;
725 UNP_PCB_UNLOCK(unp);
726 return (error);
727 }
728
729 static int
uipc_connect2(struct socket * so1,struct socket * so2)730 uipc_connect2(struct socket *so1, struct socket *so2)
731 {
732 struct unpcb *unp, *unp2;
733
734 if (so1->so_type != so2->so_type)
735 return (EPROTOTYPE);
736
737 unp = so1->so_pcb;
738 KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
739 unp2 = so2->so_pcb;
740 KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
741 unp_pcb_lock_pair(unp, unp2);
742 unp_connect2(so1, so2);
743 unp_pcb_unlock_pair(unp, unp2);
744
745 return (0);
746 }
747
748 static void
uipc_detach(struct socket * so)749 uipc_detach(struct socket *so)
750 {
751 struct unpcb *unp, *unp2;
752 struct mtx *vplock;
753 struct vnode *vp;
754 int local_unp_rights;
755
756 unp = sotounpcb(so);
757 KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
758
759 vp = NULL;
760 vplock = NULL;
761
762 if (!SOLISTENING(so))
763 unp_dispose(so);
764
765 UNP_LINK_WLOCK();
766 LIST_REMOVE(unp, unp_link);
767 if (unp->unp_gcflag & UNPGC_DEAD)
768 LIST_REMOVE(unp, unp_dead);
769 unp->unp_gencnt = ++unp_gencnt;
770 --unp_count;
771 UNP_LINK_WUNLOCK();
772
773 UNP_PCB_UNLOCK_ASSERT(unp);
774 restart:
775 if ((vp = unp->unp_vnode) != NULL) {
776 vplock = mtx_pool_find(unp_vp_mtxpool, vp);
777 mtx_lock(vplock);
778 }
779 UNP_PCB_LOCK(unp);
780 if (unp->unp_vnode != vp && unp->unp_vnode != NULL) {
781 if (vplock)
782 mtx_unlock(vplock);
783 UNP_PCB_UNLOCK(unp);
784 goto restart;
785 }
786 if ((vp = unp->unp_vnode) != NULL) {
787 VOP_UNP_DETACH(vp);
788 unp->unp_vnode = NULL;
789 }
790 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
791 unp_disconnect(unp, unp2);
792 else
793 UNP_PCB_UNLOCK(unp);
794
795 UNP_REF_LIST_LOCK();
796 while (!LIST_EMPTY(&unp->unp_refs)) {
797 struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
798
799 unp_pcb_hold(ref);
800 UNP_REF_LIST_UNLOCK();
801
802 MPASS(ref != unp);
803 UNP_PCB_UNLOCK_ASSERT(ref);
804 unp_drop(ref);
805 UNP_REF_LIST_LOCK();
806 }
807 UNP_REF_LIST_UNLOCK();
808
809 UNP_PCB_LOCK(unp);
810 local_unp_rights = unp_rights;
811 unp->unp_socket->so_pcb = NULL;
812 unp->unp_socket = NULL;
813 free(unp->unp_addr, M_SONAME);
814 unp->unp_addr = NULL;
815 if (!unp_pcb_rele(unp))
816 UNP_PCB_UNLOCK(unp);
817 if (vp) {
818 mtx_unlock(vplock);
819 vrele(vp);
820 }
821 if (local_unp_rights)
822 taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
823
824 switch (so->so_type) {
825 case SOCK_DGRAM:
826 /*
827 * Everything should have been unlinked/freed by unp_dispose()
828 * and/or unp_disconnect().
829 */
830 MPASS(so->so_rcv.uxdg_peeked == NULL);
831 MPASS(STAILQ_EMPTY(&so->so_rcv.uxdg_mb));
832 MPASS(TAILQ_EMPTY(&so->so_rcv.uxdg_conns));
833 MPASS(STAILQ_EMPTY(&so->so_snd.uxdg_mb));
834 }
835 }
836
837 static int
uipc_disconnect(struct socket * so)838 uipc_disconnect(struct socket *so)
839 {
840 struct unpcb *unp, *unp2;
841
842 unp = sotounpcb(so);
843 KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
844
845 UNP_PCB_LOCK(unp);
846 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
847 unp_disconnect(unp, unp2);
848 else
849 UNP_PCB_UNLOCK(unp);
850 return (0);
851 }
852
853 static int
uipc_listen(struct socket * so,int backlog,struct thread * td)854 uipc_listen(struct socket *so, int backlog, struct thread *td)
855 {
856 struct unpcb *unp;
857 int error;
858
859 MPASS(so->so_type != SOCK_DGRAM);
860
861 /*
862 * Synchronize with concurrent connection attempts.
863 */
864 error = 0;
865 unp = sotounpcb(so);
866 UNP_PCB_LOCK(unp);
867 if (unp->unp_conn != NULL || (unp->unp_flags & UNP_CONNECTING) != 0)
868 error = EINVAL;
869 else if (unp->unp_vnode == NULL)
870 error = EDESTADDRREQ;
871 if (error != 0) {
872 UNP_PCB_UNLOCK(unp);
873 return (error);
874 }
875
876 SOCK_LOCK(so);
877 error = solisten_proto_check(so);
878 if (error == 0) {
879 cru2xt(td, &unp->unp_peercred);
880 solisten_proto(so, backlog);
881 }
882 SOCK_UNLOCK(so);
883 UNP_PCB_UNLOCK(unp);
884 return (error);
885 }
886
887 static int
uipc_peeraddr(struct socket * so,struct sockaddr * ret)888 uipc_peeraddr(struct socket *so, struct sockaddr *ret)
889 {
890 struct unpcb *unp, *unp2;
891 const struct sockaddr *sa;
892
893 unp = sotounpcb(so);
894 KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
895
896 UNP_PCB_LOCK(unp);
897 unp2 = unp_pcb_lock_peer(unp);
898 if (unp2 != NULL) {
899 if (unp2->unp_addr != NULL)
900 sa = (struct sockaddr *)unp2->unp_addr;
901 else
902 sa = &sun_noname;
903 bcopy(sa, ret, sa->sa_len);
904 unp_pcb_unlock_pair(unp, unp2);
905 } else {
906 UNP_PCB_UNLOCK(unp);
907 sa = &sun_noname;
908 bcopy(sa, ret, sa->sa_len);
909 }
910 return (0);
911 }
912
913 static int
uipc_rcvd(struct socket * so,int flags)914 uipc_rcvd(struct socket *so, int flags)
915 {
916 struct unpcb *unp, *unp2;
917 struct socket *so2;
918 u_int mbcnt, sbcc;
919
920 unp = sotounpcb(so);
921 KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
922 KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET,
923 ("%s: socktype %d", __func__, so->so_type));
924
925 /*
926 * Adjust backpressure on sender and wakeup any waiting to write.
927 *
928 * The unp lock is acquired to maintain the validity of the unp_conn
929 * pointer; no lock on unp2 is required as unp2->unp_socket will be
930 * static as long as we don't permit unp2 to disconnect from unp,
931 * which is prevented by the lock on unp. We cache values from
932 * so_rcv to avoid holding the so_rcv lock over the entire
933 * transaction on the remote so_snd.
934 */
935 SOCKBUF_LOCK(&so->so_rcv);
936 mbcnt = so->so_rcv.sb_mbcnt;
937 sbcc = sbavail(&so->so_rcv);
938 SOCKBUF_UNLOCK(&so->so_rcv);
939 /*
940 * There is a benign race condition at this point. If we're planning to
941 * clear SB_STOP, but uipc_send is called on the connected socket at
942 * this instant, it might add data to the sockbuf and set SB_STOP. Then
943 * we would erroneously clear SB_STOP below, even though the sockbuf is
944 * full. The race is benign because the only ill effect is to allow the
945 * sockbuf to exceed its size limit, and the size limits are not
946 * strictly guaranteed anyway.
947 */
948 UNP_PCB_LOCK(unp);
949 unp2 = unp->unp_conn;
950 if (unp2 == NULL) {
951 UNP_PCB_UNLOCK(unp);
952 return (0);
953 }
954 so2 = unp2->unp_socket;
955 SOCKBUF_LOCK(&so2->so_snd);
956 if (sbcc < so2->so_snd.sb_hiwat && mbcnt < so2->so_snd.sb_mbmax)
957 so2->so_snd.sb_flags &= ~SB_STOP;
958 sowwakeup_locked(so2);
959 UNP_PCB_UNLOCK(unp);
960 return (0);
961 }
962
963 static int
uipc_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct thread * td)964 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
965 struct mbuf *control, struct thread *td)
966 {
967 struct unpcb *unp, *unp2;
968 struct socket *so2;
969 u_int mbcnt, sbcc;
970 int error;
971
972 unp = sotounpcb(so);
973 KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
974 KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET,
975 ("%s: socktype %d", __func__, so->so_type));
976
977 error = 0;
978 if (flags & PRUS_OOB) {
979 error = EOPNOTSUPP;
980 goto release;
981 }
982 if (control != NULL &&
983 (error = unp_internalize(&control, td, NULL, NULL, NULL)))
984 goto release;
985
986 unp2 = NULL;
987 if ((so->so_state & SS_ISCONNECTED) == 0) {
988 if (nam != NULL) {
989 if ((error = unp_connect(so, nam, td)) != 0)
990 goto out;
991 } else {
992 error = ENOTCONN;
993 goto out;
994 }
995 }
996
997 UNP_PCB_LOCK(unp);
998 if ((unp2 = unp_pcb_lock_peer(unp)) == NULL) {
999 UNP_PCB_UNLOCK(unp);
1000 error = ENOTCONN;
1001 goto out;
1002 } else if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1003 unp_pcb_unlock_pair(unp, unp2);
1004 error = EPIPE;
1005 goto out;
1006 }
1007 UNP_PCB_UNLOCK(unp);
1008 if ((so2 = unp2->unp_socket) == NULL) {
1009 UNP_PCB_UNLOCK(unp2);
1010 error = ENOTCONN;
1011 goto out;
1012 }
1013 SOCKBUF_LOCK(&so2->so_rcv);
1014 if (unp2->unp_flags & UNP_WANTCRED_MASK) {
1015 /*
1016 * Credentials are passed only once on SOCK_STREAM and
1017 * SOCK_SEQPACKET (LOCAL_CREDS => WANTCRED_ONESHOT), or
1018 * forever (LOCAL_CREDS_PERSISTENT => WANTCRED_ALWAYS).
1019 */
1020 control = unp_addsockcred(td, control, unp2->unp_flags, NULL,
1021 NULL, NULL);
1022 unp2->unp_flags &= ~UNP_WANTCRED_ONESHOT;
1023 }
1024
1025 /*
1026 * Send to paired receive port and wake up readers. Don't
1027 * check for space available in the receive buffer if we're
1028 * attaching ancillary data; Unix domain sockets only check
1029 * for space in the sending sockbuf, and that check is
1030 * performed one level up the stack. At that level we cannot
1031 * precisely account for the amount of buffer space used
1032 * (e.g., because control messages are not yet internalized).
1033 */
1034 switch (so->so_type) {
1035 case SOCK_STREAM:
1036 if (control != NULL) {
1037 sbappendcontrol_locked(&so2->so_rcv,
1038 m->m_len > 0 ? m : NULL, control, flags);
1039 control = NULL;
1040 } else
1041 sbappend_locked(&so2->so_rcv, m, flags);
1042 break;
1043
1044 case SOCK_SEQPACKET:
1045 if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
1046 &sun_noname, m, control))
1047 control = NULL;
1048 break;
1049 }
1050
1051 mbcnt = so2->so_rcv.sb_mbcnt;
1052 sbcc = sbavail(&so2->so_rcv);
1053 if (sbcc)
1054 sorwakeup_locked(so2);
1055 else
1056 SOCKBUF_UNLOCK(&so2->so_rcv);
1057
1058 /*
1059 * The PCB lock on unp2 protects the SB_STOP flag. Without it,
1060 * it would be possible for uipc_rcvd to be called at this
1061 * point, drain the receiving sockbuf, clear SB_STOP, and then
1062 * we would set SB_STOP below. That could lead to an empty
1063 * sockbuf having SB_STOP set
1064 */
1065 SOCKBUF_LOCK(&so->so_snd);
1066 if (sbcc >= so->so_snd.sb_hiwat || mbcnt >= so->so_snd.sb_mbmax)
1067 so->so_snd.sb_flags |= SB_STOP;
1068 SOCKBUF_UNLOCK(&so->so_snd);
1069 UNP_PCB_UNLOCK(unp2);
1070 m = NULL;
1071 out:
1072 /*
1073 * PRUS_EOF is equivalent to pr_send followed by pr_shutdown.
1074 */
1075 if (flags & PRUS_EOF) {
1076 UNP_PCB_LOCK(unp);
1077 socantsendmore(so);
1078 unp_shutdown(unp);
1079 UNP_PCB_UNLOCK(unp);
1080 }
1081 if (control != NULL && error != 0)
1082 unp_scan(control, unp_freerights);
1083
1084 release:
1085 if (control != NULL)
1086 m_freem(control);
1087 /*
1088 * In case of PRUS_NOTREADY, uipc_ready() is responsible
1089 * for freeing memory.
1090 */
1091 if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1092 m_freem(m);
1093 return (error);
1094 }
1095
1096 /* PF_UNIX/SOCK_DGRAM version of sbspace() */
1097 static inline bool
uipc_dgram_sbspace(struct sockbuf * sb,u_int cc,u_int mbcnt)1098 uipc_dgram_sbspace(struct sockbuf *sb, u_int cc, u_int mbcnt)
1099 {
1100 u_int bleft, mleft;
1101
1102 /*
1103 * Negative space may happen if send(2) is followed by
1104 * setsockopt(SO_SNDBUF/SO_RCVBUF) that shrinks maximum.
1105 */
1106 if (__predict_false(sb->sb_hiwat < sb->uxdg_cc ||
1107 sb->sb_mbmax < sb->uxdg_mbcnt))
1108 return (false);
1109
1110 if (__predict_false(sb->sb_state & SBS_CANTRCVMORE))
1111 return (false);
1112
1113 bleft = sb->sb_hiwat - sb->uxdg_cc;
1114 mleft = sb->sb_mbmax - sb->uxdg_mbcnt;
1115
1116 return (bleft >= cc && mleft >= mbcnt);
1117 }
1118
1119 /*
1120 * PF_UNIX/SOCK_DGRAM send
1121 *
1122 * Allocate a record consisting of 3 mbufs in the sequence of
1123 * from -> control -> data and append it to the socket buffer.
1124 *
1125 * The first mbuf carries sender's name and is a pkthdr that stores
1126 * overall length of datagram, its memory consumption and control length.
1127 */
1128 #define ctllen PH_loc.thirtytwo[1]
1129 _Static_assert(offsetof(struct pkthdr, memlen) + sizeof(u_int) <=
1130 offsetof(struct pkthdr, ctllen), "unix/dgram can not store ctllen");
1131 static int
uipc_sosend_dgram(struct socket * so,struct sockaddr * addr,struct uio * uio,struct mbuf * m,struct mbuf * c,int flags,struct thread * td)1132 uipc_sosend_dgram(struct socket *so, struct sockaddr *addr, struct uio *uio,
1133 struct mbuf *m, struct mbuf *c, int flags, struct thread *td)
1134 {
1135 struct unpcb *unp, *unp2;
1136 const struct sockaddr *from;
1137 struct socket *so2;
1138 struct sockbuf *sb;
1139 struct mbuf *f, *clast;
1140 u_int cc, ctl, mbcnt;
1141 u_int dcc __diagused, dctl __diagused, dmbcnt __diagused;
1142 int error;
1143
1144 MPASS((uio != NULL && m == NULL) || (m != NULL && uio == NULL));
1145
1146 error = 0;
1147 f = NULL;
1148 ctl = 0;
1149
1150 if (__predict_false(flags & MSG_OOB)) {
1151 error = EOPNOTSUPP;
1152 goto out;
1153 }
1154 if (m == NULL) {
1155 if (__predict_false(uio->uio_resid > unpdg_maxdgram)) {
1156 error = EMSGSIZE;
1157 goto out;
1158 }
1159 m = m_uiotombuf(uio, M_WAITOK, 0, max_hdr, M_PKTHDR);
1160 if (__predict_false(m == NULL)) {
1161 error = EFAULT;
1162 goto out;
1163 }
1164 f = m_gethdr(M_WAITOK, MT_SONAME);
1165 cc = m->m_pkthdr.len;
1166 mbcnt = MSIZE + m->m_pkthdr.memlen;
1167 if (c != NULL &&
1168 (error = unp_internalize(&c, td, &clast, &ctl, &mbcnt)))
1169 goto out;
1170 } else {
1171 /* pr_sosend() with mbuf usually is a kernel thread. */
1172
1173 M_ASSERTPKTHDR(m);
1174 if (__predict_false(c != NULL))
1175 panic("%s: control from a kernel thread", __func__);
1176
1177 if (__predict_false(m->m_pkthdr.len > unpdg_maxdgram)) {
1178 error = EMSGSIZE;
1179 goto out;
1180 }
1181 if ((f = m_gethdr(M_NOWAIT, MT_SONAME)) == NULL) {
1182 error = ENOBUFS;
1183 goto out;
1184 }
1185 /* Condition the foreign mbuf to our standards. */
1186 m_clrprotoflags(m);
1187 m_tag_delete_chain(m, NULL);
1188 m->m_pkthdr.rcvif = NULL;
1189 m->m_pkthdr.flowid = 0;
1190 m->m_pkthdr.csum_flags = 0;
1191 m->m_pkthdr.fibnum = 0;
1192 m->m_pkthdr.rsstype = 0;
1193
1194 cc = m->m_pkthdr.len;
1195 mbcnt = MSIZE;
1196 for (struct mbuf *mb = m; mb != NULL; mb = mb->m_next) {
1197 mbcnt += MSIZE;
1198 if (mb->m_flags & M_EXT)
1199 mbcnt += mb->m_ext.ext_size;
1200 }
1201 }
1202
1203 unp = sotounpcb(so);
1204 MPASS(unp);
1205
1206 /*
1207 * XXXGL: would be cool to fully remove so_snd out of the equation
1208 * and avoid this lock, which is not only extraneous, but also being
1209 * released, thus still leaving possibility for a race. We can easily
1210 * handle SBS_CANTSENDMORE/SS_ISCONNECTED complement in unpcb, but it
1211 * is more difficult to invent something to handle so_error.
1212 */
1213 error = SOCK_IO_SEND_LOCK(so, SBLOCKWAIT(flags));
1214 if (error)
1215 goto out2;
1216 SOCK_SENDBUF_LOCK(so);
1217 if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1218 SOCK_SENDBUF_UNLOCK(so);
1219 error = EPIPE;
1220 goto out3;
1221 }
1222 if (so->so_error != 0) {
1223 error = so->so_error;
1224 so->so_error = 0;
1225 SOCK_SENDBUF_UNLOCK(so);
1226 goto out3;
1227 }
1228 if (((so->so_state & SS_ISCONNECTED) == 0) && addr == NULL) {
1229 SOCK_SENDBUF_UNLOCK(so);
1230 error = EDESTADDRREQ;
1231 goto out3;
1232 }
1233 SOCK_SENDBUF_UNLOCK(so);
1234
1235 if (addr != NULL) {
1236 if ((error = unp_connectat(AT_FDCWD, so, addr, td, true)))
1237 goto out3;
1238 UNP_PCB_LOCK_ASSERT(unp);
1239 unp2 = unp->unp_conn;
1240 UNP_PCB_LOCK_ASSERT(unp2);
1241 } else {
1242 UNP_PCB_LOCK(unp);
1243 unp2 = unp_pcb_lock_peer(unp);
1244 if (unp2 == NULL) {
1245 UNP_PCB_UNLOCK(unp);
1246 error = ENOTCONN;
1247 goto out3;
1248 }
1249 }
1250
1251 if (unp2->unp_flags & UNP_WANTCRED_MASK)
1252 c = unp_addsockcred(td, c, unp2->unp_flags, &clast, &ctl,
1253 &mbcnt);
1254 if (unp->unp_addr != NULL)
1255 from = (struct sockaddr *)unp->unp_addr;
1256 else
1257 from = &sun_noname;
1258 f->m_len = from->sa_len;
1259 MPASS(from->sa_len <= MLEN);
1260 bcopy(from, mtod(f, void *), from->sa_len);
1261 ctl += f->m_len;
1262
1263 /*
1264 * Concatenate mbufs: from -> control -> data.
1265 * Save overall cc and mbcnt in "from" mbuf.
1266 */
1267 if (c != NULL) {
1268 #ifdef INVARIANTS
1269 struct mbuf *mc;
1270
1271 for (mc = c; mc->m_next != NULL; mc = mc->m_next);
1272 MPASS(mc == clast);
1273 #endif
1274 f->m_next = c;
1275 clast->m_next = m;
1276 c = NULL;
1277 } else
1278 f->m_next = m;
1279 m = NULL;
1280 #ifdef INVARIANTS
1281 dcc = dctl = dmbcnt = 0;
1282 for (struct mbuf *mb = f; mb != NULL; mb = mb->m_next) {
1283 if (mb->m_type == MT_DATA)
1284 dcc += mb->m_len;
1285 else
1286 dctl += mb->m_len;
1287 dmbcnt += MSIZE;
1288 if (mb->m_flags & M_EXT)
1289 dmbcnt += mb->m_ext.ext_size;
1290 }
1291 MPASS(dcc == cc);
1292 MPASS(dctl == ctl);
1293 MPASS(dmbcnt == mbcnt);
1294 #endif
1295 f->m_pkthdr.len = cc + ctl;
1296 f->m_pkthdr.memlen = mbcnt;
1297 f->m_pkthdr.ctllen = ctl;
1298
1299 /*
1300 * Destination socket buffer selection.
1301 *
1302 * Unconnected sends, when !(so->so_state & SS_ISCONNECTED) and the
1303 * destination address is supplied, create a temporary connection for
1304 * the run time of the function (see call to unp_connectat() above and
1305 * to unp_disconnect() below). We distinguish them by condition of
1306 * (addr != NULL). We intentionally avoid adding 'bool connected' for
1307 * that condition, since, again, through the run time of this code we
1308 * are always connected. For such "unconnected" sends, the destination
1309 * buffer would be the receive buffer of destination socket so2.
1310 *
1311 * For connected sends, data lands on the send buffer of the sender's
1312 * socket "so". Then, if we just added the very first datagram
1313 * on this send buffer, we need to add the send buffer on to the
1314 * receiving socket's buffer list. We put ourselves on top of the
1315 * list. Such logic gives infrequent senders priority over frequent
1316 * senders.
1317 *
1318 * Note on byte count management. As long as event methods kevent(2),
1319 * select(2) are not protocol specific (yet), we need to maintain
1320 * meaningful values on the receive buffer. So, the receive buffer
1321 * would accumulate counters from all connected buffers potentially
1322 * having sb_ccc > sb_hiwat or sb_mbcnt > sb_mbmax.
1323 */
1324 so2 = unp2->unp_socket;
1325 sb = (addr == NULL) ? &so->so_snd : &so2->so_rcv;
1326 SOCK_RECVBUF_LOCK(so2);
1327 if (uipc_dgram_sbspace(sb, cc + ctl, mbcnt)) {
1328 if (addr == NULL && STAILQ_EMPTY(&sb->uxdg_mb))
1329 TAILQ_INSERT_HEAD(&so2->so_rcv.uxdg_conns, &so->so_snd,
1330 uxdg_clist);
1331 STAILQ_INSERT_TAIL(&sb->uxdg_mb, f, m_stailqpkt);
1332 sb->uxdg_cc += cc + ctl;
1333 sb->uxdg_ctl += ctl;
1334 sb->uxdg_mbcnt += mbcnt;
1335 so2->so_rcv.sb_acc += cc + ctl;
1336 so2->so_rcv.sb_ccc += cc + ctl;
1337 so2->so_rcv.sb_ctl += ctl;
1338 so2->so_rcv.sb_mbcnt += mbcnt;
1339 sorwakeup_locked(so2);
1340 f = NULL;
1341 } else {
1342 soroverflow_locked(so2);
1343 error = ENOBUFS;
1344 if (f->m_next->m_type == MT_CONTROL) {
1345 c = f->m_next;
1346 f->m_next = NULL;
1347 }
1348 }
1349
1350 if (addr != NULL)
1351 unp_disconnect(unp, unp2);
1352 else
1353 unp_pcb_unlock_pair(unp, unp2);
1354
1355 td->td_ru.ru_msgsnd++;
1356
1357 out3:
1358 SOCK_IO_SEND_UNLOCK(so);
1359 out2:
1360 if (c)
1361 unp_scan(c, unp_freerights);
1362 out:
1363 if (f)
1364 m_freem(f);
1365 if (c)
1366 m_freem(c);
1367 if (m)
1368 m_freem(m);
1369
1370 return (error);
1371 }
1372
1373 /*
1374 * PF_UNIX/SOCK_DGRAM receive with MSG_PEEK.
1375 * The mbuf has already been unlinked from the uxdg_mb of socket buffer
1376 * and needs to be linked onto uxdg_peeked of receive socket buffer.
1377 */
1378 static int
uipc_peek_dgram(struct socket * so,struct mbuf * m,struct sockaddr ** psa,struct uio * uio,struct mbuf ** controlp,int * flagsp)1379 uipc_peek_dgram(struct socket *so, struct mbuf *m, struct sockaddr **psa,
1380 struct uio *uio, struct mbuf **controlp, int *flagsp)
1381 {
1382 ssize_t len = 0;
1383 int error;
1384
1385 so->so_rcv.uxdg_peeked = m;
1386 so->so_rcv.uxdg_cc += m->m_pkthdr.len;
1387 so->so_rcv.uxdg_ctl += m->m_pkthdr.ctllen;
1388 so->so_rcv.uxdg_mbcnt += m->m_pkthdr.memlen;
1389 SOCK_RECVBUF_UNLOCK(so);
1390
1391 KASSERT(m->m_type == MT_SONAME, ("m->m_type == %d", m->m_type));
1392 if (psa != NULL)
1393 *psa = sodupsockaddr(mtod(m, struct sockaddr *), M_WAITOK);
1394
1395 m = m->m_next;
1396 KASSERT(m, ("%s: no data or control after soname", __func__));
1397
1398 /*
1399 * With MSG_PEEK the control isn't executed, just copied.
1400 */
1401 while (m != NULL && m->m_type == MT_CONTROL) {
1402 if (controlp != NULL) {
1403 *controlp = m_copym(m, 0, m->m_len, M_WAITOK);
1404 controlp = &(*controlp)->m_next;
1405 }
1406 m = m->m_next;
1407 }
1408 KASSERT(m == NULL || m->m_type == MT_DATA,
1409 ("%s: not MT_DATA mbuf %p", __func__, m));
1410 while (m != NULL && uio->uio_resid > 0) {
1411 len = uio->uio_resid;
1412 if (len > m->m_len)
1413 len = m->m_len;
1414 error = uiomove(mtod(m, char *), (int)len, uio);
1415 if (error) {
1416 SOCK_IO_RECV_UNLOCK(so);
1417 return (error);
1418 }
1419 if (len == m->m_len)
1420 m = m->m_next;
1421 }
1422 SOCK_IO_RECV_UNLOCK(so);
1423
1424 if (flagsp != NULL) {
1425 if (m != NULL) {
1426 if (*flagsp & MSG_TRUNC) {
1427 /* Report real length of the packet */
1428 uio->uio_resid -= m_length(m, NULL) - len;
1429 }
1430 *flagsp |= MSG_TRUNC;
1431 } else
1432 *flagsp &= ~MSG_TRUNC;
1433 }
1434
1435 return (0);
1436 }
1437
1438 /*
1439 * PF_UNIX/SOCK_DGRAM receive
1440 */
1441 static int
uipc_soreceive_dgram(struct socket * so,struct sockaddr ** psa,struct uio * uio,struct mbuf ** mp0,struct mbuf ** controlp,int * flagsp)1442 uipc_soreceive_dgram(struct socket *so, struct sockaddr **psa, struct uio *uio,
1443 struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
1444 {
1445 struct sockbuf *sb = NULL;
1446 struct mbuf *m;
1447 int flags, error;
1448 ssize_t len = 0;
1449 bool nonblock;
1450
1451 MPASS(mp0 == NULL);
1452
1453 if (psa != NULL)
1454 *psa = NULL;
1455 if (controlp != NULL)
1456 *controlp = NULL;
1457
1458 flags = flagsp != NULL ? *flagsp : 0;
1459 nonblock = (so->so_state & SS_NBIO) ||
1460 (flags & (MSG_DONTWAIT | MSG_NBIO));
1461
1462 error = SOCK_IO_RECV_LOCK(so, SBLOCKWAIT(flags));
1463 if (__predict_false(error))
1464 return (error);
1465
1466 /*
1467 * Loop blocking while waiting for a datagram. Prioritize connected
1468 * peers over unconnected sends. Set sb to selected socket buffer
1469 * containing an mbuf on exit from the wait loop. A datagram that
1470 * had already been peeked at has top priority.
1471 */
1472 SOCK_RECVBUF_LOCK(so);
1473 while ((m = so->so_rcv.uxdg_peeked) == NULL &&
1474 (sb = TAILQ_FIRST(&so->so_rcv.uxdg_conns)) == NULL &&
1475 (m = STAILQ_FIRST(&so->so_rcv.uxdg_mb)) == NULL) {
1476 if (so->so_error) {
1477 error = so->so_error;
1478 if (!(flags & MSG_PEEK))
1479 so->so_error = 0;
1480 SOCK_RECVBUF_UNLOCK(so);
1481 SOCK_IO_RECV_UNLOCK(so);
1482 return (error);
1483 }
1484 if (so->so_rcv.sb_state & SBS_CANTRCVMORE ||
1485 uio->uio_resid == 0) {
1486 SOCK_RECVBUF_UNLOCK(so);
1487 SOCK_IO_RECV_UNLOCK(so);
1488 return (0);
1489 }
1490 if (nonblock) {
1491 SOCK_RECVBUF_UNLOCK(so);
1492 SOCK_IO_RECV_UNLOCK(so);
1493 return (EWOULDBLOCK);
1494 }
1495 error = sbwait(so, SO_RCV);
1496 if (error) {
1497 SOCK_RECVBUF_UNLOCK(so);
1498 SOCK_IO_RECV_UNLOCK(so);
1499 return (error);
1500 }
1501 }
1502
1503 if (sb == NULL)
1504 sb = &so->so_rcv;
1505 else if (m == NULL)
1506 m = STAILQ_FIRST(&sb->uxdg_mb);
1507 else
1508 MPASS(m == so->so_rcv.uxdg_peeked);
1509
1510 MPASS(sb->uxdg_cc > 0);
1511 M_ASSERTPKTHDR(m);
1512 KASSERT(m->m_type == MT_SONAME, ("m->m_type == %d", m->m_type));
1513
1514 if (uio->uio_td)
1515 uio->uio_td->td_ru.ru_msgrcv++;
1516
1517 if (__predict_true(m != so->so_rcv.uxdg_peeked)) {
1518 STAILQ_REMOVE_HEAD(&sb->uxdg_mb, m_stailqpkt);
1519 if (STAILQ_EMPTY(&sb->uxdg_mb) && sb != &so->so_rcv)
1520 TAILQ_REMOVE(&so->so_rcv.uxdg_conns, sb, uxdg_clist);
1521 } else
1522 so->so_rcv.uxdg_peeked = NULL;
1523
1524 sb->uxdg_cc -= m->m_pkthdr.len;
1525 sb->uxdg_ctl -= m->m_pkthdr.ctllen;
1526 sb->uxdg_mbcnt -= m->m_pkthdr.memlen;
1527
1528 if (__predict_false(flags & MSG_PEEK))
1529 return (uipc_peek_dgram(so, m, psa, uio, controlp, flagsp));
1530
1531 so->so_rcv.sb_acc -= m->m_pkthdr.len;
1532 so->so_rcv.sb_ccc -= m->m_pkthdr.len;
1533 so->so_rcv.sb_ctl -= m->m_pkthdr.ctllen;
1534 so->so_rcv.sb_mbcnt -= m->m_pkthdr.memlen;
1535 SOCK_RECVBUF_UNLOCK(so);
1536
1537 if (psa != NULL)
1538 *psa = sodupsockaddr(mtod(m, struct sockaddr *), M_WAITOK);
1539 m = m_free(m);
1540 KASSERT(m, ("%s: no data or control after soname", __func__));
1541
1542 /*
1543 * Packet to copyout() is now in 'm' and it is disconnected from the
1544 * queue.
1545 *
1546 * Process one or more MT_CONTROL mbufs present before any data mbufs
1547 * in the first mbuf chain on the socket buffer. We call into the
1548 * unp_externalize() to perform externalization (or freeing if
1549 * controlp == NULL). In some cases there can be only MT_CONTROL mbufs
1550 * without MT_DATA mbufs.
1551 */
1552 while (m != NULL && m->m_type == MT_CONTROL) {
1553 struct mbuf *cm;
1554
1555 /* XXXGL: unp_externalize() is also dom_externalize() KBI and
1556 * it frees whole chain, so we must disconnect the mbuf.
1557 */
1558 cm = m; m = m->m_next; cm->m_next = NULL;
1559 error = unp_externalize(cm, controlp, flags);
1560 if (error != 0) {
1561 SOCK_IO_RECV_UNLOCK(so);
1562 unp_scan(m, unp_freerights);
1563 m_freem(m);
1564 return (error);
1565 }
1566 if (controlp != NULL) {
1567 while (*controlp != NULL)
1568 controlp = &(*controlp)->m_next;
1569 }
1570 }
1571 KASSERT(m == NULL || m->m_type == MT_DATA,
1572 ("%s: not MT_DATA mbuf %p", __func__, m));
1573 while (m != NULL && uio->uio_resid > 0) {
1574 len = uio->uio_resid;
1575 if (len > m->m_len)
1576 len = m->m_len;
1577 error = uiomove(mtod(m, char *), (int)len, uio);
1578 if (error) {
1579 SOCK_IO_RECV_UNLOCK(so);
1580 m_freem(m);
1581 return (error);
1582 }
1583 if (len == m->m_len)
1584 m = m_free(m);
1585 else {
1586 m->m_data += len;
1587 m->m_len -= len;
1588 }
1589 }
1590 SOCK_IO_RECV_UNLOCK(so);
1591
1592 if (m != NULL) {
1593 if (flagsp != NULL) {
1594 if (flags & MSG_TRUNC) {
1595 /* Report real length of the packet */
1596 uio->uio_resid -= m_length(m, NULL);
1597 }
1598 *flagsp |= MSG_TRUNC;
1599 }
1600 m_freem(m);
1601 } else if (flagsp != NULL)
1602 *flagsp &= ~MSG_TRUNC;
1603
1604 return (0);
1605 }
1606
1607 static bool
uipc_ready_scan(struct socket * so,struct mbuf * m,int count,int * errorp)1608 uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp)
1609 {
1610 struct mbuf *mb, *n;
1611 struct sockbuf *sb;
1612
1613 SOCK_LOCK(so);
1614 if (SOLISTENING(so)) {
1615 SOCK_UNLOCK(so);
1616 return (false);
1617 }
1618 mb = NULL;
1619 sb = &so->so_rcv;
1620 SOCKBUF_LOCK(sb);
1621 if (sb->sb_fnrdy != NULL) {
1622 for (mb = sb->sb_mb, n = mb->m_nextpkt; mb != NULL;) {
1623 if (mb == m) {
1624 *errorp = sbready(sb, m, count);
1625 break;
1626 }
1627 mb = mb->m_next;
1628 if (mb == NULL) {
1629 mb = n;
1630 if (mb != NULL)
1631 n = mb->m_nextpkt;
1632 }
1633 }
1634 }
1635 SOCKBUF_UNLOCK(sb);
1636 SOCK_UNLOCK(so);
1637 return (mb != NULL);
1638 }
1639
1640 static int
uipc_ready(struct socket * so,struct mbuf * m,int count)1641 uipc_ready(struct socket *so, struct mbuf *m, int count)
1642 {
1643 struct unpcb *unp, *unp2;
1644 struct socket *so2;
1645 int error, i;
1646
1647 unp = sotounpcb(so);
1648
1649 KASSERT(so->so_type == SOCK_STREAM,
1650 ("%s: unexpected socket type for %p", __func__, so));
1651
1652 UNP_PCB_LOCK(unp);
1653 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
1654 UNP_PCB_UNLOCK(unp);
1655 so2 = unp2->unp_socket;
1656 SOCKBUF_LOCK(&so2->so_rcv);
1657 if ((error = sbready(&so2->so_rcv, m, count)) == 0)
1658 sorwakeup_locked(so2);
1659 else
1660 SOCKBUF_UNLOCK(&so2->so_rcv);
1661 UNP_PCB_UNLOCK(unp2);
1662 return (error);
1663 }
1664 UNP_PCB_UNLOCK(unp);
1665
1666 /*
1667 * The receiving socket has been disconnected, but may still be valid.
1668 * In this case, the now-ready mbufs are still present in its socket
1669 * buffer, so perform an exhaustive search before giving up and freeing
1670 * the mbufs.
1671 */
1672 UNP_LINK_RLOCK();
1673 LIST_FOREACH(unp, &unp_shead, unp_link) {
1674 if (uipc_ready_scan(unp->unp_socket, m, count, &error))
1675 break;
1676 }
1677 UNP_LINK_RUNLOCK();
1678
1679 if (unp == NULL) {
1680 for (i = 0; i < count; i++)
1681 m = m_free(m);
1682 error = ECONNRESET;
1683 }
1684 return (error);
1685 }
1686
1687 static int
uipc_sense(struct socket * so,struct stat * sb)1688 uipc_sense(struct socket *so, struct stat *sb)
1689 {
1690 struct unpcb *unp;
1691
1692 unp = sotounpcb(so);
1693 KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1694
1695 sb->st_blksize = so->so_snd.sb_hiwat;
1696 sb->st_dev = NODEV;
1697 sb->st_ino = unp->unp_ino;
1698 return (0);
1699 }
1700
1701 static int
uipc_shutdown(struct socket * so,enum shutdown_how how)1702 uipc_shutdown(struct socket *so, enum shutdown_how how)
1703 {
1704 struct unpcb *unp = sotounpcb(so);
1705 int error;
1706
1707 SOCK_LOCK(so);
1708 if (SOLISTENING(so)) {
1709 if (how != SHUT_WR) {
1710 so->so_error = ECONNABORTED;
1711 solisten_wakeup(so); /* unlocks so */
1712 } else
1713 SOCK_UNLOCK(so);
1714 return (ENOTCONN);
1715 } else if ((so->so_state &
1716 (SS_ISCONNECTED | SS_ISCONNECTING | SS_ISDISCONNECTING)) == 0) {
1717 /*
1718 * POSIX mandates us to just return ENOTCONN when shutdown(2) is
1719 * invoked on a datagram sockets, however historically we would
1720 * actually tear socket down. This is known to be leveraged by
1721 * some applications to unblock process waiting in recv(2) by
1722 * other process that it shares that socket with. Try to meet
1723 * both backward-compatibility and POSIX requirements by forcing
1724 * ENOTCONN but still flushing buffers and performing wakeup(9).
1725 *
1726 * XXXGL: it remains unknown what applications expect this
1727 * behavior and is this isolated to unix/dgram or inet/dgram or
1728 * both. See: D10351, D3039.
1729 */
1730 error = ENOTCONN;
1731 if (so->so_type != SOCK_DGRAM) {
1732 SOCK_UNLOCK(so);
1733 return (error);
1734 }
1735 } else
1736 error = 0;
1737 SOCK_UNLOCK(so);
1738
1739 switch (how) {
1740 case SHUT_RD:
1741 socantrcvmore(so);
1742 unp_dispose(so);
1743 break;
1744 case SHUT_RDWR:
1745 socantrcvmore(so);
1746 unp_dispose(so);
1747 /* FALLTHROUGH */
1748 case SHUT_WR:
1749 UNP_PCB_LOCK(unp);
1750 socantsendmore(so);
1751 unp_shutdown(unp);
1752 UNP_PCB_UNLOCK(unp);
1753 }
1754 wakeup(&so->so_timeo);
1755
1756 return (error);
1757 }
1758
1759 static int
uipc_sockaddr(struct socket * so,struct sockaddr * ret)1760 uipc_sockaddr(struct socket *so, struct sockaddr *ret)
1761 {
1762 struct unpcb *unp;
1763 const struct sockaddr *sa;
1764
1765 unp = sotounpcb(so);
1766 KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1767
1768 UNP_PCB_LOCK(unp);
1769 if (unp->unp_addr != NULL)
1770 sa = (struct sockaddr *) unp->unp_addr;
1771 else
1772 sa = &sun_noname;
1773 bcopy(sa, ret, sa->sa_len);
1774 UNP_PCB_UNLOCK(unp);
1775 return (0);
1776 }
1777
1778 static int
uipc_ctloutput(struct socket * so,struct sockopt * sopt)1779 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
1780 {
1781 struct unpcb *unp;
1782 struct xucred xu;
1783 int error, optval;
1784
1785 if (sopt->sopt_level != SOL_LOCAL)
1786 return (EINVAL);
1787
1788 unp = sotounpcb(so);
1789 KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
1790 error = 0;
1791 switch (sopt->sopt_dir) {
1792 case SOPT_GET:
1793 switch (sopt->sopt_name) {
1794 case LOCAL_PEERCRED:
1795 UNP_PCB_LOCK(unp);
1796 if (unp->unp_flags & UNP_HAVEPC)
1797 xu = unp->unp_peercred;
1798 else {
1799 if (so->so_type == SOCK_STREAM)
1800 error = ENOTCONN;
1801 else
1802 error = EINVAL;
1803 }
1804 UNP_PCB_UNLOCK(unp);
1805 if (error == 0)
1806 error = sooptcopyout(sopt, &xu, sizeof(xu));
1807 break;
1808
1809 case LOCAL_CREDS:
1810 /* Unlocked read. */
1811 optval = unp->unp_flags & UNP_WANTCRED_ONESHOT ? 1 : 0;
1812 error = sooptcopyout(sopt, &optval, sizeof(optval));
1813 break;
1814
1815 case LOCAL_CREDS_PERSISTENT:
1816 /* Unlocked read. */
1817 optval = unp->unp_flags & UNP_WANTCRED_ALWAYS ? 1 : 0;
1818 error = sooptcopyout(sopt, &optval, sizeof(optval));
1819 break;
1820
1821 default:
1822 error = EOPNOTSUPP;
1823 break;
1824 }
1825 break;
1826
1827 case SOPT_SET:
1828 switch (sopt->sopt_name) {
1829 case LOCAL_CREDS:
1830 case LOCAL_CREDS_PERSISTENT:
1831 error = sooptcopyin(sopt, &optval, sizeof(optval),
1832 sizeof(optval));
1833 if (error)
1834 break;
1835
1836 #define OPTSET(bit, exclusive) do { \
1837 UNP_PCB_LOCK(unp); \
1838 if (optval) { \
1839 if ((unp->unp_flags & (exclusive)) != 0) { \
1840 UNP_PCB_UNLOCK(unp); \
1841 error = EINVAL; \
1842 break; \
1843 } \
1844 unp->unp_flags |= (bit); \
1845 } else \
1846 unp->unp_flags &= ~(bit); \
1847 UNP_PCB_UNLOCK(unp); \
1848 } while (0)
1849
1850 switch (sopt->sopt_name) {
1851 case LOCAL_CREDS:
1852 OPTSET(UNP_WANTCRED_ONESHOT, UNP_WANTCRED_ALWAYS);
1853 break;
1854
1855 case LOCAL_CREDS_PERSISTENT:
1856 OPTSET(UNP_WANTCRED_ALWAYS, UNP_WANTCRED_ONESHOT);
1857 break;
1858
1859 default:
1860 break;
1861 }
1862 break;
1863 #undef OPTSET
1864 default:
1865 error = ENOPROTOOPT;
1866 break;
1867 }
1868 break;
1869
1870 default:
1871 error = EOPNOTSUPP;
1872 break;
1873 }
1874 return (error);
1875 }
1876
1877 static int
unp_connect(struct socket * so,struct sockaddr * nam,struct thread * td)1878 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1879 {
1880
1881 return (unp_connectat(AT_FDCWD, so, nam, td, false));
1882 }
1883
1884 static int
unp_connectat(int fd,struct socket * so,struct sockaddr * nam,struct thread * td,bool return_locked)1885 unp_connectat(int fd, struct socket *so, struct sockaddr *nam,
1886 struct thread *td, bool return_locked)
1887 {
1888 struct mtx *vplock;
1889 struct sockaddr_un *soun;
1890 struct vnode *vp;
1891 struct socket *so2;
1892 struct unpcb *unp, *unp2, *unp3;
1893 struct nameidata nd;
1894 char buf[SOCK_MAXADDRLEN];
1895 struct sockaddr *sa;
1896 cap_rights_t rights;
1897 int error, len;
1898 bool connreq;
1899
1900 if (nam->sa_family != AF_UNIX)
1901 return (EAFNOSUPPORT);
1902 if (nam->sa_len > sizeof(struct sockaddr_un))
1903 return (EINVAL);
1904 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
1905 if (len <= 0)
1906 return (EINVAL);
1907 soun = (struct sockaddr_un *)nam;
1908 bcopy(soun->sun_path, buf, len);
1909 buf[len] = 0;
1910
1911 error = 0;
1912 unp = sotounpcb(so);
1913 UNP_PCB_LOCK(unp);
1914 for (;;) {
1915 /*
1916 * Wait for connection state to stabilize. If a connection
1917 * already exists, give up. For datagram sockets, which permit
1918 * multiple consecutive connect(2) calls, upper layers are
1919 * responsible for disconnecting in advance of a subsequent
1920 * connect(2), but this is not synchronized with PCB connection
1921 * state.
1922 *
1923 * Also make sure that no threads are currently attempting to
1924 * lock the peer socket, to ensure that unp_conn cannot
1925 * transition between two valid sockets while locks are dropped.
1926 */
1927 if (SOLISTENING(so))
1928 error = EOPNOTSUPP;
1929 else if (unp->unp_conn != NULL)
1930 error = EISCONN;
1931 else if ((unp->unp_flags & UNP_CONNECTING) != 0) {
1932 error = EALREADY;
1933 }
1934 if (error != 0) {
1935 UNP_PCB_UNLOCK(unp);
1936 return (error);
1937 }
1938 if (unp->unp_pairbusy > 0) {
1939 unp->unp_flags |= UNP_WAITING;
1940 mtx_sleep(unp, UNP_PCB_LOCKPTR(unp), 0, "unpeer", 0);
1941 continue;
1942 }
1943 break;
1944 }
1945 unp->unp_flags |= UNP_CONNECTING;
1946 UNP_PCB_UNLOCK(unp);
1947
1948 connreq = (so->so_proto->pr_flags & PR_CONNREQUIRED) != 0;
1949 if (connreq)
1950 sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1951 else
1952 sa = NULL;
1953 NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF,
1954 UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_CONNECTAT));
1955 error = namei(&nd);
1956 if (error)
1957 vp = NULL;
1958 else
1959 vp = nd.ni_vp;
1960 ASSERT_VOP_LOCKED(vp, "unp_connect");
1961 if (error)
1962 goto bad;
1963 NDFREE_PNBUF(&nd);
1964
1965 if (vp->v_type != VSOCK) {
1966 error = ENOTSOCK;
1967 goto bad;
1968 }
1969 #ifdef MAC
1970 error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
1971 if (error)
1972 goto bad;
1973 #endif
1974 error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1975 if (error)
1976 goto bad;
1977
1978 unp = sotounpcb(so);
1979 KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1980
1981 vplock = mtx_pool_find(unp_vp_mtxpool, vp);
1982 mtx_lock(vplock);
1983 VOP_UNP_CONNECT(vp, &unp2);
1984 if (unp2 == NULL) {
1985 error = ECONNREFUSED;
1986 goto bad2;
1987 }
1988 so2 = unp2->unp_socket;
1989 if (so->so_type != so2->so_type) {
1990 error = EPROTOTYPE;
1991 goto bad2;
1992 }
1993 if (connreq) {
1994 if (SOLISTENING(so2)) {
1995 CURVNET_SET(so2->so_vnet);
1996 so2 = sonewconn(so2, 0);
1997 CURVNET_RESTORE();
1998 } else
1999 so2 = NULL;
2000 if (so2 == NULL) {
2001 error = ECONNREFUSED;
2002 goto bad2;
2003 }
2004 unp3 = sotounpcb(so2);
2005 unp_pcb_lock_pair(unp2, unp3);
2006 if (unp2->unp_addr != NULL) {
2007 bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
2008 unp3->unp_addr = (struct sockaddr_un *) sa;
2009 sa = NULL;
2010 }
2011
2012 unp_copy_peercred(td, unp3, unp, unp2);
2013
2014 UNP_PCB_UNLOCK(unp2);
2015 unp2 = unp3;
2016
2017 /*
2018 * It is safe to block on the PCB lock here since unp2 is
2019 * nascent and cannot be connected to any other sockets.
2020 */
2021 UNP_PCB_LOCK(unp);
2022 #ifdef MAC
2023 mac_socketpeer_set_from_socket(so, so2);
2024 mac_socketpeer_set_from_socket(so2, so);
2025 #endif
2026 } else {
2027 unp_pcb_lock_pair(unp, unp2);
2028 }
2029 KASSERT(unp2 != NULL && so2 != NULL && unp2->unp_socket == so2 &&
2030 sotounpcb(so2) == unp2,
2031 ("%s: unp2 %p so2 %p", __func__, unp2, so2));
2032 unp_connect2(so, so2);
2033 KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
2034 ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
2035 unp->unp_flags &= ~UNP_CONNECTING;
2036 if (!return_locked)
2037 unp_pcb_unlock_pair(unp, unp2);
2038 bad2:
2039 mtx_unlock(vplock);
2040 bad:
2041 if (vp != NULL) {
2042 /*
2043 * If we are returning locked (called via uipc_sosend_dgram()),
2044 * we need to be sure that vput() won't sleep. This is
2045 * guaranteed by VOP_UNP_CONNECT() call above and unp2 lock.
2046 * SOCK_STREAM/SEQPACKET can't request return_locked (yet).
2047 */
2048 MPASS(!(return_locked && connreq));
2049 vput(vp);
2050 }
2051 free(sa, M_SONAME);
2052 if (__predict_false(error)) {
2053 UNP_PCB_LOCK(unp);
2054 KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
2055 ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
2056 unp->unp_flags &= ~UNP_CONNECTING;
2057 UNP_PCB_UNLOCK(unp);
2058 }
2059 return (error);
2060 }
2061
2062 /*
2063 * Set socket peer credentials at connection time.
2064 *
2065 * The client's PCB credentials are copied from its process structure. The
2066 * server's PCB credentials are copied from the socket on which it called
2067 * listen(2). uipc_listen cached that process's credentials at the time.
2068 */
2069 void
unp_copy_peercred(struct thread * td,struct unpcb * client_unp,struct unpcb * server_unp,struct unpcb * listen_unp)2070 unp_copy_peercred(struct thread *td, struct unpcb *client_unp,
2071 struct unpcb *server_unp, struct unpcb *listen_unp)
2072 {
2073 cru2xt(td, &client_unp->unp_peercred);
2074 client_unp->unp_flags |= UNP_HAVEPC;
2075
2076 memcpy(&server_unp->unp_peercred, &listen_unp->unp_peercred,
2077 sizeof(server_unp->unp_peercred));
2078 server_unp->unp_flags |= UNP_HAVEPC;
2079 client_unp->unp_flags |= (listen_unp->unp_flags & UNP_WANTCRED_MASK);
2080 }
2081
2082 static void
unp_connect2(struct socket * so,struct socket * so2)2083 unp_connect2(struct socket *so, struct socket *so2)
2084 {
2085 struct unpcb *unp;
2086 struct unpcb *unp2;
2087
2088 MPASS(so2->so_type == so->so_type);
2089 unp = sotounpcb(so);
2090 KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
2091 unp2 = sotounpcb(so2);
2092 KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
2093
2094 UNP_PCB_LOCK_ASSERT(unp);
2095 UNP_PCB_LOCK_ASSERT(unp2);
2096 KASSERT(unp->unp_conn == NULL,
2097 ("%s: socket %p is already connected", __func__, unp));
2098
2099 unp->unp_conn = unp2;
2100 unp_pcb_hold(unp2);
2101 unp_pcb_hold(unp);
2102 switch (so->so_type) {
2103 case SOCK_DGRAM:
2104 UNP_REF_LIST_LOCK();
2105 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
2106 UNP_REF_LIST_UNLOCK();
2107 soisconnected(so);
2108 break;
2109
2110 case SOCK_STREAM:
2111 case SOCK_SEQPACKET:
2112 KASSERT(unp2->unp_conn == NULL,
2113 ("%s: socket %p is already connected", __func__, unp2));
2114 unp2->unp_conn = unp;
2115 soisconnected(so);
2116 soisconnected(so2);
2117 break;
2118
2119 default:
2120 panic("unp_connect2");
2121 }
2122 }
2123
2124 static void
unp_disconnect(struct unpcb * unp,struct unpcb * unp2)2125 unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
2126 {
2127 struct socket *so, *so2;
2128 struct mbuf *m = NULL;
2129 #ifdef INVARIANTS
2130 struct unpcb *unptmp;
2131 #endif
2132
2133 UNP_PCB_LOCK_ASSERT(unp);
2134 UNP_PCB_LOCK_ASSERT(unp2);
2135 KASSERT(unp->unp_conn == unp2,
2136 ("%s: unpcb %p is not connected to %p", __func__, unp, unp2));
2137
2138 unp->unp_conn = NULL;
2139 so = unp->unp_socket;
2140 so2 = unp2->unp_socket;
2141 switch (unp->unp_socket->so_type) {
2142 case SOCK_DGRAM:
2143 /*
2144 * Remove our send socket buffer from the peer's receive buffer.
2145 * Move the data to the receive buffer only if it is empty.
2146 * This is a protection against a scenario where a peer
2147 * connects, floods and disconnects, effectively blocking
2148 * sendto() from unconnected sockets.
2149 */
2150 SOCK_RECVBUF_LOCK(so2);
2151 if (!STAILQ_EMPTY(&so->so_snd.uxdg_mb)) {
2152 TAILQ_REMOVE(&so2->so_rcv.uxdg_conns, &so->so_snd,
2153 uxdg_clist);
2154 if (__predict_true((so2->so_rcv.sb_state &
2155 SBS_CANTRCVMORE) == 0) &&
2156 STAILQ_EMPTY(&so2->so_rcv.uxdg_mb)) {
2157 STAILQ_CONCAT(&so2->so_rcv.uxdg_mb,
2158 &so->so_snd.uxdg_mb);
2159 so2->so_rcv.uxdg_cc += so->so_snd.uxdg_cc;
2160 so2->so_rcv.uxdg_ctl += so->so_snd.uxdg_ctl;
2161 so2->so_rcv.uxdg_mbcnt += so->so_snd.uxdg_mbcnt;
2162 } else {
2163 m = STAILQ_FIRST(&so->so_snd.uxdg_mb);
2164 STAILQ_INIT(&so->so_snd.uxdg_mb);
2165 so2->so_rcv.sb_acc -= so->so_snd.uxdg_cc;
2166 so2->so_rcv.sb_ccc -= so->so_snd.uxdg_cc;
2167 so2->so_rcv.sb_ctl -= so->so_snd.uxdg_ctl;
2168 so2->so_rcv.sb_mbcnt -= so->so_snd.uxdg_mbcnt;
2169 }
2170 /* Note: so may reconnect. */
2171 so->so_snd.uxdg_cc = 0;
2172 so->so_snd.uxdg_ctl = 0;
2173 so->so_snd.uxdg_mbcnt = 0;
2174 }
2175 SOCK_RECVBUF_UNLOCK(so2);
2176 UNP_REF_LIST_LOCK();
2177 #ifdef INVARIANTS
2178 LIST_FOREACH(unptmp, &unp2->unp_refs, unp_reflink) {
2179 if (unptmp == unp)
2180 break;
2181 }
2182 KASSERT(unptmp != NULL,
2183 ("%s: %p not found in reflist of %p", __func__, unp, unp2));
2184 #endif
2185 LIST_REMOVE(unp, unp_reflink);
2186 UNP_REF_LIST_UNLOCK();
2187 if (so) {
2188 SOCK_LOCK(so);
2189 so->so_state &= ~SS_ISCONNECTED;
2190 SOCK_UNLOCK(so);
2191 }
2192 break;
2193
2194 case SOCK_STREAM:
2195 case SOCK_SEQPACKET:
2196 if (so)
2197 soisdisconnected(so);
2198 MPASS(unp2->unp_conn == unp);
2199 unp2->unp_conn = NULL;
2200 if (so2)
2201 soisdisconnected(so2);
2202 break;
2203 }
2204
2205 if (unp == unp2) {
2206 unp_pcb_rele_notlast(unp);
2207 if (!unp_pcb_rele(unp))
2208 UNP_PCB_UNLOCK(unp);
2209 } else {
2210 if (!unp_pcb_rele(unp))
2211 UNP_PCB_UNLOCK(unp);
2212 if (!unp_pcb_rele(unp2))
2213 UNP_PCB_UNLOCK(unp2);
2214 }
2215
2216 if (m != NULL) {
2217 unp_scan(m, unp_freerights);
2218 m_freemp(m);
2219 }
2220 }
2221
2222 /*
2223 * unp_pcblist() walks the global list of struct unpcb's to generate a
2224 * pointer list, bumping the refcount on each unpcb. It then copies them out
2225 * sequentially, validating the generation number on each to see if it has
2226 * been detached. All of this is necessary because copyout() may sleep on
2227 * disk I/O.
2228 */
2229 static int
unp_pcblist(SYSCTL_HANDLER_ARGS)2230 unp_pcblist(SYSCTL_HANDLER_ARGS)
2231 {
2232 struct unpcb *unp, **unp_list;
2233 unp_gen_t gencnt;
2234 struct xunpgen *xug;
2235 struct unp_head *head;
2236 struct xunpcb *xu;
2237 u_int i;
2238 int error, n;
2239
2240 switch ((intptr_t)arg1) {
2241 case SOCK_STREAM:
2242 head = &unp_shead;
2243 break;
2244
2245 case SOCK_DGRAM:
2246 head = &unp_dhead;
2247 break;
2248
2249 case SOCK_SEQPACKET:
2250 head = &unp_sphead;
2251 break;
2252
2253 default:
2254 panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
2255 }
2256
2257 /*
2258 * The process of preparing the PCB list is too time-consuming and
2259 * resource-intensive to repeat twice on every request.
2260 */
2261 if (req->oldptr == NULL) {
2262 n = unp_count;
2263 req->oldidx = 2 * (sizeof *xug)
2264 + (n + n/8) * sizeof(struct xunpcb);
2265 return (0);
2266 }
2267
2268 if (req->newptr != NULL)
2269 return (EPERM);
2270
2271 /*
2272 * OK, now we're committed to doing something.
2273 */
2274 xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK | M_ZERO);
2275 UNP_LINK_RLOCK();
2276 gencnt = unp_gencnt;
2277 n = unp_count;
2278 UNP_LINK_RUNLOCK();
2279
2280 xug->xug_len = sizeof *xug;
2281 xug->xug_count = n;
2282 xug->xug_gen = gencnt;
2283 xug->xug_sogen = so_gencnt;
2284 error = SYSCTL_OUT(req, xug, sizeof *xug);
2285 if (error) {
2286 free(xug, M_TEMP);
2287 return (error);
2288 }
2289
2290 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
2291
2292 UNP_LINK_RLOCK();
2293 for (unp = LIST_FIRST(head), i = 0; unp && i < n;
2294 unp = LIST_NEXT(unp, unp_link)) {
2295 UNP_PCB_LOCK(unp);
2296 if (unp->unp_gencnt <= gencnt) {
2297 if (cr_cansee(req->td->td_ucred,
2298 unp->unp_socket->so_cred)) {
2299 UNP_PCB_UNLOCK(unp);
2300 continue;
2301 }
2302 unp_list[i++] = unp;
2303 unp_pcb_hold(unp);
2304 }
2305 UNP_PCB_UNLOCK(unp);
2306 }
2307 UNP_LINK_RUNLOCK();
2308 n = i; /* In case we lost some during malloc. */
2309
2310 error = 0;
2311 xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
2312 for (i = 0; i < n; i++) {
2313 unp = unp_list[i];
2314 UNP_PCB_LOCK(unp);
2315 if (unp_pcb_rele(unp))
2316 continue;
2317
2318 if (unp->unp_gencnt <= gencnt) {
2319 xu->xu_len = sizeof *xu;
2320 xu->xu_unpp = (uintptr_t)unp;
2321 /*
2322 * XXX - need more locking here to protect against
2323 * connect/disconnect races for SMP.
2324 */
2325 if (unp->unp_addr != NULL)
2326 bcopy(unp->unp_addr, &xu->xu_addr,
2327 unp->unp_addr->sun_len);
2328 else
2329 bzero(&xu->xu_addr, sizeof(xu->xu_addr));
2330 if (unp->unp_conn != NULL &&
2331 unp->unp_conn->unp_addr != NULL)
2332 bcopy(unp->unp_conn->unp_addr,
2333 &xu->xu_caddr,
2334 unp->unp_conn->unp_addr->sun_len);
2335 else
2336 bzero(&xu->xu_caddr, sizeof(xu->xu_caddr));
2337 xu->unp_vnode = (uintptr_t)unp->unp_vnode;
2338 xu->unp_conn = (uintptr_t)unp->unp_conn;
2339 xu->xu_firstref = (uintptr_t)LIST_FIRST(&unp->unp_refs);
2340 xu->xu_nextref = (uintptr_t)LIST_NEXT(unp, unp_reflink);
2341 xu->unp_gencnt = unp->unp_gencnt;
2342 sotoxsocket(unp->unp_socket, &xu->xu_socket);
2343 UNP_PCB_UNLOCK(unp);
2344 error = SYSCTL_OUT(req, xu, sizeof *xu);
2345 } else {
2346 UNP_PCB_UNLOCK(unp);
2347 }
2348 }
2349 free(xu, M_TEMP);
2350 if (!error) {
2351 /*
2352 * Give the user an updated idea of our state. If the
2353 * generation differs from what we told her before, she knows
2354 * that something happened while we were processing this
2355 * request, and it might be necessary to retry.
2356 */
2357 xug->xug_gen = unp_gencnt;
2358 xug->xug_sogen = so_gencnt;
2359 xug->xug_count = unp_count;
2360 error = SYSCTL_OUT(req, xug, sizeof *xug);
2361 }
2362 free(unp_list, M_TEMP);
2363 free(xug, M_TEMP);
2364 return (error);
2365 }
2366
2367 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist,
2368 CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
2369 (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
2370 "List of active local datagram sockets");
2371 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist,
2372 CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
2373 (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
2374 "List of active local stream sockets");
2375 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
2376 CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
2377 (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
2378 "List of active local seqpacket sockets");
2379
2380 static void
unp_shutdown(struct unpcb * unp)2381 unp_shutdown(struct unpcb *unp)
2382 {
2383 struct unpcb *unp2;
2384 struct socket *so;
2385
2386 UNP_PCB_LOCK_ASSERT(unp);
2387
2388 unp2 = unp->unp_conn;
2389 if ((unp->unp_socket->so_type == SOCK_STREAM ||
2390 (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
2391 so = unp2->unp_socket;
2392 if (so != NULL)
2393 socantrcvmore(so);
2394 }
2395 }
2396
2397 static void
unp_drop(struct unpcb * unp)2398 unp_drop(struct unpcb *unp)
2399 {
2400 struct socket *so;
2401 struct unpcb *unp2;
2402
2403 /*
2404 * Regardless of whether the socket's peer dropped the connection
2405 * with this socket by aborting or disconnecting, POSIX requires
2406 * that ECONNRESET is returned.
2407 */
2408
2409 UNP_PCB_LOCK(unp);
2410 so = unp->unp_socket;
2411 if (so)
2412 so->so_error = ECONNRESET;
2413 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
2414 /* Last reference dropped in unp_disconnect(). */
2415 unp_pcb_rele_notlast(unp);
2416 unp_disconnect(unp, unp2);
2417 } else if (!unp_pcb_rele(unp)) {
2418 UNP_PCB_UNLOCK(unp);
2419 }
2420 }
2421
2422 static void
unp_freerights(struct filedescent ** fdep,int fdcount)2423 unp_freerights(struct filedescent **fdep, int fdcount)
2424 {
2425 struct file *fp;
2426 int i;
2427
2428 KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount));
2429
2430 for (i = 0; i < fdcount; i++) {
2431 fp = fdep[i]->fde_file;
2432 filecaps_free(&fdep[i]->fde_caps);
2433 unp_discard(fp);
2434 }
2435 free(fdep[0], M_FILECAPS);
2436 }
2437
2438 static int
unp_externalize(struct mbuf * control,struct mbuf ** controlp,int flags)2439 unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
2440 {
2441 struct thread *td = curthread; /* XXX */
2442 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
2443 int i;
2444 int *fdp;
2445 struct filedesc *fdesc = td->td_proc->p_fd;
2446 struct filedescent **fdep;
2447 void *data;
2448 socklen_t clen = control->m_len, datalen;
2449 int error, newfds;
2450 u_int newlen;
2451
2452 UNP_LINK_UNLOCK_ASSERT();
2453
2454 error = 0;
2455 if (controlp != NULL) /* controlp == NULL => free control messages */
2456 *controlp = NULL;
2457 while (cm != NULL) {
2458 MPASS(clen >= sizeof(*cm) && clen >= cm->cmsg_len);
2459
2460 data = CMSG_DATA(cm);
2461 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
2462 if (cm->cmsg_level == SOL_SOCKET
2463 && cm->cmsg_type == SCM_RIGHTS) {
2464 newfds = datalen / sizeof(*fdep);
2465 if (newfds == 0)
2466 goto next;
2467 fdep = data;
2468
2469 /* If we're not outputting the descriptors free them. */
2470 if (error || controlp == NULL) {
2471 unp_freerights(fdep, newfds);
2472 goto next;
2473 }
2474 FILEDESC_XLOCK(fdesc);
2475
2476 /*
2477 * Now change each pointer to an fd in the global
2478 * table to an integer that is the index to the local
2479 * fd table entry that we set up to point to the
2480 * global one we are transferring.
2481 */
2482 newlen = newfds * sizeof(int);
2483 *controlp = sbcreatecontrol(NULL, newlen,
2484 SCM_RIGHTS, SOL_SOCKET, M_WAITOK);
2485
2486 fdp = (int *)
2487 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2488 if ((error = fdallocn(td, 0, fdp, newfds))) {
2489 FILEDESC_XUNLOCK(fdesc);
2490 unp_freerights(fdep, newfds);
2491 m_freem(*controlp);
2492 *controlp = NULL;
2493 goto next;
2494 }
2495 for (i = 0; i < newfds; i++, fdp++) {
2496 _finstall(fdesc, fdep[i]->fde_file, *fdp,
2497 (flags & MSG_CMSG_CLOEXEC) != 0 ? O_CLOEXEC : 0,
2498 &fdep[i]->fde_caps);
2499 unp_externalize_fp(fdep[i]->fde_file);
2500 }
2501
2502 /*
2503 * The new type indicates that the mbuf data refers to
2504 * kernel resources that may need to be released before
2505 * the mbuf is freed.
2506 */
2507 m_chtype(*controlp, MT_EXTCONTROL);
2508 FILEDESC_XUNLOCK(fdesc);
2509 free(fdep[0], M_FILECAPS);
2510 } else {
2511 /* We can just copy anything else across. */
2512 if (error || controlp == NULL)
2513 goto next;
2514 *controlp = sbcreatecontrol(NULL, datalen,
2515 cm->cmsg_type, cm->cmsg_level, M_WAITOK);
2516 bcopy(data,
2517 CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
2518 datalen);
2519 }
2520 controlp = &(*controlp)->m_next;
2521
2522 next:
2523 if (CMSG_SPACE(datalen) < clen) {
2524 clen -= CMSG_SPACE(datalen);
2525 cm = (struct cmsghdr *)
2526 ((caddr_t)cm + CMSG_SPACE(datalen));
2527 } else {
2528 clen = 0;
2529 cm = NULL;
2530 }
2531 }
2532
2533 m_freem(control);
2534 return (error);
2535 }
2536
2537 static void
unp_zone_change(void * tag)2538 unp_zone_change(void *tag)
2539 {
2540
2541 uma_zone_set_max(unp_zone, maxsockets);
2542 }
2543
2544 #ifdef INVARIANTS
2545 static void
unp_zdtor(void * mem,int size __unused,void * arg __unused)2546 unp_zdtor(void *mem, int size __unused, void *arg __unused)
2547 {
2548 struct unpcb *unp;
2549
2550 unp = mem;
2551
2552 KASSERT(LIST_EMPTY(&unp->unp_refs),
2553 ("%s: unpcb %p has lingering refs", __func__, unp));
2554 KASSERT(unp->unp_socket == NULL,
2555 ("%s: unpcb %p has socket backpointer", __func__, unp));
2556 KASSERT(unp->unp_vnode == NULL,
2557 ("%s: unpcb %p has vnode references", __func__, unp));
2558 KASSERT(unp->unp_conn == NULL,
2559 ("%s: unpcb %p is still connected", __func__, unp));
2560 KASSERT(unp->unp_addr == NULL,
2561 ("%s: unpcb %p has leaked addr", __func__, unp));
2562 }
2563 #endif
2564
2565 static void
unp_init(void * arg __unused)2566 unp_init(void *arg __unused)
2567 {
2568 uma_dtor dtor;
2569
2570 #ifdef INVARIANTS
2571 dtor = unp_zdtor;
2572 #else
2573 dtor = NULL;
2574 #endif
2575 unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, dtor,
2576 NULL, NULL, UMA_ALIGN_CACHE, 0);
2577 uma_zone_set_max(unp_zone, maxsockets);
2578 uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached");
2579 EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
2580 NULL, EVENTHANDLER_PRI_ANY);
2581 LIST_INIT(&unp_dhead);
2582 LIST_INIT(&unp_shead);
2583 LIST_INIT(&unp_sphead);
2584 SLIST_INIT(&unp_defers);
2585 TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
2586 TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
2587 UNP_LINK_LOCK_INIT();
2588 UNP_DEFERRED_LOCK_INIT();
2589 unp_vp_mtxpool = mtx_pool_create("unp vp mtxpool", 32, MTX_DEF);
2590 }
2591 SYSINIT(unp_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, unp_init, NULL);
2592
2593 static void
unp_internalize_cleanup_rights(struct mbuf * control)2594 unp_internalize_cleanup_rights(struct mbuf *control)
2595 {
2596 struct cmsghdr *cp;
2597 struct mbuf *m;
2598 void *data;
2599 socklen_t datalen;
2600
2601 for (m = control; m != NULL; m = m->m_next) {
2602 cp = mtod(m, struct cmsghdr *);
2603 if (cp->cmsg_level != SOL_SOCKET ||
2604 cp->cmsg_type != SCM_RIGHTS)
2605 continue;
2606 data = CMSG_DATA(cp);
2607 datalen = (caddr_t)cp + cp->cmsg_len - (caddr_t)data;
2608 unp_freerights(data, datalen / sizeof(struct filedesc *));
2609 }
2610 }
2611
2612 static int
unp_internalize(struct mbuf ** controlp,struct thread * td,struct mbuf ** clast,u_int * space,u_int * mbcnt)2613 unp_internalize(struct mbuf **controlp, struct thread *td,
2614 struct mbuf **clast, u_int *space, u_int *mbcnt)
2615 {
2616 struct mbuf *control, **initial_controlp;
2617 struct proc *p;
2618 struct filedesc *fdesc;
2619 struct bintime *bt;
2620 struct cmsghdr *cm;
2621 struct cmsgcred *cmcred;
2622 struct filedescent *fde, **fdep, *fdev;
2623 struct file *fp;
2624 struct timeval *tv;
2625 struct timespec *ts;
2626 void *data;
2627 socklen_t clen, datalen;
2628 int i, j, error, *fdp, oldfds;
2629 u_int newlen;
2630
2631 MPASS((*controlp)->m_next == NULL); /* COMPAT_OLDSOCK may violate */
2632 UNP_LINK_UNLOCK_ASSERT();
2633
2634 p = td->td_proc;
2635 fdesc = p->p_fd;
2636 error = 0;
2637 control = *controlp;
2638 *controlp = NULL;
2639 initial_controlp = controlp;
2640 for (clen = control->m_len, cm = mtod(control, struct cmsghdr *),
2641 data = CMSG_DATA(cm);
2642
2643 clen >= sizeof(*cm) && cm->cmsg_level == SOL_SOCKET &&
2644 clen >= cm->cmsg_len && cm->cmsg_len >= sizeof(*cm) &&
2645 (char *)cm + cm->cmsg_len >= (char *)data;
2646
2647 clen -= min(CMSG_SPACE(datalen), clen),
2648 cm = (struct cmsghdr *) ((char *)cm + CMSG_SPACE(datalen)),
2649 data = CMSG_DATA(cm)) {
2650 datalen = (char *)cm + cm->cmsg_len - (char *)data;
2651 switch (cm->cmsg_type) {
2652 case SCM_CREDS:
2653 *controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
2654 SCM_CREDS, SOL_SOCKET, M_WAITOK);
2655 cmcred = (struct cmsgcred *)
2656 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2657 cmcred->cmcred_pid = p->p_pid;
2658 cmcred->cmcred_uid = td->td_ucred->cr_ruid;
2659 cmcred->cmcred_gid = td->td_ucred->cr_rgid;
2660 cmcred->cmcred_euid = td->td_ucred->cr_uid;
2661 cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
2662 CMGROUP_MAX);
2663 for (i = 0; i < cmcred->cmcred_ngroups; i++)
2664 cmcred->cmcred_groups[i] =
2665 td->td_ucred->cr_groups[i];
2666 break;
2667
2668 case SCM_RIGHTS:
2669 oldfds = datalen / sizeof (int);
2670 if (oldfds == 0)
2671 continue;
2672 /* On some machines sizeof pointer is bigger than
2673 * sizeof int, so we need to check if data fits into
2674 * single mbuf. We could allocate several mbufs, and
2675 * unp_externalize() should even properly handle that.
2676 * But it is not worth to complicate the code for an
2677 * insane scenario of passing over 200 file descriptors
2678 * at once.
2679 */
2680 newlen = oldfds * sizeof(fdep[0]);
2681 if (CMSG_SPACE(newlen) > MCLBYTES) {
2682 error = EMSGSIZE;
2683 goto out;
2684 }
2685 /*
2686 * Check that all the FDs passed in refer to legal
2687 * files. If not, reject the entire operation.
2688 */
2689 fdp = data;
2690 FILEDESC_SLOCK(fdesc);
2691 for (i = 0; i < oldfds; i++, fdp++) {
2692 fp = fget_noref(fdesc, *fdp);
2693 if (fp == NULL) {
2694 FILEDESC_SUNLOCK(fdesc);
2695 error = EBADF;
2696 goto out;
2697 }
2698 if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
2699 FILEDESC_SUNLOCK(fdesc);
2700 error = EOPNOTSUPP;
2701 goto out;
2702 }
2703 }
2704
2705 /*
2706 * Now replace the integer FDs with pointers to the
2707 * file structure and capability rights.
2708 */
2709 *controlp = sbcreatecontrol(NULL, newlen,
2710 SCM_RIGHTS, SOL_SOCKET, M_WAITOK);
2711 fdp = data;
2712 for (i = 0; i < oldfds; i++, fdp++) {
2713 if (!fhold(fdesc->fd_ofiles[*fdp].fde_file)) {
2714 fdp = data;
2715 for (j = 0; j < i; j++, fdp++) {
2716 fdrop(fdesc->fd_ofiles[*fdp].
2717 fde_file, td);
2718 }
2719 FILEDESC_SUNLOCK(fdesc);
2720 error = EBADF;
2721 goto out;
2722 }
2723 }
2724 fdp = data;
2725 fdep = (struct filedescent **)
2726 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2727 fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS,
2728 M_WAITOK);
2729 for (i = 0; i < oldfds; i++, fdev++, fdp++) {
2730 fde = &fdesc->fd_ofiles[*fdp];
2731 fdep[i] = fdev;
2732 fdep[i]->fde_file = fde->fde_file;
2733 filecaps_copy(&fde->fde_caps,
2734 &fdep[i]->fde_caps, true);
2735 unp_internalize_fp(fdep[i]->fde_file);
2736 }
2737 FILEDESC_SUNLOCK(fdesc);
2738 break;
2739
2740 case SCM_TIMESTAMP:
2741 *controlp = sbcreatecontrol(NULL, sizeof(*tv),
2742 SCM_TIMESTAMP, SOL_SOCKET, M_WAITOK);
2743 tv = (struct timeval *)
2744 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2745 microtime(tv);
2746 break;
2747
2748 case SCM_BINTIME:
2749 *controlp = sbcreatecontrol(NULL, sizeof(*bt),
2750 SCM_BINTIME, SOL_SOCKET, M_WAITOK);
2751 bt = (struct bintime *)
2752 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2753 bintime(bt);
2754 break;
2755
2756 case SCM_REALTIME:
2757 *controlp = sbcreatecontrol(NULL, sizeof(*ts),
2758 SCM_REALTIME, SOL_SOCKET, M_WAITOK);
2759 ts = (struct timespec *)
2760 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2761 nanotime(ts);
2762 break;
2763
2764 case SCM_MONOTONIC:
2765 *controlp = sbcreatecontrol(NULL, sizeof(*ts),
2766 SCM_MONOTONIC, SOL_SOCKET, M_WAITOK);
2767 ts = (struct timespec *)
2768 CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2769 nanouptime(ts);
2770 break;
2771
2772 default:
2773 error = EINVAL;
2774 goto out;
2775 }
2776
2777 if (space != NULL) {
2778 *space += (*controlp)->m_len;
2779 *mbcnt += MSIZE;
2780 if ((*controlp)->m_flags & M_EXT)
2781 *mbcnt += (*controlp)->m_ext.ext_size;
2782 *clast = *controlp;
2783 }
2784 controlp = &(*controlp)->m_next;
2785 }
2786 if (clen > 0)
2787 error = EINVAL;
2788
2789 out:
2790 if (error != 0 && initial_controlp != NULL)
2791 unp_internalize_cleanup_rights(*initial_controlp);
2792 m_freem(control);
2793 return (error);
2794 }
2795
2796 static struct mbuf *
unp_addsockcred(struct thread * td,struct mbuf * control,int mode,struct mbuf ** clast,u_int * space,u_int * mbcnt)2797 unp_addsockcred(struct thread *td, struct mbuf *control, int mode,
2798 struct mbuf **clast, u_int *space, u_int *mbcnt)
2799 {
2800 struct mbuf *m, *n, *n_prev;
2801 const struct cmsghdr *cm;
2802 int ngroups, i, cmsgtype;
2803 size_t ctrlsz;
2804
2805 ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
2806 if (mode & UNP_WANTCRED_ALWAYS) {
2807 ctrlsz = SOCKCRED2SIZE(ngroups);
2808 cmsgtype = SCM_CREDS2;
2809 } else {
2810 ctrlsz = SOCKCREDSIZE(ngroups);
2811 cmsgtype = SCM_CREDS;
2812 }
2813
2814 m = sbcreatecontrol(NULL, ctrlsz, cmsgtype, SOL_SOCKET, M_NOWAIT);
2815 if (m == NULL)
2816 return (control);
2817 MPASS((m->m_flags & M_EXT) == 0 && m->m_next == NULL);
2818
2819 if (mode & UNP_WANTCRED_ALWAYS) {
2820 struct sockcred2 *sc;
2821
2822 sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2823 sc->sc_version = 0;
2824 sc->sc_pid = td->td_proc->p_pid;
2825 sc->sc_uid = td->td_ucred->cr_ruid;
2826 sc->sc_euid = td->td_ucred->cr_uid;
2827 sc->sc_gid = td->td_ucred->cr_rgid;
2828 sc->sc_egid = td->td_ucred->cr_gid;
2829 sc->sc_ngroups = ngroups;
2830 for (i = 0; i < sc->sc_ngroups; i++)
2831 sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2832 } else {
2833 struct sockcred *sc;
2834
2835 sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2836 sc->sc_uid = td->td_ucred->cr_ruid;
2837 sc->sc_euid = td->td_ucred->cr_uid;
2838 sc->sc_gid = td->td_ucred->cr_rgid;
2839 sc->sc_egid = td->td_ucred->cr_gid;
2840 sc->sc_ngroups = ngroups;
2841 for (i = 0; i < sc->sc_ngroups; i++)
2842 sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2843 }
2844
2845 /*
2846 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
2847 * created SCM_CREDS control message (struct sockcred) has another
2848 * format.
2849 */
2850 if (control != NULL && cmsgtype == SCM_CREDS)
2851 for (n = control, n_prev = NULL; n != NULL;) {
2852 cm = mtod(n, struct cmsghdr *);
2853 if (cm->cmsg_level == SOL_SOCKET &&
2854 cm->cmsg_type == SCM_CREDS) {
2855 if (n_prev == NULL)
2856 control = n->m_next;
2857 else
2858 n_prev->m_next = n->m_next;
2859 if (space != NULL) {
2860 MPASS(*space >= n->m_len);
2861 *space -= n->m_len;
2862 MPASS(*mbcnt >= MSIZE);
2863 *mbcnt -= MSIZE;
2864 if (n->m_flags & M_EXT) {
2865 MPASS(*mbcnt >=
2866 n->m_ext.ext_size);
2867 *mbcnt -= n->m_ext.ext_size;
2868 }
2869 MPASS(clast);
2870 if (*clast == n) {
2871 MPASS(n->m_next == NULL);
2872 if (n_prev == NULL)
2873 *clast = m;
2874 else
2875 *clast = n_prev;
2876 }
2877 }
2878 n = m_free(n);
2879 } else {
2880 n_prev = n;
2881 n = n->m_next;
2882 }
2883 }
2884
2885 /* Prepend it to the head. */
2886 m->m_next = control;
2887 if (space != NULL) {
2888 *space += m->m_len;
2889 *mbcnt += MSIZE;
2890 if (control == NULL)
2891 *clast = m;
2892 }
2893 return (m);
2894 }
2895
2896 static struct unpcb *
fptounp(struct file * fp)2897 fptounp(struct file *fp)
2898 {
2899 struct socket *so;
2900
2901 if (fp->f_type != DTYPE_SOCKET)
2902 return (NULL);
2903 if ((so = fp->f_data) == NULL)
2904 return (NULL);
2905 if (so->so_proto->pr_domain != &localdomain)
2906 return (NULL);
2907 return sotounpcb(so);
2908 }
2909
2910 static void
unp_discard(struct file * fp)2911 unp_discard(struct file *fp)
2912 {
2913 struct unp_defer *dr;
2914
2915 if (unp_externalize_fp(fp)) {
2916 dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
2917 dr->ud_fp = fp;
2918 UNP_DEFERRED_LOCK();
2919 SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
2920 UNP_DEFERRED_UNLOCK();
2921 atomic_add_int(&unp_defers_count, 1);
2922 taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
2923 } else
2924 closef_nothread(fp);
2925 }
2926
2927 static void
unp_process_defers(void * arg __unused,int pending)2928 unp_process_defers(void *arg __unused, int pending)
2929 {
2930 struct unp_defer *dr;
2931 SLIST_HEAD(, unp_defer) drl;
2932 int count;
2933
2934 SLIST_INIT(&drl);
2935 for (;;) {
2936 UNP_DEFERRED_LOCK();
2937 if (SLIST_FIRST(&unp_defers) == NULL) {
2938 UNP_DEFERRED_UNLOCK();
2939 break;
2940 }
2941 SLIST_SWAP(&unp_defers, &drl, unp_defer);
2942 UNP_DEFERRED_UNLOCK();
2943 count = 0;
2944 while ((dr = SLIST_FIRST(&drl)) != NULL) {
2945 SLIST_REMOVE_HEAD(&drl, ud_link);
2946 closef_nothread(dr->ud_fp);
2947 free(dr, M_TEMP);
2948 count++;
2949 }
2950 atomic_add_int(&unp_defers_count, -count);
2951 }
2952 }
2953
2954 static void
unp_internalize_fp(struct file * fp)2955 unp_internalize_fp(struct file *fp)
2956 {
2957 struct unpcb *unp;
2958
2959 UNP_LINK_WLOCK();
2960 if ((unp = fptounp(fp)) != NULL) {
2961 unp->unp_file = fp;
2962 unp->unp_msgcount++;
2963 }
2964 unp_rights++;
2965 UNP_LINK_WUNLOCK();
2966 }
2967
2968 static int
unp_externalize_fp(struct file * fp)2969 unp_externalize_fp(struct file *fp)
2970 {
2971 struct unpcb *unp;
2972 int ret;
2973
2974 UNP_LINK_WLOCK();
2975 if ((unp = fptounp(fp)) != NULL) {
2976 unp->unp_msgcount--;
2977 ret = 1;
2978 } else
2979 ret = 0;
2980 unp_rights--;
2981 UNP_LINK_WUNLOCK();
2982 return (ret);
2983 }
2984
2985 /*
2986 * unp_defer indicates whether additional work has been defered for a future
2987 * pass through unp_gc(). It is thread local and does not require explicit
2988 * synchronization.
2989 */
2990 static int unp_marked;
2991
2992 static void
unp_remove_dead_ref(struct filedescent ** fdep,int fdcount)2993 unp_remove_dead_ref(struct filedescent **fdep, int fdcount)
2994 {
2995 struct unpcb *unp;
2996 struct file *fp;
2997 int i;
2998
2999 /*
3000 * This function can only be called from the gc task.
3001 */
3002 KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
3003 ("%s: not on gc callout", __func__));
3004 UNP_LINK_LOCK_ASSERT();
3005
3006 for (i = 0; i < fdcount; i++) {
3007 fp = fdep[i]->fde_file;
3008 if ((unp = fptounp(fp)) == NULL)
3009 continue;
3010 if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
3011 continue;
3012 unp->unp_gcrefs--;
3013 }
3014 }
3015
3016 static void
unp_restore_undead_ref(struct filedescent ** fdep,int fdcount)3017 unp_restore_undead_ref(struct filedescent **fdep, int fdcount)
3018 {
3019 struct unpcb *unp;
3020 struct file *fp;
3021 int i;
3022
3023 /*
3024 * This function can only be called from the gc task.
3025 */
3026 KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
3027 ("%s: not on gc callout", __func__));
3028 UNP_LINK_LOCK_ASSERT();
3029
3030 for (i = 0; i < fdcount; i++) {
3031 fp = fdep[i]->fde_file;
3032 if ((unp = fptounp(fp)) == NULL)
3033 continue;
3034 if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
3035 continue;
3036 unp->unp_gcrefs++;
3037 unp_marked++;
3038 }
3039 }
3040
3041 static void
unp_scan_socket(struct socket * so,void (* op)(struct filedescent **,int))3042 unp_scan_socket(struct socket *so, void (*op)(struct filedescent **, int))
3043 {
3044 struct sockbuf *sb;
3045
3046 SOCK_LOCK_ASSERT(so);
3047
3048 if (sotounpcb(so)->unp_gcflag & UNPGC_IGNORE_RIGHTS)
3049 return;
3050
3051 SOCK_RECVBUF_LOCK(so);
3052 switch (so->so_type) {
3053 case SOCK_DGRAM:
3054 unp_scan(STAILQ_FIRST(&so->so_rcv.uxdg_mb), op);
3055 unp_scan(so->so_rcv.uxdg_peeked, op);
3056 TAILQ_FOREACH(sb, &so->so_rcv.uxdg_conns, uxdg_clist)
3057 unp_scan(STAILQ_FIRST(&sb->uxdg_mb), op);
3058 break;
3059 case SOCK_STREAM:
3060 case SOCK_SEQPACKET:
3061 unp_scan(so->so_rcv.sb_mb, op);
3062 break;
3063 }
3064 SOCK_RECVBUF_UNLOCK(so);
3065 }
3066
3067 static void
unp_gc_scan(struct unpcb * unp,void (* op)(struct filedescent **,int))3068 unp_gc_scan(struct unpcb *unp, void (*op)(struct filedescent **, int))
3069 {
3070 struct socket *so, *soa;
3071
3072 so = unp->unp_socket;
3073 SOCK_LOCK(so);
3074 if (SOLISTENING(so)) {
3075 /*
3076 * Mark all sockets in our accept queue.
3077 */
3078 TAILQ_FOREACH(soa, &so->sol_comp, so_list)
3079 unp_scan_socket(soa, op);
3080 } else {
3081 /*
3082 * Mark all sockets we reference with RIGHTS.
3083 */
3084 unp_scan_socket(so, op);
3085 }
3086 SOCK_UNLOCK(so);
3087 }
3088
3089 static int unp_recycled;
3090 SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
3091 "Number of unreachable sockets claimed by the garbage collector.");
3092
3093 static int unp_taskcount;
3094 SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
3095 "Number of times the garbage collector has run.");
3096
3097 SYSCTL_UINT(_net_local, OID_AUTO, sockcount, CTLFLAG_RD, &unp_count, 0,
3098 "Number of active local sockets.");
3099
3100 static void
unp_gc(__unused void * arg,int pending)3101 unp_gc(__unused void *arg, int pending)
3102 {
3103 struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
3104 NULL };
3105 struct unp_head **head;
3106 struct unp_head unp_deadhead; /* List of potentially-dead sockets. */
3107 struct file *f, **unref;
3108 struct unpcb *unp, *unptmp;
3109 int i, total, unp_unreachable;
3110
3111 LIST_INIT(&unp_deadhead);
3112 unp_taskcount++;
3113 UNP_LINK_RLOCK();
3114 /*
3115 * First determine which sockets may be in cycles.
3116 */
3117 unp_unreachable = 0;
3118
3119 for (head = heads; *head != NULL; head++)
3120 LIST_FOREACH(unp, *head, unp_link) {
3121 KASSERT((unp->unp_gcflag & ~UNPGC_IGNORE_RIGHTS) == 0,
3122 ("%s: unp %p has unexpected gc flags 0x%x",
3123 __func__, unp, (unsigned int)unp->unp_gcflag));
3124
3125 f = unp->unp_file;
3126
3127 /*
3128 * Check for an unreachable socket potentially in a
3129 * cycle. It must be in a queue as indicated by
3130 * msgcount, and this must equal the file reference
3131 * count. Note that when msgcount is 0 the file is
3132 * NULL.
3133 */
3134 if (f != NULL && unp->unp_msgcount != 0 &&
3135 refcount_load(&f->f_count) == unp->unp_msgcount) {
3136 LIST_INSERT_HEAD(&unp_deadhead, unp, unp_dead);
3137 unp->unp_gcflag |= UNPGC_DEAD;
3138 unp->unp_gcrefs = unp->unp_msgcount;
3139 unp_unreachable++;
3140 }
3141 }
3142
3143 /*
3144 * Scan all sockets previously marked as potentially being in a cycle
3145 * and remove the references each socket holds on any UNPGC_DEAD
3146 * sockets in its queue. After this step, all remaining references on
3147 * sockets marked UNPGC_DEAD should not be part of any cycle.
3148 */
3149 LIST_FOREACH(unp, &unp_deadhead, unp_dead)
3150 unp_gc_scan(unp, unp_remove_dead_ref);
3151
3152 /*
3153 * If a socket still has a non-negative refcount, it cannot be in a
3154 * cycle. In this case increment refcount of all children iteratively.
3155 * Stop the scan once we do a complete loop without discovering
3156 * a new reachable socket.
3157 */
3158 do {
3159 unp_marked = 0;
3160 LIST_FOREACH_SAFE(unp, &unp_deadhead, unp_dead, unptmp)
3161 if (unp->unp_gcrefs > 0) {
3162 unp->unp_gcflag &= ~UNPGC_DEAD;
3163 LIST_REMOVE(unp, unp_dead);
3164 KASSERT(unp_unreachable > 0,
3165 ("%s: unp_unreachable underflow.",
3166 __func__));
3167 unp_unreachable--;
3168 unp_gc_scan(unp, unp_restore_undead_ref);
3169 }
3170 } while (unp_marked);
3171
3172 UNP_LINK_RUNLOCK();
3173
3174 if (unp_unreachable == 0)
3175 return;
3176
3177 /*
3178 * Allocate space for a local array of dead unpcbs.
3179 * TODO: can this path be simplified by instead using the local
3180 * dead list at unp_deadhead, after taking out references
3181 * on the file object and/or unpcb and dropping the link lock?
3182 */
3183 unref = malloc(unp_unreachable * sizeof(struct file *),
3184 M_TEMP, M_WAITOK);
3185
3186 /*
3187 * Iterate looking for sockets which have been specifically marked
3188 * as unreachable and store them locally.
3189 */
3190 UNP_LINK_RLOCK();
3191 total = 0;
3192 LIST_FOREACH(unp, &unp_deadhead, unp_dead) {
3193 KASSERT((unp->unp_gcflag & UNPGC_DEAD) != 0,
3194 ("%s: unp %p not marked UNPGC_DEAD", __func__, unp));
3195 unp->unp_gcflag &= ~UNPGC_DEAD;
3196 f = unp->unp_file;
3197 if (unp->unp_msgcount == 0 || f == NULL ||
3198 refcount_load(&f->f_count) != unp->unp_msgcount ||
3199 !fhold(f))
3200 continue;
3201 unref[total++] = f;
3202 KASSERT(total <= unp_unreachable,
3203 ("%s: incorrect unreachable count.", __func__));
3204 }
3205 UNP_LINK_RUNLOCK();
3206
3207 /*
3208 * Now flush all sockets, free'ing rights. This will free the
3209 * struct files associated with these sockets but leave each socket
3210 * with one remaining ref.
3211 */
3212 for (i = 0; i < total; i++) {
3213 struct socket *so;
3214
3215 so = unref[i]->f_data;
3216 CURVNET_SET(so->so_vnet);
3217 socantrcvmore(so);
3218 unp_dispose(so);
3219 CURVNET_RESTORE();
3220 }
3221
3222 /*
3223 * And finally release the sockets so they can be reclaimed.
3224 */
3225 for (i = 0; i < total; i++)
3226 fdrop(unref[i], NULL);
3227 unp_recycled += total;
3228 free(unref, M_TEMP);
3229 }
3230
3231 /*
3232 * Synchronize against unp_gc, which can trip over data as we are freeing it.
3233 */
3234 static void
unp_dispose(struct socket * so)3235 unp_dispose(struct socket *so)
3236 {
3237 struct sockbuf *sb;
3238 struct unpcb *unp;
3239 struct mbuf *m;
3240 int error __diagused;
3241
3242 MPASS(!SOLISTENING(so));
3243
3244 unp = sotounpcb(so);
3245 UNP_LINK_WLOCK();
3246 unp->unp_gcflag |= UNPGC_IGNORE_RIGHTS;
3247 UNP_LINK_WUNLOCK();
3248
3249 /*
3250 * Grab our special mbufs before calling sbrelease().
3251 */
3252 error = SOCK_IO_RECV_LOCK(so, SBL_WAIT | SBL_NOINTR);
3253 MPASS(!error);
3254 SOCK_RECVBUF_LOCK(so);
3255 switch (so->so_type) {
3256 case SOCK_DGRAM:
3257 while ((sb = TAILQ_FIRST(&so->so_rcv.uxdg_conns)) != NULL) {
3258 STAILQ_CONCAT(&so->so_rcv.uxdg_mb, &sb->uxdg_mb);
3259 TAILQ_REMOVE(&so->so_rcv.uxdg_conns, sb, uxdg_clist);
3260 /* Note: socket of sb may reconnect. */
3261 sb->uxdg_cc = sb->uxdg_ctl = sb->uxdg_mbcnt = 0;
3262 }
3263 sb = &so->so_rcv;
3264 if (sb->uxdg_peeked != NULL) {
3265 STAILQ_INSERT_HEAD(&sb->uxdg_mb, sb->uxdg_peeked,
3266 m_stailqpkt);
3267 sb->uxdg_peeked = NULL;
3268 }
3269 m = STAILQ_FIRST(&sb->uxdg_mb);
3270 STAILQ_INIT(&sb->uxdg_mb);
3271 /* XXX: our shortened sbrelease() */
3272 (void)chgsbsize(so->so_cred->cr_uidinfo, &sb->sb_hiwat, 0,
3273 RLIM_INFINITY);
3274 /*
3275 * XXXGL Mark sb with SBS_CANTRCVMORE. This is needed to
3276 * prevent uipc_sosend_dgram() or unp_disconnect() adding more
3277 * data to the socket.
3278 * We came here either through shutdown(2) or from the final
3279 * sofree(). The sofree() case is simple as it guarantees
3280 * that no more sends will happen, however we can race with
3281 * unp_disconnect() from our peer. The shutdown(2) case is
3282 * more exotic. It would call into unp_dispose() only if
3283 * socket is SS_ISCONNECTED. This is possible if we did
3284 * connect(2) on this socket and we also had it bound with
3285 * bind(2) and receive connections from other sockets.
3286 * Because uipc_shutdown() violates POSIX (see comment
3287 * there) we will end up here shutting down our receive side.
3288 * Of course this will have affect not only on the peer we
3289 * connect(2)ed to, but also on all of the peers who had
3290 * connect(2)ed to us. Their sends would end up with ENOBUFS.
3291 */
3292 sb->sb_state |= SBS_CANTRCVMORE;
3293 break;
3294 case SOCK_STREAM:
3295 case SOCK_SEQPACKET:
3296 sb = &so->so_rcv;
3297 m = sbcut_locked(sb, sb->sb_ccc);
3298 KASSERT(sb->sb_ccc == 0 && sb->sb_mb == 0 && sb->sb_mbcnt == 0,
3299 ("%s: ccc %u mb %p mbcnt %u", __func__,
3300 sb->sb_ccc, (void *)sb->sb_mb, sb->sb_mbcnt));
3301 sbrelease_locked(so, SO_RCV);
3302 break;
3303 }
3304 SOCK_RECVBUF_UNLOCK(so);
3305 SOCK_IO_RECV_UNLOCK(so);
3306
3307 if (m != NULL) {
3308 unp_scan(m, unp_freerights);
3309 m_freemp(m);
3310 }
3311 }
3312
3313 static void
unp_scan(struct mbuf * m0,void (* op)(struct filedescent **,int))3314 unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int))
3315 {
3316 struct mbuf *m;
3317 struct cmsghdr *cm;
3318 void *data;
3319 socklen_t clen, datalen;
3320
3321 while (m0 != NULL) {
3322 for (m = m0; m; m = m->m_next) {
3323 if (m->m_type != MT_CONTROL)
3324 continue;
3325
3326 cm = mtod(m, struct cmsghdr *);
3327 clen = m->m_len;
3328
3329 while (cm != NULL) {
3330 if (sizeof(*cm) > clen || cm->cmsg_len > clen)
3331 break;
3332
3333 data = CMSG_DATA(cm);
3334 datalen = (caddr_t)cm + cm->cmsg_len
3335 - (caddr_t)data;
3336
3337 if (cm->cmsg_level == SOL_SOCKET &&
3338 cm->cmsg_type == SCM_RIGHTS) {
3339 (*op)(data, datalen /
3340 sizeof(struct filedescent *));
3341 }
3342
3343 if (CMSG_SPACE(datalen) < clen) {
3344 clen -= CMSG_SPACE(datalen);
3345 cm = (struct cmsghdr *)
3346 ((caddr_t)cm + CMSG_SPACE(datalen));
3347 } else {
3348 clen = 0;
3349 cm = NULL;
3350 }
3351 }
3352 }
3353 m0 = m0->m_nextpkt;
3354 }
3355 }
3356
3357 /*
3358 * Definitions of protocols supported in the LOCAL domain.
3359 */
3360 static struct protosw streamproto = {
3361 .pr_type = SOCK_STREAM,
3362 .pr_flags = PR_CONNREQUIRED | PR_WANTRCVD | PR_CAPATTACH,
3363 .pr_ctloutput = &uipc_ctloutput,
3364 .pr_abort = uipc_abort,
3365 .pr_accept = uipc_peeraddr,
3366 .pr_attach = uipc_attach,
3367 .pr_bind = uipc_bind,
3368 .pr_bindat = uipc_bindat,
3369 .pr_connect = uipc_connect,
3370 .pr_connectat = uipc_connectat,
3371 .pr_connect2 = uipc_connect2,
3372 .pr_detach = uipc_detach,
3373 .pr_disconnect = uipc_disconnect,
3374 .pr_listen = uipc_listen,
3375 .pr_peeraddr = uipc_peeraddr,
3376 .pr_rcvd = uipc_rcvd,
3377 .pr_send = uipc_send,
3378 .pr_ready = uipc_ready,
3379 .pr_sense = uipc_sense,
3380 .pr_shutdown = uipc_shutdown,
3381 .pr_sockaddr = uipc_sockaddr,
3382 .pr_soreceive = soreceive_generic,
3383 .pr_close = uipc_close,
3384 .pr_chmod = uipc_chmod,
3385 };
3386
3387 static struct protosw dgramproto = {
3388 .pr_type = SOCK_DGRAM,
3389 .pr_flags = PR_ATOMIC | PR_ADDR | PR_CAPATTACH | PR_SOCKBUF,
3390 .pr_ctloutput = &uipc_ctloutput,
3391 .pr_abort = uipc_abort,
3392 .pr_accept = uipc_peeraddr,
3393 .pr_attach = uipc_attach,
3394 .pr_bind = uipc_bind,
3395 .pr_bindat = uipc_bindat,
3396 .pr_connect = uipc_connect,
3397 .pr_connectat = uipc_connectat,
3398 .pr_connect2 = uipc_connect2,
3399 .pr_detach = uipc_detach,
3400 .pr_disconnect = uipc_disconnect,
3401 .pr_peeraddr = uipc_peeraddr,
3402 .pr_sosend = uipc_sosend_dgram,
3403 .pr_sense = uipc_sense,
3404 .pr_shutdown = uipc_shutdown,
3405 .pr_sockaddr = uipc_sockaddr,
3406 .pr_soreceive = uipc_soreceive_dgram,
3407 .pr_close = uipc_close,
3408 .pr_chmod = uipc_chmod,
3409 };
3410
3411 static struct protosw seqpacketproto = {
3412 .pr_type = SOCK_SEQPACKET,
3413 /*
3414 * XXXRW: For now, PR_ADDR because soreceive will bump into them
3415 * due to our use of sbappendaddr. A new sbappend variants is needed
3416 * that supports both atomic record writes and control data.
3417 */
3418 .pr_flags = PR_ADDR | PR_ATOMIC | PR_CONNREQUIRED |
3419 PR_WANTRCVD | PR_CAPATTACH,
3420 .pr_ctloutput = &uipc_ctloutput,
3421 .pr_abort = uipc_abort,
3422 .pr_accept = uipc_peeraddr,
3423 .pr_attach = uipc_attach,
3424 .pr_bind = uipc_bind,
3425 .pr_bindat = uipc_bindat,
3426 .pr_connect = uipc_connect,
3427 .pr_connectat = uipc_connectat,
3428 .pr_connect2 = uipc_connect2,
3429 .pr_detach = uipc_detach,
3430 .pr_disconnect = uipc_disconnect,
3431 .pr_listen = uipc_listen,
3432 .pr_peeraddr = uipc_peeraddr,
3433 .pr_rcvd = uipc_rcvd,
3434 .pr_send = uipc_send,
3435 .pr_sense = uipc_sense,
3436 .pr_shutdown = uipc_shutdown,
3437 .pr_sockaddr = uipc_sockaddr,
3438 .pr_soreceive = soreceive_generic, /* XXX: or...? */
3439 .pr_close = uipc_close,
3440 .pr_chmod = uipc_chmod,
3441 };
3442
3443 static struct domain localdomain = {
3444 .dom_family = AF_LOCAL,
3445 .dom_name = "local",
3446 .dom_externalize = unp_externalize,
3447 .dom_nprotosw = 3,
3448 .dom_protosw = {
3449 &streamproto,
3450 &dgramproto,
3451 &seqpacketproto,
3452 }
3453 };
3454 DOMAIN_SET(local);
3455
3456 /*
3457 * A helper function called by VFS before socket-type vnode reclamation.
3458 * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
3459 * use count.
3460 */
3461 void
vfs_unp_reclaim(struct vnode * vp)3462 vfs_unp_reclaim(struct vnode *vp)
3463 {
3464 struct unpcb *unp;
3465 int active;
3466 struct mtx *vplock;
3467
3468 ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
3469 KASSERT(vp->v_type == VSOCK,
3470 ("vfs_unp_reclaim: vp->v_type != VSOCK"));
3471
3472 active = 0;
3473 vplock = mtx_pool_find(unp_vp_mtxpool, vp);
3474 mtx_lock(vplock);
3475 VOP_UNP_CONNECT(vp, &unp);
3476 if (unp == NULL)
3477 goto done;
3478 UNP_PCB_LOCK(unp);
3479 if (unp->unp_vnode == vp) {
3480 VOP_UNP_DETACH(vp);
3481 unp->unp_vnode = NULL;
3482 active = 1;
3483 }
3484 UNP_PCB_UNLOCK(unp);
3485 done:
3486 mtx_unlock(vplock);
3487 if (active)
3488 vunref(vp);
3489 }
3490
3491 #ifdef DDB
3492 static void
db_print_indent(int indent)3493 db_print_indent(int indent)
3494 {
3495 int i;
3496
3497 for (i = 0; i < indent; i++)
3498 db_printf(" ");
3499 }
3500
3501 static void
db_print_unpflags(int unp_flags)3502 db_print_unpflags(int unp_flags)
3503 {
3504 int comma;
3505
3506 comma = 0;
3507 if (unp_flags & UNP_HAVEPC) {
3508 db_printf("%sUNP_HAVEPC", comma ? ", " : "");
3509 comma = 1;
3510 }
3511 if (unp_flags & UNP_WANTCRED_ALWAYS) {
3512 db_printf("%sUNP_WANTCRED_ALWAYS", comma ? ", " : "");
3513 comma = 1;
3514 }
3515 if (unp_flags & UNP_WANTCRED_ONESHOT) {
3516 db_printf("%sUNP_WANTCRED_ONESHOT", comma ? ", " : "");
3517 comma = 1;
3518 }
3519 if (unp_flags & UNP_CONNECTING) {
3520 db_printf("%sUNP_CONNECTING", comma ? ", " : "");
3521 comma = 1;
3522 }
3523 if (unp_flags & UNP_BINDING) {
3524 db_printf("%sUNP_BINDING", comma ? ", " : "");
3525 comma = 1;
3526 }
3527 }
3528
3529 static void
db_print_xucred(int indent,struct xucred * xu)3530 db_print_xucred(int indent, struct xucred *xu)
3531 {
3532 int comma, i;
3533
3534 db_print_indent(indent);
3535 db_printf("cr_version: %u cr_uid: %u cr_pid: %d cr_ngroups: %d\n",
3536 xu->cr_version, xu->cr_uid, xu->cr_pid, xu->cr_ngroups);
3537 db_print_indent(indent);
3538 db_printf("cr_groups: ");
3539 comma = 0;
3540 for (i = 0; i < xu->cr_ngroups; i++) {
3541 db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
3542 comma = 1;
3543 }
3544 db_printf("\n");
3545 }
3546
3547 static void
db_print_unprefs(int indent,struct unp_head * uh)3548 db_print_unprefs(int indent, struct unp_head *uh)
3549 {
3550 struct unpcb *unp;
3551 int counter;
3552
3553 counter = 0;
3554 LIST_FOREACH(unp, uh, unp_reflink) {
3555 if (counter % 4 == 0)
3556 db_print_indent(indent);
3557 db_printf("%p ", unp);
3558 if (counter % 4 == 3)
3559 db_printf("\n");
3560 counter++;
3561 }
3562 if (counter != 0 && counter % 4 != 0)
3563 db_printf("\n");
3564 }
3565
DB_SHOW_COMMAND(unpcb,db_show_unpcb)3566 DB_SHOW_COMMAND(unpcb, db_show_unpcb)
3567 {
3568 struct unpcb *unp;
3569
3570 if (!have_addr) {
3571 db_printf("usage: show unpcb <addr>\n");
3572 return;
3573 }
3574 unp = (struct unpcb *)addr;
3575
3576 db_printf("unp_socket: %p unp_vnode: %p\n", unp->unp_socket,
3577 unp->unp_vnode);
3578
3579 db_printf("unp_ino: %ju unp_conn: %p\n", (uintmax_t)unp->unp_ino,
3580 unp->unp_conn);
3581
3582 db_printf("unp_refs:\n");
3583 db_print_unprefs(2, &unp->unp_refs);
3584
3585 /* XXXRW: Would be nice to print the full address, if any. */
3586 db_printf("unp_addr: %p\n", unp->unp_addr);
3587
3588 db_printf("unp_gencnt: %llu\n",
3589 (unsigned long long)unp->unp_gencnt);
3590
3591 db_printf("unp_flags: %x (", unp->unp_flags);
3592 db_print_unpflags(unp->unp_flags);
3593 db_printf(")\n");
3594
3595 db_printf("unp_peercred:\n");
3596 db_print_xucred(2, &unp->unp_peercred);
3597
3598 db_printf("unp_refcount: %u\n", unp->unp_refcount);
3599 }
3600 #endif
3601