xref: /freebsd/sys/kern/uipc_usrreq.c (revision bfd03046d18776ea70785ca1ef36dfc60822de3b)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5  *	The Regents of the University of California. All Rights Reserved.
6  * Copyright (c) 2004-2009 Robert N. M. Watson All Rights Reserved.
7  * Copyright (c) 2018 Matthew Macy
8  * Copyright (c) 2022 Gleb Smirnoff <glebius@FreeBSD.org>
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 /*
36  * UNIX Domain (Local) Sockets
37  *
38  * This is an implementation of UNIX (local) domain sockets.  Each socket has
39  * an associated struct unpcb (UNIX protocol control block).  Stream sockets
40  * may be connected to 0 or 1 other socket.  Datagram sockets may be
41  * connected to 0, 1, or many other sockets.  Sockets may be created and
42  * connected in pairs (socketpair(2)), or bound/connected to using the file
43  * system name space.  For most purposes, only the receive socket buffer is
44  * used, as sending on one socket delivers directly to the receive socket
45  * buffer of a second socket.
46  *
47  * The implementation is substantially complicated by the fact that
48  * "ancillary data", such as file descriptors or credentials, may be passed
49  * across UNIX domain sockets.  The potential for passing UNIX domain sockets
50  * over other UNIX domain sockets requires the implementation of a simple
51  * garbage collector to find and tear down cycles of disconnected sockets.
52  *
53  * TODO:
54  *	RDM
55  *	rethink name space problems
56  *	need a proper out-of-band
57  */
58 
59 #include <sys/cdefs.h>
60 #include "opt_ddb.h"
61 
62 #include <sys/param.h>
63 #include <sys/capsicum.h>
64 #include <sys/domain.h>
65 #include <sys/eventhandler.h>
66 #include <sys/fcntl.h>
67 #include <sys/file.h>
68 #include <sys/filedesc.h>
69 #include <sys/kernel.h>
70 #include <sys/lock.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/mount.h>
74 #include <sys/mutex.h>
75 #include <sys/namei.h>
76 #include <sys/proc.h>
77 #include <sys/protosw.h>
78 #include <sys/queue.h>
79 #include <sys/resourcevar.h>
80 #include <sys/rwlock.h>
81 #include <sys/socket.h>
82 #include <sys/socketvar.h>
83 #include <sys/signalvar.h>
84 #include <sys/stat.h>
85 #include <sys/sx.h>
86 #include <sys/sysctl.h>
87 #include <sys/systm.h>
88 #include <sys/taskqueue.h>
89 #include <sys/un.h>
90 #include <sys/unpcb.h>
91 #include <sys/vnode.h>
92 
93 #include <net/vnet.h>
94 
95 #ifdef DDB
96 #include <ddb/ddb.h>
97 #endif
98 
99 #include <security/mac/mac_framework.h>
100 
101 #include <vm/uma.h>
102 
103 MALLOC_DECLARE(M_FILECAPS);
104 
105 static struct domain localdomain;
106 
107 static uma_zone_t	unp_zone;
108 static unp_gen_t	unp_gencnt;	/* (l) */
109 static u_int		unp_count;	/* (l) Count of local sockets. */
110 static ino_t		unp_ino;	/* Prototype for fake inode numbers. */
111 static int		unp_rights;	/* (g) File descriptors in flight. */
112 static struct unp_head	unp_shead;	/* (l) List of stream sockets. */
113 static struct unp_head	unp_dhead;	/* (l) List of datagram sockets. */
114 static struct unp_head	unp_sphead;	/* (l) List of seqpacket sockets. */
115 static struct mtx_pool	*unp_vp_mtxpool;
116 
117 struct unp_defer {
118 	SLIST_ENTRY(unp_defer) ud_link;
119 	struct file *ud_fp;
120 };
121 static SLIST_HEAD(, unp_defer) unp_defers;
122 static int unp_defers_count;
123 
124 static const struct sockaddr	sun_noname = {
125 	.sa_len = sizeof(sun_noname),
126 	.sa_family = AF_LOCAL,
127 };
128 
129 /*
130  * Garbage collection of cyclic file descriptor/socket references occurs
131  * asynchronously in a taskqueue context in order to avoid recursion and
132  * reentrance in the UNIX domain socket, file descriptor, and socket layer
133  * code.  See unp_gc() for a full description.
134  */
135 static struct timeout_task unp_gc_task;
136 
137 /*
138  * The close of unix domain sockets attached as SCM_RIGHTS is
139  * postponed to the taskqueue, to avoid arbitrary recursion depth.
140  * The attached sockets might have another sockets attached.
141  */
142 static struct task	unp_defer_task;
143 
144 /*
145  * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
146  * stream sockets, although the total for sender and receiver is actually
147  * only PIPSIZ.
148  *
149  * Datagram sockets really use the sendspace as the maximum datagram size,
150  * and don't really want to reserve the sendspace.  Their recvspace should be
151  * large enough for at least one max-size datagram plus address.
152  */
153 #ifndef PIPSIZ
154 #define	PIPSIZ	8192
155 #endif
156 static u_long	unpst_sendspace = PIPSIZ;
157 static u_long	unpst_recvspace = PIPSIZ;
158 static u_long	unpdg_maxdgram = 8*1024;	/* support 8KB syslog msgs */
159 static u_long	unpdg_recvspace = 16*1024;
160 static u_long	unpsp_sendspace = PIPSIZ;	/* really max datagram size */
161 static u_long	unpsp_recvspace = PIPSIZ;
162 
163 static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
164     "Local domain");
165 static SYSCTL_NODE(_net_local, SOCK_STREAM, stream,
166     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
167     "SOCK_STREAM");
168 static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram,
169     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
170     "SOCK_DGRAM");
171 static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket,
172     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
173     "SOCK_SEQPACKET");
174 
175 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
176 	   &unpst_sendspace, 0, "Default stream send space.");
177 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
178 	   &unpst_recvspace, 0, "Default stream receive space.");
179 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
180 	   &unpdg_maxdgram, 0, "Maximum datagram size.");
181 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
182 	   &unpdg_recvspace, 0, "Default datagram receive space.");
183 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
184 	   &unpsp_sendspace, 0, "Default seqpacket send space.");
185 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
186 	   &unpsp_recvspace, 0, "Default seqpacket receive space.");
187 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
188     "File descriptors in flight.");
189 SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
190     &unp_defers_count, 0,
191     "File descriptors deferred to taskqueue for close.");
192 
193 /*
194  * Locking and synchronization:
195  *
196  * Several types of locks exist in the local domain socket implementation:
197  * - a global linkage lock
198  * - a global connection list lock
199  * - the mtxpool lock
200  * - per-unpcb mutexes
201  *
202  * The linkage lock protects the global socket lists, the generation number
203  * counter and garbage collector state.
204  *
205  * The connection list lock protects the list of referring sockets in a datagram
206  * socket PCB.  This lock is also overloaded to protect a global list of
207  * sockets whose buffers contain socket references in the form of SCM_RIGHTS
208  * messages.  To avoid recursion, such references are released by a dedicated
209  * thread.
210  *
211  * The mtxpool lock protects the vnode from being modified while referenced.
212  * Lock ordering rules require that it be acquired before any PCB locks.
213  *
214  * The unpcb lock (unp_mtx) protects the most commonly referenced fields in the
215  * unpcb.  This includes the unp_conn field, which either links two connected
216  * PCBs together (for connected socket types) or points at the destination
217  * socket (for connectionless socket types).  The operations of creating or
218  * destroying a connection therefore involve locking multiple PCBs.  To avoid
219  * lock order reversals, in some cases this involves dropping a PCB lock and
220  * using a reference counter to maintain liveness.
221  *
222  * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
223  * allocated in pr_attach() and freed in pr_detach().  The validity of that
224  * pointer is an invariant, so no lock is required to dereference the so_pcb
225  * pointer if a valid socket reference is held by the caller.  In practice,
226  * this is always true during operations performed on a socket.  Each unpcb
227  * has a back-pointer to its socket, unp_socket, which will be stable under
228  * the same circumstances.
229  *
230  * This pointer may only be safely dereferenced as long as a valid reference
231  * to the unpcb is held.  Typically, this reference will be from the socket,
232  * or from another unpcb when the referring unpcb's lock is held (in order
233  * that the reference not be invalidated during use).  For example, to follow
234  * unp->unp_conn->unp_socket, you need to hold a lock on unp_conn to guarantee
235  * that detach is not run clearing unp_socket.
236  *
237  * Blocking with UNIX domain sockets is a tricky issue: unlike most network
238  * protocols, bind() is a non-atomic operation, and connect() requires
239  * potential sleeping in the protocol, due to potentially waiting on local or
240  * distributed file systems.  We try to separate "lookup" operations, which
241  * may sleep, and the IPC operations themselves, which typically can occur
242  * with relative atomicity as locks can be held over the entire operation.
243  *
244  * Another tricky issue is simultaneous multi-threaded or multi-process
245  * access to a single UNIX domain socket.  These are handled by the flags
246  * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
247  * binding, both of which involve dropping UNIX domain socket locks in order
248  * to perform namei() and other file system operations.
249  */
250 static struct rwlock	unp_link_rwlock;
251 static struct mtx	unp_defers_lock;
252 
253 #define	UNP_LINK_LOCK_INIT()		rw_init(&unp_link_rwlock,	\
254 					    "unp_link_rwlock")
255 
256 #define	UNP_LINK_LOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
257 					    RA_LOCKED)
258 #define	UNP_LINK_UNLOCK_ASSERT()	rw_assert(&unp_link_rwlock,	\
259 					    RA_UNLOCKED)
260 
261 #define	UNP_LINK_RLOCK()		rw_rlock(&unp_link_rwlock)
262 #define	UNP_LINK_RUNLOCK()		rw_runlock(&unp_link_rwlock)
263 #define	UNP_LINK_WLOCK()		rw_wlock(&unp_link_rwlock)
264 #define	UNP_LINK_WUNLOCK()		rw_wunlock(&unp_link_rwlock)
265 #define	UNP_LINK_WLOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
266 					    RA_WLOCKED)
267 #define	UNP_LINK_WOWNED()		rw_wowned(&unp_link_rwlock)
268 
269 #define	UNP_DEFERRED_LOCK_INIT()	mtx_init(&unp_defers_lock, \
270 					    "unp_defer", NULL, MTX_DEF)
271 #define	UNP_DEFERRED_LOCK()		mtx_lock(&unp_defers_lock)
272 #define	UNP_DEFERRED_UNLOCK()		mtx_unlock(&unp_defers_lock)
273 
274 #define UNP_REF_LIST_LOCK()		UNP_DEFERRED_LOCK();
275 #define UNP_REF_LIST_UNLOCK()		UNP_DEFERRED_UNLOCK();
276 
277 #define UNP_PCB_LOCK_INIT(unp)		mtx_init(&(unp)->unp_mtx,	\
278 					    "unp", "unp",	\
279 					    MTX_DUPOK|MTX_DEF)
280 #define	UNP_PCB_LOCK_DESTROY(unp)	mtx_destroy(&(unp)->unp_mtx)
281 #define	UNP_PCB_LOCKPTR(unp)		(&(unp)->unp_mtx)
282 #define	UNP_PCB_LOCK(unp)		mtx_lock(&(unp)->unp_mtx)
283 #define	UNP_PCB_TRYLOCK(unp)		mtx_trylock(&(unp)->unp_mtx)
284 #define	UNP_PCB_UNLOCK(unp)		mtx_unlock(&(unp)->unp_mtx)
285 #define	UNP_PCB_OWNED(unp)		mtx_owned(&(unp)->unp_mtx)
286 #define	UNP_PCB_LOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_OWNED)
287 #define	UNP_PCB_UNLOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_NOTOWNED)
288 
289 static int	uipc_connect2(struct socket *, struct socket *);
290 static int	uipc_ctloutput(struct socket *, struct sockopt *);
291 static int	unp_connect(struct socket *, struct sockaddr *,
292 		    struct thread *);
293 static int	unp_connectat(int, struct socket *, struct sockaddr *,
294 		    struct thread *, bool);
295 static void	unp_connect2(struct socket *so, struct socket *so2);
296 static void	unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
297 static void	unp_dispose(struct socket *so);
298 static void	unp_shutdown(struct unpcb *);
299 static void	unp_drop(struct unpcb *);
300 static void	unp_gc(__unused void *, int);
301 static void	unp_scan(struct mbuf *, void (*)(struct filedescent **, int));
302 static void	unp_discard(struct file *);
303 static void	unp_freerights(struct filedescent **, int);
304 static int	unp_internalize(struct mbuf **, struct thread *,
305 		    struct mbuf **, u_int *, u_int *);
306 static void	unp_internalize_fp(struct file *);
307 static int	unp_externalize(struct mbuf *, struct mbuf **, int);
308 static int	unp_externalize_fp(struct file *);
309 static struct mbuf	*unp_addsockcred(struct thread *, struct mbuf *,
310 		    int, struct mbuf **, u_int *, u_int *);
311 static void	unp_process_defers(void * __unused, int);
312 
313 static void
unp_pcb_hold(struct unpcb * unp)314 unp_pcb_hold(struct unpcb *unp)
315 {
316 	u_int old __unused;
317 
318 	old = refcount_acquire(&unp->unp_refcount);
319 	KASSERT(old > 0, ("%s: unpcb %p has no references", __func__, unp));
320 }
321 
322 static __result_use_check bool
unp_pcb_rele(struct unpcb * unp)323 unp_pcb_rele(struct unpcb *unp)
324 {
325 	bool ret;
326 
327 	UNP_PCB_LOCK_ASSERT(unp);
328 
329 	if ((ret = refcount_release(&unp->unp_refcount))) {
330 		UNP_PCB_UNLOCK(unp);
331 		UNP_PCB_LOCK_DESTROY(unp);
332 		uma_zfree(unp_zone, unp);
333 	}
334 	return (ret);
335 }
336 
337 static void
unp_pcb_rele_notlast(struct unpcb * unp)338 unp_pcb_rele_notlast(struct unpcb *unp)
339 {
340 	bool ret __unused;
341 
342 	ret = refcount_release(&unp->unp_refcount);
343 	KASSERT(!ret, ("%s: unpcb %p has no references", __func__, unp));
344 }
345 
346 static void
unp_pcb_lock_pair(struct unpcb * unp,struct unpcb * unp2)347 unp_pcb_lock_pair(struct unpcb *unp, struct unpcb *unp2)
348 {
349 	UNP_PCB_UNLOCK_ASSERT(unp);
350 	UNP_PCB_UNLOCK_ASSERT(unp2);
351 
352 	if (unp == unp2) {
353 		UNP_PCB_LOCK(unp);
354 	} else if ((uintptr_t)unp2 > (uintptr_t)unp) {
355 		UNP_PCB_LOCK(unp);
356 		UNP_PCB_LOCK(unp2);
357 	} else {
358 		UNP_PCB_LOCK(unp2);
359 		UNP_PCB_LOCK(unp);
360 	}
361 }
362 
363 static void
unp_pcb_unlock_pair(struct unpcb * unp,struct unpcb * unp2)364 unp_pcb_unlock_pair(struct unpcb *unp, struct unpcb *unp2)
365 {
366 	UNP_PCB_UNLOCK(unp);
367 	if (unp != unp2)
368 		UNP_PCB_UNLOCK(unp2);
369 }
370 
371 /*
372  * Try to lock the connected peer of an already locked socket.  In some cases
373  * this requires that we unlock the current socket.  The pairbusy counter is
374  * used to block concurrent connection attempts while the lock is dropped.  The
375  * caller must be careful to revalidate PCB state.
376  */
377 static struct unpcb *
unp_pcb_lock_peer(struct unpcb * unp)378 unp_pcb_lock_peer(struct unpcb *unp)
379 {
380 	struct unpcb *unp2;
381 
382 	UNP_PCB_LOCK_ASSERT(unp);
383 	unp2 = unp->unp_conn;
384 	if (unp2 == NULL)
385 		return (NULL);
386 	if (__predict_false(unp == unp2))
387 		return (unp);
388 
389 	UNP_PCB_UNLOCK_ASSERT(unp2);
390 
391 	if (__predict_true(UNP_PCB_TRYLOCK(unp2)))
392 		return (unp2);
393 	if ((uintptr_t)unp2 > (uintptr_t)unp) {
394 		UNP_PCB_LOCK(unp2);
395 		return (unp2);
396 	}
397 	unp->unp_pairbusy++;
398 	unp_pcb_hold(unp2);
399 	UNP_PCB_UNLOCK(unp);
400 
401 	UNP_PCB_LOCK(unp2);
402 	UNP_PCB_LOCK(unp);
403 	KASSERT(unp->unp_conn == unp2 || unp->unp_conn == NULL,
404 	    ("%s: socket %p was reconnected", __func__, unp));
405 	if (--unp->unp_pairbusy == 0 && (unp->unp_flags & UNP_WAITING) != 0) {
406 		unp->unp_flags &= ~UNP_WAITING;
407 		wakeup(unp);
408 	}
409 	if (unp_pcb_rele(unp2)) {
410 		/* unp2 is unlocked. */
411 		return (NULL);
412 	}
413 	if (unp->unp_conn == NULL) {
414 		UNP_PCB_UNLOCK(unp2);
415 		return (NULL);
416 	}
417 	return (unp2);
418 }
419 
420 static void
uipc_abort(struct socket * so)421 uipc_abort(struct socket *so)
422 {
423 	struct unpcb *unp, *unp2;
424 
425 	unp = sotounpcb(so);
426 	KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
427 	UNP_PCB_UNLOCK_ASSERT(unp);
428 
429 	UNP_PCB_LOCK(unp);
430 	unp2 = unp->unp_conn;
431 	if (unp2 != NULL) {
432 		unp_pcb_hold(unp2);
433 		UNP_PCB_UNLOCK(unp);
434 		unp_drop(unp2);
435 	} else
436 		UNP_PCB_UNLOCK(unp);
437 }
438 
439 static int
uipc_attach(struct socket * so,int proto,struct thread * td)440 uipc_attach(struct socket *so, int proto, struct thread *td)
441 {
442 	u_long sendspace, recvspace;
443 	struct unpcb *unp;
444 	int error;
445 	bool locked;
446 
447 	KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
448 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
449 		switch (so->so_type) {
450 		case SOCK_STREAM:
451 			sendspace = unpst_sendspace;
452 			recvspace = unpst_recvspace;
453 			break;
454 
455 		case SOCK_DGRAM:
456 			STAILQ_INIT(&so->so_rcv.uxdg_mb);
457 			STAILQ_INIT(&so->so_snd.uxdg_mb);
458 			TAILQ_INIT(&so->so_rcv.uxdg_conns);
459 			/*
460 			 * Since send buffer is either bypassed or is a part
461 			 * of one-to-many receive buffer, we assign both space
462 			 * limits to unpdg_recvspace.
463 			 */
464 			sendspace = recvspace = unpdg_recvspace;
465 			break;
466 
467 		case SOCK_SEQPACKET:
468 			sendspace = unpsp_sendspace;
469 			recvspace = unpsp_recvspace;
470 			break;
471 
472 		default:
473 			panic("uipc_attach");
474 		}
475 		error = soreserve(so, sendspace, recvspace);
476 		if (error)
477 			return (error);
478 	}
479 	unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
480 	if (unp == NULL)
481 		return (ENOBUFS);
482 	LIST_INIT(&unp->unp_refs);
483 	UNP_PCB_LOCK_INIT(unp);
484 	unp->unp_socket = so;
485 	so->so_pcb = unp;
486 	refcount_init(&unp->unp_refcount, 1);
487 	unp->unp_mode = ACCESSPERMS;
488 
489 	if ((locked = UNP_LINK_WOWNED()) == false)
490 		UNP_LINK_WLOCK();
491 
492 	unp->unp_gencnt = ++unp_gencnt;
493 	unp->unp_ino = ++unp_ino;
494 	unp_count++;
495 	switch (so->so_type) {
496 	case SOCK_STREAM:
497 		LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
498 		break;
499 
500 	case SOCK_DGRAM:
501 		LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
502 		break;
503 
504 	case SOCK_SEQPACKET:
505 		LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
506 		break;
507 
508 	default:
509 		panic("uipc_attach");
510 	}
511 
512 	if (locked == false)
513 		UNP_LINK_WUNLOCK();
514 
515 	return (0);
516 }
517 
518 static int
uipc_bindat(int fd,struct socket * so,struct sockaddr * nam,struct thread * td)519 uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
520 {
521 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
522 	struct vattr vattr;
523 	int error, namelen;
524 	struct nameidata nd;
525 	struct unpcb *unp;
526 	struct vnode *vp;
527 	struct mount *mp;
528 	cap_rights_t rights;
529 	char *buf;
530 	mode_t mode;
531 
532 	if (nam->sa_family != AF_UNIX)
533 		return (EAFNOSUPPORT);
534 
535 	unp = sotounpcb(so);
536 	KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
537 
538 	if (soun->sun_len > sizeof(struct sockaddr_un))
539 		return (EINVAL);
540 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
541 	if (namelen <= 0)
542 		return (EINVAL);
543 
544 	/*
545 	 * We don't allow simultaneous bind() calls on a single UNIX domain
546 	 * socket, so flag in-progress operations, and return an error if an
547 	 * operation is already in progress.
548 	 *
549 	 * Historically, we have not allowed a socket to be rebound, so this
550 	 * also returns an error.  Not allowing re-binding simplifies the
551 	 * implementation and avoids a great many possible failure modes.
552 	 */
553 	UNP_PCB_LOCK(unp);
554 	if (unp->unp_vnode != NULL) {
555 		UNP_PCB_UNLOCK(unp);
556 		return (EINVAL);
557 	}
558 	if (unp->unp_flags & UNP_BINDING) {
559 		UNP_PCB_UNLOCK(unp);
560 		return (EALREADY);
561 	}
562 	unp->unp_flags |= UNP_BINDING;
563 	mode = unp->unp_mode & ~td->td_proc->p_pd->pd_cmask;
564 	UNP_PCB_UNLOCK(unp);
565 
566 	buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
567 	bcopy(soun->sun_path, buf, namelen);
568 	buf[namelen] = 0;
569 
570 restart:
571 	NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | NOCACHE,
572 	    UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_BINDAT));
573 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
574 	error = namei(&nd);
575 	if (error)
576 		goto error;
577 	vp = nd.ni_vp;
578 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
579 		NDFREE_PNBUF(&nd);
580 		if (nd.ni_dvp == vp)
581 			vrele(nd.ni_dvp);
582 		else
583 			vput(nd.ni_dvp);
584 		if (vp != NULL) {
585 			vrele(vp);
586 			error = EADDRINUSE;
587 			goto error;
588 		}
589 		error = vn_start_write(NULL, &mp, V_XSLEEP | V_PCATCH);
590 		if (error)
591 			goto error;
592 		goto restart;
593 	}
594 	VATTR_NULL(&vattr);
595 	vattr.va_type = VSOCK;
596 	vattr.va_mode = mode;
597 #ifdef MAC
598 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
599 	    &vattr);
600 #endif
601 	if (error == 0) {
602 		/*
603 		 * The prior lookup may have left LK_SHARED in cn_lkflags,
604 		 * and VOP_CREATE technically only requires the new vnode to
605 		 * be locked shared. Most filesystems will return the new vnode
606 		 * locked exclusive regardless, but we should explicitly
607 		 * specify that here since we require it and assert to that
608 		 * effect below.
609 		 */
610 		nd.ni_cnd.cn_lkflags = (nd.ni_cnd.cn_lkflags & ~LK_SHARED) |
611 		    LK_EXCLUSIVE;
612 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
613 	}
614 	NDFREE_PNBUF(&nd);
615 	if (error) {
616 		VOP_VPUT_PAIR(nd.ni_dvp, NULL, true);
617 		vn_finished_write(mp);
618 		if (error == ERELOOKUP)
619 			goto restart;
620 		goto error;
621 	}
622 	vp = nd.ni_vp;
623 	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
624 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
625 
626 	UNP_PCB_LOCK(unp);
627 	VOP_UNP_BIND(vp, unp);
628 	unp->unp_vnode = vp;
629 	unp->unp_addr = soun;
630 	unp->unp_flags &= ~UNP_BINDING;
631 	UNP_PCB_UNLOCK(unp);
632 	vref(vp);
633 	VOP_VPUT_PAIR(nd.ni_dvp, &vp, true);
634 	vn_finished_write(mp);
635 	free(buf, M_TEMP);
636 	return (0);
637 
638 error:
639 	UNP_PCB_LOCK(unp);
640 	unp->unp_flags &= ~UNP_BINDING;
641 	UNP_PCB_UNLOCK(unp);
642 	free(buf, M_TEMP);
643 	return (error);
644 }
645 
646 static int
uipc_bind(struct socket * so,struct sockaddr * nam,struct thread * td)647 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
648 {
649 
650 	return (uipc_bindat(AT_FDCWD, so, nam, td));
651 }
652 
653 static int
uipc_connect(struct socket * so,struct sockaddr * nam,struct thread * td)654 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
655 {
656 	int error;
657 
658 	KASSERT(td == curthread, ("uipc_connect: td != curthread"));
659 	error = unp_connect(so, nam, td);
660 	return (error);
661 }
662 
663 static int
uipc_connectat(int fd,struct socket * so,struct sockaddr * nam,struct thread * td)664 uipc_connectat(int fd, struct socket *so, struct sockaddr *nam,
665     struct thread *td)
666 {
667 	int error;
668 
669 	KASSERT(td == curthread, ("uipc_connectat: td != curthread"));
670 	error = unp_connectat(fd, so, nam, td, false);
671 	return (error);
672 }
673 
674 static void
uipc_close(struct socket * so)675 uipc_close(struct socket *so)
676 {
677 	struct unpcb *unp, *unp2;
678 	struct vnode *vp = NULL;
679 	struct mtx *vplock;
680 
681 	unp = sotounpcb(so);
682 	KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
683 
684 	vplock = NULL;
685 	if ((vp = unp->unp_vnode) != NULL) {
686 		vplock = mtx_pool_find(unp_vp_mtxpool, vp);
687 		mtx_lock(vplock);
688 	}
689 	UNP_PCB_LOCK(unp);
690 	if (vp && unp->unp_vnode == NULL) {
691 		mtx_unlock(vplock);
692 		vp = NULL;
693 	}
694 	if (vp != NULL) {
695 		VOP_UNP_DETACH(vp);
696 		unp->unp_vnode = NULL;
697 	}
698 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
699 		unp_disconnect(unp, unp2);
700 	else
701 		UNP_PCB_UNLOCK(unp);
702 	if (vp) {
703 		mtx_unlock(vplock);
704 		vrele(vp);
705 	}
706 }
707 
708 static int
uipc_chmod(struct socket * so,mode_t mode,struct ucred * cred __unused,struct thread * td __unused)709 uipc_chmod(struct socket *so, mode_t mode, struct ucred *cred __unused,
710     struct thread *td __unused)
711 {
712 	struct unpcb *unp;
713 	int error;
714 
715 	if ((mode & ~ACCESSPERMS) != 0)
716 		return (EINVAL);
717 
718 	error = 0;
719 	unp = sotounpcb(so);
720 	UNP_PCB_LOCK(unp);
721 	if (unp->unp_vnode != NULL || (unp->unp_flags & UNP_BINDING) != 0)
722 		error = EINVAL;
723 	else
724 		unp->unp_mode = mode;
725 	UNP_PCB_UNLOCK(unp);
726 	return (error);
727 }
728 
729 static int
uipc_connect2(struct socket * so1,struct socket * so2)730 uipc_connect2(struct socket *so1, struct socket *so2)
731 {
732 	struct unpcb *unp, *unp2;
733 
734 	if (so1->so_type != so2->so_type)
735 		return (EPROTOTYPE);
736 
737 	unp = so1->so_pcb;
738 	KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
739 	unp2 = so2->so_pcb;
740 	KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
741 	unp_pcb_lock_pair(unp, unp2);
742 	unp_connect2(so1, so2);
743 	unp_pcb_unlock_pair(unp, unp2);
744 
745 	return (0);
746 }
747 
748 static void
uipc_detach(struct socket * so)749 uipc_detach(struct socket *so)
750 {
751 	struct unpcb *unp, *unp2;
752 	struct mtx *vplock;
753 	struct vnode *vp;
754 	int local_unp_rights;
755 
756 	unp = sotounpcb(so);
757 	KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
758 
759 	vp = NULL;
760 	vplock = NULL;
761 
762 	if (!SOLISTENING(so))
763 		unp_dispose(so);
764 
765 	UNP_LINK_WLOCK();
766 	LIST_REMOVE(unp, unp_link);
767 	if (unp->unp_gcflag & UNPGC_DEAD)
768 		LIST_REMOVE(unp, unp_dead);
769 	unp->unp_gencnt = ++unp_gencnt;
770 	--unp_count;
771 	UNP_LINK_WUNLOCK();
772 
773 	UNP_PCB_UNLOCK_ASSERT(unp);
774  restart:
775 	if ((vp = unp->unp_vnode) != NULL) {
776 		vplock = mtx_pool_find(unp_vp_mtxpool, vp);
777 		mtx_lock(vplock);
778 	}
779 	UNP_PCB_LOCK(unp);
780 	if (unp->unp_vnode != vp && unp->unp_vnode != NULL) {
781 		if (vplock)
782 			mtx_unlock(vplock);
783 		UNP_PCB_UNLOCK(unp);
784 		goto restart;
785 	}
786 	if ((vp = unp->unp_vnode) != NULL) {
787 		VOP_UNP_DETACH(vp);
788 		unp->unp_vnode = NULL;
789 	}
790 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
791 		unp_disconnect(unp, unp2);
792 	else
793 		UNP_PCB_UNLOCK(unp);
794 
795 	UNP_REF_LIST_LOCK();
796 	while (!LIST_EMPTY(&unp->unp_refs)) {
797 		struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
798 
799 		unp_pcb_hold(ref);
800 		UNP_REF_LIST_UNLOCK();
801 
802 		MPASS(ref != unp);
803 		UNP_PCB_UNLOCK_ASSERT(ref);
804 		unp_drop(ref);
805 		UNP_REF_LIST_LOCK();
806 	}
807 	UNP_REF_LIST_UNLOCK();
808 
809 	UNP_PCB_LOCK(unp);
810 	local_unp_rights = unp_rights;
811 	unp->unp_socket->so_pcb = NULL;
812 	unp->unp_socket = NULL;
813 	free(unp->unp_addr, M_SONAME);
814 	unp->unp_addr = NULL;
815 	if (!unp_pcb_rele(unp))
816 		UNP_PCB_UNLOCK(unp);
817 	if (vp) {
818 		mtx_unlock(vplock);
819 		vrele(vp);
820 	}
821 	if (local_unp_rights)
822 		taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
823 
824 	switch (so->so_type) {
825 	case SOCK_DGRAM:
826 		/*
827 		 * Everything should have been unlinked/freed by unp_dispose()
828 		 * and/or unp_disconnect().
829 		 */
830 		MPASS(so->so_rcv.uxdg_peeked == NULL);
831 		MPASS(STAILQ_EMPTY(&so->so_rcv.uxdg_mb));
832 		MPASS(TAILQ_EMPTY(&so->so_rcv.uxdg_conns));
833 		MPASS(STAILQ_EMPTY(&so->so_snd.uxdg_mb));
834 	}
835 }
836 
837 static int
uipc_disconnect(struct socket * so)838 uipc_disconnect(struct socket *so)
839 {
840 	struct unpcb *unp, *unp2;
841 
842 	unp = sotounpcb(so);
843 	KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
844 
845 	UNP_PCB_LOCK(unp);
846 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
847 		unp_disconnect(unp, unp2);
848 	else
849 		UNP_PCB_UNLOCK(unp);
850 	return (0);
851 }
852 
853 static int
uipc_listen(struct socket * so,int backlog,struct thread * td)854 uipc_listen(struct socket *so, int backlog, struct thread *td)
855 {
856 	struct unpcb *unp;
857 	int error;
858 
859 	MPASS(so->so_type != SOCK_DGRAM);
860 
861 	/*
862 	 * Synchronize with concurrent connection attempts.
863 	 */
864 	error = 0;
865 	unp = sotounpcb(so);
866 	UNP_PCB_LOCK(unp);
867 	if (unp->unp_conn != NULL || (unp->unp_flags & UNP_CONNECTING) != 0)
868 		error = EINVAL;
869 	else if (unp->unp_vnode == NULL)
870 		error = EDESTADDRREQ;
871 	if (error != 0) {
872 		UNP_PCB_UNLOCK(unp);
873 		return (error);
874 	}
875 
876 	SOCK_LOCK(so);
877 	error = solisten_proto_check(so);
878 	if (error == 0) {
879 		cru2xt(td, &unp->unp_peercred);
880 		solisten_proto(so, backlog);
881 	}
882 	SOCK_UNLOCK(so);
883 	UNP_PCB_UNLOCK(unp);
884 	return (error);
885 }
886 
887 static int
uipc_peeraddr(struct socket * so,struct sockaddr * ret)888 uipc_peeraddr(struct socket *so, struct sockaddr *ret)
889 {
890 	struct unpcb *unp, *unp2;
891 	const struct sockaddr *sa;
892 
893 	unp = sotounpcb(so);
894 	KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
895 
896 	UNP_PCB_LOCK(unp);
897 	unp2 = unp_pcb_lock_peer(unp);
898 	if (unp2 != NULL) {
899 		if (unp2->unp_addr != NULL)
900 			sa = (struct sockaddr *)unp2->unp_addr;
901 		else
902 			sa = &sun_noname;
903 		bcopy(sa, ret, sa->sa_len);
904 		unp_pcb_unlock_pair(unp, unp2);
905 	} else {
906 		UNP_PCB_UNLOCK(unp);
907 		sa = &sun_noname;
908 		bcopy(sa, ret, sa->sa_len);
909 	}
910 	return (0);
911 }
912 
913 static int
uipc_rcvd(struct socket * so,int flags)914 uipc_rcvd(struct socket *so, int flags)
915 {
916 	struct unpcb *unp, *unp2;
917 	struct socket *so2;
918 	u_int mbcnt, sbcc;
919 
920 	unp = sotounpcb(so);
921 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
922 	KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET,
923 	    ("%s: socktype %d", __func__, so->so_type));
924 
925 	/*
926 	 * Adjust backpressure on sender and wakeup any waiting to write.
927 	 *
928 	 * The unp lock is acquired to maintain the validity of the unp_conn
929 	 * pointer; no lock on unp2 is required as unp2->unp_socket will be
930 	 * static as long as we don't permit unp2 to disconnect from unp,
931 	 * which is prevented by the lock on unp.  We cache values from
932 	 * so_rcv to avoid holding the so_rcv lock over the entire
933 	 * transaction on the remote so_snd.
934 	 */
935 	SOCKBUF_LOCK(&so->so_rcv);
936 	mbcnt = so->so_rcv.sb_mbcnt;
937 	sbcc = sbavail(&so->so_rcv);
938 	SOCKBUF_UNLOCK(&so->so_rcv);
939 	/*
940 	 * There is a benign race condition at this point.  If we're planning to
941 	 * clear SB_STOP, but uipc_send is called on the connected socket at
942 	 * this instant, it might add data to the sockbuf and set SB_STOP.  Then
943 	 * we would erroneously clear SB_STOP below, even though the sockbuf is
944 	 * full.  The race is benign because the only ill effect is to allow the
945 	 * sockbuf to exceed its size limit, and the size limits are not
946 	 * strictly guaranteed anyway.
947 	 */
948 	UNP_PCB_LOCK(unp);
949 	unp2 = unp->unp_conn;
950 	if (unp2 == NULL) {
951 		UNP_PCB_UNLOCK(unp);
952 		return (0);
953 	}
954 	so2 = unp2->unp_socket;
955 	SOCKBUF_LOCK(&so2->so_snd);
956 	if (sbcc < so2->so_snd.sb_hiwat && mbcnt < so2->so_snd.sb_mbmax)
957 		so2->so_snd.sb_flags &= ~SB_STOP;
958 	sowwakeup_locked(so2);
959 	UNP_PCB_UNLOCK(unp);
960 	return (0);
961 }
962 
963 static int
uipc_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct thread * td)964 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
965     struct mbuf *control, struct thread *td)
966 {
967 	struct unpcb *unp, *unp2;
968 	struct socket *so2;
969 	u_int mbcnt, sbcc;
970 	int error;
971 
972 	unp = sotounpcb(so);
973 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
974 	KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET,
975 	    ("%s: socktype %d", __func__, so->so_type));
976 
977 	error = 0;
978 	if (flags & PRUS_OOB) {
979 		error = EOPNOTSUPP;
980 		goto release;
981 	}
982 	if (control != NULL &&
983 	    (error = unp_internalize(&control, td, NULL, NULL, NULL)))
984 		goto release;
985 
986 	unp2 = NULL;
987 	if ((so->so_state & SS_ISCONNECTED) == 0) {
988 		if (nam != NULL) {
989 			if ((error = unp_connect(so, nam, td)) != 0)
990 				goto out;
991 		} else {
992 			error = ENOTCONN;
993 			goto out;
994 		}
995 	}
996 
997 	UNP_PCB_LOCK(unp);
998 	if ((unp2 = unp_pcb_lock_peer(unp)) == NULL) {
999 		UNP_PCB_UNLOCK(unp);
1000 		error = ENOTCONN;
1001 		goto out;
1002 	} else if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1003 		unp_pcb_unlock_pair(unp, unp2);
1004 		error = EPIPE;
1005 		goto out;
1006 	}
1007 	UNP_PCB_UNLOCK(unp);
1008 	if ((so2 = unp2->unp_socket) == NULL) {
1009 		UNP_PCB_UNLOCK(unp2);
1010 		error = ENOTCONN;
1011 		goto out;
1012 	}
1013 	SOCKBUF_LOCK(&so2->so_rcv);
1014 	if (unp2->unp_flags & UNP_WANTCRED_MASK) {
1015 		/*
1016 		 * Credentials are passed only once on SOCK_STREAM and
1017 		 * SOCK_SEQPACKET (LOCAL_CREDS => WANTCRED_ONESHOT), or
1018 		 * forever (LOCAL_CREDS_PERSISTENT => WANTCRED_ALWAYS).
1019 		 */
1020 		control = unp_addsockcred(td, control, unp2->unp_flags, NULL,
1021 		    NULL, NULL);
1022 		unp2->unp_flags &= ~UNP_WANTCRED_ONESHOT;
1023 	}
1024 
1025 	/*
1026 	 * Send to paired receive port and wake up readers.  Don't
1027 	 * check for space available in the receive buffer if we're
1028 	 * attaching ancillary data; Unix domain sockets only check
1029 	 * for space in the sending sockbuf, and that check is
1030 	 * performed one level up the stack.  At that level we cannot
1031 	 * precisely account for the amount of buffer space used
1032 	 * (e.g., because control messages are not yet internalized).
1033 	 */
1034 	switch (so->so_type) {
1035 	case SOCK_STREAM:
1036 		if (control != NULL) {
1037 			sbappendcontrol_locked(&so2->so_rcv,
1038 			    m->m_len > 0 ?  m : NULL, control, flags);
1039 			control = NULL;
1040 		} else
1041 			sbappend_locked(&so2->so_rcv, m, flags);
1042 		break;
1043 
1044 	case SOCK_SEQPACKET:
1045 		if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
1046 		    &sun_noname, m, control))
1047 			control = NULL;
1048 		break;
1049 	}
1050 
1051 	mbcnt = so2->so_rcv.sb_mbcnt;
1052 	sbcc = sbavail(&so2->so_rcv);
1053 	if (sbcc)
1054 		sorwakeup_locked(so2);
1055 	else
1056 		SOCKBUF_UNLOCK(&so2->so_rcv);
1057 
1058 	/*
1059 	 * The PCB lock on unp2 protects the SB_STOP flag.  Without it,
1060 	 * it would be possible for uipc_rcvd to be called at this
1061 	 * point, drain the receiving sockbuf, clear SB_STOP, and then
1062 	 * we would set SB_STOP below.  That could lead to an empty
1063 	 * sockbuf having SB_STOP set
1064 	 */
1065 	SOCKBUF_LOCK(&so->so_snd);
1066 	if (sbcc >= so->so_snd.sb_hiwat || mbcnt >= so->so_snd.sb_mbmax)
1067 		so->so_snd.sb_flags |= SB_STOP;
1068 	SOCKBUF_UNLOCK(&so->so_snd);
1069 	UNP_PCB_UNLOCK(unp2);
1070 	m = NULL;
1071 out:
1072 	/*
1073 	 * PRUS_EOF is equivalent to pr_send followed by pr_shutdown.
1074 	 */
1075 	if (flags & PRUS_EOF) {
1076 		UNP_PCB_LOCK(unp);
1077 		socantsendmore(so);
1078 		unp_shutdown(unp);
1079 		UNP_PCB_UNLOCK(unp);
1080 	}
1081 	if (control != NULL && error != 0)
1082 		unp_scan(control, unp_freerights);
1083 
1084 release:
1085 	if (control != NULL)
1086 		m_freem(control);
1087 	/*
1088 	 * In case of PRUS_NOTREADY, uipc_ready() is responsible
1089 	 * for freeing memory.
1090 	 */
1091 	if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1092 		m_freem(m);
1093 	return (error);
1094 }
1095 
1096 /* PF_UNIX/SOCK_DGRAM version of sbspace() */
1097 static inline bool
uipc_dgram_sbspace(struct sockbuf * sb,u_int cc,u_int mbcnt)1098 uipc_dgram_sbspace(struct sockbuf *sb, u_int cc, u_int mbcnt)
1099 {
1100 	u_int bleft, mleft;
1101 
1102 	/*
1103 	 * Negative space may happen if send(2) is followed by
1104 	 * setsockopt(SO_SNDBUF/SO_RCVBUF) that shrinks maximum.
1105 	 */
1106 	if (__predict_false(sb->sb_hiwat < sb->uxdg_cc ||
1107 	    sb->sb_mbmax < sb->uxdg_mbcnt))
1108 		return (false);
1109 
1110 	if (__predict_false(sb->sb_state & SBS_CANTRCVMORE))
1111 		return (false);
1112 
1113 	bleft = sb->sb_hiwat - sb->uxdg_cc;
1114 	mleft = sb->sb_mbmax - sb->uxdg_mbcnt;
1115 
1116 	return (bleft >= cc && mleft >= mbcnt);
1117 }
1118 
1119 /*
1120  * PF_UNIX/SOCK_DGRAM send
1121  *
1122  * Allocate a record consisting of 3 mbufs in the sequence of
1123  * from -> control -> data and append it to the socket buffer.
1124  *
1125  * The first mbuf carries sender's name and is a pkthdr that stores
1126  * overall length of datagram, its memory consumption and control length.
1127  */
1128 #define	ctllen	PH_loc.thirtytwo[1]
1129 _Static_assert(offsetof(struct pkthdr, memlen) + sizeof(u_int) <=
1130     offsetof(struct pkthdr, ctllen), "unix/dgram can not store ctllen");
1131 static int
uipc_sosend_dgram(struct socket * so,struct sockaddr * addr,struct uio * uio,struct mbuf * m,struct mbuf * c,int flags,struct thread * td)1132 uipc_sosend_dgram(struct socket *so, struct sockaddr *addr, struct uio *uio,
1133     struct mbuf *m, struct mbuf *c, int flags, struct thread *td)
1134 {
1135 	struct unpcb *unp, *unp2;
1136 	const struct sockaddr *from;
1137 	struct socket *so2;
1138 	struct sockbuf *sb;
1139 	struct mbuf *f, *clast;
1140 	u_int cc, ctl, mbcnt;
1141 	u_int dcc __diagused, dctl __diagused, dmbcnt __diagused;
1142 	int error;
1143 
1144 	MPASS((uio != NULL && m == NULL) || (m != NULL && uio == NULL));
1145 
1146 	error = 0;
1147 	f = NULL;
1148 	ctl = 0;
1149 
1150 	if (__predict_false(flags & MSG_OOB)) {
1151 		error = EOPNOTSUPP;
1152 		goto out;
1153 	}
1154 	if (m == NULL) {
1155 		if (__predict_false(uio->uio_resid > unpdg_maxdgram)) {
1156 			error = EMSGSIZE;
1157 			goto out;
1158 		}
1159 		m = m_uiotombuf(uio, M_WAITOK, 0, max_hdr, M_PKTHDR);
1160 		if (__predict_false(m == NULL)) {
1161 			error = EFAULT;
1162 			goto out;
1163 		}
1164 		f = m_gethdr(M_WAITOK, MT_SONAME);
1165 		cc = m->m_pkthdr.len;
1166 		mbcnt = MSIZE + m->m_pkthdr.memlen;
1167 		if (c != NULL &&
1168 		    (error = unp_internalize(&c, td, &clast, &ctl, &mbcnt)))
1169 			goto out;
1170 	} else {
1171 		/* pr_sosend() with mbuf usually is a kernel thread. */
1172 
1173 		M_ASSERTPKTHDR(m);
1174 		if (__predict_false(c != NULL))
1175 			panic("%s: control from a kernel thread", __func__);
1176 
1177 		if (__predict_false(m->m_pkthdr.len > unpdg_maxdgram)) {
1178 			error = EMSGSIZE;
1179 			goto out;
1180 		}
1181 		if ((f = m_gethdr(M_NOWAIT, MT_SONAME)) == NULL) {
1182 			error = ENOBUFS;
1183 			goto out;
1184 		}
1185 		/* Condition the foreign mbuf to our standards. */
1186 		m_clrprotoflags(m);
1187 		m_tag_delete_chain(m, NULL);
1188 		m->m_pkthdr.rcvif = NULL;
1189 		m->m_pkthdr.flowid = 0;
1190 		m->m_pkthdr.csum_flags = 0;
1191 		m->m_pkthdr.fibnum = 0;
1192 		m->m_pkthdr.rsstype = 0;
1193 
1194 		cc = m->m_pkthdr.len;
1195 		mbcnt = MSIZE;
1196 		for (struct mbuf *mb = m; mb != NULL; mb = mb->m_next) {
1197 			mbcnt += MSIZE;
1198 			if (mb->m_flags & M_EXT)
1199 				mbcnt += mb->m_ext.ext_size;
1200 		}
1201 	}
1202 
1203 	unp = sotounpcb(so);
1204 	MPASS(unp);
1205 
1206 	/*
1207 	 * XXXGL: would be cool to fully remove so_snd out of the equation
1208 	 * and avoid this lock, which is not only extraneous, but also being
1209 	 * released, thus still leaving possibility for a race.  We can easily
1210 	 * handle SBS_CANTSENDMORE/SS_ISCONNECTED complement in unpcb, but it
1211 	 * is more difficult to invent something to handle so_error.
1212 	 */
1213 	error = SOCK_IO_SEND_LOCK(so, SBLOCKWAIT(flags));
1214 	if (error)
1215 		goto out2;
1216 	SOCK_SENDBUF_LOCK(so);
1217 	if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1218 		SOCK_SENDBUF_UNLOCK(so);
1219 		error = EPIPE;
1220 		goto out3;
1221 	}
1222 	if (so->so_error != 0) {
1223 		error = so->so_error;
1224 		so->so_error = 0;
1225 		SOCK_SENDBUF_UNLOCK(so);
1226 		goto out3;
1227 	}
1228 	if (((so->so_state & SS_ISCONNECTED) == 0) && addr == NULL) {
1229 		SOCK_SENDBUF_UNLOCK(so);
1230 		error = EDESTADDRREQ;
1231 		goto out3;
1232 	}
1233 	SOCK_SENDBUF_UNLOCK(so);
1234 
1235 	if (addr != NULL) {
1236 		if ((error = unp_connectat(AT_FDCWD, so, addr, td, true)))
1237 			goto out3;
1238 		UNP_PCB_LOCK_ASSERT(unp);
1239 		unp2 = unp->unp_conn;
1240 		UNP_PCB_LOCK_ASSERT(unp2);
1241 	} else {
1242 		UNP_PCB_LOCK(unp);
1243 		unp2 = unp_pcb_lock_peer(unp);
1244 		if (unp2 == NULL) {
1245 			UNP_PCB_UNLOCK(unp);
1246 			error = ENOTCONN;
1247 			goto out3;
1248 		}
1249 	}
1250 
1251 	if (unp2->unp_flags & UNP_WANTCRED_MASK)
1252 		c = unp_addsockcred(td, c, unp2->unp_flags, &clast, &ctl,
1253 		    &mbcnt);
1254 	if (unp->unp_addr != NULL)
1255 		from = (struct sockaddr *)unp->unp_addr;
1256 	else
1257 		from = &sun_noname;
1258 	f->m_len = from->sa_len;
1259 	MPASS(from->sa_len <= MLEN);
1260 	bcopy(from, mtod(f, void *), from->sa_len);
1261 	ctl += f->m_len;
1262 
1263 	/*
1264 	 * Concatenate mbufs: from -> control -> data.
1265 	 * Save overall cc and mbcnt in "from" mbuf.
1266 	 */
1267 	if (c != NULL) {
1268 #ifdef INVARIANTS
1269 		struct mbuf *mc;
1270 
1271 		for (mc = c; mc->m_next != NULL; mc = mc->m_next);
1272 		MPASS(mc == clast);
1273 #endif
1274 		f->m_next = c;
1275 		clast->m_next = m;
1276 		c = NULL;
1277 	} else
1278 		f->m_next = m;
1279 	m = NULL;
1280 #ifdef INVARIANTS
1281 	dcc = dctl = dmbcnt = 0;
1282 	for (struct mbuf *mb = f; mb != NULL; mb = mb->m_next) {
1283 		if (mb->m_type == MT_DATA)
1284 			dcc += mb->m_len;
1285 		else
1286 			dctl += mb->m_len;
1287 		dmbcnt += MSIZE;
1288 		if (mb->m_flags & M_EXT)
1289 			dmbcnt += mb->m_ext.ext_size;
1290 	}
1291 	MPASS(dcc == cc);
1292 	MPASS(dctl == ctl);
1293 	MPASS(dmbcnt == mbcnt);
1294 #endif
1295 	f->m_pkthdr.len = cc + ctl;
1296 	f->m_pkthdr.memlen = mbcnt;
1297 	f->m_pkthdr.ctllen = ctl;
1298 
1299 	/*
1300 	 * Destination socket buffer selection.
1301 	 *
1302 	 * Unconnected sends, when !(so->so_state & SS_ISCONNECTED) and the
1303 	 * destination address is supplied, create a temporary connection for
1304 	 * the run time of the function (see call to unp_connectat() above and
1305 	 * to unp_disconnect() below).  We distinguish them by condition of
1306 	 * (addr != NULL).  We intentionally avoid adding 'bool connected' for
1307 	 * that condition, since, again, through the run time of this code we
1308 	 * are always connected.  For such "unconnected" sends, the destination
1309 	 * buffer would be the receive buffer of destination socket so2.
1310 	 *
1311 	 * For connected sends, data lands on the send buffer of the sender's
1312 	 * socket "so".  Then, if we just added the very first datagram
1313 	 * on this send buffer, we need to add the send buffer on to the
1314 	 * receiving socket's buffer list.  We put ourselves on top of the
1315 	 * list.  Such logic gives infrequent senders priority over frequent
1316 	 * senders.
1317 	 *
1318 	 * Note on byte count management. As long as event methods kevent(2),
1319 	 * select(2) are not protocol specific (yet), we need to maintain
1320 	 * meaningful values on the receive buffer.  So, the receive buffer
1321 	 * would accumulate counters from all connected buffers potentially
1322 	 * having sb_ccc > sb_hiwat or sb_mbcnt > sb_mbmax.
1323 	 */
1324 	so2 = unp2->unp_socket;
1325 	sb = (addr == NULL) ? &so->so_snd : &so2->so_rcv;
1326 	SOCK_RECVBUF_LOCK(so2);
1327 	if (uipc_dgram_sbspace(sb, cc + ctl, mbcnt)) {
1328 		if (addr == NULL && STAILQ_EMPTY(&sb->uxdg_mb))
1329 			TAILQ_INSERT_HEAD(&so2->so_rcv.uxdg_conns, &so->so_snd,
1330 			    uxdg_clist);
1331 		STAILQ_INSERT_TAIL(&sb->uxdg_mb, f, m_stailqpkt);
1332 		sb->uxdg_cc += cc + ctl;
1333 		sb->uxdg_ctl += ctl;
1334 		sb->uxdg_mbcnt += mbcnt;
1335 		so2->so_rcv.sb_acc += cc + ctl;
1336 		so2->so_rcv.sb_ccc += cc + ctl;
1337 		so2->so_rcv.sb_ctl += ctl;
1338 		so2->so_rcv.sb_mbcnt += mbcnt;
1339 		sorwakeup_locked(so2);
1340 		f = NULL;
1341 	} else {
1342 		soroverflow_locked(so2);
1343 		error = ENOBUFS;
1344 		if (f->m_next->m_type == MT_CONTROL) {
1345 			c = f->m_next;
1346 			f->m_next = NULL;
1347 		}
1348 	}
1349 
1350 	if (addr != NULL)
1351 		unp_disconnect(unp, unp2);
1352 	else
1353 		unp_pcb_unlock_pair(unp, unp2);
1354 
1355 	td->td_ru.ru_msgsnd++;
1356 
1357 out3:
1358 	SOCK_IO_SEND_UNLOCK(so);
1359 out2:
1360 	if (c)
1361 		unp_scan(c, unp_freerights);
1362 out:
1363 	if (f)
1364 		m_freem(f);
1365 	if (c)
1366 		m_freem(c);
1367 	if (m)
1368 		m_freem(m);
1369 
1370 	return (error);
1371 }
1372 
1373 /*
1374  * PF_UNIX/SOCK_DGRAM receive with MSG_PEEK.
1375  * The mbuf has already been unlinked from the uxdg_mb of socket buffer
1376  * and needs to be linked onto uxdg_peeked of receive socket buffer.
1377  */
1378 static int
uipc_peek_dgram(struct socket * so,struct mbuf * m,struct sockaddr ** psa,struct uio * uio,struct mbuf ** controlp,int * flagsp)1379 uipc_peek_dgram(struct socket *so, struct mbuf *m, struct sockaddr **psa,
1380     struct uio *uio, struct mbuf **controlp, int *flagsp)
1381 {
1382 	ssize_t len = 0;
1383 	int error;
1384 
1385 	so->so_rcv.uxdg_peeked = m;
1386 	so->so_rcv.uxdg_cc += m->m_pkthdr.len;
1387 	so->so_rcv.uxdg_ctl += m->m_pkthdr.ctllen;
1388 	so->so_rcv.uxdg_mbcnt += m->m_pkthdr.memlen;
1389 	SOCK_RECVBUF_UNLOCK(so);
1390 
1391 	KASSERT(m->m_type == MT_SONAME, ("m->m_type == %d", m->m_type));
1392 	if (psa != NULL)
1393 		*psa = sodupsockaddr(mtod(m, struct sockaddr *), M_WAITOK);
1394 
1395 	m = m->m_next;
1396 	KASSERT(m, ("%s: no data or control after soname", __func__));
1397 
1398 	/*
1399 	 * With MSG_PEEK the control isn't executed, just copied.
1400 	 */
1401 	while (m != NULL && m->m_type == MT_CONTROL) {
1402 		if (controlp != NULL) {
1403 			*controlp = m_copym(m, 0, m->m_len, M_WAITOK);
1404 			controlp = &(*controlp)->m_next;
1405 		}
1406 		m = m->m_next;
1407 	}
1408 	KASSERT(m == NULL || m->m_type == MT_DATA,
1409 	    ("%s: not MT_DATA mbuf %p", __func__, m));
1410 	while (m != NULL && uio->uio_resid > 0) {
1411 		len = uio->uio_resid;
1412 		if (len > m->m_len)
1413 			len = m->m_len;
1414 		error = uiomove(mtod(m, char *), (int)len, uio);
1415 		if (error) {
1416 			SOCK_IO_RECV_UNLOCK(so);
1417 			return (error);
1418 		}
1419 		if (len == m->m_len)
1420 			m = m->m_next;
1421 	}
1422 	SOCK_IO_RECV_UNLOCK(so);
1423 
1424 	if (flagsp != NULL) {
1425 		if (m != NULL) {
1426 			if (*flagsp & MSG_TRUNC) {
1427 				/* Report real length of the packet */
1428 				uio->uio_resid -= m_length(m, NULL) - len;
1429 			}
1430 			*flagsp |= MSG_TRUNC;
1431 		} else
1432 			*flagsp &= ~MSG_TRUNC;
1433 	}
1434 
1435 	return (0);
1436 }
1437 
1438 /*
1439  * PF_UNIX/SOCK_DGRAM receive
1440  */
1441 static int
uipc_soreceive_dgram(struct socket * so,struct sockaddr ** psa,struct uio * uio,struct mbuf ** mp0,struct mbuf ** controlp,int * flagsp)1442 uipc_soreceive_dgram(struct socket *so, struct sockaddr **psa, struct uio *uio,
1443     struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
1444 {
1445 	struct sockbuf *sb = NULL;
1446 	struct mbuf *m;
1447 	int flags, error;
1448 	ssize_t len = 0;
1449 	bool nonblock;
1450 
1451 	MPASS(mp0 == NULL);
1452 
1453 	if (psa != NULL)
1454 		*psa = NULL;
1455 	if (controlp != NULL)
1456 		*controlp = NULL;
1457 
1458 	flags = flagsp != NULL ? *flagsp : 0;
1459 	nonblock = (so->so_state & SS_NBIO) ||
1460 	    (flags & (MSG_DONTWAIT | MSG_NBIO));
1461 
1462 	error = SOCK_IO_RECV_LOCK(so, SBLOCKWAIT(flags));
1463 	if (__predict_false(error))
1464 		return (error);
1465 
1466 	/*
1467 	 * Loop blocking while waiting for a datagram.  Prioritize connected
1468 	 * peers over unconnected sends.  Set sb to selected socket buffer
1469 	 * containing an mbuf on exit from the wait loop.  A datagram that
1470 	 * had already been peeked at has top priority.
1471 	 */
1472 	SOCK_RECVBUF_LOCK(so);
1473 	while ((m = so->so_rcv.uxdg_peeked) == NULL &&
1474 	    (sb = TAILQ_FIRST(&so->so_rcv.uxdg_conns)) == NULL &&
1475 	    (m = STAILQ_FIRST(&so->so_rcv.uxdg_mb)) == NULL) {
1476 		if (so->so_error) {
1477 			error = so->so_error;
1478 			if (!(flags & MSG_PEEK))
1479 				so->so_error = 0;
1480 			SOCK_RECVBUF_UNLOCK(so);
1481 			SOCK_IO_RECV_UNLOCK(so);
1482 			return (error);
1483 		}
1484 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE ||
1485 		    uio->uio_resid == 0) {
1486 			SOCK_RECVBUF_UNLOCK(so);
1487 			SOCK_IO_RECV_UNLOCK(so);
1488 			return (0);
1489 		}
1490 		if (nonblock) {
1491 			SOCK_RECVBUF_UNLOCK(so);
1492 			SOCK_IO_RECV_UNLOCK(so);
1493 			return (EWOULDBLOCK);
1494 		}
1495 		error = sbwait(so, SO_RCV);
1496 		if (error) {
1497 			SOCK_RECVBUF_UNLOCK(so);
1498 			SOCK_IO_RECV_UNLOCK(so);
1499 			return (error);
1500 		}
1501 	}
1502 
1503 	if (sb == NULL)
1504 		sb = &so->so_rcv;
1505 	else if (m == NULL)
1506 		m = STAILQ_FIRST(&sb->uxdg_mb);
1507 	else
1508 		MPASS(m == so->so_rcv.uxdg_peeked);
1509 
1510 	MPASS(sb->uxdg_cc > 0);
1511 	M_ASSERTPKTHDR(m);
1512 	KASSERT(m->m_type == MT_SONAME, ("m->m_type == %d", m->m_type));
1513 
1514 	if (uio->uio_td)
1515 		uio->uio_td->td_ru.ru_msgrcv++;
1516 
1517 	if (__predict_true(m != so->so_rcv.uxdg_peeked)) {
1518 		STAILQ_REMOVE_HEAD(&sb->uxdg_mb, m_stailqpkt);
1519 		if (STAILQ_EMPTY(&sb->uxdg_mb) && sb != &so->so_rcv)
1520 			TAILQ_REMOVE(&so->so_rcv.uxdg_conns, sb, uxdg_clist);
1521 	} else
1522 		so->so_rcv.uxdg_peeked = NULL;
1523 
1524 	sb->uxdg_cc -= m->m_pkthdr.len;
1525 	sb->uxdg_ctl -= m->m_pkthdr.ctllen;
1526 	sb->uxdg_mbcnt -= m->m_pkthdr.memlen;
1527 
1528 	if (__predict_false(flags & MSG_PEEK))
1529 		return (uipc_peek_dgram(so, m, psa, uio, controlp, flagsp));
1530 
1531 	so->so_rcv.sb_acc -= m->m_pkthdr.len;
1532 	so->so_rcv.sb_ccc -= m->m_pkthdr.len;
1533 	so->so_rcv.sb_ctl -= m->m_pkthdr.ctllen;
1534 	so->so_rcv.sb_mbcnt -= m->m_pkthdr.memlen;
1535 	SOCK_RECVBUF_UNLOCK(so);
1536 
1537 	if (psa != NULL)
1538 		*psa = sodupsockaddr(mtod(m, struct sockaddr *), M_WAITOK);
1539 	m = m_free(m);
1540 	KASSERT(m, ("%s: no data or control after soname", __func__));
1541 
1542 	/*
1543 	 * Packet to copyout() is now in 'm' and it is disconnected from the
1544 	 * queue.
1545 	 *
1546 	 * Process one or more MT_CONTROL mbufs present before any data mbufs
1547 	 * in the first mbuf chain on the socket buffer.  We call into the
1548 	 * unp_externalize() to perform externalization (or freeing if
1549 	 * controlp == NULL). In some cases there can be only MT_CONTROL mbufs
1550 	 * without MT_DATA mbufs.
1551 	 */
1552 	while (m != NULL && m->m_type == MT_CONTROL) {
1553 		struct mbuf *cm;
1554 
1555 		/* XXXGL: unp_externalize() is also dom_externalize() KBI and
1556 		 * it frees whole chain, so we must disconnect the mbuf.
1557 		 */
1558 		cm = m; m = m->m_next; cm->m_next = NULL;
1559 		error = unp_externalize(cm, controlp, flags);
1560 		if (error != 0) {
1561 			SOCK_IO_RECV_UNLOCK(so);
1562 			unp_scan(m, unp_freerights);
1563 			m_freem(m);
1564 			return (error);
1565 		}
1566 		if (controlp != NULL) {
1567 			while (*controlp != NULL)
1568 				controlp = &(*controlp)->m_next;
1569 		}
1570 	}
1571 	KASSERT(m == NULL || m->m_type == MT_DATA,
1572 	    ("%s: not MT_DATA mbuf %p", __func__, m));
1573 	while (m != NULL && uio->uio_resid > 0) {
1574 		len = uio->uio_resid;
1575 		if (len > m->m_len)
1576 			len = m->m_len;
1577 		error = uiomove(mtod(m, char *), (int)len, uio);
1578 		if (error) {
1579 			SOCK_IO_RECV_UNLOCK(so);
1580 			m_freem(m);
1581 			return (error);
1582 		}
1583 		if (len == m->m_len)
1584 			m = m_free(m);
1585 		else {
1586 			m->m_data += len;
1587 			m->m_len -= len;
1588 		}
1589 	}
1590 	SOCK_IO_RECV_UNLOCK(so);
1591 
1592 	if (m != NULL) {
1593 		if (flagsp != NULL) {
1594 			if (flags & MSG_TRUNC) {
1595 				/* Report real length of the packet */
1596 				uio->uio_resid -= m_length(m, NULL);
1597 			}
1598 			*flagsp |= MSG_TRUNC;
1599 		}
1600 		m_freem(m);
1601 	} else if (flagsp != NULL)
1602 		*flagsp &= ~MSG_TRUNC;
1603 
1604 	return (0);
1605 }
1606 
1607 static bool
uipc_ready_scan(struct socket * so,struct mbuf * m,int count,int * errorp)1608 uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp)
1609 {
1610 	struct mbuf *mb, *n;
1611 	struct sockbuf *sb;
1612 
1613 	SOCK_LOCK(so);
1614 	if (SOLISTENING(so)) {
1615 		SOCK_UNLOCK(so);
1616 		return (false);
1617 	}
1618 	mb = NULL;
1619 	sb = &so->so_rcv;
1620 	SOCKBUF_LOCK(sb);
1621 	if (sb->sb_fnrdy != NULL) {
1622 		for (mb = sb->sb_mb, n = mb->m_nextpkt; mb != NULL;) {
1623 			if (mb == m) {
1624 				*errorp = sbready(sb, m, count);
1625 				break;
1626 			}
1627 			mb = mb->m_next;
1628 			if (mb == NULL) {
1629 				mb = n;
1630 				if (mb != NULL)
1631 					n = mb->m_nextpkt;
1632 			}
1633 		}
1634 	}
1635 	SOCKBUF_UNLOCK(sb);
1636 	SOCK_UNLOCK(so);
1637 	return (mb != NULL);
1638 }
1639 
1640 static int
uipc_ready(struct socket * so,struct mbuf * m,int count)1641 uipc_ready(struct socket *so, struct mbuf *m, int count)
1642 {
1643 	struct unpcb *unp, *unp2;
1644 	struct socket *so2;
1645 	int error, i;
1646 
1647 	unp = sotounpcb(so);
1648 
1649 	KASSERT(so->so_type == SOCK_STREAM,
1650 	    ("%s: unexpected socket type for %p", __func__, so));
1651 
1652 	UNP_PCB_LOCK(unp);
1653 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
1654 		UNP_PCB_UNLOCK(unp);
1655 		so2 = unp2->unp_socket;
1656 		SOCKBUF_LOCK(&so2->so_rcv);
1657 		if ((error = sbready(&so2->so_rcv, m, count)) == 0)
1658 			sorwakeup_locked(so2);
1659 		else
1660 			SOCKBUF_UNLOCK(&so2->so_rcv);
1661 		UNP_PCB_UNLOCK(unp2);
1662 		return (error);
1663 	}
1664 	UNP_PCB_UNLOCK(unp);
1665 
1666 	/*
1667 	 * The receiving socket has been disconnected, but may still be valid.
1668 	 * In this case, the now-ready mbufs are still present in its socket
1669 	 * buffer, so perform an exhaustive search before giving up and freeing
1670 	 * the mbufs.
1671 	 */
1672 	UNP_LINK_RLOCK();
1673 	LIST_FOREACH(unp, &unp_shead, unp_link) {
1674 		if (uipc_ready_scan(unp->unp_socket, m, count, &error))
1675 			break;
1676 	}
1677 	UNP_LINK_RUNLOCK();
1678 
1679 	if (unp == NULL) {
1680 		for (i = 0; i < count; i++)
1681 			m = m_free(m);
1682 		error = ECONNRESET;
1683 	}
1684 	return (error);
1685 }
1686 
1687 static int
uipc_sense(struct socket * so,struct stat * sb)1688 uipc_sense(struct socket *so, struct stat *sb)
1689 {
1690 	struct unpcb *unp;
1691 
1692 	unp = sotounpcb(so);
1693 	KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1694 
1695 	sb->st_blksize = so->so_snd.sb_hiwat;
1696 	sb->st_dev = NODEV;
1697 	sb->st_ino = unp->unp_ino;
1698 	return (0);
1699 }
1700 
1701 static int
uipc_shutdown(struct socket * so,enum shutdown_how how)1702 uipc_shutdown(struct socket *so, enum shutdown_how how)
1703 {
1704 	struct unpcb *unp = sotounpcb(so);
1705 	int error;
1706 
1707 	SOCK_LOCK(so);
1708 	if (SOLISTENING(so)) {
1709 		if (how != SHUT_WR) {
1710 			so->so_error = ECONNABORTED;
1711 			solisten_wakeup(so);    /* unlocks so */
1712 		} else
1713 			SOCK_UNLOCK(so);
1714 		return (ENOTCONN);
1715 	} else if ((so->so_state &
1716 	    (SS_ISCONNECTED | SS_ISCONNECTING | SS_ISDISCONNECTING)) == 0) {
1717 		/*
1718 		 * POSIX mandates us to just return ENOTCONN when shutdown(2) is
1719 		 * invoked on a datagram sockets, however historically we would
1720 		 * actually tear socket down.  This is known to be leveraged by
1721 		 * some applications to unblock process waiting in recv(2) by
1722 		 * other process that it shares that socket with.  Try to meet
1723 		 * both backward-compatibility and POSIX requirements by forcing
1724 		 * ENOTCONN but still flushing buffers and performing wakeup(9).
1725 		 *
1726 		 * XXXGL: it remains unknown what applications expect this
1727 		 * behavior and is this isolated to unix/dgram or inet/dgram or
1728 		 * both.  See: D10351, D3039.
1729 		 */
1730 		error = ENOTCONN;
1731 		if (so->so_type != SOCK_DGRAM) {
1732 			SOCK_UNLOCK(so);
1733 			return (error);
1734 		}
1735 	} else
1736 		error = 0;
1737 	SOCK_UNLOCK(so);
1738 
1739 	switch (how) {
1740 	case SHUT_RD:
1741 		socantrcvmore(so);
1742 		unp_dispose(so);
1743 		break;
1744 	case SHUT_RDWR:
1745 		socantrcvmore(so);
1746 		unp_dispose(so);
1747 		/* FALLTHROUGH */
1748 	case SHUT_WR:
1749 		UNP_PCB_LOCK(unp);
1750 		socantsendmore(so);
1751 		unp_shutdown(unp);
1752 		UNP_PCB_UNLOCK(unp);
1753 	}
1754 	wakeup(&so->so_timeo);
1755 
1756 	return (error);
1757 }
1758 
1759 static int
uipc_sockaddr(struct socket * so,struct sockaddr * ret)1760 uipc_sockaddr(struct socket *so, struct sockaddr *ret)
1761 {
1762 	struct unpcb *unp;
1763 	const struct sockaddr *sa;
1764 
1765 	unp = sotounpcb(so);
1766 	KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1767 
1768 	UNP_PCB_LOCK(unp);
1769 	if (unp->unp_addr != NULL)
1770 		sa = (struct sockaddr *) unp->unp_addr;
1771 	else
1772 		sa = &sun_noname;
1773 	bcopy(sa, ret, sa->sa_len);
1774 	UNP_PCB_UNLOCK(unp);
1775 	return (0);
1776 }
1777 
1778 static int
uipc_ctloutput(struct socket * so,struct sockopt * sopt)1779 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
1780 {
1781 	struct unpcb *unp;
1782 	struct xucred xu;
1783 	int error, optval;
1784 
1785 	if (sopt->sopt_level != SOL_LOCAL)
1786 		return (EINVAL);
1787 
1788 	unp = sotounpcb(so);
1789 	KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
1790 	error = 0;
1791 	switch (sopt->sopt_dir) {
1792 	case SOPT_GET:
1793 		switch (sopt->sopt_name) {
1794 		case LOCAL_PEERCRED:
1795 			UNP_PCB_LOCK(unp);
1796 			if (unp->unp_flags & UNP_HAVEPC)
1797 				xu = unp->unp_peercred;
1798 			else {
1799 				if (so->so_type == SOCK_STREAM)
1800 					error = ENOTCONN;
1801 				else
1802 					error = EINVAL;
1803 			}
1804 			UNP_PCB_UNLOCK(unp);
1805 			if (error == 0)
1806 				error = sooptcopyout(sopt, &xu, sizeof(xu));
1807 			break;
1808 
1809 		case LOCAL_CREDS:
1810 			/* Unlocked read. */
1811 			optval = unp->unp_flags & UNP_WANTCRED_ONESHOT ? 1 : 0;
1812 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1813 			break;
1814 
1815 		case LOCAL_CREDS_PERSISTENT:
1816 			/* Unlocked read. */
1817 			optval = unp->unp_flags & UNP_WANTCRED_ALWAYS ? 1 : 0;
1818 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1819 			break;
1820 
1821 		default:
1822 			error = EOPNOTSUPP;
1823 			break;
1824 		}
1825 		break;
1826 
1827 	case SOPT_SET:
1828 		switch (sopt->sopt_name) {
1829 		case LOCAL_CREDS:
1830 		case LOCAL_CREDS_PERSISTENT:
1831 			error = sooptcopyin(sopt, &optval, sizeof(optval),
1832 					    sizeof(optval));
1833 			if (error)
1834 				break;
1835 
1836 #define	OPTSET(bit, exclusive) do {					\
1837 	UNP_PCB_LOCK(unp);						\
1838 	if (optval) {							\
1839 		if ((unp->unp_flags & (exclusive)) != 0) {		\
1840 			UNP_PCB_UNLOCK(unp);				\
1841 			error = EINVAL;					\
1842 			break;						\
1843 		}							\
1844 		unp->unp_flags |= (bit);				\
1845 	} else								\
1846 		unp->unp_flags &= ~(bit);				\
1847 	UNP_PCB_UNLOCK(unp);						\
1848 } while (0)
1849 
1850 			switch (sopt->sopt_name) {
1851 			case LOCAL_CREDS:
1852 				OPTSET(UNP_WANTCRED_ONESHOT, UNP_WANTCRED_ALWAYS);
1853 				break;
1854 
1855 			case LOCAL_CREDS_PERSISTENT:
1856 				OPTSET(UNP_WANTCRED_ALWAYS, UNP_WANTCRED_ONESHOT);
1857 				break;
1858 
1859 			default:
1860 				break;
1861 			}
1862 			break;
1863 #undef	OPTSET
1864 		default:
1865 			error = ENOPROTOOPT;
1866 			break;
1867 		}
1868 		break;
1869 
1870 	default:
1871 		error = EOPNOTSUPP;
1872 		break;
1873 	}
1874 	return (error);
1875 }
1876 
1877 static int
unp_connect(struct socket * so,struct sockaddr * nam,struct thread * td)1878 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1879 {
1880 
1881 	return (unp_connectat(AT_FDCWD, so, nam, td, false));
1882 }
1883 
1884 static int
unp_connectat(int fd,struct socket * so,struct sockaddr * nam,struct thread * td,bool return_locked)1885 unp_connectat(int fd, struct socket *so, struct sockaddr *nam,
1886     struct thread *td, bool return_locked)
1887 {
1888 	struct mtx *vplock;
1889 	struct sockaddr_un *soun;
1890 	struct vnode *vp;
1891 	struct socket *so2;
1892 	struct unpcb *unp, *unp2, *unp3;
1893 	struct nameidata nd;
1894 	char buf[SOCK_MAXADDRLEN];
1895 	struct sockaddr *sa;
1896 	cap_rights_t rights;
1897 	int error, len;
1898 	bool connreq;
1899 
1900 	if (nam->sa_family != AF_UNIX)
1901 		return (EAFNOSUPPORT);
1902 	if (nam->sa_len > sizeof(struct sockaddr_un))
1903 		return (EINVAL);
1904 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
1905 	if (len <= 0)
1906 		return (EINVAL);
1907 	soun = (struct sockaddr_un *)nam;
1908 	bcopy(soun->sun_path, buf, len);
1909 	buf[len] = 0;
1910 
1911 	error = 0;
1912 	unp = sotounpcb(so);
1913 	UNP_PCB_LOCK(unp);
1914 	for (;;) {
1915 		/*
1916 		 * Wait for connection state to stabilize.  If a connection
1917 		 * already exists, give up.  For datagram sockets, which permit
1918 		 * multiple consecutive connect(2) calls, upper layers are
1919 		 * responsible for disconnecting in advance of a subsequent
1920 		 * connect(2), but this is not synchronized with PCB connection
1921 		 * state.
1922 		 *
1923 		 * Also make sure that no threads are currently attempting to
1924 		 * lock the peer socket, to ensure that unp_conn cannot
1925 		 * transition between two valid sockets while locks are dropped.
1926 		 */
1927 		if (SOLISTENING(so))
1928 			error = EOPNOTSUPP;
1929 		else if (unp->unp_conn != NULL)
1930 			error = EISCONN;
1931 		else if ((unp->unp_flags & UNP_CONNECTING) != 0) {
1932 			error = EALREADY;
1933 		}
1934 		if (error != 0) {
1935 			UNP_PCB_UNLOCK(unp);
1936 			return (error);
1937 		}
1938 		if (unp->unp_pairbusy > 0) {
1939 			unp->unp_flags |= UNP_WAITING;
1940 			mtx_sleep(unp, UNP_PCB_LOCKPTR(unp), 0, "unpeer", 0);
1941 			continue;
1942 		}
1943 		break;
1944 	}
1945 	unp->unp_flags |= UNP_CONNECTING;
1946 	UNP_PCB_UNLOCK(unp);
1947 
1948 	connreq = (so->so_proto->pr_flags & PR_CONNREQUIRED) != 0;
1949 	if (connreq)
1950 		sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1951 	else
1952 		sa = NULL;
1953 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF,
1954 	    UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_CONNECTAT));
1955 	error = namei(&nd);
1956 	if (error)
1957 		vp = NULL;
1958 	else
1959 		vp = nd.ni_vp;
1960 	ASSERT_VOP_LOCKED(vp, "unp_connect");
1961 	if (error)
1962 		goto bad;
1963 	NDFREE_PNBUF(&nd);
1964 
1965 	if (vp->v_type != VSOCK) {
1966 		error = ENOTSOCK;
1967 		goto bad;
1968 	}
1969 #ifdef MAC
1970 	error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
1971 	if (error)
1972 		goto bad;
1973 #endif
1974 	error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1975 	if (error)
1976 		goto bad;
1977 
1978 	unp = sotounpcb(so);
1979 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1980 
1981 	vplock = mtx_pool_find(unp_vp_mtxpool, vp);
1982 	mtx_lock(vplock);
1983 	VOP_UNP_CONNECT(vp, &unp2);
1984 	if (unp2 == NULL) {
1985 		error = ECONNREFUSED;
1986 		goto bad2;
1987 	}
1988 	so2 = unp2->unp_socket;
1989 	if (so->so_type != so2->so_type) {
1990 		error = EPROTOTYPE;
1991 		goto bad2;
1992 	}
1993 	if (connreq) {
1994 		if (SOLISTENING(so2)) {
1995 			CURVNET_SET(so2->so_vnet);
1996 			so2 = sonewconn(so2, 0);
1997 			CURVNET_RESTORE();
1998 		} else
1999 			so2 = NULL;
2000 		if (so2 == NULL) {
2001 			error = ECONNREFUSED;
2002 			goto bad2;
2003 		}
2004 		unp3 = sotounpcb(so2);
2005 		unp_pcb_lock_pair(unp2, unp3);
2006 		if (unp2->unp_addr != NULL) {
2007 			bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
2008 			unp3->unp_addr = (struct sockaddr_un *) sa;
2009 			sa = NULL;
2010 		}
2011 
2012 		unp_copy_peercred(td, unp3, unp, unp2);
2013 
2014 		UNP_PCB_UNLOCK(unp2);
2015 		unp2 = unp3;
2016 
2017 		/*
2018 		 * It is safe to block on the PCB lock here since unp2 is
2019 		 * nascent and cannot be connected to any other sockets.
2020 		 */
2021 		UNP_PCB_LOCK(unp);
2022 #ifdef MAC
2023 		mac_socketpeer_set_from_socket(so, so2);
2024 		mac_socketpeer_set_from_socket(so2, so);
2025 #endif
2026 	} else {
2027 		unp_pcb_lock_pair(unp, unp2);
2028 	}
2029 	KASSERT(unp2 != NULL && so2 != NULL && unp2->unp_socket == so2 &&
2030 	    sotounpcb(so2) == unp2,
2031 	    ("%s: unp2 %p so2 %p", __func__, unp2, so2));
2032 	unp_connect2(so, so2);
2033 	KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
2034 	    ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
2035 	unp->unp_flags &= ~UNP_CONNECTING;
2036 	if (!return_locked)
2037 		unp_pcb_unlock_pair(unp, unp2);
2038 bad2:
2039 	mtx_unlock(vplock);
2040 bad:
2041 	if (vp != NULL) {
2042 		/*
2043 		 * If we are returning locked (called via uipc_sosend_dgram()),
2044 		 * we need to be sure that vput() won't sleep.  This is
2045 		 * guaranteed by VOP_UNP_CONNECT() call above and unp2 lock.
2046 		 * SOCK_STREAM/SEQPACKET can't request return_locked (yet).
2047 		 */
2048 		MPASS(!(return_locked && connreq));
2049 		vput(vp);
2050 	}
2051 	free(sa, M_SONAME);
2052 	if (__predict_false(error)) {
2053 		UNP_PCB_LOCK(unp);
2054 		KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
2055 		    ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
2056 		unp->unp_flags &= ~UNP_CONNECTING;
2057 		UNP_PCB_UNLOCK(unp);
2058 	}
2059 	return (error);
2060 }
2061 
2062 /*
2063  * Set socket peer credentials at connection time.
2064  *
2065  * The client's PCB credentials are copied from its process structure.  The
2066  * server's PCB credentials are copied from the socket on which it called
2067  * listen(2).  uipc_listen cached that process's credentials at the time.
2068  */
2069 void
unp_copy_peercred(struct thread * td,struct unpcb * client_unp,struct unpcb * server_unp,struct unpcb * listen_unp)2070 unp_copy_peercred(struct thread *td, struct unpcb *client_unp,
2071     struct unpcb *server_unp, struct unpcb *listen_unp)
2072 {
2073 	cru2xt(td, &client_unp->unp_peercred);
2074 	client_unp->unp_flags |= UNP_HAVEPC;
2075 
2076 	memcpy(&server_unp->unp_peercred, &listen_unp->unp_peercred,
2077 	    sizeof(server_unp->unp_peercred));
2078 	server_unp->unp_flags |= UNP_HAVEPC;
2079 	client_unp->unp_flags |= (listen_unp->unp_flags & UNP_WANTCRED_MASK);
2080 }
2081 
2082 static void
unp_connect2(struct socket * so,struct socket * so2)2083 unp_connect2(struct socket *so, struct socket *so2)
2084 {
2085 	struct unpcb *unp;
2086 	struct unpcb *unp2;
2087 
2088 	MPASS(so2->so_type == so->so_type);
2089 	unp = sotounpcb(so);
2090 	KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
2091 	unp2 = sotounpcb(so2);
2092 	KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
2093 
2094 	UNP_PCB_LOCK_ASSERT(unp);
2095 	UNP_PCB_LOCK_ASSERT(unp2);
2096 	KASSERT(unp->unp_conn == NULL,
2097 	    ("%s: socket %p is already connected", __func__, unp));
2098 
2099 	unp->unp_conn = unp2;
2100 	unp_pcb_hold(unp2);
2101 	unp_pcb_hold(unp);
2102 	switch (so->so_type) {
2103 	case SOCK_DGRAM:
2104 		UNP_REF_LIST_LOCK();
2105 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
2106 		UNP_REF_LIST_UNLOCK();
2107 		soisconnected(so);
2108 		break;
2109 
2110 	case SOCK_STREAM:
2111 	case SOCK_SEQPACKET:
2112 		KASSERT(unp2->unp_conn == NULL,
2113 		    ("%s: socket %p is already connected", __func__, unp2));
2114 		unp2->unp_conn = unp;
2115 		soisconnected(so);
2116 		soisconnected(so2);
2117 		break;
2118 
2119 	default:
2120 		panic("unp_connect2");
2121 	}
2122 }
2123 
2124 static void
unp_disconnect(struct unpcb * unp,struct unpcb * unp2)2125 unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
2126 {
2127 	struct socket *so, *so2;
2128 	struct mbuf *m = NULL;
2129 #ifdef INVARIANTS
2130 	struct unpcb *unptmp;
2131 #endif
2132 
2133 	UNP_PCB_LOCK_ASSERT(unp);
2134 	UNP_PCB_LOCK_ASSERT(unp2);
2135 	KASSERT(unp->unp_conn == unp2,
2136 	    ("%s: unpcb %p is not connected to %p", __func__, unp, unp2));
2137 
2138 	unp->unp_conn = NULL;
2139 	so = unp->unp_socket;
2140 	so2 = unp2->unp_socket;
2141 	switch (unp->unp_socket->so_type) {
2142 	case SOCK_DGRAM:
2143 		/*
2144 		 * Remove our send socket buffer from the peer's receive buffer.
2145 		 * Move the data to the receive buffer only if it is empty.
2146 		 * This is a protection against a scenario where a peer
2147 		 * connects, floods and disconnects, effectively blocking
2148 		 * sendto() from unconnected sockets.
2149 		 */
2150 		SOCK_RECVBUF_LOCK(so2);
2151 		if (!STAILQ_EMPTY(&so->so_snd.uxdg_mb)) {
2152 			TAILQ_REMOVE(&so2->so_rcv.uxdg_conns, &so->so_snd,
2153 			    uxdg_clist);
2154 			if (__predict_true((so2->so_rcv.sb_state &
2155 			    SBS_CANTRCVMORE) == 0) &&
2156 			    STAILQ_EMPTY(&so2->so_rcv.uxdg_mb)) {
2157 				STAILQ_CONCAT(&so2->so_rcv.uxdg_mb,
2158 				    &so->so_snd.uxdg_mb);
2159 				so2->so_rcv.uxdg_cc += so->so_snd.uxdg_cc;
2160 				so2->so_rcv.uxdg_ctl += so->so_snd.uxdg_ctl;
2161 				so2->so_rcv.uxdg_mbcnt += so->so_snd.uxdg_mbcnt;
2162 			} else {
2163 				m = STAILQ_FIRST(&so->so_snd.uxdg_mb);
2164 				STAILQ_INIT(&so->so_snd.uxdg_mb);
2165 				so2->so_rcv.sb_acc -= so->so_snd.uxdg_cc;
2166 				so2->so_rcv.sb_ccc -= so->so_snd.uxdg_cc;
2167 				so2->so_rcv.sb_ctl -= so->so_snd.uxdg_ctl;
2168 				so2->so_rcv.sb_mbcnt -= so->so_snd.uxdg_mbcnt;
2169 			}
2170 			/* Note: so may reconnect. */
2171 			so->so_snd.uxdg_cc = 0;
2172 			so->so_snd.uxdg_ctl = 0;
2173 			so->so_snd.uxdg_mbcnt = 0;
2174 		}
2175 		SOCK_RECVBUF_UNLOCK(so2);
2176 		UNP_REF_LIST_LOCK();
2177 #ifdef INVARIANTS
2178 		LIST_FOREACH(unptmp, &unp2->unp_refs, unp_reflink) {
2179 			if (unptmp == unp)
2180 				break;
2181 		}
2182 		KASSERT(unptmp != NULL,
2183 		    ("%s: %p not found in reflist of %p", __func__, unp, unp2));
2184 #endif
2185 		LIST_REMOVE(unp, unp_reflink);
2186 		UNP_REF_LIST_UNLOCK();
2187 		if (so) {
2188 			SOCK_LOCK(so);
2189 			so->so_state &= ~SS_ISCONNECTED;
2190 			SOCK_UNLOCK(so);
2191 		}
2192 		break;
2193 
2194 	case SOCK_STREAM:
2195 	case SOCK_SEQPACKET:
2196 		if (so)
2197 			soisdisconnected(so);
2198 		MPASS(unp2->unp_conn == unp);
2199 		unp2->unp_conn = NULL;
2200 		if (so2)
2201 			soisdisconnected(so2);
2202 		break;
2203 	}
2204 
2205 	if (unp == unp2) {
2206 		unp_pcb_rele_notlast(unp);
2207 		if (!unp_pcb_rele(unp))
2208 			UNP_PCB_UNLOCK(unp);
2209 	} else {
2210 		if (!unp_pcb_rele(unp))
2211 			UNP_PCB_UNLOCK(unp);
2212 		if (!unp_pcb_rele(unp2))
2213 			UNP_PCB_UNLOCK(unp2);
2214 	}
2215 
2216 	if (m != NULL) {
2217 		unp_scan(m, unp_freerights);
2218 		m_freemp(m);
2219 	}
2220 }
2221 
2222 /*
2223  * unp_pcblist() walks the global list of struct unpcb's to generate a
2224  * pointer list, bumping the refcount on each unpcb.  It then copies them out
2225  * sequentially, validating the generation number on each to see if it has
2226  * been detached.  All of this is necessary because copyout() may sleep on
2227  * disk I/O.
2228  */
2229 static int
unp_pcblist(SYSCTL_HANDLER_ARGS)2230 unp_pcblist(SYSCTL_HANDLER_ARGS)
2231 {
2232 	struct unpcb *unp, **unp_list;
2233 	unp_gen_t gencnt;
2234 	struct xunpgen *xug;
2235 	struct unp_head *head;
2236 	struct xunpcb *xu;
2237 	u_int i;
2238 	int error, n;
2239 
2240 	switch ((intptr_t)arg1) {
2241 	case SOCK_STREAM:
2242 		head = &unp_shead;
2243 		break;
2244 
2245 	case SOCK_DGRAM:
2246 		head = &unp_dhead;
2247 		break;
2248 
2249 	case SOCK_SEQPACKET:
2250 		head = &unp_sphead;
2251 		break;
2252 
2253 	default:
2254 		panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
2255 	}
2256 
2257 	/*
2258 	 * The process of preparing the PCB list is too time-consuming and
2259 	 * resource-intensive to repeat twice on every request.
2260 	 */
2261 	if (req->oldptr == NULL) {
2262 		n = unp_count;
2263 		req->oldidx = 2 * (sizeof *xug)
2264 			+ (n + n/8) * sizeof(struct xunpcb);
2265 		return (0);
2266 	}
2267 
2268 	if (req->newptr != NULL)
2269 		return (EPERM);
2270 
2271 	/*
2272 	 * OK, now we're committed to doing something.
2273 	 */
2274 	xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK | M_ZERO);
2275 	UNP_LINK_RLOCK();
2276 	gencnt = unp_gencnt;
2277 	n = unp_count;
2278 	UNP_LINK_RUNLOCK();
2279 
2280 	xug->xug_len = sizeof *xug;
2281 	xug->xug_count = n;
2282 	xug->xug_gen = gencnt;
2283 	xug->xug_sogen = so_gencnt;
2284 	error = SYSCTL_OUT(req, xug, sizeof *xug);
2285 	if (error) {
2286 		free(xug, M_TEMP);
2287 		return (error);
2288 	}
2289 
2290 	unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
2291 
2292 	UNP_LINK_RLOCK();
2293 	for (unp = LIST_FIRST(head), i = 0; unp && i < n;
2294 	     unp = LIST_NEXT(unp, unp_link)) {
2295 		UNP_PCB_LOCK(unp);
2296 		if (unp->unp_gencnt <= gencnt) {
2297 			if (cr_cansee(req->td->td_ucred,
2298 			    unp->unp_socket->so_cred)) {
2299 				UNP_PCB_UNLOCK(unp);
2300 				continue;
2301 			}
2302 			unp_list[i++] = unp;
2303 			unp_pcb_hold(unp);
2304 		}
2305 		UNP_PCB_UNLOCK(unp);
2306 	}
2307 	UNP_LINK_RUNLOCK();
2308 	n = i;			/* In case we lost some during malloc. */
2309 
2310 	error = 0;
2311 	xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
2312 	for (i = 0; i < n; i++) {
2313 		unp = unp_list[i];
2314 		UNP_PCB_LOCK(unp);
2315 		if (unp_pcb_rele(unp))
2316 			continue;
2317 
2318 		if (unp->unp_gencnt <= gencnt) {
2319 			xu->xu_len = sizeof *xu;
2320 			xu->xu_unpp = (uintptr_t)unp;
2321 			/*
2322 			 * XXX - need more locking here to protect against
2323 			 * connect/disconnect races for SMP.
2324 			 */
2325 			if (unp->unp_addr != NULL)
2326 				bcopy(unp->unp_addr, &xu->xu_addr,
2327 				      unp->unp_addr->sun_len);
2328 			else
2329 				bzero(&xu->xu_addr, sizeof(xu->xu_addr));
2330 			if (unp->unp_conn != NULL &&
2331 			    unp->unp_conn->unp_addr != NULL)
2332 				bcopy(unp->unp_conn->unp_addr,
2333 				      &xu->xu_caddr,
2334 				      unp->unp_conn->unp_addr->sun_len);
2335 			else
2336 				bzero(&xu->xu_caddr, sizeof(xu->xu_caddr));
2337 			xu->unp_vnode = (uintptr_t)unp->unp_vnode;
2338 			xu->unp_conn = (uintptr_t)unp->unp_conn;
2339 			xu->xu_firstref = (uintptr_t)LIST_FIRST(&unp->unp_refs);
2340 			xu->xu_nextref = (uintptr_t)LIST_NEXT(unp, unp_reflink);
2341 			xu->unp_gencnt = unp->unp_gencnt;
2342 			sotoxsocket(unp->unp_socket, &xu->xu_socket);
2343 			UNP_PCB_UNLOCK(unp);
2344 			error = SYSCTL_OUT(req, xu, sizeof *xu);
2345 		} else {
2346 			UNP_PCB_UNLOCK(unp);
2347 		}
2348 	}
2349 	free(xu, M_TEMP);
2350 	if (!error) {
2351 		/*
2352 		 * Give the user an updated idea of our state.  If the
2353 		 * generation differs from what we told her before, she knows
2354 		 * that something happened while we were processing this
2355 		 * request, and it might be necessary to retry.
2356 		 */
2357 		xug->xug_gen = unp_gencnt;
2358 		xug->xug_sogen = so_gencnt;
2359 		xug->xug_count = unp_count;
2360 		error = SYSCTL_OUT(req, xug, sizeof *xug);
2361 	}
2362 	free(unp_list, M_TEMP);
2363 	free(xug, M_TEMP);
2364 	return (error);
2365 }
2366 
2367 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist,
2368     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
2369     (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
2370     "List of active local datagram sockets");
2371 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist,
2372     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
2373     (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
2374     "List of active local stream sockets");
2375 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
2376     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
2377     (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
2378     "List of active local seqpacket sockets");
2379 
2380 static void
unp_shutdown(struct unpcb * unp)2381 unp_shutdown(struct unpcb *unp)
2382 {
2383 	struct unpcb *unp2;
2384 	struct socket *so;
2385 
2386 	UNP_PCB_LOCK_ASSERT(unp);
2387 
2388 	unp2 = unp->unp_conn;
2389 	if ((unp->unp_socket->so_type == SOCK_STREAM ||
2390 	    (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
2391 		so = unp2->unp_socket;
2392 		if (so != NULL)
2393 			socantrcvmore(so);
2394 	}
2395 }
2396 
2397 static void
unp_drop(struct unpcb * unp)2398 unp_drop(struct unpcb *unp)
2399 {
2400 	struct socket *so;
2401 	struct unpcb *unp2;
2402 
2403 	/*
2404 	 * Regardless of whether the socket's peer dropped the connection
2405 	 * with this socket by aborting or disconnecting, POSIX requires
2406 	 * that ECONNRESET is returned.
2407 	 */
2408 
2409 	UNP_PCB_LOCK(unp);
2410 	so = unp->unp_socket;
2411 	if (so)
2412 		so->so_error = ECONNRESET;
2413 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
2414 		/* Last reference dropped in unp_disconnect(). */
2415 		unp_pcb_rele_notlast(unp);
2416 		unp_disconnect(unp, unp2);
2417 	} else if (!unp_pcb_rele(unp)) {
2418 		UNP_PCB_UNLOCK(unp);
2419 	}
2420 }
2421 
2422 static void
unp_freerights(struct filedescent ** fdep,int fdcount)2423 unp_freerights(struct filedescent **fdep, int fdcount)
2424 {
2425 	struct file *fp;
2426 	int i;
2427 
2428 	KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount));
2429 
2430 	for (i = 0; i < fdcount; i++) {
2431 		fp = fdep[i]->fde_file;
2432 		filecaps_free(&fdep[i]->fde_caps);
2433 		unp_discard(fp);
2434 	}
2435 	free(fdep[0], M_FILECAPS);
2436 }
2437 
2438 static int
unp_externalize(struct mbuf * control,struct mbuf ** controlp,int flags)2439 unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
2440 {
2441 	struct thread *td = curthread;		/* XXX */
2442 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
2443 	int i;
2444 	int *fdp;
2445 	struct filedesc *fdesc = td->td_proc->p_fd;
2446 	struct filedescent **fdep;
2447 	void *data;
2448 	socklen_t clen = control->m_len, datalen;
2449 	int error, newfds;
2450 	u_int newlen;
2451 
2452 	UNP_LINK_UNLOCK_ASSERT();
2453 
2454 	error = 0;
2455 	if (controlp != NULL) /* controlp == NULL => free control messages */
2456 		*controlp = NULL;
2457 	while (cm != NULL) {
2458 		MPASS(clen >= sizeof(*cm) && clen >= cm->cmsg_len);
2459 
2460 		data = CMSG_DATA(cm);
2461 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
2462 		if (cm->cmsg_level == SOL_SOCKET
2463 		    && cm->cmsg_type == SCM_RIGHTS) {
2464 			newfds = datalen / sizeof(*fdep);
2465 			if (newfds == 0)
2466 				goto next;
2467 			fdep = data;
2468 
2469 			/* If we're not outputting the descriptors free them. */
2470 			if (error || controlp == NULL) {
2471 				unp_freerights(fdep, newfds);
2472 				goto next;
2473 			}
2474 			FILEDESC_XLOCK(fdesc);
2475 
2476 			/*
2477 			 * Now change each pointer to an fd in the global
2478 			 * table to an integer that is the index to the local
2479 			 * fd table entry that we set up to point to the
2480 			 * global one we are transferring.
2481 			 */
2482 			newlen = newfds * sizeof(int);
2483 			*controlp = sbcreatecontrol(NULL, newlen,
2484 			    SCM_RIGHTS, SOL_SOCKET, M_WAITOK);
2485 
2486 			fdp = (int *)
2487 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2488 			if ((error = fdallocn(td, 0, fdp, newfds))) {
2489 				FILEDESC_XUNLOCK(fdesc);
2490 				unp_freerights(fdep, newfds);
2491 				m_freem(*controlp);
2492 				*controlp = NULL;
2493 				goto next;
2494 			}
2495 			for (i = 0; i < newfds; i++, fdp++) {
2496 				_finstall(fdesc, fdep[i]->fde_file, *fdp,
2497 				    (flags & MSG_CMSG_CLOEXEC) != 0 ? O_CLOEXEC : 0,
2498 				    &fdep[i]->fde_caps);
2499 				unp_externalize_fp(fdep[i]->fde_file);
2500 			}
2501 
2502 			/*
2503 			 * The new type indicates that the mbuf data refers to
2504 			 * kernel resources that may need to be released before
2505 			 * the mbuf is freed.
2506 			 */
2507 			m_chtype(*controlp, MT_EXTCONTROL);
2508 			FILEDESC_XUNLOCK(fdesc);
2509 			free(fdep[0], M_FILECAPS);
2510 		} else {
2511 			/* We can just copy anything else across. */
2512 			if (error || controlp == NULL)
2513 				goto next;
2514 			*controlp = sbcreatecontrol(NULL, datalen,
2515 			    cm->cmsg_type, cm->cmsg_level, M_WAITOK);
2516 			bcopy(data,
2517 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
2518 			    datalen);
2519 		}
2520 		controlp = &(*controlp)->m_next;
2521 
2522 next:
2523 		if (CMSG_SPACE(datalen) < clen) {
2524 			clen -= CMSG_SPACE(datalen);
2525 			cm = (struct cmsghdr *)
2526 			    ((caddr_t)cm + CMSG_SPACE(datalen));
2527 		} else {
2528 			clen = 0;
2529 			cm = NULL;
2530 		}
2531 	}
2532 
2533 	m_freem(control);
2534 	return (error);
2535 }
2536 
2537 static void
unp_zone_change(void * tag)2538 unp_zone_change(void *tag)
2539 {
2540 
2541 	uma_zone_set_max(unp_zone, maxsockets);
2542 }
2543 
2544 #ifdef INVARIANTS
2545 static void
unp_zdtor(void * mem,int size __unused,void * arg __unused)2546 unp_zdtor(void *mem, int size __unused, void *arg __unused)
2547 {
2548 	struct unpcb *unp;
2549 
2550 	unp = mem;
2551 
2552 	KASSERT(LIST_EMPTY(&unp->unp_refs),
2553 	    ("%s: unpcb %p has lingering refs", __func__, unp));
2554 	KASSERT(unp->unp_socket == NULL,
2555 	    ("%s: unpcb %p has socket backpointer", __func__, unp));
2556 	KASSERT(unp->unp_vnode == NULL,
2557 	    ("%s: unpcb %p has vnode references", __func__, unp));
2558 	KASSERT(unp->unp_conn == NULL,
2559 	    ("%s: unpcb %p is still connected", __func__, unp));
2560 	KASSERT(unp->unp_addr == NULL,
2561 	    ("%s: unpcb %p has leaked addr", __func__, unp));
2562 }
2563 #endif
2564 
2565 static void
unp_init(void * arg __unused)2566 unp_init(void *arg __unused)
2567 {
2568 	uma_dtor dtor;
2569 
2570 #ifdef INVARIANTS
2571 	dtor = unp_zdtor;
2572 #else
2573 	dtor = NULL;
2574 #endif
2575 	unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, dtor,
2576 	    NULL, NULL, UMA_ALIGN_CACHE, 0);
2577 	uma_zone_set_max(unp_zone, maxsockets);
2578 	uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached");
2579 	EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
2580 	    NULL, EVENTHANDLER_PRI_ANY);
2581 	LIST_INIT(&unp_dhead);
2582 	LIST_INIT(&unp_shead);
2583 	LIST_INIT(&unp_sphead);
2584 	SLIST_INIT(&unp_defers);
2585 	TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
2586 	TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
2587 	UNP_LINK_LOCK_INIT();
2588 	UNP_DEFERRED_LOCK_INIT();
2589 	unp_vp_mtxpool = mtx_pool_create("unp vp mtxpool", 32, MTX_DEF);
2590 }
2591 SYSINIT(unp_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, unp_init, NULL);
2592 
2593 static void
unp_internalize_cleanup_rights(struct mbuf * control)2594 unp_internalize_cleanup_rights(struct mbuf *control)
2595 {
2596 	struct cmsghdr *cp;
2597 	struct mbuf *m;
2598 	void *data;
2599 	socklen_t datalen;
2600 
2601 	for (m = control; m != NULL; m = m->m_next) {
2602 		cp = mtod(m, struct cmsghdr *);
2603 		if (cp->cmsg_level != SOL_SOCKET ||
2604 		    cp->cmsg_type != SCM_RIGHTS)
2605 			continue;
2606 		data = CMSG_DATA(cp);
2607 		datalen = (caddr_t)cp + cp->cmsg_len - (caddr_t)data;
2608 		unp_freerights(data, datalen / sizeof(struct filedesc *));
2609 	}
2610 }
2611 
2612 static int
unp_internalize(struct mbuf ** controlp,struct thread * td,struct mbuf ** clast,u_int * space,u_int * mbcnt)2613 unp_internalize(struct mbuf **controlp, struct thread *td,
2614     struct mbuf **clast, u_int *space, u_int *mbcnt)
2615 {
2616 	struct mbuf *control, **initial_controlp;
2617 	struct proc *p;
2618 	struct filedesc *fdesc;
2619 	struct bintime *bt;
2620 	struct cmsghdr *cm;
2621 	struct cmsgcred *cmcred;
2622 	struct filedescent *fde, **fdep, *fdev;
2623 	struct file *fp;
2624 	struct timeval *tv;
2625 	struct timespec *ts;
2626 	void *data;
2627 	socklen_t clen, datalen;
2628 	int i, j, error, *fdp, oldfds;
2629 	u_int newlen;
2630 
2631 	MPASS((*controlp)->m_next == NULL); /* COMPAT_OLDSOCK may violate */
2632 	UNP_LINK_UNLOCK_ASSERT();
2633 
2634 	p = td->td_proc;
2635 	fdesc = p->p_fd;
2636 	error = 0;
2637 	control = *controlp;
2638 	*controlp = NULL;
2639 	initial_controlp = controlp;
2640 	for (clen = control->m_len, cm = mtod(control, struct cmsghdr *),
2641 	    data = CMSG_DATA(cm);
2642 
2643 	    clen >= sizeof(*cm) && cm->cmsg_level == SOL_SOCKET &&
2644 	    clen >= cm->cmsg_len && cm->cmsg_len >= sizeof(*cm) &&
2645 	    (char *)cm + cm->cmsg_len >= (char *)data;
2646 
2647 	    clen -= min(CMSG_SPACE(datalen), clen),
2648 	    cm = (struct cmsghdr *) ((char *)cm + CMSG_SPACE(datalen)),
2649 	    data = CMSG_DATA(cm)) {
2650 		datalen = (char *)cm + cm->cmsg_len - (char *)data;
2651 		switch (cm->cmsg_type) {
2652 		case SCM_CREDS:
2653 			*controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
2654 			    SCM_CREDS, SOL_SOCKET, M_WAITOK);
2655 			cmcred = (struct cmsgcred *)
2656 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2657 			cmcred->cmcred_pid = p->p_pid;
2658 			cmcred->cmcred_uid = td->td_ucred->cr_ruid;
2659 			cmcred->cmcred_gid = td->td_ucred->cr_rgid;
2660 			cmcred->cmcred_euid = td->td_ucred->cr_uid;
2661 			cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
2662 			    CMGROUP_MAX);
2663 			for (i = 0; i < cmcred->cmcred_ngroups; i++)
2664 				cmcred->cmcred_groups[i] =
2665 				    td->td_ucred->cr_groups[i];
2666 			break;
2667 
2668 		case SCM_RIGHTS:
2669 			oldfds = datalen / sizeof (int);
2670 			if (oldfds == 0)
2671 				continue;
2672 			/* On some machines sizeof pointer is bigger than
2673 			 * sizeof int, so we need to check if data fits into
2674 			 * single mbuf.  We could allocate several mbufs, and
2675 			 * unp_externalize() should even properly handle that.
2676 			 * But it is not worth to complicate the code for an
2677 			 * insane scenario of passing over 200 file descriptors
2678 			 * at once.
2679 			 */
2680 			newlen = oldfds * sizeof(fdep[0]);
2681 			if (CMSG_SPACE(newlen) > MCLBYTES) {
2682 				error = EMSGSIZE;
2683 				goto out;
2684 			}
2685 			/*
2686 			 * Check that all the FDs passed in refer to legal
2687 			 * files.  If not, reject the entire operation.
2688 			 */
2689 			fdp = data;
2690 			FILEDESC_SLOCK(fdesc);
2691 			for (i = 0; i < oldfds; i++, fdp++) {
2692 				fp = fget_noref(fdesc, *fdp);
2693 				if (fp == NULL) {
2694 					FILEDESC_SUNLOCK(fdesc);
2695 					error = EBADF;
2696 					goto out;
2697 				}
2698 				if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
2699 					FILEDESC_SUNLOCK(fdesc);
2700 					error = EOPNOTSUPP;
2701 					goto out;
2702 				}
2703 			}
2704 
2705 			/*
2706 			 * Now replace the integer FDs with pointers to the
2707 			 * file structure and capability rights.
2708 			 */
2709 			*controlp = sbcreatecontrol(NULL, newlen,
2710 			    SCM_RIGHTS, SOL_SOCKET, M_WAITOK);
2711 			fdp = data;
2712 			for (i = 0; i < oldfds; i++, fdp++) {
2713 				if (!fhold(fdesc->fd_ofiles[*fdp].fde_file)) {
2714 					fdp = data;
2715 					for (j = 0; j < i; j++, fdp++) {
2716 						fdrop(fdesc->fd_ofiles[*fdp].
2717 						    fde_file, td);
2718 					}
2719 					FILEDESC_SUNLOCK(fdesc);
2720 					error = EBADF;
2721 					goto out;
2722 				}
2723 			}
2724 			fdp = data;
2725 			fdep = (struct filedescent **)
2726 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2727 			fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS,
2728 			    M_WAITOK);
2729 			for (i = 0; i < oldfds; i++, fdev++, fdp++) {
2730 				fde = &fdesc->fd_ofiles[*fdp];
2731 				fdep[i] = fdev;
2732 				fdep[i]->fde_file = fde->fde_file;
2733 				filecaps_copy(&fde->fde_caps,
2734 				    &fdep[i]->fde_caps, true);
2735 				unp_internalize_fp(fdep[i]->fde_file);
2736 			}
2737 			FILEDESC_SUNLOCK(fdesc);
2738 			break;
2739 
2740 		case SCM_TIMESTAMP:
2741 			*controlp = sbcreatecontrol(NULL, sizeof(*tv),
2742 			    SCM_TIMESTAMP, SOL_SOCKET, M_WAITOK);
2743 			tv = (struct timeval *)
2744 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2745 			microtime(tv);
2746 			break;
2747 
2748 		case SCM_BINTIME:
2749 			*controlp = sbcreatecontrol(NULL, sizeof(*bt),
2750 			    SCM_BINTIME, SOL_SOCKET, M_WAITOK);
2751 			bt = (struct bintime *)
2752 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2753 			bintime(bt);
2754 			break;
2755 
2756 		case SCM_REALTIME:
2757 			*controlp = sbcreatecontrol(NULL, sizeof(*ts),
2758 			    SCM_REALTIME, SOL_SOCKET, M_WAITOK);
2759 			ts = (struct timespec *)
2760 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2761 			nanotime(ts);
2762 			break;
2763 
2764 		case SCM_MONOTONIC:
2765 			*controlp = sbcreatecontrol(NULL, sizeof(*ts),
2766 			    SCM_MONOTONIC, SOL_SOCKET, M_WAITOK);
2767 			ts = (struct timespec *)
2768 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2769 			nanouptime(ts);
2770 			break;
2771 
2772 		default:
2773 			error = EINVAL;
2774 			goto out;
2775 		}
2776 
2777 		if (space != NULL) {
2778 			*space += (*controlp)->m_len;
2779 			*mbcnt += MSIZE;
2780 			if ((*controlp)->m_flags & M_EXT)
2781 				*mbcnt += (*controlp)->m_ext.ext_size;
2782 			*clast = *controlp;
2783 		}
2784 		controlp = &(*controlp)->m_next;
2785 	}
2786 	if (clen > 0)
2787 		error = EINVAL;
2788 
2789 out:
2790 	if (error != 0 && initial_controlp != NULL)
2791 		unp_internalize_cleanup_rights(*initial_controlp);
2792 	m_freem(control);
2793 	return (error);
2794 }
2795 
2796 static struct mbuf *
unp_addsockcred(struct thread * td,struct mbuf * control,int mode,struct mbuf ** clast,u_int * space,u_int * mbcnt)2797 unp_addsockcred(struct thread *td, struct mbuf *control, int mode,
2798     struct mbuf **clast, u_int *space, u_int *mbcnt)
2799 {
2800 	struct mbuf *m, *n, *n_prev;
2801 	const struct cmsghdr *cm;
2802 	int ngroups, i, cmsgtype;
2803 	size_t ctrlsz;
2804 
2805 	ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
2806 	if (mode & UNP_WANTCRED_ALWAYS) {
2807 		ctrlsz = SOCKCRED2SIZE(ngroups);
2808 		cmsgtype = SCM_CREDS2;
2809 	} else {
2810 		ctrlsz = SOCKCREDSIZE(ngroups);
2811 		cmsgtype = SCM_CREDS;
2812 	}
2813 
2814 	m = sbcreatecontrol(NULL, ctrlsz, cmsgtype, SOL_SOCKET, M_NOWAIT);
2815 	if (m == NULL)
2816 		return (control);
2817 	MPASS((m->m_flags & M_EXT) == 0 && m->m_next == NULL);
2818 
2819 	if (mode & UNP_WANTCRED_ALWAYS) {
2820 		struct sockcred2 *sc;
2821 
2822 		sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2823 		sc->sc_version = 0;
2824 		sc->sc_pid = td->td_proc->p_pid;
2825 		sc->sc_uid = td->td_ucred->cr_ruid;
2826 		sc->sc_euid = td->td_ucred->cr_uid;
2827 		sc->sc_gid = td->td_ucred->cr_rgid;
2828 		sc->sc_egid = td->td_ucred->cr_gid;
2829 		sc->sc_ngroups = ngroups;
2830 		for (i = 0; i < sc->sc_ngroups; i++)
2831 			sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2832 	} else {
2833 		struct sockcred *sc;
2834 
2835 		sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2836 		sc->sc_uid = td->td_ucred->cr_ruid;
2837 		sc->sc_euid = td->td_ucred->cr_uid;
2838 		sc->sc_gid = td->td_ucred->cr_rgid;
2839 		sc->sc_egid = td->td_ucred->cr_gid;
2840 		sc->sc_ngroups = ngroups;
2841 		for (i = 0; i < sc->sc_ngroups; i++)
2842 			sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2843 	}
2844 
2845 	/*
2846 	 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
2847 	 * created SCM_CREDS control message (struct sockcred) has another
2848 	 * format.
2849 	 */
2850 	if (control != NULL && cmsgtype == SCM_CREDS)
2851 		for (n = control, n_prev = NULL; n != NULL;) {
2852 			cm = mtod(n, struct cmsghdr *);
2853     			if (cm->cmsg_level == SOL_SOCKET &&
2854 			    cm->cmsg_type == SCM_CREDS) {
2855     				if (n_prev == NULL)
2856 					control = n->m_next;
2857 				else
2858 					n_prev->m_next = n->m_next;
2859 				if (space != NULL) {
2860 					MPASS(*space >= n->m_len);
2861 					*space -= n->m_len;
2862 					MPASS(*mbcnt >= MSIZE);
2863 					*mbcnt -= MSIZE;
2864 					if (n->m_flags & M_EXT) {
2865 						MPASS(*mbcnt >=
2866 						    n->m_ext.ext_size);
2867 						*mbcnt -= n->m_ext.ext_size;
2868 					}
2869 					MPASS(clast);
2870 					if (*clast == n) {
2871 						MPASS(n->m_next == NULL);
2872 						if (n_prev == NULL)
2873 							*clast = m;
2874 						else
2875 							*clast = n_prev;
2876 					}
2877 				}
2878 				n = m_free(n);
2879 			} else {
2880 				n_prev = n;
2881 				n = n->m_next;
2882 			}
2883 		}
2884 
2885 	/* Prepend it to the head. */
2886 	m->m_next = control;
2887 	if (space != NULL) {
2888 		*space += m->m_len;
2889 		*mbcnt += MSIZE;
2890 		if (control == NULL)
2891 			*clast = m;
2892 	}
2893 	return (m);
2894 }
2895 
2896 static struct unpcb *
fptounp(struct file * fp)2897 fptounp(struct file *fp)
2898 {
2899 	struct socket *so;
2900 
2901 	if (fp->f_type != DTYPE_SOCKET)
2902 		return (NULL);
2903 	if ((so = fp->f_data) == NULL)
2904 		return (NULL);
2905 	if (so->so_proto->pr_domain != &localdomain)
2906 		return (NULL);
2907 	return sotounpcb(so);
2908 }
2909 
2910 static void
unp_discard(struct file * fp)2911 unp_discard(struct file *fp)
2912 {
2913 	struct unp_defer *dr;
2914 
2915 	if (unp_externalize_fp(fp)) {
2916 		dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
2917 		dr->ud_fp = fp;
2918 		UNP_DEFERRED_LOCK();
2919 		SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
2920 		UNP_DEFERRED_UNLOCK();
2921 		atomic_add_int(&unp_defers_count, 1);
2922 		taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
2923 	} else
2924 		closef_nothread(fp);
2925 }
2926 
2927 static void
unp_process_defers(void * arg __unused,int pending)2928 unp_process_defers(void *arg __unused, int pending)
2929 {
2930 	struct unp_defer *dr;
2931 	SLIST_HEAD(, unp_defer) drl;
2932 	int count;
2933 
2934 	SLIST_INIT(&drl);
2935 	for (;;) {
2936 		UNP_DEFERRED_LOCK();
2937 		if (SLIST_FIRST(&unp_defers) == NULL) {
2938 			UNP_DEFERRED_UNLOCK();
2939 			break;
2940 		}
2941 		SLIST_SWAP(&unp_defers, &drl, unp_defer);
2942 		UNP_DEFERRED_UNLOCK();
2943 		count = 0;
2944 		while ((dr = SLIST_FIRST(&drl)) != NULL) {
2945 			SLIST_REMOVE_HEAD(&drl, ud_link);
2946 			closef_nothread(dr->ud_fp);
2947 			free(dr, M_TEMP);
2948 			count++;
2949 		}
2950 		atomic_add_int(&unp_defers_count, -count);
2951 	}
2952 }
2953 
2954 static void
unp_internalize_fp(struct file * fp)2955 unp_internalize_fp(struct file *fp)
2956 {
2957 	struct unpcb *unp;
2958 
2959 	UNP_LINK_WLOCK();
2960 	if ((unp = fptounp(fp)) != NULL) {
2961 		unp->unp_file = fp;
2962 		unp->unp_msgcount++;
2963 	}
2964 	unp_rights++;
2965 	UNP_LINK_WUNLOCK();
2966 }
2967 
2968 static int
unp_externalize_fp(struct file * fp)2969 unp_externalize_fp(struct file *fp)
2970 {
2971 	struct unpcb *unp;
2972 	int ret;
2973 
2974 	UNP_LINK_WLOCK();
2975 	if ((unp = fptounp(fp)) != NULL) {
2976 		unp->unp_msgcount--;
2977 		ret = 1;
2978 	} else
2979 		ret = 0;
2980 	unp_rights--;
2981 	UNP_LINK_WUNLOCK();
2982 	return (ret);
2983 }
2984 
2985 /*
2986  * unp_defer indicates whether additional work has been defered for a future
2987  * pass through unp_gc().  It is thread local and does not require explicit
2988  * synchronization.
2989  */
2990 static int	unp_marked;
2991 
2992 static void
unp_remove_dead_ref(struct filedescent ** fdep,int fdcount)2993 unp_remove_dead_ref(struct filedescent **fdep, int fdcount)
2994 {
2995 	struct unpcb *unp;
2996 	struct file *fp;
2997 	int i;
2998 
2999 	/*
3000 	 * This function can only be called from the gc task.
3001 	 */
3002 	KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
3003 	    ("%s: not on gc callout", __func__));
3004 	UNP_LINK_LOCK_ASSERT();
3005 
3006 	for (i = 0; i < fdcount; i++) {
3007 		fp = fdep[i]->fde_file;
3008 		if ((unp = fptounp(fp)) == NULL)
3009 			continue;
3010 		if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
3011 			continue;
3012 		unp->unp_gcrefs--;
3013 	}
3014 }
3015 
3016 static void
unp_restore_undead_ref(struct filedescent ** fdep,int fdcount)3017 unp_restore_undead_ref(struct filedescent **fdep, int fdcount)
3018 {
3019 	struct unpcb *unp;
3020 	struct file *fp;
3021 	int i;
3022 
3023 	/*
3024 	 * This function can only be called from the gc task.
3025 	 */
3026 	KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
3027 	    ("%s: not on gc callout", __func__));
3028 	UNP_LINK_LOCK_ASSERT();
3029 
3030 	for (i = 0; i < fdcount; i++) {
3031 		fp = fdep[i]->fde_file;
3032 		if ((unp = fptounp(fp)) == NULL)
3033 			continue;
3034 		if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
3035 			continue;
3036 		unp->unp_gcrefs++;
3037 		unp_marked++;
3038 	}
3039 }
3040 
3041 static void
unp_scan_socket(struct socket * so,void (* op)(struct filedescent **,int))3042 unp_scan_socket(struct socket *so, void (*op)(struct filedescent **, int))
3043 {
3044 	struct sockbuf *sb;
3045 
3046 	SOCK_LOCK_ASSERT(so);
3047 
3048 	if (sotounpcb(so)->unp_gcflag & UNPGC_IGNORE_RIGHTS)
3049 		return;
3050 
3051 	SOCK_RECVBUF_LOCK(so);
3052 	switch (so->so_type) {
3053 	case SOCK_DGRAM:
3054 		unp_scan(STAILQ_FIRST(&so->so_rcv.uxdg_mb), op);
3055 		unp_scan(so->so_rcv.uxdg_peeked, op);
3056 		TAILQ_FOREACH(sb, &so->so_rcv.uxdg_conns, uxdg_clist)
3057 			unp_scan(STAILQ_FIRST(&sb->uxdg_mb), op);
3058 		break;
3059 	case SOCK_STREAM:
3060 	case SOCK_SEQPACKET:
3061 		unp_scan(so->so_rcv.sb_mb, op);
3062 		break;
3063 	}
3064 	SOCK_RECVBUF_UNLOCK(so);
3065 }
3066 
3067 static void
unp_gc_scan(struct unpcb * unp,void (* op)(struct filedescent **,int))3068 unp_gc_scan(struct unpcb *unp, void (*op)(struct filedescent **, int))
3069 {
3070 	struct socket *so, *soa;
3071 
3072 	so = unp->unp_socket;
3073 	SOCK_LOCK(so);
3074 	if (SOLISTENING(so)) {
3075 		/*
3076 		 * Mark all sockets in our accept queue.
3077 		 */
3078 		TAILQ_FOREACH(soa, &so->sol_comp, so_list)
3079 			unp_scan_socket(soa, op);
3080 	} else {
3081 		/*
3082 		 * Mark all sockets we reference with RIGHTS.
3083 		 */
3084 		unp_scan_socket(so, op);
3085 	}
3086 	SOCK_UNLOCK(so);
3087 }
3088 
3089 static int unp_recycled;
3090 SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
3091     "Number of unreachable sockets claimed by the garbage collector.");
3092 
3093 static int unp_taskcount;
3094 SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
3095     "Number of times the garbage collector has run.");
3096 
3097 SYSCTL_UINT(_net_local, OID_AUTO, sockcount, CTLFLAG_RD, &unp_count, 0,
3098     "Number of active local sockets.");
3099 
3100 static void
unp_gc(__unused void * arg,int pending)3101 unp_gc(__unused void *arg, int pending)
3102 {
3103 	struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
3104 				    NULL };
3105 	struct unp_head **head;
3106 	struct unp_head unp_deadhead;	/* List of potentially-dead sockets. */
3107 	struct file *f, **unref;
3108 	struct unpcb *unp, *unptmp;
3109 	int i, total, unp_unreachable;
3110 
3111 	LIST_INIT(&unp_deadhead);
3112 	unp_taskcount++;
3113 	UNP_LINK_RLOCK();
3114 	/*
3115 	 * First determine which sockets may be in cycles.
3116 	 */
3117 	unp_unreachable = 0;
3118 
3119 	for (head = heads; *head != NULL; head++)
3120 		LIST_FOREACH(unp, *head, unp_link) {
3121 			KASSERT((unp->unp_gcflag & ~UNPGC_IGNORE_RIGHTS) == 0,
3122 			    ("%s: unp %p has unexpected gc flags 0x%x",
3123 			    __func__, unp, (unsigned int)unp->unp_gcflag));
3124 
3125 			f = unp->unp_file;
3126 
3127 			/*
3128 			 * Check for an unreachable socket potentially in a
3129 			 * cycle.  It must be in a queue as indicated by
3130 			 * msgcount, and this must equal the file reference
3131 			 * count.  Note that when msgcount is 0 the file is
3132 			 * NULL.
3133 			 */
3134 			if (f != NULL && unp->unp_msgcount != 0 &&
3135 			    refcount_load(&f->f_count) == unp->unp_msgcount) {
3136 				LIST_INSERT_HEAD(&unp_deadhead, unp, unp_dead);
3137 				unp->unp_gcflag |= UNPGC_DEAD;
3138 				unp->unp_gcrefs = unp->unp_msgcount;
3139 				unp_unreachable++;
3140 			}
3141 		}
3142 
3143 	/*
3144 	 * Scan all sockets previously marked as potentially being in a cycle
3145 	 * and remove the references each socket holds on any UNPGC_DEAD
3146 	 * sockets in its queue.  After this step, all remaining references on
3147 	 * sockets marked UNPGC_DEAD should not be part of any cycle.
3148 	 */
3149 	LIST_FOREACH(unp, &unp_deadhead, unp_dead)
3150 		unp_gc_scan(unp, unp_remove_dead_ref);
3151 
3152 	/*
3153 	 * If a socket still has a non-negative refcount, it cannot be in a
3154 	 * cycle.  In this case increment refcount of all children iteratively.
3155 	 * Stop the scan once we do a complete loop without discovering
3156 	 * a new reachable socket.
3157 	 */
3158 	do {
3159 		unp_marked = 0;
3160 		LIST_FOREACH_SAFE(unp, &unp_deadhead, unp_dead, unptmp)
3161 			if (unp->unp_gcrefs > 0) {
3162 				unp->unp_gcflag &= ~UNPGC_DEAD;
3163 				LIST_REMOVE(unp, unp_dead);
3164 				KASSERT(unp_unreachable > 0,
3165 				    ("%s: unp_unreachable underflow.",
3166 				    __func__));
3167 				unp_unreachable--;
3168 				unp_gc_scan(unp, unp_restore_undead_ref);
3169 			}
3170 	} while (unp_marked);
3171 
3172 	UNP_LINK_RUNLOCK();
3173 
3174 	if (unp_unreachable == 0)
3175 		return;
3176 
3177 	/*
3178 	 * Allocate space for a local array of dead unpcbs.
3179 	 * TODO: can this path be simplified by instead using the local
3180 	 * dead list at unp_deadhead, after taking out references
3181 	 * on the file object and/or unpcb and dropping the link lock?
3182 	 */
3183 	unref = malloc(unp_unreachable * sizeof(struct file *),
3184 	    M_TEMP, M_WAITOK);
3185 
3186 	/*
3187 	 * Iterate looking for sockets which have been specifically marked
3188 	 * as unreachable and store them locally.
3189 	 */
3190 	UNP_LINK_RLOCK();
3191 	total = 0;
3192 	LIST_FOREACH(unp, &unp_deadhead, unp_dead) {
3193 		KASSERT((unp->unp_gcflag & UNPGC_DEAD) != 0,
3194 		    ("%s: unp %p not marked UNPGC_DEAD", __func__, unp));
3195 		unp->unp_gcflag &= ~UNPGC_DEAD;
3196 		f = unp->unp_file;
3197 		if (unp->unp_msgcount == 0 || f == NULL ||
3198 		    refcount_load(&f->f_count) != unp->unp_msgcount ||
3199 		    !fhold(f))
3200 			continue;
3201 		unref[total++] = f;
3202 		KASSERT(total <= unp_unreachable,
3203 		    ("%s: incorrect unreachable count.", __func__));
3204 	}
3205 	UNP_LINK_RUNLOCK();
3206 
3207 	/*
3208 	 * Now flush all sockets, free'ing rights.  This will free the
3209 	 * struct files associated with these sockets but leave each socket
3210 	 * with one remaining ref.
3211 	 */
3212 	for (i = 0; i < total; i++) {
3213 		struct socket *so;
3214 
3215 		so = unref[i]->f_data;
3216 		CURVNET_SET(so->so_vnet);
3217 		socantrcvmore(so);
3218 		unp_dispose(so);
3219 		CURVNET_RESTORE();
3220 	}
3221 
3222 	/*
3223 	 * And finally release the sockets so they can be reclaimed.
3224 	 */
3225 	for (i = 0; i < total; i++)
3226 		fdrop(unref[i], NULL);
3227 	unp_recycled += total;
3228 	free(unref, M_TEMP);
3229 }
3230 
3231 /*
3232  * Synchronize against unp_gc, which can trip over data as we are freeing it.
3233  */
3234 static void
unp_dispose(struct socket * so)3235 unp_dispose(struct socket *so)
3236 {
3237 	struct sockbuf *sb;
3238 	struct unpcb *unp;
3239 	struct mbuf *m;
3240 	int error __diagused;
3241 
3242 	MPASS(!SOLISTENING(so));
3243 
3244 	unp = sotounpcb(so);
3245 	UNP_LINK_WLOCK();
3246 	unp->unp_gcflag |= UNPGC_IGNORE_RIGHTS;
3247 	UNP_LINK_WUNLOCK();
3248 
3249 	/*
3250 	 * Grab our special mbufs before calling sbrelease().
3251 	 */
3252 	error = SOCK_IO_RECV_LOCK(so, SBL_WAIT | SBL_NOINTR);
3253 	MPASS(!error);
3254 	SOCK_RECVBUF_LOCK(so);
3255 	switch (so->so_type) {
3256 	case SOCK_DGRAM:
3257 		while ((sb = TAILQ_FIRST(&so->so_rcv.uxdg_conns)) != NULL) {
3258 			STAILQ_CONCAT(&so->so_rcv.uxdg_mb, &sb->uxdg_mb);
3259 			TAILQ_REMOVE(&so->so_rcv.uxdg_conns, sb, uxdg_clist);
3260 			/* Note: socket of sb may reconnect. */
3261 			sb->uxdg_cc = sb->uxdg_ctl = sb->uxdg_mbcnt = 0;
3262 		}
3263 		sb = &so->so_rcv;
3264 		if (sb->uxdg_peeked != NULL) {
3265 			STAILQ_INSERT_HEAD(&sb->uxdg_mb, sb->uxdg_peeked,
3266 			    m_stailqpkt);
3267 			sb->uxdg_peeked = NULL;
3268 		}
3269 		m = STAILQ_FIRST(&sb->uxdg_mb);
3270 		STAILQ_INIT(&sb->uxdg_mb);
3271 		/* XXX: our shortened sbrelease() */
3272 		(void)chgsbsize(so->so_cred->cr_uidinfo, &sb->sb_hiwat, 0,
3273 		    RLIM_INFINITY);
3274 		/*
3275 		 * XXXGL Mark sb with SBS_CANTRCVMORE.  This is needed to
3276 		 * prevent uipc_sosend_dgram() or unp_disconnect() adding more
3277 		 * data to the socket.
3278 		 * We came here either through shutdown(2) or from the final
3279 		 * sofree().  The sofree() case is simple as it guarantees
3280 		 * that no more sends will happen, however we can race with
3281 		 * unp_disconnect() from our peer.  The shutdown(2) case is
3282 		 * more exotic.  It would call into unp_dispose() only if
3283 		 * socket is SS_ISCONNECTED.  This is possible if we did
3284 		 * connect(2) on this socket and we also had it bound with
3285 		 * bind(2) and receive connections from other sockets.
3286 		 * Because uipc_shutdown() violates POSIX (see comment
3287 		 * there) we will end up here shutting down our receive side.
3288 		 * Of course this will have affect not only on the peer we
3289 		 * connect(2)ed to, but also on all of the peers who had
3290 		 * connect(2)ed to us.  Their sends would end up with ENOBUFS.
3291 		 */
3292 		sb->sb_state |= SBS_CANTRCVMORE;
3293 		break;
3294 	case SOCK_STREAM:
3295 	case SOCK_SEQPACKET:
3296 		sb = &so->so_rcv;
3297 		m = sbcut_locked(sb, sb->sb_ccc);
3298 		KASSERT(sb->sb_ccc == 0 && sb->sb_mb == 0 && sb->sb_mbcnt == 0,
3299 		    ("%s: ccc %u mb %p mbcnt %u", __func__,
3300 		    sb->sb_ccc, (void *)sb->sb_mb, sb->sb_mbcnt));
3301 		sbrelease_locked(so, SO_RCV);
3302 		break;
3303 	}
3304 	SOCK_RECVBUF_UNLOCK(so);
3305 	SOCK_IO_RECV_UNLOCK(so);
3306 
3307 	if (m != NULL) {
3308 		unp_scan(m, unp_freerights);
3309 		m_freemp(m);
3310 	}
3311 }
3312 
3313 static void
unp_scan(struct mbuf * m0,void (* op)(struct filedescent **,int))3314 unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int))
3315 {
3316 	struct mbuf *m;
3317 	struct cmsghdr *cm;
3318 	void *data;
3319 	socklen_t clen, datalen;
3320 
3321 	while (m0 != NULL) {
3322 		for (m = m0; m; m = m->m_next) {
3323 			if (m->m_type != MT_CONTROL)
3324 				continue;
3325 
3326 			cm = mtod(m, struct cmsghdr *);
3327 			clen = m->m_len;
3328 
3329 			while (cm != NULL) {
3330 				if (sizeof(*cm) > clen || cm->cmsg_len > clen)
3331 					break;
3332 
3333 				data = CMSG_DATA(cm);
3334 				datalen = (caddr_t)cm + cm->cmsg_len
3335 				    - (caddr_t)data;
3336 
3337 				if (cm->cmsg_level == SOL_SOCKET &&
3338 				    cm->cmsg_type == SCM_RIGHTS) {
3339 					(*op)(data, datalen /
3340 					    sizeof(struct filedescent *));
3341 				}
3342 
3343 				if (CMSG_SPACE(datalen) < clen) {
3344 					clen -= CMSG_SPACE(datalen);
3345 					cm = (struct cmsghdr *)
3346 					    ((caddr_t)cm + CMSG_SPACE(datalen));
3347 				} else {
3348 					clen = 0;
3349 					cm = NULL;
3350 				}
3351 			}
3352 		}
3353 		m0 = m0->m_nextpkt;
3354 	}
3355 }
3356 
3357 /*
3358  * Definitions of protocols supported in the LOCAL domain.
3359  */
3360 static struct protosw streamproto = {
3361 	.pr_type =		SOCK_STREAM,
3362 	.pr_flags =		PR_CONNREQUIRED | PR_WANTRCVD | PR_CAPATTACH,
3363 	.pr_ctloutput =		&uipc_ctloutput,
3364 	.pr_abort = 		uipc_abort,
3365 	.pr_accept =		uipc_peeraddr,
3366 	.pr_attach =		uipc_attach,
3367 	.pr_bind =		uipc_bind,
3368 	.pr_bindat =		uipc_bindat,
3369 	.pr_connect =		uipc_connect,
3370 	.pr_connectat =		uipc_connectat,
3371 	.pr_connect2 =		uipc_connect2,
3372 	.pr_detach =		uipc_detach,
3373 	.pr_disconnect =	uipc_disconnect,
3374 	.pr_listen =		uipc_listen,
3375 	.pr_peeraddr =		uipc_peeraddr,
3376 	.pr_rcvd =		uipc_rcvd,
3377 	.pr_send =		uipc_send,
3378 	.pr_ready =		uipc_ready,
3379 	.pr_sense =		uipc_sense,
3380 	.pr_shutdown =		uipc_shutdown,
3381 	.pr_sockaddr =		uipc_sockaddr,
3382 	.pr_soreceive =		soreceive_generic,
3383 	.pr_close =		uipc_close,
3384 	.pr_chmod =		uipc_chmod,
3385 };
3386 
3387 static struct protosw dgramproto = {
3388 	.pr_type =		SOCK_DGRAM,
3389 	.pr_flags =		PR_ATOMIC | PR_ADDR | PR_CAPATTACH | PR_SOCKBUF,
3390 	.pr_ctloutput =		&uipc_ctloutput,
3391 	.pr_abort = 		uipc_abort,
3392 	.pr_accept =		uipc_peeraddr,
3393 	.pr_attach =		uipc_attach,
3394 	.pr_bind =		uipc_bind,
3395 	.pr_bindat =		uipc_bindat,
3396 	.pr_connect =		uipc_connect,
3397 	.pr_connectat =		uipc_connectat,
3398 	.pr_connect2 =		uipc_connect2,
3399 	.pr_detach =		uipc_detach,
3400 	.pr_disconnect =	uipc_disconnect,
3401 	.pr_peeraddr =		uipc_peeraddr,
3402 	.pr_sosend =		uipc_sosend_dgram,
3403 	.pr_sense =		uipc_sense,
3404 	.pr_shutdown =		uipc_shutdown,
3405 	.pr_sockaddr =		uipc_sockaddr,
3406 	.pr_soreceive =		uipc_soreceive_dgram,
3407 	.pr_close =		uipc_close,
3408 	.pr_chmod =		uipc_chmod,
3409 };
3410 
3411 static struct protosw seqpacketproto = {
3412 	.pr_type =		SOCK_SEQPACKET,
3413 	/*
3414 	 * XXXRW: For now, PR_ADDR because soreceive will bump into them
3415 	 * due to our use of sbappendaddr.  A new sbappend variants is needed
3416 	 * that supports both atomic record writes and control data.
3417 	 */
3418 	.pr_flags =		PR_ADDR | PR_ATOMIC | PR_CONNREQUIRED |
3419 				PR_WANTRCVD | PR_CAPATTACH,
3420 	.pr_ctloutput =		&uipc_ctloutput,
3421 	.pr_abort =		uipc_abort,
3422 	.pr_accept =		uipc_peeraddr,
3423 	.pr_attach =		uipc_attach,
3424 	.pr_bind =		uipc_bind,
3425 	.pr_bindat =		uipc_bindat,
3426 	.pr_connect =		uipc_connect,
3427 	.pr_connectat =		uipc_connectat,
3428 	.pr_connect2 =		uipc_connect2,
3429 	.pr_detach =		uipc_detach,
3430 	.pr_disconnect =	uipc_disconnect,
3431 	.pr_listen =		uipc_listen,
3432 	.pr_peeraddr =		uipc_peeraddr,
3433 	.pr_rcvd =		uipc_rcvd,
3434 	.pr_send =		uipc_send,
3435 	.pr_sense =		uipc_sense,
3436 	.pr_shutdown =		uipc_shutdown,
3437 	.pr_sockaddr =		uipc_sockaddr,
3438 	.pr_soreceive =		soreceive_generic,	/* XXX: or...? */
3439 	.pr_close =		uipc_close,
3440 	.pr_chmod =		uipc_chmod,
3441 };
3442 
3443 static struct domain localdomain = {
3444 	.dom_family =		AF_LOCAL,
3445 	.dom_name =		"local",
3446 	.dom_externalize =	unp_externalize,
3447 	.dom_nprotosw =		3,
3448 	.dom_protosw =		{
3449 		&streamproto,
3450 		&dgramproto,
3451 		&seqpacketproto,
3452 	}
3453 };
3454 DOMAIN_SET(local);
3455 
3456 /*
3457  * A helper function called by VFS before socket-type vnode reclamation.
3458  * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
3459  * use count.
3460  */
3461 void
vfs_unp_reclaim(struct vnode * vp)3462 vfs_unp_reclaim(struct vnode *vp)
3463 {
3464 	struct unpcb *unp;
3465 	int active;
3466 	struct mtx *vplock;
3467 
3468 	ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
3469 	KASSERT(vp->v_type == VSOCK,
3470 	    ("vfs_unp_reclaim: vp->v_type != VSOCK"));
3471 
3472 	active = 0;
3473 	vplock = mtx_pool_find(unp_vp_mtxpool, vp);
3474 	mtx_lock(vplock);
3475 	VOP_UNP_CONNECT(vp, &unp);
3476 	if (unp == NULL)
3477 		goto done;
3478 	UNP_PCB_LOCK(unp);
3479 	if (unp->unp_vnode == vp) {
3480 		VOP_UNP_DETACH(vp);
3481 		unp->unp_vnode = NULL;
3482 		active = 1;
3483 	}
3484 	UNP_PCB_UNLOCK(unp);
3485  done:
3486 	mtx_unlock(vplock);
3487 	if (active)
3488 		vunref(vp);
3489 }
3490 
3491 #ifdef DDB
3492 static void
db_print_indent(int indent)3493 db_print_indent(int indent)
3494 {
3495 	int i;
3496 
3497 	for (i = 0; i < indent; i++)
3498 		db_printf(" ");
3499 }
3500 
3501 static void
db_print_unpflags(int unp_flags)3502 db_print_unpflags(int unp_flags)
3503 {
3504 	int comma;
3505 
3506 	comma = 0;
3507 	if (unp_flags & UNP_HAVEPC) {
3508 		db_printf("%sUNP_HAVEPC", comma ? ", " : "");
3509 		comma = 1;
3510 	}
3511 	if (unp_flags & UNP_WANTCRED_ALWAYS) {
3512 		db_printf("%sUNP_WANTCRED_ALWAYS", comma ? ", " : "");
3513 		comma = 1;
3514 	}
3515 	if (unp_flags & UNP_WANTCRED_ONESHOT) {
3516 		db_printf("%sUNP_WANTCRED_ONESHOT", comma ? ", " : "");
3517 		comma = 1;
3518 	}
3519 	if (unp_flags & UNP_CONNECTING) {
3520 		db_printf("%sUNP_CONNECTING", comma ? ", " : "");
3521 		comma = 1;
3522 	}
3523 	if (unp_flags & UNP_BINDING) {
3524 		db_printf("%sUNP_BINDING", comma ? ", " : "");
3525 		comma = 1;
3526 	}
3527 }
3528 
3529 static void
db_print_xucred(int indent,struct xucred * xu)3530 db_print_xucred(int indent, struct xucred *xu)
3531 {
3532 	int comma, i;
3533 
3534 	db_print_indent(indent);
3535 	db_printf("cr_version: %u   cr_uid: %u   cr_pid: %d   cr_ngroups: %d\n",
3536 	    xu->cr_version, xu->cr_uid, xu->cr_pid, xu->cr_ngroups);
3537 	db_print_indent(indent);
3538 	db_printf("cr_groups: ");
3539 	comma = 0;
3540 	for (i = 0; i < xu->cr_ngroups; i++) {
3541 		db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
3542 		comma = 1;
3543 	}
3544 	db_printf("\n");
3545 }
3546 
3547 static void
db_print_unprefs(int indent,struct unp_head * uh)3548 db_print_unprefs(int indent, struct unp_head *uh)
3549 {
3550 	struct unpcb *unp;
3551 	int counter;
3552 
3553 	counter = 0;
3554 	LIST_FOREACH(unp, uh, unp_reflink) {
3555 		if (counter % 4 == 0)
3556 			db_print_indent(indent);
3557 		db_printf("%p  ", unp);
3558 		if (counter % 4 == 3)
3559 			db_printf("\n");
3560 		counter++;
3561 	}
3562 	if (counter != 0 && counter % 4 != 0)
3563 		db_printf("\n");
3564 }
3565 
DB_SHOW_COMMAND(unpcb,db_show_unpcb)3566 DB_SHOW_COMMAND(unpcb, db_show_unpcb)
3567 {
3568 	struct unpcb *unp;
3569 
3570         if (!have_addr) {
3571                 db_printf("usage: show unpcb <addr>\n");
3572                 return;
3573         }
3574         unp = (struct unpcb *)addr;
3575 
3576 	db_printf("unp_socket: %p   unp_vnode: %p\n", unp->unp_socket,
3577 	    unp->unp_vnode);
3578 
3579 	db_printf("unp_ino: %ju   unp_conn: %p\n", (uintmax_t)unp->unp_ino,
3580 	    unp->unp_conn);
3581 
3582 	db_printf("unp_refs:\n");
3583 	db_print_unprefs(2, &unp->unp_refs);
3584 
3585 	/* XXXRW: Would be nice to print the full address, if any. */
3586 	db_printf("unp_addr: %p\n", unp->unp_addr);
3587 
3588 	db_printf("unp_gencnt: %llu\n",
3589 	    (unsigned long long)unp->unp_gencnt);
3590 
3591 	db_printf("unp_flags: %x (", unp->unp_flags);
3592 	db_print_unpflags(unp->unp_flags);
3593 	db_printf(")\n");
3594 
3595 	db_printf("unp_peercred:\n");
3596 	db_print_xucred(2, &unp->unp_peercred);
3597 
3598 	db_printf("unp_refcount: %u\n", unp->unp_refcount);
3599 }
3600 #endif
3601