xref: /freebsd/sys/kern/uipc_usrreq.c (revision 75e7e3ce34d9782d825f7b3579afd82e3de55b5e)
19454b2d8SWarner Losh /*-
251369649SPedro F. Giffuni  * SPDX-License-Identifier: BSD-3-Clause
351369649SPedro F. Giffuni  *
4df8bae1dSRodney W. Grimes  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5f344fb0bSWarner Losh  *	The Regents of the University of California. All Rights Reserved.
6f344fb0bSWarner Losh  * Copyright (c) 2004-2009 Robert N. M. Watson All Rights Reserved.
7c0874c34SMatt Macy  * Copyright (c) 2018 Matthew Macy
8df8bae1dSRodney W. Grimes  *
9df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
10df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
11df8bae1dSRodney W. Grimes  * are met:
12df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
13df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
14df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
15df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
16df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
1769a28758SEd Maste  * 3. Neither the name of the University nor the names of its contributors
18df8bae1dSRodney W. Grimes  *    may be used to endorse or promote products derived from this software
19df8bae1dSRodney W. Grimes  *    without specific prior written permission.
20df8bae1dSRodney W. Grimes  *
21df8bae1dSRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24df8bae1dSRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
32df8bae1dSRodney W. Grimes  *
33748e0b0aSGarrett Wollman  *	From: @(#)uipc_usrreq.c	8.3 (Berkeley) 1/4/94
34df8bae1dSRodney W. Grimes  */
35df8bae1dSRodney W. Grimes 
36f23929fbSRobert Watson /*
37f23929fbSRobert Watson  * UNIX Domain (Local) Sockets
38f23929fbSRobert Watson  *
39f23929fbSRobert Watson  * This is an implementation of UNIX (local) domain sockets.  Each socket has
40f23929fbSRobert Watson  * an associated struct unpcb (UNIX protocol control block).  Stream sockets
41f23929fbSRobert Watson  * may be connected to 0 or 1 other socket.  Datagram sockets may be
42f23929fbSRobert Watson  * connected to 0, 1, or many other sockets.  Sockets may be created and
43f23929fbSRobert Watson  * connected in pairs (socketpair(2)), or bound/connected to using the file
44f23929fbSRobert Watson  * system name space.  For most purposes, only the receive socket buffer is
45f23929fbSRobert Watson  * used, as sending on one socket delivers directly to the receive socket
465b950deaSRobert Watson  * buffer of a second socket.
475b950deaSRobert Watson  *
485b950deaSRobert Watson  * The implementation is substantially complicated by the fact that
495b950deaSRobert Watson  * "ancillary data", such as file descriptors or credentials, may be passed
505b950deaSRobert Watson  * across UNIX domain sockets.  The potential for passing UNIX domain sockets
515b950deaSRobert Watson  * over other UNIX domain sockets requires the implementation of a simple
525b950deaSRobert Watson  * garbage collector to find and tear down cycles of disconnected sockets.
53aea52f1bSRobert Watson  *
54aea52f1bSRobert Watson  * TODO:
5584d61770SRobert Watson  *	RDM
56aea52f1bSRobert Watson  *	rethink name space problems
57aea52f1bSRobert Watson  *	need a proper out-of-band
58f23929fbSRobert Watson  */
59f23929fbSRobert Watson 
60677b542eSDavid E. O'Brien #include <sys/cdefs.h>
61677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
62677b542eSDavid E. O'Brien 
6303c96c31SRobert Watson #include "opt_ddb.h"
64335654d7SRobert Watson 
65df8bae1dSRodney W. Grimes #include <sys/param.h>
664a144410SRobert Watson #include <sys/capsicum.h>
67fb919e4dSMark Murray #include <sys/domain.h>
684f590175SPaul Saab #include <sys/eventhandler.h>
69d5cbccecSMark Johnston #include <sys/fcntl.h>
70639acc13SGarrett Wollman #include <sys/file.h>
71960ed29cSSeigo Tanimura #include <sys/filedesc.h>
72960ed29cSSeigo Tanimura #include <sys/kernel.h>
73960ed29cSSeigo Tanimura #include <sys/lock.h>
74d5cbccecSMark Johnston #include <sys/malloc.h>
75639acc13SGarrett Wollman #include <sys/mbuf.h>
76033eb86eSJeff Roberson #include <sys/mount.h>
77960ed29cSSeigo Tanimura #include <sys/mutex.h>
78639acc13SGarrett Wollman #include <sys/namei.h>
79639acc13SGarrett Wollman #include <sys/proc.h>
80df8bae1dSRodney W. Grimes #include <sys/protosw.h>
810cb64678SKonstantin Belousov #include <sys/queue.h>
82960ed29cSSeigo Tanimura #include <sys/resourcevar.h>
83e7c33e29SRobert Watson #include <sys/rwlock.h>
84df8bae1dSRodney W. Grimes #include <sys/socket.h>
85df8bae1dSRodney W. Grimes #include <sys/socketvar.h>
86960ed29cSSeigo Tanimura #include <sys/signalvar.h>
87df8bae1dSRodney W. Grimes #include <sys/stat.h>
88960ed29cSSeigo Tanimura #include <sys/sx.h>
89639acc13SGarrett Wollman #include <sys/sysctl.h>
90960ed29cSSeigo Tanimura #include <sys/systm.h>
91a0ec558aSRobert Watson #include <sys/taskqueue.h>
92639acc13SGarrett Wollman #include <sys/un.h>
9398271db4SGarrett Wollman #include <sys/unpcb.h>
94639acc13SGarrett Wollman #include <sys/vnode.h>
95530c0060SRobert Watson 
96530c0060SRobert Watson #include <net/vnet.h>
97df8bae1dSRodney W. Grimes 
9803c96c31SRobert Watson #ifdef DDB
9903c96c31SRobert Watson #include <ddb/ddb.h>
10003c96c31SRobert Watson #endif
10103c96c31SRobert Watson 
102aed55708SRobert Watson #include <security/mac/mac_framework.h>
103aed55708SRobert Watson 
1049e9d298aSJeff Roberson #include <vm/uma.h>
10598271db4SGarrett Wollman 
1068cb539f1SPawel Jakub Dawidek MALLOC_DECLARE(M_FILECAPS);
1078cb539f1SPawel Jakub Dawidek 
1083dab55bcSRobert Watson /*
109d5cbccecSMark Johnston  * See unpcb.h for the locking key.
1103dab55bcSRobert Watson  */
1113dab55bcSRobert Watson 
1129e9d298aSJeff Roberson static uma_zone_t	unp_zone;
1133dab55bcSRobert Watson static unp_gen_t	unp_gencnt;	/* (l) */
1143dab55bcSRobert Watson static u_int		unp_count;	/* (l) Count of local sockets. */
115aea52f1bSRobert Watson static ino_t		unp_ino;	/* Prototype for fake inode numbers. */
1163dab55bcSRobert Watson static int		unp_rights;	/* (g) File descriptors in flight. */
1173dab55bcSRobert Watson static struct unp_head	unp_shead;	/* (l) List of stream sockets. */
1183dab55bcSRobert Watson static struct unp_head	unp_dhead;	/* (l) List of datagram sockets. */
11984d61770SRobert Watson static struct unp_head	unp_sphead;	/* (l) List of seqpacket sockets. */
12098271db4SGarrett Wollman 
1210cb64678SKonstantin Belousov struct unp_defer {
1220cb64678SKonstantin Belousov 	SLIST_ENTRY(unp_defer) ud_link;
1230cb64678SKonstantin Belousov 	struct file *ud_fp;
1240cb64678SKonstantin Belousov };
1250cb64678SKonstantin Belousov static SLIST_HEAD(, unp_defer) unp_defers;
1260cb64678SKonstantin Belousov static int unp_defers_count;
1270cb64678SKonstantin Belousov 
128aea52f1bSRobert Watson static const struct sockaddr	sun_noname = { sizeof(sun_noname), AF_LOCAL };
12998271db4SGarrett Wollman 
130df8bae1dSRodney W. Grimes /*
131aea52f1bSRobert Watson  * Garbage collection of cyclic file descriptor/socket references occurs
132aea52f1bSRobert Watson  * asynchronously in a taskqueue context in order to avoid recursion and
133aea52f1bSRobert Watson  * reentrance in the UNIX domain socket, file descriptor, and socket layer
134aea52f1bSRobert Watson  * code.  See unp_gc() for a full description.
135df8bae1dSRodney W. Grimes  */
136daee0f0bSKonstantin Belousov static struct timeout_task unp_gc_task;
137f708ef1bSPoul-Henning Kamp 
138ce5f32deSRobert Watson /*
1390cb64678SKonstantin Belousov  * The close of unix domain sockets attached as SCM_RIGHTS is
1400cb64678SKonstantin Belousov  * postponed to the taskqueue, to avoid arbitrary recursion depth.
1410cb64678SKonstantin Belousov  * The attached sockets might have another sockets attached.
1420cb64678SKonstantin Belousov  */
1430cb64678SKonstantin Belousov static struct task	unp_defer_task;
1440cb64678SKonstantin Belousov 
1450cb64678SKonstantin Belousov /*
1467e711c3aSRobert Watson  * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
1477e711c3aSRobert Watson  * stream sockets, although the total for sender and receiver is actually
1487e711c3aSRobert Watson  * only PIPSIZ.
1497e711c3aSRobert Watson  *
1507e711c3aSRobert Watson  * Datagram sockets really use the sendspace as the maximum datagram size,
1517e711c3aSRobert Watson  * and don't really want to reserve the sendspace.  Their recvspace should be
1527e711c3aSRobert Watson  * large enough for at least one max-size datagram plus address.
1537e711c3aSRobert Watson  */
1547e711c3aSRobert Watson #ifndef PIPSIZ
1557e711c3aSRobert Watson #define	PIPSIZ	8192
1567e711c3aSRobert Watson #endif
1577e711c3aSRobert Watson static u_long	unpst_sendspace = PIPSIZ;
1587e711c3aSRobert Watson static u_long	unpst_recvspace = PIPSIZ;
1597e711c3aSRobert Watson static u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
160d157f262SMark Johnston static u_long	unpdg_recvspace = 16*1024;	/* support 8KB syslog msgs */
16184d61770SRobert Watson static u_long	unpsp_sendspace = PIPSIZ;	/* really max datagram size */
16284d61770SRobert Watson static u_long	unpsp_recvspace = PIPSIZ;
1637e711c3aSRobert Watson 
1647029da5cSPawel Biernacki static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1657029da5cSPawel Biernacki     "Local domain");
1667029da5cSPawel Biernacki static SYSCTL_NODE(_net_local, SOCK_STREAM, stream,
1677029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1686472ac3dSEd Schouten     "SOCK_STREAM");
1697029da5cSPawel Biernacki static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram,
1707029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1717029da5cSPawel Biernacki     "SOCK_DGRAM");
1727029da5cSPawel Biernacki static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket,
1737029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
17484d61770SRobert Watson     "SOCK_SEQPACKET");
175e4445a03SRobert Watson 
1767e711c3aSRobert Watson SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
177be6b1304STom Rhodes 	   &unpst_sendspace, 0, "Default stream send space.");
1787e711c3aSRobert Watson SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
179be6b1304STom Rhodes 	   &unpst_recvspace, 0, "Default stream receive space.");
1807e711c3aSRobert Watson SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
181be6b1304STom Rhodes 	   &unpdg_sendspace, 0, "Default datagram send space.");
1827e711c3aSRobert Watson SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
183be6b1304STom Rhodes 	   &unpdg_recvspace, 0, "Default datagram receive space.");
18484d61770SRobert Watson SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
18584d61770SRobert Watson 	   &unpsp_sendspace, 0, "Default seqpacket send space.");
18684d61770SRobert Watson SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
18784d61770SRobert Watson 	   &unpsp_recvspace, 0, "Default seqpacket receive space.");
188be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
189be6b1304STom Rhodes     "File descriptors in flight.");
1900cb64678SKonstantin Belousov SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
1910cb64678SKonstantin Belousov     &unp_defers_count, 0,
1920cb64678SKonstantin Belousov     "File descriptors deferred to taskqueue for close.");
1937e711c3aSRobert Watson 
194175389cfSEdward Tomasz Napierala /*
195e7c33e29SRobert Watson  * Locking and synchronization:
196ce5f32deSRobert Watson  *
197d5cbccecSMark Johnston  * Several types of locks exist in the local domain socket implementation:
198d5cbccecSMark Johnston  * - a global linkage lock
199d5cbccecSMark Johnston  * - a global connection list lock
200d5cbccecSMark Johnston  * - the mtxpool lock
201d5cbccecSMark Johnston  * - per-unpcb mutexes
202d5cbccecSMark Johnston  *
203d5cbccecSMark Johnston  * The linkage lock protects the global socket lists, the generation number
204d5cbccecSMark Johnston  * counter and garbage collector state.
205d5cbccecSMark Johnston  *
206d5cbccecSMark Johnston  * The connection list lock protects the list of referring sockets in a datagram
207d5cbccecSMark Johnston  * socket PCB.  This lock is also overloaded to protect a global list of
208d5cbccecSMark Johnston  * sockets whose buffers contain socket references in the form of SCM_RIGHTS
209d5cbccecSMark Johnston  * messages.  To avoid recursion, such references are released by a dedicated
210d5cbccecSMark Johnston  * thread.
21175a67bf3SMatt Macy  *
21275a67bf3SMatt Macy  * The mtxpool lock protects the vnode from being modified while referenced.
213d5cbccecSMark Johnston  * Lock ordering rules require that it be acquired before any PCB locks.
21475a67bf3SMatt Macy  *
215d5cbccecSMark Johnston  * The unpcb lock (unp_mtx) protects the most commonly referenced fields in the
216d5cbccecSMark Johnston  * unpcb.  This includes the unp_conn field, which either links two connected
217d5cbccecSMark Johnston  * PCBs together (for connected socket types) or points at the destination
218d5cbccecSMark Johnston  * socket (for connectionless socket types).  The operations of creating or
219d5cbccecSMark Johnston  * destroying a connection therefore involve locking multiple PCBs.  To avoid
220d5cbccecSMark Johnston  * lock order reversals, in some cases this involves dropping a PCB lock and
221d5cbccecSMark Johnston  * using a reference counter to maintain liveness.
222ce5f32deSRobert Watson  *
223e7c33e29SRobert Watson  * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
224e7c33e29SRobert Watson  * allocated in pru_attach() and freed in pru_detach().  The validity of that
225e7c33e29SRobert Watson  * pointer is an invariant, so no lock is required to dereference the so_pcb
226e7c33e29SRobert Watson  * pointer if a valid socket reference is held by the caller.  In practice,
227e7c33e29SRobert Watson  * this is always true during operations performed on a socket.  Each unpcb
228e7c33e29SRobert Watson  * has a back-pointer to its socket, unp_socket, which will be stable under
229e7c33e29SRobert Watson  * the same circumstances.
230e7c33e29SRobert Watson  *
231e7c33e29SRobert Watson  * This pointer may only be safely dereferenced as long as a valid reference
232e7c33e29SRobert Watson  * to the unpcb is held.  Typically, this reference will be from the socket,
233e7c33e29SRobert Watson  * or from another unpcb when the referring unpcb's lock is held (in order
234e7c33e29SRobert Watson  * that the reference not be invalidated during use).  For example, to follow
23575a67bf3SMatt Macy  * unp->unp_conn->unp_socket, you need to hold a lock on unp_conn to guarantee
23675a67bf3SMatt Macy  * that detach is not run clearing unp_socket.
237e7c33e29SRobert Watson  *
238e7c33e29SRobert Watson  * Blocking with UNIX domain sockets is a tricky issue: unlike most network
239e7c33e29SRobert Watson  * protocols, bind() is a non-atomic operation, and connect() requires
240e7c33e29SRobert Watson  * potential sleeping in the protocol, due to potentially waiting on local or
241e7c33e29SRobert Watson  * distributed file systems.  We try to separate "lookup" operations, which
242e7c33e29SRobert Watson  * may sleep, and the IPC operations themselves, which typically can occur
243e7c33e29SRobert Watson  * with relative atomicity as locks can be held over the entire operation.
244e7c33e29SRobert Watson  *
245e7c33e29SRobert Watson  * Another tricky issue is simultaneous multi-threaded or multi-process
246e7c33e29SRobert Watson  * access to a single UNIX domain socket.  These are handled by the flags
247e7c33e29SRobert Watson  * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
248e7c33e29SRobert Watson  * binding, both of which involve dropping UNIX domain socket locks in order
249e7c33e29SRobert Watson  * to perform namei() and other file system operations.
250ce5f32deSRobert Watson  */
2513dab55bcSRobert Watson static struct rwlock	unp_link_rwlock;
2520cb64678SKonstantin Belousov static struct mtx	unp_defers_lock;
253e7c33e29SRobert Watson 
2543dab55bcSRobert Watson #define	UNP_LINK_LOCK_INIT()		rw_init(&unp_link_rwlock,	\
2553dab55bcSRobert Watson 					    "unp_link_rwlock")
256e7c33e29SRobert Watson 
2573dab55bcSRobert Watson #define	UNP_LINK_LOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
258e7c33e29SRobert Watson 					    RA_LOCKED)
2593dab55bcSRobert Watson #define	UNP_LINK_UNLOCK_ASSERT()	rw_assert(&unp_link_rwlock,	\
260e7c33e29SRobert Watson 					    RA_UNLOCKED)
261e7c33e29SRobert Watson 
2623dab55bcSRobert Watson #define	UNP_LINK_RLOCK()		rw_rlock(&unp_link_rwlock)
2633dab55bcSRobert Watson #define	UNP_LINK_RUNLOCK()		rw_runlock(&unp_link_rwlock)
2643dab55bcSRobert Watson #define	UNP_LINK_WLOCK()		rw_wlock(&unp_link_rwlock)
2653dab55bcSRobert Watson #define	UNP_LINK_WUNLOCK()		rw_wunlock(&unp_link_rwlock)
2663dab55bcSRobert Watson #define	UNP_LINK_WLOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
267e7c33e29SRobert Watson 					    RA_WLOCKED)
268779f106aSGleb Smirnoff #define	UNP_LINK_WOWNED()		rw_wowned(&unp_link_rwlock)
269e7c33e29SRobert Watson 
2700cb64678SKonstantin Belousov #define	UNP_DEFERRED_LOCK_INIT()	mtx_init(&unp_defers_lock, \
2710cb64678SKonstantin Belousov 					    "unp_defer", NULL, MTX_DEF)
2720cb64678SKonstantin Belousov #define	UNP_DEFERRED_LOCK()		mtx_lock(&unp_defers_lock)
2730cb64678SKonstantin Belousov #define	UNP_DEFERRED_UNLOCK()		mtx_unlock(&unp_defers_lock)
2740cb64678SKonstantin Belousov 
27575a67bf3SMatt Macy #define UNP_REF_LIST_LOCK()		UNP_DEFERRED_LOCK();
27675a67bf3SMatt Macy #define UNP_REF_LIST_UNLOCK()		UNP_DEFERRED_UNLOCK();
27775a67bf3SMatt Macy 
278e7c33e29SRobert Watson #define UNP_PCB_LOCK_INIT(unp)		mtx_init(&(unp)->unp_mtx,	\
279d9525340SMatt Macy 					    "unp", "unp",	\
28075a67bf3SMatt Macy 					    MTX_DUPOK|MTX_DEF)
281e7c33e29SRobert Watson #define	UNP_PCB_LOCK_DESTROY(unp)	mtx_destroy(&(unp)->unp_mtx)
282ccdadf1aSMark Johnston #define	UNP_PCB_LOCKPTR(unp)		(&(unp)->unp_mtx)
283e7c33e29SRobert Watson #define	UNP_PCB_LOCK(unp)		mtx_lock(&(unp)->unp_mtx)
28475a67bf3SMatt Macy #define	UNP_PCB_TRYLOCK(unp)		mtx_trylock(&(unp)->unp_mtx)
285e7c33e29SRobert Watson #define	UNP_PCB_UNLOCK(unp)		mtx_unlock(&(unp)->unp_mtx)
28675a67bf3SMatt Macy #define	UNP_PCB_OWNED(unp)		mtx_owned(&(unp)->unp_mtx)
287e7c33e29SRobert Watson #define	UNP_PCB_LOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_OWNED)
28875a67bf3SMatt Macy #define	UNP_PCB_UNLOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_NOTOWNED)
2890d9ce3a1SRobert Watson 
2902c899584SRobert Watson static int	uipc_connect2(struct socket *, struct socket *);
2910b36cd25SRobert Watson static int	uipc_ctloutput(struct socket *, struct sockopt *);
292aea52f1bSRobert Watson static int	unp_connect(struct socket *, struct sockaddr *,
293aea52f1bSRobert Watson 		    struct thread *);
2947493f24eSPawel Jakub Dawidek static int	unp_connectat(int, struct socket *, struct sockaddr *,
2957493f24eSPawel Jakub Dawidek 		    struct thread *);
29608f17d14SGleb Smirnoff static void	unp_connect2(struct socket *so, struct socket *so2, int);
297e7c33e29SRobert Watson static void	unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
29899ab95dbSMark Johnston static void	unp_dispose(struct socket *so);
2994d77a549SAlfred Perlstein static void	unp_shutdown(struct unpcb *);
300afc055d9SEd Schouten static void	unp_drop(struct unpcb *);
301a0ec558aSRobert Watson static void	unp_gc(__unused void *, int);
302be26ba7cSPawel Jakub Dawidek static void	unp_scan(struct mbuf *, void (*)(struct filedescent **, int));
3034d77a549SAlfred Perlstein static void	unp_discard(struct file *);
3048cb539f1SPawel Jakub Dawidek static void	unp_freerights(struct filedescent **, int);
3054d77a549SAlfred Perlstein static int	unp_internalize(struct mbuf **, struct thread *);
306397c19d1SJeff Roberson static void	unp_internalize_fp(struct file *);
307c2e3c52eSJilles Tjoelker static int	unp_externalize(struct mbuf *, struct mbuf **, int);
3080cb64678SKonstantin Belousov static int	unp_externalize_fp(struct file *);
309ede4af47SConrad Meyer static struct mbuf	*unp_addsockcred(struct thread *, struct mbuf *, int);
3100cb64678SKonstantin Belousov static void	unp_process_defers(void * __unused, int);
311f708ef1bSPoul-Henning Kamp 
31275a67bf3SMatt Macy static void
31375a67bf3SMatt Macy unp_pcb_hold(struct unpcb *unp)
31475a67bf3SMatt Macy {
3155362170dSMark Johnston 	u_int old __unused;
3165362170dSMark Johnston 
3175362170dSMark Johnston 	old = refcount_acquire(&unp->unp_refcount);
3185362170dSMark Johnston 	KASSERT(old > 0, ("%s: unpcb %p has no references", __func__, unp));
31975a67bf3SMatt Macy }
32075a67bf3SMatt Macy 
3215362170dSMark Johnston static __result_use_check bool
32275a67bf3SMatt Macy unp_pcb_rele(struct unpcb *unp)
32375a67bf3SMatt Macy {
3245362170dSMark Johnston 	bool ret;
32575a67bf3SMatt Macy 
32675a67bf3SMatt Macy 	UNP_PCB_LOCK_ASSERT(unp);
3275362170dSMark Johnston 
3285362170dSMark Johnston 	if ((ret = refcount_release(&unp->unp_refcount))) {
32975a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
33075a67bf3SMatt Macy 		UNP_PCB_LOCK_DESTROY(unp);
33175a67bf3SMatt Macy 		uma_zfree(unp_zone, unp);
33275a67bf3SMatt Macy 	}
3335362170dSMark Johnston 	return (ret);
33475a67bf3SMatt Macy }
33575a67bf3SMatt Macy 
33675a67bf3SMatt Macy static void
337f0317f86SMark Johnston unp_pcb_rele_notlast(struct unpcb *unp)
338f0317f86SMark Johnston {
339f0317f86SMark Johnston 	bool ret __unused;
340f0317f86SMark Johnston 
341f0317f86SMark Johnston 	ret = refcount_release(&unp->unp_refcount);
342f0317f86SMark Johnston 	KASSERT(!ret, ("%s: unpcb %p has no references", __func__, unp));
343f0317f86SMark Johnston }
344f0317f86SMark Johnston 
345f0317f86SMark Johnston static void
3464820bf6aSMark Johnston unp_pcb_lock_pair(struct unpcb *unp, struct unpcb *unp2)
34775a67bf3SMatt Macy {
34875a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp);
34975a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp2);
3504820bf6aSMark Johnston 
3514820bf6aSMark Johnston 	if (unp == unp2) {
3524820bf6aSMark Johnston 		UNP_PCB_LOCK(unp);
3534820bf6aSMark Johnston 	} else if ((uintptr_t)unp2 > (uintptr_t)unp) {
35475a67bf3SMatt Macy 		UNP_PCB_LOCK(unp);
35575a67bf3SMatt Macy 		UNP_PCB_LOCK(unp2);
35675a67bf3SMatt Macy 	} else {
35775a67bf3SMatt Macy 		UNP_PCB_LOCK(unp2);
35875a67bf3SMatt Macy 		UNP_PCB_LOCK(unp);
35975a67bf3SMatt Macy 	}
36075a67bf3SMatt Macy }
36175a67bf3SMatt Macy 
3624820bf6aSMark Johnston static void
3634820bf6aSMark Johnston unp_pcb_unlock_pair(struct unpcb *unp, struct unpcb *unp2)
3644820bf6aSMark Johnston {
3654820bf6aSMark Johnston 	UNP_PCB_UNLOCK(unp);
3664820bf6aSMark Johnston 	if (unp != unp2)
3674820bf6aSMark Johnston 		UNP_PCB_UNLOCK(unp2);
3684820bf6aSMark Johnston }
3694820bf6aSMark Johnston 
370ccdadf1aSMark Johnston /*
371ccdadf1aSMark Johnston  * Try to lock the connected peer of an already locked socket.  In some cases
372ccdadf1aSMark Johnston  * this requires that we unlock the current socket.  The pairbusy counter is
373ccdadf1aSMark Johnston  * used to block concurrent connection attempts while the lock is dropped.  The
374ccdadf1aSMark Johnston  * caller must be careful to revalidate PCB state.
375ccdadf1aSMark Johnston  */
376ccdadf1aSMark Johnston static struct unpcb *
377ccdadf1aSMark Johnston unp_pcb_lock_peer(struct unpcb *unp)
37875a67bf3SMatt Macy {
37975a67bf3SMatt Macy 	struct unpcb *unp2;
38075a67bf3SMatt Macy 
381ccdadf1aSMark Johnston 	UNP_PCB_LOCK_ASSERT(unp);
382ccdadf1aSMark Johnston 	unp2 = unp->unp_conn;
3836404d7ffSMateusz Guzik 	if (unp2 == NULL)
384ccdadf1aSMark Johnston 		return (NULL);
385ccdadf1aSMark Johnston 	if (__predict_false(unp == unp2))
386ccdadf1aSMark Johnston 		return (unp);
387ccdadf1aSMark Johnston 
388ccdadf1aSMark Johnston 	UNP_PCB_UNLOCK_ASSERT(unp2);
389ccdadf1aSMark Johnston 
390ccdadf1aSMark Johnston 	if (__predict_true(UNP_PCB_TRYLOCK(unp2)))
391ccdadf1aSMark Johnston 		return (unp2);
392ccdadf1aSMark Johnston 	if ((uintptr_t)unp2 > (uintptr_t)unp) {
393ccdadf1aSMark Johnston 		UNP_PCB_LOCK(unp2);
394ccdadf1aSMark Johnston 		return (unp2);
395ccdadf1aSMark Johnston 	}
396ccdadf1aSMark Johnston 	unp->unp_pairbusy++;
397e62ca80bSMark Johnston 	unp_pcb_hold(unp2);
398e62ca80bSMark Johnston 	UNP_PCB_UNLOCK(unp);
399ccdadf1aSMark Johnston 
400e62ca80bSMark Johnston 	UNP_PCB_LOCK(unp2);
401e62ca80bSMark Johnston 	UNP_PCB_LOCK(unp);
402ccdadf1aSMark Johnston 	KASSERT(unp->unp_conn == unp2 || unp->unp_conn == NULL,
403ccdadf1aSMark Johnston 	    ("%s: socket %p was reconnected", __func__, unp));
404ccdadf1aSMark Johnston 	if (--unp->unp_pairbusy == 0 && (unp->unp_flags & UNP_WAITING) != 0) {
405ccdadf1aSMark Johnston 		unp->unp_flags &= ~UNP_WAITING;
406ccdadf1aSMark Johnston 		wakeup(unp);
40775a67bf3SMatt Macy 	}
408ccdadf1aSMark Johnston 	if (unp_pcb_rele(unp2)) {
409ccdadf1aSMark Johnston 		/* unp2 is unlocked. */
410ccdadf1aSMark Johnston 		return (NULL);
411ccdadf1aSMark Johnston 	}
412ccdadf1aSMark Johnston 	if (unp->unp_conn == NULL) {
413ccdadf1aSMark Johnston 		UNP_PCB_UNLOCK(unp2);
414ccdadf1aSMark Johnston 		return (NULL);
415ccdadf1aSMark Johnston 	}
416ccdadf1aSMark Johnston 	return (unp2);
417ccdadf1aSMark Johnston }
41875a67bf3SMatt Macy 
419e4445a03SRobert Watson /*
420e4445a03SRobert Watson  * Definitions of protocols supported in the LOCAL domain.
421e4445a03SRobert Watson  */
422e4445a03SRobert Watson static struct domain localdomain;
423fa9402f2SRobert Watson static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream;
42484d61770SRobert Watson static struct pr_usrreqs uipc_usrreqs_seqpacket;
425e4445a03SRobert Watson static struct protosw localsw[] = {
426e4445a03SRobert Watson {
427e4445a03SRobert Watson 	.pr_type =		SOCK_STREAM,
428e4445a03SRobert Watson 	.pr_domain =		&localdomain,
42927457983SMark Johnston 	.pr_flags =		PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS|
43027457983SMark Johnston 				    PR_CAPATTACH,
431e4445a03SRobert Watson 	.pr_ctloutput =		&uipc_ctloutput,
432fa9402f2SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs_stream
433e4445a03SRobert Watson },
434e4445a03SRobert Watson {
435e4445a03SRobert Watson 	.pr_type =		SOCK_DGRAM,
436e4445a03SRobert Watson 	.pr_domain =		&localdomain,
43727457983SMark Johnston 	.pr_flags =		PR_ATOMIC|PR_ADDR|PR_RIGHTS|PR_CAPATTACH,
438aaf63435SGleb Smirnoff 	.pr_ctloutput =		&uipc_ctloutput,
439fa9402f2SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs_dgram
440e4445a03SRobert Watson },
44184d61770SRobert Watson {
44284d61770SRobert Watson 	.pr_type =		SOCK_SEQPACKET,
44384d61770SRobert Watson 	.pr_domain =		&localdomain,
44484d61770SRobert Watson 
44584d61770SRobert Watson 	/*
44684d61770SRobert Watson 	 * XXXRW: For now, PR_ADDR because soreceive will bump into them
44784d61770SRobert Watson 	 * due to our use of sbappendaddr.  A new sbappend variants is needed
44884d61770SRobert Watson 	 * that supports both atomic record writes and control data.
44984d61770SRobert Watson 	 */
45027457983SMark Johnston 	.pr_flags =		PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|
45127457983SMark Johnston 				    PR_WANTRCVD|PR_RIGHTS|PR_CAPATTACH,
452e0643280SGleb Smirnoff 	.pr_ctloutput =		&uipc_ctloutput,
45384d61770SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs_seqpacket,
45484d61770SRobert Watson },
455e4445a03SRobert Watson };
456e4445a03SRobert Watson 
457e4445a03SRobert Watson static struct domain localdomain = {
458e4445a03SRobert Watson 	.dom_family =		AF_LOCAL,
459e4445a03SRobert Watson 	.dom_name =		"local",
460e4445a03SRobert Watson 	.dom_externalize =	unp_externalize,
46199ab95dbSMark Johnston 	.dom_dispose =		unp_dispose,
462e4445a03SRobert Watson 	.dom_protosw =		localsw,
46302abd400SPedro F. Giffuni 	.dom_protoswNPROTOSW =	&localsw[nitems(localsw)]
464e4445a03SRobert Watson };
465e4445a03SRobert Watson DOMAIN_SET(local);
466e4445a03SRobert Watson 
467ac45e92fSRobert Watson static void
468a29f300eSGarrett Wollman uipc_abort(struct socket *so)
469df8bae1dSRodney W. Grimes {
470e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
471df8bae1dSRodney W. Grimes 
47240f2ac28SRobert Watson 	unp = sotounpcb(so);
4734d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
47475a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp);
475e7c33e29SRobert Watson 
476e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
477e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
478e7c33e29SRobert Watson 	if (unp2 != NULL) {
47975a67bf3SMatt Macy 		unp_pcb_hold(unp2);
480e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
48175a67bf3SMatt Macy 		unp_drop(unp2);
48275a67bf3SMatt Macy 	} else
48375a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
484df8bae1dSRodney W. Grimes }
485df8bae1dSRodney W. Grimes 
486a29f300eSGarrett Wollman static int
48757bf258eSGarrett Wollman uipc_accept(struct socket *so, struct sockaddr **nam)
488a29f300eSGarrett Wollman {
489e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
4900d9ce3a1SRobert Watson 	const struct sockaddr *sa;
491df8bae1dSRodney W. Grimes 
492df8bae1dSRodney W. Grimes 	/*
4931c381b19SRobert Watson 	 * Pass back name of connected socket, if it was bound and we are
4941c381b19SRobert Watson 	 * still connected (our peer may have closed already!).
495df8bae1dSRodney W. Grimes 	 */
4964d4b555eSRobert Watson 	unp = sotounpcb(so);
4974d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_accept: unp == NULL"));
498e7c33e29SRobert Watson 
4990d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
50044800027SMark Johnston 	UNP_PCB_LOCK(unp);
50144800027SMark Johnston 	unp2 = unp_pcb_lock_peer(unp);
50244800027SMark Johnston 	if (unp2 != NULL && unp2->unp_addr != NULL)
503e7c33e29SRobert Watson 		sa = (struct sockaddr *)unp2->unp_addr;
50444800027SMark Johnston 	else
5050d9ce3a1SRobert Watson 		sa = &sun_noname;
5060d9ce3a1SRobert Watson 	bcopy(sa, *nam, sa->sa_len);
507b4e07e3dSMark Johnston 	if (unp2 != NULL)
50844800027SMark Johnston 		unp_pcb_unlock_pair(unp, unp2);
509b4e07e3dSMark Johnston 	else
510b4e07e3dSMark Johnston 		UNP_PCB_UNLOCK(unp);
511e5aeaa0cSDag-Erling Smørgrav 	return (0);
512a29f300eSGarrett Wollman }
513df8bae1dSRodney W. Grimes 
514a29f300eSGarrett Wollman static int
515b40ce416SJulian Elischer uipc_attach(struct socket *so, int proto, struct thread *td)
516a29f300eSGarrett Wollman {
517e7c33e29SRobert Watson 	u_long sendspace, recvspace;
5186d32873cSRobert Watson 	struct unpcb *unp;
5193dab55bcSRobert Watson 	int error;
520779f106aSGleb Smirnoff 	bool locked;
521df8bae1dSRodney W. Grimes 
5226d32873cSRobert Watson 	KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
5236d32873cSRobert Watson 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
5246d32873cSRobert Watson 		switch (so->so_type) {
5256d32873cSRobert Watson 		case SOCK_STREAM:
526e7c33e29SRobert Watson 			sendspace = unpst_sendspace;
527e7c33e29SRobert Watson 			recvspace = unpst_recvspace;
5286d32873cSRobert Watson 			break;
5296d32873cSRobert Watson 
5306d32873cSRobert Watson 		case SOCK_DGRAM:
531e7c33e29SRobert Watson 			sendspace = unpdg_sendspace;
532e7c33e29SRobert Watson 			recvspace = unpdg_recvspace;
5336d32873cSRobert Watson 			break;
5346d32873cSRobert Watson 
53584d61770SRobert Watson 		case SOCK_SEQPACKET:
53684d61770SRobert Watson 			sendspace = unpsp_sendspace;
53784d61770SRobert Watson 			recvspace = unpsp_recvspace;
53884d61770SRobert Watson 			break;
53984d61770SRobert Watson 
5406d32873cSRobert Watson 		default:
541e7c33e29SRobert Watson 			panic("uipc_attach");
5426d32873cSRobert Watson 		}
543e7c33e29SRobert Watson 		error = soreserve(so, sendspace, recvspace);
5446d32873cSRobert Watson 		if (error)
5456d32873cSRobert Watson 			return (error);
5466d32873cSRobert Watson 	}
54746a1d9bfSRobert Watson 	unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
5486d32873cSRobert Watson 	if (unp == NULL)
5496d32873cSRobert Watson 		return (ENOBUFS);
5506d32873cSRobert Watson 	LIST_INIT(&unp->unp_refs);
551e7c33e29SRobert Watson 	UNP_PCB_LOCK_INIT(unp);
5526d32873cSRobert Watson 	unp->unp_socket = so;
5536d32873cSRobert Watson 	so->so_pcb = unp;
5545362170dSMark Johnston 	refcount_init(&unp->unp_refcount, 1);
555e7c33e29SRobert Watson 
556779f106aSGleb Smirnoff 	if ((locked = UNP_LINK_WOWNED()) == false)
557779f106aSGleb Smirnoff 		UNP_LINK_WLOCK();
558779f106aSGleb Smirnoff 
5596d32873cSRobert Watson 	unp->unp_gencnt = ++unp_gencnt;
560f218ac50SMateusz Guzik 	unp->unp_ino = ++unp_ino;
5616d32873cSRobert Watson 	unp_count++;
56284d61770SRobert Watson 	switch (so->so_type) {
56384d61770SRobert Watson 	case SOCK_STREAM:
56484d61770SRobert Watson 		LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
56584d61770SRobert Watson 		break;
56684d61770SRobert Watson 
56784d61770SRobert Watson 	case SOCK_DGRAM:
56884d61770SRobert Watson 		LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
56984d61770SRobert Watson 		break;
57084d61770SRobert Watson 
57184d61770SRobert Watson 	case SOCK_SEQPACKET:
57284d61770SRobert Watson 		LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
57384d61770SRobert Watson 		break;
57484d61770SRobert Watson 
57584d61770SRobert Watson 	default:
57684d61770SRobert Watson 		panic("uipc_attach");
57784d61770SRobert Watson 	}
578779f106aSGleb Smirnoff 
579779f106aSGleb Smirnoff 	if (locked == false)
580779f106aSGleb Smirnoff 		UNP_LINK_WUNLOCK();
5816d32873cSRobert Watson 
5826d32873cSRobert Watson 	return (0);
583a29f300eSGarrett Wollman }
584a29f300eSGarrett Wollman 
585a29f300eSGarrett Wollman static int
5867493f24eSPawel Jakub Dawidek uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
587a29f300eSGarrett Wollman {
588dd47f5caSRobert Watson 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
589dd47f5caSRobert Watson 	struct vattr vattr;
5905050aa86SKonstantin Belousov 	int error, namelen;
591dd47f5caSRobert Watson 	struct nameidata nd;
59240f2ac28SRobert Watson 	struct unpcb *unp;
593dd47f5caSRobert Watson 	struct vnode *vp;
594dd47f5caSRobert Watson 	struct mount *mp;
5957008be5bSPawel Jakub Dawidek 	cap_rights_t rights;
596dd47f5caSRobert Watson 	char *buf;
597a29f300eSGarrett Wollman 
598cb7df69bSKevin Lo 	if (nam->sa_family != AF_UNIX)
599cb7df69bSKevin Lo 		return (EAFNOSUPPORT);
600cb7df69bSKevin Lo 
60140f2ac28SRobert Watson 	unp = sotounpcb(so);
6024d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
6034f1f0ef5SRobert Watson 
604a06534c3SBjoern A. Zeeb 	if (soun->sun_len > sizeof(struct sockaddr_un))
605a06534c3SBjoern A. Zeeb 		return (EINVAL);
6064f1f0ef5SRobert Watson 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
6074f1f0ef5SRobert Watson 	if (namelen <= 0)
6084f1f0ef5SRobert Watson 		return (EINVAL);
609dd47f5caSRobert Watson 
610dd47f5caSRobert Watson 	/*
6114f1f0ef5SRobert Watson 	 * We don't allow simultaneous bind() calls on a single UNIX domain
6124f1f0ef5SRobert Watson 	 * socket, so flag in-progress operations, and return an error if an
6134f1f0ef5SRobert Watson 	 * operation is already in progress.
6144f1f0ef5SRobert Watson 	 *
6154f1f0ef5SRobert Watson 	 * Historically, we have not allowed a socket to be rebound, so this
616d7924b70SRobert Watson 	 * also returns an error.  Not allowing re-binding simplifies the
617d7924b70SRobert Watson 	 * implementation and avoids a great many possible failure modes.
618dd47f5caSRobert Watson 	 */
619e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
620dd47f5caSRobert Watson 	if (unp->unp_vnode != NULL) {
621e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
622dd47f5caSRobert Watson 		return (EINVAL);
623dd47f5caSRobert Watson 	}
6244f1f0ef5SRobert Watson 	if (unp->unp_flags & UNP_BINDING) {
625e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
6264f1f0ef5SRobert Watson 		return (EALREADY);
627dd47f5caSRobert Watson 	}
6284f1f0ef5SRobert Watson 	unp->unp_flags |= UNP_BINDING;
629e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
630dd47f5caSRobert Watson 
631dd47f5caSRobert Watson 	buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
6327928893dSEd Maste 	bcopy(soun->sun_path, buf, namelen);
6337928893dSEd Maste 	buf[namelen] = 0;
634dd47f5caSRobert Watson 
635dd47f5caSRobert Watson restart:
6366c21f6edSKonstantin Belousov 	NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME | NOCACHE,
6377e1d3eefSMateusz Guzik 	    UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_BINDAT));
638dd47f5caSRobert Watson /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
639dd47f5caSRobert Watson 	error = namei(&nd);
640dd47f5caSRobert Watson 	if (error)
6414f1f0ef5SRobert Watson 		goto error;
642dd47f5caSRobert Watson 	vp = nd.ni_vp;
643dd47f5caSRobert Watson 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
644bb92cd7bSMateusz Guzik 		NDFREE_PNBUF(&nd);
645dd47f5caSRobert Watson 		if (nd.ni_dvp == vp)
646dd47f5caSRobert Watson 			vrele(nd.ni_dvp);
647dd47f5caSRobert Watson 		else
648dd47f5caSRobert Watson 			vput(nd.ni_dvp);
649dd47f5caSRobert Watson 		if (vp != NULL) {
650dd47f5caSRobert Watson 			vrele(vp);
651dd47f5caSRobert Watson 			error = EADDRINUSE;
6524f1f0ef5SRobert Watson 			goto error;
653dd47f5caSRobert Watson 		}
654dd47f5caSRobert Watson 		error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH);
655dd47f5caSRobert Watson 		if (error)
6564f1f0ef5SRobert Watson 			goto error;
657dd47f5caSRobert Watson 		goto restart;
658dd47f5caSRobert Watson 	}
659dd47f5caSRobert Watson 	VATTR_NULL(&vattr);
660dd47f5caSRobert Watson 	vattr.va_type = VSOCK;
66185078b85SConrad Meyer 	vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_pd->pd_cmask);
662dd47f5caSRobert Watson #ifdef MAC
66330d239bcSRobert Watson 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
664dd47f5caSRobert Watson 	    &vattr);
665dd47f5caSRobert Watson #endif
666885868cdSRobert Watson 	if (error == 0)
667dd47f5caSRobert Watson 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
668bb92cd7bSMateusz Guzik 	NDFREE_PNBUF(&nd);
669dd47f5caSRobert Watson 	if (error) {
6703b2aa360SKonstantin Belousov 		VOP_VPUT_PAIR(nd.ni_dvp, NULL, true);
671dd47f5caSRobert Watson 		vn_finished_write(mp);
672441eb16aSKonstantin Belousov 		if (error == ERELOOKUP)
673441eb16aSKonstantin Belousov 			goto restart;
6744f1f0ef5SRobert Watson 		goto error;
675dd47f5caSRobert Watson 	}
676dd47f5caSRobert Watson 	vp = nd.ni_vp;
67757fd3d55SPawel Jakub Dawidek 	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
678dd47f5caSRobert Watson 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
679e7c33e29SRobert Watson 
680e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
6810c3c207fSGleb Smirnoff 	VOP_UNP_BIND(vp, unp);
682dd47f5caSRobert Watson 	unp->unp_vnode = vp;
683dd47f5caSRobert Watson 	unp->unp_addr = soun;
6844f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_BINDING;
685e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
6863b2aa360SKonstantin Belousov 	vref(vp);
6873b2aa360SKonstantin Belousov 	VOP_VPUT_PAIR(nd.ni_dvp, &vp, true);
688dd47f5caSRobert Watson 	vn_finished_write(mp);
6894f1f0ef5SRobert Watson 	free(buf, M_TEMP);
6904f1f0ef5SRobert Watson 	return (0);
691e7c33e29SRobert Watson 
6924f1f0ef5SRobert Watson error:
693e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
6944f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_BINDING;
695e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
696dd47f5caSRobert Watson 	free(buf, M_TEMP);
69740f2ac28SRobert Watson 	return (error);
698a29f300eSGarrett Wollman }
699a29f300eSGarrett Wollman 
700a29f300eSGarrett Wollman static int
7017493f24eSPawel Jakub Dawidek uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
7027493f24eSPawel Jakub Dawidek {
7037493f24eSPawel Jakub Dawidek 
7047493f24eSPawel Jakub Dawidek 	return (uipc_bindat(AT_FDCWD, so, nam, td));
7057493f24eSPawel Jakub Dawidek }
7067493f24eSPawel Jakub Dawidek 
7077493f24eSPawel Jakub Dawidek static int
708b40ce416SJulian Elischer uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
709a29f300eSGarrett Wollman {
7100d9ce3a1SRobert Watson 	int error;
711a29f300eSGarrett Wollman 
712fd179ee9SRobert Watson 	KASSERT(td == curthread, ("uipc_connect: td != curthread"));
713fd179ee9SRobert Watson 	error = unp_connect(so, nam, td);
7140d9ce3a1SRobert Watson 	return (error);
715a29f300eSGarrett Wollman }
716a29f300eSGarrett Wollman 
7177493f24eSPawel Jakub Dawidek static int
7187493f24eSPawel Jakub Dawidek uipc_connectat(int fd, struct socket *so, struct sockaddr *nam,
7197493f24eSPawel Jakub Dawidek     struct thread *td)
7207493f24eSPawel Jakub Dawidek {
7217493f24eSPawel Jakub Dawidek 	int error;
7227493f24eSPawel Jakub Dawidek 
7237493f24eSPawel Jakub Dawidek 	KASSERT(td == curthread, ("uipc_connectat: td != curthread"));
7247493f24eSPawel Jakub Dawidek 	error = unp_connectat(fd, so, nam, td);
7257493f24eSPawel Jakub Dawidek 	return (error);
7267493f24eSPawel Jakub Dawidek }
7277493f24eSPawel Jakub Dawidek 
728a152f8a3SRobert Watson static void
729a152f8a3SRobert Watson uipc_close(struct socket *so)
730a152f8a3SRobert Watson {
731e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
732779f106aSGleb Smirnoff 	struct vnode *vp = NULL;
73375a67bf3SMatt Macy 	struct mtx *vplock;
734ccdadf1aSMark Johnston 
735a152f8a3SRobert Watson 	unp = sotounpcb(so);
736a152f8a3SRobert Watson 	KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
737e7c33e29SRobert Watson 
73875a67bf3SMatt Macy 	vplock = NULL;
73975a67bf3SMatt Macy 	if ((vp = unp->unp_vnode) != NULL) {
74075a67bf3SMatt Macy 		vplock = mtx_pool_find(mtxpool_sleep, vp);
74175a67bf3SMatt Macy 		mtx_lock(vplock);
742e7c33e29SRobert Watson 	}
74375a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
74475a67bf3SMatt Macy 	if (vp && unp->unp_vnode == NULL) {
74575a67bf3SMatt Macy 		mtx_unlock(vplock);
74675a67bf3SMatt Macy 		vp = NULL;
74775a67bf3SMatt Macy 	}
74875a67bf3SMatt Macy 	if (vp != NULL) {
749779f106aSGleb Smirnoff 		VOP_UNP_DETACH(vp);
750779f106aSGleb Smirnoff 		unp->unp_vnode = NULL;
751779f106aSGleb Smirnoff 	}
752ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
753acf9fd05SMatt Macy 		unp_disconnect(unp, unp2);
754ccdadf1aSMark Johnston 	else
755e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
75675a67bf3SMatt Macy 	if (vp) {
75775a67bf3SMatt Macy 		mtx_unlock(vplock);
758779f106aSGleb Smirnoff 		vrele(vp);
759a152f8a3SRobert Watson 	}
76075a67bf3SMatt Macy }
761a152f8a3SRobert Watson 
7622c899584SRobert Watson static int
763a29f300eSGarrett Wollman uipc_connect2(struct socket *so1, struct socket *so2)
764a29f300eSGarrett Wollman {
765e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
76608f17d14SGleb Smirnoff 
76708f17d14SGleb Smirnoff 	if (so1->so_type != so2->so_type)
76808f17d14SGleb Smirnoff 		return (EPROTOTYPE);
769a29f300eSGarrett Wollman 
770e7c33e29SRobert Watson 	unp = so1->so_pcb;
7714d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
772e7c33e29SRobert Watson 	unp2 = so2->so_pcb;
773e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
7744820bf6aSMark Johnston 	unp_pcb_lock_pair(unp, unp2);
77508f17d14SGleb Smirnoff 	unp_connect2(so1, so2, PRU_CONNECT2);
7764820bf6aSMark Johnston 	unp_pcb_unlock_pair(unp, unp2);
77708f17d14SGleb Smirnoff 
77808f17d14SGleb Smirnoff 	return (0);
779a29f300eSGarrett Wollman }
780a29f300eSGarrett Wollman 
781bc725eafSRobert Watson static void
782a29f300eSGarrett Wollman uipc_detach(struct socket *so)
783a29f300eSGarrett Wollman {
784e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
78575a67bf3SMatt Macy 	struct mtx *vplock;
7866d32873cSRobert Watson 	struct vnode *vp;
787ccdadf1aSMark Johnston 	int local_unp_rights;
788a29f300eSGarrett Wollman 
78940f2ac28SRobert Watson 	unp = sotounpcb(so);
7904d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
791e7c33e29SRobert Watson 
792434ac8b6SMark Johnston 	vp = NULL;
793c0874c34SMatt Macy 	vplock = NULL;
794434ac8b6SMark Johnston 
795779f106aSGleb Smirnoff 	UNP_LINK_WLOCK();
7966d32873cSRobert Watson 	LIST_REMOVE(unp, unp_link);
797a9aa06f7SJason A. Harmening 	if (unp->unp_gcflag & UNPGC_DEAD)
798a9aa06f7SJason A. Harmening 		LIST_REMOVE(unp, unp_dead);
7996d32873cSRobert Watson 	unp->unp_gencnt = ++unp_gencnt;
8006d32873cSRobert Watson 	--unp_count;
80175a67bf3SMatt Macy 	UNP_LINK_WUNLOCK();
802434ac8b6SMark Johnston 
80375a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp);
80475a67bf3SMatt Macy  restart:
80575a67bf3SMatt Macy 	if ((vp = unp->unp_vnode) != NULL) {
80675a67bf3SMatt Macy 		vplock = mtx_pool_find(mtxpool_sleep, vp);
80775a67bf3SMatt Macy 		mtx_lock(vplock);
80875a67bf3SMatt Macy 	}
80975a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
810db38b699SMark Johnston 	if (unp->unp_vnode != vp && unp->unp_vnode != NULL) {
811c0874c34SMatt Macy 		if (vplock)
81275a67bf3SMatt Macy 			mtx_unlock(vplock);
81375a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
81475a67bf3SMatt Macy 		goto restart;
81575a67bf3SMatt Macy 	}
8166d32873cSRobert Watson 	if ((vp = unp->unp_vnode) != NULL) {
817c7e41c8bSMikolaj Golub 		VOP_UNP_DETACH(vp);
8186d32873cSRobert Watson 		unp->unp_vnode = NULL;
8196d32873cSRobert Watson 	}
820ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
821e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
822f0317f86SMark Johnston 	else
82375a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
824ccdadf1aSMark Johnston 
82575a67bf3SMatt Macy 	UNP_REF_LIST_LOCK();
8266d32873cSRobert Watson 	while (!LIST_EMPTY(&unp->unp_refs)) {
8276d32873cSRobert Watson 		struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
828e7c33e29SRobert Watson 
82975a67bf3SMatt Macy 		unp_pcb_hold(ref);
83075a67bf3SMatt Macy 		UNP_REF_LIST_UNLOCK();
83175a67bf3SMatt Macy 
83275a67bf3SMatt Macy 		MPASS(ref != unp);
83375a67bf3SMatt Macy 		UNP_PCB_UNLOCK_ASSERT(ref);
834afc055d9SEd Schouten 		unp_drop(ref);
83575a67bf3SMatt Macy 		UNP_REF_LIST_LOCK();
8366d32873cSRobert Watson 	}
83775a67bf3SMatt Macy 	UNP_REF_LIST_UNLOCK();
838ccdadf1aSMark Johnston 
83975a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
840397c19d1SJeff Roberson 	local_unp_rights = unp_rights;
8416d32873cSRobert Watson 	unp->unp_socket->so_pcb = NULL;
84275a67bf3SMatt Macy 	unp->unp_socket = NULL;
843db38b699SMark Johnston 	free(unp->unp_addr, M_SONAME);
844db38b699SMark Johnston 	unp->unp_addr = NULL;
845db38b699SMark Johnston 	if (!unp_pcb_rele(unp))
8466e2faa24SRobert Watson 		UNP_PCB_UNLOCK(unp);
84775a67bf3SMatt Macy 	if (vp) {
84875a67bf3SMatt Macy 		mtx_unlock(vplock);
8496d32873cSRobert Watson 		vrele(vp);
85075a67bf3SMatt Macy 	}
8516d32873cSRobert Watson 	if (local_unp_rights)
852daee0f0bSKonstantin Belousov 		taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
853a29f300eSGarrett Wollman }
854a29f300eSGarrett Wollman 
855a29f300eSGarrett Wollman static int
856a29f300eSGarrett Wollman uipc_disconnect(struct socket *so)
857a29f300eSGarrett Wollman {
858e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
859a29f300eSGarrett Wollman 
86040f2ac28SRobert Watson 	unp = sotounpcb(so);
8614d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
862e7c33e29SRobert Watson 
863e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
864ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
86575a67bf3SMatt Macy 		unp_disconnect(unp, unp2);
866ccdadf1aSMark Johnston 	else
867ccdadf1aSMark Johnston 		UNP_PCB_UNLOCK(unp);
868e5aeaa0cSDag-Erling Smørgrav 	return (0);
869a29f300eSGarrett Wollman }
870a29f300eSGarrett Wollman 
871a29f300eSGarrett Wollman static int
872d374e81eSRobert Watson uipc_listen(struct socket *so, int backlog, struct thread *td)
873a29f300eSGarrett Wollman {
87440f2ac28SRobert Watson 	struct unpcb *unp;
8750d9ce3a1SRobert Watson 	int error;
876a29f300eSGarrett Wollman 
87701235012SGleb Smirnoff 	MPASS(so->so_type != SOCK_DGRAM);
878beb4b312SGleb Smirnoff 
879bd4a39ccSMark Johnston 	/*
880bd4a39ccSMark Johnston 	 * Synchronize with concurrent connection attempts.
881bd4a39ccSMark Johnston 	 */
882bd4a39ccSMark Johnston 	error = 0;
88340f2ac28SRobert Watson 	unp = sotounpcb(so);
884e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
885bd4a39ccSMark Johnston 	if (unp->unp_conn != NULL || (unp->unp_flags & UNP_CONNECTING) != 0)
886bd4a39ccSMark Johnston 		error = EINVAL;
887bd4a39ccSMark Johnston 	else if (unp->unp_vnode == NULL)
888bd4a39ccSMark Johnston 		error = EDESTADDRREQ;
889bd4a39ccSMark Johnston 	if (error != 0) {
890e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
89147a84387SEd Schouten 		return (error);
89240f2ac28SRobert Watson 	}
893e7c33e29SRobert Watson 
894e7c33e29SRobert Watson 	SOCK_LOCK(so);
895e7c33e29SRobert Watson 	error = solisten_proto_check(so);
896e7c33e29SRobert Watson 	if (error == 0) {
897c5afec6eSDmitry Chagin 		cru2xt(td, &unp->unp_peercred);
898e7c33e29SRobert Watson 		solisten_proto(so, backlog);
899e7c33e29SRobert Watson 	}
900e7c33e29SRobert Watson 	SOCK_UNLOCK(so);
901e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
9020d9ce3a1SRobert Watson 	return (error);
903a29f300eSGarrett Wollman }
904a29f300eSGarrett Wollman 
905a29f300eSGarrett Wollman static int
90657bf258eSGarrett Wollman uipc_peeraddr(struct socket *so, struct sockaddr **nam)
907a29f300eSGarrett Wollman {
908e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
9090d9ce3a1SRobert Watson 	const struct sockaddr *sa;
910a29f300eSGarrett Wollman 
9114d4b555eSRobert Watson 	unp = sotounpcb(so);
9124d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
913e7c33e29SRobert Watson 
9140d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
915afd9f91cSJohn Baldwin 	UNP_LINK_RLOCK();
916bdc5f6a3SHajimu UMEMOTO 	/*
917e7c33e29SRobert Watson 	 * XXX: It seems that this test always fails even when connection is
918e7c33e29SRobert Watson 	 * established.  So, this else clause is added as workaround to
919e7c33e29SRobert Watson 	 * return PF_LOCAL sockaddr.
920bdc5f6a3SHajimu UMEMOTO 	 */
921e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
922e7c33e29SRobert Watson 	if (unp2 != NULL) {
923e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
924e7c33e29SRobert Watson 		if (unp2->unp_addr != NULL)
925afd9f91cSJohn Baldwin 			sa = (struct sockaddr *) unp2->unp_addr;
926e7c33e29SRobert Watson 		else
9270d9ce3a1SRobert Watson 			sa = &sun_noname;
9280d9ce3a1SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
929e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
930e7c33e29SRobert Watson 	} else {
931e7c33e29SRobert Watson 		sa = &sun_noname;
932e7c33e29SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
933e7c33e29SRobert Watson 	}
934afd9f91cSJohn Baldwin 	UNP_LINK_RUNLOCK();
935e5aeaa0cSDag-Erling Smørgrav 	return (0);
936a29f300eSGarrett Wollman }
937a29f300eSGarrett Wollman 
938a29f300eSGarrett Wollman static int
939a29f300eSGarrett Wollman uipc_rcvd(struct socket *so, int flags)
940a29f300eSGarrett Wollman {
941e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
942a29f300eSGarrett Wollman 	struct socket *so2;
943337cc6b6SRobert Watson 	u_int mbcnt, sbcc;
944a29f300eSGarrett Wollman 
94540f2ac28SRobert Watson 	unp = sotounpcb(so);
9462b21d0e8SGleb Smirnoff 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
9472b21d0e8SGleb Smirnoff 	KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET,
9482b21d0e8SGleb Smirnoff 	    ("%s: socktype %d", __func__, so->so_type));
949e7c33e29SRobert Watson 
950df8bae1dSRodney W. Grimes 	/*
951e7c33e29SRobert Watson 	 * Adjust backpressure on sender and wakeup any waiting to write.
952e7c33e29SRobert Watson 	 *
953d7924b70SRobert Watson 	 * The unp lock is acquired to maintain the validity of the unp_conn
954d7924b70SRobert Watson 	 * pointer; no lock on unp2 is required as unp2->unp_socket will be
955d7924b70SRobert Watson 	 * static as long as we don't permit unp2 to disconnect from unp,
956d7924b70SRobert Watson 	 * which is prevented by the lock on unp.  We cache values from
957d7924b70SRobert Watson 	 * so_rcv to avoid holding the so_rcv lock over the entire
958d7924b70SRobert Watson 	 * transaction on the remote so_snd.
959df8bae1dSRodney W. Grimes 	 */
960337cc6b6SRobert Watson 	SOCKBUF_LOCK(&so->so_rcv);
961337cc6b6SRobert Watson 	mbcnt = so->so_rcv.sb_mbcnt;
9622b21d0e8SGleb Smirnoff 	sbcc = sbavail(&so->so_rcv);
963337cc6b6SRobert Watson 	SOCKBUF_UNLOCK(&so->so_rcv);
964c2090e73SAlan Somers 	/*
965c2090e73SAlan Somers 	 * There is a benign race condition at this point.  If we're planning to
966c2090e73SAlan Somers 	 * clear SB_STOP, but uipc_send is called on the connected socket at
967c2090e73SAlan Somers 	 * this instant, it might add data to the sockbuf and set SB_STOP.  Then
968c2090e73SAlan Somers 	 * we would erroneously clear SB_STOP below, even though the sockbuf is
969c2090e73SAlan Somers 	 * full.  The race is benign because the only ill effect is to allow the
970c2090e73SAlan Somers 	 * sockbuf to exceed its size limit, and the size limits are not
971c2090e73SAlan Somers 	 * strictly guaranteed anyway.
972c2090e73SAlan Somers 	 */
973e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
974e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
975e7c33e29SRobert Watson 	if (unp2 == NULL) {
976e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
977e7c33e29SRobert Watson 		return (0);
978337cc6b6SRobert Watson 	}
979e7c33e29SRobert Watson 	so2 = unp2->unp_socket;
980337cc6b6SRobert Watson 	SOCKBUF_LOCK(&so2->so_snd);
981c2090e73SAlan Somers 	if (sbcc < so2->so_snd.sb_hiwat && mbcnt < so2->so_snd.sb_mbmax)
982c2090e73SAlan Somers 		so2->so_snd.sb_flags &= ~SB_STOP;
9831e4d7da7SRobert Watson 	sowwakeup_locked(so2);
984e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
985e5aeaa0cSDag-Erling Smørgrav 	return (0);
986a29f300eSGarrett Wollman }
987df8bae1dSRodney W. Grimes 
988a29f300eSGarrett Wollman static int
98957bf258eSGarrett Wollman uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
990b40ce416SJulian Elischer     struct mbuf *control, struct thread *td)
991a29f300eSGarrett Wollman {
992f3f49bbbSRobert Watson 	struct unpcb *unp, *unp2;
993a29f300eSGarrett Wollman 	struct socket *so2;
994c2090e73SAlan Somers 	u_int mbcnt, sbcc;
99542188bb5SMark Johnston 	int error;
996a29f300eSGarrett Wollman 
99740f2ac28SRobert Watson 	unp = sotounpcb(so);
9982b21d0e8SGleb Smirnoff 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
9992b21d0e8SGleb Smirnoff 	KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM ||
10002b21d0e8SGleb Smirnoff 	    so->so_type == SOCK_SEQPACKET,
10012b21d0e8SGleb Smirnoff 	    ("%s: socktype %d", __func__, so->so_type));
1002e7c33e29SRobert Watson 
100342188bb5SMark Johnston 	error = 0;
1004a29f300eSGarrett Wollman 	if (flags & PRUS_OOB) {
1005a29f300eSGarrett Wollman 		error = EOPNOTSUPP;
1006a29f300eSGarrett Wollman 		goto release;
1007a29f300eSGarrett Wollman 	}
1008fc3fcacfSRobert Watson 	if (control != NULL && (error = unp_internalize(&control, td)))
1009a29f300eSGarrett Wollman 		goto release;
101075a67bf3SMatt Macy 
101175a67bf3SMatt Macy 	unp2 = NULL;
1012a29f300eSGarrett Wollman 	switch (so->so_type) {
1013a29f300eSGarrett Wollman 	case SOCK_DGRAM:
1014a29f300eSGarrett Wollman 	{
1015e7dd9a10SRobert Watson 		const struct sockaddr *from;
1016df8bae1dSRodney W. Grimes 
1017fc3fcacfSRobert Watson 		if (nam != NULL) {
1018ccdadf1aSMark Johnston 			error = unp_connect(so, nam, td);
1019ccdadf1aSMark Johnston 			if (error != 0)
1020df8bae1dSRodney W. Grimes 				break;
1021ccdadf1aSMark Johnston 		}
102275a67bf3SMatt Macy 		UNP_PCB_LOCK(unp);
102360a5ef26SRobert Watson 
1024b5ff0914SRobert Watson 		/*
1025b5ff0914SRobert Watson 		 * Because connect() and send() are non-atomic in a sendto()
1026b5ff0914SRobert Watson 		 * with a target address, it's possible that the socket will
1027b5ff0914SRobert Watson 		 * have disconnected before the send() can run.  In that case
1028b5ff0914SRobert Watson 		 * return the slightly counter-intuitive but otherwise
1029b5ff0914SRobert Watson 		 * correct error that the socket is not connected.
1030b5ff0914SRobert Watson 		 */
1031ccdadf1aSMark Johnston 		unp2 = unp_pcb_lock_peer(unp);
1032ccdadf1aSMark Johnston 		if (unp2 == NULL) {
103375a67bf3SMatt Macy 			UNP_PCB_UNLOCK(unp);
1034b5ff0914SRobert Watson 			error = ENOTCONN;
1035b5ff0914SRobert Watson 			break;
1036b5ff0914SRobert Watson 		}
1037ccdadf1aSMark Johnston 
10382de07e40SConrad Meyer 		if (unp2->unp_flags & UNP_WANTCRED_MASK)
1039ede4af47SConrad Meyer 			control = unp_addsockcred(td, control,
1040ede4af47SConrad Meyer 			    unp2->unp_flags);
1041fc3fcacfSRobert Watson 		if (unp->unp_addr != NULL)
104257bf258eSGarrett Wollman 			from = (struct sockaddr *)unp->unp_addr;
1043df8bae1dSRodney W. Grimes 		else
1044df8bae1dSRodney W. Grimes 			from = &sun_noname;
1045ede6e136SRobert Watson 		so2 = unp2->unp_socket;
1046a34b7046SRobert Watson 		SOCKBUF_LOCK(&so2->so_rcv);
10476dde7ecbSPeter Wemm 		if (sbappendaddr_locked(&so2->so_rcv, from, m,
10488de34a88SAlan Somers 		    control)) {
10491e4d7da7SRobert Watson 			sorwakeup_locked(so2);
1050fc3fcacfSRobert Watson 			m = NULL;
1051fc3fcacfSRobert Watson 			control = NULL;
1052e5aeaa0cSDag-Erling Smørgrav 		} else {
10537045b160SRoy Marples 			soroverflow_locked(so2);
105465572cadSGleb Smirnoff 			error = (so->so_state & SS_NBIO) ? EAGAIN : ENOBUFS;
1055e5aeaa0cSDag-Erling Smørgrav 		}
105675a67bf3SMatt Macy 		if (nam != NULL)
1057e7c33e29SRobert Watson 			unp_disconnect(unp, unp2);
1058f0317f86SMark Johnston 		else
1059f0317f86SMark Johnston 			unp_pcb_unlock_pair(unp, unp2);
1060df8bae1dSRodney W. Grimes 		break;
1061df8bae1dSRodney W. Grimes 	}
1062df8bae1dSRodney W. Grimes 
106384d61770SRobert Watson 	case SOCK_SEQPACKET:
1064df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
1065402cc72dSDavid Greenman 		if ((so->so_state & SS_ISCONNECTED) == 0) {
1066fc3fcacfSRobert Watson 			if (nam != NULL) {
1067ccdadf1aSMark Johnston 				error = unp_connect(so, nam, td);
1068b36871afSMark Johnston 				if (error != 0)
106975a67bf3SMatt Macy 					break;
1070402cc72dSDavid Greenman 			} else {
1071402cc72dSDavid Greenman 				error = ENOTCONN;
1072402cc72dSDavid Greenman 				break;
1073402cc72dSDavid Greenman 			}
1074b36871afSMark Johnston 		}
1075b36871afSMark Johnston 
1076ccdadf1aSMark Johnston 		UNP_PCB_LOCK(unp);
1077ccdadf1aSMark Johnston 		if ((unp2 = unp_pcb_lock_peer(unp)) == NULL) {
107875a67bf3SMatt Macy 			UNP_PCB_UNLOCK(unp);
1079b5ff0914SRobert Watson 			error = ENOTCONN;
1080b5ff0914SRobert Watson 			break;
1081b36871afSMark Johnston 		} else if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1082ccdadf1aSMark Johnston 			unp_pcb_unlock_pair(unp, unp2);
1083b36871afSMark Johnston 			error = EPIPE;
1084b36871afSMark Johnston 			break;
108575a67bf3SMatt Macy 		}
108675a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
108775a67bf3SMatt Macy 		if ((so2 = unp2->unp_socket) == NULL) {
108875a67bf3SMatt Macy 			UNP_PCB_UNLOCK(unp2);
108975a67bf3SMatt Macy 			error = ENOTCONN;
109075a67bf3SMatt Macy 			break;
109175a67bf3SMatt Macy 		}
1092a34b7046SRobert Watson 		SOCKBUF_LOCK(&so2->so_rcv);
10932de07e40SConrad Meyer 		if (unp2->unp_flags & UNP_WANTCRED_MASK) {
10946a2989fdSMatthew N. Dodd 			/*
10952de07e40SConrad Meyer 			 * Credentials are passed only once on SOCK_STREAM and
10962de07e40SConrad Meyer 			 * SOCK_SEQPACKET (LOCAL_CREDS => WANTCRED_ONESHOT), or
10972de07e40SConrad Meyer 			 * forever (LOCAL_CREDS_PERSISTENT => WANTCRED_ALWAYS).
10986a2989fdSMatthew N. Dodd 			 */
1099ede4af47SConrad Meyer 			control = unp_addsockcred(td, control, unp2->unp_flags);
11002de07e40SConrad Meyer 			unp2->unp_flags &= ~UNP_WANTCRED_ONESHOT;
11016a2989fdSMatthew N. Dodd 		}
11025b0480f2SMark Johnston 
1103df8bae1dSRodney W. Grimes 		/*
11045b0480f2SMark Johnston 		 * Send to paired receive port and wake up readers.  Don't
11055b0480f2SMark Johnston 		 * check for space available in the receive buffer if we're
11065b0480f2SMark Johnston 		 * attaching ancillary data; Unix domain sockets only check
11075b0480f2SMark Johnston 		 * for space in the sending sockbuf, and that check is
11085b0480f2SMark Johnston 		 * performed one level up the stack.  At that level we cannot
11095b0480f2SMark Johnston 		 * precisely account for the amount of buffer space used
11105b0480f2SMark Johnston 		 * (e.g., because control messages are not yet internalized).
1111df8bae1dSRodney W. Grimes 		 */
111284d61770SRobert Watson 		switch (so->so_type) {
111384d61770SRobert Watson 		case SOCK_STREAM:
1114fc3fcacfSRobert Watson 			if (control != NULL) {
11155b0480f2SMark Johnston 				sbappendcontrol_locked(&so2->so_rcv, m,
111625f4ddfbSMark Johnston 				    control, flags);
1117fc3fcacfSRobert Watson 				control = NULL;
1118e7c33e29SRobert Watson 			} else
1119829fae90SGleb Smirnoff 				sbappend_locked(&so2->so_rcv, m, flags);
112084d61770SRobert Watson 			break;
112184d61770SRobert Watson 
1122b36871afSMark Johnston 		case SOCK_SEQPACKET:
11238de34a88SAlan Somers 			if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
1124b36871afSMark Johnston 			    &sun_noname, m, control))
112584d61770SRobert Watson 				control = NULL;
112684d61770SRobert Watson 			break;
112784d61770SRobert Watson 		}
112884d61770SRobert Watson 
1129c2090e73SAlan Somers 		mbcnt = so2->so_rcv.sb_mbcnt;
11302b21d0e8SGleb Smirnoff 		sbcc = sbavail(&so2->so_rcv);
11312b21d0e8SGleb Smirnoff 		if (sbcc)
1132337cc6b6SRobert Watson 			sorwakeup_locked(so2);
11332b21d0e8SGleb Smirnoff 		else
11342b21d0e8SGleb Smirnoff 			SOCKBUF_UNLOCK(&so2->so_rcv);
1135337cc6b6SRobert Watson 
1136c2090e73SAlan Somers 		/*
1137c2090e73SAlan Somers 		 * The PCB lock on unp2 protects the SB_STOP flag.  Without it,
1138c2090e73SAlan Somers 		 * it would be possible for uipc_rcvd to be called at this
1139c2090e73SAlan Somers 		 * point, drain the receiving sockbuf, clear SB_STOP, and then
1140c2090e73SAlan Somers 		 * we would set SB_STOP below.  That could lead to an empty
1141c2090e73SAlan Somers 		 * sockbuf having SB_STOP set
1142c2090e73SAlan Somers 		 */
1143337cc6b6SRobert Watson 		SOCKBUF_LOCK(&so->so_snd);
1144c2090e73SAlan Somers 		if (sbcc >= so->so_snd.sb_hiwat || mbcnt >= so->so_snd.sb_mbmax)
1145c2090e73SAlan Somers 			so->so_snd.sb_flags |= SB_STOP;
11467abe2ac2SAlan Cox 		SOCKBUF_UNLOCK(&so->so_snd);
1147e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
1148fc3fcacfSRobert Watson 		m = NULL;
1149df8bae1dSRodney W. Grimes 		break;
1150df8bae1dSRodney W. Grimes 	}
1151a29f300eSGarrett Wollman 
11526b8fda4dSGarrett Wollman 	/*
115360a5ef26SRobert Watson 	 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown.
11546b8fda4dSGarrett Wollman 	 */
1155a29f300eSGarrett Wollman 	if (flags & PRUS_EOF) {
1156ede6e136SRobert Watson 		UNP_PCB_LOCK(unp);
11576b8fda4dSGarrett Wollman 		socantsendmore(so);
11586b8fda4dSGarrett Wollman 		unp_shutdown(unp);
1159e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
1160ede6e136SRobert Watson 	}
1161fc3fcacfSRobert Watson 	if (control != NULL && error != 0)
1162eac7f079SGleb Smirnoff 		unp_scan(control, unp_freerights);
1163bd508d39SDon Lewis 
1164a29f300eSGarrett Wollman release:
1165fc3fcacfSRobert Watson 	if (control != NULL)
1166a29f300eSGarrett Wollman 		m_freem(control);
1167100db364SGleb Smirnoff 	/*
1168100db364SGleb Smirnoff 	 * In case of PRUS_NOTREADY, uipc_ready() is responsible
1169100db364SGleb Smirnoff 	 * for freeing memory.
1170100db364SGleb Smirnoff 	 */
1171100db364SGleb Smirnoff 	if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1172a29f300eSGarrett Wollman 		m_freem(m);
1173e5aeaa0cSDag-Erling Smørgrav 	return (error);
1174a29f300eSGarrett Wollman }
1175df8bae1dSRodney W. Grimes 
1176a50b1900SMark Johnston static bool
1177a50b1900SMark Johnston uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp)
1178a50b1900SMark Johnston {
1179a50b1900SMark Johnston 	struct mbuf *mb, *n;
1180a50b1900SMark Johnston 	struct sockbuf *sb;
1181a50b1900SMark Johnston 
1182a50b1900SMark Johnston 	SOCK_LOCK(so);
1183a50b1900SMark Johnston 	if (SOLISTENING(so)) {
1184a50b1900SMark Johnston 		SOCK_UNLOCK(so);
1185a50b1900SMark Johnston 		return (false);
1186a50b1900SMark Johnston 	}
1187a50b1900SMark Johnston 	mb = NULL;
1188a50b1900SMark Johnston 	sb = &so->so_rcv;
1189a50b1900SMark Johnston 	SOCKBUF_LOCK(sb);
1190a50b1900SMark Johnston 	if (sb->sb_fnrdy != NULL) {
1191a50b1900SMark Johnston 		for (mb = sb->sb_mb, n = mb->m_nextpkt; mb != NULL;) {
1192a50b1900SMark Johnston 			if (mb == m) {
1193a50b1900SMark Johnston 				*errorp = sbready(sb, m, count);
1194a50b1900SMark Johnston 				break;
1195a50b1900SMark Johnston 			}
1196a50b1900SMark Johnston 			mb = mb->m_next;
1197a50b1900SMark Johnston 			if (mb == NULL) {
1198a50b1900SMark Johnston 				mb = n;
11991b778ba2SMark Johnston 				if (mb != NULL)
1200a50b1900SMark Johnston 					n = mb->m_nextpkt;
1201a50b1900SMark Johnston 			}
1202a50b1900SMark Johnston 		}
1203a50b1900SMark Johnston 	}
1204a50b1900SMark Johnston 	SOCKBUF_UNLOCK(sb);
1205a50b1900SMark Johnston 	SOCK_UNLOCK(so);
1206a50b1900SMark Johnston 	return (mb != NULL);
1207a50b1900SMark Johnston }
1208a50b1900SMark Johnston 
1209a29f300eSGarrett Wollman static int
1210c80ea19bSGleb Smirnoff uipc_ready(struct socket *so, struct mbuf *m, int count)
1211c80ea19bSGleb Smirnoff {
1212c80ea19bSGleb Smirnoff 	struct unpcb *unp, *unp2;
1213c80ea19bSGleb Smirnoff 	struct socket *so2;
1214a50b1900SMark Johnston 	int error, i;
1215c80ea19bSGleb Smirnoff 
1216c80ea19bSGleb Smirnoff 	unp = sotounpcb(so);
1217c80ea19bSGleb Smirnoff 
1218a50b1900SMark Johnston 	KASSERT(so->so_type == SOCK_STREAM,
1219a50b1900SMark Johnston 	    ("%s: unexpected socket type for %p", __func__, so));
1220a50b1900SMark Johnston 
1221a62b4665SMatt Macy 	UNP_PCB_LOCK(unp);
1222ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
1223a62b4665SMatt Macy 		UNP_PCB_UNLOCK(unp);
1224c80ea19bSGleb Smirnoff 		so2 = unp2->unp_socket;
1225c80ea19bSGleb Smirnoff 		SOCKBUF_LOCK(&so2->so_rcv);
1226c80ea19bSGleb Smirnoff 		if ((error = sbready(&so2->so_rcv, m, count)) == 0)
1227c80ea19bSGleb Smirnoff 			sorwakeup_locked(so2);
1228c80ea19bSGleb Smirnoff 		else
1229c80ea19bSGleb Smirnoff 			SOCKBUF_UNLOCK(&so2->so_rcv);
1230c80ea19bSGleb Smirnoff 		UNP_PCB_UNLOCK(unp2);
1231c80ea19bSGleb Smirnoff 		return (error);
1232ccdadf1aSMark Johnston 	}
1233ccdadf1aSMark Johnston 	UNP_PCB_UNLOCK(unp);
1234a50b1900SMark Johnston 
1235a50b1900SMark Johnston 	/*
1236a50b1900SMark Johnston 	 * The receiving socket has been disconnected, but may still be valid.
1237a50b1900SMark Johnston 	 * In this case, the now-ready mbufs are still present in its socket
1238a50b1900SMark Johnston 	 * buffer, so perform an exhaustive search before giving up and freeing
1239a50b1900SMark Johnston 	 * the mbufs.
1240a50b1900SMark Johnston 	 */
1241a50b1900SMark Johnston 	UNP_LINK_RLOCK();
1242a50b1900SMark Johnston 	LIST_FOREACH(unp, &unp_shead, unp_link) {
1243a50b1900SMark Johnston 		if (uipc_ready_scan(unp->unp_socket, m, count, &error))
1244a50b1900SMark Johnston 			break;
1245a50b1900SMark Johnston 	}
1246a50b1900SMark Johnston 	UNP_LINK_RUNLOCK();
1247a50b1900SMark Johnston 
1248a50b1900SMark Johnston 	if (unp == NULL) {
1249a50b1900SMark Johnston 		for (i = 0; i < count; i++)
1250a62b4665SMatt Macy 			m = m_free(m);
1251a50b1900SMark Johnston 		error = ECONNRESET;
1252a50b1900SMark Johnston 	}
1253a50b1900SMark Johnston 	return (error);
1254c80ea19bSGleb Smirnoff }
1255c80ea19bSGleb Smirnoff 
1256c80ea19bSGleb Smirnoff static int
1257a29f300eSGarrett Wollman uipc_sense(struct socket *so, struct stat *sb)
1258a29f300eSGarrett Wollman {
1259c2090e73SAlan Somers 	struct unpcb *unp;
1260a29f300eSGarrett Wollman 
126140f2ac28SRobert Watson 	unp = sotounpcb(so);
12624d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1263e7c33e29SRobert Watson 
1264a29f300eSGarrett Wollman 	sb->st_blksize = so->so_snd.sb_hiwat;
1265f3732fd1SPoul-Henning Kamp 	sb->st_dev = NODEV;
1266a29f300eSGarrett Wollman 	sb->st_ino = unp->unp_ino;
1267df8bae1dSRodney W. Grimes 	return (0);
1268a29f300eSGarrett Wollman }
1269df8bae1dSRodney W. Grimes 
1270a29f300eSGarrett Wollman static int
1271a29f300eSGarrett Wollman uipc_shutdown(struct socket *so)
1272a29f300eSGarrett Wollman {
127340f2ac28SRobert Watson 	struct unpcb *unp;
1274df8bae1dSRodney W. Grimes 
127540f2ac28SRobert Watson 	unp = sotounpcb(so);
12764d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
1277e7c33e29SRobert Watson 
1278e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1279a29f300eSGarrett Wollman 	socantsendmore(so);
1280a29f300eSGarrett Wollman 	unp_shutdown(unp);
1281e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1282e5aeaa0cSDag-Erling Smørgrav 	return (0);
1283a29f300eSGarrett Wollman }
1284df8bae1dSRodney W. Grimes 
1285a29f300eSGarrett Wollman static int
128657bf258eSGarrett Wollman uipc_sockaddr(struct socket *so, struct sockaddr **nam)
1287a29f300eSGarrett Wollman {
128840f2ac28SRobert Watson 	struct unpcb *unp;
12890d9ce3a1SRobert Watson 	const struct sockaddr *sa;
1290a29f300eSGarrett Wollman 
12914d4b555eSRobert Watson 	unp = sotounpcb(so);
12924d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1293e7c33e29SRobert Watson 
12940d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1295e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1296fc3fcacfSRobert Watson 	if (unp->unp_addr != NULL)
12970d9ce3a1SRobert Watson 		sa = (struct sockaddr *) unp->unp_addr;
129883f3198bSThomas Moestl 	else
12990d9ce3a1SRobert Watson 		sa = &sun_noname;
13000d9ce3a1SRobert Watson 	bcopy(sa, *nam, sa->sa_len);
1301e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1302e5aeaa0cSDag-Erling Smørgrav 	return (0);
1303df8bae1dSRodney W. Grimes }
1304a29f300eSGarrett Wollman 
1305fa9402f2SRobert Watson static struct pr_usrreqs uipc_usrreqs_dgram = {
1306756d52a1SPoul-Henning Kamp 	.pru_abort = 		uipc_abort,
1307756d52a1SPoul-Henning Kamp 	.pru_accept =		uipc_accept,
1308756d52a1SPoul-Henning Kamp 	.pru_attach =		uipc_attach,
1309756d52a1SPoul-Henning Kamp 	.pru_bind =		uipc_bind,
13107493f24eSPawel Jakub Dawidek 	.pru_bindat =		uipc_bindat,
1311756d52a1SPoul-Henning Kamp 	.pru_connect =		uipc_connect,
13127493f24eSPawel Jakub Dawidek 	.pru_connectat =	uipc_connectat,
1313756d52a1SPoul-Henning Kamp 	.pru_connect2 =		uipc_connect2,
1314756d52a1SPoul-Henning Kamp 	.pru_detach =		uipc_detach,
1315756d52a1SPoul-Henning Kamp 	.pru_disconnect =	uipc_disconnect,
1316756d52a1SPoul-Henning Kamp 	.pru_peeraddr =		uipc_peeraddr,
1317756d52a1SPoul-Henning Kamp 	.pru_send =		uipc_send,
1318756d52a1SPoul-Henning Kamp 	.pru_sense =		uipc_sense,
1319756d52a1SPoul-Henning Kamp 	.pru_shutdown =		uipc_shutdown,
1320756d52a1SPoul-Henning Kamp 	.pru_sockaddr =		uipc_sockaddr,
1321fa9402f2SRobert Watson 	.pru_soreceive =	soreceive_dgram,
1322fa9402f2SRobert Watson 	.pru_close =		uipc_close,
1323fa9402f2SRobert Watson };
1324fa9402f2SRobert Watson 
132584d61770SRobert Watson static struct pr_usrreqs uipc_usrreqs_seqpacket = {
132684d61770SRobert Watson 	.pru_abort =		uipc_abort,
132784d61770SRobert Watson 	.pru_accept =		uipc_accept,
132884d61770SRobert Watson 	.pru_attach =		uipc_attach,
132984d61770SRobert Watson 	.pru_bind =		uipc_bind,
13307493f24eSPawel Jakub Dawidek 	.pru_bindat =		uipc_bindat,
133184d61770SRobert Watson 	.pru_connect =		uipc_connect,
13327493f24eSPawel Jakub Dawidek 	.pru_connectat =	uipc_connectat,
133384d61770SRobert Watson 	.pru_connect2 =		uipc_connect2,
133484d61770SRobert Watson 	.pru_detach =		uipc_detach,
133584d61770SRobert Watson 	.pru_disconnect =	uipc_disconnect,
133684d61770SRobert Watson 	.pru_listen =		uipc_listen,
133784d61770SRobert Watson 	.pru_peeraddr =		uipc_peeraddr,
133884d61770SRobert Watson 	.pru_rcvd =		uipc_rcvd,
133984d61770SRobert Watson 	.pru_send =		uipc_send,
134084d61770SRobert Watson 	.pru_sense =		uipc_sense,
134184d61770SRobert Watson 	.pru_shutdown =		uipc_shutdown,
134284d61770SRobert Watson 	.pru_sockaddr =		uipc_sockaddr,
134384d61770SRobert Watson 	.pru_soreceive =	soreceive_generic,	/* XXX: or...? */
134484d61770SRobert Watson 	.pru_close =		uipc_close,
134584d61770SRobert Watson };
134684d61770SRobert Watson 
1347fa9402f2SRobert Watson static struct pr_usrreqs uipc_usrreqs_stream = {
1348fa9402f2SRobert Watson 	.pru_abort = 		uipc_abort,
1349fa9402f2SRobert Watson 	.pru_accept =		uipc_accept,
1350fa9402f2SRobert Watson 	.pru_attach =		uipc_attach,
1351fa9402f2SRobert Watson 	.pru_bind =		uipc_bind,
13527493f24eSPawel Jakub Dawidek 	.pru_bindat =		uipc_bindat,
1353fa9402f2SRobert Watson 	.pru_connect =		uipc_connect,
13547493f24eSPawel Jakub Dawidek 	.pru_connectat =	uipc_connectat,
1355fa9402f2SRobert Watson 	.pru_connect2 =		uipc_connect2,
1356fa9402f2SRobert Watson 	.pru_detach =		uipc_detach,
1357fa9402f2SRobert Watson 	.pru_disconnect =	uipc_disconnect,
1358fa9402f2SRobert Watson 	.pru_listen =		uipc_listen,
1359fa9402f2SRobert Watson 	.pru_peeraddr =		uipc_peeraddr,
1360fa9402f2SRobert Watson 	.pru_rcvd =		uipc_rcvd,
1361fa9402f2SRobert Watson 	.pru_send =		uipc_send,
1362c80ea19bSGleb Smirnoff 	.pru_ready =		uipc_ready,
1363fa9402f2SRobert Watson 	.pru_sense =		uipc_sense,
1364fa9402f2SRobert Watson 	.pru_shutdown =		uipc_shutdown,
1365fa9402f2SRobert Watson 	.pru_sockaddr =		uipc_sockaddr,
1366fa9402f2SRobert Watson 	.pru_soreceive =	soreceive_generic,
1367a152f8a3SRobert Watson 	.pru_close =		uipc_close,
1368a29f300eSGarrett Wollman };
1369df8bae1dSRodney W. Grimes 
13700b36cd25SRobert Watson static int
1371892af6b9SRobert Watson uipc_ctloutput(struct socket *so, struct sockopt *sopt)
13720c1bb4fbSDima Dorfman {
137340f2ac28SRobert Watson 	struct unpcb *unp;
13740d9ce3a1SRobert Watson 	struct xucred xu;
13756a2989fdSMatthew N. Dodd 	int error, optval;
13766a2989fdSMatthew N. Dodd 
13776e0c8e1aSKonstantin Belousov 	if (sopt->sopt_level != SOL_LOCAL)
137896a041b5SMatthew N. Dodd 		return (EINVAL);
137996a041b5SMatthew N. Dodd 
13806a2989fdSMatthew N. Dodd 	unp = sotounpcb(so);
13814d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
13826a2989fdSMatthew N. Dodd 	error = 0;
13830c1bb4fbSDima Dorfman 	switch (sopt->sopt_dir) {
13840c1bb4fbSDima Dorfman 	case SOPT_GET:
13850c1bb4fbSDima Dorfman 		switch (sopt->sopt_name) {
13860c1bb4fbSDima Dorfman 		case LOCAL_PEERCRED:
1387e7c33e29SRobert Watson 			UNP_PCB_LOCK(unp);
13880c1bb4fbSDima Dorfman 			if (unp->unp_flags & UNP_HAVEPC)
13890d9ce3a1SRobert Watson 				xu = unp->unp_peercred;
13900c1bb4fbSDima Dorfman 			else {
13910c1bb4fbSDima Dorfman 				if (so->so_type == SOCK_STREAM)
13920c1bb4fbSDima Dorfman 					error = ENOTCONN;
13930c1bb4fbSDima Dorfman 				else
13940c1bb4fbSDima Dorfman 					error = EINVAL;
13950c1bb4fbSDima Dorfman 			}
1396e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
13970d9ce3a1SRobert Watson 			if (error == 0)
13980d9ce3a1SRobert Watson 				error = sooptcopyout(sopt, &xu, sizeof(xu));
13990c1bb4fbSDima Dorfman 			break;
1400e7c33e29SRobert Watson 
14016a2989fdSMatthew N. Dodd 		case LOCAL_CREDS:
1402a6357845SRobert Watson 			/* Unlocked read. */
14032de07e40SConrad Meyer 			optval = unp->unp_flags & UNP_WANTCRED_ONESHOT ? 1 : 0;
14042de07e40SConrad Meyer 			error = sooptcopyout(sopt, &optval, sizeof(optval));
14052de07e40SConrad Meyer 			break;
14062de07e40SConrad Meyer 
14072de07e40SConrad Meyer 		case LOCAL_CREDS_PERSISTENT:
14082de07e40SConrad Meyer 			/* Unlocked read. */
14092de07e40SConrad Meyer 			optval = unp->unp_flags & UNP_WANTCRED_ALWAYS ? 1 : 0;
14106a2989fdSMatthew N. Dodd 			error = sooptcopyout(sopt, &optval, sizeof(optval));
14116a2989fdSMatthew N. Dodd 			break;
1412e7c33e29SRobert Watson 
14136a2989fdSMatthew N. Dodd 		case LOCAL_CONNWAIT:
1414a6357845SRobert Watson 			/* Unlocked read. */
14156a2989fdSMatthew N. Dodd 			optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0;
14166a2989fdSMatthew N. Dodd 			error = sooptcopyout(sopt, &optval, sizeof(optval));
14176a2989fdSMatthew N. Dodd 			break;
1418e7c33e29SRobert Watson 
14190c1bb4fbSDima Dorfman 		default:
14200c1bb4fbSDima Dorfman 			error = EOPNOTSUPP;
14210c1bb4fbSDima Dorfman 			break;
14220c1bb4fbSDima Dorfman 		}
14230c1bb4fbSDima Dorfman 		break;
1424e7c33e29SRobert Watson 
14250c1bb4fbSDima Dorfman 	case SOPT_SET:
14266a2989fdSMatthew N. Dodd 		switch (sopt->sopt_name) {
14276a2989fdSMatthew N. Dodd 		case LOCAL_CREDS:
14282de07e40SConrad Meyer 		case LOCAL_CREDS_PERSISTENT:
14296a2989fdSMatthew N. Dodd 		case LOCAL_CONNWAIT:
14306a2989fdSMatthew N. Dodd 			error = sooptcopyin(sopt, &optval, sizeof(optval),
14316a2989fdSMatthew N. Dodd 					    sizeof(optval));
14326a2989fdSMatthew N. Dodd 			if (error)
14336a2989fdSMatthew N. Dodd 				break;
14346a2989fdSMatthew N. Dodd 
14352de07e40SConrad Meyer #define	OPTSET(bit, exclusive) do {					\
1436e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);						\
14372de07e40SConrad Meyer 	if (optval) {							\
14382de07e40SConrad Meyer 		if ((unp->unp_flags & (exclusive)) != 0) {		\
14392de07e40SConrad Meyer 			UNP_PCB_UNLOCK(unp);				\
14402de07e40SConrad Meyer 			error = EINVAL;					\
14412de07e40SConrad Meyer 			break;						\
14422de07e40SConrad Meyer 		}							\
14432de07e40SConrad Meyer 		unp->unp_flags |= (bit);				\
14442de07e40SConrad Meyer 	} else								\
14452de07e40SConrad Meyer 		unp->unp_flags &= ~(bit);				\
1446e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);						\
1447e7c33e29SRobert Watson } while (0)
14486a2989fdSMatthew N. Dodd 
14496a2989fdSMatthew N. Dodd 			switch (sopt->sopt_name) {
14506a2989fdSMatthew N. Dodd 			case LOCAL_CREDS:
14512de07e40SConrad Meyer 				OPTSET(UNP_WANTCRED_ONESHOT, UNP_WANTCRED_ALWAYS);
14522de07e40SConrad Meyer 				break;
14532de07e40SConrad Meyer 
14542de07e40SConrad Meyer 			case LOCAL_CREDS_PERSISTENT:
14552de07e40SConrad Meyer 				OPTSET(UNP_WANTCRED_ALWAYS, UNP_WANTCRED_ONESHOT);
14566a2989fdSMatthew N. Dodd 				break;
1457e7c33e29SRobert Watson 
14586a2989fdSMatthew N. Dodd 			case LOCAL_CONNWAIT:
14592de07e40SConrad Meyer 				OPTSET(UNP_CONNWAIT, 0);
14606a2989fdSMatthew N. Dodd 				break;
1461e7c33e29SRobert Watson 
14626a2989fdSMatthew N. Dodd 			default:
14636a2989fdSMatthew N. Dodd 				break;
14646a2989fdSMatthew N. Dodd 			}
14656a2989fdSMatthew N. Dodd 			break;
14666a2989fdSMatthew N. Dodd #undef	OPTSET
14676a2989fdSMatthew N. Dodd 		default:
14686a2989fdSMatthew N. Dodd 			error = ENOPROTOOPT;
14696a2989fdSMatthew N. Dodd 			break;
14706a2989fdSMatthew N. Dodd 		}
1471abb886faSMatthew N. Dodd 		break;
1472e7c33e29SRobert Watson 
14730c1bb4fbSDima Dorfman 	default:
14740c1bb4fbSDima Dorfman 		error = EOPNOTSUPP;
14750c1bb4fbSDima Dorfman 		break;
14760c1bb4fbSDima Dorfman 	}
14770c1bb4fbSDima Dorfman 	return (error);
14780c1bb4fbSDima Dorfman }
14790c1bb4fbSDima Dorfman 
1480f708ef1bSPoul-Henning Kamp static int
1481892af6b9SRobert Watson unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1482df8bae1dSRodney W. Grimes {
14837493f24eSPawel Jakub Dawidek 
14847493f24eSPawel Jakub Dawidek 	return (unp_connectat(AT_FDCWD, so, nam, td));
14857493f24eSPawel Jakub Dawidek }
14867493f24eSPawel Jakub Dawidek 
14877493f24eSPawel Jakub Dawidek static int
14887493f24eSPawel Jakub Dawidek unp_connectat(int fd, struct socket *so, struct sockaddr *nam,
14897493f24eSPawel Jakub Dawidek     struct thread *td)
14907493f24eSPawel Jakub Dawidek {
1491ed92e1c7SMark Johnston 	struct mtx *vplock;
1492ed92e1c7SMark Johnston 	struct sockaddr_un *soun;
1493892af6b9SRobert Watson 	struct vnode *vp;
1494779f106aSGleb Smirnoff 	struct socket *so2;
1495b295bdcdSRobert Watson 	struct unpcb *unp, *unp2, *unp3;
1496df8bae1dSRodney W. Grimes 	struct nameidata nd;
149757bf258eSGarrett Wollman 	char buf[SOCK_MAXADDRLEN];
14980d9ce3a1SRobert Watson 	struct sockaddr *sa;
14997008be5bSPawel Jakub Dawidek 	cap_rights_t rights;
1500ccdadf1aSMark Johnston 	int error, len;
1501ed92e1c7SMark Johnston 	bool connreq;
15020d9ce3a1SRobert Watson 
1503cb7df69bSKevin Lo 	if (nam->sa_family != AF_UNIX)
1504cb7df69bSKevin Lo 		return (EAFNOSUPPORT);
1505a06534c3SBjoern A. Zeeb 	if (nam->sa_len > sizeof(struct sockaddr_un))
1506a06534c3SBjoern A. Zeeb 		return (EINVAL);
150757bf258eSGarrett Wollman 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
150857bf258eSGarrett Wollman 	if (len <= 0)
1509e5aeaa0cSDag-Erling Smørgrav 		return (EINVAL);
1510ed92e1c7SMark Johnston 	soun = (struct sockaddr_un *)nam;
15117928893dSEd Maste 	bcopy(soun->sun_path, buf, len);
15127928893dSEd Maste 	buf[len] = 0;
1513e7c33e29SRobert Watson 
1514bd4a39ccSMark Johnston 	error = 0;
151575a67bf3SMatt Macy 	unp = sotounpcb(so);
1516e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1517ccdadf1aSMark Johnston 	for (;;) {
1518ccdadf1aSMark Johnston 		/*
1519ccdadf1aSMark Johnston 		 * Wait for connection state to stabilize.  If a connection
1520ccdadf1aSMark Johnston 		 * already exists, give up.  For datagram sockets, which permit
1521ccdadf1aSMark Johnston 		 * multiple consecutive connect(2) calls, upper layers are
1522ccdadf1aSMark Johnston 		 * responsible for disconnecting in advance of a subsequent
1523ccdadf1aSMark Johnston 		 * connect(2), but this is not synchronized with PCB connection
1524ccdadf1aSMark Johnston 		 * state.
1525ccdadf1aSMark Johnston 		 *
1526ccdadf1aSMark Johnston 		 * Also make sure that no threads are currently attempting to
1527ccdadf1aSMark Johnston 		 * lock the peer socket, to ensure that unp_conn cannot
1528ccdadf1aSMark Johnston 		 * transition between two valid sockets while locks are dropped.
1529ccdadf1aSMark Johnston 		 */
1530bd4a39ccSMark Johnston 		if (SOLISTENING(so))
1531bd4a39ccSMark Johnston 			error = EOPNOTSUPP;
1532bd4a39ccSMark Johnston 		else if (unp->unp_conn != NULL)
1533bd4a39ccSMark Johnston 			error = EISCONN;
1534bd4a39ccSMark Johnston 		else if ((unp->unp_flags & UNP_CONNECTING) != 0) {
1535bd4a39ccSMark Johnston 			error = EALREADY;
1536ccdadf1aSMark Johnston 		}
1537bd4a39ccSMark Johnston 		if (error != 0) {
1538e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
1539bd4a39ccSMark Johnston 			return (error);
15404f1f0ef5SRobert Watson 		}
1541ccdadf1aSMark Johnston 		if (unp->unp_pairbusy > 0) {
1542ccdadf1aSMark Johnston 			unp->unp_flags |= UNP_WAITING;
1543ccdadf1aSMark Johnston 			mtx_sleep(unp, UNP_PCB_LOCKPTR(unp), 0, "unpeer", 0);
1544ccdadf1aSMark Johnston 			continue;
1545ccdadf1aSMark Johnston 		}
1546ccdadf1aSMark Johnston 		break;
1547ccdadf1aSMark Johnston 	}
154805102f04SRobert Watson 	unp->unp_flags |= UNP_CONNECTING;
1549e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1550e7c33e29SRobert Watson 
1551ed92e1c7SMark Johnston 	connreq = (so->so_proto->pr_flags & PR_CONNREQUIRED) != 0;
1552ed92e1c7SMark Johnston 	if (connreq)
15530d9ce3a1SRobert Watson 		sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1554ed92e1c7SMark Johnston 	else
1555ed92e1c7SMark Johnston 		sa = NULL;
15567493f24eSPawel Jakub Dawidek 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF,
15577e1d3eefSMateusz Guzik 	    UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_CONNECTAT));
1558797f2d22SPoul-Henning Kamp 	error = namei(&nd);
1559797f2d22SPoul-Henning Kamp 	if (error)
15600d9ce3a1SRobert Watson 		vp = NULL;
15610d9ce3a1SRobert Watson 	else
1562df8bae1dSRodney W. Grimes 		vp = nd.ni_vp;
15630d9ce3a1SRobert Watson 	ASSERT_VOP_LOCKED(vp, "unp_connect");
1564cdb62ab7SMateusz Guzik 	NDFREE_NOTHING(&nd);
15650d9ce3a1SRobert Watson 	if (error)
15660d9ce3a1SRobert Watson 		goto bad;
15670d9ce3a1SRobert Watson 
1568df8bae1dSRodney W. Grimes 	if (vp->v_type != VSOCK) {
1569df8bae1dSRodney W. Grimes 		error = ENOTSOCK;
1570df8bae1dSRodney W. Grimes 		goto bad;
1571df8bae1dSRodney W. Grimes 	}
15726fac927cSRobert Watson #ifdef MAC
157330d239bcSRobert Watson 	error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
15746fac927cSRobert Watson 	if (error)
15756fac927cSRobert Watson 		goto bad;
15766fac927cSRobert Watson #endif
1577a854ed98SJohn Baldwin 	error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1578797f2d22SPoul-Henning Kamp 	if (error)
1579df8bae1dSRodney W. Grimes 		goto bad;
1580e7c33e29SRobert Watson 
1581b295bdcdSRobert Watson 	unp = sotounpcb(so);
15824d4b555eSRobert Watson 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1583e7c33e29SRobert Watson 
158475a67bf3SMatt Macy 	vplock = mtx_pool_find(mtxpool_sleep, vp);
158575a67bf3SMatt Macy 	mtx_lock(vplock);
15860c3c207fSGleb Smirnoff 	VOP_UNP_CONNECT(vp, &unp2);
15870c3c207fSGleb Smirnoff 	if (unp2 == NULL) {
1588df8bae1dSRodney W. Grimes 		error = ECONNREFUSED;
15892260c03dSRobert Watson 		goto bad2;
1590df8bae1dSRodney W. Grimes 	}
15910c3c207fSGleb Smirnoff 	so2 = unp2->unp_socket;
1592df8bae1dSRodney W. Grimes 	if (so->so_type != so2->so_type) {
1593df8bae1dSRodney W. Grimes 		error = EPROTOTYPE;
15942260c03dSRobert Watson 		goto bad2;
1595df8bae1dSRodney W. Grimes 	}
1596ed92e1c7SMark Johnston 	if (connreq) {
1597f4bb1869SMark Johnston 		if (SOLISTENING(so2)) {
15981fb51a12SBjoern A. Zeeb 			CURVNET_SET(so2->so_vnet);
1599779f106aSGleb Smirnoff 			so2 = sonewconn(so2, 0);
16001fb51a12SBjoern A. Zeeb 			CURVNET_RESTORE();
1601e7c33e29SRobert Watson 		} else
1602779f106aSGleb Smirnoff 			so2 = NULL;
1603779f106aSGleb Smirnoff 		if (so2 == NULL) {
1604df8bae1dSRodney W. Grimes 			error = ECONNREFUSED;
1605cb8f450bSMatt Macy 			goto bad2;
1606df8bae1dSRodney W. Grimes 		}
1607779f106aSGleb Smirnoff 		unp3 = sotounpcb(so2);
16084820bf6aSMark Johnston 		unp_pcb_lock_pair(unp2, unp3);
16090d9ce3a1SRobert Watson 		if (unp2->unp_addr != NULL) {
16100d9ce3a1SRobert Watson 			bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
16110d9ce3a1SRobert Watson 			unp3->unp_addr = (struct sockaddr_un *) sa;
16120d9ce3a1SRobert Watson 			sa = NULL;
16130d9ce3a1SRobert Watson 		}
1614b523ec24SRobert Watson 
1615da446550SAlan Somers 		unp_copy_peercred(td, unp3, unp, unp2);
1616b523ec24SRobert Watson 
1617e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
1618779f106aSGleb Smirnoff 		unp2 = unp3;
1619ccdadf1aSMark Johnston 
1620ccdadf1aSMark Johnston 		/*
1621ccdadf1aSMark Johnston 		 * It is safe to block on the PCB lock here since unp2 is
1622ccdadf1aSMark Johnston 		 * nascent and cannot be connected to any other sockets.
1623ccdadf1aSMark Johnston 		 */
1624ccdadf1aSMark Johnston 		UNP_PCB_LOCK(unp);
1625335654d7SRobert Watson #ifdef MAC
1626779f106aSGleb Smirnoff 		mac_socketpeer_set_from_socket(so, so2);
1627779f106aSGleb Smirnoff 		mac_socketpeer_set_from_socket(so2, so);
1628335654d7SRobert Watson #endif
1629a3a73490SMatt Macy 	} else {
16304820bf6aSMark Johnston 		unp_pcb_lock_pair(unp, unp2);
1631a3a73490SMatt Macy 	}
1632779f106aSGleb Smirnoff 	KASSERT(unp2 != NULL && so2 != NULL && unp2->unp_socket == so2 &&
1633779f106aSGleb Smirnoff 	    sotounpcb(so2) == unp2,
1634779f106aSGleb Smirnoff 	    ("%s: unp2 %p so2 %p", __func__, unp2, so2));
163508f17d14SGleb Smirnoff 	unp_connect2(so, so2, PRU_CONNECT);
1636bb35a4e1SGleb Smirnoff 	KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
1637bb35a4e1SGleb Smirnoff 	    ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
1638bb35a4e1SGleb Smirnoff 	unp->unp_flags &= ~UNP_CONNECTING;
16394820bf6aSMark Johnston 	unp_pcb_unlock_pair(unp, unp2);
16400d9ce3a1SRobert Watson bad2:
164175a67bf3SMatt Macy 	mtx_unlock(vplock);
1642df8bae1dSRodney W. Grimes bad:
164375a67bf3SMatt Macy 	if (vp != NULL) {
1644df8bae1dSRodney W. Grimes 		vput(vp);
164575a67bf3SMatt Macy 	}
16460d9ce3a1SRobert Watson 	free(sa, M_SONAME);
1647bb35a4e1SGleb Smirnoff 	if (__predict_false(error)) {
1648e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
1649ccdadf1aSMark Johnston 		KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
1650ccdadf1aSMark Johnston 		    ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
16514f1f0ef5SRobert Watson 		unp->unp_flags &= ~UNP_CONNECTING;
1652e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
1653bb35a4e1SGleb Smirnoff 	}
1654df8bae1dSRodney W. Grimes 	return (error);
1655df8bae1dSRodney W. Grimes }
1656df8bae1dSRodney W. Grimes 
1657da446550SAlan Somers /*
1658da446550SAlan Somers  * Set socket peer credentials at connection time.
1659da446550SAlan Somers  *
1660da446550SAlan Somers  * The client's PCB credentials are copied from its process structure.  The
1661da446550SAlan Somers  * server's PCB credentials are copied from the socket on which it called
1662da446550SAlan Somers  * listen(2).  uipc_listen cached that process's credentials at the time.
1663da446550SAlan Somers  */
1664da446550SAlan Somers void
1665da446550SAlan Somers unp_copy_peercred(struct thread *td, struct unpcb *client_unp,
1666da446550SAlan Somers     struct unpcb *server_unp, struct unpcb *listen_unp)
1667da446550SAlan Somers {
1668c5afec6eSDmitry Chagin 	cru2xt(td, &client_unp->unp_peercred);
1669da446550SAlan Somers 	client_unp->unp_flags |= UNP_HAVEPC;
1670da446550SAlan Somers 
1671da446550SAlan Somers 	memcpy(&server_unp->unp_peercred, &listen_unp->unp_peercred,
1672da446550SAlan Somers 	    sizeof(server_unp->unp_peercred));
1673da446550SAlan Somers 	server_unp->unp_flags |= UNP_HAVEPC;
16742de07e40SConrad Meyer 	client_unp->unp_flags |= (listen_unp->unp_flags & UNP_WANTCRED_MASK);
1675da446550SAlan Somers }
1676da446550SAlan Somers 
167708f17d14SGleb Smirnoff static void
16786a2989fdSMatthew N. Dodd unp_connect2(struct socket *so, struct socket *so2, int req)
1679df8bae1dSRodney W. Grimes {
1680e7c33e29SRobert Watson 	struct unpcb *unp;
1681892af6b9SRobert Watson 	struct unpcb *unp2;
1682df8bae1dSRodney W. Grimes 
168308f17d14SGleb Smirnoff 	MPASS(so2->so_type == so->so_type);
1684e7c33e29SRobert Watson 	unp = sotounpcb(so);
1685e7c33e29SRobert Watson 	KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
1686e7c33e29SRobert Watson 	unp2 = sotounpcb(so2);
1687e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
1688e7c33e29SRobert Watson 
1689e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
1690e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp2);
1691ccdadf1aSMark Johnston 	KASSERT(unp->unp_conn == NULL,
1692ccdadf1aSMark Johnston 	    ("%s: socket %p is already connected", __func__, unp));
16930d9ce3a1SRobert Watson 
1694df8bae1dSRodney W. Grimes 	unp->unp_conn = unp2;
169575a67bf3SMatt Macy 	unp_pcb_hold(unp2);
169675a67bf3SMatt Macy 	unp_pcb_hold(unp);
1697df8bae1dSRodney W. Grimes 	switch (so->so_type) {
1698df8bae1dSRodney W. Grimes 	case SOCK_DGRAM:
169975a67bf3SMatt Macy 		UNP_REF_LIST_LOCK();
170098271db4SGarrett Wollman 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
170175a67bf3SMatt Macy 		UNP_REF_LIST_UNLOCK();
1702df8bae1dSRodney W. Grimes 		soisconnected(so);
1703df8bae1dSRodney W. Grimes 		break;
1704df8bae1dSRodney W. Grimes 
1705df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
170684d61770SRobert Watson 	case SOCK_SEQPACKET:
1707ccdadf1aSMark Johnston 		KASSERT(unp2->unp_conn == NULL,
1708ccdadf1aSMark Johnston 		    ("%s: socket %p is already connected", __func__, unp2));
1709df8bae1dSRodney W. Grimes 		unp2->unp_conn = unp;
17106a2989fdSMatthew N. Dodd 		if (req == PRU_CONNECT &&
17116a2989fdSMatthew N. Dodd 		    ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
17126a2989fdSMatthew N. Dodd 			soisconnecting(so);
17136a2989fdSMatthew N. Dodd 		else
1714df8bae1dSRodney W. Grimes 			soisconnected(so);
1715df8bae1dSRodney W. Grimes 		soisconnected(so2);
1716df8bae1dSRodney W. Grimes 		break;
1717df8bae1dSRodney W. Grimes 
1718df8bae1dSRodney W. Grimes 	default:
1719df8bae1dSRodney W. Grimes 		panic("unp_connect2");
1720df8bae1dSRodney W. Grimes 	}
1721df8bae1dSRodney W. Grimes }
1722df8bae1dSRodney W. Grimes 
1723f708ef1bSPoul-Henning Kamp static void
1724e7c33e29SRobert Watson unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
1725df8bae1dSRodney W. Grimes {
172675a67bf3SMatt Macy 	struct socket *so, *so2;
1727f0317f86SMark Johnston #ifdef INVARIANTS
1728f0317f86SMark Johnston 	struct unpcb *unptmp;
1729f0317f86SMark Johnston #endif
17300d9ce3a1SRobert Watson 
1731e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
1732e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp2);
1733f0317f86SMark Johnston 	KASSERT(unp->unp_conn == unp2,
1734f0317f86SMark Johnston 	    ("%s: unpcb %p is not connected to %p", __func__, unp, unp2));
1735e7c33e29SRobert Watson 
1736fc3fcacfSRobert Watson 	unp->unp_conn = NULL;
173775a67bf3SMatt Macy 	so = unp->unp_socket;
173875a67bf3SMatt Macy 	so2 = unp2->unp_socket;
1739df8bae1dSRodney W. Grimes 	switch (unp->unp_socket->so_type) {
1740df8bae1dSRodney W. Grimes 	case SOCK_DGRAM:
174175a67bf3SMatt Macy 		UNP_REF_LIST_LOCK();
1742f0317f86SMark Johnston #ifdef INVARIANTS
1743f0317f86SMark Johnston 		LIST_FOREACH(unptmp, &unp2->unp_refs, unp_reflink) {
1744f0317f86SMark Johnston 			if (unptmp == unp)
1745f0317f86SMark Johnston 				break;
1746f0317f86SMark Johnston 		}
1747f0317f86SMark Johnston 		KASSERT(unptmp != NULL,
1748f0317f86SMark Johnston 		    ("%s: %p not found in reflist of %p", __func__, unp, unp2));
1749f0317f86SMark Johnston #endif
175098271db4SGarrett Wollman 		LIST_REMOVE(unp, unp_reflink);
175175a67bf3SMatt Macy 		UNP_REF_LIST_UNLOCK();
175275a67bf3SMatt Macy 		if (so) {
17531b2e3b4bSRobert Watson 			SOCK_LOCK(so);
17541b2e3b4bSRobert Watson 			so->so_state &= ~SS_ISCONNECTED;
17551b2e3b4bSRobert Watson 			SOCK_UNLOCK(so);
175675a67bf3SMatt Macy 		}
1757df8bae1dSRodney W. Grimes 		break;
1758df8bae1dSRodney W. Grimes 
1759df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
176084d61770SRobert Watson 	case SOCK_SEQPACKET:
176175a67bf3SMatt Macy 		if (so)
176275a67bf3SMatt Macy 			soisdisconnected(so);
176375a67bf3SMatt Macy 		MPASS(unp2->unp_conn == unp);
1764fc3fcacfSRobert Watson 		unp2->unp_conn = NULL;
176575a67bf3SMatt Macy 		if (so2)
176675a67bf3SMatt Macy 			soisdisconnected(so2);
1767df8bae1dSRodney W. Grimes 		break;
1768df8bae1dSRodney W. Grimes 	}
1769f0317f86SMark Johnston 
1770f0317f86SMark Johnston 	if (unp == unp2) {
1771f0317f86SMark Johnston 		unp_pcb_rele_notlast(unp);
1772f0317f86SMark Johnston 		if (!unp_pcb_rele(unp))
1773f0317f86SMark Johnston 			UNP_PCB_UNLOCK(unp);
1774f0317f86SMark Johnston 	} else {
1775f0317f86SMark Johnston 		if (!unp_pcb_rele(unp))
1776f0317f86SMark Johnston 			UNP_PCB_UNLOCK(unp);
1777f0317f86SMark Johnston 		if (!unp_pcb_rele(unp2))
1778f0317f86SMark Johnston 			UNP_PCB_UNLOCK(unp2);
1779f0317f86SMark Johnston 	}
1780df8bae1dSRodney W. Grimes }
1781df8bae1dSRodney W. Grimes 
17820d9ce3a1SRobert Watson /*
1783d7924b70SRobert Watson  * unp_pcblist() walks the global list of struct unpcb's to generate a
1784d7924b70SRobert Watson  * pointer list, bumping the refcount on each unpcb.  It then copies them out
1785d7924b70SRobert Watson  * sequentially, validating the generation number on each to see if it has
1786d7924b70SRobert Watson  * been detached.  All of this is necessary because copyout() may sleep on
1787d7924b70SRobert Watson  * disk I/O.
17880d9ce3a1SRobert Watson  */
178998271db4SGarrett Wollman static int
179082d9ae4eSPoul-Henning Kamp unp_pcblist(SYSCTL_HANDLER_ARGS)
179198271db4SGarrett Wollman {
179298271db4SGarrett Wollman 	struct unpcb *unp, **unp_list;
179398271db4SGarrett Wollman 	unp_gen_t gencnt;
17948f364875SJulian Elischer 	struct xunpgen *xug;
179598271db4SGarrett Wollman 	struct unp_head *head;
17968f364875SJulian Elischer 	struct xunpcb *xu;
1797d821d364SPedro F. Giffuni 	u_int i;
17985362170dSMark Johnston 	int error, n;
179998271db4SGarrett Wollman 
180084d61770SRobert Watson 	switch ((intptr_t)arg1) {
180184d61770SRobert Watson 	case SOCK_STREAM:
180284d61770SRobert Watson 		head = &unp_shead;
180384d61770SRobert Watson 		break;
180484d61770SRobert Watson 
180584d61770SRobert Watson 	case SOCK_DGRAM:
180684d61770SRobert Watson 		head = &unp_dhead;
180784d61770SRobert Watson 		break;
180884d61770SRobert Watson 
180984d61770SRobert Watson 	case SOCK_SEQPACKET:
181084d61770SRobert Watson 		head = &unp_sphead;
181184d61770SRobert Watson 		break;
181284d61770SRobert Watson 
181384d61770SRobert Watson 	default:
1814604f19c9SRobert Watson 		panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
181584d61770SRobert Watson 	}
181698271db4SGarrett Wollman 
181798271db4SGarrett Wollman 	/*
181898271db4SGarrett Wollman 	 * The process of preparing the PCB list is too time-consuming and
181998271db4SGarrett Wollman 	 * resource-intensive to repeat twice on every request.
182098271db4SGarrett Wollman 	 */
1821fc3fcacfSRobert Watson 	if (req->oldptr == NULL) {
182298271db4SGarrett Wollman 		n = unp_count;
18238f364875SJulian Elischer 		req->oldidx = 2 * (sizeof *xug)
182498271db4SGarrett Wollman 			+ (n + n/8) * sizeof(struct xunpcb);
1825e5aeaa0cSDag-Erling Smørgrav 		return (0);
182698271db4SGarrett Wollman 	}
182798271db4SGarrett Wollman 
1828fc3fcacfSRobert Watson 	if (req->newptr != NULL)
1829e5aeaa0cSDag-Erling Smørgrav 		return (EPERM);
183098271db4SGarrett Wollman 
183198271db4SGarrett Wollman 	/*
183298271db4SGarrett Wollman 	 * OK, now we're committed to doing something.
183398271db4SGarrett Wollman 	 */
183479db6fe7SMark Johnston 	xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK | M_ZERO);
1835779f106aSGleb Smirnoff 	UNP_LINK_RLOCK();
183698271db4SGarrett Wollman 	gencnt = unp_gencnt;
183798271db4SGarrett Wollman 	n = unp_count;
1838779f106aSGleb Smirnoff 	UNP_LINK_RUNLOCK();
183998271db4SGarrett Wollman 
18408f364875SJulian Elischer 	xug->xug_len = sizeof *xug;
18418f364875SJulian Elischer 	xug->xug_count = n;
18428f364875SJulian Elischer 	xug->xug_gen = gencnt;
18438f364875SJulian Elischer 	xug->xug_sogen = so_gencnt;
18448f364875SJulian Elischer 	error = SYSCTL_OUT(req, xug, sizeof *xug);
18458f364875SJulian Elischer 	if (error) {
18468f364875SJulian Elischer 		free(xug, M_TEMP);
1847e5aeaa0cSDag-Erling Smørgrav 		return (error);
18488f364875SJulian Elischer 	}
184998271db4SGarrett Wollman 
1850a163d034SWarner Losh 	unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
185198271db4SGarrett Wollman 
1852779f106aSGleb Smirnoff 	UNP_LINK_RLOCK();
18532e3c8fcbSPoul-Henning Kamp 	for (unp = LIST_FIRST(head), i = 0; unp && i < n;
18542e3c8fcbSPoul-Henning Kamp 	     unp = LIST_NEXT(unp, unp_link)) {
1855e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
18568a7d8cc6SRobert Watson 		if (unp->unp_gencnt <= gencnt) {
1857a854ed98SJohn Baldwin 			if (cr_cansee(req->td->td_ucred,
1858e7c33e29SRobert Watson 			    unp->unp_socket->so_cred)) {
1859e7c33e29SRobert Watson 				UNP_PCB_UNLOCK(unp);
18604787fd37SPaul Saab 				continue;
1861e7c33e29SRobert Watson 			}
186298271db4SGarrett Wollman 			unp_list[i++] = unp;
186375a67bf3SMatt Macy 			unp_pcb_hold(unp);
186498271db4SGarrett Wollman 		}
1865e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
18664787fd37SPaul Saab 	}
1867779f106aSGleb Smirnoff 	UNP_LINK_RUNLOCK();
18681c381b19SRobert Watson 	n = i;			/* In case we lost some during malloc. */
186998271db4SGarrett Wollman 
187098271db4SGarrett Wollman 	error = 0;
1871fe2eee82SColin Percival 	xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
187298271db4SGarrett Wollman 	for (i = 0; i < n; i++) {
187398271db4SGarrett Wollman 		unp = unp_list[i];
1874e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
18755362170dSMark Johnston 		if (unp_pcb_rele(unp))
18765362170dSMark Johnston 			continue;
187775a67bf3SMatt Macy 
18785362170dSMark Johnston 		if (unp->unp_gencnt <= gencnt) {
18798f364875SJulian Elischer 			xu->xu_len = sizeof *xu;
18803a20f06aSBrooks Davis 			xu->xu_unpp = (uintptr_t)unp;
188198271db4SGarrett Wollman 			/*
188298271db4SGarrett Wollman 			 * XXX - need more locking here to protect against
188398271db4SGarrett Wollman 			 * connect/disconnect races for SMP.
188498271db4SGarrett Wollman 			 */
1885fc3fcacfSRobert Watson 			if (unp->unp_addr != NULL)
18868f364875SJulian Elischer 				bcopy(unp->unp_addr, &xu->xu_addr,
188798271db4SGarrett Wollman 				      unp->unp_addr->sun_len);
18880e229f34SGleb Smirnoff 			else
18890e229f34SGleb Smirnoff 				bzero(&xu->xu_addr, sizeof(xu->xu_addr));
1890fc3fcacfSRobert Watson 			if (unp->unp_conn != NULL &&
1891fc3fcacfSRobert Watson 			    unp->unp_conn->unp_addr != NULL)
189298271db4SGarrett Wollman 				bcopy(unp->unp_conn->unp_addr,
18938f364875SJulian Elischer 				      &xu->xu_caddr,
189498271db4SGarrett Wollman 				      unp->unp_conn->unp_addr->sun_len);
18950e229f34SGleb Smirnoff 			else
18960e229f34SGleb Smirnoff 				bzero(&xu->xu_caddr, sizeof(xu->xu_caddr));
18973a20f06aSBrooks Davis 			xu->unp_vnode = (uintptr_t)unp->unp_vnode;
18983a20f06aSBrooks Davis 			xu->unp_conn = (uintptr_t)unp->unp_conn;
18993a20f06aSBrooks Davis 			xu->xu_firstref = (uintptr_t)LIST_FIRST(&unp->unp_refs);
19003a20f06aSBrooks Davis 			xu->xu_nextref = (uintptr_t)LIST_NEXT(unp, unp_reflink);
19010e229f34SGleb Smirnoff 			xu->unp_gencnt = unp->unp_gencnt;
19028f364875SJulian Elischer 			sotoxsocket(unp->unp_socket, &xu->xu_socket);
1903e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
19048f364875SJulian Elischer 			error = SYSCTL_OUT(req, xu, sizeof *xu);
19055362170dSMark Johnston 		} else {
1906e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
1907e7c33e29SRobert Watson 		}
19085362170dSMark Johnston 	}
19098f364875SJulian Elischer 	free(xu, M_TEMP);
191098271db4SGarrett Wollman 	if (!error) {
191198271db4SGarrett Wollman 		/*
19121c381b19SRobert Watson 		 * Give the user an updated idea of our state.  If the
19131c381b19SRobert Watson 		 * generation differs from what we told her before, she knows
19141c381b19SRobert Watson 		 * that something happened while we were processing this
19151c381b19SRobert Watson 		 * request, and it might be necessary to retry.
191698271db4SGarrett Wollman 		 */
19178f364875SJulian Elischer 		xug->xug_gen = unp_gencnt;
19188f364875SJulian Elischer 		xug->xug_sogen = so_gencnt;
19198f364875SJulian Elischer 		xug->xug_count = unp_count;
19208f364875SJulian Elischer 		error = SYSCTL_OUT(req, xug, sizeof *xug);
192198271db4SGarrett Wollman 	}
192298271db4SGarrett Wollman 	free(unp_list, M_TEMP);
19238f364875SJulian Elischer 	free(xug, M_TEMP);
1924e5aeaa0cSDag-Erling Smørgrav 	return (error);
192598271db4SGarrett Wollman }
192698271db4SGarrett Wollman 
19277029da5cSPawel Biernacki SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist,
19287029da5cSPawel Biernacki     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
19292fee06f0SMatthew D Fleming     (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
193098271db4SGarrett Wollman     "List of active local datagram sockets");
19317029da5cSPawel Biernacki SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist,
19327029da5cSPawel Biernacki     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
19332fee06f0SMatthew D Fleming     (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
193498271db4SGarrett Wollman     "List of active local stream sockets");
19352fee06f0SMatthew D Fleming SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
19367029da5cSPawel Biernacki     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
19372fee06f0SMatthew D Fleming     (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
193884d61770SRobert Watson     "List of active local seqpacket sockets");
193998271db4SGarrett Wollman 
1940f708ef1bSPoul-Henning Kamp static void
1941892af6b9SRobert Watson unp_shutdown(struct unpcb *unp)
1942df8bae1dSRodney W. Grimes {
1943e7c33e29SRobert Watson 	struct unpcb *unp2;
1944df8bae1dSRodney W. Grimes 	struct socket *so;
1945df8bae1dSRodney W. Grimes 
1946e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
19470d9ce3a1SRobert Watson 
1948e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
194984d61770SRobert Watson 	if ((unp->unp_socket->so_type == SOCK_STREAM ||
195084d61770SRobert Watson 	    (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
1951e7c33e29SRobert Watson 		so = unp2->unp_socket;
1952e7c33e29SRobert Watson 		if (so != NULL)
1953df8bae1dSRodney W. Grimes 			socantrcvmore(so);
1954df8bae1dSRodney W. Grimes 	}
1955e7c33e29SRobert Watson }
1956df8bae1dSRodney W. Grimes 
1957f708ef1bSPoul-Henning Kamp static void
1958afc055d9SEd Schouten unp_drop(struct unpcb *unp)
1959df8bae1dSRodney W. Grimes {
196050b07c1fSMark Johnston 	struct socket *so;
1961e7c33e29SRobert Watson 	struct unpcb *unp2;
19620d9ce3a1SRobert Watson 
1963afc055d9SEd Schouten 	/*
1964afc055d9SEd Schouten 	 * Regardless of whether the socket's peer dropped the connection
1965afc055d9SEd Schouten 	 * with this socket by aborting or disconnecting, POSIX requires
1966afc055d9SEd Schouten 	 * that ECONNRESET is returned.
1967afc055d9SEd Schouten 	 */
196875a67bf3SMatt Macy 
196975a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
197050b07c1fSMark Johnston 	so = unp->unp_socket;
197175a67bf3SMatt Macy 	if (so)
1972afc055d9SEd Schouten 		so->so_error = ECONNRESET;
1973ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
1974f0317f86SMark Johnston 		/* Last reference dropped in unp_disconnect(). */
1975f0317f86SMark Johnston 		unp_pcb_rele_notlast(unp);
1976e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
1977f0317f86SMark Johnston 	} else if (!unp_pcb_rele(unp)) {
197875a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
197975a67bf3SMatt Macy 	}
1980f0317f86SMark Johnston }
1981df8bae1dSRodney W. Grimes 
19822bc21ed9SDavid Malone static void
19838cb539f1SPawel Jakub Dawidek unp_freerights(struct filedescent **fdep, int fdcount)
1984df8bae1dSRodney W. Grimes {
19852bc21ed9SDavid Malone 	struct file *fp;
19862609222aSPawel Jakub Dawidek 	int i;
1987df8bae1dSRodney W. Grimes 
198882e825c4SGleb Smirnoff 	KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount));
198982e825c4SGleb Smirnoff 
19908cb539f1SPawel Jakub Dawidek 	for (i = 0; i < fdcount; i++) {
19918cb539f1SPawel Jakub Dawidek 		fp = fdep[i]->fde_file;
19928cb539f1SPawel Jakub Dawidek 		filecaps_free(&fdep[i]->fde_caps);
19938692c025SYoshinobu Inoue 		unp_discard(fp);
1994df8bae1dSRodney W. Grimes 	}
19958cb539f1SPawel Jakub Dawidek 	free(fdep[0], M_FILECAPS);
19962bc21ed9SDavid Malone }
19972bc21ed9SDavid Malone 
19980b36cd25SRobert Watson static int
1999c2e3c52eSJilles Tjoelker unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
20002bc21ed9SDavid Malone {
20012bc21ed9SDavid Malone 	struct thread *td = curthread;		/* XXX */
20022bc21ed9SDavid Malone 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
20032bc21ed9SDavid Malone 	int i;
20042bc21ed9SDavid Malone 	int *fdp;
20052609222aSPawel Jakub Dawidek 	struct filedesc *fdesc = td->td_proc->p_fd;
2006ea31808cSMateusz Guzik 	struct filedescent **fdep;
20072bc21ed9SDavid Malone 	void *data;
20082bc21ed9SDavid Malone 	socklen_t clen = control->m_len, datalen;
20092bc21ed9SDavid Malone 	int error, newfds;
20102bc21ed9SDavid Malone 	u_int newlen;
20112bc21ed9SDavid Malone 
20123dab55bcSRobert Watson 	UNP_LINK_UNLOCK_ASSERT();
20134c5bc1caSRobert Watson 
20142bc21ed9SDavid Malone 	error = 0;
20152bc21ed9SDavid Malone 	if (controlp != NULL) /* controlp == NULL => free control messages */
20162bc21ed9SDavid Malone 		*controlp = NULL;
20172bc21ed9SDavid Malone 	while (cm != NULL) {
2018*75e7e3ceSGleb Smirnoff 		MPASS(clen >= sizeof(*cm) && clen >= cm->cmsg_len);
20194682ac69SGleb Smirnoff 
20202bc21ed9SDavid Malone 		data = CMSG_DATA(cm);
20212bc21ed9SDavid Malone 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
20222bc21ed9SDavid Malone 		if (cm->cmsg_level == SOL_SOCKET
20232bc21ed9SDavid Malone 		    && cm->cmsg_type == SCM_RIGHTS) {
20242609222aSPawel Jakub Dawidek 			newfds = datalen / sizeof(*fdep);
202582e825c4SGleb Smirnoff 			if (newfds == 0)
202682e825c4SGleb Smirnoff 				goto next;
20272609222aSPawel Jakub Dawidek 			fdep = data;
20282bc21ed9SDavid Malone 
2029e2f9a08bSOlivier Houchard 			/* If we're not outputting the descriptors free them. */
20302bc21ed9SDavid Malone 			if (error || controlp == NULL) {
20312609222aSPawel Jakub Dawidek 				unp_freerights(fdep, newfds);
20322bc21ed9SDavid Malone 				goto next;
20332bc21ed9SDavid Malone 			}
20342609222aSPawel Jakub Dawidek 			FILEDESC_XLOCK(fdesc);
203560a5ef26SRobert Watson 
2036ed5b7817SJulian Elischer 			/*
20371c381b19SRobert Watson 			 * Now change each pointer to an fd in the global
20381c381b19SRobert Watson 			 * table to an integer that is the index to the local
20391c381b19SRobert Watson 			 * fd table entry that we set up to point to the
20401c381b19SRobert Watson 			 * global one we are transferring.
2041ed5b7817SJulian Elischer 			 */
20422bc21ed9SDavid Malone 			newlen = newfds * sizeof(int);
20432bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, newlen,
2044b46667c6SGleb Smirnoff 			    SCM_RIGHTS, SOL_SOCKET, M_NOWAIT);
20452bc21ed9SDavid Malone 			if (*controlp == NULL) {
20462609222aSPawel Jakub Dawidek 				FILEDESC_XUNLOCK(fdesc);
20472bc21ed9SDavid Malone 				error = E2BIG;
20482609222aSPawel Jakub Dawidek 				unp_freerights(fdep, newfds);
20492bc21ed9SDavid Malone 				goto next;
20502bc21ed9SDavid Malone 			}
20512bc21ed9SDavid Malone 
20522bc21ed9SDavid Malone 			fdp = (int *)
20532bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2054db8f33fdSMateusz Guzik 			if (fdallocn(td, 0, fdp, newfds) != 0) {
20553331a33aSMateusz Guzik 				FILEDESC_XUNLOCK(fdesc);
2056db8f33fdSMateusz Guzik 				error = EMSGSIZE;
2057db8f33fdSMateusz Guzik 				unp_freerights(fdep, newfds);
2058db8f33fdSMateusz Guzik 				m_freem(*controlp);
2059db8f33fdSMateusz Guzik 				*controlp = NULL;
2060db8f33fdSMateusz Guzik 				goto next;
2061db8f33fdSMateusz Guzik 			}
20628cb539f1SPawel Jakub Dawidek 			for (i = 0; i < newfds; i++, fdp++) {
2063ea31808cSMateusz Guzik 				_finstall(fdesc, fdep[i]->fde_file, *fdp,
20646ceacebdSAlex Richardson 				    (flags & MSG_CMSG_CLOEXEC) != 0 ? O_CLOEXEC : 0,
2065ea31808cSMateusz Guzik 				    &fdep[i]->fde_caps);
2066ea31808cSMateusz Guzik 				unp_externalize_fp(fdep[i]->fde_file);
2067df8bae1dSRodney W. Grimes 			}
2068c7902fbeSMark Johnston 
2069c7902fbeSMark Johnston 			/*
2070c7902fbeSMark Johnston 			 * The new type indicates that the mbuf data refers to
2071c7902fbeSMark Johnston 			 * kernel resources that may need to be released before
2072c7902fbeSMark Johnston 			 * the mbuf is freed.
2073c7902fbeSMark Johnston 			 */
2074c7902fbeSMark Johnston 			m_chtype(*controlp, MT_EXTCONTROL);
20752609222aSPawel Jakub Dawidek 			FILEDESC_XUNLOCK(fdesc);
20768cb539f1SPawel Jakub Dawidek 			free(fdep[0], M_FILECAPS);
20771c381b19SRobert Watson 		} else {
20781c381b19SRobert Watson 			/* We can just copy anything else across. */
20792bc21ed9SDavid Malone 			if (error || controlp == NULL)
20802bc21ed9SDavid Malone 				goto next;
20812bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, datalen,
2082b46667c6SGleb Smirnoff 			    cm->cmsg_type, cm->cmsg_level, M_NOWAIT);
20832bc21ed9SDavid Malone 			if (*controlp == NULL) {
20842bc21ed9SDavid Malone 				error = ENOBUFS;
20852bc21ed9SDavid Malone 				goto next;
20862bc21ed9SDavid Malone 			}
20872bc21ed9SDavid Malone 			bcopy(data,
20882bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
20892bc21ed9SDavid Malone 			    datalen);
20902bc21ed9SDavid Malone 		}
20912bc21ed9SDavid Malone 		controlp = &(*controlp)->m_next;
20922bc21ed9SDavid Malone 
20932bc21ed9SDavid Malone next:
20942bc21ed9SDavid Malone 		if (CMSG_SPACE(datalen) < clen) {
20952bc21ed9SDavid Malone 			clen -= CMSG_SPACE(datalen);
20962bc21ed9SDavid Malone 			cm = (struct cmsghdr *)
20972bc21ed9SDavid Malone 			    ((caddr_t)cm + CMSG_SPACE(datalen));
20988692c025SYoshinobu Inoue 		} else {
20992bc21ed9SDavid Malone 			clen = 0;
21002bc21ed9SDavid Malone 			cm = NULL;
21018692c025SYoshinobu Inoue 		}
21028692c025SYoshinobu Inoue 	}
21038692c025SYoshinobu Inoue 
21042bc21ed9SDavid Malone 	m_freem(control);
21052bc21ed9SDavid Malone 	return (error);
2106df8bae1dSRodney W. Grimes }
2107df8bae1dSRodney W. Grimes 
21084f590175SPaul Saab static void
21094f590175SPaul Saab unp_zone_change(void *tag)
21104f590175SPaul Saab {
21114f590175SPaul Saab 
21124f590175SPaul Saab 	uma_zone_set_max(unp_zone, maxsockets);
21134f590175SPaul Saab }
21144f590175SPaul Saab 
21155362170dSMark Johnston #ifdef INVARIANTS
21165362170dSMark Johnston static void
21175362170dSMark Johnston unp_zdtor(void *mem, int size __unused, void *arg __unused)
21185362170dSMark Johnston {
21195362170dSMark Johnston 	struct unpcb *unp;
21205362170dSMark Johnston 
21215362170dSMark Johnston 	unp = mem;
21225362170dSMark Johnston 
21235362170dSMark Johnston 	KASSERT(LIST_EMPTY(&unp->unp_refs),
21245362170dSMark Johnston 	    ("%s: unpcb %p has lingering refs", __func__, unp));
21255362170dSMark Johnston 	KASSERT(unp->unp_socket == NULL,
21265362170dSMark Johnston 	    ("%s: unpcb %p has socket backpointer", __func__, unp));
21275362170dSMark Johnston 	KASSERT(unp->unp_vnode == NULL,
21285362170dSMark Johnston 	    ("%s: unpcb %p has vnode references", __func__, unp));
21295362170dSMark Johnston 	KASSERT(unp->unp_conn == NULL,
21305362170dSMark Johnston 	    ("%s: unpcb %p is still connected", __func__, unp));
21315362170dSMark Johnston 	KASSERT(unp->unp_addr == NULL,
21325362170dSMark Johnston 	    ("%s: unpcb %p has leaked addr", __func__, unp));
21335362170dSMark Johnston }
21345362170dSMark Johnston #endif
21355362170dSMark Johnston 
21360b36cd25SRobert Watson static void
213724e1c6aeSGleb Smirnoff unp_init(void *arg __unused)
213898271db4SGarrett Wollman {
21395362170dSMark Johnston 	uma_dtor dtor;
21401c381b19SRobert Watson 
21415362170dSMark Johnston #ifdef INVARIANTS
21425362170dSMark Johnston 	dtor = unp_zdtor;
21435362170dSMark Johnston #else
21445362170dSMark Johnston 	dtor = NULL;
21455362170dSMark Johnston #endif
21465362170dSMark Johnston 	unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, dtor,
214775a67bf3SMatt Macy 	    NULL, NULL, UMA_ALIGN_CACHE, 0);
21484f590175SPaul Saab 	uma_zone_set_max(unp_zone, maxsockets);
21496e0b6746SPawel Jakub Dawidek 	uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached");
21504f590175SPaul Saab 	EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
21514f590175SPaul Saab 	    NULL, EVENTHANDLER_PRI_ANY);
215298271db4SGarrett Wollman 	LIST_INIT(&unp_dhead);
215398271db4SGarrett Wollman 	LIST_INIT(&unp_shead);
215484d61770SRobert Watson 	LIST_INIT(&unp_sphead);
21550cb64678SKonstantin Belousov 	SLIST_INIT(&unp_defers);
2156daee0f0bSKonstantin Belousov 	TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
21570cb64678SKonstantin Belousov 	TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
21583dab55bcSRobert Watson 	UNP_LINK_LOCK_INIT();
21590cb64678SKonstantin Belousov 	UNP_DEFERRED_LOCK_INIT();
216098271db4SGarrett Wollman }
216124e1c6aeSGleb Smirnoff SYSINIT(unp_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_SECOND, unp_init, NULL);
216298271db4SGarrett Wollman 
216347c3450eSKonstantin Belousov static void
216447c3450eSKonstantin Belousov unp_internalize_cleanup_rights(struct mbuf *control)
216547c3450eSKonstantin Belousov {
216647c3450eSKonstantin Belousov 	struct cmsghdr *cp;
216747c3450eSKonstantin Belousov 	struct mbuf *m;
216847c3450eSKonstantin Belousov 	void *data;
216947c3450eSKonstantin Belousov 	socklen_t datalen;
217047c3450eSKonstantin Belousov 
217147c3450eSKonstantin Belousov 	for (m = control; m != NULL; m = m->m_next) {
217247c3450eSKonstantin Belousov 		cp = mtod(m, struct cmsghdr *);
217347c3450eSKonstantin Belousov 		if (cp->cmsg_level != SOL_SOCKET ||
217447c3450eSKonstantin Belousov 		    cp->cmsg_type != SCM_RIGHTS)
217547c3450eSKonstantin Belousov 			continue;
217647c3450eSKonstantin Belousov 		data = CMSG_DATA(cp);
217747c3450eSKonstantin Belousov 		datalen = (caddr_t)cp + cp->cmsg_len - (caddr_t)data;
217847c3450eSKonstantin Belousov 		unp_freerights(data, datalen / sizeof(struct filedesc *));
217947c3450eSKonstantin Belousov 	}
218047c3450eSKonstantin Belousov }
218147c3450eSKonstantin Belousov 
2182f708ef1bSPoul-Henning Kamp static int
2183892af6b9SRobert Watson unp_internalize(struct mbuf **controlp, struct thread *td)
2184df8bae1dSRodney W. Grimes {
218547c3450eSKonstantin Belousov 	struct mbuf *control, **initial_controlp;
218647c3450eSKonstantin Belousov 	struct proc *p;
218747c3450eSKonstantin Belousov 	struct filedesc *fdesc;
2188ab15d803SSergey Kandaurov 	struct bintime *bt;
218947c3450eSKonstantin Belousov 	struct cmsghdr *cm;
21902bc21ed9SDavid Malone 	struct cmsgcred *cmcred;
21918cb539f1SPawel Jakub Dawidek 	struct filedescent *fde, **fdep, *fdev;
21922bc21ed9SDavid Malone 	struct file *fp;
21932bc21ed9SDavid Malone 	struct timeval *tv;
2194339efd75SMaxim Sobolev 	struct timespec *ts;
21952bc21ed9SDavid Malone 	void *data;
219647c3450eSKonstantin Belousov 	socklen_t clen, datalen;
2197f1cf2b9dSKonstantin Belousov 	int i, j, error, *fdp, oldfds;
21988692c025SYoshinobu Inoue 	u_int newlen;
2199df8bae1dSRodney W. Grimes 
22003dab55bcSRobert Watson 	UNP_LINK_UNLOCK_ASSERT();
22014c5bc1caSRobert Watson 
220247c3450eSKonstantin Belousov 	p = td->td_proc;
220347c3450eSKonstantin Belousov 	fdesc = p->p_fd;
22042bc21ed9SDavid Malone 	error = 0;
220547c3450eSKonstantin Belousov 	control = *controlp;
220647c3450eSKonstantin Belousov 	clen = control->m_len;
22072bc21ed9SDavid Malone 	*controlp = NULL;
220847c3450eSKonstantin Belousov 	initial_controlp = controlp;
220947c3450eSKonstantin Belousov 	for (cm = mtod(control, struct cmsghdr *); cm != NULL;) {
22102bc21ed9SDavid Malone 		if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
2211de966666SMateusz Guzik 		    || cm->cmsg_len > clen || cm->cmsg_len < sizeof(*cm)) {
22122bc21ed9SDavid Malone 			error = EINVAL;
22132bc21ed9SDavid Malone 			goto out;
22142bc21ed9SDavid Malone 		}
22152bc21ed9SDavid Malone 		data = CMSG_DATA(cm);
22162bc21ed9SDavid Malone 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
22172bc21ed9SDavid Malone 
22182bc21ed9SDavid Malone 		switch (cm->cmsg_type) {
22190b788fa1SBill Paul 		/*
22200b788fa1SBill Paul 		 * Fill in credential information.
22210b788fa1SBill Paul 		 */
22222bc21ed9SDavid Malone 		case SCM_CREDS:
2223b46667c6SGleb Smirnoff 			*controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
222424df85d2SGleb Smirnoff 			    SCM_CREDS, SOL_SOCKET, M_WAITOK);
22252bc21ed9SDavid Malone 			cmcred = (struct cmsgcred *)
22262bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
22270b788fa1SBill Paul 			cmcred->cmcred_pid = p->p_pid;
2228a854ed98SJohn Baldwin 			cmcred->cmcred_uid = td->td_ucred->cr_ruid;
2229a854ed98SJohn Baldwin 			cmcred->cmcred_gid = td->td_ucred->cr_rgid;
2230a854ed98SJohn Baldwin 			cmcred->cmcred_euid = td->td_ucred->cr_uid;
2231a854ed98SJohn Baldwin 			cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
22320b788fa1SBill Paul 			    CMGROUP_MAX);
22330b788fa1SBill Paul 			for (i = 0; i < cmcred->cmcred_ngroups; i++)
22342bc21ed9SDavid Malone 				cmcred->cmcred_groups[i] =
2235a854ed98SJohn Baldwin 				    td->td_ucred->cr_groups[i];
22362bc21ed9SDavid Malone 			break;
22370b788fa1SBill Paul 
22382bc21ed9SDavid Malone 		case SCM_RIGHTS:
22392bc21ed9SDavid Malone 			oldfds = datalen / sizeof (int);
224082e825c4SGleb Smirnoff 			if (oldfds == 0)
224182e825c4SGleb Smirnoff 				break;
2242579b45e2SGleb Smirnoff 			/* On some machines sizeof pointer is bigger than
2243579b45e2SGleb Smirnoff 			 * sizeof int, so we need to check if data fits into
2244579b45e2SGleb Smirnoff 			 * single mbuf.  We could allocate several mbufs, and
2245579b45e2SGleb Smirnoff 			 * unp_externalize() should even properly handle that.
2246579b45e2SGleb Smirnoff 			 * But it is not worth to complicate the code for an
2247579b45e2SGleb Smirnoff 			 * insane scenario of passing over 200 file descriptors
2248579b45e2SGleb Smirnoff 			 * at once.
2249579b45e2SGleb Smirnoff 			 */
2250579b45e2SGleb Smirnoff 			newlen = oldfds * sizeof(fdep[0]);
2251579b45e2SGleb Smirnoff 			if (CMSG_SPACE(newlen) > MCLBYTES) {
2252579b45e2SGleb Smirnoff 				error = EMSGSIZE;
2253579b45e2SGleb Smirnoff 				goto out;
2254579b45e2SGleb Smirnoff 			}
2255ed5b7817SJulian Elischer 			/*
22561c381b19SRobert Watson 			 * Check that all the FDs passed in refer to legal
22571c381b19SRobert Watson 			 * files.  If not, reject the entire operation.
2258ed5b7817SJulian Elischer 			 */
22592bc21ed9SDavid Malone 			fdp = data;
22602609222aSPawel Jakub Dawidek 			FILEDESC_SLOCK(fdesc);
22616a1cf96bSMateusz Guzik 			for (i = 0; i < oldfds; i++, fdp++) {
2262f17ef286SMateusz Guzik 				fp = fget_noref(fdesc, *fdp);
22636a1cf96bSMateusz Guzik 				if (fp == NULL) {
22642609222aSPawel Jakub Dawidek 					FILEDESC_SUNLOCK(fdesc);
22652bc21ed9SDavid Malone 					error = EBADF;
22662bc21ed9SDavid Malone 					goto out;
22672bc21ed9SDavid Malone 				}
2268e7d6662fSAlfred Perlstein 				if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
22692609222aSPawel Jakub Dawidek 					FILEDESC_SUNLOCK(fdesc);
2270e7d6662fSAlfred Perlstein 					error = EOPNOTSUPP;
2271e7d6662fSAlfred Perlstein 					goto out;
2272e7d6662fSAlfred Perlstein 				}
2273df8bae1dSRodney W. Grimes 			}
22745e3f7694SRobert Watson 
2275ed5b7817SJulian Elischer 			/*
22760b36cd25SRobert Watson 			 * Now replace the integer FDs with pointers to the
22772609222aSPawel Jakub Dawidek 			 * file structure and capability rights.
2278ed5b7817SJulian Elischer 			 */
2279b46667c6SGleb Smirnoff 			*controlp = sbcreatecontrol(NULL, newlen,
228024df85d2SGleb Smirnoff 			    SCM_RIGHTS, SOL_SOCKET, M_WAITOK);
22812bc21ed9SDavid Malone 			fdp = data;
2282f1cf2b9dSKonstantin Belousov 			for (i = 0; i < oldfds; i++, fdp++) {
2283f1cf2b9dSKonstantin Belousov 				if (!fhold(fdesc->fd_ofiles[*fdp].fde_file)) {
2284f1cf2b9dSKonstantin Belousov 					fdp = data;
2285f1cf2b9dSKonstantin Belousov 					for (j = 0; j < i; j++, fdp++) {
2286f1cf2b9dSKonstantin Belousov 						fdrop(fdesc->fd_ofiles[*fdp].
2287f1cf2b9dSKonstantin Belousov 						    fde_file, td);
2288f1cf2b9dSKonstantin Belousov 					}
2289f1cf2b9dSKonstantin Belousov 					FILEDESC_SUNLOCK(fdesc);
2290f1cf2b9dSKonstantin Belousov 					error = EBADF;
2291f1cf2b9dSKonstantin Belousov 					goto out;
2292f1cf2b9dSKonstantin Belousov 				}
2293f1cf2b9dSKonstantin Belousov 			}
2294f1cf2b9dSKonstantin Belousov 			fdp = data;
22958cb539f1SPawel Jakub Dawidek 			fdep = (struct filedescent **)
22962bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
22978cb539f1SPawel Jakub Dawidek 			fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS,
22988cb539f1SPawel Jakub Dawidek 			    M_WAITOK);
22998cb539f1SPawel Jakub Dawidek 			for (i = 0; i < oldfds; i++, fdev++, fdp++) {
23002609222aSPawel Jakub Dawidek 				fde = &fdesc->fd_ofiles[*fdp];
23018cb539f1SPawel Jakub Dawidek 				fdep[i] = fdev;
23028cb539f1SPawel Jakub Dawidek 				fdep[i]->fde_file = fde->fde_file;
23038cb539f1SPawel Jakub Dawidek 				filecaps_copy(&fde->fde_caps,
2304d7832811SMateusz Guzik 				    &fdep[i]->fde_caps, true);
23058cb539f1SPawel Jakub Dawidek 				unp_internalize_fp(fdep[i]->fde_file);
2306df8bae1dSRodney W. Grimes 			}
23072609222aSPawel Jakub Dawidek 			FILEDESC_SUNLOCK(fdesc);
23082bc21ed9SDavid Malone 			break;
23092bc21ed9SDavid Malone 
23102bc21ed9SDavid Malone 		case SCM_TIMESTAMP:
2311b46667c6SGleb Smirnoff 			*controlp = sbcreatecontrol(NULL, sizeof(*tv),
231224df85d2SGleb Smirnoff 			    SCM_TIMESTAMP, SOL_SOCKET, M_WAITOK);
23132bc21ed9SDavid Malone 			tv = (struct timeval *)
23142bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
23152bc21ed9SDavid Malone 			microtime(tv);
23162bc21ed9SDavid Malone 			break;
23172bc21ed9SDavid Malone 
2318ab15d803SSergey Kandaurov 		case SCM_BINTIME:
2319b46667c6SGleb Smirnoff 			*controlp = sbcreatecontrol(NULL, sizeof(*bt),
232024df85d2SGleb Smirnoff 			    SCM_BINTIME, SOL_SOCKET, M_WAITOK);
2321ab15d803SSergey Kandaurov 			bt = (struct bintime *)
2322ab15d803SSergey Kandaurov 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2323ab15d803SSergey Kandaurov 			bintime(bt);
2324ab15d803SSergey Kandaurov 			break;
2325ab15d803SSergey Kandaurov 
2326339efd75SMaxim Sobolev 		case SCM_REALTIME:
2327b46667c6SGleb Smirnoff 			*controlp = sbcreatecontrol(NULL, sizeof(*ts),
232824df85d2SGleb Smirnoff 			    SCM_REALTIME, SOL_SOCKET, M_WAITOK);
2329339efd75SMaxim Sobolev 			ts = (struct timespec *)
2330339efd75SMaxim Sobolev 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2331339efd75SMaxim Sobolev 			nanotime(ts);
2332339efd75SMaxim Sobolev 			break;
2333339efd75SMaxim Sobolev 
2334339efd75SMaxim Sobolev 		case SCM_MONOTONIC:
2335b46667c6SGleb Smirnoff 			*controlp = sbcreatecontrol(NULL, sizeof(*ts),
233624df85d2SGleb Smirnoff 			    SCM_MONOTONIC, SOL_SOCKET, M_WAITOK);
2337339efd75SMaxim Sobolev 			ts = (struct timespec *)
2338339efd75SMaxim Sobolev 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2339339efd75SMaxim Sobolev 			nanouptime(ts);
2340339efd75SMaxim Sobolev 			break;
2341339efd75SMaxim Sobolev 
23422bc21ed9SDavid Malone 		default:
23432bc21ed9SDavid Malone 			error = EINVAL;
23442bc21ed9SDavid Malone 			goto out;
23452bc21ed9SDavid Malone 		}
23462bc21ed9SDavid Malone 
23474013d726SMark Johnston 		if (*controlp != NULL)
23482bc21ed9SDavid Malone 			controlp = &(*controlp)->m_next;
23492bc21ed9SDavid Malone 		if (CMSG_SPACE(datalen) < clen) {
23502bc21ed9SDavid Malone 			clen -= CMSG_SPACE(datalen);
23512bc21ed9SDavid Malone 			cm = (struct cmsghdr *)
23522bc21ed9SDavid Malone 			    ((caddr_t)cm + CMSG_SPACE(datalen));
23532bc21ed9SDavid Malone 		} else {
23542bc21ed9SDavid Malone 			clen = 0;
23552bc21ed9SDavid Malone 			cm = NULL;
23562bc21ed9SDavid Malone 		}
23572bc21ed9SDavid Malone 	}
23582bc21ed9SDavid Malone 
23592bc21ed9SDavid Malone out:
236047c3450eSKonstantin Belousov 	if (error != 0 && initial_controlp != NULL)
236147c3450eSKonstantin Belousov 		unp_internalize_cleanup_rights(*initial_controlp);
23622bc21ed9SDavid Malone 	m_freem(control);
23632bc21ed9SDavid Malone 	return (error);
2364df8bae1dSRodney W. Grimes }
2365df8bae1dSRodney W. Grimes 
23665b950deaSRobert Watson static struct mbuf *
2367ede4af47SConrad Meyer unp_addsockcred(struct thread *td, struct mbuf *control, int mode)
23686a2989fdSMatthew N. Dodd {
236970df31f4SMaxim Konovalov 	struct mbuf *m, *n, *n_prev;
237070df31f4SMaxim Konovalov 	const struct cmsghdr *cm;
2371ede4af47SConrad Meyer 	int ngroups, i, cmsgtype;
2372ede4af47SConrad Meyer 	size_t ctrlsz;
23736a2989fdSMatthew N. Dodd 
23746a2989fdSMatthew N. Dodd 	ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
2375ede4af47SConrad Meyer 	if (mode & UNP_WANTCRED_ALWAYS) {
2376ede4af47SConrad Meyer 		ctrlsz = SOCKCRED2SIZE(ngroups);
2377ede4af47SConrad Meyer 		cmsgtype = SCM_CREDS2;
2378ede4af47SConrad Meyer 	} else {
2379ede4af47SConrad Meyer 		ctrlsz = SOCKCREDSIZE(ngroups);
2380ede4af47SConrad Meyer 		cmsgtype = SCM_CREDS;
2381ede4af47SConrad Meyer 	}
2382ede4af47SConrad Meyer 
2383b46667c6SGleb Smirnoff 	m = sbcreatecontrol(NULL, ctrlsz, cmsgtype, SOL_SOCKET, M_NOWAIT);
23846a2989fdSMatthew N. Dodd 	if (m == NULL)
23856a2989fdSMatthew N. Dodd 		return (control);
23866a2989fdSMatthew N. Dodd 
2387ede4af47SConrad Meyer 	if (mode & UNP_WANTCRED_ALWAYS) {
2388ede4af47SConrad Meyer 		struct sockcred2 *sc;
2389ede4af47SConrad Meyer 
2390ede4af47SConrad Meyer 		sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2391ede4af47SConrad Meyer 		sc->sc_version = 0;
2392ede4af47SConrad Meyer 		sc->sc_pid = td->td_proc->p_pid;
23936a2989fdSMatthew N. Dodd 		sc->sc_uid = td->td_ucred->cr_ruid;
23946a2989fdSMatthew N. Dodd 		sc->sc_euid = td->td_ucred->cr_uid;
23956a2989fdSMatthew N. Dodd 		sc->sc_gid = td->td_ucred->cr_rgid;
23966a2989fdSMatthew N. Dodd 		sc->sc_egid = td->td_ucred->cr_gid;
23976a2989fdSMatthew N. Dodd 		sc->sc_ngroups = ngroups;
23986a2989fdSMatthew N. Dodd 		for (i = 0; i < sc->sc_ngroups; i++)
23996a2989fdSMatthew N. Dodd 			sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2400ede4af47SConrad Meyer 	} else {
2401ede4af47SConrad Meyer 		struct sockcred *sc;
2402ede4af47SConrad Meyer 
2403ede4af47SConrad Meyer 		sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2404ede4af47SConrad Meyer 		sc->sc_uid = td->td_ucred->cr_ruid;
2405ede4af47SConrad Meyer 		sc->sc_euid = td->td_ucred->cr_uid;
2406ede4af47SConrad Meyer 		sc->sc_gid = td->td_ucred->cr_rgid;
2407ede4af47SConrad Meyer 		sc->sc_egid = td->td_ucred->cr_gid;
2408ede4af47SConrad Meyer 		sc->sc_ngroups = ngroups;
2409ede4af47SConrad Meyer 		for (i = 0; i < sc->sc_ngroups; i++)
2410ede4af47SConrad Meyer 			sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2411ede4af47SConrad Meyer 	}
24126a2989fdSMatthew N. Dodd 
24136a2989fdSMatthew N. Dodd 	/*
24141c381b19SRobert Watson 	 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
24151c381b19SRobert Watson 	 * created SCM_CREDS control message (struct sockcred) has another
24161c381b19SRobert Watson 	 * format.
24176a2989fdSMatthew N. Dodd 	 */
2418ede4af47SConrad Meyer 	if (control != NULL && cmsgtype == SCM_CREDS)
241970df31f4SMaxim Konovalov 		for (n = control, n_prev = NULL; n != NULL;) {
242070df31f4SMaxim Konovalov 			cm = mtod(n, struct cmsghdr *);
242170df31f4SMaxim Konovalov     			if (cm->cmsg_level == SOL_SOCKET &&
242270df31f4SMaxim Konovalov 			    cm->cmsg_type == SCM_CREDS) {
242370df31f4SMaxim Konovalov     				if (n_prev == NULL)
242470df31f4SMaxim Konovalov 					control = n->m_next;
242570df31f4SMaxim Konovalov 				else
242670df31f4SMaxim Konovalov 					n_prev->m_next = n->m_next;
242770df31f4SMaxim Konovalov 				n = m_free(n);
242870df31f4SMaxim Konovalov 			} else {
242970df31f4SMaxim Konovalov 				n_prev = n;
243070df31f4SMaxim Konovalov 				n = n->m_next;
243170df31f4SMaxim Konovalov 			}
243270df31f4SMaxim Konovalov 		}
24336a2989fdSMatthew N. Dodd 
243470df31f4SMaxim Konovalov 	/* Prepend it to the head. */
243570df31f4SMaxim Konovalov 	m->m_next = control;
243670df31f4SMaxim Konovalov 	return (m);
24376a2989fdSMatthew N. Dodd }
24386a2989fdSMatthew N. Dodd 
2439397c19d1SJeff Roberson static struct unpcb *
2440397c19d1SJeff Roberson fptounp(struct file *fp)
2441397c19d1SJeff Roberson {
2442397c19d1SJeff Roberson 	struct socket *so;
2443397c19d1SJeff Roberson 
2444397c19d1SJeff Roberson 	if (fp->f_type != DTYPE_SOCKET)
2445397c19d1SJeff Roberson 		return (NULL);
2446397c19d1SJeff Roberson 	if ((so = fp->f_data) == NULL)
2447397c19d1SJeff Roberson 		return (NULL);
2448397c19d1SJeff Roberson 	if (so->so_proto->pr_domain != &localdomain)
2449397c19d1SJeff Roberson 		return (NULL);
2450397c19d1SJeff Roberson 	return sotounpcb(so);
2451397c19d1SJeff Roberson }
2452397c19d1SJeff Roberson 
2453397c19d1SJeff Roberson static void
2454397c19d1SJeff Roberson unp_discard(struct file *fp)
2455397c19d1SJeff Roberson {
24560cb64678SKonstantin Belousov 	struct unp_defer *dr;
2457397c19d1SJeff Roberson 
24580cb64678SKonstantin Belousov 	if (unp_externalize_fp(fp)) {
24590cb64678SKonstantin Belousov 		dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
24600cb64678SKonstantin Belousov 		dr->ud_fp = fp;
24610cb64678SKonstantin Belousov 		UNP_DEFERRED_LOCK();
24620cb64678SKonstantin Belousov 		SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
24630cb64678SKonstantin Belousov 		UNP_DEFERRED_UNLOCK();
24640cb64678SKonstantin Belousov 		atomic_add_int(&unp_defers_count, 1);
24650cb64678SKonstantin Belousov 		taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
24660cb64678SKonstantin Belousov 	} else
24674faa375cSMateusz Guzik 		closef_nothread(fp);
2468397c19d1SJeff Roberson }
2469397c19d1SJeff Roberson 
2470397c19d1SJeff Roberson static void
24710cb64678SKonstantin Belousov unp_process_defers(void *arg __unused, int pending)
24720cb64678SKonstantin Belousov {
24730cb64678SKonstantin Belousov 	struct unp_defer *dr;
24740cb64678SKonstantin Belousov 	SLIST_HEAD(, unp_defer) drl;
24750cb64678SKonstantin Belousov 	int count;
24760cb64678SKonstantin Belousov 
24770cb64678SKonstantin Belousov 	SLIST_INIT(&drl);
24780cb64678SKonstantin Belousov 	for (;;) {
24790cb64678SKonstantin Belousov 		UNP_DEFERRED_LOCK();
24800cb64678SKonstantin Belousov 		if (SLIST_FIRST(&unp_defers) == NULL) {
24810cb64678SKonstantin Belousov 			UNP_DEFERRED_UNLOCK();
24820cb64678SKonstantin Belousov 			break;
24830cb64678SKonstantin Belousov 		}
24840cb64678SKonstantin Belousov 		SLIST_SWAP(&unp_defers, &drl, unp_defer);
24850cb64678SKonstantin Belousov 		UNP_DEFERRED_UNLOCK();
24860cb64678SKonstantin Belousov 		count = 0;
24870cb64678SKonstantin Belousov 		while ((dr = SLIST_FIRST(&drl)) != NULL) {
24880cb64678SKonstantin Belousov 			SLIST_REMOVE_HEAD(&drl, ud_link);
24894faa375cSMateusz Guzik 			closef_nothread(dr->ud_fp);
24900cb64678SKonstantin Belousov 			free(dr, M_TEMP);
24910cb64678SKonstantin Belousov 			count++;
24920cb64678SKonstantin Belousov 		}
24930cb64678SKonstantin Belousov 		atomic_add_int(&unp_defers_count, -count);
24940cb64678SKonstantin Belousov 	}
24950cb64678SKonstantin Belousov }
24960cb64678SKonstantin Belousov 
24970cb64678SKonstantin Belousov static void
2498397c19d1SJeff Roberson unp_internalize_fp(struct file *fp)
2499397c19d1SJeff Roberson {
2500397c19d1SJeff Roberson 	struct unpcb *unp;
2501397c19d1SJeff Roberson 
25023dab55bcSRobert Watson 	UNP_LINK_WLOCK();
2503397c19d1SJeff Roberson 	if ((unp = fptounp(fp)) != NULL) {
2504397c19d1SJeff Roberson 		unp->unp_file = fp;
2505397c19d1SJeff Roberson 		unp->unp_msgcount++;
2506397c19d1SJeff Roberson 	}
2507397c19d1SJeff Roberson 	unp_rights++;
25083dab55bcSRobert Watson 	UNP_LINK_WUNLOCK();
2509397c19d1SJeff Roberson }
2510397c19d1SJeff Roberson 
25110cb64678SKonstantin Belousov static int
2512397c19d1SJeff Roberson unp_externalize_fp(struct file *fp)
2513397c19d1SJeff Roberson {
2514397c19d1SJeff Roberson 	struct unpcb *unp;
25150cb64678SKonstantin Belousov 	int ret;
2516397c19d1SJeff Roberson 
25173dab55bcSRobert Watson 	UNP_LINK_WLOCK();
25180cb64678SKonstantin Belousov 	if ((unp = fptounp(fp)) != NULL) {
2519397c19d1SJeff Roberson 		unp->unp_msgcount--;
25200cb64678SKonstantin Belousov 		ret = 1;
25210cb64678SKonstantin Belousov 	} else
25220cb64678SKonstantin Belousov 		ret = 0;
2523397c19d1SJeff Roberson 	unp_rights--;
25243dab55bcSRobert Watson 	UNP_LINK_WUNLOCK();
25250cb64678SKonstantin Belousov 	return (ret);
2526397c19d1SJeff Roberson }
2527397c19d1SJeff Roberson 
2528161a0c7cSRobert Watson /*
2529a0ec558aSRobert Watson  * unp_defer indicates whether additional work has been defered for a future
2530a0ec558aSRobert Watson  * pass through unp_gc().  It is thread local and does not require explicit
2531a0ec558aSRobert Watson  * synchronization.
2532161a0c7cSRobert Watson  */
2533397c19d1SJeff Roberson static int	unp_marked;
2534a0ec558aSRobert Watson 
2535397c19d1SJeff Roberson static void
2536a9aa06f7SJason A. Harmening unp_remove_dead_ref(struct filedescent **fdep, int fdcount)
2537397c19d1SJeff Roberson {
2538397c19d1SJeff Roberson 	struct unpcb *unp;
2539be26ba7cSPawel Jakub Dawidek 	struct file *fp;
2540be26ba7cSPawel Jakub Dawidek 	int i;
2541397c19d1SJeff Roberson 
2542a9aa06f7SJason A. Harmening 	/*
2543a9aa06f7SJason A. Harmening 	 * This function can only be called from the gc task.
2544a9aa06f7SJason A. Harmening 	 */
2545a9aa06f7SJason A. Harmening 	KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
2546a9aa06f7SJason A. Harmening 	    ("%s: not on gc callout", __func__));
2547a9aa06f7SJason A. Harmening 	UNP_LINK_LOCK_ASSERT();
2548a9aa06f7SJason A. Harmening 
2549be26ba7cSPawel Jakub Dawidek 	for (i = 0; i < fdcount; i++) {
2550be26ba7cSPawel Jakub Dawidek 		fp = fdep[i]->fde_file;
25516f552cb0SJeff Roberson 		if ((unp = fptounp(fp)) == NULL)
2552be26ba7cSPawel Jakub Dawidek 			continue;
2553a9aa06f7SJason A. Harmening 		if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
2554be26ba7cSPawel Jakub Dawidek 			continue;
2555a9aa06f7SJason A. Harmening 		unp->unp_gcrefs--;
2556a9aa06f7SJason A. Harmening 	}
2557a9aa06f7SJason A. Harmening }
2558a9aa06f7SJason A. Harmening 
2559a9aa06f7SJason A. Harmening static void
2560a9aa06f7SJason A. Harmening unp_restore_undead_ref(struct filedescent **fdep, int fdcount)
2561a9aa06f7SJason A. Harmening {
2562a9aa06f7SJason A. Harmening 	struct unpcb *unp;
2563a9aa06f7SJason A. Harmening 	struct file *fp;
2564a9aa06f7SJason A. Harmening 	int i;
2565a9aa06f7SJason A. Harmening 
2566a9aa06f7SJason A. Harmening 	/*
2567a9aa06f7SJason A. Harmening 	 * This function can only be called from the gc task.
2568a9aa06f7SJason A. Harmening 	 */
2569a9aa06f7SJason A. Harmening 	KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
2570a9aa06f7SJason A. Harmening 	    ("%s: not on gc callout", __func__));
2571a9aa06f7SJason A. Harmening 	UNP_LINK_LOCK_ASSERT();
2572a9aa06f7SJason A. Harmening 
2573a9aa06f7SJason A. Harmening 	for (i = 0; i < fdcount; i++) {
2574a9aa06f7SJason A. Harmening 		fp = fdep[i]->fde_file;
2575a9aa06f7SJason A. Harmening 		if ((unp = fptounp(fp)) == NULL)
2576a9aa06f7SJason A. Harmening 			continue;
2577a9aa06f7SJason A. Harmening 		if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
2578a9aa06f7SJason A. Harmening 			continue;
2579a9aa06f7SJason A. Harmening 		unp->unp_gcrefs++;
2580397c19d1SJeff Roberson 		unp_marked++;
2581397c19d1SJeff Roberson 	}
2582be26ba7cSPawel Jakub Dawidek }
2583397c19d1SJeff Roberson 
2584397c19d1SJeff Roberson static void
2585a9aa06f7SJason A. Harmening unp_gc_scan(struct unpcb *unp, void (*op)(struct filedescent **, int))
2586397c19d1SJeff Roberson {
2587779f106aSGleb Smirnoff 	struct socket *so, *soa;
258860a5ef26SRobert Watson 
2589397c19d1SJeff Roberson 	so = unp->unp_socket;
2590779f106aSGleb Smirnoff 	SOCK_LOCK(so);
2591779f106aSGleb Smirnoff 	if (SOLISTENING(so)) {
2592397c19d1SJeff Roberson 		/*
2593397c19d1SJeff Roberson 		 * Mark all sockets in our accept queue.
2594397c19d1SJeff Roberson 		 */
2595779f106aSGleb Smirnoff 		TAILQ_FOREACH(soa, &so->sol_comp, so_list) {
2596779f106aSGleb Smirnoff 			if (sotounpcb(soa)->unp_gcflag & UNPGC_IGNORE_RIGHTS)
25970c40f353SConrad Meyer 				continue;
2598397c19d1SJeff Roberson 			SOCKBUF_LOCK(&soa->so_rcv);
2599a9aa06f7SJason A. Harmening 			unp_scan(soa->so_rcv.sb_mb, op);
2600397c19d1SJeff Roberson 			SOCKBUF_UNLOCK(&soa->so_rcv);
2601397c19d1SJeff Roberson 		}
2602779f106aSGleb Smirnoff 	} else {
2603779f106aSGleb Smirnoff 		/*
2604779f106aSGleb Smirnoff 		 * Mark all sockets we reference with RIGHTS.
2605779f106aSGleb Smirnoff 		 */
2606779f106aSGleb Smirnoff 		if ((unp->unp_gcflag & UNPGC_IGNORE_RIGHTS) == 0) {
2607779f106aSGleb Smirnoff 			SOCKBUF_LOCK(&so->so_rcv);
2608a9aa06f7SJason A. Harmening 			unp_scan(so->so_rcv.sb_mb, op);
2609779f106aSGleb Smirnoff 			SOCKBUF_UNLOCK(&so->so_rcv);
2610779f106aSGleb Smirnoff 		}
2611779f106aSGleb Smirnoff 	}
2612779f106aSGleb Smirnoff 	SOCK_UNLOCK(so);
2613397c19d1SJeff Roberson }
2614a0ec558aSRobert Watson 
2615a0ec558aSRobert Watson static int unp_recycled;
2616be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
2617be6b1304STom Rhodes     "Number of unreachable sockets claimed by the garbage collector.");
2618df8bae1dSRodney W. Grimes 
2619397c19d1SJeff Roberson static int unp_taskcount;
2620be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
2621be6b1304STom Rhodes     "Number of times the garbage collector has run.");
2622397c19d1SJeff Roberson 
2623a9aa06f7SJason A. Harmening SYSCTL_UINT(_net_local, OID_AUTO, sockcount, CTLFLAG_RD, &unp_count, 0,
2624a9aa06f7SJason A. Harmening     "Number of active local sockets.");
2625a9aa06f7SJason A. Harmening 
2626f708ef1bSPoul-Henning Kamp static void
2627a0ec558aSRobert Watson unp_gc(__unused void *arg, int pending)
2628df8bae1dSRodney W. Grimes {
262984d61770SRobert Watson 	struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
263084d61770SRobert Watson 				    NULL };
2631397c19d1SJeff Roberson 	struct unp_head **head;
2632a9aa06f7SJason A. Harmening 	struct unp_head unp_deadhead;	/* List of potentially-dead sockets. */
2633f7780c61SKonstantin Belousov 	struct file *f, **unref;
2634a9aa06f7SJason A. Harmening 	struct unpcb *unp, *unptmp;
2635a9aa06f7SJason A. Harmening 	int i, total, unp_unreachable;
2636df8bae1dSRodney W. Grimes 
2637a9aa06f7SJason A. Harmening 	LIST_INIT(&unp_deadhead);
2638a0ec558aSRobert Watson 	unp_taskcount++;
2639779f106aSGleb Smirnoff 	UNP_LINK_RLOCK();
2640ed5b7817SJulian Elischer 	/*
2641a9aa06f7SJason A. Harmening 	 * First determine which sockets may be in cycles.
2642ed5b7817SJulian Elischer 	 */
2643a9aa06f7SJason A. Harmening 	unp_unreachable = 0;
2644a9aa06f7SJason A. Harmening 
2645397c19d1SJeff Roberson 	for (head = heads; *head != NULL; head++)
2646a9aa06f7SJason A. Harmening 		LIST_FOREACH(unp, *head, unp_link) {
2647a9aa06f7SJason A. Harmening 			KASSERT((unp->unp_gcflag & ~UNPGC_IGNORE_RIGHTS) == 0,
2648a9aa06f7SJason A. Harmening 			    ("%s: unp %p has unexpected gc flags 0x%x",
2649a9aa06f7SJason A. Harmening 			    __func__, unp, (unsigned int)unp->unp_gcflag));
2650a9aa06f7SJason A. Harmening 
2651a9aa06f7SJason A. Harmening 			f = unp->unp_file;
265260a5ef26SRobert Watson 
2653397c19d1SJeff Roberson 			/*
2654a9aa06f7SJason A. Harmening 			 * Check for an unreachable socket potentially in a
2655a9aa06f7SJason A. Harmening 			 * cycle.  It must be in a queue as indicated by
2656a9aa06f7SJason A. Harmening 			 * msgcount, and this must equal the file reference
2657a9aa06f7SJason A. Harmening 			 * count.  Note that when msgcount is 0 the file is
2658a9aa06f7SJason A. Harmening 			 * NULL.
2659a9aa06f7SJason A. Harmening 			 */
2660a9aa06f7SJason A. Harmening 			if (f != NULL && unp->unp_msgcount != 0 &&
26613c50616fSMateusz Guzik 			    refcount_load(&f->f_count) == unp->unp_msgcount) {
2662a9aa06f7SJason A. Harmening 				LIST_INSERT_HEAD(&unp_deadhead, unp, unp_dead);
2663a9aa06f7SJason A. Harmening 				unp->unp_gcflag |= UNPGC_DEAD;
2664a9aa06f7SJason A. Harmening 				unp->unp_gcrefs = unp->unp_msgcount;
2665a9aa06f7SJason A. Harmening 				unp_unreachable++;
2666a9aa06f7SJason A. Harmening 			}
2667a9aa06f7SJason A. Harmening 		}
2668a9aa06f7SJason A. Harmening 
2669a9aa06f7SJason A. Harmening 	/*
2670a9aa06f7SJason A. Harmening 	 * Scan all sockets previously marked as potentially being in a cycle
2671a9aa06f7SJason A. Harmening 	 * and remove the references each socket holds on any UNPGC_DEAD
2672a9aa06f7SJason A. Harmening 	 * sockets in its queue.  After this step, all remaining references on
2673a9aa06f7SJason A. Harmening 	 * sockets marked UNPGC_DEAD should not be part of any cycle.
2674a9aa06f7SJason A. Harmening 	 */
2675a9aa06f7SJason A. Harmening 	LIST_FOREACH(unp, &unp_deadhead, unp_dead)
2676a9aa06f7SJason A. Harmening 		unp_gc_scan(unp, unp_remove_dead_ref);
2677a9aa06f7SJason A. Harmening 
2678a9aa06f7SJason A. Harmening 	/*
2679a9aa06f7SJason A. Harmening 	 * If a socket still has a non-negative refcount, it cannot be in a
2680a9aa06f7SJason A. Harmening 	 * cycle.  In this case increment refcount of all children iteratively.
2681397c19d1SJeff Roberson 	 * Stop the scan once we do a complete loop without discovering
2682397c19d1SJeff Roberson 	 * a new reachable socket.
2683397c19d1SJeff Roberson 	 */
2684df8bae1dSRodney W. Grimes 	do {
2685397c19d1SJeff Roberson 		unp_marked = 0;
2686a9aa06f7SJason A. Harmening 		LIST_FOREACH_SAFE(unp, &unp_deadhead, unp_dead, unptmp)
2687a9aa06f7SJason A. Harmening 			if (unp->unp_gcrefs > 0) {
2688a9aa06f7SJason A. Harmening 				unp->unp_gcflag &= ~UNPGC_DEAD;
2689a9aa06f7SJason A. Harmening 				LIST_REMOVE(unp, unp_dead);
2690a9aa06f7SJason A. Harmening 				KASSERT(unp_unreachable > 0,
2691a9aa06f7SJason A. Harmening 				    ("%s: unp_unreachable underflow.",
2692a9aa06f7SJason A. Harmening 				    __func__));
2693a9aa06f7SJason A. Harmening 				unp_unreachable--;
2694a9aa06f7SJason A. Harmening 				unp_gc_scan(unp, unp_restore_undead_ref);
2695a9aa06f7SJason A. Harmening 			}
2696397c19d1SJeff Roberson 	} while (unp_marked);
2697a9aa06f7SJason A. Harmening 
2698779f106aSGleb Smirnoff 	UNP_LINK_RUNLOCK();
2699a9aa06f7SJason A. Harmening 
2700397c19d1SJeff Roberson 	if (unp_unreachable == 0)
2701397c19d1SJeff Roberson 		return;
270260a5ef26SRobert Watson 
2703ed5b7817SJulian Elischer 	/*
2704a9aa06f7SJason A. Harmening 	 * Allocate space for a local array of dead unpcbs.
2705a9aa06f7SJason A. Harmening 	 * TODO: can this path be simplified by instead using the local
2706a9aa06f7SJason A. Harmening 	 * dead list at unp_deadhead, after taking out references
2707a9aa06f7SJason A. Harmening 	 * on the file object and/or unpcb and dropping the link lock?
2708ed5b7817SJulian Elischer 	 */
2709397c19d1SJeff Roberson 	unref = malloc(unp_unreachable * sizeof(struct file *),
2710397c19d1SJeff Roberson 	    M_TEMP, M_WAITOK);
271160a5ef26SRobert Watson 
2712ed5b7817SJulian Elischer 	/*
2713397c19d1SJeff Roberson 	 * Iterate looking for sockets which have been specifically marked
2714a9aa06f7SJason A. Harmening 	 * as unreachable and store them locally.
2715ed5b7817SJulian Elischer 	 */
2716f7780c61SKonstantin Belousov 	UNP_LINK_RLOCK();
2717a9aa06f7SJason A. Harmening 	total = 0;
2718a9aa06f7SJason A. Harmening 	LIST_FOREACH(unp, &unp_deadhead, unp_dead) {
2719a9aa06f7SJason A. Harmening 		KASSERT((unp->unp_gcflag & UNPGC_DEAD) != 0,
2720a9aa06f7SJason A. Harmening 		    ("%s: unp %p not marked UNPGC_DEAD", __func__, unp));
2721a9aa06f7SJason A. Harmening 		unp->unp_gcflag &= ~UNPGC_DEAD;
2722f7780c61SKonstantin Belousov 		f = unp->unp_file;
2723f7780c61SKonstantin Belousov 		if (unp->unp_msgcount == 0 || f == NULL ||
27243c50616fSMateusz Guzik 		    refcount_load(&f->f_count) != unp->unp_msgcount ||
2725f1cf2b9dSKonstantin Belousov 		    !fhold(f))
2726f7780c61SKonstantin Belousov 			continue;
2727f7780c61SKonstantin Belousov 		unref[total++] = f;
2728f7780c61SKonstantin Belousov 		KASSERT(total <= unp_unreachable,
2729a9aa06f7SJason A. Harmening 		    ("%s: incorrect unreachable count.", __func__));
2730397c19d1SJeff Roberson 	}
2731f7780c61SKonstantin Belousov 	UNP_LINK_RUNLOCK();
273260a5ef26SRobert Watson 
2733ed5b7817SJulian Elischer 	/*
2734397c19d1SJeff Roberson 	 * Now flush all sockets, free'ing rights.  This will free the
2735397c19d1SJeff Roberson 	 * struct files associated with these sockets but leave each socket
2736397c19d1SJeff Roberson 	 * with one remaining ref.
2737ed5b7817SJulian Elischer 	 */
27381fb51a12SBjoern A. Zeeb 	for (i = 0; i < total; i++) {
27391fb51a12SBjoern A. Zeeb 		struct socket *so;
27401fb51a12SBjoern A. Zeeb 
27411fb51a12SBjoern A. Zeeb 		so = unref[i]->f_data;
27421fb51a12SBjoern A. Zeeb 		CURVNET_SET(so->so_vnet);
27431fb51a12SBjoern A. Zeeb 		sorflush(so);
27441fb51a12SBjoern A. Zeeb 		CURVNET_RESTORE();
27451fb51a12SBjoern A. Zeeb 	}
274660a5ef26SRobert Watson 
2747ed5b7817SJulian Elischer 	/*
2748397c19d1SJeff Roberson 	 * And finally release the sockets so they can be reclaimed.
2749ed5b7817SJulian Elischer 	 */
2750f7780c61SKonstantin Belousov 	for (i = 0; i < total; i++)
2751397c19d1SJeff Roberson 		fdrop(unref[i], NULL);
2752f7780c61SKonstantin Belousov 	unp_recycled += total;
2753397c19d1SJeff Roberson 	free(unref, M_TEMP);
2754df8bae1dSRodney W. Grimes }
2755df8bae1dSRodney W. Grimes 
27560c40f353SConrad Meyer /*
27570c40f353SConrad Meyer  * Synchronize against unp_gc, which can trip over data as we are freeing it.
27580c40f353SConrad Meyer  */
27590c40f353SConrad Meyer static void
276099ab95dbSMark Johnston unp_dispose(struct socket *so)
27610c40f353SConrad Meyer {
2762a982ce04SGleb Smirnoff 	struct sockbuf *sb = &so->so_rcv;
27630c40f353SConrad Meyer 	struct unpcb *unp;
2764a982ce04SGleb Smirnoff 	struct mbuf *m;
27650c40f353SConrad Meyer 
276642f2fa99SGleb Smirnoff 	MPASS(!SOLISTENING(so));
276742f2fa99SGleb Smirnoff 
27680c40f353SConrad Meyer 	unp = sotounpcb(so);
2769779f106aSGleb Smirnoff 	UNP_LINK_WLOCK();
27700c40f353SConrad Meyer 	unp->unp_gcflag |= UNPGC_IGNORE_RIGHTS;
2771779f106aSGleb Smirnoff 	UNP_LINK_WUNLOCK();
2772a982ce04SGleb Smirnoff 
2773a982ce04SGleb Smirnoff 	/*
2774a982ce04SGleb Smirnoff 	 * Grab our special mbufs before calling sbrelease().
2775a982ce04SGleb Smirnoff 	 */
2776a982ce04SGleb Smirnoff 	SOCK_RECVBUF_LOCK(so);
2777a982ce04SGleb Smirnoff 	m = sbcut_locked(sb, sb->sb_ccc);
2778a982ce04SGleb Smirnoff 	KASSERT(sb->sb_ccc == 0 && sb->sb_mb == 0 && sb->sb_mbcnt == 0,
2779a982ce04SGleb Smirnoff 	    ("%s: ccc %u mb %p mbcnt %u", __func__,
2780a982ce04SGleb Smirnoff 	    sb->sb_ccc, (void *)sb->sb_mb, sb->sb_mbcnt));
278143283184SGleb Smirnoff 	sbrelease_locked(so, SO_RCV);
2782a982ce04SGleb Smirnoff 	SOCK_RECVBUF_UNLOCK(so);
2783a982ce04SGleb Smirnoff 	if (SOCK_IO_RECV_OWNED(so))
2784a982ce04SGleb Smirnoff 		SOCK_IO_RECV_UNLOCK(so);
2785a982ce04SGleb Smirnoff 
27862e5bf7c4SGleb Smirnoff 	if (m != NULL) {
2787eac7f079SGleb Smirnoff 		unp_scan(m, unp_freerights);
27882e5bf7c4SGleb Smirnoff 		m_freem(m);
27892e5bf7c4SGleb Smirnoff 	}
27900c40f353SConrad Meyer }
27910c40f353SConrad Meyer 
2792f708ef1bSPoul-Henning Kamp static void
2793be26ba7cSPawel Jakub Dawidek unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int))
2794df8bae1dSRodney W. Grimes {
27952bc21ed9SDavid Malone 	struct mbuf *m;
27962bc21ed9SDavid Malone 	struct cmsghdr *cm;
27972bc21ed9SDavid Malone 	void *data;
27982bc21ed9SDavid Malone 	socklen_t clen, datalen;
2799df8bae1dSRodney W. Grimes 
2800fc3fcacfSRobert Watson 	while (m0 != NULL) {
28012bc21ed9SDavid Malone 		for (m = m0; m; m = m->m_next) {
280212396bdcSDavid Malone 			if (m->m_type != MT_CONTROL)
2803df8bae1dSRodney W. Grimes 				continue;
28042bc21ed9SDavid Malone 
28052bc21ed9SDavid Malone 			cm = mtod(m, struct cmsghdr *);
28062bc21ed9SDavid Malone 			clen = m->m_len;
28072bc21ed9SDavid Malone 
28082bc21ed9SDavid Malone 			while (cm != NULL) {
28092bc21ed9SDavid Malone 				if (sizeof(*cm) > clen || cm->cmsg_len > clen)
28102bc21ed9SDavid Malone 					break;
28112bc21ed9SDavid Malone 
28122bc21ed9SDavid Malone 				data = CMSG_DATA(cm);
28132bc21ed9SDavid Malone 				datalen = (caddr_t)cm + cm->cmsg_len
28142bc21ed9SDavid Malone 				    - (caddr_t)data;
28152bc21ed9SDavid Malone 
28162bc21ed9SDavid Malone 				if (cm->cmsg_level == SOL_SOCKET &&
28172bc21ed9SDavid Malone 				    cm->cmsg_type == SCM_RIGHTS) {
2818be26ba7cSPawel Jakub Dawidek 					(*op)(data, datalen /
2819be26ba7cSPawel Jakub Dawidek 					    sizeof(struct filedescent *));
28202bc21ed9SDavid Malone 				}
28212bc21ed9SDavid Malone 
28222bc21ed9SDavid Malone 				if (CMSG_SPACE(datalen) < clen) {
28232bc21ed9SDavid Malone 					clen -= CMSG_SPACE(datalen);
28242bc21ed9SDavid Malone 					cm = (struct cmsghdr *)
28252bc21ed9SDavid Malone 					    ((caddr_t)cm + CMSG_SPACE(datalen));
28262bc21ed9SDavid Malone 				} else {
28272bc21ed9SDavid Malone 					clen = 0;
28282bc21ed9SDavid Malone 					cm = NULL;
28292bc21ed9SDavid Malone 				}
28302bc21ed9SDavid Malone 			}
2831df8bae1dSRodney W. Grimes 		}
2832c29a3321SKevin Lo 		m0 = m0->m_nextpkt;
2833df8bae1dSRodney W. Grimes 	}
2834df8bae1dSRodney W. Grimes }
2835df8bae1dSRodney W. Grimes 
2836662c901cSMikolaj Golub /*
2837662c901cSMikolaj Golub  * A helper function called by VFS before socket-type vnode reclamation.
2838662c901cSMikolaj Golub  * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
2839662c901cSMikolaj Golub  * use count.
2840662c901cSMikolaj Golub  */
2841662c901cSMikolaj Golub void
2842662c901cSMikolaj Golub vfs_unp_reclaim(struct vnode *vp)
2843662c901cSMikolaj Golub {
2844662c901cSMikolaj Golub 	struct unpcb *unp;
2845662c901cSMikolaj Golub 	int active;
284675a67bf3SMatt Macy 	struct mtx *vplock;
2847662c901cSMikolaj Golub 
2848662c901cSMikolaj Golub 	ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
2849662c901cSMikolaj Golub 	KASSERT(vp->v_type == VSOCK,
2850662c901cSMikolaj Golub 	    ("vfs_unp_reclaim: vp->v_type != VSOCK"));
2851662c901cSMikolaj Golub 
2852662c901cSMikolaj Golub 	active = 0;
285375a67bf3SMatt Macy 	vplock = mtx_pool_find(mtxpool_sleep, vp);
285475a67bf3SMatt Macy 	mtx_lock(vplock);
28550c3c207fSGleb Smirnoff 	VOP_UNP_CONNECT(vp, &unp);
2856662c901cSMikolaj Golub 	if (unp == NULL)
2857662c901cSMikolaj Golub 		goto done;
2858662c901cSMikolaj Golub 	UNP_PCB_LOCK(unp);
2859c7e41c8bSMikolaj Golub 	if (unp->unp_vnode == vp) {
2860c7e41c8bSMikolaj Golub 		VOP_UNP_DETACH(vp);
2861662c901cSMikolaj Golub 		unp->unp_vnode = NULL;
2862662c901cSMikolaj Golub 		active = 1;
2863662c901cSMikolaj Golub 	}
2864662c901cSMikolaj Golub 	UNP_PCB_UNLOCK(unp);
2865662c901cSMikolaj Golub  done:
286675a67bf3SMatt Macy 	mtx_unlock(vplock);
2867662c901cSMikolaj Golub 	if (active)
2868662c901cSMikolaj Golub 		vunref(vp);
2869662c901cSMikolaj Golub }
2870662c901cSMikolaj Golub 
287103c96c31SRobert Watson #ifdef DDB
287203c96c31SRobert Watson static void
287303c96c31SRobert Watson db_print_indent(int indent)
287403c96c31SRobert Watson {
287503c96c31SRobert Watson 	int i;
287603c96c31SRobert Watson 
287703c96c31SRobert Watson 	for (i = 0; i < indent; i++)
287803c96c31SRobert Watson 		db_printf(" ");
287903c96c31SRobert Watson }
288003c96c31SRobert Watson 
288103c96c31SRobert Watson static void
288203c96c31SRobert Watson db_print_unpflags(int unp_flags)
288303c96c31SRobert Watson {
288403c96c31SRobert Watson 	int comma;
288503c96c31SRobert Watson 
288603c96c31SRobert Watson 	comma = 0;
288703c96c31SRobert Watson 	if (unp_flags & UNP_HAVEPC) {
288803c96c31SRobert Watson 		db_printf("%sUNP_HAVEPC", comma ? ", " : "");
288903c96c31SRobert Watson 		comma = 1;
289003c96c31SRobert Watson 	}
28912de07e40SConrad Meyer 	if (unp_flags & UNP_WANTCRED_ALWAYS) {
28922de07e40SConrad Meyer 		db_printf("%sUNP_WANTCRED_ALWAYS", comma ? ", " : "");
28932de07e40SConrad Meyer 		comma = 1;
28942de07e40SConrad Meyer 	}
28952de07e40SConrad Meyer 	if (unp_flags & UNP_WANTCRED_ONESHOT) {
28962de07e40SConrad Meyer 		db_printf("%sUNP_WANTCRED_ONESHOT", comma ? ", " : "");
289703c96c31SRobert Watson 		comma = 1;
289803c96c31SRobert Watson 	}
289903c96c31SRobert Watson 	if (unp_flags & UNP_CONNWAIT) {
290003c96c31SRobert Watson 		db_printf("%sUNP_CONNWAIT", comma ? ", " : "");
290103c96c31SRobert Watson 		comma = 1;
290203c96c31SRobert Watson 	}
290303c96c31SRobert Watson 	if (unp_flags & UNP_CONNECTING) {
290403c96c31SRobert Watson 		db_printf("%sUNP_CONNECTING", comma ? ", " : "");
290503c96c31SRobert Watson 		comma = 1;
290603c96c31SRobert Watson 	}
290703c96c31SRobert Watson 	if (unp_flags & UNP_BINDING) {
290803c96c31SRobert Watson 		db_printf("%sUNP_BINDING", comma ? ", " : "");
290903c96c31SRobert Watson 		comma = 1;
291003c96c31SRobert Watson 	}
291103c96c31SRobert Watson }
291203c96c31SRobert Watson 
291303c96c31SRobert Watson static void
291403c96c31SRobert Watson db_print_xucred(int indent, struct xucred *xu)
291503c96c31SRobert Watson {
291603c96c31SRobert Watson 	int comma, i;
291703c96c31SRobert Watson 
291803c96c31SRobert Watson 	db_print_indent(indent);
2919c5afec6eSDmitry Chagin 	db_printf("cr_version: %u   cr_uid: %u   cr_pid: %d   cr_ngroups: %d\n",
2920c5afec6eSDmitry Chagin 	    xu->cr_version, xu->cr_uid, xu->cr_pid, xu->cr_ngroups);
292103c96c31SRobert Watson 	db_print_indent(indent);
292203c96c31SRobert Watson 	db_printf("cr_groups: ");
292303c96c31SRobert Watson 	comma = 0;
292403c96c31SRobert Watson 	for (i = 0; i < xu->cr_ngroups; i++) {
292503c96c31SRobert Watson 		db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
292603c96c31SRobert Watson 		comma = 1;
292703c96c31SRobert Watson 	}
292803c96c31SRobert Watson 	db_printf("\n");
292903c96c31SRobert Watson }
293003c96c31SRobert Watson 
293103c96c31SRobert Watson static void
293203c96c31SRobert Watson db_print_unprefs(int indent, struct unp_head *uh)
293303c96c31SRobert Watson {
293403c96c31SRobert Watson 	struct unpcb *unp;
293503c96c31SRobert Watson 	int counter;
293603c96c31SRobert Watson 
293703c96c31SRobert Watson 	counter = 0;
293803c96c31SRobert Watson 	LIST_FOREACH(unp, uh, unp_reflink) {
293903c96c31SRobert Watson 		if (counter % 4 == 0)
294003c96c31SRobert Watson 			db_print_indent(indent);
294103c96c31SRobert Watson 		db_printf("%p  ", unp);
294203c96c31SRobert Watson 		if (counter % 4 == 3)
294303c96c31SRobert Watson 			db_printf("\n");
294403c96c31SRobert Watson 		counter++;
294503c96c31SRobert Watson 	}
294603c96c31SRobert Watson 	if (counter != 0 && counter % 4 != 0)
294703c96c31SRobert Watson 		db_printf("\n");
294803c96c31SRobert Watson }
294903c96c31SRobert Watson 
295003c96c31SRobert Watson DB_SHOW_COMMAND(unpcb, db_show_unpcb)
295103c96c31SRobert Watson {
295203c96c31SRobert Watson 	struct unpcb *unp;
295303c96c31SRobert Watson 
295403c96c31SRobert Watson         if (!have_addr) {
295503c96c31SRobert Watson                 db_printf("usage: show unpcb <addr>\n");
295603c96c31SRobert Watson                 return;
295703c96c31SRobert Watson         }
295803c96c31SRobert Watson         unp = (struct unpcb *)addr;
295903c96c31SRobert Watson 
296003c96c31SRobert Watson 	db_printf("unp_socket: %p   unp_vnode: %p\n", unp->unp_socket,
296103c96c31SRobert Watson 	    unp->unp_vnode);
296203c96c31SRobert Watson 
2963fc8fdae0SMatthew D Fleming 	db_printf("unp_ino: %ju   unp_conn: %p\n", (uintmax_t)unp->unp_ino,
296403c96c31SRobert Watson 	    unp->unp_conn);
296503c96c31SRobert Watson 
296603c96c31SRobert Watson 	db_printf("unp_refs:\n");
296703c96c31SRobert Watson 	db_print_unprefs(2, &unp->unp_refs);
296803c96c31SRobert Watson 
296903c96c31SRobert Watson 	/* XXXRW: Would be nice to print the full address, if any. */
297003c96c31SRobert Watson 	db_printf("unp_addr: %p\n", unp->unp_addr);
297103c96c31SRobert Watson 
2972c2090e73SAlan Somers 	db_printf("unp_gencnt: %llu\n",
297303c96c31SRobert Watson 	    (unsigned long long)unp->unp_gencnt);
297403c96c31SRobert Watson 
297503c96c31SRobert Watson 	db_printf("unp_flags: %x (", unp->unp_flags);
297603c96c31SRobert Watson 	db_print_unpflags(unp->unp_flags);
297703c96c31SRobert Watson 	db_printf(")\n");
297803c96c31SRobert Watson 
297903c96c31SRobert Watson 	db_printf("unp_peercred:\n");
298003c96c31SRobert Watson 	db_print_xucred(2, &unp->unp_peercred);
298103c96c31SRobert Watson 
298203c96c31SRobert Watson 	db_printf("unp_refcount: %u\n", unp->unp_refcount);
298303c96c31SRobert Watson }
298403c96c31SRobert Watson #endif
2985