1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1991, 1993 5 * The Regents of the University of California. All Rights Reserved. 6 * Copyright (c) 2004-2009 Robert N. M. Watson All Rights Reserved. 7 * Copyright (c) 2018 Matthew Macy 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 34 */ 35 36 /* 37 * UNIX Domain (Local) Sockets 38 * 39 * This is an implementation of UNIX (local) domain sockets. Each socket has 40 * an associated struct unpcb (UNIX protocol control block). Stream sockets 41 * may be connected to 0 or 1 other socket. Datagram sockets may be 42 * connected to 0, 1, or many other sockets. Sockets may be created and 43 * connected in pairs (socketpair(2)), or bound/connected to using the file 44 * system name space. For most purposes, only the receive socket buffer is 45 * used, as sending on one socket delivers directly to the receive socket 46 * buffer of a second socket. 47 * 48 * The implementation is substantially complicated by the fact that 49 * "ancillary data", such as file descriptors or credentials, may be passed 50 * across UNIX domain sockets. The potential for passing UNIX domain sockets 51 * over other UNIX domain sockets requires the implementation of a simple 52 * garbage collector to find and tear down cycles of disconnected sockets. 53 * 54 * TODO: 55 * RDM 56 * rethink name space problems 57 * need a proper out-of-band 58 */ 59 60 #include <sys/cdefs.h> 61 __FBSDID("$FreeBSD$"); 62 63 #include "opt_ddb.h" 64 65 #include <sys/param.h> 66 #include <sys/capsicum.h> 67 #include <sys/domain.h> 68 #include <sys/eventhandler.h> 69 #include <sys/fcntl.h> 70 #include <sys/file.h> 71 #include <sys/filedesc.h> 72 #include <sys/kernel.h> 73 #include <sys/lock.h> 74 #include <sys/malloc.h> 75 #include <sys/mbuf.h> 76 #include <sys/mount.h> 77 #include <sys/mutex.h> 78 #include <sys/namei.h> 79 #include <sys/proc.h> 80 #include <sys/protosw.h> 81 #include <sys/queue.h> 82 #include <sys/resourcevar.h> 83 #include <sys/rwlock.h> 84 #include <sys/socket.h> 85 #include <sys/socketvar.h> 86 #include <sys/signalvar.h> 87 #include <sys/stat.h> 88 #include <sys/sx.h> 89 #include <sys/sysctl.h> 90 #include <sys/systm.h> 91 #include <sys/taskqueue.h> 92 #include <sys/un.h> 93 #include <sys/unpcb.h> 94 #include <sys/vnode.h> 95 96 #include <net/vnet.h> 97 98 #ifdef DDB 99 #include <ddb/ddb.h> 100 #endif 101 102 #include <security/mac/mac_framework.h> 103 104 #include <vm/uma.h> 105 106 MALLOC_DECLARE(M_FILECAPS); 107 108 /* 109 * See unpcb.h for the locking key. 110 */ 111 112 static uma_zone_t unp_zone; 113 static unp_gen_t unp_gencnt; /* (l) */ 114 static u_int unp_count; /* (l) Count of local sockets. */ 115 static ino_t unp_ino; /* Prototype for fake inode numbers. */ 116 static int unp_rights; /* (g) File descriptors in flight. */ 117 static struct unp_head unp_shead; /* (l) List of stream sockets. */ 118 static struct unp_head unp_dhead; /* (l) List of datagram sockets. */ 119 static struct unp_head unp_sphead; /* (l) List of seqpacket sockets. */ 120 121 struct unp_defer { 122 SLIST_ENTRY(unp_defer) ud_link; 123 struct file *ud_fp; 124 }; 125 static SLIST_HEAD(, unp_defer) unp_defers; 126 static int unp_defers_count; 127 128 static const struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL }; 129 130 /* 131 * Garbage collection of cyclic file descriptor/socket references occurs 132 * asynchronously in a taskqueue context in order to avoid recursion and 133 * reentrance in the UNIX domain socket, file descriptor, and socket layer 134 * code. See unp_gc() for a full description. 135 */ 136 static struct timeout_task unp_gc_task; 137 138 /* 139 * The close of unix domain sockets attached as SCM_RIGHTS is 140 * postponed to the taskqueue, to avoid arbitrary recursion depth. 141 * The attached sockets might have another sockets attached. 142 */ 143 static struct task unp_defer_task; 144 145 /* 146 * Both send and receive buffers are allocated PIPSIZ bytes of buffering for 147 * stream sockets, although the total for sender and receiver is actually 148 * only PIPSIZ. 149 * 150 * Datagram sockets really use the sendspace as the maximum datagram size, 151 * and don't really want to reserve the sendspace. Their recvspace should be 152 * large enough for at least one max-size datagram plus address. 153 */ 154 #ifndef PIPSIZ 155 #define PIPSIZ 8192 156 #endif 157 static u_long unpst_sendspace = PIPSIZ; 158 static u_long unpst_recvspace = PIPSIZ; 159 static u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 160 static u_long unpdg_recvspace = 4*1024; 161 static u_long unpsp_sendspace = PIPSIZ; /* really max datagram size */ 162 static u_long unpsp_recvspace = PIPSIZ; 163 164 static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 165 "Local domain"); 166 static SYSCTL_NODE(_net_local, SOCK_STREAM, stream, 167 CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 168 "SOCK_STREAM"); 169 static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, 170 CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 171 "SOCK_DGRAM"); 172 static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket, 173 CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 174 "SOCK_SEQPACKET"); 175 176 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW, 177 &unpst_sendspace, 0, "Default stream send space."); 178 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW, 179 &unpst_recvspace, 0, "Default stream receive space."); 180 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW, 181 &unpdg_sendspace, 0, "Default datagram send space."); 182 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW, 183 &unpdg_recvspace, 0, "Default datagram receive space."); 184 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW, 185 &unpsp_sendspace, 0, "Default seqpacket send space."); 186 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW, 187 &unpsp_recvspace, 0, "Default seqpacket receive space."); 188 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, 189 "File descriptors in flight."); 190 SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD, 191 &unp_defers_count, 0, 192 "File descriptors deferred to taskqueue for close."); 193 194 /* 195 * Locking and synchronization: 196 * 197 * Several types of locks exist in the local domain socket implementation: 198 * - a global linkage lock 199 * - a global connection list lock 200 * - the mtxpool lock 201 * - per-unpcb mutexes 202 * 203 * The linkage lock protects the global socket lists, the generation number 204 * counter and garbage collector state. 205 * 206 * The connection list lock protects the list of referring sockets in a datagram 207 * socket PCB. This lock is also overloaded to protect a global list of 208 * sockets whose buffers contain socket references in the form of SCM_RIGHTS 209 * messages. To avoid recursion, such references are released by a dedicated 210 * thread. 211 * 212 * The mtxpool lock protects the vnode from being modified while referenced. 213 * Lock ordering rules require that it be acquired before any PCB locks. 214 * 215 * The unpcb lock (unp_mtx) protects the most commonly referenced fields in the 216 * unpcb. This includes the unp_conn field, which either links two connected 217 * PCBs together (for connected socket types) or points at the destination 218 * socket (for connectionless socket types). The operations of creating or 219 * destroying a connection therefore involve locking multiple PCBs. To avoid 220 * lock order reversals, in some cases this involves dropping a PCB lock and 221 * using a reference counter to maintain liveness. 222 * 223 * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer, 224 * allocated in pru_attach() and freed in pru_detach(). The validity of that 225 * pointer is an invariant, so no lock is required to dereference the so_pcb 226 * pointer if a valid socket reference is held by the caller. In practice, 227 * this is always true during operations performed on a socket. Each unpcb 228 * has a back-pointer to its socket, unp_socket, which will be stable under 229 * the same circumstances. 230 * 231 * This pointer may only be safely dereferenced as long as a valid reference 232 * to the unpcb is held. Typically, this reference will be from the socket, 233 * or from another unpcb when the referring unpcb's lock is held (in order 234 * that the reference not be invalidated during use). For example, to follow 235 * unp->unp_conn->unp_socket, you need to hold a lock on unp_conn to guarantee 236 * that detach is not run clearing unp_socket. 237 * 238 * Blocking with UNIX domain sockets is a tricky issue: unlike most network 239 * protocols, bind() is a non-atomic operation, and connect() requires 240 * potential sleeping in the protocol, due to potentially waiting on local or 241 * distributed file systems. We try to separate "lookup" operations, which 242 * may sleep, and the IPC operations themselves, which typically can occur 243 * with relative atomicity as locks can be held over the entire operation. 244 * 245 * Another tricky issue is simultaneous multi-threaded or multi-process 246 * access to a single UNIX domain socket. These are handled by the flags 247 * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or 248 * binding, both of which involve dropping UNIX domain socket locks in order 249 * to perform namei() and other file system operations. 250 */ 251 static struct rwlock unp_link_rwlock; 252 static struct mtx unp_defers_lock; 253 254 #define UNP_LINK_LOCK_INIT() rw_init(&unp_link_rwlock, \ 255 "unp_link_rwlock") 256 257 #define UNP_LINK_LOCK_ASSERT() rw_assert(&unp_link_rwlock, \ 258 RA_LOCKED) 259 #define UNP_LINK_UNLOCK_ASSERT() rw_assert(&unp_link_rwlock, \ 260 RA_UNLOCKED) 261 262 #define UNP_LINK_RLOCK() rw_rlock(&unp_link_rwlock) 263 #define UNP_LINK_RUNLOCK() rw_runlock(&unp_link_rwlock) 264 #define UNP_LINK_WLOCK() rw_wlock(&unp_link_rwlock) 265 #define UNP_LINK_WUNLOCK() rw_wunlock(&unp_link_rwlock) 266 #define UNP_LINK_WLOCK_ASSERT() rw_assert(&unp_link_rwlock, \ 267 RA_WLOCKED) 268 #define UNP_LINK_WOWNED() rw_wowned(&unp_link_rwlock) 269 270 #define UNP_DEFERRED_LOCK_INIT() mtx_init(&unp_defers_lock, \ 271 "unp_defer", NULL, MTX_DEF) 272 #define UNP_DEFERRED_LOCK() mtx_lock(&unp_defers_lock) 273 #define UNP_DEFERRED_UNLOCK() mtx_unlock(&unp_defers_lock) 274 275 #define UNP_REF_LIST_LOCK() UNP_DEFERRED_LOCK(); 276 #define UNP_REF_LIST_UNLOCK() UNP_DEFERRED_UNLOCK(); 277 278 #define UNP_PCB_LOCK_INIT(unp) mtx_init(&(unp)->unp_mtx, \ 279 "unp", "unp", \ 280 MTX_DUPOK|MTX_DEF) 281 #define UNP_PCB_LOCK_DESTROY(unp) mtx_destroy(&(unp)->unp_mtx) 282 #define UNP_PCB_LOCKPTR(unp) (&(unp)->unp_mtx) 283 #define UNP_PCB_LOCK(unp) mtx_lock(&(unp)->unp_mtx) 284 #define UNP_PCB_TRYLOCK(unp) mtx_trylock(&(unp)->unp_mtx) 285 #define UNP_PCB_UNLOCK(unp) mtx_unlock(&(unp)->unp_mtx) 286 #define UNP_PCB_OWNED(unp) mtx_owned(&(unp)->unp_mtx) 287 #define UNP_PCB_LOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_OWNED) 288 #define UNP_PCB_UNLOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_NOTOWNED) 289 290 static int uipc_connect2(struct socket *, struct socket *); 291 static int uipc_ctloutput(struct socket *, struct sockopt *); 292 static int unp_connect(struct socket *, struct sockaddr *, 293 struct thread *); 294 static int unp_connectat(int, struct socket *, struct sockaddr *, 295 struct thread *); 296 static int unp_connect2(struct socket *so, struct socket *so2, int); 297 static void unp_disconnect(struct unpcb *unp, struct unpcb *unp2); 298 static void unp_dispose(struct socket *so); 299 static void unp_dispose_mbuf(struct mbuf *); 300 static void unp_shutdown(struct unpcb *); 301 static void unp_drop(struct unpcb *); 302 static void unp_gc(__unused void *, int); 303 static void unp_scan(struct mbuf *, void (*)(struct filedescent **, int)); 304 static void unp_discard(struct file *); 305 static void unp_freerights(struct filedescent **, int); 306 static void unp_init(void); 307 static int unp_internalize(struct mbuf **, struct thread *); 308 static void unp_internalize_fp(struct file *); 309 static int unp_externalize(struct mbuf *, struct mbuf **, int); 310 static int unp_externalize_fp(struct file *); 311 static struct mbuf *unp_addsockcred(struct thread *, struct mbuf *); 312 static void unp_process_defers(void * __unused, int); 313 314 static void 315 unp_pcb_hold(struct unpcb *unp) 316 { 317 u_int old __unused; 318 319 old = refcount_acquire(&unp->unp_refcount); 320 KASSERT(old > 0, ("%s: unpcb %p has no references", __func__, unp)); 321 } 322 323 static __result_use_check bool 324 unp_pcb_rele(struct unpcb *unp) 325 { 326 bool ret; 327 328 UNP_PCB_LOCK_ASSERT(unp); 329 330 if ((ret = refcount_release(&unp->unp_refcount))) { 331 UNP_PCB_UNLOCK(unp); 332 UNP_PCB_LOCK_DESTROY(unp); 333 uma_zfree(unp_zone, unp); 334 } 335 return (ret); 336 } 337 338 static void 339 unp_pcb_rele_notlast(struct unpcb *unp) 340 { 341 bool ret __unused; 342 343 ret = refcount_release(&unp->unp_refcount); 344 KASSERT(!ret, ("%s: unpcb %p has no references", __func__, unp)); 345 } 346 347 static void 348 unp_pcb_lock_pair(struct unpcb *unp, struct unpcb *unp2) 349 { 350 UNP_PCB_UNLOCK_ASSERT(unp); 351 UNP_PCB_UNLOCK_ASSERT(unp2); 352 353 if (unp == unp2) { 354 UNP_PCB_LOCK(unp); 355 } else if ((uintptr_t)unp2 > (uintptr_t)unp) { 356 UNP_PCB_LOCK(unp); 357 UNP_PCB_LOCK(unp2); 358 } else { 359 UNP_PCB_LOCK(unp2); 360 UNP_PCB_LOCK(unp); 361 } 362 } 363 364 static void 365 unp_pcb_unlock_pair(struct unpcb *unp, struct unpcb *unp2) 366 { 367 UNP_PCB_UNLOCK(unp); 368 if (unp != unp2) 369 UNP_PCB_UNLOCK(unp2); 370 } 371 372 /* 373 * Try to lock the connected peer of an already locked socket. In some cases 374 * this requires that we unlock the current socket. The pairbusy counter is 375 * used to block concurrent connection attempts while the lock is dropped. The 376 * caller must be careful to revalidate PCB state. 377 */ 378 static struct unpcb * 379 unp_pcb_lock_peer(struct unpcb *unp) 380 { 381 struct unpcb *unp2; 382 383 UNP_PCB_LOCK_ASSERT(unp); 384 unp2 = unp->unp_conn; 385 if (__predict_false(unp2 == NULL)) 386 return (NULL); 387 if (__predict_false(unp == unp2)) 388 return (unp); 389 390 UNP_PCB_UNLOCK_ASSERT(unp2); 391 392 if (__predict_true(UNP_PCB_TRYLOCK(unp2))) 393 return (unp2); 394 if ((uintptr_t)unp2 > (uintptr_t)unp) { 395 UNP_PCB_LOCK(unp2); 396 return (unp2); 397 } 398 unp->unp_pairbusy++; 399 unp_pcb_hold(unp2); 400 UNP_PCB_UNLOCK(unp); 401 402 UNP_PCB_LOCK(unp2); 403 UNP_PCB_LOCK(unp); 404 KASSERT(unp->unp_conn == unp2 || unp->unp_conn == NULL, 405 ("%s: socket %p was reconnected", __func__, unp)); 406 if (--unp->unp_pairbusy == 0 && (unp->unp_flags & UNP_WAITING) != 0) { 407 unp->unp_flags &= ~UNP_WAITING; 408 wakeup(unp); 409 } 410 if (unp_pcb_rele(unp2)) { 411 /* unp2 is unlocked. */ 412 return (NULL); 413 } 414 if (unp->unp_conn == NULL) { 415 UNP_PCB_UNLOCK(unp2); 416 return (NULL); 417 } 418 return (unp2); 419 } 420 421 /* 422 * Definitions of protocols supported in the LOCAL domain. 423 */ 424 static struct domain localdomain; 425 static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream; 426 static struct pr_usrreqs uipc_usrreqs_seqpacket; 427 static struct protosw localsw[] = { 428 { 429 .pr_type = SOCK_STREAM, 430 .pr_domain = &localdomain, 431 .pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS, 432 .pr_ctloutput = &uipc_ctloutput, 433 .pr_usrreqs = &uipc_usrreqs_stream 434 }, 435 { 436 .pr_type = SOCK_DGRAM, 437 .pr_domain = &localdomain, 438 .pr_flags = PR_ATOMIC|PR_ADDR|PR_RIGHTS, 439 .pr_ctloutput = &uipc_ctloutput, 440 .pr_usrreqs = &uipc_usrreqs_dgram 441 }, 442 { 443 .pr_type = SOCK_SEQPACKET, 444 .pr_domain = &localdomain, 445 446 /* 447 * XXXRW: For now, PR_ADDR because soreceive will bump into them 448 * due to our use of sbappendaddr. A new sbappend variants is needed 449 * that supports both atomic record writes and control data. 450 */ 451 .pr_flags = PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|PR_WANTRCVD| 452 PR_RIGHTS, 453 .pr_ctloutput = &uipc_ctloutput, 454 .pr_usrreqs = &uipc_usrreqs_seqpacket, 455 }, 456 }; 457 458 static struct domain localdomain = { 459 .dom_family = AF_LOCAL, 460 .dom_name = "local", 461 .dom_init = unp_init, 462 .dom_externalize = unp_externalize, 463 .dom_dispose = unp_dispose, 464 .dom_protosw = localsw, 465 .dom_protoswNPROTOSW = &localsw[nitems(localsw)] 466 }; 467 DOMAIN_SET(local); 468 469 static void 470 uipc_abort(struct socket *so) 471 { 472 struct unpcb *unp, *unp2; 473 474 unp = sotounpcb(so); 475 KASSERT(unp != NULL, ("uipc_abort: unp == NULL")); 476 UNP_PCB_UNLOCK_ASSERT(unp); 477 478 UNP_PCB_LOCK(unp); 479 unp2 = unp->unp_conn; 480 if (unp2 != NULL) { 481 unp_pcb_hold(unp2); 482 UNP_PCB_UNLOCK(unp); 483 unp_drop(unp2); 484 } else 485 UNP_PCB_UNLOCK(unp); 486 } 487 488 static int 489 uipc_accept(struct socket *so, struct sockaddr **nam) 490 { 491 struct unpcb *unp, *unp2; 492 const struct sockaddr *sa; 493 494 /* 495 * Pass back name of connected socket, if it was bound and we are 496 * still connected (our peer may have closed already!). 497 */ 498 unp = sotounpcb(so); 499 KASSERT(unp != NULL, ("uipc_accept: unp == NULL")); 500 501 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 502 UNP_PCB_LOCK(unp); 503 unp2 = unp_pcb_lock_peer(unp); 504 if (unp2 != NULL && unp2->unp_addr != NULL) 505 sa = (struct sockaddr *)unp2->unp_addr; 506 else 507 sa = &sun_noname; 508 bcopy(sa, *nam, sa->sa_len); 509 unp_pcb_unlock_pair(unp, unp2); 510 return (0); 511 } 512 513 static int 514 uipc_attach(struct socket *so, int proto, struct thread *td) 515 { 516 u_long sendspace, recvspace; 517 struct unpcb *unp; 518 int error; 519 bool locked; 520 521 KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL")); 522 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 523 switch (so->so_type) { 524 case SOCK_STREAM: 525 sendspace = unpst_sendspace; 526 recvspace = unpst_recvspace; 527 break; 528 529 case SOCK_DGRAM: 530 sendspace = unpdg_sendspace; 531 recvspace = unpdg_recvspace; 532 break; 533 534 case SOCK_SEQPACKET: 535 sendspace = unpsp_sendspace; 536 recvspace = unpsp_recvspace; 537 break; 538 539 default: 540 panic("uipc_attach"); 541 } 542 error = soreserve(so, sendspace, recvspace); 543 if (error) 544 return (error); 545 } 546 unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO); 547 if (unp == NULL) 548 return (ENOBUFS); 549 LIST_INIT(&unp->unp_refs); 550 UNP_PCB_LOCK_INIT(unp); 551 unp->unp_socket = so; 552 so->so_pcb = unp; 553 refcount_init(&unp->unp_refcount, 1); 554 555 if ((locked = UNP_LINK_WOWNED()) == false) 556 UNP_LINK_WLOCK(); 557 558 unp->unp_gencnt = ++unp_gencnt; 559 unp->unp_ino = ++unp_ino; 560 unp_count++; 561 switch (so->so_type) { 562 case SOCK_STREAM: 563 LIST_INSERT_HEAD(&unp_shead, unp, unp_link); 564 break; 565 566 case SOCK_DGRAM: 567 LIST_INSERT_HEAD(&unp_dhead, unp, unp_link); 568 break; 569 570 case SOCK_SEQPACKET: 571 LIST_INSERT_HEAD(&unp_sphead, unp, unp_link); 572 break; 573 574 default: 575 panic("uipc_attach"); 576 } 577 578 if (locked == false) 579 UNP_LINK_WUNLOCK(); 580 581 return (0); 582 } 583 584 static int 585 uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td) 586 { 587 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 588 struct vattr vattr; 589 int error, namelen; 590 struct nameidata nd; 591 struct unpcb *unp; 592 struct vnode *vp; 593 struct mount *mp; 594 cap_rights_t rights; 595 char *buf; 596 597 if (nam->sa_family != AF_UNIX) 598 return (EAFNOSUPPORT); 599 600 unp = sotounpcb(so); 601 KASSERT(unp != NULL, ("uipc_bind: unp == NULL")); 602 603 if (soun->sun_len > sizeof(struct sockaddr_un)) 604 return (EINVAL); 605 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 606 if (namelen <= 0) 607 return (EINVAL); 608 609 /* 610 * We don't allow simultaneous bind() calls on a single UNIX domain 611 * socket, so flag in-progress operations, and return an error if an 612 * operation is already in progress. 613 * 614 * Historically, we have not allowed a socket to be rebound, so this 615 * also returns an error. Not allowing re-binding simplifies the 616 * implementation and avoids a great many possible failure modes. 617 */ 618 UNP_PCB_LOCK(unp); 619 if (unp->unp_vnode != NULL) { 620 UNP_PCB_UNLOCK(unp); 621 return (EINVAL); 622 } 623 if (unp->unp_flags & UNP_BINDING) { 624 UNP_PCB_UNLOCK(unp); 625 return (EALREADY); 626 } 627 unp->unp_flags |= UNP_BINDING; 628 UNP_PCB_UNLOCK(unp); 629 630 buf = malloc(namelen + 1, M_TEMP, M_WAITOK); 631 bcopy(soun->sun_path, buf, namelen); 632 buf[namelen] = 0; 633 634 restart: 635 NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME | NOCACHE, 636 UIO_SYSSPACE, buf, fd, cap_rights_init(&rights, CAP_BINDAT), td); 637 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */ 638 error = namei(&nd); 639 if (error) 640 goto error; 641 vp = nd.ni_vp; 642 if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { 643 NDFREE(&nd, NDF_ONLY_PNBUF); 644 if (nd.ni_dvp == vp) 645 vrele(nd.ni_dvp); 646 else 647 vput(nd.ni_dvp); 648 if (vp != NULL) { 649 vrele(vp); 650 error = EADDRINUSE; 651 goto error; 652 } 653 error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH); 654 if (error) 655 goto error; 656 goto restart; 657 } 658 VATTR_NULL(&vattr); 659 vattr.va_type = VSOCK; 660 vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask); 661 #ifdef MAC 662 error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd, 663 &vattr); 664 #endif 665 if (error == 0) 666 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); 667 NDFREE(&nd, NDF_ONLY_PNBUF); 668 vput(nd.ni_dvp); 669 if (error) { 670 vn_finished_write(mp); 671 goto error; 672 } 673 vp = nd.ni_vp; 674 ASSERT_VOP_ELOCKED(vp, "uipc_bind"); 675 soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK); 676 677 UNP_PCB_LOCK(unp); 678 VOP_UNP_BIND(vp, unp); 679 unp->unp_vnode = vp; 680 unp->unp_addr = soun; 681 unp->unp_flags &= ~UNP_BINDING; 682 UNP_PCB_UNLOCK(unp); 683 VOP_UNLOCK(vp); 684 vn_finished_write(mp); 685 free(buf, M_TEMP); 686 return (0); 687 688 error: 689 UNP_PCB_LOCK(unp); 690 unp->unp_flags &= ~UNP_BINDING; 691 UNP_PCB_UNLOCK(unp); 692 free(buf, M_TEMP); 693 return (error); 694 } 695 696 static int 697 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 698 { 699 700 return (uipc_bindat(AT_FDCWD, so, nam, td)); 701 } 702 703 static int 704 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 705 { 706 int error; 707 708 KASSERT(td == curthread, ("uipc_connect: td != curthread")); 709 error = unp_connect(so, nam, td); 710 return (error); 711 } 712 713 static int 714 uipc_connectat(int fd, struct socket *so, struct sockaddr *nam, 715 struct thread *td) 716 { 717 int error; 718 719 KASSERT(td == curthread, ("uipc_connectat: td != curthread")); 720 error = unp_connectat(fd, so, nam, td); 721 return (error); 722 } 723 724 static void 725 uipc_close(struct socket *so) 726 { 727 struct unpcb *unp, *unp2; 728 struct vnode *vp = NULL; 729 struct mtx *vplock; 730 731 unp = sotounpcb(so); 732 KASSERT(unp != NULL, ("uipc_close: unp == NULL")); 733 734 vplock = NULL; 735 if ((vp = unp->unp_vnode) != NULL) { 736 vplock = mtx_pool_find(mtxpool_sleep, vp); 737 mtx_lock(vplock); 738 } 739 UNP_PCB_LOCK(unp); 740 if (vp && unp->unp_vnode == NULL) { 741 mtx_unlock(vplock); 742 vp = NULL; 743 } 744 if (vp != NULL) { 745 VOP_UNP_DETACH(vp); 746 unp->unp_vnode = NULL; 747 } 748 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) 749 unp_disconnect(unp, unp2); 750 else 751 UNP_PCB_UNLOCK(unp); 752 if (vp) { 753 mtx_unlock(vplock); 754 vrele(vp); 755 } 756 } 757 758 static int 759 uipc_connect2(struct socket *so1, struct socket *so2) 760 { 761 struct unpcb *unp, *unp2; 762 int error; 763 764 unp = so1->so_pcb; 765 KASSERT(unp != NULL, ("uipc_connect2: unp == NULL")); 766 unp2 = so2->so_pcb; 767 KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL")); 768 unp_pcb_lock_pair(unp, unp2); 769 error = unp_connect2(so1, so2, PRU_CONNECT2); 770 unp_pcb_unlock_pair(unp, unp2); 771 return (error); 772 } 773 774 static void 775 uipc_detach(struct socket *so) 776 { 777 struct unpcb *unp, *unp2; 778 struct mtx *vplock; 779 struct vnode *vp; 780 int local_unp_rights; 781 782 unp = sotounpcb(so); 783 KASSERT(unp != NULL, ("uipc_detach: unp == NULL")); 784 785 vp = NULL; 786 vplock = NULL; 787 788 SOCK_LOCK(so); 789 if (!SOLISTENING(so)) { 790 /* 791 * Once the socket is removed from the global lists, 792 * uipc_ready() will not be able to locate its socket buffer, so 793 * clear the buffer now. At this point internalized rights have 794 * already been disposed of. 795 */ 796 sbrelease(&so->so_rcv, so); 797 } 798 SOCK_UNLOCK(so); 799 800 UNP_LINK_WLOCK(); 801 LIST_REMOVE(unp, unp_link); 802 if (unp->unp_gcflag & UNPGC_DEAD) 803 LIST_REMOVE(unp, unp_dead); 804 unp->unp_gencnt = ++unp_gencnt; 805 --unp_count; 806 UNP_LINK_WUNLOCK(); 807 808 UNP_PCB_UNLOCK_ASSERT(unp); 809 restart: 810 if ((vp = unp->unp_vnode) != NULL) { 811 vplock = mtx_pool_find(mtxpool_sleep, vp); 812 mtx_lock(vplock); 813 } 814 UNP_PCB_LOCK(unp); 815 if (unp->unp_vnode != vp && unp->unp_vnode != NULL) { 816 if (vplock) 817 mtx_unlock(vplock); 818 UNP_PCB_UNLOCK(unp); 819 goto restart; 820 } 821 if ((vp = unp->unp_vnode) != NULL) { 822 VOP_UNP_DETACH(vp); 823 unp->unp_vnode = NULL; 824 } 825 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) 826 unp_disconnect(unp, unp2); 827 else 828 UNP_PCB_UNLOCK(unp); 829 830 UNP_REF_LIST_LOCK(); 831 while (!LIST_EMPTY(&unp->unp_refs)) { 832 struct unpcb *ref = LIST_FIRST(&unp->unp_refs); 833 834 unp_pcb_hold(ref); 835 UNP_REF_LIST_UNLOCK(); 836 837 MPASS(ref != unp); 838 UNP_PCB_UNLOCK_ASSERT(ref); 839 unp_drop(ref); 840 UNP_REF_LIST_LOCK(); 841 } 842 UNP_REF_LIST_UNLOCK(); 843 844 UNP_PCB_LOCK(unp); 845 local_unp_rights = unp_rights; 846 unp->unp_socket->so_pcb = NULL; 847 unp->unp_socket = NULL; 848 free(unp->unp_addr, M_SONAME); 849 unp->unp_addr = NULL; 850 if (!unp_pcb_rele(unp)) 851 UNP_PCB_UNLOCK(unp); 852 if (vp) { 853 mtx_unlock(vplock); 854 vrele(vp); 855 } 856 if (local_unp_rights) 857 taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1); 858 } 859 860 static int 861 uipc_disconnect(struct socket *so) 862 { 863 struct unpcb *unp, *unp2; 864 865 unp = sotounpcb(so); 866 KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL")); 867 868 UNP_PCB_LOCK(unp); 869 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) 870 unp_disconnect(unp, unp2); 871 else 872 UNP_PCB_UNLOCK(unp); 873 return (0); 874 } 875 876 static int 877 uipc_listen(struct socket *so, int backlog, struct thread *td) 878 { 879 struct unpcb *unp; 880 int error; 881 882 if (so->so_type != SOCK_STREAM && so->so_type != SOCK_SEQPACKET) 883 return (EOPNOTSUPP); 884 885 unp = sotounpcb(so); 886 KASSERT(unp != NULL, ("uipc_listen: unp == NULL")); 887 888 UNP_PCB_LOCK(unp); 889 if (unp->unp_vnode == NULL) { 890 /* Already connected or not bound to an address. */ 891 error = unp->unp_conn != NULL ? EINVAL : EDESTADDRREQ; 892 UNP_PCB_UNLOCK(unp); 893 return (error); 894 } 895 896 SOCK_LOCK(so); 897 error = solisten_proto_check(so); 898 if (error == 0) { 899 cru2xt(td, &unp->unp_peercred); 900 solisten_proto(so, backlog); 901 } 902 SOCK_UNLOCK(so); 903 UNP_PCB_UNLOCK(unp); 904 return (error); 905 } 906 907 static int 908 uipc_peeraddr(struct socket *so, struct sockaddr **nam) 909 { 910 struct unpcb *unp, *unp2; 911 const struct sockaddr *sa; 912 913 unp = sotounpcb(so); 914 KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL")); 915 916 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 917 UNP_LINK_RLOCK(); 918 /* 919 * XXX: It seems that this test always fails even when connection is 920 * established. So, this else clause is added as workaround to 921 * return PF_LOCAL sockaddr. 922 */ 923 unp2 = unp->unp_conn; 924 if (unp2 != NULL) { 925 UNP_PCB_LOCK(unp2); 926 if (unp2->unp_addr != NULL) 927 sa = (struct sockaddr *) unp2->unp_addr; 928 else 929 sa = &sun_noname; 930 bcopy(sa, *nam, sa->sa_len); 931 UNP_PCB_UNLOCK(unp2); 932 } else { 933 sa = &sun_noname; 934 bcopy(sa, *nam, sa->sa_len); 935 } 936 UNP_LINK_RUNLOCK(); 937 return (0); 938 } 939 940 static int 941 uipc_rcvd(struct socket *so, int flags) 942 { 943 struct unpcb *unp, *unp2; 944 struct socket *so2; 945 u_int mbcnt, sbcc; 946 947 unp = sotounpcb(so); 948 KASSERT(unp != NULL, ("%s: unp == NULL", __func__)); 949 KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET, 950 ("%s: socktype %d", __func__, so->so_type)); 951 952 /* 953 * Adjust backpressure on sender and wakeup any waiting to write. 954 * 955 * The unp lock is acquired to maintain the validity of the unp_conn 956 * pointer; no lock on unp2 is required as unp2->unp_socket will be 957 * static as long as we don't permit unp2 to disconnect from unp, 958 * which is prevented by the lock on unp. We cache values from 959 * so_rcv to avoid holding the so_rcv lock over the entire 960 * transaction on the remote so_snd. 961 */ 962 SOCKBUF_LOCK(&so->so_rcv); 963 mbcnt = so->so_rcv.sb_mbcnt; 964 sbcc = sbavail(&so->so_rcv); 965 SOCKBUF_UNLOCK(&so->so_rcv); 966 /* 967 * There is a benign race condition at this point. If we're planning to 968 * clear SB_STOP, but uipc_send is called on the connected socket at 969 * this instant, it might add data to the sockbuf and set SB_STOP. Then 970 * we would erroneously clear SB_STOP below, even though the sockbuf is 971 * full. The race is benign because the only ill effect is to allow the 972 * sockbuf to exceed its size limit, and the size limits are not 973 * strictly guaranteed anyway. 974 */ 975 UNP_PCB_LOCK(unp); 976 unp2 = unp->unp_conn; 977 if (unp2 == NULL) { 978 UNP_PCB_UNLOCK(unp); 979 return (0); 980 } 981 so2 = unp2->unp_socket; 982 SOCKBUF_LOCK(&so2->so_snd); 983 if (sbcc < so2->so_snd.sb_hiwat && mbcnt < so2->so_snd.sb_mbmax) 984 so2->so_snd.sb_flags &= ~SB_STOP; 985 sowwakeup_locked(so2); 986 UNP_PCB_UNLOCK(unp); 987 return (0); 988 } 989 990 static int 991 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, 992 struct mbuf *control, struct thread *td) 993 { 994 struct unpcb *unp, *unp2; 995 struct socket *so2; 996 u_int mbcnt, sbcc; 997 int freed, error; 998 999 unp = sotounpcb(so); 1000 KASSERT(unp != NULL, ("%s: unp == NULL", __func__)); 1001 KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM || 1002 so->so_type == SOCK_SEQPACKET, 1003 ("%s: socktype %d", __func__, so->so_type)); 1004 1005 freed = error = 0; 1006 if (flags & PRUS_OOB) { 1007 error = EOPNOTSUPP; 1008 goto release; 1009 } 1010 if (control != NULL && (error = unp_internalize(&control, td))) 1011 goto release; 1012 1013 unp2 = NULL; 1014 switch (so->so_type) { 1015 case SOCK_DGRAM: 1016 { 1017 const struct sockaddr *from; 1018 1019 if (nam != NULL) { 1020 error = unp_connect(so, nam, td); 1021 if (error != 0) 1022 break; 1023 } 1024 UNP_PCB_LOCK(unp); 1025 1026 /* 1027 * Because connect() and send() are non-atomic in a sendto() 1028 * with a target address, it's possible that the socket will 1029 * have disconnected before the send() can run. In that case 1030 * return the slightly counter-intuitive but otherwise 1031 * correct error that the socket is not connected. 1032 */ 1033 unp2 = unp_pcb_lock_peer(unp); 1034 if (unp2 == NULL) { 1035 UNP_PCB_UNLOCK(unp); 1036 error = ENOTCONN; 1037 break; 1038 } 1039 1040 if (unp2->unp_flags & UNP_WANTCRED) 1041 control = unp_addsockcred(td, control); 1042 if (unp->unp_addr != NULL) 1043 from = (struct sockaddr *)unp->unp_addr; 1044 else 1045 from = &sun_noname; 1046 so2 = unp2->unp_socket; 1047 SOCKBUF_LOCK(&so2->so_rcv); 1048 if (sbappendaddr_locked(&so2->so_rcv, from, m, 1049 control)) { 1050 sorwakeup_locked(so2); 1051 m = NULL; 1052 control = NULL; 1053 } else { 1054 SOCKBUF_UNLOCK(&so2->so_rcv); 1055 error = ENOBUFS; 1056 } 1057 if (nam != NULL) 1058 unp_disconnect(unp, unp2); 1059 else 1060 unp_pcb_unlock_pair(unp, unp2); 1061 break; 1062 } 1063 1064 case SOCK_SEQPACKET: 1065 case SOCK_STREAM: 1066 if ((so->so_state & SS_ISCONNECTED) == 0) { 1067 if (nam != NULL) { 1068 error = unp_connect(so, nam, td); 1069 if (error != 0) 1070 break; 1071 } else { 1072 error = ENOTCONN; 1073 break; 1074 } 1075 } 1076 1077 UNP_PCB_LOCK(unp); 1078 if ((unp2 = unp_pcb_lock_peer(unp)) == NULL) { 1079 UNP_PCB_UNLOCK(unp); 1080 error = ENOTCONN; 1081 break; 1082 } else if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 1083 unp_pcb_unlock_pair(unp, unp2); 1084 error = EPIPE; 1085 break; 1086 } 1087 UNP_PCB_UNLOCK(unp); 1088 if ((so2 = unp2->unp_socket) == NULL) { 1089 UNP_PCB_UNLOCK(unp2); 1090 error = ENOTCONN; 1091 break; 1092 } 1093 SOCKBUF_LOCK(&so2->so_rcv); 1094 if (unp2->unp_flags & UNP_WANTCRED) { 1095 /* 1096 * Credentials are passed only once on SOCK_STREAM 1097 * and SOCK_SEQPACKET. 1098 */ 1099 unp2->unp_flags &= ~UNP_WANTCRED; 1100 control = unp_addsockcred(td, control); 1101 } 1102 1103 /* 1104 * Send to paired receive port and wake up readers. Don't 1105 * check for space available in the receive buffer if we're 1106 * attaching ancillary data; Unix domain sockets only check 1107 * for space in the sending sockbuf, and that check is 1108 * performed one level up the stack. At that level we cannot 1109 * precisely account for the amount of buffer space used 1110 * (e.g., because control messages are not yet internalized). 1111 */ 1112 switch (so->so_type) { 1113 case SOCK_STREAM: 1114 if (control != NULL) { 1115 sbappendcontrol_locked(&so2->so_rcv, m, 1116 control, flags); 1117 control = NULL; 1118 } else 1119 sbappend_locked(&so2->so_rcv, m, flags); 1120 break; 1121 1122 case SOCK_SEQPACKET: 1123 if (sbappendaddr_nospacecheck_locked(&so2->so_rcv, 1124 &sun_noname, m, control)) 1125 control = NULL; 1126 break; 1127 } 1128 1129 mbcnt = so2->so_rcv.sb_mbcnt; 1130 sbcc = sbavail(&so2->so_rcv); 1131 if (sbcc) 1132 sorwakeup_locked(so2); 1133 else 1134 SOCKBUF_UNLOCK(&so2->so_rcv); 1135 1136 /* 1137 * The PCB lock on unp2 protects the SB_STOP flag. Without it, 1138 * it would be possible for uipc_rcvd to be called at this 1139 * point, drain the receiving sockbuf, clear SB_STOP, and then 1140 * we would set SB_STOP below. That could lead to an empty 1141 * sockbuf having SB_STOP set 1142 */ 1143 SOCKBUF_LOCK(&so->so_snd); 1144 if (sbcc >= so->so_snd.sb_hiwat || mbcnt >= so->so_snd.sb_mbmax) 1145 so->so_snd.sb_flags |= SB_STOP; 1146 SOCKBUF_UNLOCK(&so->so_snd); 1147 UNP_PCB_UNLOCK(unp2); 1148 m = NULL; 1149 break; 1150 } 1151 1152 /* 1153 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown. 1154 */ 1155 if (flags & PRUS_EOF) { 1156 UNP_PCB_LOCK(unp); 1157 socantsendmore(so); 1158 unp_shutdown(unp); 1159 UNP_PCB_UNLOCK(unp); 1160 } 1161 if (control != NULL && error != 0) 1162 unp_dispose_mbuf(control); 1163 1164 release: 1165 if (control != NULL) 1166 m_freem(control); 1167 /* 1168 * In case of PRUS_NOTREADY, uipc_ready() is responsible 1169 * for freeing memory. 1170 */ 1171 if (m != NULL && (flags & PRUS_NOTREADY) == 0) 1172 m_freem(m); 1173 return (error); 1174 } 1175 1176 static bool 1177 uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp) 1178 { 1179 struct mbuf *mb, *n; 1180 struct sockbuf *sb; 1181 1182 SOCK_LOCK(so); 1183 if (SOLISTENING(so)) { 1184 SOCK_UNLOCK(so); 1185 return (false); 1186 } 1187 mb = NULL; 1188 sb = &so->so_rcv; 1189 SOCKBUF_LOCK(sb); 1190 if (sb->sb_fnrdy != NULL) { 1191 for (mb = sb->sb_mb, n = mb->m_nextpkt; mb != NULL;) { 1192 if (mb == m) { 1193 *errorp = sbready(sb, m, count); 1194 break; 1195 } 1196 mb = mb->m_next; 1197 if (mb == NULL) { 1198 mb = n; 1199 if (mb != NULL) 1200 n = mb->m_nextpkt; 1201 } 1202 } 1203 } 1204 SOCKBUF_UNLOCK(sb); 1205 SOCK_UNLOCK(so); 1206 return (mb != NULL); 1207 } 1208 1209 static int 1210 uipc_ready(struct socket *so, struct mbuf *m, int count) 1211 { 1212 struct unpcb *unp, *unp2; 1213 struct socket *so2; 1214 int error, i; 1215 1216 unp = sotounpcb(so); 1217 1218 KASSERT(so->so_type == SOCK_STREAM, 1219 ("%s: unexpected socket type for %p", __func__, so)); 1220 1221 UNP_PCB_LOCK(unp); 1222 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) { 1223 UNP_PCB_UNLOCK(unp); 1224 so2 = unp2->unp_socket; 1225 SOCKBUF_LOCK(&so2->so_rcv); 1226 if ((error = sbready(&so2->so_rcv, m, count)) == 0) 1227 sorwakeup_locked(so2); 1228 else 1229 SOCKBUF_UNLOCK(&so2->so_rcv); 1230 UNP_PCB_UNLOCK(unp2); 1231 return (error); 1232 } 1233 UNP_PCB_UNLOCK(unp); 1234 1235 /* 1236 * The receiving socket has been disconnected, but may still be valid. 1237 * In this case, the now-ready mbufs are still present in its socket 1238 * buffer, so perform an exhaustive search before giving up and freeing 1239 * the mbufs. 1240 */ 1241 UNP_LINK_RLOCK(); 1242 LIST_FOREACH(unp, &unp_shead, unp_link) { 1243 if (uipc_ready_scan(unp->unp_socket, m, count, &error)) 1244 break; 1245 } 1246 UNP_LINK_RUNLOCK(); 1247 1248 if (unp == NULL) { 1249 for (i = 0; i < count; i++) 1250 m = m_free(m); 1251 error = ECONNRESET; 1252 } 1253 return (error); 1254 } 1255 1256 static int 1257 uipc_sense(struct socket *so, struct stat *sb) 1258 { 1259 struct unpcb *unp; 1260 1261 unp = sotounpcb(so); 1262 KASSERT(unp != NULL, ("uipc_sense: unp == NULL")); 1263 1264 sb->st_blksize = so->so_snd.sb_hiwat; 1265 sb->st_dev = NODEV; 1266 sb->st_ino = unp->unp_ino; 1267 return (0); 1268 } 1269 1270 static int 1271 uipc_shutdown(struct socket *so) 1272 { 1273 struct unpcb *unp; 1274 1275 unp = sotounpcb(so); 1276 KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL")); 1277 1278 UNP_PCB_LOCK(unp); 1279 socantsendmore(so); 1280 unp_shutdown(unp); 1281 UNP_PCB_UNLOCK(unp); 1282 return (0); 1283 } 1284 1285 static int 1286 uipc_sockaddr(struct socket *so, struct sockaddr **nam) 1287 { 1288 struct unpcb *unp; 1289 const struct sockaddr *sa; 1290 1291 unp = sotounpcb(so); 1292 KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL")); 1293 1294 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 1295 UNP_PCB_LOCK(unp); 1296 if (unp->unp_addr != NULL) 1297 sa = (struct sockaddr *) unp->unp_addr; 1298 else 1299 sa = &sun_noname; 1300 bcopy(sa, *nam, sa->sa_len); 1301 UNP_PCB_UNLOCK(unp); 1302 return (0); 1303 } 1304 1305 static struct pr_usrreqs uipc_usrreqs_dgram = { 1306 .pru_abort = uipc_abort, 1307 .pru_accept = uipc_accept, 1308 .pru_attach = uipc_attach, 1309 .pru_bind = uipc_bind, 1310 .pru_bindat = uipc_bindat, 1311 .pru_connect = uipc_connect, 1312 .pru_connectat = uipc_connectat, 1313 .pru_connect2 = uipc_connect2, 1314 .pru_detach = uipc_detach, 1315 .pru_disconnect = uipc_disconnect, 1316 .pru_listen = uipc_listen, 1317 .pru_peeraddr = uipc_peeraddr, 1318 .pru_rcvd = uipc_rcvd, 1319 .pru_send = uipc_send, 1320 .pru_sense = uipc_sense, 1321 .pru_shutdown = uipc_shutdown, 1322 .pru_sockaddr = uipc_sockaddr, 1323 .pru_soreceive = soreceive_dgram, 1324 .pru_close = uipc_close, 1325 }; 1326 1327 static struct pr_usrreqs uipc_usrreqs_seqpacket = { 1328 .pru_abort = uipc_abort, 1329 .pru_accept = uipc_accept, 1330 .pru_attach = uipc_attach, 1331 .pru_bind = uipc_bind, 1332 .pru_bindat = uipc_bindat, 1333 .pru_connect = uipc_connect, 1334 .pru_connectat = uipc_connectat, 1335 .pru_connect2 = uipc_connect2, 1336 .pru_detach = uipc_detach, 1337 .pru_disconnect = uipc_disconnect, 1338 .pru_listen = uipc_listen, 1339 .pru_peeraddr = uipc_peeraddr, 1340 .pru_rcvd = uipc_rcvd, 1341 .pru_send = uipc_send, 1342 .pru_sense = uipc_sense, 1343 .pru_shutdown = uipc_shutdown, 1344 .pru_sockaddr = uipc_sockaddr, 1345 .pru_soreceive = soreceive_generic, /* XXX: or...? */ 1346 .pru_close = uipc_close, 1347 }; 1348 1349 static struct pr_usrreqs uipc_usrreqs_stream = { 1350 .pru_abort = uipc_abort, 1351 .pru_accept = uipc_accept, 1352 .pru_attach = uipc_attach, 1353 .pru_bind = uipc_bind, 1354 .pru_bindat = uipc_bindat, 1355 .pru_connect = uipc_connect, 1356 .pru_connectat = uipc_connectat, 1357 .pru_connect2 = uipc_connect2, 1358 .pru_detach = uipc_detach, 1359 .pru_disconnect = uipc_disconnect, 1360 .pru_listen = uipc_listen, 1361 .pru_peeraddr = uipc_peeraddr, 1362 .pru_rcvd = uipc_rcvd, 1363 .pru_send = uipc_send, 1364 .pru_ready = uipc_ready, 1365 .pru_sense = uipc_sense, 1366 .pru_shutdown = uipc_shutdown, 1367 .pru_sockaddr = uipc_sockaddr, 1368 .pru_soreceive = soreceive_generic, 1369 .pru_close = uipc_close, 1370 }; 1371 1372 static int 1373 uipc_ctloutput(struct socket *so, struct sockopt *sopt) 1374 { 1375 struct unpcb *unp; 1376 struct xucred xu; 1377 int error, optval; 1378 1379 if (sopt->sopt_level != SOL_LOCAL) 1380 return (EINVAL); 1381 1382 unp = sotounpcb(so); 1383 KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL")); 1384 error = 0; 1385 switch (sopt->sopt_dir) { 1386 case SOPT_GET: 1387 switch (sopt->sopt_name) { 1388 case LOCAL_PEERCRED: 1389 UNP_PCB_LOCK(unp); 1390 if (unp->unp_flags & UNP_HAVEPC) 1391 xu = unp->unp_peercred; 1392 else { 1393 if (so->so_type == SOCK_STREAM) 1394 error = ENOTCONN; 1395 else 1396 error = EINVAL; 1397 } 1398 UNP_PCB_UNLOCK(unp); 1399 if (error == 0) 1400 error = sooptcopyout(sopt, &xu, sizeof(xu)); 1401 break; 1402 1403 case LOCAL_CREDS: 1404 /* Unlocked read. */ 1405 optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0; 1406 error = sooptcopyout(sopt, &optval, sizeof(optval)); 1407 break; 1408 1409 case LOCAL_CONNWAIT: 1410 /* Unlocked read. */ 1411 optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0; 1412 error = sooptcopyout(sopt, &optval, sizeof(optval)); 1413 break; 1414 1415 default: 1416 error = EOPNOTSUPP; 1417 break; 1418 } 1419 break; 1420 1421 case SOPT_SET: 1422 switch (sopt->sopt_name) { 1423 case LOCAL_CREDS: 1424 case LOCAL_CONNWAIT: 1425 error = sooptcopyin(sopt, &optval, sizeof(optval), 1426 sizeof(optval)); 1427 if (error) 1428 break; 1429 1430 #define OPTSET(bit) do { \ 1431 UNP_PCB_LOCK(unp); \ 1432 if (optval) \ 1433 unp->unp_flags |= bit; \ 1434 else \ 1435 unp->unp_flags &= ~bit; \ 1436 UNP_PCB_UNLOCK(unp); \ 1437 } while (0) 1438 1439 switch (sopt->sopt_name) { 1440 case LOCAL_CREDS: 1441 OPTSET(UNP_WANTCRED); 1442 break; 1443 1444 case LOCAL_CONNWAIT: 1445 OPTSET(UNP_CONNWAIT); 1446 break; 1447 1448 default: 1449 break; 1450 } 1451 break; 1452 #undef OPTSET 1453 default: 1454 error = ENOPROTOOPT; 1455 break; 1456 } 1457 break; 1458 1459 default: 1460 error = EOPNOTSUPP; 1461 break; 1462 } 1463 return (error); 1464 } 1465 1466 static int 1467 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 1468 { 1469 1470 return (unp_connectat(AT_FDCWD, so, nam, td)); 1471 } 1472 1473 static int 1474 unp_connectat(int fd, struct socket *so, struct sockaddr *nam, 1475 struct thread *td) 1476 { 1477 struct mtx *vplock; 1478 struct sockaddr_un *soun; 1479 struct vnode *vp; 1480 struct socket *so2; 1481 struct unpcb *unp, *unp2, *unp3; 1482 struct nameidata nd; 1483 char buf[SOCK_MAXADDRLEN]; 1484 struct sockaddr *sa; 1485 cap_rights_t rights; 1486 int error, len; 1487 bool connreq; 1488 1489 if (nam->sa_family != AF_UNIX) 1490 return (EAFNOSUPPORT); 1491 if (nam->sa_len > sizeof(struct sockaddr_un)) 1492 return (EINVAL); 1493 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); 1494 if (len <= 0) 1495 return (EINVAL); 1496 soun = (struct sockaddr_un *)nam; 1497 bcopy(soun->sun_path, buf, len); 1498 buf[len] = 0; 1499 1500 unp = sotounpcb(so); 1501 UNP_PCB_LOCK(unp); 1502 for (;;) { 1503 /* 1504 * Wait for connection state to stabilize. If a connection 1505 * already exists, give up. For datagram sockets, which permit 1506 * multiple consecutive connect(2) calls, upper layers are 1507 * responsible for disconnecting in advance of a subsequent 1508 * connect(2), but this is not synchronized with PCB connection 1509 * state. 1510 * 1511 * Also make sure that no threads are currently attempting to 1512 * lock the peer socket, to ensure that unp_conn cannot 1513 * transition between two valid sockets while locks are dropped. 1514 */ 1515 if (unp->unp_conn != NULL) { 1516 UNP_PCB_UNLOCK(unp); 1517 return (EISCONN); 1518 } 1519 if ((unp->unp_flags & UNP_CONNECTING) != 0) { 1520 UNP_PCB_UNLOCK(unp); 1521 return (EALREADY); 1522 } 1523 if (unp->unp_pairbusy > 0) { 1524 unp->unp_flags |= UNP_WAITING; 1525 mtx_sleep(unp, UNP_PCB_LOCKPTR(unp), 0, "unpeer", 0); 1526 continue; 1527 } 1528 break; 1529 } 1530 unp->unp_flags |= UNP_CONNECTING; 1531 UNP_PCB_UNLOCK(unp); 1532 1533 connreq = (so->so_proto->pr_flags & PR_CONNREQUIRED) != 0; 1534 if (connreq) 1535 sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 1536 else 1537 sa = NULL; 1538 NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF, 1539 UIO_SYSSPACE, buf, fd, cap_rights_init(&rights, CAP_CONNECTAT), td); 1540 error = namei(&nd); 1541 if (error) 1542 vp = NULL; 1543 else 1544 vp = nd.ni_vp; 1545 ASSERT_VOP_LOCKED(vp, "unp_connect"); 1546 NDFREE(&nd, NDF_ONLY_PNBUF); 1547 if (error) 1548 goto bad; 1549 1550 if (vp->v_type != VSOCK) { 1551 error = ENOTSOCK; 1552 goto bad; 1553 } 1554 #ifdef MAC 1555 error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD); 1556 if (error) 1557 goto bad; 1558 #endif 1559 error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td); 1560 if (error) 1561 goto bad; 1562 1563 unp = sotounpcb(so); 1564 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1565 1566 vplock = mtx_pool_find(mtxpool_sleep, vp); 1567 mtx_lock(vplock); 1568 VOP_UNP_CONNECT(vp, &unp2); 1569 if (unp2 == NULL) { 1570 error = ECONNREFUSED; 1571 goto bad2; 1572 } 1573 so2 = unp2->unp_socket; 1574 if (so->so_type != so2->so_type) { 1575 error = EPROTOTYPE; 1576 goto bad2; 1577 } 1578 if (connreq) { 1579 if (so2->so_options & SO_ACCEPTCONN) { 1580 CURVNET_SET(so2->so_vnet); 1581 so2 = sonewconn(so2, 0); 1582 CURVNET_RESTORE(); 1583 } else 1584 so2 = NULL; 1585 if (so2 == NULL) { 1586 error = ECONNREFUSED; 1587 goto bad2; 1588 } 1589 unp3 = sotounpcb(so2); 1590 unp_pcb_lock_pair(unp2, unp3); 1591 if (unp2->unp_addr != NULL) { 1592 bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len); 1593 unp3->unp_addr = (struct sockaddr_un *) sa; 1594 sa = NULL; 1595 } 1596 1597 unp_copy_peercred(td, unp3, unp, unp2); 1598 1599 UNP_PCB_UNLOCK(unp2); 1600 unp2 = unp3; 1601 1602 /* 1603 * It is safe to block on the PCB lock here since unp2 is 1604 * nascent and cannot be connected to any other sockets. 1605 */ 1606 UNP_PCB_LOCK(unp); 1607 #ifdef MAC 1608 mac_socketpeer_set_from_socket(so, so2); 1609 mac_socketpeer_set_from_socket(so2, so); 1610 #endif 1611 } else { 1612 unp_pcb_lock_pair(unp, unp2); 1613 } 1614 KASSERT(unp2 != NULL && so2 != NULL && unp2->unp_socket == so2 && 1615 sotounpcb(so2) == unp2, 1616 ("%s: unp2 %p so2 %p", __func__, unp2, so2)); 1617 error = unp_connect2(so, so2, PRU_CONNECT); 1618 unp_pcb_unlock_pair(unp, unp2); 1619 bad2: 1620 mtx_unlock(vplock); 1621 bad: 1622 if (vp != NULL) { 1623 vput(vp); 1624 } 1625 free(sa, M_SONAME); 1626 UNP_PCB_LOCK(unp); 1627 KASSERT((unp->unp_flags & UNP_CONNECTING) != 0, 1628 ("%s: unp %p has UNP_CONNECTING clear", __func__, unp)); 1629 unp->unp_flags &= ~UNP_CONNECTING; 1630 UNP_PCB_UNLOCK(unp); 1631 return (error); 1632 } 1633 1634 /* 1635 * Set socket peer credentials at connection time. 1636 * 1637 * The client's PCB credentials are copied from its process structure. The 1638 * server's PCB credentials are copied from the socket on which it called 1639 * listen(2). uipc_listen cached that process's credentials at the time. 1640 */ 1641 void 1642 unp_copy_peercred(struct thread *td, struct unpcb *client_unp, 1643 struct unpcb *server_unp, struct unpcb *listen_unp) 1644 { 1645 cru2xt(td, &client_unp->unp_peercred); 1646 client_unp->unp_flags |= UNP_HAVEPC; 1647 1648 memcpy(&server_unp->unp_peercred, &listen_unp->unp_peercred, 1649 sizeof(server_unp->unp_peercred)); 1650 server_unp->unp_flags |= UNP_HAVEPC; 1651 if (listen_unp->unp_flags & UNP_WANTCRED) 1652 client_unp->unp_flags |= UNP_WANTCRED; 1653 } 1654 1655 static int 1656 unp_connect2(struct socket *so, struct socket *so2, int req) 1657 { 1658 struct unpcb *unp; 1659 struct unpcb *unp2; 1660 1661 unp = sotounpcb(so); 1662 KASSERT(unp != NULL, ("unp_connect2: unp == NULL")); 1663 unp2 = sotounpcb(so2); 1664 KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL")); 1665 1666 UNP_PCB_LOCK_ASSERT(unp); 1667 UNP_PCB_LOCK_ASSERT(unp2); 1668 KASSERT(unp->unp_conn == NULL, 1669 ("%s: socket %p is already connected", __func__, unp)); 1670 1671 if (so2->so_type != so->so_type) 1672 return (EPROTOTYPE); 1673 unp->unp_conn = unp2; 1674 unp_pcb_hold(unp2); 1675 unp_pcb_hold(unp); 1676 switch (so->so_type) { 1677 case SOCK_DGRAM: 1678 UNP_REF_LIST_LOCK(); 1679 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink); 1680 UNP_REF_LIST_UNLOCK(); 1681 soisconnected(so); 1682 break; 1683 1684 case SOCK_STREAM: 1685 case SOCK_SEQPACKET: 1686 KASSERT(unp2->unp_conn == NULL, 1687 ("%s: socket %p is already connected", __func__, unp2)); 1688 unp2->unp_conn = unp; 1689 if (req == PRU_CONNECT && 1690 ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT)) 1691 soisconnecting(so); 1692 else 1693 soisconnected(so); 1694 soisconnected(so2); 1695 break; 1696 1697 default: 1698 panic("unp_connect2"); 1699 } 1700 return (0); 1701 } 1702 1703 static void 1704 unp_disconnect(struct unpcb *unp, struct unpcb *unp2) 1705 { 1706 struct socket *so, *so2; 1707 #ifdef INVARIANTS 1708 struct unpcb *unptmp; 1709 #endif 1710 1711 UNP_PCB_LOCK_ASSERT(unp); 1712 UNP_PCB_LOCK_ASSERT(unp2); 1713 KASSERT(unp->unp_conn == unp2, 1714 ("%s: unpcb %p is not connected to %p", __func__, unp, unp2)); 1715 1716 unp->unp_conn = NULL; 1717 so = unp->unp_socket; 1718 so2 = unp2->unp_socket; 1719 switch (unp->unp_socket->so_type) { 1720 case SOCK_DGRAM: 1721 UNP_REF_LIST_LOCK(); 1722 #ifdef INVARIANTS 1723 LIST_FOREACH(unptmp, &unp2->unp_refs, unp_reflink) { 1724 if (unptmp == unp) 1725 break; 1726 } 1727 KASSERT(unptmp != NULL, 1728 ("%s: %p not found in reflist of %p", __func__, unp, unp2)); 1729 #endif 1730 LIST_REMOVE(unp, unp_reflink); 1731 UNP_REF_LIST_UNLOCK(); 1732 if (so) { 1733 SOCK_LOCK(so); 1734 so->so_state &= ~SS_ISCONNECTED; 1735 SOCK_UNLOCK(so); 1736 } 1737 break; 1738 1739 case SOCK_STREAM: 1740 case SOCK_SEQPACKET: 1741 if (so) 1742 soisdisconnected(so); 1743 MPASS(unp2->unp_conn == unp); 1744 unp2->unp_conn = NULL; 1745 if (so2) 1746 soisdisconnected(so2); 1747 break; 1748 } 1749 1750 if (unp == unp2) { 1751 unp_pcb_rele_notlast(unp); 1752 if (!unp_pcb_rele(unp)) 1753 UNP_PCB_UNLOCK(unp); 1754 } else { 1755 if (!unp_pcb_rele(unp)) 1756 UNP_PCB_UNLOCK(unp); 1757 if (!unp_pcb_rele(unp2)) 1758 UNP_PCB_UNLOCK(unp2); 1759 } 1760 } 1761 1762 /* 1763 * unp_pcblist() walks the global list of struct unpcb's to generate a 1764 * pointer list, bumping the refcount on each unpcb. It then copies them out 1765 * sequentially, validating the generation number on each to see if it has 1766 * been detached. All of this is necessary because copyout() may sleep on 1767 * disk I/O. 1768 */ 1769 static int 1770 unp_pcblist(SYSCTL_HANDLER_ARGS) 1771 { 1772 struct unpcb *unp, **unp_list; 1773 unp_gen_t gencnt; 1774 struct xunpgen *xug; 1775 struct unp_head *head; 1776 struct xunpcb *xu; 1777 u_int i; 1778 int error, n; 1779 1780 switch ((intptr_t)arg1) { 1781 case SOCK_STREAM: 1782 head = &unp_shead; 1783 break; 1784 1785 case SOCK_DGRAM: 1786 head = &unp_dhead; 1787 break; 1788 1789 case SOCK_SEQPACKET: 1790 head = &unp_sphead; 1791 break; 1792 1793 default: 1794 panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1); 1795 } 1796 1797 /* 1798 * The process of preparing the PCB list is too time-consuming and 1799 * resource-intensive to repeat twice on every request. 1800 */ 1801 if (req->oldptr == NULL) { 1802 n = unp_count; 1803 req->oldidx = 2 * (sizeof *xug) 1804 + (n + n/8) * sizeof(struct xunpcb); 1805 return (0); 1806 } 1807 1808 if (req->newptr != NULL) 1809 return (EPERM); 1810 1811 /* 1812 * OK, now we're committed to doing something. 1813 */ 1814 xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK | M_ZERO); 1815 UNP_LINK_RLOCK(); 1816 gencnt = unp_gencnt; 1817 n = unp_count; 1818 UNP_LINK_RUNLOCK(); 1819 1820 xug->xug_len = sizeof *xug; 1821 xug->xug_count = n; 1822 xug->xug_gen = gencnt; 1823 xug->xug_sogen = so_gencnt; 1824 error = SYSCTL_OUT(req, xug, sizeof *xug); 1825 if (error) { 1826 free(xug, M_TEMP); 1827 return (error); 1828 } 1829 1830 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); 1831 1832 UNP_LINK_RLOCK(); 1833 for (unp = LIST_FIRST(head), i = 0; unp && i < n; 1834 unp = LIST_NEXT(unp, unp_link)) { 1835 UNP_PCB_LOCK(unp); 1836 if (unp->unp_gencnt <= gencnt) { 1837 if (cr_cansee(req->td->td_ucred, 1838 unp->unp_socket->so_cred)) { 1839 UNP_PCB_UNLOCK(unp); 1840 continue; 1841 } 1842 unp_list[i++] = unp; 1843 unp_pcb_hold(unp); 1844 } 1845 UNP_PCB_UNLOCK(unp); 1846 } 1847 UNP_LINK_RUNLOCK(); 1848 n = i; /* In case we lost some during malloc. */ 1849 1850 error = 0; 1851 xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO); 1852 for (i = 0; i < n; i++) { 1853 unp = unp_list[i]; 1854 UNP_PCB_LOCK(unp); 1855 if (unp_pcb_rele(unp)) 1856 continue; 1857 1858 if (unp->unp_gencnt <= gencnt) { 1859 xu->xu_len = sizeof *xu; 1860 xu->xu_unpp = (uintptr_t)unp; 1861 /* 1862 * XXX - need more locking here to protect against 1863 * connect/disconnect races for SMP. 1864 */ 1865 if (unp->unp_addr != NULL) 1866 bcopy(unp->unp_addr, &xu->xu_addr, 1867 unp->unp_addr->sun_len); 1868 else 1869 bzero(&xu->xu_addr, sizeof(xu->xu_addr)); 1870 if (unp->unp_conn != NULL && 1871 unp->unp_conn->unp_addr != NULL) 1872 bcopy(unp->unp_conn->unp_addr, 1873 &xu->xu_caddr, 1874 unp->unp_conn->unp_addr->sun_len); 1875 else 1876 bzero(&xu->xu_caddr, sizeof(xu->xu_caddr)); 1877 xu->unp_vnode = (uintptr_t)unp->unp_vnode; 1878 xu->unp_conn = (uintptr_t)unp->unp_conn; 1879 xu->xu_firstref = (uintptr_t)LIST_FIRST(&unp->unp_refs); 1880 xu->xu_nextref = (uintptr_t)LIST_NEXT(unp, unp_reflink); 1881 xu->unp_gencnt = unp->unp_gencnt; 1882 sotoxsocket(unp->unp_socket, &xu->xu_socket); 1883 UNP_PCB_UNLOCK(unp); 1884 error = SYSCTL_OUT(req, xu, sizeof *xu); 1885 } else { 1886 UNP_PCB_UNLOCK(unp); 1887 } 1888 } 1889 free(xu, M_TEMP); 1890 if (!error) { 1891 /* 1892 * Give the user an updated idea of our state. If the 1893 * generation differs from what we told her before, she knows 1894 * that something happened while we were processing this 1895 * request, and it might be necessary to retry. 1896 */ 1897 xug->xug_gen = unp_gencnt; 1898 xug->xug_sogen = so_gencnt; 1899 xug->xug_count = unp_count; 1900 error = SYSCTL_OUT(req, xug, sizeof *xug); 1901 } 1902 free(unp_list, M_TEMP); 1903 free(xug, M_TEMP); 1904 return (error); 1905 } 1906 1907 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, 1908 CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, 1909 (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb", 1910 "List of active local datagram sockets"); 1911 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, 1912 CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, 1913 (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb", 1914 "List of active local stream sockets"); 1915 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist, 1916 CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, 1917 (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb", 1918 "List of active local seqpacket sockets"); 1919 1920 static void 1921 unp_shutdown(struct unpcb *unp) 1922 { 1923 struct unpcb *unp2; 1924 struct socket *so; 1925 1926 UNP_PCB_LOCK_ASSERT(unp); 1927 1928 unp2 = unp->unp_conn; 1929 if ((unp->unp_socket->so_type == SOCK_STREAM || 1930 (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) { 1931 so = unp2->unp_socket; 1932 if (so != NULL) 1933 socantrcvmore(so); 1934 } 1935 } 1936 1937 static void 1938 unp_drop(struct unpcb *unp) 1939 { 1940 struct socket *so = unp->unp_socket; 1941 struct unpcb *unp2; 1942 1943 /* 1944 * Regardless of whether the socket's peer dropped the connection 1945 * with this socket by aborting or disconnecting, POSIX requires 1946 * that ECONNRESET is returned. 1947 */ 1948 1949 UNP_PCB_LOCK(unp); 1950 if (so) 1951 so->so_error = ECONNRESET; 1952 if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) { 1953 /* Last reference dropped in unp_disconnect(). */ 1954 unp_pcb_rele_notlast(unp); 1955 unp_disconnect(unp, unp2); 1956 } else if (!unp_pcb_rele(unp)) { 1957 UNP_PCB_UNLOCK(unp); 1958 } 1959 } 1960 1961 static void 1962 unp_freerights(struct filedescent **fdep, int fdcount) 1963 { 1964 struct file *fp; 1965 int i; 1966 1967 KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount)); 1968 1969 for (i = 0; i < fdcount; i++) { 1970 fp = fdep[i]->fde_file; 1971 filecaps_free(&fdep[i]->fde_caps); 1972 unp_discard(fp); 1973 } 1974 free(fdep[0], M_FILECAPS); 1975 } 1976 1977 static int 1978 unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags) 1979 { 1980 struct thread *td = curthread; /* XXX */ 1981 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1982 int i; 1983 int *fdp; 1984 struct filedesc *fdesc = td->td_proc->p_fd; 1985 struct filedescent **fdep; 1986 void *data; 1987 socklen_t clen = control->m_len, datalen; 1988 int error, newfds; 1989 u_int newlen; 1990 1991 UNP_LINK_UNLOCK_ASSERT(); 1992 1993 error = 0; 1994 if (controlp != NULL) /* controlp == NULL => free control messages */ 1995 *controlp = NULL; 1996 while (cm != NULL) { 1997 if (sizeof(*cm) > clen || cm->cmsg_len > clen) { 1998 error = EINVAL; 1999 break; 2000 } 2001 data = CMSG_DATA(cm); 2002 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data; 2003 if (cm->cmsg_level == SOL_SOCKET 2004 && cm->cmsg_type == SCM_RIGHTS) { 2005 newfds = datalen / sizeof(*fdep); 2006 if (newfds == 0) 2007 goto next; 2008 fdep = data; 2009 2010 /* If we're not outputting the descriptors free them. */ 2011 if (error || controlp == NULL) { 2012 unp_freerights(fdep, newfds); 2013 goto next; 2014 } 2015 FILEDESC_XLOCK(fdesc); 2016 2017 /* 2018 * Now change each pointer to an fd in the global 2019 * table to an integer that is the index to the local 2020 * fd table entry that we set up to point to the 2021 * global one we are transferring. 2022 */ 2023 newlen = newfds * sizeof(int); 2024 *controlp = sbcreatecontrol(NULL, newlen, 2025 SCM_RIGHTS, SOL_SOCKET); 2026 if (*controlp == NULL) { 2027 FILEDESC_XUNLOCK(fdesc); 2028 error = E2BIG; 2029 unp_freerights(fdep, newfds); 2030 goto next; 2031 } 2032 2033 fdp = (int *) 2034 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2035 if (fdallocn(td, 0, fdp, newfds) != 0) { 2036 FILEDESC_XUNLOCK(fdesc); 2037 error = EMSGSIZE; 2038 unp_freerights(fdep, newfds); 2039 m_freem(*controlp); 2040 *controlp = NULL; 2041 goto next; 2042 } 2043 for (i = 0; i < newfds; i++, fdp++) { 2044 _finstall(fdesc, fdep[i]->fde_file, *fdp, 2045 (flags & MSG_CMSG_CLOEXEC) != 0 ? UF_EXCLOSE : 0, 2046 &fdep[i]->fde_caps); 2047 unp_externalize_fp(fdep[i]->fde_file); 2048 } 2049 2050 /* 2051 * The new type indicates that the mbuf data refers to 2052 * kernel resources that may need to be released before 2053 * the mbuf is freed. 2054 */ 2055 m_chtype(*controlp, MT_EXTCONTROL); 2056 FILEDESC_XUNLOCK(fdesc); 2057 free(fdep[0], M_FILECAPS); 2058 } else { 2059 /* We can just copy anything else across. */ 2060 if (error || controlp == NULL) 2061 goto next; 2062 *controlp = sbcreatecontrol(NULL, datalen, 2063 cm->cmsg_type, cm->cmsg_level); 2064 if (*controlp == NULL) { 2065 error = ENOBUFS; 2066 goto next; 2067 } 2068 bcopy(data, 2069 CMSG_DATA(mtod(*controlp, struct cmsghdr *)), 2070 datalen); 2071 } 2072 controlp = &(*controlp)->m_next; 2073 2074 next: 2075 if (CMSG_SPACE(datalen) < clen) { 2076 clen -= CMSG_SPACE(datalen); 2077 cm = (struct cmsghdr *) 2078 ((caddr_t)cm + CMSG_SPACE(datalen)); 2079 } else { 2080 clen = 0; 2081 cm = NULL; 2082 } 2083 } 2084 2085 m_freem(control); 2086 return (error); 2087 } 2088 2089 static void 2090 unp_zone_change(void *tag) 2091 { 2092 2093 uma_zone_set_max(unp_zone, maxsockets); 2094 } 2095 2096 #ifdef INVARIANTS 2097 static void 2098 unp_zdtor(void *mem, int size __unused, void *arg __unused) 2099 { 2100 struct unpcb *unp; 2101 2102 unp = mem; 2103 2104 KASSERT(LIST_EMPTY(&unp->unp_refs), 2105 ("%s: unpcb %p has lingering refs", __func__, unp)); 2106 KASSERT(unp->unp_socket == NULL, 2107 ("%s: unpcb %p has socket backpointer", __func__, unp)); 2108 KASSERT(unp->unp_vnode == NULL, 2109 ("%s: unpcb %p has vnode references", __func__, unp)); 2110 KASSERT(unp->unp_conn == NULL, 2111 ("%s: unpcb %p is still connected", __func__, unp)); 2112 KASSERT(unp->unp_addr == NULL, 2113 ("%s: unpcb %p has leaked addr", __func__, unp)); 2114 } 2115 #endif 2116 2117 static void 2118 unp_init(void) 2119 { 2120 uma_dtor dtor; 2121 2122 #ifdef VIMAGE 2123 if (!IS_DEFAULT_VNET(curvnet)) 2124 return; 2125 #endif 2126 2127 #ifdef INVARIANTS 2128 dtor = unp_zdtor; 2129 #else 2130 dtor = NULL; 2131 #endif 2132 unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, dtor, 2133 NULL, NULL, UMA_ALIGN_CACHE, 0); 2134 uma_zone_set_max(unp_zone, maxsockets); 2135 uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached"); 2136 EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change, 2137 NULL, EVENTHANDLER_PRI_ANY); 2138 LIST_INIT(&unp_dhead); 2139 LIST_INIT(&unp_shead); 2140 LIST_INIT(&unp_sphead); 2141 SLIST_INIT(&unp_defers); 2142 TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL); 2143 TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL); 2144 UNP_LINK_LOCK_INIT(); 2145 UNP_DEFERRED_LOCK_INIT(); 2146 } 2147 2148 static void 2149 unp_internalize_cleanup_rights(struct mbuf *control) 2150 { 2151 struct cmsghdr *cp; 2152 struct mbuf *m; 2153 void *data; 2154 socklen_t datalen; 2155 2156 for (m = control; m != NULL; m = m->m_next) { 2157 cp = mtod(m, struct cmsghdr *); 2158 if (cp->cmsg_level != SOL_SOCKET || 2159 cp->cmsg_type != SCM_RIGHTS) 2160 continue; 2161 data = CMSG_DATA(cp); 2162 datalen = (caddr_t)cp + cp->cmsg_len - (caddr_t)data; 2163 unp_freerights(data, datalen / sizeof(struct filedesc *)); 2164 } 2165 } 2166 2167 static int 2168 unp_internalize(struct mbuf **controlp, struct thread *td) 2169 { 2170 struct mbuf *control, **initial_controlp; 2171 struct proc *p; 2172 struct filedesc *fdesc; 2173 struct bintime *bt; 2174 struct cmsghdr *cm; 2175 struct cmsgcred *cmcred; 2176 struct filedescent *fde, **fdep, *fdev; 2177 struct file *fp; 2178 struct timeval *tv; 2179 struct timespec *ts; 2180 void *data; 2181 socklen_t clen, datalen; 2182 int i, j, error, *fdp, oldfds; 2183 u_int newlen; 2184 2185 UNP_LINK_UNLOCK_ASSERT(); 2186 2187 p = td->td_proc; 2188 fdesc = p->p_fd; 2189 error = 0; 2190 control = *controlp; 2191 clen = control->m_len; 2192 *controlp = NULL; 2193 initial_controlp = controlp; 2194 for (cm = mtod(control, struct cmsghdr *); cm != NULL;) { 2195 if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET 2196 || cm->cmsg_len > clen || cm->cmsg_len < sizeof(*cm)) { 2197 error = EINVAL; 2198 goto out; 2199 } 2200 data = CMSG_DATA(cm); 2201 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data; 2202 2203 switch (cm->cmsg_type) { 2204 /* 2205 * Fill in credential information. 2206 */ 2207 case SCM_CREDS: 2208 *controlp = sbcreatecontrol(NULL, sizeof(*cmcred), 2209 SCM_CREDS, SOL_SOCKET); 2210 if (*controlp == NULL) { 2211 error = ENOBUFS; 2212 goto out; 2213 } 2214 cmcred = (struct cmsgcred *) 2215 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2216 cmcred->cmcred_pid = p->p_pid; 2217 cmcred->cmcred_uid = td->td_ucred->cr_ruid; 2218 cmcred->cmcred_gid = td->td_ucred->cr_rgid; 2219 cmcred->cmcred_euid = td->td_ucred->cr_uid; 2220 cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups, 2221 CMGROUP_MAX); 2222 for (i = 0; i < cmcred->cmcred_ngroups; i++) 2223 cmcred->cmcred_groups[i] = 2224 td->td_ucred->cr_groups[i]; 2225 break; 2226 2227 case SCM_RIGHTS: 2228 oldfds = datalen / sizeof (int); 2229 if (oldfds == 0) 2230 break; 2231 /* 2232 * Check that all the FDs passed in refer to legal 2233 * files. If not, reject the entire operation. 2234 */ 2235 fdp = data; 2236 FILEDESC_SLOCK(fdesc); 2237 for (i = 0; i < oldfds; i++, fdp++) { 2238 fp = fget_locked(fdesc, *fdp); 2239 if (fp == NULL) { 2240 FILEDESC_SUNLOCK(fdesc); 2241 error = EBADF; 2242 goto out; 2243 } 2244 if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) { 2245 FILEDESC_SUNLOCK(fdesc); 2246 error = EOPNOTSUPP; 2247 goto out; 2248 } 2249 } 2250 2251 /* 2252 * Now replace the integer FDs with pointers to the 2253 * file structure and capability rights. 2254 */ 2255 newlen = oldfds * sizeof(fdep[0]); 2256 *controlp = sbcreatecontrol(NULL, newlen, 2257 SCM_RIGHTS, SOL_SOCKET); 2258 if (*controlp == NULL) { 2259 FILEDESC_SUNLOCK(fdesc); 2260 error = E2BIG; 2261 goto out; 2262 } 2263 fdp = data; 2264 for (i = 0; i < oldfds; i++, fdp++) { 2265 if (!fhold(fdesc->fd_ofiles[*fdp].fde_file)) { 2266 fdp = data; 2267 for (j = 0; j < i; j++, fdp++) { 2268 fdrop(fdesc->fd_ofiles[*fdp]. 2269 fde_file, td); 2270 } 2271 FILEDESC_SUNLOCK(fdesc); 2272 error = EBADF; 2273 goto out; 2274 } 2275 } 2276 fdp = data; 2277 fdep = (struct filedescent **) 2278 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2279 fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS, 2280 M_WAITOK); 2281 for (i = 0; i < oldfds; i++, fdev++, fdp++) { 2282 fde = &fdesc->fd_ofiles[*fdp]; 2283 fdep[i] = fdev; 2284 fdep[i]->fde_file = fde->fde_file; 2285 filecaps_copy(&fde->fde_caps, 2286 &fdep[i]->fde_caps, true); 2287 unp_internalize_fp(fdep[i]->fde_file); 2288 } 2289 FILEDESC_SUNLOCK(fdesc); 2290 break; 2291 2292 case SCM_TIMESTAMP: 2293 *controlp = sbcreatecontrol(NULL, sizeof(*tv), 2294 SCM_TIMESTAMP, SOL_SOCKET); 2295 if (*controlp == NULL) { 2296 error = ENOBUFS; 2297 goto out; 2298 } 2299 tv = (struct timeval *) 2300 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2301 microtime(tv); 2302 break; 2303 2304 case SCM_BINTIME: 2305 *controlp = sbcreatecontrol(NULL, sizeof(*bt), 2306 SCM_BINTIME, SOL_SOCKET); 2307 if (*controlp == NULL) { 2308 error = ENOBUFS; 2309 goto out; 2310 } 2311 bt = (struct bintime *) 2312 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2313 bintime(bt); 2314 break; 2315 2316 case SCM_REALTIME: 2317 *controlp = sbcreatecontrol(NULL, sizeof(*ts), 2318 SCM_REALTIME, SOL_SOCKET); 2319 if (*controlp == NULL) { 2320 error = ENOBUFS; 2321 goto out; 2322 } 2323 ts = (struct timespec *) 2324 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2325 nanotime(ts); 2326 break; 2327 2328 case SCM_MONOTONIC: 2329 *controlp = sbcreatecontrol(NULL, sizeof(*ts), 2330 SCM_MONOTONIC, SOL_SOCKET); 2331 if (*controlp == NULL) { 2332 error = ENOBUFS; 2333 goto out; 2334 } 2335 ts = (struct timespec *) 2336 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 2337 nanouptime(ts); 2338 break; 2339 2340 default: 2341 error = EINVAL; 2342 goto out; 2343 } 2344 2345 if (*controlp != NULL) 2346 controlp = &(*controlp)->m_next; 2347 if (CMSG_SPACE(datalen) < clen) { 2348 clen -= CMSG_SPACE(datalen); 2349 cm = (struct cmsghdr *) 2350 ((caddr_t)cm + CMSG_SPACE(datalen)); 2351 } else { 2352 clen = 0; 2353 cm = NULL; 2354 } 2355 } 2356 2357 out: 2358 if (error != 0 && initial_controlp != NULL) 2359 unp_internalize_cleanup_rights(*initial_controlp); 2360 m_freem(control); 2361 return (error); 2362 } 2363 2364 static struct mbuf * 2365 unp_addsockcred(struct thread *td, struct mbuf *control) 2366 { 2367 struct mbuf *m, *n, *n_prev; 2368 struct sockcred *sc; 2369 const struct cmsghdr *cm; 2370 int ngroups; 2371 int i; 2372 2373 ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX); 2374 m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET); 2375 if (m == NULL) 2376 return (control); 2377 2378 sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *)); 2379 sc->sc_uid = td->td_ucred->cr_ruid; 2380 sc->sc_euid = td->td_ucred->cr_uid; 2381 sc->sc_gid = td->td_ucred->cr_rgid; 2382 sc->sc_egid = td->td_ucred->cr_gid; 2383 sc->sc_ngroups = ngroups; 2384 for (i = 0; i < sc->sc_ngroups; i++) 2385 sc->sc_groups[i] = td->td_ucred->cr_groups[i]; 2386 2387 /* 2388 * Unlink SCM_CREDS control messages (struct cmsgcred), since just 2389 * created SCM_CREDS control message (struct sockcred) has another 2390 * format. 2391 */ 2392 if (control != NULL) 2393 for (n = control, n_prev = NULL; n != NULL;) { 2394 cm = mtod(n, struct cmsghdr *); 2395 if (cm->cmsg_level == SOL_SOCKET && 2396 cm->cmsg_type == SCM_CREDS) { 2397 if (n_prev == NULL) 2398 control = n->m_next; 2399 else 2400 n_prev->m_next = n->m_next; 2401 n = m_free(n); 2402 } else { 2403 n_prev = n; 2404 n = n->m_next; 2405 } 2406 } 2407 2408 /* Prepend it to the head. */ 2409 m->m_next = control; 2410 return (m); 2411 } 2412 2413 static struct unpcb * 2414 fptounp(struct file *fp) 2415 { 2416 struct socket *so; 2417 2418 if (fp->f_type != DTYPE_SOCKET) 2419 return (NULL); 2420 if ((so = fp->f_data) == NULL) 2421 return (NULL); 2422 if (so->so_proto->pr_domain != &localdomain) 2423 return (NULL); 2424 return sotounpcb(so); 2425 } 2426 2427 static void 2428 unp_discard(struct file *fp) 2429 { 2430 struct unp_defer *dr; 2431 2432 if (unp_externalize_fp(fp)) { 2433 dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK); 2434 dr->ud_fp = fp; 2435 UNP_DEFERRED_LOCK(); 2436 SLIST_INSERT_HEAD(&unp_defers, dr, ud_link); 2437 UNP_DEFERRED_UNLOCK(); 2438 atomic_add_int(&unp_defers_count, 1); 2439 taskqueue_enqueue(taskqueue_thread, &unp_defer_task); 2440 } else 2441 (void) closef(fp, (struct thread *)NULL); 2442 } 2443 2444 static void 2445 unp_process_defers(void *arg __unused, int pending) 2446 { 2447 struct unp_defer *dr; 2448 SLIST_HEAD(, unp_defer) drl; 2449 int count; 2450 2451 SLIST_INIT(&drl); 2452 for (;;) { 2453 UNP_DEFERRED_LOCK(); 2454 if (SLIST_FIRST(&unp_defers) == NULL) { 2455 UNP_DEFERRED_UNLOCK(); 2456 break; 2457 } 2458 SLIST_SWAP(&unp_defers, &drl, unp_defer); 2459 UNP_DEFERRED_UNLOCK(); 2460 count = 0; 2461 while ((dr = SLIST_FIRST(&drl)) != NULL) { 2462 SLIST_REMOVE_HEAD(&drl, ud_link); 2463 closef(dr->ud_fp, NULL); 2464 free(dr, M_TEMP); 2465 count++; 2466 } 2467 atomic_add_int(&unp_defers_count, -count); 2468 } 2469 } 2470 2471 static void 2472 unp_internalize_fp(struct file *fp) 2473 { 2474 struct unpcb *unp; 2475 2476 UNP_LINK_WLOCK(); 2477 if ((unp = fptounp(fp)) != NULL) { 2478 unp->unp_file = fp; 2479 unp->unp_msgcount++; 2480 } 2481 unp_rights++; 2482 UNP_LINK_WUNLOCK(); 2483 } 2484 2485 static int 2486 unp_externalize_fp(struct file *fp) 2487 { 2488 struct unpcb *unp; 2489 int ret; 2490 2491 UNP_LINK_WLOCK(); 2492 if ((unp = fptounp(fp)) != NULL) { 2493 unp->unp_msgcount--; 2494 ret = 1; 2495 } else 2496 ret = 0; 2497 unp_rights--; 2498 UNP_LINK_WUNLOCK(); 2499 return (ret); 2500 } 2501 2502 /* 2503 * unp_defer indicates whether additional work has been defered for a future 2504 * pass through unp_gc(). It is thread local and does not require explicit 2505 * synchronization. 2506 */ 2507 static int unp_marked; 2508 2509 static void 2510 unp_remove_dead_ref(struct filedescent **fdep, int fdcount) 2511 { 2512 struct unpcb *unp; 2513 struct file *fp; 2514 int i; 2515 2516 /* 2517 * This function can only be called from the gc task. 2518 */ 2519 KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0, 2520 ("%s: not on gc callout", __func__)); 2521 UNP_LINK_LOCK_ASSERT(); 2522 2523 for (i = 0; i < fdcount; i++) { 2524 fp = fdep[i]->fde_file; 2525 if ((unp = fptounp(fp)) == NULL) 2526 continue; 2527 if ((unp->unp_gcflag & UNPGC_DEAD) == 0) 2528 continue; 2529 unp->unp_gcrefs--; 2530 } 2531 } 2532 2533 static void 2534 unp_restore_undead_ref(struct filedescent **fdep, int fdcount) 2535 { 2536 struct unpcb *unp; 2537 struct file *fp; 2538 int i; 2539 2540 /* 2541 * This function can only be called from the gc task. 2542 */ 2543 KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0, 2544 ("%s: not on gc callout", __func__)); 2545 UNP_LINK_LOCK_ASSERT(); 2546 2547 for (i = 0; i < fdcount; i++) { 2548 fp = fdep[i]->fde_file; 2549 if ((unp = fptounp(fp)) == NULL) 2550 continue; 2551 if ((unp->unp_gcflag & UNPGC_DEAD) == 0) 2552 continue; 2553 unp->unp_gcrefs++; 2554 unp_marked++; 2555 } 2556 } 2557 2558 static void 2559 unp_gc_scan(struct unpcb *unp, void (*op)(struct filedescent **, int)) 2560 { 2561 struct socket *so, *soa; 2562 2563 so = unp->unp_socket; 2564 SOCK_LOCK(so); 2565 if (SOLISTENING(so)) { 2566 /* 2567 * Mark all sockets in our accept queue. 2568 */ 2569 TAILQ_FOREACH(soa, &so->sol_comp, so_list) { 2570 if (sotounpcb(soa)->unp_gcflag & UNPGC_IGNORE_RIGHTS) 2571 continue; 2572 SOCKBUF_LOCK(&soa->so_rcv); 2573 unp_scan(soa->so_rcv.sb_mb, op); 2574 SOCKBUF_UNLOCK(&soa->so_rcv); 2575 } 2576 } else { 2577 /* 2578 * Mark all sockets we reference with RIGHTS. 2579 */ 2580 if ((unp->unp_gcflag & UNPGC_IGNORE_RIGHTS) == 0) { 2581 SOCKBUF_LOCK(&so->so_rcv); 2582 unp_scan(so->so_rcv.sb_mb, op); 2583 SOCKBUF_UNLOCK(&so->so_rcv); 2584 } 2585 } 2586 SOCK_UNLOCK(so); 2587 } 2588 2589 static int unp_recycled; 2590 SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0, 2591 "Number of unreachable sockets claimed by the garbage collector."); 2592 2593 static int unp_taskcount; 2594 SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0, 2595 "Number of times the garbage collector has run."); 2596 2597 SYSCTL_UINT(_net_local, OID_AUTO, sockcount, CTLFLAG_RD, &unp_count, 0, 2598 "Number of active local sockets."); 2599 2600 static void 2601 unp_gc(__unused void *arg, int pending) 2602 { 2603 struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead, 2604 NULL }; 2605 struct unp_head **head; 2606 struct unp_head unp_deadhead; /* List of potentially-dead sockets. */ 2607 struct file *f, **unref; 2608 struct unpcb *unp, *unptmp; 2609 int i, total, unp_unreachable; 2610 2611 LIST_INIT(&unp_deadhead); 2612 unp_taskcount++; 2613 UNP_LINK_RLOCK(); 2614 /* 2615 * First determine which sockets may be in cycles. 2616 */ 2617 unp_unreachable = 0; 2618 2619 for (head = heads; *head != NULL; head++) 2620 LIST_FOREACH(unp, *head, unp_link) { 2621 KASSERT((unp->unp_gcflag & ~UNPGC_IGNORE_RIGHTS) == 0, 2622 ("%s: unp %p has unexpected gc flags 0x%x", 2623 __func__, unp, (unsigned int)unp->unp_gcflag)); 2624 2625 f = unp->unp_file; 2626 2627 /* 2628 * Check for an unreachable socket potentially in a 2629 * cycle. It must be in a queue as indicated by 2630 * msgcount, and this must equal the file reference 2631 * count. Note that when msgcount is 0 the file is 2632 * NULL. 2633 */ 2634 if (f != NULL && unp->unp_msgcount != 0 && 2635 f->f_count == unp->unp_msgcount) { 2636 LIST_INSERT_HEAD(&unp_deadhead, unp, unp_dead); 2637 unp->unp_gcflag |= UNPGC_DEAD; 2638 unp->unp_gcrefs = unp->unp_msgcount; 2639 unp_unreachable++; 2640 } 2641 } 2642 2643 /* 2644 * Scan all sockets previously marked as potentially being in a cycle 2645 * and remove the references each socket holds on any UNPGC_DEAD 2646 * sockets in its queue. After this step, all remaining references on 2647 * sockets marked UNPGC_DEAD should not be part of any cycle. 2648 */ 2649 LIST_FOREACH(unp, &unp_deadhead, unp_dead) 2650 unp_gc_scan(unp, unp_remove_dead_ref); 2651 2652 /* 2653 * If a socket still has a non-negative refcount, it cannot be in a 2654 * cycle. In this case increment refcount of all children iteratively. 2655 * Stop the scan once we do a complete loop without discovering 2656 * a new reachable socket. 2657 */ 2658 do { 2659 unp_marked = 0; 2660 LIST_FOREACH_SAFE(unp, &unp_deadhead, unp_dead, unptmp) 2661 if (unp->unp_gcrefs > 0) { 2662 unp->unp_gcflag &= ~UNPGC_DEAD; 2663 LIST_REMOVE(unp, unp_dead); 2664 KASSERT(unp_unreachable > 0, 2665 ("%s: unp_unreachable underflow.", 2666 __func__)); 2667 unp_unreachable--; 2668 unp_gc_scan(unp, unp_restore_undead_ref); 2669 } 2670 } while (unp_marked); 2671 2672 UNP_LINK_RUNLOCK(); 2673 2674 if (unp_unreachable == 0) 2675 return; 2676 2677 /* 2678 * Allocate space for a local array of dead unpcbs. 2679 * TODO: can this path be simplified by instead using the local 2680 * dead list at unp_deadhead, after taking out references 2681 * on the file object and/or unpcb and dropping the link lock? 2682 */ 2683 unref = malloc(unp_unreachable * sizeof(struct file *), 2684 M_TEMP, M_WAITOK); 2685 2686 /* 2687 * Iterate looking for sockets which have been specifically marked 2688 * as unreachable and store them locally. 2689 */ 2690 UNP_LINK_RLOCK(); 2691 total = 0; 2692 LIST_FOREACH(unp, &unp_deadhead, unp_dead) { 2693 KASSERT((unp->unp_gcflag & UNPGC_DEAD) != 0, 2694 ("%s: unp %p not marked UNPGC_DEAD", __func__, unp)); 2695 unp->unp_gcflag &= ~UNPGC_DEAD; 2696 f = unp->unp_file; 2697 if (unp->unp_msgcount == 0 || f == NULL || 2698 f->f_count != unp->unp_msgcount || 2699 !fhold(f)) 2700 continue; 2701 unref[total++] = f; 2702 KASSERT(total <= unp_unreachable, 2703 ("%s: incorrect unreachable count.", __func__)); 2704 } 2705 UNP_LINK_RUNLOCK(); 2706 2707 /* 2708 * Now flush all sockets, free'ing rights. This will free the 2709 * struct files associated with these sockets but leave each socket 2710 * with one remaining ref. 2711 */ 2712 for (i = 0; i < total; i++) { 2713 struct socket *so; 2714 2715 so = unref[i]->f_data; 2716 CURVNET_SET(so->so_vnet); 2717 sorflush(so); 2718 CURVNET_RESTORE(); 2719 } 2720 2721 /* 2722 * And finally release the sockets so they can be reclaimed. 2723 */ 2724 for (i = 0; i < total; i++) 2725 fdrop(unref[i], NULL); 2726 unp_recycled += total; 2727 free(unref, M_TEMP); 2728 } 2729 2730 static void 2731 unp_dispose_mbuf(struct mbuf *m) 2732 { 2733 2734 if (m) 2735 unp_scan(m, unp_freerights); 2736 } 2737 2738 /* 2739 * Synchronize against unp_gc, which can trip over data as we are freeing it. 2740 */ 2741 static void 2742 unp_dispose(struct socket *so) 2743 { 2744 struct unpcb *unp; 2745 2746 unp = sotounpcb(so); 2747 UNP_LINK_WLOCK(); 2748 unp->unp_gcflag |= UNPGC_IGNORE_RIGHTS; 2749 UNP_LINK_WUNLOCK(); 2750 if (!SOLISTENING(so)) 2751 unp_dispose_mbuf(so->so_rcv.sb_mb); 2752 } 2753 2754 static void 2755 unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int)) 2756 { 2757 struct mbuf *m; 2758 struct cmsghdr *cm; 2759 void *data; 2760 socklen_t clen, datalen; 2761 2762 while (m0 != NULL) { 2763 for (m = m0; m; m = m->m_next) { 2764 if (m->m_type != MT_CONTROL) 2765 continue; 2766 2767 cm = mtod(m, struct cmsghdr *); 2768 clen = m->m_len; 2769 2770 while (cm != NULL) { 2771 if (sizeof(*cm) > clen || cm->cmsg_len > clen) 2772 break; 2773 2774 data = CMSG_DATA(cm); 2775 datalen = (caddr_t)cm + cm->cmsg_len 2776 - (caddr_t)data; 2777 2778 if (cm->cmsg_level == SOL_SOCKET && 2779 cm->cmsg_type == SCM_RIGHTS) { 2780 (*op)(data, datalen / 2781 sizeof(struct filedescent *)); 2782 } 2783 2784 if (CMSG_SPACE(datalen) < clen) { 2785 clen -= CMSG_SPACE(datalen); 2786 cm = (struct cmsghdr *) 2787 ((caddr_t)cm + CMSG_SPACE(datalen)); 2788 } else { 2789 clen = 0; 2790 cm = NULL; 2791 } 2792 } 2793 } 2794 m0 = m0->m_nextpkt; 2795 } 2796 } 2797 2798 /* 2799 * A helper function called by VFS before socket-type vnode reclamation. 2800 * For an active vnode it clears unp_vnode pointer and decrements unp_vnode 2801 * use count. 2802 */ 2803 void 2804 vfs_unp_reclaim(struct vnode *vp) 2805 { 2806 struct unpcb *unp; 2807 int active; 2808 struct mtx *vplock; 2809 2810 ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim"); 2811 KASSERT(vp->v_type == VSOCK, 2812 ("vfs_unp_reclaim: vp->v_type != VSOCK")); 2813 2814 active = 0; 2815 vplock = mtx_pool_find(mtxpool_sleep, vp); 2816 mtx_lock(vplock); 2817 VOP_UNP_CONNECT(vp, &unp); 2818 if (unp == NULL) 2819 goto done; 2820 UNP_PCB_LOCK(unp); 2821 if (unp->unp_vnode == vp) { 2822 VOP_UNP_DETACH(vp); 2823 unp->unp_vnode = NULL; 2824 active = 1; 2825 } 2826 UNP_PCB_UNLOCK(unp); 2827 done: 2828 mtx_unlock(vplock); 2829 if (active) 2830 vunref(vp); 2831 } 2832 2833 #ifdef DDB 2834 static void 2835 db_print_indent(int indent) 2836 { 2837 int i; 2838 2839 for (i = 0; i < indent; i++) 2840 db_printf(" "); 2841 } 2842 2843 static void 2844 db_print_unpflags(int unp_flags) 2845 { 2846 int comma; 2847 2848 comma = 0; 2849 if (unp_flags & UNP_HAVEPC) { 2850 db_printf("%sUNP_HAVEPC", comma ? ", " : ""); 2851 comma = 1; 2852 } 2853 if (unp_flags & UNP_WANTCRED) { 2854 db_printf("%sUNP_WANTCRED", comma ? ", " : ""); 2855 comma = 1; 2856 } 2857 if (unp_flags & UNP_CONNWAIT) { 2858 db_printf("%sUNP_CONNWAIT", comma ? ", " : ""); 2859 comma = 1; 2860 } 2861 if (unp_flags & UNP_CONNECTING) { 2862 db_printf("%sUNP_CONNECTING", comma ? ", " : ""); 2863 comma = 1; 2864 } 2865 if (unp_flags & UNP_BINDING) { 2866 db_printf("%sUNP_BINDING", comma ? ", " : ""); 2867 comma = 1; 2868 } 2869 } 2870 2871 static void 2872 db_print_xucred(int indent, struct xucred *xu) 2873 { 2874 int comma, i; 2875 2876 db_print_indent(indent); 2877 db_printf("cr_version: %u cr_uid: %u cr_pid: %d cr_ngroups: %d\n", 2878 xu->cr_version, xu->cr_uid, xu->cr_pid, xu->cr_ngroups); 2879 db_print_indent(indent); 2880 db_printf("cr_groups: "); 2881 comma = 0; 2882 for (i = 0; i < xu->cr_ngroups; i++) { 2883 db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]); 2884 comma = 1; 2885 } 2886 db_printf("\n"); 2887 } 2888 2889 static void 2890 db_print_unprefs(int indent, struct unp_head *uh) 2891 { 2892 struct unpcb *unp; 2893 int counter; 2894 2895 counter = 0; 2896 LIST_FOREACH(unp, uh, unp_reflink) { 2897 if (counter % 4 == 0) 2898 db_print_indent(indent); 2899 db_printf("%p ", unp); 2900 if (counter % 4 == 3) 2901 db_printf("\n"); 2902 counter++; 2903 } 2904 if (counter != 0 && counter % 4 != 0) 2905 db_printf("\n"); 2906 } 2907 2908 DB_SHOW_COMMAND(unpcb, db_show_unpcb) 2909 { 2910 struct unpcb *unp; 2911 2912 if (!have_addr) { 2913 db_printf("usage: show unpcb <addr>\n"); 2914 return; 2915 } 2916 unp = (struct unpcb *)addr; 2917 2918 db_printf("unp_socket: %p unp_vnode: %p\n", unp->unp_socket, 2919 unp->unp_vnode); 2920 2921 db_printf("unp_ino: %ju unp_conn: %p\n", (uintmax_t)unp->unp_ino, 2922 unp->unp_conn); 2923 2924 db_printf("unp_refs:\n"); 2925 db_print_unprefs(2, &unp->unp_refs); 2926 2927 /* XXXRW: Would be nice to print the full address, if any. */ 2928 db_printf("unp_addr: %p\n", unp->unp_addr); 2929 2930 db_printf("unp_gencnt: %llu\n", 2931 (unsigned long long)unp->unp_gencnt); 2932 2933 db_printf("unp_flags: %x (", unp->unp_flags); 2934 db_print_unpflags(unp->unp_flags); 2935 db_printf(")\n"); 2936 2937 db_printf("unp_peercred:\n"); 2938 db_print_xucred(2, &unp->unp_peercred); 2939 2940 db_printf("unp_refcount: %u\n", unp->unp_refcount); 2941 } 2942 #endif 2943