1 /* 2 * NET4: Implementation of BSD Unix domain sockets. 3 * 4 * Authors: Alan Cox, <alan.cox@linux.org> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 * 11 * Version: $Id: af_unix.c,v 1.133 2002/02/08 03:57:19 davem Exp $ 12 * 13 * Fixes: 14 * Linus Torvalds : Assorted bug cures. 15 * Niibe Yutaka : async I/O support. 16 * Carsten Paeth : PF_UNIX check, address fixes. 17 * Alan Cox : Limit size of allocated blocks. 18 * Alan Cox : Fixed the stupid socketpair bug. 19 * Alan Cox : BSD compatibility fine tuning. 20 * Alan Cox : Fixed a bug in connect when interrupted. 21 * Alan Cox : Sorted out a proper draft version of 22 * file descriptor passing hacked up from 23 * Mike Shaver's work. 24 * Marty Leisner : Fixes to fd passing 25 * Nick Nevin : recvmsg bugfix. 26 * Alan Cox : Started proper garbage collector 27 * Heiko EiBfeldt : Missing verify_area check 28 * Alan Cox : Started POSIXisms 29 * Andreas Schwab : Replace inode by dentry for proper 30 * reference counting 31 * Kirk Petersen : Made this a module 32 * Christoph Rohland : Elegant non-blocking accept/connect algorithm. 33 * Lots of bug fixes. 34 * Alexey Kuznetosv : Repaired (I hope) bugs introduces 35 * by above two patches. 36 * Andrea Arcangeli : If possible we block in connect(2) 37 * if the max backlog of the listen socket 38 * is been reached. This won't break 39 * old apps and it will avoid huge amount 40 * of socks hashed (this for unix_gc() 41 * performances reasons). 42 * Security fix that limits the max 43 * number of socks to 2*max_files and 44 * the number of skb queueable in the 45 * dgram receiver. 46 * Artur Skawina : Hash function optimizations 47 * Alexey Kuznetsov : Full scale SMP. Lot of bugs are introduced 8) 48 * Malcolm Beattie : Set peercred for socketpair 49 * Michal Ostrowski : Module initialization cleanup. 50 * Arnaldo C. Melo : Remove MOD_{INC,DEC}_USE_COUNT, 51 * the core infrastructure is doing that 52 * for all net proto families now (2.5.69+) 53 * 54 * 55 * Known differences from reference BSD that was tested: 56 * 57 * [TO FIX] 58 * ECONNREFUSED is not returned from one end of a connected() socket to the 59 * other the moment one end closes. 60 * fstat() doesn't return st_dev=0, and give the blksize as high water mark 61 * and a fake inode identifier (nor the BSD first socket fstat twice bug). 62 * [NOT TO FIX] 63 * accept() returns a path name even if the connecting socket has closed 64 * in the meantime (BSD loses the path and gives up). 65 * accept() returns 0 length path for an unbound connector. BSD returns 16 66 * and a null first byte in the path (but not for gethost/peername - BSD bug ??) 67 * socketpair(...SOCK_RAW..) doesn't panic the kernel. 68 * BSD af_unix apparently has connect forgetting to block properly. 69 * (need to check this with the POSIX spec in detail) 70 * 71 * Differences from 2.0.0-11-... (ANK) 72 * Bug fixes and improvements. 73 * - client shutdown killed server socket. 74 * - removed all useless cli/sti pairs. 75 * 76 * Semantic changes/extensions. 77 * - generic control message passing. 78 * - SCM_CREDENTIALS control message. 79 * - "Abstract" (not FS based) socket bindings. 80 * Abstract names are sequences of bytes (not zero terminated) 81 * started by 0, so that this name space does not intersect 82 * with BSD names. 83 */ 84 85 #include <linux/module.h> 86 #include <linux/kernel.h> 87 #include <linux/signal.h> 88 #include <linux/sched.h> 89 #include <linux/errno.h> 90 #include <linux/string.h> 91 #include <linux/stat.h> 92 #include <linux/dcache.h> 93 #include <linux/namei.h> 94 #include <linux/socket.h> 95 #include <linux/un.h> 96 #include <linux/fcntl.h> 97 #include <linux/termios.h> 98 #include <linux/sockios.h> 99 #include <linux/net.h> 100 #include <linux/in.h> 101 #include <linux/fs.h> 102 #include <linux/slab.h> 103 #include <asm/uaccess.h> 104 #include <linux/skbuff.h> 105 #include <linux/netdevice.h> 106 #include <net/sock.h> 107 #include <net/tcp_states.h> 108 #include <net/af_unix.h> 109 #include <linux/proc_fs.h> 110 #include <linux/seq_file.h> 111 #include <net/scm.h> 112 #include <linux/init.h> 113 #include <linux/poll.h> 114 #include <linux/smp_lock.h> 115 #include <linux/rtnetlink.h> 116 #include <linux/mount.h> 117 #include <net/checksum.h> 118 #include <linux/security.h> 119 120 int sysctl_unix_max_dgram_qlen = 10; 121 122 struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1]; 123 DEFINE_SPINLOCK(unix_table_lock); 124 static atomic_t unix_nr_socks = ATOMIC_INIT(0); 125 126 #define unix_sockets_unbound (&unix_socket_table[UNIX_HASH_SIZE]) 127 128 #define UNIX_ABSTRACT(sk) (unix_sk(sk)->addr->hash != UNIX_HASH_SIZE) 129 130 #ifdef CONFIG_SECURITY_NETWORK 131 static void unix_get_peersec_dgram(struct sk_buff *skb) 132 { 133 int err; 134 135 err = security_socket_getpeersec_dgram(skb, UNIXSECDATA(skb), 136 UNIXSECLEN(skb)); 137 if (err) 138 *(UNIXSECDATA(skb)) = NULL; 139 } 140 141 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) 142 { 143 scm->secdata = *UNIXSECDATA(skb); 144 scm->seclen = *UNIXSECLEN(skb); 145 } 146 #else 147 static void unix_get_peersec_dgram(struct sk_buff *skb) 148 { } 149 150 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) 151 { } 152 #endif /* CONFIG_SECURITY_NETWORK */ 153 154 /* 155 * SMP locking strategy: 156 * hash table is protected with spinlock unix_table_lock 157 * each socket state is protected by separate rwlock. 158 */ 159 160 static inline unsigned unix_hash_fold(unsigned hash) 161 { 162 hash ^= hash>>16; 163 hash ^= hash>>8; 164 return hash&(UNIX_HASH_SIZE-1); 165 } 166 167 #define unix_peer(sk) (unix_sk(sk)->peer) 168 169 static inline int unix_our_peer(struct sock *sk, struct sock *osk) 170 { 171 return unix_peer(osk) == sk; 172 } 173 174 static inline int unix_may_send(struct sock *sk, struct sock *osk) 175 { 176 return (unix_peer(osk) == NULL || unix_our_peer(sk, osk)); 177 } 178 179 static struct sock *unix_peer_get(struct sock *s) 180 { 181 struct sock *peer; 182 183 unix_state_rlock(s); 184 peer = unix_peer(s); 185 if (peer) 186 sock_hold(peer); 187 unix_state_runlock(s); 188 return peer; 189 } 190 191 static inline void unix_release_addr(struct unix_address *addr) 192 { 193 if (atomic_dec_and_test(&addr->refcnt)) 194 kfree(addr); 195 } 196 197 /* 198 * Check unix socket name: 199 * - should be not zero length. 200 * - if started by not zero, should be NULL terminated (FS object) 201 * - if started by zero, it is abstract name. 202 */ 203 204 static int unix_mkname(struct sockaddr_un * sunaddr, int len, unsigned *hashp) 205 { 206 if (len <= sizeof(short) || len > sizeof(*sunaddr)) 207 return -EINVAL; 208 if (!sunaddr || sunaddr->sun_family != AF_UNIX) 209 return -EINVAL; 210 if (sunaddr->sun_path[0]) { 211 /* 212 * This may look like an off by one error but it is a bit more 213 * subtle. 108 is the longest valid AF_UNIX path for a binding. 214 * sun_path[108] doesnt as such exist. However in kernel space 215 * we are guaranteed that it is a valid memory location in our 216 * kernel address buffer. 217 */ 218 ((char *)sunaddr)[len]=0; 219 len = strlen(sunaddr->sun_path)+1+sizeof(short); 220 return len; 221 } 222 223 *hashp = unix_hash_fold(csum_partial((char*)sunaddr, len, 0)); 224 return len; 225 } 226 227 static void __unix_remove_socket(struct sock *sk) 228 { 229 sk_del_node_init(sk); 230 } 231 232 static void __unix_insert_socket(struct hlist_head *list, struct sock *sk) 233 { 234 BUG_TRAP(sk_unhashed(sk)); 235 sk_add_node(sk, list); 236 } 237 238 static inline void unix_remove_socket(struct sock *sk) 239 { 240 spin_lock(&unix_table_lock); 241 __unix_remove_socket(sk); 242 spin_unlock(&unix_table_lock); 243 } 244 245 static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk) 246 { 247 spin_lock(&unix_table_lock); 248 __unix_insert_socket(list, sk); 249 spin_unlock(&unix_table_lock); 250 } 251 252 static struct sock *__unix_find_socket_byname(struct sockaddr_un *sunname, 253 int len, int type, unsigned hash) 254 { 255 struct sock *s; 256 struct hlist_node *node; 257 258 sk_for_each(s, node, &unix_socket_table[hash ^ type]) { 259 struct unix_sock *u = unix_sk(s); 260 261 if (u->addr->len == len && 262 !memcmp(u->addr->name, sunname, len)) 263 goto found; 264 } 265 s = NULL; 266 found: 267 return s; 268 } 269 270 static inline struct sock *unix_find_socket_byname(struct sockaddr_un *sunname, 271 int len, int type, 272 unsigned hash) 273 { 274 struct sock *s; 275 276 spin_lock(&unix_table_lock); 277 s = __unix_find_socket_byname(sunname, len, type, hash); 278 if (s) 279 sock_hold(s); 280 spin_unlock(&unix_table_lock); 281 return s; 282 } 283 284 static struct sock *unix_find_socket_byinode(struct inode *i) 285 { 286 struct sock *s; 287 struct hlist_node *node; 288 289 spin_lock(&unix_table_lock); 290 sk_for_each(s, node, 291 &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) { 292 struct dentry *dentry = unix_sk(s)->dentry; 293 294 if(dentry && dentry->d_inode == i) 295 { 296 sock_hold(s); 297 goto found; 298 } 299 } 300 s = NULL; 301 found: 302 spin_unlock(&unix_table_lock); 303 return s; 304 } 305 306 static inline int unix_writable(struct sock *sk) 307 { 308 return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf; 309 } 310 311 static void unix_write_space(struct sock *sk) 312 { 313 read_lock(&sk->sk_callback_lock); 314 if (unix_writable(sk)) { 315 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 316 wake_up_interruptible(sk->sk_sleep); 317 sk_wake_async(sk, 2, POLL_OUT); 318 } 319 read_unlock(&sk->sk_callback_lock); 320 } 321 322 /* When dgram socket disconnects (or changes its peer), we clear its receive 323 * queue of packets arrived from previous peer. First, it allows to do 324 * flow control based only on wmem_alloc; second, sk connected to peer 325 * may receive messages only from that peer. */ 326 static void unix_dgram_disconnected(struct sock *sk, struct sock *other) 327 { 328 if (!skb_queue_empty(&sk->sk_receive_queue)) { 329 skb_queue_purge(&sk->sk_receive_queue); 330 wake_up_interruptible_all(&unix_sk(sk)->peer_wait); 331 332 /* If one link of bidirectional dgram pipe is disconnected, 333 * we signal error. Messages are lost. Do not make this, 334 * when peer was not connected to us. 335 */ 336 if (!sock_flag(other, SOCK_DEAD) && unix_peer(other) == sk) { 337 other->sk_err = ECONNRESET; 338 other->sk_error_report(other); 339 } 340 } 341 } 342 343 static void unix_sock_destructor(struct sock *sk) 344 { 345 struct unix_sock *u = unix_sk(sk); 346 347 skb_queue_purge(&sk->sk_receive_queue); 348 349 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 350 BUG_TRAP(sk_unhashed(sk)); 351 BUG_TRAP(!sk->sk_socket); 352 if (!sock_flag(sk, SOCK_DEAD)) { 353 printk("Attempt to release alive unix socket: %p\n", sk); 354 return; 355 } 356 357 if (u->addr) 358 unix_release_addr(u->addr); 359 360 atomic_dec(&unix_nr_socks); 361 #ifdef UNIX_REFCNT_DEBUG 362 printk(KERN_DEBUG "UNIX %p is destroyed, %d are still alive.\n", sk, atomic_read(&unix_nr_socks)); 363 #endif 364 } 365 366 static int unix_release_sock (struct sock *sk, int embrion) 367 { 368 struct unix_sock *u = unix_sk(sk); 369 struct dentry *dentry; 370 struct vfsmount *mnt; 371 struct sock *skpair; 372 struct sk_buff *skb; 373 int state; 374 375 unix_remove_socket(sk); 376 377 /* Clear state */ 378 unix_state_wlock(sk); 379 sock_orphan(sk); 380 sk->sk_shutdown = SHUTDOWN_MASK; 381 dentry = u->dentry; 382 u->dentry = NULL; 383 mnt = u->mnt; 384 u->mnt = NULL; 385 state = sk->sk_state; 386 sk->sk_state = TCP_CLOSE; 387 unix_state_wunlock(sk); 388 389 wake_up_interruptible_all(&u->peer_wait); 390 391 skpair=unix_peer(sk); 392 393 if (skpair!=NULL) { 394 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { 395 unix_state_wlock(skpair); 396 /* No more writes */ 397 skpair->sk_shutdown = SHUTDOWN_MASK; 398 if (!skb_queue_empty(&sk->sk_receive_queue) || embrion) 399 skpair->sk_err = ECONNRESET; 400 unix_state_wunlock(skpair); 401 skpair->sk_state_change(skpair); 402 read_lock(&skpair->sk_callback_lock); 403 sk_wake_async(skpair,1,POLL_HUP); 404 read_unlock(&skpair->sk_callback_lock); 405 } 406 sock_put(skpair); /* It may now die */ 407 unix_peer(sk) = NULL; 408 } 409 410 /* Try to flush out this socket. Throw out buffers at least */ 411 412 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) { 413 if (state==TCP_LISTEN) 414 unix_release_sock(skb->sk, 1); 415 /* passed fds are erased in the kfree_skb hook */ 416 kfree_skb(skb); 417 } 418 419 if (dentry) { 420 dput(dentry); 421 mntput(mnt); 422 } 423 424 sock_put(sk); 425 426 /* ---- Socket is dead now and most probably destroyed ---- */ 427 428 /* 429 * Fixme: BSD difference: In BSD all sockets connected to use get 430 * ECONNRESET and we die on the spot. In Linux we behave 431 * like files and pipes do and wait for the last 432 * dereference. 433 * 434 * Can't we simply set sock->err? 435 * 436 * What the above comment does talk about? --ANK(980817) 437 */ 438 439 if (atomic_read(&unix_tot_inflight)) 440 unix_gc(); /* Garbage collect fds */ 441 442 return 0; 443 } 444 445 static int unix_listen(struct socket *sock, int backlog) 446 { 447 int err; 448 struct sock *sk = sock->sk; 449 struct unix_sock *u = unix_sk(sk); 450 451 err = -EOPNOTSUPP; 452 if (sock->type!=SOCK_STREAM && sock->type!=SOCK_SEQPACKET) 453 goto out; /* Only stream/seqpacket sockets accept */ 454 err = -EINVAL; 455 if (!u->addr) 456 goto out; /* No listens on an unbound socket */ 457 unix_state_wlock(sk); 458 if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN) 459 goto out_unlock; 460 if (backlog > sk->sk_max_ack_backlog) 461 wake_up_interruptible_all(&u->peer_wait); 462 sk->sk_max_ack_backlog = backlog; 463 sk->sk_state = TCP_LISTEN; 464 /* set credentials so connect can copy them */ 465 sk->sk_peercred.pid = current->tgid; 466 sk->sk_peercred.uid = current->euid; 467 sk->sk_peercred.gid = current->egid; 468 err = 0; 469 470 out_unlock: 471 unix_state_wunlock(sk); 472 out: 473 return err; 474 } 475 476 static int unix_release(struct socket *); 477 static int unix_bind(struct socket *, struct sockaddr *, int); 478 static int unix_stream_connect(struct socket *, struct sockaddr *, 479 int addr_len, int flags); 480 static int unix_socketpair(struct socket *, struct socket *); 481 static int unix_accept(struct socket *, struct socket *, int); 482 static int unix_getname(struct socket *, struct sockaddr *, int *, int); 483 static unsigned int unix_poll(struct file *, struct socket *, poll_table *); 484 static int unix_ioctl(struct socket *, unsigned int, unsigned long); 485 static int unix_shutdown(struct socket *, int); 486 static int unix_stream_sendmsg(struct kiocb *, struct socket *, 487 struct msghdr *, size_t); 488 static int unix_stream_recvmsg(struct kiocb *, struct socket *, 489 struct msghdr *, size_t, int); 490 static int unix_dgram_sendmsg(struct kiocb *, struct socket *, 491 struct msghdr *, size_t); 492 static int unix_dgram_recvmsg(struct kiocb *, struct socket *, 493 struct msghdr *, size_t, int); 494 static int unix_dgram_connect(struct socket *, struct sockaddr *, 495 int, int); 496 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *, 497 struct msghdr *, size_t); 498 499 static const struct proto_ops unix_stream_ops = { 500 .family = PF_UNIX, 501 .owner = THIS_MODULE, 502 .release = unix_release, 503 .bind = unix_bind, 504 .connect = unix_stream_connect, 505 .socketpair = unix_socketpair, 506 .accept = unix_accept, 507 .getname = unix_getname, 508 .poll = unix_poll, 509 .ioctl = unix_ioctl, 510 .listen = unix_listen, 511 .shutdown = unix_shutdown, 512 .setsockopt = sock_no_setsockopt, 513 .getsockopt = sock_no_getsockopt, 514 .sendmsg = unix_stream_sendmsg, 515 .recvmsg = unix_stream_recvmsg, 516 .mmap = sock_no_mmap, 517 .sendpage = sock_no_sendpage, 518 }; 519 520 static const struct proto_ops unix_dgram_ops = { 521 .family = PF_UNIX, 522 .owner = THIS_MODULE, 523 .release = unix_release, 524 .bind = unix_bind, 525 .connect = unix_dgram_connect, 526 .socketpair = unix_socketpair, 527 .accept = sock_no_accept, 528 .getname = unix_getname, 529 .poll = datagram_poll, 530 .ioctl = unix_ioctl, 531 .listen = sock_no_listen, 532 .shutdown = unix_shutdown, 533 .setsockopt = sock_no_setsockopt, 534 .getsockopt = sock_no_getsockopt, 535 .sendmsg = unix_dgram_sendmsg, 536 .recvmsg = unix_dgram_recvmsg, 537 .mmap = sock_no_mmap, 538 .sendpage = sock_no_sendpage, 539 }; 540 541 static const struct proto_ops unix_seqpacket_ops = { 542 .family = PF_UNIX, 543 .owner = THIS_MODULE, 544 .release = unix_release, 545 .bind = unix_bind, 546 .connect = unix_stream_connect, 547 .socketpair = unix_socketpair, 548 .accept = unix_accept, 549 .getname = unix_getname, 550 .poll = datagram_poll, 551 .ioctl = unix_ioctl, 552 .listen = unix_listen, 553 .shutdown = unix_shutdown, 554 .setsockopt = sock_no_setsockopt, 555 .getsockopt = sock_no_getsockopt, 556 .sendmsg = unix_seqpacket_sendmsg, 557 .recvmsg = unix_dgram_recvmsg, 558 .mmap = sock_no_mmap, 559 .sendpage = sock_no_sendpage, 560 }; 561 562 static struct proto unix_proto = { 563 .name = "UNIX", 564 .owner = THIS_MODULE, 565 .obj_size = sizeof(struct unix_sock), 566 }; 567 568 static struct sock * unix_create1(struct socket *sock) 569 { 570 struct sock *sk = NULL; 571 struct unix_sock *u; 572 573 if (atomic_read(&unix_nr_socks) >= 2*get_max_files()) 574 goto out; 575 576 sk = sk_alloc(PF_UNIX, GFP_KERNEL, &unix_proto, 1); 577 if (!sk) 578 goto out; 579 580 atomic_inc(&unix_nr_socks); 581 582 sock_init_data(sock,sk); 583 584 sk->sk_write_space = unix_write_space; 585 sk->sk_max_ack_backlog = sysctl_unix_max_dgram_qlen; 586 sk->sk_destruct = unix_sock_destructor; 587 u = unix_sk(sk); 588 u->dentry = NULL; 589 u->mnt = NULL; 590 spin_lock_init(&u->lock); 591 atomic_set(&u->inflight, sock ? 0 : -1); 592 mutex_init(&u->readlock); /* single task reading lock */ 593 init_waitqueue_head(&u->peer_wait); 594 unix_insert_socket(unix_sockets_unbound, sk); 595 out: 596 return sk; 597 } 598 599 static int unix_create(struct socket *sock, int protocol) 600 { 601 if (protocol && protocol != PF_UNIX) 602 return -EPROTONOSUPPORT; 603 604 sock->state = SS_UNCONNECTED; 605 606 switch (sock->type) { 607 case SOCK_STREAM: 608 sock->ops = &unix_stream_ops; 609 break; 610 /* 611 * Believe it or not BSD has AF_UNIX, SOCK_RAW though 612 * nothing uses it. 613 */ 614 case SOCK_RAW: 615 sock->type=SOCK_DGRAM; 616 case SOCK_DGRAM: 617 sock->ops = &unix_dgram_ops; 618 break; 619 case SOCK_SEQPACKET: 620 sock->ops = &unix_seqpacket_ops; 621 break; 622 default: 623 return -ESOCKTNOSUPPORT; 624 } 625 626 return unix_create1(sock) ? 0 : -ENOMEM; 627 } 628 629 static int unix_release(struct socket *sock) 630 { 631 struct sock *sk = sock->sk; 632 633 if (!sk) 634 return 0; 635 636 sock->sk = NULL; 637 638 return unix_release_sock (sk, 0); 639 } 640 641 static int unix_autobind(struct socket *sock) 642 { 643 struct sock *sk = sock->sk; 644 struct unix_sock *u = unix_sk(sk); 645 static u32 ordernum = 1; 646 struct unix_address * addr; 647 int err; 648 649 mutex_lock(&u->readlock); 650 651 err = 0; 652 if (u->addr) 653 goto out; 654 655 err = -ENOMEM; 656 addr = kmalloc(sizeof(*addr) + sizeof(short) + 16, GFP_KERNEL); 657 if (!addr) 658 goto out; 659 660 memset(addr, 0, sizeof(*addr) + sizeof(short) + 16); 661 addr->name->sun_family = AF_UNIX; 662 atomic_set(&addr->refcnt, 1); 663 664 retry: 665 addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short); 666 addr->hash = unix_hash_fold(csum_partial((void*)addr->name, addr->len, 0)); 667 668 spin_lock(&unix_table_lock); 669 ordernum = (ordernum+1)&0xFFFFF; 670 671 if (__unix_find_socket_byname(addr->name, addr->len, sock->type, 672 addr->hash)) { 673 spin_unlock(&unix_table_lock); 674 /* Sanity yield. It is unusual case, but yet... */ 675 if (!(ordernum&0xFF)) 676 yield(); 677 goto retry; 678 } 679 addr->hash ^= sk->sk_type; 680 681 __unix_remove_socket(sk); 682 u->addr = addr; 683 __unix_insert_socket(&unix_socket_table[addr->hash], sk); 684 spin_unlock(&unix_table_lock); 685 err = 0; 686 687 out: mutex_unlock(&u->readlock); 688 return err; 689 } 690 691 static struct sock *unix_find_other(struct sockaddr_un *sunname, int len, 692 int type, unsigned hash, int *error) 693 { 694 struct sock *u; 695 struct nameidata nd; 696 int err = 0; 697 698 if (sunname->sun_path[0]) { 699 err = path_lookup(sunname->sun_path, LOOKUP_FOLLOW, &nd); 700 if (err) 701 goto fail; 702 err = vfs_permission(&nd, MAY_WRITE); 703 if (err) 704 goto put_fail; 705 706 err = -ECONNREFUSED; 707 if (!S_ISSOCK(nd.dentry->d_inode->i_mode)) 708 goto put_fail; 709 u=unix_find_socket_byinode(nd.dentry->d_inode); 710 if (!u) 711 goto put_fail; 712 713 if (u->sk_type == type) 714 touch_atime(nd.mnt, nd.dentry); 715 716 path_release(&nd); 717 718 err=-EPROTOTYPE; 719 if (u->sk_type != type) { 720 sock_put(u); 721 goto fail; 722 } 723 } else { 724 err = -ECONNREFUSED; 725 u=unix_find_socket_byname(sunname, len, type, hash); 726 if (u) { 727 struct dentry *dentry; 728 dentry = unix_sk(u)->dentry; 729 if (dentry) 730 touch_atime(unix_sk(u)->mnt, dentry); 731 } else 732 goto fail; 733 } 734 return u; 735 736 put_fail: 737 path_release(&nd); 738 fail: 739 *error=err; 740 return NULL; 741 } 742 743 744 static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) 745 { 746 struct sock *sk = sock->sk; 747 struct unix_sock *u = unix_sk(sk); 748 struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr; 749 struct dentry * dentry = NULL; 750 struct nameidata nd; 751 int err; 752 unsigned hash; 753 struct unix_address *addr; 754 struct hlist_head *list; 755 756 err = -EINVAL; 757 if (sunaddr->sun_family != AF_UNIX) 758 goto out; 759 760 if (addr_len==sizeof(short)) { 761 err = unix_autobind(sock); 762 goto out; 763 } 764 765 err = unix_mkname(sunaddr, addr_len, &hash); 766 if (err < 0) 767 goto out; 768 addr_len = err; 769 770 mutex_lock(&u->readlock); 771 772 err = -EINVAL; 773 if (u->addr) 774 goto out_up; 775 776 err = -ENOMEM; 777 addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL); 778 if (!addr) 779 goto out_up; 780 781 memcpy(addr->name, sunaddr, addr_len); 782 addr->len = addr_len; 783 addr->hash = hash ^ sk->sk_type; 784 atomic_set(&addr->refcnt, 1); 785 786 if (sunaddr->sun_path[0]) { 787 unsigned int mode; 788 err = 0; 789 /* 790 * Get the parent directory, calculate the hash for last 791 * component. 792 */ 793 err = path_lookup(sunaddr->sun_path, LOOKUP_PARENT, &nd); 794 if (err) 795 goto out_mknod_parent; 796 797 dentry = lookup_create(&nd, 0); 798 err = PTR_ERR(dentry); 799 if (IS_ERR(dentry)) 800 goto out_mknod_unlock; 801 802 /* 803 * All right, let's create it. 804 */ 805 mode = S_IFSOCK | 806 (SOCK_INODE(sock)->i_mode & ~current->fs->umask); 807 err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0); 808 if (err) 809 goto out_mknod_dput; 810 mutex_unlock(&nd.dentry->d_inode->i_mutex); 811 dput(nd.dentry); 812 nd.dentry = dentry; 813 814 addr->hash = UNIX_HASH_SIZE; 815 } 816 817 spin_lock(&unix_table_lock); 818 819 if (!sunaddr->sun_path[0]) { 820 err = -EADDRINUSE; 821 if (__unix_find_socket_byname(sunaddr, addr_len, 822 sk->sk_type, hash)) { 823 unix_release_addr(addr); 824 goto out_unlock; 825 } 826 827 list = &unix_socket_table[addr->hash]; 828 } else { 829 list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)]; 830 u->dentry = nd.dentry; 831 u->mnt = nd.mnt; 832 } 833 834 err = 0; 835 __unix_remove_socket(sk); 836 u->addr = addr; 837 __unix_insert_socket(list, sk); 838 839 out_unlock: 840 spin_unlock(&unix_table_lock); 841 out_up: 842 mutex_unlock(&u->readlock); 843 out: 844 return err; 845 846 out_mknod_dput: 847 dput(dentry); 848 out_mknod_unlock: 849 mutex_unlock(&nd.dentry->d_inode->i_mutex); 850 path_release(&nd); 851 out_mknod_parent: 852 if (err==-EEXIST) 853 err=-EADDRINUSE; 854 unix_release_addr(addr); 855 goto out_up; 856 } 857 858 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, 859 int alen, int flags) 860 { 861 struct sock *sk = sock->sk; 862 struct sockaddr_un *sunaddr=(struct sockaddr_un*)addr; 863 struct sock *other; 864 unsigned hash; 865 int err; 866 867 if (addr->sa_family != AF_UNSPEC) { 868 err = unix_mkname(sunaddr, alen, &hash); 869 if (err < 0) 870 goto out; 871 alen = err; 872 873 if (test_bit(SOCK_PASSCRED, &sock->flags) && 874 !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0) 875 goto out; 876 877 other=unix_find_other(sunaddr, alen, sock->type, hash, &err); 878 if (!other) 879 goto out; 880 881 unix_state_wlock(sk); 882 883 err = -EPERM; 884 if (!unix_may_send(sk, other)) 885 goto out_unlock; 886 887 err = security_unix_may_send(sk->sk_socket, other->sk_socket); 888 if (err) 889 goto out_unlock; 890 891 } else { 892 /* 893 * 1003.1g breaking connected state with AF_UNSPEC 894 */ 895 other = NULL; 896 unix_state_wlock(sk); 897 } 898 899 /* 900 * If it was connected, reconnect. 901 */ 902 if (unix_peer(sk)) { 903 struct sock *old_peer = unix_peer(sk); 904 unix_peer(sk)=other; 905 unix_state_wunlock(sk); 906 907 if (other != old_peer) 908 unix_dgram_disconnected(sk, old_peer); 909 sock_put(old_peer); 910 } else { 911 unix_peer(sk)=other; 912 unix_state_wunlock(sk); 913 } 914 return 0; 915 916 out_unlock: 917 unix_state_wunlock(sk); 918 sock_put(other); 919 out: 920 return err; 921 } 922 923 static long unix_wait_for_peer(struct sock *other, long timeo) 924 { 925 struct unix_sock *u = unix_sk(other); 926 int sched; 927 DEFINE_WAIT(wait); 928 929 prepare_to_wait_exclusive(&u->peer_wait, &wait, TASK_INTERRUPTIBLE); 930 931 sched = !sock_flag(other, SOCK_DEAD) && 932 !(other->sk_shutdown & RCV_SHUTDOWN) && 933 (skb_queue_len(&other->sk_receive_queue) > 934 other->sk_max_ack_backlog); 935 936 unix_state_runlock(other); 937 938 if (sched) 939 timeo = schedule_timeout(timeo); 940 941 finish_wait(&u->peer_wait, &wait); 942 return timeo; 943 } 944 945 static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, 946 int addr_len, int flags) 947 { 948 struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr; 949 struct sock *sk = sock->sk; 950 struct unix_sock *u = unix_sk(sk), *newu, *otheru; 951 struct sock *newsk = NULL; 952 struct sock *other = NULL; 953 struct sk_buff *skb = NULL; 954 unsigned hash; 955 int st; 956 int err; 957 long timeo; 958 959 err = unix_mkname(sunaddr, addr_len, &hash); 960 if (err < 0) 961 goto out; 962 addr_len = err; 963 964 if (test_bit(SOCK_PASSCRED, &sock->flags) 965 && !u->addr && (err = unix_autobind(sock)) != 0) 966 goto out; 967 968 timeo = sock_sndtimeo(sk, flags & O_NONBLOCK); 969 970 /* First of all allocate resources. 971 If we will make it after state is locked, 972 we will have to recheck all again in any case. 973 */ 974 975 err = -ENOMEM; 976 977 /* create new sock for complete connection */ 978 newsk = unix_create1(NULL); 979 if (newsk == NULL) 980 goto out; 981 982 /* Allocate skb for sending to listening sock */ 983 skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL); 984 if (skb == NULL) 985 goto out; 986 987 restart: 988 /* Find listening sock. */ 989 other = unix_find_other(sunaddr, addr_len, sk->sk_type, hash, &err); 990 if (!other) 991 goto out; 992 993 /* Latch state of peer */ 994 unix_state_rlock(other); 995 996 /* Apparently VFS overslept socket death. Retry. */ 997 if (sock_flag(other, SOCK_DEAD)) { 998 unix_state_runlock(other); 999 sock_put(other); 1000 goto restart; 1001 } 1002 1003 err = -ECONNREFUSED; 1004 if (other->sk_state != TCP_LISTEN) 1005 goto out_unlock; 1006 1007 if (skb_queue_len(&other->sk_receive_queue) > 1008 other->sk_max_ack_backlog) { 1009 err = -EAGAIN; 1010 if (!timeo) 1011 goto out_unlock; 1012 1013 timeo = unix_wait_for_peer(other, timeo); 1014 1015 err = sock_intr_errno(timeo); 1016 if (signal_pending(current)) 1017 goto out; 1018 sock_put(other); 1019 goto restart; 1020 } 1021 1022 /* Latch our state. 1023 1024 It is tricky place. We need to grab write lock and cannot 1025 drop lock on peer. It is dangerous because deadlock is 1026 possible. Connect to self case and simultaneous 1027 attempt to connect are eliminated by checking socket 1028 state. other is TCP_LISTEN, if sk is TCP_LISTEN we 1029 check this before attempt to grab lock. 1030 1031 Well, and we have to recheck the state after socket locked. 1032 */ 1033 st = sk->sk_state; 1034 1035 switch (st) { 1036 case TCP_CLOSE: 1037 /* This is ok... continue with connect */ 1038 break; 1039 case TCP_ESTABLISHED: 1040 /* Socket is already connected */ 1041 err = -EISCONN; 1042 goto out_unlock; 1043 default: 1044 err = -EINVAL; 1045 goto out_unlock; 1046 } 1047 1048 unix_state_wlock(sk); 1049 1050 if (sk->sk_state != st) { 1051 unix_state_wunlock(sk); 1052 unix_state_runlock(other); 1053 sock_put(other); 1054 goto restart; 1055 } 1056 1057 err = security_unix_stream_connect(sock, other->sk_socket, newsk); 1058 if (err) { 1059 unix_state_wunlock(sk); 1060 goto out_unlock; 1061 } 1062 1063 /* The way is open! Fastly set all the necessary fields... */ 1064 1065 sock_hold(sk); 1066 unix_peer(newsk) = sk; 1067 newsk->sk_state = TCP_ESTABLISHED; 1068 newsk->sk_type = sk->sk_type; 1069 newsk->sk_peercred.pid = current->tgid; 1070 newsk->sk_peercred.uid = current->euid; 1071 newsk->sk_peercred.gid = current->egid; 1072 newu = unix_sk(newsk); 1073 newsk->sk_sleep = &newu->peer_wait; 1074 otheru = unix_sk(other); 1075 1076 /* copy address information from listening to new sock*/ 1077 if (otheru->addr) { 1078 atomic_inc(&otheru->addr->refcnt); 1079 newu->addr = otheru->addr; 1080 } 1081 if (otheru->dentry) { 1082 newu->dentry = dget(otheru->dentry); 1083 newu->mnt = mntget(otheru->mnt); 1084 } 1085 1086 /* Set credentials */ 1087 sk->sk_peercred = other->sk_peercred; 1088 1089 sock->state = SS_CONNECTED; 1090 sk->sk_state = TCP_ESTABLISHED; 1091 sock_hold(newsk); 1092 1093 smp_mb__after_atomic_inc(); /* sock_hold() does an atomic_inc() */ 1094 unix_peer(sk) = newsk; 1095 1096 unix_state_wunlock(sk); 1097 1098 /* take ten and and send info to listening sock */ 1099 spin_lock(&other->sk_receive_queue.lock); 1100 __skb_queue_tail(&other->sk_receive_queue, skb); 1101 /* Undo artificially decreased inflight after embrion 1102 * is installed to listening socket. */ 1103 atomic_inc(&newu->inflight); 1104 spin_unlock(&other->sk_receive_queue.lock); 1105 unix_state_runlock(other); 1106 other->sk_data_ready(other, 0); 1107 sock_put(other); 1108 return 0; 1109 1110 out_unlock: 1111 if (other) 1112 unix_state_runlock(other); 1113 1114 out: 1115 if (skb) 1116 kfree_skb(skb); 1117 if (newsk) 1118 unix_release_sock(newsk, 0); 1119 if (other) 1120 sock_put(other); 1121 return err; 1122 } 1123 1124 static int unix_socketpair(struct socket *socka, struct socket *sockb) 1125 { 1126 struct sock *ska=socka->sk, *skb = sockb->sk; 1127 1128 /* Join our sockets back to back */ 1129 sock_hold(ska); 1130 sock_hold(skb); 1131 unix_peer(ska)=skb; 1132 unix_peer(skb)=ska; 1133 ska->sk_peercred.pid = skb->sk_peercred.pid = current->tgid; 1134 ska->sk_peercred.uid = skb->sk_peercred.uid = current->euid; 1135 ska->sk_peercred.gid = skb->sk_peercred.gid = current->egid; 1136 1137 if (ska->sk_type != SOCK_DGRAM) { 1138 ska->sk_state = TCP_ESTABLISHED; 1139 skb->sk_state = TCP_ESTABLISHED; 1140 socka->state = SS_CONNECTED; 1141 sockb->state = SS_CONNECTED; 1142 } 1143 return 0; 1144 } 1145 1146 static int unix_accept(struct socket *sock, struct socket *newsock, int flags) 1147 { 1148 struct sock *sk = sock->sk; 1149 struct sock *tsk; 1150 struct sk_buff *skb; 1151 int err; 1152 1153 err = -EOPNOTSUPP; 1154 if (sock->type!=SOCK_STREAM && sock->type!=SOCK_SEQPACKET) 1155 goto out; 1156 1157 err = -EINVAL; 1158 if (sk->sk_state != TCP_LISTEN) 1159 goto out; 1160 1161 /* If socket state is TCP_LISTEN it cannot change (for now...), 1162 * so that no locks are necessary. 1163 */ 1164 1165 skb = skb_recv_datagram(sk, 0, flags&O_NONBLOCK, &err); 1166 if (!skb) { 1167 /* This means receive shutdown. */ 1168 if (err == 0) 1169 err = -EINVAL; 1170 goto out; 1171 } 1172 1173 tsk = skb->sk; 1174 skb_free_datagram(sk, skb); 1175 wake_up_interruptible(&unix_sk(sk)->peer_wait); 1176 1177 /* attach accepted sock to socket */ 1178 unix_state_wlock(tsk); 1179 newsock->state = SS_CONNECTED; 1180 sock_graft(tsk, newsock); 1181 unix_state_wunlock(tsk); 1182 return 0; 1183 1184 out: 1185 return err; 1186 } 1187 1188 1189 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer) 1190 { 1191 struct sock *sk = sock->sk; 1192 struct unix_sock *u; 1193 struct sockaddr_un *sunaddr=(struct sockaddr_un *)uaddr; 1194 int err = 0; 1195 1196 if (peer) { 1197 sk = unix_peer_get(sk); 1198 1199 err = -ENOTCONN; 1200 if (!sk) 1201 goto out; 1202 err = 0; 1203 } else { 1204 sock_hold(sk); 1205 } 1206 1207 u = unix_sk(sk); 1208 unix_state_rlock(sk); 1209 if (!u->addr) { 1210 sunaddr->sun_family = AF_UNIX; 1211 sunaddr->sun_path[0] = 0; 1212 *uaddr_len = sizeof(short); 1213 } else { 1214 struct unix_address *addr = u->addr; 1215 1216 *uaddr_len = addr->len; 1217 memcpy(sunaddr, addr->name, *uaddr_len); 1218 } 1219 unix_state_runlock(sk); 1220 sock_put(sk); 1221 out: 1222 return err; 1223 } 1224 1225 static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) 1226 { 1227 int i; 1228 1229 scm->fp = UNIXCB(skb).fp; 1230 skb->destructor = sock_wfree; 1231 UNIXCB(skb).fp = NULL; 1232 1233 for (i=scm->fp->count-1; i>=0; i--) 1234 unix_notinflight(scm->fp->fp[i]); 1235 } 1236 1237 static void unix_destruct_fds(struct sk_buff *skb) 1238 { 1239 struct scm_cookie scm; 1240 memset(&scm, 0, sizeof(scm)); 1241 unix_detach_fds(&scm, skb); 1242 1243 /* Alas, it calls VFS */ 1244 /* So fscking what? fput() had been SMP-safe since the last Summer */ 1245 scm_destroy(&scm); 1246 sock_wfree(skb); 1247 } 1248 1249 static void unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) 1250 { 1251 int i; 1252 for (i=scm->fp->count-1; i>=0; i--) 1253 unix_inflight(scm->fp->fp[i]); 1254 UNIXCB(skb).fp = scm->fp; 1255 skb->destructor = unix_destruct_fds; 1256 scm->fp = NULL; 1257 } 1258 1259 /* 1260 * Send AF_UNIX data. 1261 */ 1262 1263 static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock, 1264 struct msghdr *msg, size_t len) 1265 { 1266 struct sock_iocb *siocb = kiocb_to_siocb(kiocb); 1267 struct sock *sk = sock->sk; 1268 struct unix_sock *u = unix_sk(sk); 1269 struct sockaddr_un *sunaddr=msg->msg_name; 1270 struct sock *other = NULL; 1271 int namelen = 0; /* fake GCC */ 1272 int err; 1273 unsigned hash; 1274 struct sk_buff *skb; 1275 long timeo; 1276 struct scm_cookie tmp_scm; 1277 1278 if (NULL == siocb->scm) 1279 siocb->scm = &tmp_scm; 1280 err = scm_send(sock, msg, siocb->scm); 1281 if (err < 0) 1282 return err; 1283 1284 err = -EOPNOTSUPP; 1285 if (msg->msg_flags&MSG_OOB) 1286 goto out; 1287 1288 if (msg->msg_namelen) { 1289 err = unix_mkname(sunaddr, msg->msg_namelen, &hash); 1290 if (err < 0) 1291 goto out; 1292 namelen = err; 1293 } else { 1294 sunaddr = NULL; 1295 err = -ENOTCONN; 1296 other = unix_peer_get(sk); 1297 if (!other) 1298 goto out; 1299 } 1300 1301 if (test_bit(SOCK_PASSCRED, &sock->flags) 1302 && !u->addr && (err = unix_autobind(sock)) != 0) 1303 goto out; 1304 1305 err = -EMSGSIZE; 1306 if (len > sk->sk_sndbuf - 32) 1307 goto out; 1308 1309 skb = sock_alloc_send_skb(sk, len, msg->msg_flags&MSG_DONTWAIT, &err); 1310 if (skb==NULL) 1311 goto out; 1312 1313 memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); 1314 if (siocb->scm->fp) 1315 unix_attach_fds(siocb->scm, skb); 1316 1317 unix_get_peersec_dgram(skb); 1318 1319 skb->h.raw = skb->data; 1320 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 1321 if (err) 1322 goto out_free; 1323 1324 timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); 1325 1326 restart: 1327 if (!other) { 1328 err = -ECONNRESET; 1329 if (sunaddr == NULL) 1330 goto out_free; 1331 1332 other = unix_find_other(sunaddr, namelen, sk->sk_type, 1333 hash, &err); 1334 if (other==NULL) 1335 goto out_free; 1336 } 1337 1338 unix_state_rlock(other); 1339 err = -EPERM; 1340 if (!unix_may_send(sk, other)) 1341 goto out_unlock; 1342 1343 if (sock_flag(other, SOCK_DEAD)) { 1344 /* 1345 * Check with 1003.1g - what should 1346 * datagram error 1347 */ 1348 unix_state_runlock(other); 1349 sock_put(other); 1350 1351 err = 0; 1352 unix_state_wlock(sk); 1353 if (unix_peer(sk) == other) { 1354 unix_peer(sk)=NULL; 1355 unix_state_wunlock(sk); 1356 1357 unix_dgram_disconnected(sk, other); 1358 sock_put(other); 1359 err = -ECONNREFUSED; 1360 } else { 1361 unix_state_wunlock(sk); 1362 } 1363 1364 other = NULL; 1365 if (err) 1366 goto out_free; 1367 goto restart; 1368 } 1369 1370 err = -EPIPE; 1371 if (other->sk_shutdown & RCV_SHUTDOWN) 1372 goto out_unlock; 1373 1374 if (sk->sk_type != SOCK_SEQPACKET) { 1375 err = security_unix_may_send(sk->sk_socket, other->sk_socket); 1376 if (err) 1377 goto out_unlock; 1378 } 1379 1380 if (unix_peer(other) != sk && 1381 (skb_queue_len(&other->sk_receive_queue) > 1382 other->sk_max_ack_backlog)) { 1383 if (!timeo) { 1384 err = -EAGAIN; 1385 goto out_unlock; 1386 } 1387 1388 timeo = unix_wait_for_peer(other, timeo); 1389 1390 err = sock_intr_errno(timeo); 1391 if (signal_pending(current)) 1392 goto out_free; 1393 1394 goto restart; 1395 } 1396 1397 skb_queue_tail(&other->sk_receive_queue, skb); 1398 unix_state_runlock(other); 1399 other->sk_data_ready(other, len); 1400 sock_put(other); 1401 scm_destroy(siocb->scm); 1402 return len; 1403 1404 out_unlock: 1405 unix_state_runlock(other); 1406 out_free: 1407 kfree_skb(skb); 1408 out: 1409 if (other) 1410 sock_put(other); 1411 scm_destroy(siocb->scm); 1412 return err; 1413 } 1414 1415 1416 static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock, 1417 struct msghdr *msg, size_t len) 1418 { 1419 struct sock_iocb *siocb = kiocb_to_siocb(kiocb); 1420 struct sock *sk = sock->sk; 1421 struct sock *other = NULL; 1422 struct sockaddr_un *sunaddr=msg->msg_name; 1423 int err,size; 1424 struct sk_buff *skb; 1425 int sent=0; 1426 struct scm_cookie tmp_scm; 1427 1428 if (NULL == siocb->scm) 1429 siocb->scm = &tmp_scm; 1430 err = scm_send(sock, msg, siocb->scm); 1431 if (err < 0) 1432 return err; 1433 1434 err = -EOPNOTSUPP; 1435 if (msg->msg_flags&MSG_OOB) 1436 goto out_err; 1437 1438 if (msg->msg_namelen) { 1439 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP; 1440 goto out_err; 1441 } else { 1442 sunaddr = NULL; 1443 err = -ENOTCONN; 1444 other = unix_peer(sk); 1445 if (!other) 1446 goto out_err; 1447 } 1448 1449 if (sk->sk_shutdown & SEND_SHUTDOWN) 1450 goto pipe_err; 1451 1452 while(sent < len) 1453 { 1454 /* 1455 * Optimisation for the fact that under 0.01% of X 1456 * messages typically need breaking up. 1457 */ 1458 1459 size = len-sent; 1460 1461 /* Keep two messages in the pipe so it schedules better */ 1462 if (size > ((sk->sk_sndbuf >> 1) - 64)) 1463 size = (sk->sk_sndbuf >> 1) - 64; 1464 1465 if (size > SKB_MAX_ALLOC) 1466 size = SKB_MAX_ALLOC; 1467 1468 /* 1469 * Grab a buffer 1470 */ 1471 1472 skb=sock_alloc_send_skb(sk,size,msg->msg_flags&MSG_DONTWAIT, &err); 1473 1474 if (skb==NULL) 1475 goto out_err; 1476 1477 /* 1478 * If you pass two values to the sock_alloc_send_skb 1479 * it tries to grab the large buffer with GFP_NOFS 1480 * (which can fail easily), and if it fails grab the 1481 * fallback size buffer which is under a page and will 1482 * succeed. [Alan] 1483 */ 1484 size = min_t(int, size, skb_tailroom(skb)); 1485 1486 memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); 1487 if (siocb->scm->fp) 1488 unix_attach_fds(siocb->scm, skb); 1489 1490 if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) { 1491 kfree_skb(skb); 1492 goto out_err; 1493 } 1494 1495 unix_state_rlock(other); 1496 1497 if (sock_flag(other, SOCK_DEAD) || 1498 (other->sk_shutdown & RCV_SHUTDOWN)) 1499 goto pipe_err_free; 1500 1501 skb_queue_tail(&other->sk_receive_queue, skb); 1502 unix_state_runlock(other); 1503 other->sk_data_ready(other, size); 1504 sent+=size; 1505 } 1506 1507 scm_destroy(siocb->scm); 1508 siocb->scm = NULL; 1509 1510 return sent; 1511 1512 pipe_err_free: 1513 unix_state_runlock(other); 1514 kfree_skb(skb); 1515 pipe_err: 1516 if (sent==0 && !(msg->msg_flags&MSG_NOSIGNAL)) 1517 send_sig(SIGPIPE,current,0); 1518 err = -EPIPE; 1519 out_err: 1520 scm_destroy(siocb->scm); 1521 siocb->scm = NULL; 1522 return sent ? : err; 1523 } 1524 1525 static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock, 1526 struct msghdr *msg, size_t len) 1527 { 1528 int err; 1529 struct sock *sk = sock->sk; 1530 1531 err = sock_error(sk); 1532 if (err) 1533 return err; 1534 1535 if (sk->sk_state != TCP_ESTABLISHED) 1536 return -ENOTCONN; 1537 1538 if (msg->msg_namelen) 1539 msg->msg_namelen = 0; 1540 1541 return unix_dgram_sendmsg(kiocb, sock, msg, len); 1542 } 1543 1544 static void unix_copy_addr(struct msghdr *msg, struct sock *sk) 1545 { 1546 struct unix_sock *u = unix_sk(sk); 1547 1548 msg->msg_namelen = 0; 1549 if (u->addr) { 1550 msg->msg_namelen = u->addr->len; 1551 memcpy(msg->msg_name, u->addr->name, u->addr->len); 1552 } 1553 } 1554 1555 static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock, 1556 struct msghdr *msg, size_t size, 1557 int flags) 1558 { 1559 struct sock_iocb *siocb = kiocb_to_siocb(iocb); 1560 struct scm_cookie tmp_scm; 1561 struct sock *sk = sock->sk; 1562 struct unix_sock *u = unix_sk(sk); 1563 int noblock = flags & MSG_DONTWAIT; 1564 struct sk_buff *skb; 1565 int err; 1566 1567 err = -EOPNOTSUPP; 1568 if (flags&MSG_OOB) 1569 goto out; 1570 1571 msg->msg_namelen = 0; 1572 1573 mutex_lock(&u->readlock); 1574 1575 skb = skb_recv_datagram(sk, flags, noblock, &err); 1576 if (!skb) 1577 goto out_unlock; 1578 1579 wake_up_interruptible(&u->peer_wait); 1580 1581 if (msg->msg_name) 1582 unix_copy_addr(msg, skb->sk); 1583 1584 if (size > skb->len) 1585 size = skb->len; 1586 else if (size < skb->len) 1587 msg->msg_flags |= MSG_TRUNC; 1588 1589 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, size); 1590 if (err) 1591 goto out_free; 1592 1593 if (!siocb->scm) { 1594 siocb->scm = &tmp_scm; 1595 memset(&tmp_scm, 0, sizeof(tmp_scm)); 1596 } 1597 siocb->scm->creds = *UNIXCREDS(skb); 1598 unix_set_secdata(siocb->scm, skb); 1599 1600 if (!(flags & MSG_PEEK)) 1601 { 1602 if (UNIXCB(skb).fp) 1603 unix_detach_fds(siocb->scm, skb); 1604 } 1605 else 1606 { 1607 /* It is questionable: on PEEK we could: 1608 - do not return fds - good, but too simple 8) 1609 - return fds, and do not return them on read (old strategy, 1610 apparently wrong) 1611 - clone fds (I chose it for now, it is the most universal 1612 solution) 1613 1614 POSIX 1003.1g does not actually define this clearly 1615 at all. POSIX 1003.1g doesn't define a lot of things 1616 clearly however! 1617 1618 */ 1619 if (UNIXCB(skb).fp) 1620 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp); 1621 } 1622 err = size; 1623 1624 scm_recv(sock, msg, siocb->scm, flags); 1625 1626 out_free: 1627 skb_free_datagram(sk,skb); 1628 out_unlock: 1629 mutex_unlock(&u->readlock); 1630 out: 1631 return err; 1632 } 1633 1634 /* 1635 * Sleep until data has arrive. But check for races.. 1636 */ 1637 1638 static long unix_stream_data_wait(struct sock * sk, long timeo) 1639 { 1640 DEFINE_WAIT(wait); 1641 1642 unix_state_rlock(sk); 1643 1644 for (;;) { 1645 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE); 1646 1647 if (!skb_queue_empty(&sk->sk_receive_queue) || 1648 sk->sk_err || 1649 (sk->sk_shutdown & RCV_SHUTDOWN) || 1650 signal_pending(current) || 1651 !timeo) 1652 break; 1653 1654 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); 1655 unix_state_runlock(sk); 1656 timeo = schedule_timeout(timeo); 1657 unix_state_rlock(sk); 1658 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); 1659 } 1660 1661 finish_wait(sk->sk_sleep, &wait); 1662 unix_state_runlock(sk); 1663 return timeo; 1664 } 1665 1666 1667 1668 static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, 1669 struct msghdr *msg, size_t size, 1670 int flags) 1671 { 1672 struct sock_iocb *siocb = kiocb_to_siocb(iocb); 1673 struct scm_cookie tmp_scm; 1674 struct sock *sk = sock->sk; 1675 struct unix_sock *u = unix_sk(sk); 1676 struct sockaddr_un *sunaddr=msg->msg_name; 1677 int copied = 0; 1678 int check_creds = 0; 1679 int target; 1680 int err = 0; 1681 long timeo; 1682 1683 err = -EINVAL; 1684 if (sk->sk_state != TCP_ESTABLISHED) 1685 goto out; 1686 1687 err = -EOPNOTSUPP; 1688 if (flags&MSG_OOB) 1689 goto out; 1690 1691 target = sock_rcvlowat(sk, flags&MSG_WAITALL, size); 1692 timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT); 1693 1694 msg->msg_namelen = 0; 1695 1696 /* Lock the socket to prevent queue disordering 1697 * while sleeps in memcpy_tomsg 1698 */ 1699 1700 if (!siocb->scm) { 1701 siocb->scm = &tmp_scm; 1702 memset(&tmp_scm, 0, sizeof(tmp_scm)); 1703 } 1704 1705 mutex_lock(&u->readlock); 1706 1707 do 1708 { 1709 int chunk; 1710 struct sk_buff *skb; 1711 1712 skb = skb_dequeue(&sk->sk_receive_queue); 1713 if (skb==NULL) 1714 { 1715 if (copied >= target) 1716 break; 1717 1718 /* 1719 * POSIX 1003.1g mandates this order. 1720 */ 1721 1722 if ((err = sock_error(sk)) != 0) 1723 break; 1724 if (sk->sk_shutdown & RCV_SHUTDOWN) 1725 break; 1726 err = -EAGAIN; 1727 if (!timeo) 1728 break; 1729 mutex_unlock(&u->readlock); 1730 1731 timeo = unix_stream_data_wait(sk, timeo); 1732 1733 if (signal_pending(current)) { 1734 err = sock_intr_errno(timeo); 1735 goto out; 1736 } 1737 mutex_lock(&u->readlock); 1738 continue; 1739 } 1740 1741 if (check_creds) { 1742 /* Never glue messages from different writers */ 1743 if (memcmp(UNIXCREDS(skb), &siocb->scm->creds, sizeof(siocb->scm->creds)) != 0) { 1744 skb_queue_head(&sk->sk_receive_queue, skb); 1745 break; 1746 } 1747 } else { 1748 /* Copy credentials */ 1749 siocb->scm->creds = *UNIXCREDS(skb); 1750 check_creds = 1; 1751 } 1752 1753 /* Copy address just once */ 1754 if (sunaddr) 1755 { 1756 unix_copy_addr(msg, skb->sk); 1757 sunaddr = NULL; 1758 } 1759 1760 chunk = min_t(unsigned int, skb->len, size); 1761 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) { 1762 skb_queue_head(&sk->sk_receive_queue, skb); 1763 if (copied == 0) 1764 copied = -EFAULT; 1765 break; 1766 } 1767 copied += chunk; 1768 size -= chunk; 1769 1770 /* Mark read part of skb as used */ 1771 if (!(flags & MSG_PEEK)) 1772 { 1773 skb_pull(skb, chunk); 1774 1775 if (UNIXCB(skb).fp) 1776 unix_detach_fds(siocb->scm, skb); 1777 1778 /* put the skb back if we didn't use it up.. */ 1779 if (skb->len) 1780 { 1781 skb_queue_head(&sk->sk_receive_queue, skb); 1782 break; 1783 } 1784 1785 kfree_skb(skb); 1786 1787 if (siocb->scm->fp) 1788 break; 1789 } 1790 else 1791 { 1792 /* It is questionable, see note in unix_dgram_recvmsg. 1793 */ 1794 if (UNIXCB(skb).fp) 1795 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp); 1796 1797 /* put message back and return */ 1798 skb_queue_head(&sk->sk_receive_queue, skb); 1799 break; 1800 } 1801 } while (size); 1802 1803 mutex_unlock(&u->readlock); 1804 scm_recv(sock, msg, siocb->scm, flags); 1805 out: 1806 return copied ? : err; 1807 } 1808 1809 static int unix_shutdown(struct socket *sock, int mode) 1810 { 1811 struct sock *sk = sock->sk; 1812 struct sock *other; 1813 1814 mode = (mode+1)&(RCV_SHUTDOWN|SEND_SHUTDOWN); 1815 1816 if (mode) { 1817 unix_state_wlock(sk); 1818 sk->sk_shutdown |= mode; 1819 other=unix_peer(sk); 1820 if (other) 1821 sock_hold(other); 1822 unix_state_wunlock(sk); 1823 sk->sk_state_change(sk); 1824 1825 if (other && 1826 (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) { 1827 1828 int peer_mode = 0; 1829 1830 if (mode&RCV_SHUTDOWN) 1831 peer_mode |= SEND_SHUTDOWN; 1832 if (mode&SEND_SHUTDOWN) 1833 peer_mode |= RCV_SHUTDOWN; 1834 unix_state_wlock(other); 1835 other->sk_shutdown |= peer_mode; 1836 unix_state_wunlock(other); 1837 other->sk_state_change(other); 1838 read_lock(&other->sk_callback_lock); 1839 if (peer_mode == SHUTDOWN_MASK) 1840 sk_wake_async(other,1,POLL_HUP); 1841 else if (peer_mode & RCV_SHUTDOWN) 1842 sk_wake_async(other,1,POLL_IN); 1843 read_unlock(&other->sk_callback_lock); 1844 } 1845 if (other) 1846 sock_put(other); 1847 } 1848 return 0; 1849 } 1850 1851 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 1852 { 1853 struct sock *sk = sock->sk; 1854 long amount=0; 1855 int err; 1856 1857 switch(cmd) 1858 { 1859 case SIOCOUTQ: 1860 amount = atomic_read(&sk->sk_wmem_alloc); 1861 err = put_user(amount, (int __user *)arg); 1862 break; 1863 case SIOCINQ: 1864 { 1865 struct sk_buff *skb; 1866 1867 if (sk->sk_state == TCP_LISTEN) { 1868 err = -EINVAL; 1869 break; 1870 } 1871 1872 spin_lock(&sk->sk_receive_queue.lock); 1873 if (sk->sk_type == SOCK_STREAM || 1874 sk->sk_type == SOCK_SEQPACKET) { 1875 skb_queue_walk(&sk->sk_receive_queue, skb) 1876 amount += skb->len; 1877 } else { 1878 skb = skb_peek(&sk->sk_receive_queue); 1879 if (skb) 1880 amount=skb->len; 1881 } 1882 spin_unlock(&sk->sk_receive_queue.lock); 1883 err = put_user(amount, (int __user *)arg); 1884 break; 1885 } 1886 1887 default: 1888 err = -ENOIOCTLCMD; 1889 break; 1890 } 1891 return err; 1892 } 1893 1894 static unsigned int unix_poll(struct file * file, struct socket *sock, poll_table *wait) 1895 { 1896 struct sock *sk = sock->sk; 1897 unsigned int mask; 1898 1899 poll_wait(file, sk->sk_sleep, wait); 1900 mask = 0; 1901 1902 /* exceptional events? */ 1903 if (sk->sk_err) 1904 mask |= POLLERR; 1905 if (sk->sk_shutdown == SHUTDOWN_MASK) 1906 mask |= POLLHUP; 1907 if (sk->sk_shutdown & RCV_SHUTDOWN) 1908 mask |= POLLRDHUP; 1909 1910 /* readable? */ 1911 if (!skb_queue_empty(&sk->sk_receive_queue) || 1912 (sk->sk_shutdown & RCV_SHUTDOWN)) 1913 mask |= POLLIN | POLLRDNORM; 1914 1915 /* Connection-based need to check for termination and startup */ 1916 if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) && sk->sk_state == TCP_CLOSE) 1917 mask |= POLLHUP; 1918 1919 /* 1920 * we set writable also when the other side has shut down the 1921 * connection. This prevents stuck sockets. 1922 */ 1923 if (unix_writable(sk)) 1924 mask |= POLLOUT | POLLWRNORM | POLLWRBAND; 1925 1926 return mask; 1927 } 1928 1929 1930 #ifdef CONFIG_PROC_FS 1931 static struct sock *unix_seq_idx(int *iter, loff_t pos) 1932 { 1933 loff_t off = 0; 1934 struct sock *s; 1935 1936 for (s = first_unix_socket(iter); s; s = next_unix_socket(iter, s)) { 1937 if (off == pos) 1938 return s; 1939 ++off; 1940 } 1941 return NULL; 1942 } 1943 1944 1945 static void *unix_seq_start(struct seq_file *seq, loff_t *pos) 1946 { 1947 spin_lock(&unix_table_lock); 1948 return *pos ? unix_seq_idx(seq->private, *pos - 1) : ((void *) 1); 1949 } 1950 1951 static void *unix_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1952 { 1953 ++*pos; 1954 1955 if (v == (void *)1) 1956 return first_unix_socket(seq->private); 1957 return next_unix_socket(seq->private, v); 1958 } 1959 1960 static void unix_seq_stop(struct seq_file *seq, void *v) 1961 { 1962 spin_unlock(&unix_table_lock); 1963 } 1964 1965 static int unix_seq_show(struct seq_file *seq, void *v) 1966 { 1967 1968 if (v == (void *)1) 1969 seq_puts(seq, "Num RefCount Protocol Flags Type St " 1970 "Inode Path\n"); 1971 else { 1972 struct sock *s = v; 1973 struct unix_sock *u = unix_sk(s); 1974 unix_state_rlock(s); 1975 1976 seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu", 1977 s, 1978 atomic_read(&s->sk_refcnt), 1979 0, 1980 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0, 1981 s->sk_type, 1982 s->sk_socket ? 1983 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) : 1984 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING), 1985 sock_i_ino(s)); 1986 1987 if (u->addr) { 1988 int i, len; 1989 seq_putc(seq, ' '); 1990 1991 i = 0; 1992 len = u->addr->len - sizeof(short); 1993 if (!UNIX_ABSTRACT(s)) 1994 len--; 1995 else { 1996 seq_putc(seq, '@'); 1997 i++; 1998 } 1999 for ( ; i < len; i++) 2000 seq_putc(seq, u->addr->name->sun_path[i]); 2001 } 2002 unix_state_runlock(s); 2003 seq_putc(seq, '\n'); 2004 } 2005 2006 return 0; 2007 } 2008 2009 static struct seq_operations unix_seq_ops = { 2010 .start = unix_seq_start, 2011 .next = unix_seq_next, 2012 .stop = unix_seq_stop, 2013 .show = unix_seq_show, 2014 }; 2015 2016 2017 static int unix_seq_open(struct inode *inode, struct file *file) 2018 { 2019 struct seq_file *seq; 2020 int rc = -ENOMEM; 2021 int *iter = kmalloc(sizeof(int), GFP_KERNEL); 2022 2023 if (!iter) 2024 goto out; 2025 2026 rc = seq_open(file, &unix_seq_ops); 2027 if (rc) 2028 goto out_kfree; 2029 2030 seq = file->private_data; 2031 seq->private = iter; 2032 *iter = 0; 2033 out: 2034 return rc; 2035 out_kfree: 2036 kfree(iter); 2037 goto out; 2038 } 2039 2040 static struct file_operations unix_seq_fops = { 2041 .owner = THIS_MODULE, 2042 .open = unix_seq_open, 2043 .read = seq_read, 2044 .llseek = seq_lseek, 2045 .release = seq_release_private, 2046 }; 2047 2048 #endif 2049 2050 static struct net_proto_family unix_family_ops = { 2051 .family = PF_UNIX, 2052 .create = unix_create, 2053 .owner = THIS_MODULE, 2054 }; 2055 2056 static int __init af_unix_init(void) 2057 { 2058 int rc = -1; 2059 struct sk_buff *dummy_skb; 2060 2061 if (sizeof(struct unix_skb_parms) > sizeof(dummy_skb->cb)) { 2062 printk(KERN_CRIT "%s: panic\n", __FUNCTION__); 2063 goto out; 2064 } 2065 2066 rc = proto_register(&unix_proto, 1); 2067 if (rc != 0) { 2068 printk(KERN_CRIT "%s: Cannot create unix_sock SLAB cache!\n", 2069 __FUNCTION__); 2070 goto out; 2071 } 2072 2073 sock_register(&unix_family_ops); 2074 #ifdef CONFIG_PROC_FS 2075 proc_net_fops_create("unix", 0, &unix_seq_fops); 2076 #endif 2077 unix_sysctl_register(); 2078 out: 2079 return rc; 2080 } 2081 2082 static void __exit af_unix_exit(void) 2083 { 2084 sock_unregister(PF_UNIX); 2085 unix_sysctl_unregister(); 2086 proc_net_remove("unix"); 2087 proto_unregister(&unix_proto); 2088 } 2089 2090 module_init(af_unix_init); 2091 module_exit(af_unix_exit); 2092 2093 MODULE_LICENSE("GPL"); 2094 MODULE_ALIAS_NETPROTO(PF_UNIX); 2095