uipc_usrreq.c revision 167097
11541Srgrimes/*- 21541Srgrimes * Copyright (c) 1982, 1986, 1989, 1991, 1993 31541Srgrimes * The Regents of the University of California. 41541Srgrimes * Copyright (c) 2004-2007 Robert N. M. Watson 51541Srgrimes * All rights reserved. 61541Srgrimes * 71541Srgrimes * Redistribution and use in source and binary forms, with or without 81541Srgrimes * modification, are permitted provided that the following conditions 91541Srgrimes * are met: 101541Srgrimes * 1. Redistributions of source code must retain the above copyright 111541Srgrimes * notice, this list of conditions and the following disclaimer. 121541Srgrimes * 2. Redistributions in binary form must reproduce the above copyright 131541Srgrimes * notice, this list of conditions and the following disclaimer in the 141541Srgrimes * documentation and/or other materials provided with the distribution. 151541Srgrimes * 4. Neither the name of the University nor the names of its contributors 161541Srgrimes * may be used to endorse or promote products derived from this software 171541Srgrimes * without specific prior written permission. 181541Srgrimes * 191541Srgrimes * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 201541Srgrimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 211541Srgrimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 221541Srgrimes * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 231541Srgrimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 241541Srgrimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 251541Srgrimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 261541Srgrimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 271541Srgrimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 281541Srgrimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 291541Srgrimes * SUCH DAMAGE. 30116189Sobrien * 31116189Sobrien * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 32116189Sobrien */ 33102281Sjhb 341541Srgrimes/* 351541Srgrimes * UNIX Domain (Local) Sockets 36124479Sdes * 371541Srgrimes * This is an implementation of UNIX (local) domain sockets. Each socket has 381541Srgrimes * an associated struct unpcb (UNIX protocol control block). Stream sockets 39124479Sdes * may be connected to 0 or 1 other socket. Datagram sockets may be 401541Srgrimes * connected to 0, 1, or many other sockets. Sockets may be created and 41124479Sdes * connected in pairs (socketpair(2)), or bound/connected to using the file 421541Srgrimes * system name space. For most purposes, only the receive socket buffer is 431541Srgrimes * used, as sending on one socket delivers directly to the receive socket 44124479Sdes * buffer of a second socket. 451541Srgrimes * 46124514Sdes * The implementation is substantially complicated by the fact that 47124479Sdes * "ancillary data", such as file descriptors or credentials, may be passed 481541Srgrimes * across UNIX domain sockets. The potential for passing UNIX domain sockets 49 * over other UNIX domain sockets requires the implementation of a simple 50 * garbage collector to find and tear down cycles of disconnected sockets. 51 * 52 * TODO: 53 * SEQPACKET, RDM 54 * rethink name space problems 55 * need a proper out-of-band 56 * lock pushdown 57 */ 58 59#include <sys/cdefs.h> 60__FBSDID("$FreeBSD: head/sys/kern/uipc_usrreq.c 167097 2007-02-28 08:08:50Z rwatson $"); 61 62#include "opt_mac.h" 63 64#include <sys/param.h> 65#include <sys/domain.h> 66#include <sys/fcntl.h> 67#include <sys/malloc.h> /* XXX must be before <sys/file.h> */ 68#include <sys/eventhandler.h> 69#include <sys/file.h> 70#include <sys/filedesc.h> 71#include <sys/jail.h> 72#include <sys/kernel.h> 73#include <sys/lock.h> 74#include <sys/mbuf.h> 75#include <sys/mount.h> 76#include <sys/mutex.h> 77#include <sys/namei.h> 78#include <sys/proc.h> 79#include <sys/protosw.h> 80#include <sys/resourcevar.h> 81#include <sys/rwlock.h> 82#include <sys/socket.h> 83#include <sys/socketvar.h> 84#include <sys/signalvar.h> 85#include <sys/stat.h> 86#include <sys/sx.h> 87#include <sys/sysctl.h> 88#include <sys/systm.h> 89#include <sys/taskqueue.h> 90#include <sys/un.h> 91#include <sys/unpcb.h> 92#include <sys/vnode.h> 93 94#include <security/mac/mac_framework.h> 95 96#include <vm/uma.h> 97 98static uma_zone_t unp_zone; 99static unp_gen_t unp_gencnt; 100static u_int unp_count; /* Count of local sockets. */ 101static ino_t unp_ino; /* Prototype for fake inode numbers. */ 102static int unp_rights; /* File descriptors in flight. */ 103static struct unp_head unp_shead; /* List of local stream sockets. */ 104static struct unp_head unp_dhead; /* List of local datagram sockets. */ 105 106static const struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL }; 107 108/* 109 * Garbage collection of cyclic file descriptor/socket references occurs 110 * asynchronously in a taskqueue context in order to avoid recursion and 111 * reentrance in the UNIX domain socket, file descriptor, and socket layer 112 * code. See unp_gc() for a full description. 113 */ 114static struct task unp_gc_task; 115 116/* 117 * Both send and receive buffers are allocated PIPSIZ bytes of buffering for 118 * stream sockets, although the total for sender and receiver is actually 119 * only PIPSIZ. 120 * 121 * Datagram sockets really use the sendspace as the maximum datagram size, 122 * and don't really want to reserve the sendspace. Their recvspace should be 123 * large enough for at least one max-size datagram plus address. 124 */ 125#ifndef PIPSIZ 126#define PIPSIZ 8192 127#endif 128static u_long unpst_sendspace = PIPSIZ; 129static u_long unpst_recvspace = PIPSIZ; 130static u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 131static u_long unpdg_recvspace = 4*1024; 132 133SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW, 0, "Local domain"); 134SYSCTL_NODE(_net_local, SOCK_STREAM, stream, CTLFLAG_RW, 0, "SOCK_STREAM"); 135SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, CTLFLAG_RW, 0, "SOCK_DGRAM"); 136 137SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW, 138 &unpst_sendspace, 0, ""); 139SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW, 140 &unpst_recvspace, 0, ""); 141SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW, 142 &unpdg_sendspace, 0, ""); 143SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW, 144 &unpdg_recvspace, 0, ""); 145SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, ""); 146 147/*- 148 * Locking and synchronization: 149 * 150 * The global UNIX domain socket rwlock (unp_global_rwlock) protects all 151 * global variables, including the linked lists tracking the set of allocated 152 * UNIX domain sockets. The global rwlock also serves to prevent deadlock 153 * when more than one PCB lock is acquired at a time (i.e., during 154 * connect()). Finally, the global rwlock protects uncounted references from 155 * vnodes to sockets bound to those vnodes: to safely dereference the 156 * v_socket pointer, the global rwlock must be held while a full reference is 157 * acquired. 158 * 159 * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer, 160 * allocated in pru_attach() and freed in pru_detach(). The validity of that 161 * pointer is an invariant, so no lock is required to dereference the so_pcb 162 * pointer if a valid socket reference is held by the caller. In practice, 163 * this is always true during operations performed on a socket. Each unpcb 164 * has a back-pointer to its socket, unp_socket, which will be stable under 165 * the same circumstances. 166 * 167 * This pointer may only be safely dereferenced as long as a valid reference 168 * to the unpcb is held. Typically, this reference will be from the socket, 169 * or from another unpcb when the referring unpcb's lock is held (in order 170 * that the reference not be invalidated during use). For example, to follow 171 * unp->unp_conn->unp_socket, you need unlock the lock on unp, not unp_conn, 172 * as unp_socket remains valid as long as the reference to unp_conn is valid. 173 * 174 * Fields of unpcbss are locked using a per-unpcb lock, unp_mtx. Individual 175 * atomic reads without the lock may be performed "lockless", but more 176 * complex reads and read-modify-writes require the mutex to be held. No 177 * lock order is defined between unpcb locks -- multiple unpcb locks may be 178 * acquired at the same time only when holding the global UNIX domain socket 179 * rwlock exclusively, which prevents deadlocks. 180 * 181 * Blocking with UNIX domain sockets is a tricky issue: unlike most network 182 * protocols, bind() is a non-atomic operation, and connect() requires 183 * potential sleeping in the protocol, due to potentially waiting on local or 184 * distributed file systems. We try to separate "lookup" operations, which 185 * may sleep, and the IPC operations themselves, which typically can occur 186 * with relative atomicity as locks can be held over the entire operation. 187 * 188 * Another tricky issue is simultaneous multi-threaded or multi-process 189 * access to a single UNIX domain socket. These are handled by the flags 190 * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or 191 * binding, both of which involve dropping UNIX domain socket locks in order 192 * to perform namei() and other file system operations. 193 */ 194static struct rwlock unp_global_rwlock; 195 196#define UNP_GLOBAL_LOCK_INIT() rw_init(&unp_global_rwlock, \ 197 "unp_global_rwlock") 198 199#define UNP_GLOBAL_LOCK_ASSERT() rw_assert(&unp_global_rwlock, \ 200 RA_LOCKED) 201#define UNP_GLOBAL_UNLOCK_ASSERT() rw_assert(&unp_global_rwlock, \ 202 RA_UNLOCKED) 203 204#define UNP_GLOBAL_WLOCK() rw_wlock(&unp_global_rwlock) 205#define UNP_GLOBAL_WUNLOCK() rw_wunlock(&unp_global_rwlock) 206#define UNP_GLOBAL_WLOCK_ASSERT() rw_assert(&unp_global_rwlock, \ 207 RA_WLOCKED) 208#define UNP_GLOBAL_WOWNED() rw_wowned(&unp_global_rwlock) 209 210#define UNP_GLOBAL_RLOCK() rw_rlock(&unp_global_rwlock) 211#define UNP_GLOBAL_RUNLOCK() rw_runlock(&unp_global_rwlock) 212#define UNP_GLOBAL_RLOCK_ASSERT() rw_assert(&unp_global_rwlock, \ 213 RA_RLOCKED) 214 215#define UNP_PCB_LOCK_INIT(unp) mtx_init(&(unp)->unp_mtx, \ 216 "unp_mtx", "unp_mtx", \ 217 MTX_DUPOK|MTX_DEF|MTX_RECURSE) 218#define UNP_PCB_LOCK_DESTROY(unp) mtx_destroy(&(unp)->unp_mtx) 219#define UNP_PCB_LOCK(unp) mtx_lock(&(unp)->unp_mtx) 220#define UNP_PCB_UNLOCK(unp) mtx_unlock(&(unp)->unp_mtx) 221#define UNP_PCB_LOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_OWNED) 222 223static int unp_connect(struct socket *, struct sockaddr *, 224 struct thread *); 225static int unp_connect2(struct socket *so, struct socket *so2, int); 226static void unp_disconnect(struct unpcb *unp, struct unpcb *unp2); 227static void unp_shutdown(struct unpcb *); 228static void unp_drop(struct unpcb *, int); 229static void unp_gc(__unused void *, int); 230static void unp_scan(struct mbuf *, void (*)(struct file *)); 231static void unp_mark(struct file *); 232static void unp_discard(struct file *); 233static void unp_freerights(struct file **, int); 234static int unp_internalize(struct mbuf **, struct thread *); 235static struct mbuf *unp_addsockcred(struct thread *, struct mbuf *); 236 237/* 238 * Definitions of protocols supported in the LOCAL domain. 239 */ 240static struct domain localdomain; 241static struct protosw localsw[] = { 242{ 243 .pr_type = SOCK_STREAM, 244 .pr_domain = &localdomain, 245 .pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS, 246 .pr_ctloutput = &uipc_ctloutput, 247 .pr_usrreqs = &uipc_usrreqs 248}, 249{ 250 .pr_type = SOCK_DGRAM, 251 .pr_domain = &localdomain, 252 .pr_flags = PR_ATOMIC|PR_ADDR|PR_RIGHTS, 253 .pr_usrreqs = &uipc_usrreqs 254}, 255}; 256 257static struct domain localdomain = { 258 .dom_family = AF_LOCAL, 259 .dom_name = "local", 260 .dom_init = unp_init, 261 .dom_externalize = unp_externalize, 262 .dom_dispose = unp_dispose, 263 .dom_protosw = localsw, 264 .dom_protoswNPROTOSW = &localsw[sizeof(localsw)/sizeof(localsw[0])] 265}; 266DOMAIN_SET(local); 267 268static void 269uipc_abort(struct socket *so) 270{ 271 struct unpcb *unp, *unp2; 272 273 unp = sotounpcb(so); 274 KASSERT(unp != NULL, ("uipc_abort: unp == NULL")); 275 276 UNP_GLOBAL_WLOCK(); 277 UNP_PCB_LOCK(unp); 278 unp2 = unp->unp_conn; 279 if (unp2 != NULL) { 280 UNP_PCB_LOCK(unp2); 281 unp_drop(unp2, ECONNABORTED); 282 UNP_PCB_UNLOCK(unp2); 283 } 284 UNP_PCB_UNLOCK(unp); 285 UNP_GLOBAL_WUNLOCK(); 286} 287 288static int 289uipc_accept(struct socket *so, struct sockaddr **nam) 290{ 291 struct unpcb *unp, *unp2; 292 const struct sockaddr *sa; 293 294 /* 295 * Pass back name of connected socket, if it was bound and we are 296 * still connected (our peer may have closed already!). 297 */ 298 unp = sotounpcb(so); 299 KASSERT(unp != NULL, ("uipc_accept: unp == NULL")); 300 301 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 302 UNP_GLOBAL_RLOCK(); 303 unp2 = unp->unp_conn; 304 if (unp2 != NULL && unp2->unp_addr != NULL) { 305 UNP_PCB_LOCK(unp2); 306 sa = (struct sockaddr *) unp2->unp_addr; 307 bcopy(sa, *nam, sa->sa_len); 308 UNP_PCB_UNLOCK(unp2); 309 } else { 310 sa = &sun_noname; 311 bcopy(sa, *nam, sa->sa_len); 312 } 313 UNP_GLOBAL_RUNLOCK(); 314 return (0); 315} 316 317static int 318uipc_attach(struct socket *so, int proto, struct thread *td) 319{ 320 u_long sendspace, recvspace; 321 struct unpcb *unp; 322 int error, locked; 323 324 KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL")); 325 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 326 switch (so->so_type) { 327 case SOCK_STREAM: 328 sendspace = unpst_sendspace; 329 recvspace = unpst_recvspace; 330 break; 331 332 case SOCK_DGRAM: 333 sendspace = unpdg_sendspace; 334 recvspace = unpdg_recvspace; 335 break; 336 337 default: 338 panic("uipc_attach"); 339 } 340 error = soreserve(so, sendspace, recvspace); 341 if (error) 342 return (error); 343 } 344 unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO); 345 if (unp == NULL) 346 return (ENOBUFS); 347 LIST_INIT(&unp->unp_refs); 348 UNP_PCB_LOCK_INIT(unp); 349 unp->unp_socket = so; 350 so->so_pcb = unp; 351 unp->unp_refcount = 1; 352 locked = 0; 353 354 /* 355 * uipc_attach() may be called indirectly from within the UNIX domain 356 * socket code via sonewconn() in unp_connect(). Since rwlocks can 357 * not be recursed, we do the closest thing. 358 */ 359 if (!UNP_GLOBAL_WOWNED()) { 360 UNP_GLOBAL_WLOCK(); 361 locked = 1; 362 } 363 unp->unp_gencnt = ++unp_gencnt; 364 unp_count++; 365 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ? &unp_dhead : &unp_shead, 366 unp, unp_link); 367 if (locked) 368 UNP_GLOBAL_WUNLOCK(); 369 370 return (0); 371} 372 373static int 374uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 375{ 376 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 377 struct vattr vattr; 378 int error, namelen; 379 struct nameidata nd; 380 struct unpcb *unp; 381 struct vnode *vp; 382 struct mount *mp; 383 char *buf; 384 385 unp = sotounpcb(so); 386 KASSERT(unp != NULL, ("uipc_bind: unp == NULL")); 387 388 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 389 if (namelen <= 0) 390 return (EINVAL); 391 392 /* 393 * We don't allow simultaneous bind() calls on a single UNIX domain 394 * socket, so flag in-progress operations, and return an error if an 395 * operation is already in progress. 396 * 397 * Historically, we have not allowed a socket to be rebound, so this 398 * also returns an error. Not allowing re-binding certainly 399 * simplifies the implementation and avoids a great many possible 400 * failure modes. 401 */ 402 UNP_PCB_LOCK(unp); 403 if (unp->unp_vnode != NULL) { 404 UNP_PCB_UNLOCK(unp); 405 return (EINVAL); 406 } 407 if (unp->unp_flags & UNP_BINDING) { 408 UNP_PCB_UNLOCK(unp); 409 return (EALREADY); 410 } 411 unp->unp_flags |= UNP_BINDING; 412 UNP_PCB_UNLOCK(unp); 413 414 buf = malloc(namelen + 1, M_TEMP, M_WAITOK); 415 strlcpy(buf, soun->sun_path, namelen + 1); 416 417 mtx_lock(&Giant); 418restart: 419 mtx_assert(&Giant, MA_OWNED); 420 NDINIT(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME, UIO_SYSSPACE, 421 buf, td); 422/* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */ 423 error = namei(&nd); 424 if (error) 425 goto error; 426 vp = nd.ni_vp; 427 if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { 428 NDFREE(&nd, NDF_ONLY_PNBUF); 429 if (nd.ni_dvp == vp) 430 vrele(nd.ni_dvp); 431 else 432 vput(nd.ni_dvp); 433 if (vp != NULL) { 434 vrele(vp); 435 error = EADDRINUSE; 436 goto error; 437 } 438 error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH); 439 if (error) 440 goto error; 441 goto restart; 442 } 443 VATTR_NULL(&vattr); 444 vattr.va_type = VSOCK; 445 vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask); 446#ifdef MAC 447 error = mac_check_vnode_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd, 448 &vattr); 449#endif 450 if (error == 0) { 451 VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); 452 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); 453 } 454 NDFREE(&nd, NDF_ONLY_PNBUF); 455 vput(nd.ni_dvp); 456 if (error) { 457 vn_finished_write(mp); 458 goto error; 459 } 460 vp = nd.ni_vp; 461 ASSERT_VOP_LOCKED(vp, "uipc_bind"); 462 soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK); 463 464 UNP_GLOBAL_WLOCK(); 465 UNP_PCB_LOCK(unp); 466 vp->v_socket = unp->unp_socket; 467 unp->unp_vnode = vp; 468 unp->unp_addr = soun; 469 unp->unp_flags &= ~UNP_BINDING; 470 UNP_PCB_UNLOCK(unp); 471 UNP_GLOBAL_WUNLOCK(); 472 VOP_UNLOCK(vp, 0, td); 473 vn_finished_write(mp); 474 mtx_unlock(&Giant); 475 free(buf, M_TEMP); 476 return (0); 477 478error: 479 UNP_PCB_LOCK(unp); 480 unp->unp_flags &= ~UNP_BINDING; 481 UNP_PCB_UNLOCK(unp); 482 mtx_unlock(&Giant); 483 free(buf, M_TEMP); 484 return (error); 485} 486 487static int 488uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 489{ 490 int error; 491 492 KASSERT(td == curthread, ("uipc_connect: td != curthread")); 493 UNP_GLOBAL_WLOCK(); 494 error = unp_connect(so, nam, td); 495 UNP_GLOBAL_WUNLOCK(); 496 return (error); 497} 498 499static void 500uipc_close(struct socket *so) 501{ 502 struct unpcb *unp, *unp2; 503 504 unp = sotounpcb(so); 505 KASSERT(unp != NULL, ("uipc_close: unp == NULL")); 506 507 UNP_GLOBAL_WLOCK(); 508 UNP_PCB_LOCK(unp); 509 unp2 = unp->unp_conn; 510 if (unp2 != NULL) { 511 UNP_PCB_LOCK(unp2); 512 unp_disconnect(unp, unp2); 513 UNP_PCB_UNLOCK(unp2); 514 } 515 UNP_PCB_UNLOCK(unp); 516 UNP_GLOBAL_WUNLOCK(); 517} 518 519int 520uipc_connect2(struct socket *so1, struct socket *so2) 521{ 522 struct unpcb *unp, *unp2; 523 int error; 524 525 UNP_GLOBAL_WLOCK(); 526 unp = so1->so_pcb; 527 KASSERT(unp != NULL, ("uipc_connect2: unp == NULL")); 528 UNP_PCB_LOCK(unp); 529 unp2 = so2->so_pcb; 530 KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL")); 531 UNP_PCB_LOCK(unp2); 532 error = unp_connect2(so1, so2, PRU_CONNECT2); 533 UNP_PCB_UNLOCK(unp2); 534 UNP_PCB_UNLOCK(unp); 535 UNP_GLOBAL_WUNLOCK(); 536 return (error); 537} 538 539/* control is EOPNOTSUPP */ 540 541static void 542uipc_detach(struct socket *so) 543{ 544 struct unpcb *unp, *unp2; 545 struct sockaddr_un *saved_unp_addr; 546 struct vnode *vp; 547 int freeunp, local_unp_rights; 548 549 unp = sotounpcb(so); 550 KASSERT(unp != NULL, ("uipc_detach: unp == NULL")); 551 552 UNP_GLOBAL_WLOCK(); 553 UNP_PCB_LOCK(unp); 554 555 LIST_REMOVE(unp, unp_link); 556 unp->unp_gencnt = ++unp_gencnt; 557 --unp_count; 558 559 /* 560 * XXXRW: Should assert vp->v_socket == so. 561 */ 562 if ((vp = unp->unp_vnode) != NULL) { 563 unp->unp_vnode->v_socket = NULL; 564 unp->unp_vnode = NULL; 565 } 566 unp2 = unp->unp_conn; 567 if (unp2 != NULL) { 568 UNP_PCB_LOCK(unp2); 569 unp_disconnect(unp, unp2); 570 UNP_PCB_UNLOCK(unp2); 571 } 572 573 /* 574 * We hold the global lock, so it's OK to acquire multiple pcb locks 575 * at a time. 576 */ 577 while (!LIST_EMPTY(&unp->unp_refs)) { 578 struct unpcb *ref = LIST_FIRST(&unp->unp_refs); 579 580 UNP_PCB_LOCK(ref); 581 unp_drop(ref, ECONNRESET); 582 UNP_PCB_UNLOCK(ref); 583 } 584 UNP_GLOBAL_WUNLOCK(); 585 unp->unp_socket->so_pcb = NULL; 586 local_unp_rights = unp_rights; 587 saved_unp_addr = unp->unp_addr; 588 unp->unp_addr = NULL; 589 unp->unp_refcount--; 590 freeunp = (unp->unp_refcount == 0); 591 if (saved_unp_addr != NULL) 592 FREE(saved_unp_addr, M_SONAME); 593 if (freeunp) { 594 UNP_PCB_LOCK_DESTROY(unp); 595 uma_zfree(unp_zone, unp); 596 } 597 if (vp) { 598 int vfslocked; 599 600 vfslocked = VFS_LOCK_GIANT(vp->v_mount); 601 vrele(vp); 602 VFS_UNLOCK_GIANT(vfslocked); 603 } 604 if (local_unp_rights) 605 taskqueue_enqueue(taskqueue_thread, &unp_gc_task); 606} 607 608static int 609uipc_disconnect(struct socket *so) 610{ 611 struct unpcb *unp, *unp2; 612 613 unp = sotounpcb(so); 614 KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL")); 615 616 UNP_GLOBAL_WLOCK(); 617 UNP_PCB_LOCK(unp); 618 unp2 = unp->unp_conn; 619 if (unp2 != NULL) { 620 UNP_PCB_LOCK(unp2); 621 unp_disconnect(unp, unp2); 622 UNP_PCB_UNLOCK(unp2); 623 } 624 UNP_PCB_UNLOCK(unp); 625 UNP_GLOBAL_WUNLOCK(); 626 return (0); 627} 628 629static int 630uipc_listen(struct socket *so, int backlog, struct thread *td) 631{ 632 struct unpcb *unp; 633 int error; 634 635 unp = sotounpcb(so); 636 KASSERT(unp != NULL, ("uipc_listen: unp == NULL")); 637 638 UNP_PCB_LOCK(unp); 639 if (unp->unp_vnode == NULL) { 640 UNP_PCB_UNLOCK(unp); 641 return (EINVAL); 642 } 643 644 SOCK_LOCK(so); 645 error = solisten_proto_check(so); 646 if (error == 0) { 647 cru2x(td->td_ucred, &unp->unp_peercred); 648 unp->unp_flags |= UNP_HAVEPCCACHED; 649 solisten_proto(so, backlog); 650 } 651 SOCK_UNLOCK(so); 652 UNP_PCB_UNLOCK(unp); 653 return (error); 654} 655 656static int 657uipc_peeraddr(struct socket *so, struct sockaddr **nam) 658{ 659 struct unpcb *unp, *unp2; 660 const struct sockaddr *sa; 661 662 unp = sotounpcb(so); 663 KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL")); 664 665 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 666 UNP_PCB_LOCK(unp); 667 /* 668 * XXX: It seems that this test always fails even when connection is 669 * established. So, this else clause is added as workaround to 670 * return PF_LOCAL sockaddr. 671 */ 672 unp2 = unp->unp_conn; 673 if (unp2 != NULL) { 674 UNP_PCB_LOCK(unp2); 675 if (unp2->unp_addr != NULL) 676 sa = (struct sockaddr *) unp->unp_conn->unp_addr; 677 else 678 sa = &sun_noname; 679 bcopy(sa, *nam, sa->sa_len); 680 UNP_PCB_UNLOCK(unp2); 681 } else { 682 sa = &sun_noname; 683 bcopy(sa, *nam, sa->sa_len); 684 } 685 UNP_PCB_UNLOCK(unp); 686 return (0); 687} 688 689static int 690uipc_rcvd(struct socket *so, int flags) 691{ 692 struct unpcb *unp, *unp2; 693 struct socket *so2; 694 u_int mbcnt, sbcc; 695 u_long newhiwat; 696 697 unp = sotounpcb(so); 698 KASSERT(unp != NULL, ("uipc_rcvd: unp == NULL")); 699 700 if (so->so_type == SOCK_DGRAM) 701 panic("uipc_rcvd DGRAM?"); 702 703 if (so->so_type != SOCK_STREAM) 704 panic("uipc_rcvd unknown socktype"); 705 706 /* 707 * Adjust backpressure on sender and wakeup any waiting to write. 708 * 709 * The consistency requirements here are a bit complex: we must 710 * acquire the lock for our own unpcb in order to prevent it from 711 * disconnecting while in use, changing the unp_conn peer. We do not 712 * need unp2's lock, since the unp2->unp_socket pointer will remain 713 * static as long as the unp2 pcb is valid, which it will be until we 714 * release unp's lock to allow a disconnect. We do need socket 715 * mutexes for both socket endpoints since we manipulate fields in 716 * both; we hold both locks at once since we access both 717 * simultaneously. 718 */ 719 SOCKBUF_LOCK(&so->so_rcv); 720 mbcnt = so->so_rcv.sb_mbcnt; 721 sbcc = so->so_rcv.sb_cc; 722 SOCKBUF_UNLOCK(&so->so_rcv); 723 UNP_PCB_LOCK(unp); 724 unp2 = unp->unp_conn; 725 if (unp2 == NULL) { 726 UNP_PCB_UNLOCK(unp); 727 return (0); 728 } 729 so2 = unp2->unp_socket; 730 SOCKBUF_LOCK(&so2->so_snd); 731 so2->so_snd.sb_mbmax += unp->unp_mbcnt - mbcnt; 732 newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc - sbcc; 733 (void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat, 734 newhiwat, RLIM_INFINITY); 735 sowwakeup_locked(so2); 736 unp->unp_mbcnt = mbcnt; 737 unp->unp_cc = sbcc; 738 UNP_PCB_UNLOCK(unp); 739 return (0); 740} 741 742/* pru_rcvoob is EOPNOTSUPP */ 743 744static int 745uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, 746 struct mbuf *control, struct thread *td) 747{ 748 struct unpcb *unp, *unp2; 749 struct socket *so2; 750 u_int mbcnt, sbcc; 751 u_long newhiwat; 752 int error = 0; 753 754 unp = sotounpcb(so); 755 KASSERT(unp != NULL, ("uipc_send: unp == NULL")); 756 757 if (flags & PRUS_OOB) { 758 error = EOPNOTSUPP; 759 goto release; 760 } 761 762 if (control != NULL && (error = unp_internalize(&control, td))) 763 goto release; 764 765 if ((nam != NULL) || (flags & PRUS_EOF)) 766 UNP_GLOBAL_WLOCK(); 767 else 768 UNP_GLOBAL_RLOCK(); 769 770 switch (so->so_type) { 771 case SOCK_DGRAM: 772 { 773 const struct sockaddr *from; 774 775 unp2 = unp->unp_conn; 776 if (nam != NULL) { 777 if (unp2 != NULL) { 778 error = EISCONN; 779 UNP_PCB_LOCK(unp); 780 break; 781 } 782 error = unp_connect(so, nam, td); 783 UNP_PCB_LOCK(unp); 784 if (error) 785 break; 786 unp2 = unp->unp_conn; 787 } else { 788 UNP_PCB_LOCK(unp); 789 if (unp2 == NULL) { 790 error = ENOTCONN; 791 UNP_PCB_LOCK(unp); 792 break; 793 } 794 } 795 /* 796 * Because connect() and send() are non-atomic in a sendto() 797 * with a target address, it's possible that the socket will 798 * have disconnected before the send() can run. In that case 799 * return the slightly counter-intuitive but otherwise 800 * correct error that the socket is not connected. 801 */ 802 UNP_PCB_LOCK_ASSERT(unp); 803 if (unp2 == NULL) { 804 error = ENOTCONN; 805 break; 806 } 807 UNP_PCB_LOCK(unp2); 808 so2 = unp2->unp_socket; 809 if (unp->unp_addr != NULL) 810 from = (struct sockaddr *)unp->unp_addr; 811 else 812 from = &sun_noname; 813 if (unp2->unp_flags & UNP_WANTCRED) 814 control = unp_addsockcred(td, control); 815 SOCKBUF_LOCK(&so2->so_rcv); 816 if (sbappendaddr_locked(&so2->so_rcv, from, m, control)) { 817 sorwakeup_locked(so2); 818 m = NULL; 819 control = NULL; 820 } else { 821 SOCKBUF_UNLOCK(&so2->so_rcv); 822 error = ENOBUFS; 823 } 824 if (nam != NULL) 825 unp_disconnect(unp, unp2); 826 UNP_PCB_UNLOCK(unp2); 827 break; 828 } 829 830 case SOCK_STREAM: 831 /* 832 * Connect if not connected yet. 833 * 834 * Note: A better implementation would complain if not equal 835 * to the peer's address. 836 */ 837 if ((so->so_state & SS_ISCONNECTED) == 0) { 838 if (nam != NULL) { 839 error = unp_connect(so, nam, td); 840 UNP_PCB_LOCK(unp); 841 if (error) 842 break; /* XXX */ 843 } else { 844 error = ENOTCONN; 845 UNP_PCB_LOCK(unp); 846 break; 847 } 848 } else 849 UNP_PCB_LOCK(unp); 850 UNP_PCB_LOCK_ASSERT(unp); 851 852 /* Lockless read. */ 853 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 854 error = EPIPE; 855 break; 856 } 857 /* 858 * Because connect() and send() are non-atomic in a sendto() 859 * with a target address, it's possible that the socket will 860 * have disconnected before the send() can run. In that case 861 * return the slightly counter-intuitive but otherwise 862 * correct error that the socket is not connected. 863 * 864 * Lock order here has to be handled carefully: we hold the 865 * global lock, so acquiring two unpcb locks is OK. We must 866 * acquire both before acquiring any socket mutexes. We must 867 * also acquire the local socket send mutex before the remote 868 * socket receive mutex. The only tricky thing is making 869 * sure to acquire the unp2 lock before the local socket send 870 * lock, or we will experience deadlocks. 871 */ 872 unp2 = unp->unp_conn; 873 if (unp2 == NULL) { 874 error = ENOTCONN; 875 break; 876 } 877 UNP_PCB_LOCK(unp2); 878 so2 = unp2->unp_socket; 879 SOCKBUF_LOCK(&so2->so_rcv); 880 if (unp2->unp_flags & UNP_WANTCRED) { 881 /* 882 * Credentials are passed only once on 883 * SOCK_STREAM. 884 */ 885 unp2->unp_flags &= ~UNP_WANTCRED; 886 control = unp_addsockcred(td, control); 887 } 888 /* 889 * Send to paired receive port, and then reduce send buffer 890 * hiwater marks to maintain backpressure. Wake up readers. 891 */ 892 if (control != NULL) { 893 if (sbappendcontrol_locked(&so2->so_rcv, m, control)) 894 control = NULL; 895 } else 896 sbappend_locked(&so2->so_rcv, m); 897 mbcnt = so2->so_rcv.sb_mbcnt - unp2->unp_mbcnt; 898 unp2->unp_mbcnt = so2->so_rcv.sb_mbcnt; 899 sbcc = so2->so_rcv.sb_cc; 900 sorwakeup_locked(so2); 901 902 SOCKBUF_LOCK(&so->so_snd); 903 newhiwat = so->so_snd.sb_hiwat - (sbcc - unp2->unp_cc); 904 (void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat, 905 newhiwat, RLIM_INFINITY); 906 so->so_snd.sb_mbmax -= mbcnt; 907 SOCKBUF_UNLOCK(&so->so_snd); 908 unp2->unp_cc = sbcc; 909 UNP_PCB_UNLOCK(unp2); 910 m = NULL; 911 break; 912 913 default: 914 panic("uipc_send unknown socktype"); 915 } 916 917 /* 918 * SEND_EOF is equivalent to a SEND followed by 919 * a SHUTDOWN. 920 */ 921 if (flags & PRUS_EOF) { 922 socantsendmore(so); 923 unp_shutdown(unp); 924 } 925 UNP_PCB_UNLOCK(unp); 926 927 if ((nam != NULL) || (flags & PRUS_EOF)) 928 UNP_GLOBAL_WUNLOCK(); 929 else 930 UNP_GLOBAL_RUNLOCK(); 931 932 if (control != NULL && error != 0) 933 unp_dispose(control); 934 935release: 936 if (control != NULL) 937 m_freem(control); 938 if (m != NULL) 939 m_freem(m); 940 return (error); 941} 942 943static int 944uipc_sense(struct socket *so, struct stat *sb) 945{ 946 struct unpcb *unp, *unp2; 947 struct socket *so2; 948 949 unp = sotounpcb(so); 950 KASSERT(unp != NULL, ("uipc_sense: unp == NULL")); 951 952 sb->st_blksize = so->so_snd.sb_hiwat; 953 UNP_GLOBAL_RLOCK(); 954 UNP_PCB_LOCK(unp); 955 unp2 = unp->unp_conn; 956 if (so->so_type == SOCK_STREAM && unp2 != NULL) { 957 so2 = unp2->unp_socket; 958 sb->st_blksize += so2->so_rcv.sb_cc; 959 } 960 sb->st_dev = NODEV; 961 if (unp->unp_ino == 0) 962 unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino; 963 sb->st_ino = unp->unp_ino; 964 UNP_PCB_UNLOCK(unp); 965 UNP_GLOBAL_RUNLOCK(); 966 return (0); 967} 968 969static int 970uipc_shutdown(struct socket *so) 971{ 972 struct unpcb *unp; 973 974 unp = sotounpcb(so); 975 KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL")); 976 977 UNP_GLOBAL_WLOCK(); 978 UNP_PCB_LOCK(unp); 979 socantsendmore(so); 980 unp_shutdown(unp); 981 UNP_PCB_UNLOCK(unp); 982 UNP_GLOBAL_WUNLOCK(); 983 return (0); 984} 985 986static int 987uipc_sockaddr(struct socket *so, struct sockaddr **nam) 988{ 989 struct unpcb *unp; 990 const struct sockaddr *sa; 991 992 unp = sotounpcb(so); 993 KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL")); 994 995 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 996 UNP_PCB_LOCK(unp); 997 if (unp->unp_addr != NULL) 998 sa = (struct sockaddr *) unp->unp_addr; 999 else 1000 sa = &sun_noname; 1001 bcopy(sa, *nam, sa->sa_len); 1002 UNP_PCB_UNLOCK(unp); 1003 return (0); 1004} 1005 1006struct pr_usrreqs uipc_usrreqs = { 1007 .pru_abort = uipc_abort, 1008 .pru_accept = uipc_accept, 1009 .pru_attach = uipc_attach, 1010 .pru_bind = uipc_bind, 1011 .pru_connect = uipc_connect, 1012 .pru_connect2 = uipc_connect2, 1013 .pru_detach = uipc_detach, 1014 .pru_disconnect = uipc_disconnect, 1015 .pru_listen = uipc_listen, 1016 .pru_peeraddr = uipc_peeraddr, 1017 .pru_rcvd = uipc_rcvd, 1018 .pru_send = uipc_send, 1019 .pru_sense = uipc_sense, 1020 .pru_shutdown = uipc_shutdown, 1021 .pru_sockaddr = uipc_sockaddr, 1022 .pru_close = uipc_close, 1023}; 1024 1025int 1026uipc_ctloutput(struct socket *so, struct sockopt *sopt) 1027{ 1028 struct unpcb *unp; 1029 struct xucred xu; 1030 int error, optval; 1031 1032 if (sopt->sopt_level != 0) 1033 return (EINVAL); 1034 1035 unp = sotounpcb(so); 1036 KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL")); 1037 error = 0; 1038 switch (sopt->sopt_dir) { 1039 case SOPT_GET: 1040 switch (sopt->sopt_name) { 1041 case LOCAL_PEERCRED: 1042 UNP_PCB_LOCK(unp); 1043 if (unp->unp_flags & UNP_HAVEPC) 1044 xu = unp->unp_peercred; 1045 else { 1046 if (so->so_type == SOCK_STREAM) 1047 error = ENOTCONN; 1048 else 1049 error = EINVAL; 1050 } 1051 UNP_PCB_UNLOCK(unp); 1052 if (error == 0) 1053 error = sooptcopyout(sopt, &xu, sizeof(xu)); 1054 break; 1055 1056 case LOCAL_CREDS: 1057 /* Unocked read. */ 1058 optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0; 1059 error = sooptcopyout(sopt, &optval, sizeof(optval)); 1060 break; 1061 1062 case LOCAL_CONNWAIT: 1063 /* Unocked read. */ 1064 optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0; 1065 error = sooptcopyout(sopt, &optval, sizeof(optval)); 1066 break; 1067 1068 default: 1069 error = EOPNOTSUPP; 1070 break; 1071 } 1072 break; 1073 1074 case SOPT_SET: 1075 switch (sopt->sopt_name) { 1076 case LOCAL_CREDS: 1077 case LOCAL_CONNWAIT: 1078 error = sooptcopyin(sopt, &optval, sizeof(optval), 1079 sizeof(optval)); 1080 if (error) 1081 break; 1082 1083#define OPTSET(bit) do { \ 1084 UNP_PCB_LOCK(unp); \ 1085 if (optval) \ 1086 unp->unp_flags |= bit; \ 1087 else \ 1088 unp->unp_flags &= ~bit; \ 1089 UNP_PCB_UNLOCK(unp); \ 1090} while (0) 1091 1092 switch (sopt->sopt_name) { 1093 case LOCAL_CREDS: 1094 OPTSET(UNP_WANTCRED); 1095 break; 1096 1097 case LOCAL_CONNWAIT: 1098 OPTSET(UNP_CONNWAIT); 1099 break; 1100 1101 default: 1102 break; 1103 } 1104 break; 1105#undef OPTSET 1106 default: 1107 error = ENOPROTOOPT; 1108 break; 1109 } 1110 break; 1111 1112 default: 1113 error = EOPNOTSUPP; 1114 break; 1115 } 1116 return (error); 1117} 1118 1119static int 1120unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 1121{ 1122 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 1123 struct vnode *vp; 1124 struct socket *so2, *so3; 1125 struct unpcb *unp, *unp2, *unp3; 1126 int error, len; 1127 struct nameidata nd; 1128 char buf[SOCK_MAXADDRLEN]; 1129 struct sockaddr *sa; 1130 1131 UNP_GLOBAL_WLOCK_ASSERT(); 1132 UNP_GLOBAL_WUNLOCK(); 1133 1134 unp = sotounpcb(so); 1135 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1136 1137 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); 1138 if (len <= 0) 1139 return (EINVAL); 1140 strlcpy(buf, soun->sun_path, len + 1); 1141 1142 UNP_PCB_LOCK(unp); 1143 if (unp->unp_flags & UNP_CONNECTING) { 1144 UNP_PCB_UNLOCK(unp); 1145 return (EALREADY); 1146 } 1147 unp->unp_flags |= UNP_CONNECTING; 1148 UNP_PCB_UNLOCK(unp); 1149 1150 sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 1151 mtx_lock(&Giant); 1152 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, buf, td); 1153 error = namei(&nd); 1154 if (error) 1155 vp = NULL; 1156 else 1157 vp = nd.ni_vp; 1158 ASSERT_VOP_LOCKED(vp, "unp_connect"); 1159 NDFREE(&nd, NDF_ONLY_PNBUF); 1160 if (error) 1161 goto bad; 1162 1163 if (vp->v_type != VSOCK) { 1164 error = ENOTSOCK; 1165 goto bad; 1166 } 1167#ifdef MAC 1168 error = mac_check_vnode_open(td->td_ucred, vp, VWRITE | VREAD); 1169 if (error) 1170 goto bad; 1171#endif 1172 error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td); 1173 if (error) 1174 goto bad; 1175 mtx_unlock(&Giant); 1176 1177 unp = sotounpcb(so); 1178 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1179 1180 /* 1181 * Lock global lock for two reasons: make sure v_socket is stable, 1182 * and to protect simultaneous locking of multiple pcbs. 1183 */ 1184 UNP_GLOBAL_WLOCK(); 1185 so2 = vp->v_socket; 1186 if (so2 == NULL) { 1187 error = ECONNREFUSED; 1188 goto bad2; 1189 } 1190 if (so->so_type != so2->so_type) { 1191 error = EPROTOTYPE; 1192 goto bad2; 1193 } 1194 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 1195 if (so2->so_options & SO_ACCEPTCONN) { 1196 /* 1197 * We can't drop the global lock here or 'so2' may 1198 * become invalid, meaning that we will later recurse 1199 * back into the UNIX domain socket code while 1200 * holding the global lock. 1201 */ 1202 so3 = sonewconn(so2, 0); 1203 } else 1204 so3 = NULL; 1205 if (so3 == NULL) { 1206 error = ECONNREFUSED; 1207 goto bad2; 1208 } 1209 unp = sotounpcb(so); 1210 unp2 = sotounpcb(so2); 1211 unp3 = sotounpcb(so3); 1212 UNP_PCB_LOCK(unp); 1213 UNP_PCB_LOCK(unp2); 1214 UNP_PCB_LOCK(unp3); 1215 if (unp2->unp_addr != NULL) { 1216 bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len); 1217 unp3->unp_addr = (struct sockaddr_un *) sa; 1218 sa = NULL; 1219 } 1220 /* 1221 * unp_peercred management: 1222 * 1223 * The connecter's (client's) credentials are copied from its 1224 * process structure at the time of connect() (which is now). 1225 */ 1226 cru2x(td->td_ucred, &unp3->unp_peercred); 1227 unp3->unp_flags |= UNP_HAVEPC; 1228 /* 1229 * The receiver's (server's) credentials are copied from the 1230 * unp_peercred member of socket on which the former called 1231 * listen(); uipc_listen() cached that process's credentials 1232 * at that time so we can use them now. 1233 */ 1234 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED, 1235 ("unp_connect: listener without cached peercred")); 1236 memcpy(&unp->unp_peercred, &unp2->unp_peercred, 1237 sizeof(unp->unp_peercred)); 1238 unp->unp_flags |= UNP_HAVEPC; 1239 if (unp2->unp_flags & UNP_WANTCRED) 1240 unp3->unp_flags |= UNP_WANTCRED; 1241 UNP_PCB_UNLOCK(unp3); 1242 UNP_PCB_UNLOCK(unp2); 1243 UNP_PCB_UNLOCK(unp); 1244#ifdef MAC 1245 SOCK_LOCK(so); 1246 mac_set_socket_peer_from_socket(so, so3); 1247 mac_set_socket_peer_from_socket(so3, so); 1248 SOCK_UNLOCK(so); 1249#endif 1250 1251 so2 = so3; 1252 } 1253 unp = sotounpcb(so); 1254 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1255 unp2 = sotounpcb(so2); 1256 KASSERT(unp2 != NULL, ("unp_connect: unp2 == NULL")); 1257 UNP_PCB_LOCK(unp); 1258 UNP_PCB_LOCK(unp2); 1259 error = unp_connect2(so, so2, PRU_CONNECT); 1260 UNP_PCB_UNLOCK(unp2); 1261 UNP_PCB_UNLOCK(unp); 1262bad2: 1263 UNP_GLOBAL_WUNLOCK(); 1264 mtx_lock(&Giant); 1265bad: 1266 mtx_assert(&Giant, MA_OWNED); 1267 if (vp != NULL) 1268 vput(vp); 1269 mtx_unlock(&Giant); 1270 free(sa, M_SONAME); 1271 UNP_GLOBAL_WLOCK(); 1272 UNP_PCB_LOCK(unp); 1273 unp->unp_flags &= ~UNP_CONNECTING; 1274 UNP_PCB_UNLOCK(unp); 1275 return (error); 1276} 1277 1278static int 1279unp_connect2(struct socket *so, struct socket *so2, int req) 1280{ 1281 struct unpcb *unp; 1282 struct unpcb *unp2; 1283 1284 unp = sotounpcb(so); 1285 KASSERT(unp != NULL, ("unp_connect2: unp == NULL")); 1286 unp2 = sotounpcb(so2); 1287 KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL")); 1288 1289 UNP_GLOBAL_WLOCK_ASSERT(); 1290 UNP_PCB_LOCK_ASSERT(unp); 1291 UNP_PCB_LOCK_ASSERT(unp2); 1292 1293 if (so2->so_type != so->so_type) 1294 return (EPROTOTYPE); 1295 unp->unp_conn = unp2; 1296 1297 switch (so->so_type) { 1298 case SOCK_DGRAM: 1299 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink); 1300 soisconnected(so); 1301 break; 1302 1303 case SOCK_STREAM: 1304 unp2->unp_conn = unp; 1305 if (req == PRU_CONNECT && 1306 ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT)) 1307 soisconnecting(so); 1308 else 1309 soisconnected(so); 1310 soisconnected(so2); 1311 break; 1312 1313 default: 1314 panic("unp_connect2"); 1315 } 1316 return (0); 1317} 1318 1319static void 1320unp_disconnect(struct unpcb *unp, struct unpcb *unp2) 1321{ 1322 struct socket *so; 1323 1324 KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL")); 1325 1326 UNP_GLOBAL_WLOCK_ASSERT(); 1327 UNP_PCB_LOCK_ASSERT(unp); 1328 UNP_PCB_LOCK_ASSERT(unp2); 1329 1330 unp->unp_conn = NULL; 1331 switch (unp->unp_socket->so_type) { 1332 case SOCK_DGRAM: 1333 LIST_REMOVE(unp, unp_reflink); 1334 so = unp->unp_socket; 1335 SOCK_LOCK(so); 1336 so->so_state &= ~SS_ISCONNECTED; 1337 SOCK_UNLOCK(so); 1338 break; 1339 1340 case SOCK_STREAM: 1341 soisdisconnected(unp->unp_socket); 1342 unp2->unp_conn = NULL; 1343 soisdisconnected(unp2->unp_socket); 1344 break; 1345 } 1346} 1347 1348/* 1349 * unp_pcblist() assumes that UNIX domain socket memory is never reclaimed by 1350 * the zone (UMA_ZONE_NOFREE), and as such potentially stale pointers are 1351 * safe to reference. It first scans the list of struct unpcb's to generate 1352 * a pointer list, then it rescans its list one entry at a time to 1353 * externalize and copyout. It checks the generation number to see if a 1354 * struct unpcb has been reused, and will skip it if so. 1355 */ 1356static int 1357unp_pcblist(SYSCTL_HANDLER_ARGS) 1358{ 1359 int error, i, n; 1360 int freeunp; 1361 struct unpcb *unp, **unp_list; 1362 unp_gen_t gencnt; 1363 struct xunpgen *xug; 1364 struct unp_head *head; 1365 struct xunpcb *xu; 1366 1367 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead); 1368 1369 /* 1370 * The process of preparing the PCB list is too time-consuming and 1371 * resource-intensive to repeat twice on every request. 1372 */ 1373 if (req->oldptr == NULL) { 1374 n = unp_count; 1375 req->oldidx = 2 * (sizeof *xug) 1376 + (n + n/8) * sizeof(struct xunpcb); 1377 return (0); 1378 } 1379 1380 if (req->newptr != NULL) 1381 return (EPERM); 1382 1383 /* 1384 * OK, now we're committed to doing something. 1385 */ 1386 xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK); 1387 UNP_GLOBAL_RLOCK(); 1388 gencnt = unp_gencnt; 1389 n = unp_count; 1390 UNP_GLOBAL_RUNLOCK(); 1391 1392 xug->xug_len = sizeof *xug; 1393 xug->xug_count = n; 1394 xug->xug_gen = gencnt; 1395 xug->xug_sogen = so_gencnt; 1396 error = SYSCTL_OUT(req, xug, sizeof *xug); 1397 if (error) { 1398 free(xug, M_TEMP); 1399 return (error); 1400 } 1401 1402 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); 1403 1404 /* 1405 * XXXRW: Note, this code relies very explicitly in pcb's being type 1406 * stable. 1407 */ 1408 UNP_GLOBAL_RLOCK(); 1409 for (unp = LIST_FIRST(head), i = 0; unp && i < n; 1410 unp = LIST_NEXT(unp, unp_link)) { 1411 UNP_PCB_LOCK(unp); 1412 if (unp->unp_gencnt <= gencnt) { 1413 if (cr_cansee(req->td->td_ucred, 1414 unp->unp_socket->so_cred)) { 1415 UNP_PCB_UNLOCK(unp); 1416 continue; 1417 } 1418 unp_list[i++] = unp; 1419 unp->unp_refcount++; 1420 } 1421 UNP_PCB_UNLOCK(unp); 1422 } 1423 UNP_GLOBAL_RUNLOCK(); 1424 n = i; /* In case we lost some during malloc. */ 1425 1426 /* 1427 * XXXRW: The logic below asumes that it is OK to lock a mutex in 1428 * an unpcb that may have been freed. 1429 */ 1430 error = 0; 1431 xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO); 1432 for (i = 0; i < n; i++) { 1433 unp = unp_list[i]; 1434 UNP_PCB_LOCK(unp); 1435 unp->unp_refcount--; 1436 if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) { 1437 xu->xu_len = sizeof *xu; 1438 xu->xu_unpp = unp; 1439 /* 1440 * XXX - need more locking here to protect against 1441 * connect/disconnect races for SMP. 1442 */ 1443 if (unp->unp_addr != NULL) 1444 bcopy(unp->unp_addr, &xu->xu_addr, 1445 unp->unp_addr->sun_len); 1446 if (unp->unp_conn != NULL && 1447 unp->unp_conn->unp_addr != NULL) 1448 bcopy(unp->unp_conn->unp_addr, 1449 &xu->xu_caddr, 1450 unp->unp_conn->unp_addr->sun_len); 1451 bcopy(unp, &xu->xu_unp, sizeof *unp); 1452 sotoxsocket(unp->unp_socket, &xu->xu_socket); 1453 UNP_PCB_UNLOCK(unp); 1454 error = SYSCTL_OUT(req, xu, sizeof *xu); 1455 } else { 1456 freeunp = (unp->unp_refcount == 0); 1457 UNP_PCB_UNLOCK(unp); 1458 if (freeunp) { 1459 UNP_PCB_LOCK_DESTROY(unp); 1460 uma_zfree(unp_zone, unp); 1461 } 1462 } 1463 } 1464 free(xu, M_TEMP); 1465 if (!error) { 1466 /* 1467 * Give the user an updated idea of our state. If the 1468 * generation differs from what we told her before, she knows 1469 * that something happened while we were processing this 1470 * request, and it might be necessary to retry. 1471 */ 1472 xug->xug_gen = unp_gencnt; 1473 xug->xug_sogen = so_gencnt; 1474 xug->xug_count = unp_count; 1475 error = SYSCTL_OUT(req, xug, sizeof *xug); 1476 } 1477 free(unp_list, M_TEMP); 1478 free(xug, M_TEMP); 1479 return (error); 1480} 1481 1482SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD, 1483 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb", 1484 "List of active local datagram sockets"); 1485SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD, 1486 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb", 1487 "List of active local stream sockets"); 1488 1489static void 1490unp_shutdown(struct unpcb *unp) 1491{ 1492 struct unpcb *unp2; 1493 struct socket *so; 1494 1495 UNP_GLOBAL_WLOCK_ASSERT(); 1496 UNP_PCB_LOCK_ASSERT(unp); 1497 1498 unp2 = unp->unp_conn; 1499 if (unp->unp_socket->so_type == SOCK_STREAM && unp2 != NULL) { 1500 so = unp2->unp_socket; 1501 if (so != NULL) 1502 socantrcvmore(so); 1503 } 1504} 1505 1506static void 1507unp_drop(struct unpcb *unp, int errno) 1508{ 1509 struct socket *so = unp->unp_socket; 1510 struct unpcb *unp2; 1511 1512 UNP_GLOBAL_WLOCK_ASSERT(); 1513 UNP_PCB_LOCK_ASSERT(unp); 1514 1515 so->so_error = errno; 1516 unp2 = unp->unp_conn; 1517 if (unp2 == NULL) 1518 return; 1519 1520 UNP_PCB_LOCK(unp2); 1521 unp_disconnect(unp, unp2); 1522 UNP_PCB_UNLOCK(unp2); 1523} 1524 1525static void 1526unp_freerights(struct file **rp, int fdcount) 1527{ 1528 int i; 1529 struct file *fp; 1530 1531 for (i = 0; i < fdcount; i++) { 1532 /* 1533 * Zero the pointer before calling unp_discard since it may 1534 * end up in unp_gc().. 1535 * 1536 * XXXRW: This is less true than it used to be. 1537 */ 1538 fp = *rp; 1539 *rp++ = NULL; 1540 unp_discard(fp); 1541 } 1542} 1543 1544int 1545unp_externalize(struct mbuf *control, struct mbuf **controlp) 1546{ 1547 struct thread *td = curthread; /* XXX */ 1548 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1549 int i; 1550 int *fdp; 1551 struct file **rp; 1552 struct file *fp; 1553 void *data; 1554 socklen_t clen = control->m_len, datalen; 1555 int error, newfds; 1556 int f; 1557 u_int newlen; 1558 1559 UNP_GLOBAL_UNLOCK_ASSERT(); 1560 1561 error = 0; 1562 if (controlp != NULL) /* controlp == NULL => free control messages */ 1563 *controlp = NULL; 1564 1565 while (cm != NULL) { 1566 if (sizeof(*cm) > clen || cm->cmsg_len > clen) { 1567 error = EINVAL; 1568 break; 1569 } 1570 1571 data = CMSG_DATA(cm); 1572 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data; 1573 1574 if (cm->cmsg_level == SOL_SOCKET 1575 && cm->cmsg_type == SCM_RIGHTS) { 1576 newfds = datalen / sizeof(struct file *); 1577 rp = data; 1578 1579 /* If we're not outputting the descriptors free them. */ 1580 if (error || controlp == NULL) { 1581 unp_freerights(rp, newfds); 1582 goto next; 1583 } 1584 FILEDESC_LOCK(td->td_proc->p_fd); 1585 /* if the new FD's will not fit free them. */ 1586 if (!fdavail(td, newfds)) { 1587 FILEDESC_UNLOCK(td->td_proc->p_fd); 1588 error = EMSGSIZE; 1589 unp_freerights(rp, newfds); 1590 goto next; 1591 } 1592 /* 1593 * Now change each pointer to an fd in the global 1594 * table to an integer that is the index to the local 1595 * fd table entry that we set up to point to the 1596 * global one we are transferring. 1597 */ 1598 newlen = newfds * sizeof(int); 1599 *controlp = sbcreatecontrol(NULL, newlen, 1600 SCM_RIGHTS, SOL_SOCKET); 1601 if (*controlp == NULL) { 1602 FILEDESC_UNLOCK(td->td_proc->p_fd); 1603 error = E2BIG; 1604 unp_freerights(rp, newfds); 1605 goto next; 1606 } 1607 1608 fdp = (int *) 1609 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1610 for (i = 0; i < newfds; i++) { 1611 if (fdalloc(td, 0, &f)) 1612 panic("unp_externalize fdalloc failed"); 1613 fp = *rp++; 1614 td->td_proc->p_fd->fd_ofiles[f] = fp; 1615 FILE_LOCK(fp); 1616 fp->f_msgcount--; 1617 FILE_UNLOCK(fp); 1618 unp_rights--; 1619 *fdp++ = f; 1620 } 1621 FILEDESC_UNLOCK(td->td_proc->p_fd); 1622 } else { 1623 /* We can just copy anything else across. */ 1624 if (error || controlp == NULL) 1625 goto next; 1626 *controlp = sbcreatecontrol(NULL, datalen, 1627 cm->cmsg_type, cm->cmsg_level); 1628 if (*controlp == NULL) { 1629 error = ENOBUFS; 1630 goto next; 1631 } 1632 bcopy(data, 1633 CMSG_DATA(mtod(*controlp, struct cmsghdr *)), 1634 datalen); 1635 } 1636 1637 controlp = &(*controlp)->m_next; 1638 1639next: 1640 if (CMSG_SPACE(datalen) < clen) { 1641 clen -= CMSG_SPACE(datalen); 1642 cm = (struct cmsghdr *) 1643 ((caddr_t)cm + CMSG_SPACE(datalen)); 1644 } else { 1645 clen = 0; 1646 cm = NULL; 1647 } 1648 } 1649 1650 m_freem(control); 1651 1652 return (error); 1653} 1654 1655static void 1656unp_zone_change(void *tag) 1657{ 1658 1659 uma_zone_set_max(unp_zone, maxsockets); 1660} 1661 1662void 1663unp_init(void) 1664{ 1665 1666 unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, NULL, 1667 NULL, NULL, UMA_ALIGN_PTR, 0); 1668 if (unp_zone == NULL) 1669 panic("unp_init"); 1670 uma_zone_set_max(unp_zone, maxsockets); 1671 EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change, 1672 NULL, EVENTHANDLER_PRI_ANY); 1673 LIST_INIT(&unp_dhead); 1674 LIST_INIT(&unp_shead); 1675 TASK_INIT(&unp_gc_task, 0, unp_gc, NULL); 1676 UNP_GLOBAL_LOCK_INIT(); 1677} 1678 1679static int 1680unp_internalize(struct mbuf **controlp, struct thread *td) 1681{ 1682 struct mbuf *control = *controlp; 1683 struct proc *p = td->td_proc; 1684 struct filedesc *fdescp = p->p_fd; 1685 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1686 struct cmsgcred *cmcred; 1687 struct file **rp; 1688 struct file *fp; 1689 struct timeval *tv; 1690 int i, fd, *fdp; 1691 void *data; 1692 socklen_t clen = control->m_len, datalen; 1693 int error, oldfds; 1694 u_int newlen; 1695 1696 UNP_GLOBAL_UNLOCK_ASSERT(); 1697 1698 error = 0; 1699 *controlp = NULL; 1700 1701 while (cm != NULL) { 1702 if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET 1703 || cm->cmsg_len > clen) { 1704 error = EINVAL; 1705 goto out; 1706 } 1707 1708 data = CMSG_DATA(cm); 1709 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data; 1710 1711 switch (cm->cmsg_type) { 1712 /* 1713 * Fill in credential information. 1714 */ 1715 case SCM_CREDS: 1716 *controlp = sbcreatecontrol(NULL, sizeof(*cmcred), 1717 SCM_CREDS, SOL_SOCKET); 1718 if (*controlp == NULL) { 1719 error = ENOBUFS; 1720 goto out; 1721 } 1722 1723 cmcred = (struct cmsgcred *) 1724 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1725 cmcred->cmcred_pid = p->p_pid; 1726 cmcred->cmcred_uid = td->td_ucred->cr_ruid; 1727 cmcred->cmcred_gid = td->td_ucred->cr_rgid; 1728 cmcred->cmcred_euid = td->td_ucred->cr_uid; 1729 cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups, 1730 CMGROUP_MAX); 1731 for (i = 0; i < cmcred->cmcred_ngroups; i++) 1732 cmcred->cmcred_groups[i] = 1733 td->td_ucred->cr_groups[i]; 1734 break; 1735 1736 case SCM_RIGHTS: 1737 oldfds = datalen / sizeof (int); 1738 /* 1739 * Check that all the FDs passed in refer to legal 1740 * files. If not, reject the entire operation. 1741 */ 1742 fdp = data; 1743 FILEDESC_LOCK(fdescp); 1744 for (i = 0; i < oldfds; i++) { 1745 fd = *fdp++; 1746 if ((unsigned)fd >= fdescp->fd_nfiles || 1747 fdescp->fd_ofiles[fd] == NULL) { 1748 FILEDESC_UNLOCK(fdescp); 1749 error = EBADF; 1750 goto out; 1751 } 1752 fp = fdescp->fd_ofiles[fd]; 1753 if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) { 1754 FILEDESC_UNLOCK(fdescp); 1755 error = EOPNOTSUPP; 1756 goto out; 1757 } 1758 1759 } 1760 /* 1761 * Now replace the integer FDs with pointers to 1762 * the associated global file table entry.. 1763 */ 1764 newlen = oldfds * sizeof(struct file *); 1765 *controlp = sbcreatecontrol(NULL, newlen, 1766 SCM_RIGHTS, SOL_SOCKET); 1767 if (*controlp == NULL) { 1768 FILEDESC_UNLOCK(fdescp); 1769 error = E2BIG; 1770 goto out; 1771 } 1772 1773 fdp = data; 1774 rp = (struct file **) 1775 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1776 for (i = 0; i < oldfds; i++) { 1777 fp = fdescp->fd_ofiles[*fdp++]; 1778 *rp++ = fp; 1779 FILE_LOCK(fp); 1780 fp->f_count++; 1781 fp->f_msgcount++; 1782 FILE_UNLOCK(fp); 1783 unp_rights++; 1784 } 1785 FILEDESC_UNLOCK(fdescp); 1786 break; 1787 1788 case SCM_TIMESTAMP: 1789 *controlp = sbcreatecontrol(NULL, sizeof(*tv), 1790 SCM_TIMESTAMP, SOL_SOCKET); 1791 if (*controlp == NULL) { 1792 error = ENOBUFS; 1793 goto out; 1794 } 1795 tv = (struct timeval *) 1796 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1797 microtime(tv); 1798 break; 1799 1800 default: 1801 error = EINVAL; 1802 goto out; 1803 } 1804 1805 controlp = &(*controlp)->m_next; 1806 1807 if (CMSG_SPACE(datalen) < clen) { 1808 clen -= CMSG_SPACE(datalen); 1809 cm = (struct cmsghdr *) 1810 ((caddr_t)cm + CMSG_SPACE(datalen)); 1811 } else { 1812 clen = 0; 1813 cm = NULL; 1814 } 1815 } 1816 1817out: 1818 m_freem(control); 1819 1820 return (error); 1821} 1822 1823static struct mbuf * 1824unp_addsockcred(struct thread *td, struct mbuf *control) 1825{ 1826 struct mbuf *m, *n, *n_prev; 1827 struct sockcred *sc; 1828 const struct cmsghdr *cm; 1829 int ngroups; 1830 int i; 1831 1832 ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX); 1833 1834 m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET); 1835 if (m == NULL) 1836 return (control); 1837 1838 sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *)); 1839 sc->sc_uid = td->td_ucred->cr_ruid; 1840 sc->sc_euid = td->td_ucred->cr_uid; 1841 sc->sc_gid = td->td_ucred->cr_rgid; 1842 sc->sc_egid = td->td_ucred->cr_gid; 1843 sc->sc_ngroups = ngroups; 1844 for (i = 0; i < sc->sc_ngroups; i++) 1845 sc->sc_groups[i] = td->td_ucred->cr_groups[i]; 1846 1847 /* 1848 * Unlink SCM_CREDS control messages (struct cmsgcred), since just 1849 * created SCM_CREDS control message (struct sockcred) has another 1850 * format. 1851 */ 1852 if (control != NULL) 1853 for (n = control, n_prev = NULL; n != NULL;) { 1854 cm = mtod(n, struct cmsghdr *); 1855 if (cm->cmsg_level == SOL_SOCKET && 1856 cm->cmsg_type == SCM_CREDS) { 1857 if (n_prev == NULL) 1858 control = n->m_next; 1859 else 1860 n_prev->m_next = n->m_next; 1861 n = m_free(n); 1862 } else { 1863 n_prev = n; 1864 n = n->m_next; 1865 } 1866 } 1867 1868 /* Prepend it to the head. */ 1869 m->m_next = control; 1870 1871 return (m); 1872} 1873 1874/* 1875 * unp_defer indicates whether additional work has been defered for a future 1876 * pass through unp_gc(). It is thread local and does not require explicit 1877 * synchronization. 1878 */ 1879static int unp_defer; 1880 1881static int unp_taskcount; 1882SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0, ""); 1883 1884static int unp_recycled; 1885SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0, ""); 1886 1887static void 1888unp_gc(__unused void *arg, int pending) 1889{ 1890 struct file *fp, *nextfp; 1891 struct socket *so; 1892 struct file **extra_ref, **fpp; 1893 int nunref, i; 1894 int nfiles_snap; 1895 int nfiles_slack = 20; 1896 1897 unp_taskcount++; 1898 unp_defer = 0; 1899 /* 1900 * Before going through all this, set all FDs to be NOT deferred and 1901 * NOT externally accessible. 1902 */ 1903 sx_slock(&filelist_lock); 1904 LIST_FOREACH(fp, &filehead, f_list) 1905 fp->f_gcflag &= ~(FMARK|FDEFER); 1906 do { 1907 KASSERT(unp_defer >= 0, ("unp_gc: unp_defer %d", unp_defer)); 1908 LIST_FOREACH(fp, &filehead, f_list) { 1909 FILE_LOCK(fp); 1910 /* 1911 * If the file is not open, skip it -- could be a 1912 * file in the process of being opened, or in the 1913 * process of being closed. If the file is 1914 * "closing", it may have been marked for deferred 1915 * consideration. Clear the flag now if so. 1916 */ 1917 if (fp->f_count == 0) { 1918 if (fp->f_gcflag & FDEFER) 1919 unp_defer--; 1920 fp->f_gcflag &= ~(FMARK|FDEFER); 1921 FILE_UNLOCK(fp); 1922 continue; 1923 } 1924 /* 1925 * If we already marked it as 'defer' in a 1926 * previous pass, then try to process it this 1927 * time and un-mark it. 1928 */ 1929 if (fp->f_gcflag & FDEFER) { 1930 fp->f_gcflag &= ~FDEFER; 1931 unp_defer--; 1932 } else { 1933 /* 1934 * If it's not deferred, then check if it's 1935 * already marked.. if so skip it 1936 */ 1937 if (fp->f_gcflag & FMARK) { 1938 FILE_UNLOCK(fp); 1939 continue; 1940 } 1941 /* 1942 * If all references are from messages in 1943 * transit, then skip it. it's not externally 1944 * accessible. 1945 */ 1946 if (fp->f_count == fp->f_msgcount) { 1947 FILE_UNLOCK(fp); 1948 continue; 1949 } 1950 /* 1951 * If it got this far then it must be 1952 * externally accessible. 1953 */ 1954 fp->f_gcflag |= FMARK; 1955 } 1956 /* 1957 * Either it was deferred, or it is externally 1958 * accessible and not already marked so. Now check 1959 * if it is possibly one of OUR sockets. 1960 */ 1961 if (fp->f_type != DTYPE_SOCKET || 1962 (so = fp->f_data) == NULL) { 1963 FILE_UNLOCK(fp); 1964 continue; 1965 } 1966 if (so->so_proto->pr_domain != &localdomain || 1967 (so->so_proto->pr_flags & PR_RIGHTS) == 0) { 1968 FILE_UNLOCK(fp); 1969 continue; 1970 } 1971 1972 /* 1973 * Tell any other threads that do a subsequent 1974 * fdrop() that we are scanning the message 1975 * buffers. 1976 */ 1977 fp->f_gcflag |= FWAIT; 1978 FILE_UNLOCK(fp); 1979 1980 /* 1981 * So, Ok, it's one of our sockets and it IS 1982 * externally accessible (or was deferred). Now we 1983 * look to see if we hold any file descriptors in its 1984 * message buffers. Follow those links and mark them 1985 * as accessible too. 1986 */ 1987 SOCKBUF_LOCK(&so->so_rcv); 1988 unp_scan(so->so_rcv.sb_mb, unp_mark); 1989 SOCKBUF_UNLOCK(&so->so_rcv); 1990 1991 /* 1992 * Wake up any threads waiting in fdrop(). 1993 */ 1994 FILE_LOCK(fp); 1995 fp->f_gcflag &= ~FWAIT; 1996 wakeup(&fp->f_gcflag); 1997 FILE_UNLOCK(fp); 1998 } 1999 } while (unp_defer); 2000 sx_sunlock(&filelist_lock); 2001 /* 2002 * XXXRW: The following comments need updating for a post-SMPng and 2003 * deferred unp_gc() world, but are still generally accurate. 2004 * 2005 * We grab an extra reference to each of the file table entries that 2006 * are not otherwise accessible and then free the rights that are 2007 * stored in messages on them. 2008 * 2009 * The bug in the orginal code is a little tricky, so I'll describe 2010 * what's wrong with it here. 2011 * 2012 * It is incorrect to simply unp_discard each entry for f_msgcount 2013 * times -- consider the case of sockets A and B that contain 2014 * references to each other. On a last close of some other socket, 2015 * we trigger a gc since the number of outstanding rights (unp_rights) 2016 * is non-zero. If during the sweep phase the gc code unp_discards, 2017 * we end up doing a (full) closef on the descriptor. A closef on A 2018 * results in the following chain. Closef calls soo_close, which 2019 * calls soclose. Soclose calls first (through the switch 2020 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply 2021 * returns because the previous instance had set unp_gcing, and we 2022 * return all the way back to soclose, which marks the socket with 2023 * SS_NOFDREF, and then calls sofree. Sofree calls sorflush to free 2024 * up the rights that are queued in messages on the socket A, i.e., 2025 * the reference on B. The sorflush calls via the dom_dispose switch 2026 * unp_dispose, which unp_scans with unp_discard. This second 2027 * instance of unp_discard just calls closef on B. 2028 * 2029 * Well, a similar chain occurs on B, resulting in a sorflush on B, 2030 * which results in another closef on A. Unfortunately, A is already 2031 * being closed, and the descriptor has already been marked with 2032 * SS_NOFDREF, and soclose panics at this point. 2033 * 2034 * Here, we first take an extra reference to each inaccessible 2035 * descriptor. Then, we call sorflush ourself, since we know it is a 2036 * Unix domain socket anyhow. After we destroy all the rights 2037 * carried in messages, we do a last closef to get rid of our extra 2038 * reference. This is the last close, and the unp_detach etc will 2039 * shut down the socket. 2040 * 2041 * 91/09/19, bsy@cs.cmu.edu 2042 */ 2043again: 2044 nfiles_snap = openfiles + nfiles_slack; /* some slack */ 2045 extra_ref = malloc(nfiles_snap * sizeof(struct file *), M_TEMP, 2046 M_WAITOK); 2047 sx_slock(&filelist_lock); 2048 if (nfiles_snap < openfiles) { 2049 sx_sunlock(&filelist_lock); 2050 free(extra_ref, M_TEMP); 2051 nfiles_slack += 20; 2052 goto again; 2053 } 2054 for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; 2055 fp != NULL; fp = nextfp) { 2056 nextfp = LIST_NEXT(fp, f_list); 2057 FILE_LOCK(fp); 2058 /* 2059 * If it's not open, skip it 2060 */ 2061 if (fp->f_count == 0) { 2062 FILE_UNLOCK(fp); 2063 continue; 2064 } 2065 /* 2066 * If all refs are from msgs, and it's not marked accessible 2067 * then it must be referenced from some unreachable cycle of 2068 * (shut-down) FDs, so include it in our list of FDs to 2069 * remove. 2070 */ 2071 if (fp->f_count == fp->f_msgcount && !(fp->f_gcflag & FMARK)) { 2072 *fpp++ = fp; 2073 nunref++; 2074 fp->f_count++; 2075 } 2076 FILE_UNLOCK(fp); 2077 } 2078 sx_sunlock(&filelist_lock); 2079 /* 2080 * For each FD on our hit list, do the following two things: 2081 */ 2082 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) { 2083 struct file *tfp = *fpp; 2084 FILE_LOCK(tfp); 2085 if (tfp->f_type == DTYPE_SOCKET && 2086 tfp->f_data != NULL) { 2087 FILE_UNLOCK(tfp); 2088 sorflush(tfp->f_data); 2089 } else { 2090 FILE_UNLOCK(tfp); 2091 } 2092 } 2093 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) { 2094 closef(*fpp, (struct thread *) NULL); 2095 unp_recycled++; 2096 } 2097 free(extra_ref, M_TEMP); 2098} 2099 2100void 2101unp_dispose(struct mbuf *m) 2102{ 2103 2104 if (m) 2105 unp_scan(m, unp_discard); 2106} 2107 2108static void 2109unp_scan(struct mbuf *m0, void (*op)(struct file *)) 2110{ 2111 struct mbuf *m; 2112 struct file **rp; 2113 struct cmsghdr *cm; 2114 void *data; 2115 int i; 2116 socklen_t clen, datalen; 2117 int qfds; 2118 2119 while (m0 != NULL) { 2120 for (m = m0; m; m = m->m_next) { 2121 if (m->m_type != MT_CONTROL) 2122 continue; 2123 2124 cm = mtod(m, struct cmsghdr *); 2125 clen = m->m_len; 2126 2127 while (cm != NULL) { 2128 if (sizeof(*cm) > clen || cm->cmsg_len > clen) 2129 break; 2130 2131 data = CMSG_DATA(cm); 2132 datalen = (caddr_t)cm + cm->cmsg_len 2133 - (caddr_t)data; 2134 2135 if (cm->cmsg_level == SOL_SOCKET && 2136 cm->cmsg_type == SCM_RIGHTS) { 2137 qfds = datalen / sizeof (struct file *); 2138 rp = data; 2139 for (i = 0; i < qfds; i++) 2140 (*op)(*rp++); 2141 } 2142 2143 if (CMSG_SPACE(datalen) < clen) { 2144 clen -= CMSG_SPACE(datalen); 2145 cm = (struct cmsghdr *) 2146 ((caddr_t)cm + CMSG_SPACE(datalen)); 2147 } else { 2148 clen = 0; 2149 cm = NULL; 2150 } 2151 } 2152 } 2153 m0 = m0->m_act; 2154 } 2155} 2156 2157static void 2158unp_mark(struct file *fp) 2159{ 2160 2161 /* XXXRW: Should probably assert file list lock here. */ 2162 2163 if (fp->f_gcflag & FMARK) 2164 return; 2165 unp_defer++; 2166 fp->f_gcflag |= (FMARK|FDEFER); 2167} 2168 2169static void 2170unp_discard(struct file *fp) 2171{ 2172 2173 UNP_GLOBAL_WLOCK(); 2174 FILE_LOCK(fp); 2175 fp->f_msgcount--; 2176 unp_rights--; 2177 FILE_UNLOCK(fp); 2178 UNP_GLOBAL_WUNLOCK(); 2179 (void) closef(fp, (struct thread *)NULL); 2180} 2181