xref: /netbsd-src/sys/kern/uipc_usrreq.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: uipc_usrreq.c,v 1.103 2007/12/08 19:29:49 pooka Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2004 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the NetBSD
22  *	Foundation, Inc. and its contributors.
23  * 4. Neither the name of The NetBSD Foundation nor the names of its
24  *    contributors may be used to endorse or promote products derived
25  *    from this software without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37  * POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * Copyright (c) 1982, 1986, 1989, 1991, 1993
42  *	The Regents of the University of California.  All rights reserved.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. Neither the name of the University nor the names of its contributors
53  *    may be used to endorse or promote products derived from this software
54  *    without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66  * SUCH DAMAGE.
67  *
68  *	@(#)uipc_usrreq.c	8.9 (Berkeley) 5/14/95
69  */
70 
71 /*
72  * Copyright (c) 1997 Christopher G. Demetriou.  All rights reserved.
73  *
74  * Redistribution and use in source and binary forms, with or without
75  * modification, are permitted provided that the following conditions
76  * are met:
77  * 1. Redistributions of source code must retain the above copyright
78  *    notice, this list of conditions and the following disclaimer.
79  * 2. Redistributions in binary form must reproduce the above copyright
80  *    notice, this list of conditions and the following disclaimer in the
81  *    documentation and/or other materials provided with the distribution.
82  * 3. All advertising materials mentioning features or use of this software
83  *    must display the following acknowledgement:
84  *	This product includes software developed by the University of
85  *	California, Berkeley and its contributors.
86  * 4. Neither the name of the University nor the names of its contributors
87  *    may be used to endorse or promote products derived from this software
88  *    without specific prior written permission.
89  *
90  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
91  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
92  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
93  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
94  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
95  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
96  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
97  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
98  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
99  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
100  * SUCH DAMAGE.
101  *
102  *	@(#)uipc_usrreq.c	8.9 (Berkeley) 5/14/95
103  */
104 
105 #include <sys/cdefs.h>
106 __KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.103 2007/12/08 19:29:49 pooka Exp $");
107 
108 #include <sys/param.h>
109 #include <sys/systm.h>
110 #include <sys/proc.h>
111 #include <sys/filedesc.h>
112 #include <sys/domain.h>
113 #include <sys/protosw.h>
114 #include <sys/socket.h>
115 #include <sys/socketvar.h>
116 #include <sys/unpcb.h>
117 #include <sys/un.h>
118 #include <sys/namei.h>
119 #include <sys/vnode.h>
120 #include <sys/file.h>
121 #include <sys/stat.h>
122 #include <sys/mbuf.h>
123 #include <sys/kauth.h>
124 #include <sys/kmem.h>
125 
126 /*
127  * Unix communications domain.
128  *
129  * TODO:
130  *	SEQPACKET, RDM
131  *	rethink name space problems
132  *	need a proper out-of-band
133  */
134 const struct sockaddr_un sun_noname = {
135 	.sun_len = sizeof(sun_noname),
136 	.sun_family = AF_LOCAL,
137 };
138 ino_t	unp_ino;			/* prototype for fake inode numbers */
139 
140 struct mbuf *unp_addsockcred(struct lwp *, struct mbuf *);
141 
142 int
143 unp_output(struct mbuf *m, struct mbuf *control, struct unpcb *unp,
144 	struct lwp *l)
145 {
146 	struct socket *so2;
147 	const struct sockaddr_un *sun;
148 
149 	so2 = unp->unp_conn->unp_socket;
150 	if (unp->unp_addr)
151 		sun = unp->unp_addr;
152 	else
153 		sun = &sun_noname;
154 	if (unp->unp_conn->unp_flags & UNP_WANTCRED)
155 		control = unp_addsockcred(l, control);
156 	if (sbappendaddr(&so2->so_rcv, (const struct sockaddr *)sun, m,
157 	    control) == 0) {
158 		unp_dispose(control);
159 		m_freem(control);
160 		m_freem(m);
161 		so2->so_rcv.sb_overflowed++;
162 		return (ENOBUFS);
163 	} else {
164 		sorwakeup(so2);
165 		return (0);
166 	}
167 }
168 
169 void
170 unp_setsockaddr(struct unpcb *unp, struct mbuf *nam)
171 {
172 	const struct sockaddr_un *sun;
173 
174 	if (unp->unp_addr)
175 		sun = unp->unp_addr;
176 	else
177 		sun = &sun_noname;
178 	nam->m_len = sun->sun_len;
179 	if (nam->m_len > MLEN)
180 		MEXTMALLOC(nam, nam->m_len, M_WAITOK);
181 	memcpy(mtod(nam, void *), sun, (size_t)nam->m_len);
182 }
183 
184 void
185 unp_setpeeraddr(struct unpcb *unp, struct mbuf *nam)
186 {
187 	const struct sockaddr_un *sun;
188 
189 	if (unp->unp_conn && unp->unp_conn->unp_addr)
190 		sun = unp->unp_conn->unp_addr;
191 	else
192 		sun = &sun_noname;
193 	nam->m_len = sun->sun_len;
194 	if (nam->m_len > MLEN)
195 		MEXTMALLOC(nam, nam->m_len, M_WAITOK);
196 	memcpy(mtod(nam, void *), sun, (size_t)nam->m_len);
197 }
198 
199 /*ARGSUSED*/
200 int
201 uipc_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
202 	struct mbuf *control, struct lwp *l)
203 {
204 	struct unpcb *unp = sotounpcb(so);
205 	struct socket *so2;
206 	struct proc *p;
207 	u_int newhiwat;
208 	int error = 0;
209 
210 	if (req == PRU_CONTROL)
211 		return (EOPNOTSUPP);
212 
213 #ifdef DIAGNOSTIC
214 	if (req != PRU_SEND && req != PRU_SENDOOB && control)
215 		panic("uipc_usrreq: unexpected control mbuf");
216 #endif
217 	p = l ? l->l_proc : NULL;
218 	if (unp == 0 && req != PRU_ATTACH) {
219 		error = EINVAL;
220 		goto release;
221 	}
222 
223 	switch (req) {
224 
225 	case PRU_ATTACH:
226 		if (unp != 0) {
227 			error = EISCONN;
228 			break;
229 		}
230 		error = unp_attach(so);
231 		break;
232 
233 	case PRU_DETACH:
234 		unp_detach(unp);
235 		break;
236 
237 	case PRU_BIND:
238 		KASSERT(l != NULL);
239 		error = unp_bind(unp, nam, l);
240 		break;
241 
242 	case PRU_LISTEN:
243 		if (unp->unp_vnode == 0)
244 			error = EINVAL;
245 		break;
246 
247 	case PRU_CONNECT:
248 		KASSERT(l != NULL);
249 		error = unp_connect(so, nam, l);
250 		break;
251 
252 	case PRU_CONNECT2:
253 		error = unp_connect2(so, (struct socket *)nam, PRU_CONNECT2);
254 		break;
255 
256 	case PRU_DISCONNECT:
257 		unp_disconnect(unp);
258 		break;
259 
260 	case PRU_ACCEPT:
261 		unp_setpeeraddr(unp, nam);
262 		/*
263 		 * Mark the initiating STREAM socket as connected *ONLY*
264 		 * after it's been accepted.  This prevents a client from
265 		 * overrunning a server and receiving ECONNREFUSED.
266 		 */
267 		if (unp->unp_conn != NULL &&
268 		    (unp->unp_conn->unp_socket->so_state & SS_ISCONNECTING))
269 			soisconnected(unp->unp_conn->unp_socket);
270 		break;
271 
272 	case PRU_SHUTDOWN:
273 		socantsendmore(so);
274 		unp_shutdown(unp);
275 		break;
276 
277 	case PRU_RCVD:
278 		switch (so->so_type) {
279 
280 		case SOCK_DGRAM:
281 			panic("uipc 1");
282 			/*NOTREACHED*/
283 
284 		case SOCK_STREAM:
285 #define	rcv (&so->so_rcv)
286 #define snd (&so2->so_snd)
287 			if (unp->unp_conn == 0)
288 				break;
289 			so2 = unp->unp_conn->unp_socket;
290 			/*
291 			 * Adjust backpressure on sender
292 			 * and wakeup any waiting to write.
293 			 */
294 			snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
295 			unp->unp_mbcnt = rcv->sb_mbcnt;
296 			newhiwat = snd->sb_hiwat + unp->unp_cc - rcv->sb_cc;
297 			(void)chgsbsize(so2->so_uidinfo,
298 			    &snd->sb_hiwat, newhiwat, RLIM_INFINITY);
299 			unp->unp_cc = rcv->sb_cc;
300 			sowwakeup(so2);
301 #undef snd
302 #undef rcv
303 			break;
304 
305 		default:
306 			panic("uipc 2");
307 		}
308 		break;
309 
310 	case PRU_SEND:
311 		/*
312 		 * Note: unp_internalize() rejects any control message
313 		 * other than SCM_RIGHTS, and only allows one.  This
314 		 * has the side-effect of preventing a caller from
315 		 * forging SCM_CREDS.
316 		 */
317 		if (control) {
318 			KASSERT(l != NULL);
319 			if ((error = unp_internalize(control, l)) != 0)
320 				goto die;
321 		}
322 		switch (so->so_type) {
323 
324 		case SOCK_DGRAM: {
325 			if (nam) {
326 				if ((so->so_state & SS_ISCONNECTED) != 0) {
327 					error = EISCONN;
328 					goto die;
329 				}
330 				KASSERT(l != NULL);
331 				error = unp_connect(so, nam, l);
332 				if (error) {
333 				die:
334 					unp_dispose(control);
335 					m_freem(control);
336 					m_freem(m);
337 					break;
338 				}
339 			} else {
340 				if ((so->so_state & SS_ISCONNECTED) == 0) {
341 					error = ENOTCONN;
342 					goto die;
343 				}
344 			}
345 			KASSERT(p != NULL);
346 			error = unp_output(m, control, unp, l);
347 			if (nam)
348 				unp_disconnect(unp);
349 			break;
350 		}
351 
352 		case SOCK_STREAM:
353 #define	rcv (&so2->so_rcv)
354 #define	snd (&so->so_snd)
355 			if (unp->unp_conn == NULL) {
356 				error = ENOTCONN;
357 				break;
358 			}
359 			so2 = unp->unp_conn->unp_socket;
360 			if (unp->unp_conn->unp_flags & UNP_WANTCRED) {
361 				/*
362 				 * Credentials are passed only once on
363 				 * SOCK_STREAM.
364 				 */
365 				unp->unp_conn->unp_flags &= ~UNP_WANTCRED;
366 				control = unp_addsockcred(l, control);
367 			}
368 			/*
369 			 * Send to paired receive port, and then reduce
370 			 * send buffer hiwater marks to maintain backpressure.
371 			 * Wake up readers.
372 			 */
373 			if (control) {
374 				if (sbappendcontrol(rcv, m, control) == 0) {
375 					unp_dispose(control);
376 					m_freem(control);
377 				}
378 			} else
379 				sbappend(rcv, m);
380 			snd->sb_mbmax -=
381 			    rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
382 			unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
383 			newhiwat = snd->sb_hiwat -
384 			    (rcv->sb_cc - unp->unp_conn->unp_cc);
385 			(void)chgsbsize(so->so_uidinfo,
386 			    &snd->sb_hiwat, newhiwat, RLIM_INFINITY);
387 			unp->unp_conn->unp_cc = rcv->sb_cc;
388 			sorwakeup(so2);
389 #undef snd
390 #undef rcv
391 			break;
392 
393 		default:
394 			panic("uipc 4");
395 		}
396 		break;
397 
398 	case PRU_ABORT:
399 		unp_drop(unp, ECONNABORTED);
400 
401 		KASSERT(so->so_head == NULL);
402 #ifdef DIAGNOSTIC
403 		if (so->so_pcb == 0)
404 			panic("uipc 5: drop killed pcb");
405 #endif
406 		unp_detach(unp);
407 		break;
408 
409 	case PRU_SENSE:
410 		((struct stat *) m)->st_blksize = so->so_snd.sb_hiwat;
411 		if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
412 			so2 = unp->unp_conn->unp_socket;
413 			((struct stat *) m)->st_blksize += so2->so_rcv.sb_cc;
414 		}
415 		((struct stat *) m)->st_dev = NODEV;
416 		if (unp->unp_ino == 0)
417 			unp->unp_ino = unp_ino++;
418 		((struct stat *) m)->st_atimespec =
419 		    ((struct stat *) m)->st_mtimespec =
420 		    ((struct stat *) m)->st_ctimespec = unp->unp_ctime;
421 		((struct stat *) m)->st_ino = unp->unp_ino;
422 		return (0);
423 
424 	case PRU_RCVOOB:
425 		error = EOPNOTSUPP;
426 		break;
427 
428 	case PRU_SENDOOB:
429 		m_freem(control);
430 		m_freem(m);
431 		error = EOPNOTSUPP;
432 		break;
433 
434 	case PRU_SOCKADDR:
435 		unp_setsockaddr(unp, nam);
436 		break;
437 
438 	case PRU_PEERADDR:
439 		unp_setpeeraddr(unp, nam);
440 		break;
441 
442 	default:
443 		panic("piusrreq");
444 	}
445 
446 release:
447 	return (error);
448 }
449 
450 /*
451  * Unix domain socket option processing.
452  */
453 int
454 uipc_ctloutput(int op, struct socket *so, int level, int optname,
455 	struct mbuf **mp)
456 {
457 	struct unpcb *unp = sotounpcb(so);
458 	struct mbuf *m = *mp;
459 	int optval = 0, error = 0;
460 
461 	if (level != 0) {
462 		error = ENOPROTOOPT;
463 		if (op == PRCO_SETOPT && m)
464 			(void) m_free(m);
465 	} else switch (op) {
466 
467 	case PRCO_SETOPT:
468 		switch (optname) {
469 		case LOCAL_CREDS:
470 		case LOCAL_CONNWAIT:
471 			if (m == NULL || m->m_len != sizeof(int))
472 				error = EINVAL;
473 			else {
474 				optval = *mtod(m, int *);
475 				switch (optname) {
476 #define	OPTSET(bit) \
477 	if (optval) \
478 		unp->unp_flags |= (bit); \
479 	else \
480 		unp->unp_flags &= ~(bit);
481 
482 				case LOCAL_CREDS:
483 					OPTSET(UNP_WANTCRED);
484 					break;
485 				case LOCAL_CONNWAIT:
486 					OPTSET(UNP_CONNWAIT);
487 					break;
488 				}
489 			}
490 			break;
491 #undef OPTSET
492 
493 		default:
494 			error = ENOPROTOOPT;
495 			break;
496 		}
497 		if (m)
498 			(void) m_free(m);
499 		break;
500 
501 	case PRCO_GETOPT:
502 		switch (optname) {
503 		case LOCAL_PEEREID:
504 			if (unp->unp_flags & UNP_EIDSVALID) {
505 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
506 				m->m_len = sizeof(struct unpcbid);
507 				*mtod(m, struct unpcbid *) = unp->unp_connid;
508 			} else {
509 				error = EINVAL;
510 			}
511 			break;
512 		case LOCAL_CREDS:
513 			*mp = m = m_get(M_WAIT, MT_SOOPTS);
514 			m->m_len = sizeof(int);
515 
516 #define	OPTBIT(bit)	(unp->unp_flags & (bit) ? 1 : 0)
517 
518 			optval = OPTBIT(UNP_WANTCRED);
519 			*mtod(m, int *) = optval;
520 			break;
521 #undef OPTBIT
522 
523 		default:
524 			error = ENOPROTOOPT;
525 			break;
526 		}
527 		break;
528 	}
529 	return (error);
530 }
531 
532 /*
533  * Both send and receive buffers are allocated PIPSIZ bytes of buffering
534  * for stream sockets, although the total for sender and receiver is
535  * actually only PIPSIZ.
536  * Datagram sockets really use the sendspace as the maximum datagram size,
537  * and don't really want to reserve the sendspace.  Their recvspace should
538  * be large enough for at least one max-size datagram plus address.
539  */
540 #define	PIPSIZ	4096
541 u_long	unpst_sendspace = PIPSIZ;
542 u_long	unpst_recvspace = PIPSIZ;
543 u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
544 u_long	unpdg_recvspace = 4*1024;
545 
546 int	unp_rights;			/* file descriptors in flight */
547 
548 int
549 unp_attach(struct socket *so)
550 {
551 	struct unpcb *unp;
552 	int error;
553 
554 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
555 		switch (so->so_type) {
556 
557 		case SOCK_STREAM:
558 			error = soreserve(so, unpst_sendspace, unpst_recvspace);
559 			break;
560 
561 		case SOCK_DGRAM:
562 			error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
563 			break;
564 
565 		default:
566 			panic("unp_attach");
567 		}
568 		if (error)
569 			return (error);
570 	}
571 	unp = malloc(sizeof(*unp), M_PCB, M_NOWAIT);
572 	if (unp == NULL)
573 		return (ENOBUFS);
574 	memset((void *)unp, 0, sizeof(*unp));
575 	unp->unp_socket = so;
576 	so->so_pcb = unp;
577 	nanotime(&unp->unp_ctime);
578 	return (0);
579 }
580 
581 void
582 unp_detach(struct unpcb *unp)
583 {
584 
585 	if (unp->unp_vnode) {
586 		unp->unp_vnode->v_socket = 0;
587 		vrele(unp->unp_vnode);
588 		unp->unp_vnode = 0;
589 	}
590 	if (unp->unp_conn)
591 		unp_disconnect(unp);
592 	while (unp->unp_refs)
593 		unp_drop(unp->unp_refs, ECONNRESET);
594 	soisdisconnected(unp->unp_socket);
595 	unp->unp_socket->so_pcb = 0;
596 	if (unp->unp_addr)
597 		free(unp->unp_addr, M_SONAME);
598 	if (unp_rights) {
599 		/*
600 		 * Normally the receive buffer is flushed later,
601 		 * in sofree, but if our receive buffer holds references
602 		 * to descriptors that are now garbage, we will dispose
603 		 * of those descriptor references after the garbage collector
604 		 * gets them (resulting in a "panic: closef: count < 0").
605 		 */
606 		sorflush(unp->unp_socket);
607 		free(unp, M_PCB);
608 		unp_gc();
609 	} else
610 		free(unp, M_PCB);
611 }
612 
613 int
614 unp_bind(struct unpcb *unp, struct mbuf *nam, struct lwp *l)
615 {
616 	struct sockaddr_un *sun;
617 	struct vnode *vp;
618 	struct vattr vattr;
619 	size_t addrlen;
620 	struct proc *p;
621 	int error;
622 	struct nameidata nd;
623 
624 	if (unp->unp_vnode != 0)
625 		return (EINVAL);
626 
627 	p = l->l_proc;
628 	/*
629 	 * Allocate the new sockaddr.  We have to allocate one
630 	 * extra byte so that we can ensure that the pathname
631 	 * is nul-terminated.
632 	 */
633 	addrlen = nam->m_len + 1;
634 	sun = malloc(addrlen, M_SONAME, M_WAITOK);
635 	m_copydata(nam, 0, nam->m_len, (void *)sun);
636 	*(((char *)sun) + nam->m_len) = '\0';
637 
638 	NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT | TRYEMULROOT, UIO_SYSSPACE,
639 	    sun->sun_path);
640 
641 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
642 	if ((error = namei(&nd)) != 0)
643 		goto bad;
644 	vp = nd.ni_vp;
645 	if (vp != NULL) {
646 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
647 		if (nd.ni_dvp == vp)
648 			vrele(nd.ni_dvp);
649 		else
650 			vput(nd.ni_dvp);
651 		vrele(vp);
652 		error = EADDRINUSE;
653 		goto bad;
654 	}
655 	VATTR_NULL(&vattr);
656 	vattr.va_type = VSOCK;
657 	vattr.va_mode = ACCESSPERMS & ~(p->p_cwdi->cwdi_cmask);
658 	VOP_LEASE(nd.ni_dvp, l->l_cred, LEASE_WRITE);
659 	error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
660 	if (error)
661 		goto bad;
662 	vp = nd.ni_vp;
663 	vp->v_socket = unp->unp_socket;
664 	unp->unp_vnode = vp;
665 	unp->unp_addrlen = addrlen;
666 	unp->unp_addr = sun;
667 	unp->unp_connid.unp_pid = p->p_pid;
668 	unp->unp_connid.unp_euid = kauth_cred_geteuid(p->p_cred);
669 	unp->unp_connid.unp_egid = kauth_cred_getegid(p->p_cred);
670 	unp->unp_flags |= UNP_EIDSBIND;
671 	VOP_UNLOCK(vp, 0);
672 	return (0);
673 
674  bad:
675 	free(sun, M_SONAME);
676 	return (error);
677 }
678 
679 int
680 unp_connect(struct socket *so, struct mbuf *nam, struct lwp *l)
681 {
682 	struct sockaddr_un *sun;
683 	struct vnode *vp;
684 	struct socket *so2, *so3;
685 	struct unpcb *unp, *unp2, *unp3;
686 	size_t addrlen;
687 	struct proc *p;
688 	int error;
689 	struct nameidata nd;
690 
691 	p = l->l_proc;
692 	/*
693 	 * Allocate a temporary sockaddr.  We have to allocate one extra
694 	 * byte so that we can ensure that the pathname is nul-terminated.
695 	 * When we establish the connection, we copy the other PCB's
696 	 * sockaddr to our own.
697 	 */
698 	addrlen = nam->m_len + 1;
699 	sun = malloc(addrlen, M_SONAME, M_WAITOK);
700 	m_copydata(nam, 0, nam->m_len, (void *)sun);
701 	*(((char *)sun) + nam->m_len) = '\0';
702 
703 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | TRYEMULROOT, UIO_SYSSPACE,
704 	    sun->sun_path);
705 
706 	if ((error = namei(&nd)) != 0)
707 		goto bad2;
708 	vp = nd.ni_vp;
709 	if (vp->v_type != VSOCK) {
710 		error = ENOTSOCK;
711 		goto bad;
712 	}
713 	if ((error = VOP_ACCESS(vp, VWRITE, l->l_cred)) != 0)
714 		goto bad;
715 	so2 = vp->v_socket;
716 	if (so2 == 0) {
717 		error = ECONNREFUSED;
718 		goto bad;
719 	}
720 	if (so->so_type != so2->so_type) {
721 		error = EPROTOTYPE;
722 		goto bad;
723 	}
724 	if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
725 		if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
726 		    (so3 = sonewconn(so2, 0)) == 0) {
727 			error = ECONNREFUSED;
728 			goto bad;
729 		}
730 		unp = sotounpcb(so);
731 		unp2 = sotounpcb(so2);
732 		unp3 = sotounpcb(so3);
733 		if (unp2->unp_addr) {
734 			unp3->unp_addr = malloc(unp2->unp_addrlen,
735 			    M_SONAME, M_WAITOK);
736 			memcpy(unp3->unp_addr, unp2->unp_addr,
737 			    unp2->unp_addrlen);
738 			unp3->unp_addrlen = unp2->unp_addrlen;
739 		}
740 		unp3->unp_flags = unp2->unp_flags;
741 		unp3->unp_connid.unp_pid = p->p_pid;
742 		unp3->unp_connid.unp_euid = kauth_cred_geteuid(p->p_cred);
743 		unp3->unp_connid.unp_egid = kauth_cred_getegid(p->p_cred);
744 		unp3->unp_flags |= UNP_EIDSVALID;
745 		so2 = so3;
746 		if (unp2->unp_flags & UNP_EIDSBIND) {
747 			unp->unp_connid = unp2->unp_connid;
748 			unp->unp_flags |= UNP_EIDSVALID;
749 		}
750 	}
751 	error = unp_connect2(so, so2, PRU_CONNECT);
752  bad:
753 	vput(vp);
754  bad2:
755 	free(sun, M_SONAME);
756 	return (error);
757 }
758 
759 int
760 unp_connect2(struct socket *so, struct socket *so2, int req)
761 {
762 	struct unpcb *unp = sotounpcb(so);
763 	struct unpcb *unp2;
764 
765 	if (so2->so_type != so->so_type)
766 		return (EPROTOTYPE);
767 	unp2 = sotounpcb(so2);
768 	unp->unp_conn = unp2;
769 	switch (so->so_type) {
770 
771 	case SOCK_DGRAM:
772 		unp->unp_nextref = unp2->unp_refs;
773 		unp2->unp_refs = unp;
774 		soisconnected(so);
775 		break;
776 
777 	case SOCK_STREAM:
778 		unp2->unp_conn = unp;
779 		if (req == PRU_CONNECT &&
780 		    ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
781 			soisconnecting(so);
782 		else
783 			soisconnected(so);
784 		soisconnected(so2);
785 		break;
786 
787 	default:
788 		panic("unp_connect2");
789 	}
790 	return (0);
791 }
792 
793 void
794 unp_disconnect(struct unpcb *unp)
795 {
796 	struct unpcb *unp2 = unp->unp_conn;
797 
798 	if (unp2 == 0)
799 		return;
800 	unp->unp_conn = 0;
801 	switch (unp->unp_socket->so_type) {
802 
803 	case SOCK_DGRAM:
804 		if (unp2->unp_refs == unp)
805 			unp2->unp_refs = unp->unp_nextref;
806 		else {
807 			unp2 = unp2->unp_refs;
808 			for (;;) {
809 				if (unp2 == 0)
810 					panic("unp_disconnect");
811 				if (unp2->unp_nextref == unp)
812 					break;
813 				unp2 = unp2->unp_nextref;
814 			}
815 			unp2->unp_nextref = unp->unp_nextref;
816 		}
817 		unp->unp_nextref = 0;
818 		unp->unp_socket->so_state &= ~SS_ISCONNECTED;
819 		break;
820 
821 	case SOCK_STREAM:
822 		soisdisconnected(unp->unp_socket);
823 		unp2->unp_conn = 0;
824 		soisdisconnected(unp2->unp_socket);
825 		break;
826 	}
827 }
828 
829 #ifdef notdef
830 unp_abort(struct unpcb *unp)
831 {
832 	unp_detach(unp);
833 }
834 #endif
835 
836 void
837 unp_shutdown(struct unpcb *unp)
838 {
839 	struct socket *so;
840 
841 	if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn &&
842 	    (so = unp->unp_conn->unp_socket))
843 		socantrcvmore(so);
844 }
845 
846 void
847 unp_drop(struct unpcb *unp, int errno)
848 {
849 	struct socket *so = unp->unp_socket;
850 
851 	so->so_error = errno;
852 	unp_disconnect(unp);
853 	if (so->so_head) {
854 		so->so_pcb = 0;
855 		sofree(so);
856 		if (unp->unp_addr)
857 			free(unp->unp_addr, M_SONAME);
858 		free(unp, M_PCB);
859 	}
860 }
861 
862 #ifdef notdef
863 unp_drain(void)
864 {
865 
866 }
867 #endif
868 
869 int
870 unp_externalize(struct mbuf *rights, struct lwp *l)
871 {
872 	struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
873 	struct proc *p = l->l_proc;
874 	int i, *fdp;
875 	struct file **rp;
876 	struct file *fp;
877 	int nfds, error = 0;
878 
879 	nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) /
880 	    sizeof(struct file *);
881 	rp = (struct file **)CMSG_DATA(cm);
882 
883 	fdp = malloc(nfds * sizeof(int), M_TEMP, M_WAITOK);
884 	rw_enter(&p->p_cwdi->cwdi_lock, RW_READER);
885 
886 	/* Make sure the recipient should be able to see the descriptors.. */
887 	if (p->p_cwdi->cwdi_rdir != NULL) {
888 		rp = (struct file **)CMSG_DATA(cm);
889 		for (i = 0; i < nfds; i++) {
890 			fp = *rp++;
891 			/*
892 			 * If we are in a chroot'ed directory, and
893 			 * someone wants to pass us a directory, make
894 			 * sure it's inside the subtree we're allowed
895 			 * to access.
896 			 */
897 			if (fp->f_type == DTYPE_VNODE) {
898 				struct vnode *vp = (struct vnode *)fp->f_data;
899 				if ((vp->v_type == VDIR) &&
900 				    !vn_isunder(vp, p->p_cwdi->cwdi_rdir, l)) {
901 					error = EPERM;
902 					break;
903 				}
904 			}
905 		}
906 	}
907 
908  restart:
909 	rp = (struct file **)CMSG_DATA(cm);
910 	if (error != 0) {
911 		for (i = 0; i < nfds; i++) {
912 			fp = *rp;
913 			/*
914 			 * zero the pointer before calling unp_discard,
915 			 * since it may end up in unp_gc()..
916 			 */
917 			*rp++ = 0;
918 			unp_discard(fp);
919 		}
920 		goto out;
921 	}
922 
923 	/*
924 	 * First loop -- allocate file descriptor table slots for the
925 	 * new descriptors.
926 	 */
927 	for (i = 0; i < nfds; i++) {
928 		fp = *rp++;
929 		if ((error = fdalloc(p, 0, &fdp[i])) != 0) {
930 			/*
931 			 * Back out what we've done so far.
932 			 */
933 			for (--i; i >= 0; i--)
934 				fdremove(p->p_fd, fdp[i]);
935 
936 			if (error == ENOSPC) {
937 				fdexpand(p);
938 				error = 0;
939 			} else {
940 				/*
941 				 * This is the error that has historically
942 				 * been returned, and some callers may
943 				 * expect it.
944 				 */
945 				error = EMSGSIZE;
946 			}
947 			goto restart;
948 		}
949 
950 		/*
951 		 * Make the slot reference the descriptor so that
952 		 * fdalloc() works properly.. We finalize it all
953 		 * in the loop below.
954 		 */
955 		rw_enter(&p->p_fd->fd_lock, RW_WRITER);
956 		p->p_fd->fd_ofiles[fdp[i]] = fp;
957 		rw_exit(&p->p_fd->fd_lock);
958 	}
959 
960 	/*
961 	 * Now that adding them has succeeded, update all of the
962 	 * descriptor passing state.
963 	 */
964 	rp = (struct file **)CMSG_DATA(cm);
965 	for (i = 0; i < nfds; i++) {
966 		fp = *rp++;
967 		fp->f_msgcount--;
968 		unp_rights--;
969 	}
970 
971 	/*
972 	 * Copy temporary array to message and adjust length, in case of
973 	 * transition from large struct file pointers to ints.
974 	 */
975 	memcpy(CMSG_DATA(cm), fdp, nfds * sizeof(int));
976 	cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
977 	rights->m_len = CMSG_SPACE(nfds * sizeof(int));
978  out:
979 	rw_exit(&p->p_cwdi->cwdi_lock);
980 	free(fdp, M_TEMP);
981 	return (error);
982 }
983 
984 int
985 unp_internalize(struct mbuf *control, struct lwp *l)
986 {
987 	struct proc *p = l->l_proc;
988 	struct filedesc *fdescp = p->p_fd;
989 	struct cmsghdr *newcm, *cm = mtod(control, struct cmsghdr *);
990 	struct file **rp, **files;
991 	struct file *fp;
992 	int i, fd, *fdp;
993 	int nfds;
994 	u_int neededspace;
995 
996 	/* Sanity check the control message header */
997 	if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
998 	    cm->cmsg_len != control->m_len)
999 		return (EINVAL);
1000 
1001 	/* Verify that the file descriptors are valid */
1002 	nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int);
1003 	fdp = (int *)CMSG_DATA(cm);
1004 	for (i = 0; i < nfds; i++) {
1005 		fd = *fdp++;
1006 		if ((fp = fd_getfile(fdescp, fd)) == NULL)
1007 			return (EBADF);
1008 		/* XXXSMP grab reference to file */
1009 		mutex_exit(&fp->f_lock);
1010 	}
1011 
1012 	/* Make sure we have room for the struct file pointers */
1013 	neededspace = CMSG_SPACE(nfds * sizeof(struct file *)) -
1014 	    control->m_len;
1015 	if (neededspace > M_TRAILINGSPACE(control)) {
1016 
1017 		/* allocate new space and copy header into it */
1018 		newcm = malloc(
1019 		    CMSG_SPACE(nfds * sizeof(struct file *)),
1020 		    M_MBUF, M_WAITOK);
1021 		if (newcm == NULL) {
1022 			/* XXXSMP drop references to files */
1023 			return (E2BIG);
1024 		}
1025 		memcpy(newcm, cm, sizeof(struct cmsghdr));
1026 		files = (struct file **)CMSG_DATA(newcm);
1027 	} else {
1028 		/* we can convert in-place */
1029 		newcm = NULL;
1030 		files = (struct file **)CMSG_DATA(cm);
1031 	}
1032 
1033 	/*
1034 	 * Transform the file descriptors into struct file pointers, in
1035 	 * reverse order so that if pointers are bigger than ints, the
1036 	 * int won't get until we're done.
1037 	 */
1038 	rw_enter(&fdescp->fd_lock, RW_READER);
1039 	fdp = (int *)CMSG_DATA(cm) + nfds;
1040 	rp = files + nfds;
1041 	for (i = 0; i < nfds; i++) {
1042 		fp = fdescp->fd_ofiles[*--fdp];
1043 		mutex_enter(&fp->f_lock);
1044 #ifdef DIAGNOSTIC
1045 		if (fp->f_iflags & FIF_WANTCLOSE)
1046 			panic("unp_internalize: file already closed");
1047 #endif
1048 		*--rp = fp;
1049 		fp->f_count++;
1050 		fp->f_msgcount++;
1051 		mutex_exit(&fp->f_lock);
1052 		unp_rights++;
1053 	}
1054 	rw_exit(&fdescp->fd_lock);
1055 
1056 	if (newcm) {
1057 		if (control->m_flags & M_EXT)
1058 			MEXTREMOVE(control);
1059 		MEXTADD(control, newcm,
1060 		    CMSG_SPACE(nfds * sizeof(struct file *)),
1061 		    M_MBUF, NULL, NULL);
1062 		cm = newcm;
1063 	}
1064 
1065 	/* adjust message & mbuf to note amount of space actually used. */
1066 	cm->cmsg_len = CMSG_LEN(nfds * sizeof(struct file *));
1067 	control->m_len = CMSG_SPACE(nfds * sizeof(struct file *));
1068 
1069 	return (0);
1070 }
1071 
1072 struct mbuf *
1073 unp_addsockcred(struct lwp *l, struct mbuf *control)
1074 {
1075 	struct cmsghdr *cmp;
1076 	struct sockcred *sc;
1077 	struct mbuf *m, *n;
1078 	int len, space, i;
1079 
1080 	len = CMSG_LEN(SOCKCREDSIZE(kauth_cred_ngroups(l->l_cred)));
1081 	space = CMSG_SPACE(SOCKCREDSIZE(kauth_cred_ngroups(l->l_cred)));
1082 
1083 	m = m_get(M_WAIT, MT_CONTROL);
1084 	if (space > MLEN) {
1085 		if (space > MCLBYTES)
1086 			MEXTMALLOC(m, space, M_WAITOK);
1087 		else
1088 			m_clget(m, M_WAIT);
1089 		if ((m->m_flags & M_EXT) == 0) {
1090 			m_free(m);
1091 			return (control);
1092 		}
1093 	}
1094 
1095 	m->m_len = space;
1096 	m->m_next = NULL;
1097 	cmp = mtod(m, struct cmsghdr *);
1098 	sc = (struct sockcred *)CMSG_DATA(cmp);
1099 	cmp->cmsg_len = len;
1100 	cmp->cmsg_level = SOL_SOCKET;
1101 	cmp->cmsg_type = SCM_CREDS;
1102 	sc->sc_uid = kauth_cred_getuid(l->l_cred);
1103 	sc->sc_euid = kauth_cred_geteuid(l->l_cred);
1104 	sc->sc_gid = kauth_cred_getgid(l->l_cred);
1105 	sc->sc_egid = kauth_cred_getegid(l->l_cred);
1106 	sc->sc_ngroups = kauth_cred_ngroups(l->l_cred);
1107 	for (i = 0; i < sc->sc_ngroups; i++)
1108 		sc->sc_groups[i] = kauth_cred_group(l->l_cred, i);
1109 
1110 	/*
1111 	 * If a control message already exists, append us to the end.
1112 	 */
1113 	if (control != NULL) {
1114 		for (n = control; n->m_next != NULL; n = n->m_next)
1115 			;
1116 		n->m_next = m;
1117 	} else
1118 		control = m;
1119 
1120 	return (control);
1121 }
1122 
1123 int	unp_defer, unp_gcing;
1124 extern	struct domain unixdomain;
1125 
1126 /*
1127  * Comment added long after the fact explaining what's going on here.
1128  * Do a mark-sweep GC of file descriptors on the system, to free up
1129  * any which are caught in flight to an about-to-be-closed socket.
1130  *
1131  * Traditional mark-sweep gc's start at the "root", and mark
1132  * everything reachable from the root (which, in our case would be the
1133  * process table).  The mark bits are cleared during the sweep.
1134  *
1135  * XXX For some inexplicable reason (perhaps because the file
1136  * descriptor tables used to live in the u area which could be swapped
1137  * out and thus hard to reach), we do multiple scans over the set of
1138  * descriptors, using use *two* mark bits per object (DEFER and MARK).
1139  * Whenever we find a descriptor which references other descriptors,
1140  * the ones it references are marked with both bits, and we iterate
1141  * over the whole file table until there are no more DEFER bits set.
1142  * We also make an extra pass *before* the GC to clear the mark bits,
1143  * which could have been cleared at almost no cost during the previous
1144  * sweep.
1145  *
1146  * XXX MP: this needs to run with locks such that no other thread of
1147  * control can create or destroy references to file descriptors. it
1148  * may be necessary to defer the GC until later (when the locking
1149  * situation is more hospitable); it may be necessary to push this
1150  * into a separate thread.
1151  */
1152 void
1153 unp_gc(void)
1154 {
1155 	struct file *fp, *nextfp;
1156 	struct socket *so, *so1;
1157 	struct file **extra_ref, **fpp;
1158 	int nunref, i;
1159 
1160 	if (unp_gcing)
1161 		return;
1162 	unp_gcing = 1;
1163 	unp_defer = 0;
1164 
1165 	mutex_enter(&filelist_lock);
1166 
1167 	/* Clear mark bits */
1168 	LIST_FOREACH(fp, &filehead, f_list)
1169 		fp->f_flag &= ~(FMARK|FDEFER);
1170 
1171 	/*
1172 	 * Iterate over the set of descriptors, marking ones believed
1173 	 * (based on refcount) to be referenced from a process, and
1174 	 * marking for rescan descriptors which are queued on a socket.
1175 	 */
1176 	do {
1177 		LIST_FOREACH(fp, &filehead, f_list) {
1178 		    	mutex_enter(&fp->f_lock);
1179 		    	if (fp->f_flag & FDEFER) {
1180 				fp->f_flag &= ~FDEFER;
1181 				unp_defer--;
1182 #ifdef DIAGNOSTIC
1183 				if (fp->f_count == 0)
1184 					panic("unp_gc: deferred unreferenced socket");
1185 #endif
1186 			} else {
1187 				if (fp->f_count == 0 ||
1188 				    (fp->f_flag & FMARK) ||
1189 				    fp->f_count == fp->f_msgcount) {
1190 				    	mutex_exit(&fp->f_lock);
1191 					continue;
1192 				}
1193 			}
1194 			fp->f_flag |= FMARK;
1195 
1196 			if (fp->f_type != DTYPE_SOCKET ||
1197 			    (so = (struct socket *)fp->f_data) == 0 ||
1198 			    so->so_proto->pr_domain != &unixdomain ||
1199 			    (so->so_proto->pr_flags&PR_RIGHTS) == 0) {
1200 			    	mutex_exit(&fp->f_lock);
1201 				continue;
1202 			}
1203 #ifdef notdef
1204 			if (so->so_rcv.sb_flags & SB_LOCK) {
1205 				/*
1206 				 * This is problematical; it's not clear
1207 				 * we need to wait for the sockbuf to be
1208 				 * unlocked (on a uniprocessor, at least),
1209 				 * and it's also not clear what to do
1210 				 * if sbwait returns an error due to receipt
1211 				 * of a signal.  If sbwait does return
1212 				 * an error, we'll go into an infinite
1213 				 * loop.  Delete all of this for now.
1214 				 */
1215 				(void) sbwait(&so->so_rcv);
1216 				goto restart;
1217 			}
1218 #endif
1219 		    	mutex_exit(&fp->f_lock);
1220 
1221 			unp_scan(so->so_rcv.sb_mb, unp_mark, 0);
1222 			/*
1223 			 * mark descriptors referenced from sockets queued on the accept queue as well.
1224 			 */
1225 			if (so->so_options & SO_ACCEPTCONN) {
1226 				TAILQ_FOREACH(so1, &so->so_q0, so_qe) {
1227 					unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
1228 				}
1229 				TAILQ_FOREACH(so1, &so->so_q, so_qe) {
1230 					unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
1231 				}
1232 			}
1233 		}
1234 	} while (unp_defer);
1235 
1236 	mutex_exit(&filelist_lock);
1237 
1238 	/*
1239 	 * Sweep pass.  Find unmarked descriptors, and free them.
1240 	 *
1241 	 * We grab an extra reference to each of the file table entries
1242 	 * that are not otherwise accessible and then free the rights
1243 	 * that are stored in messages on them.
1244 	 *
1245 	 * The bug in the original code is a little tricky, so I'll describe
1246 	 * what's wrong with it here.
1247 	 *
1248 	 * It is incorrect to simply unp_discard each entry for f_msgcount
1249 	 * times -- consider the case of sockets A and B that contain
1250 	 * references to each other.  On a last close of some other socket,
1251 	 * we trigger a gc since the number of outstanding rights (unp_rights)
1252 	 * is non-zero.  If during the sweep phase the gc code un_discards,
1253 	 * we end up doing a (full) closef on the descriptor.  A closef on A
1254 	 * results in the following chain.  Closef calls soo_close, which
1255 	 * calls soclose.   Soclose calls first (through the switch
1256 	 * uipc_usrreq) unp_detach, which re-invokes unp_gc.  Unp_gc simply
1257 	 * returns because the previous instance had set unp_gcing, and
1258 	 * we return all the way back to soclose, which marks the socket
1259 	 * with SS_NOFDREF, and then calls sofree.  Sofree calls sorflush
1260 	 * to free up the rights that are queued in messages on the socket A,
1261 	 * i.e., the reference on B.  The sorflush calls via the dom_dispose
1262 	 * switch unp_dispose, which unp_scans with unp_discard.  This second
1263 	 * instance of unp_discard just calls closef on B.
1264 	 *
1265 	 * Well, a similar chain occurs on B, resulting in a sorflush on B,
1266 	 * which results in another closef on A.  Unfortunately, A is already
1267 	 * being closed, and the descriptor has already been marked with
1268 	 * SS_NOFDREF, and soclose panics at this point.
1269 	 *
1270 	 * Here, we first take an extra reference to each inaccessible
1271 	 * descriptor.  Then, if the inaccessible descriptor is a
1272 	 * socket, we call sorflush in case it is a Unix domain
1273 	 * socket.  After we destroy all the rights carried in
1274 	 * messages, we do a last closef to get rid of our extra
1275 	 * reference.  This is the last close, and the unp_detach etc
1276 	 * will shut down the socket.
1277 	 *
1278 	 * 91/09/19, bsy@cs.cmu.edu
1279 	 */
1280 	extra_ref = kmem_alloc(nfiles * sizeof(struct file *), KM_SLEEP);
1281 
1282 	mutex_enter(&filelist_lock);
1283 	for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; fp != 0;
1284 	    fp = nextfp) {
1285 		nextfp = LIST_NEXT(fp, f_list);
1286 		mutex_enter(&fp->f_lock);
1287 		if (fp->f_count != 0 &&
1288 		    fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
1289 			*fpp++ = fp;
1290 			nunref++;
1291 			fp->f_count++;
1292 		}
1293 		mutex_exit(&fp->f_lock);
1294 	}
1295 	mutex_exit(&filelist_lock);
1296 
1297 	for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
1298 		fp = *fpp;
1299 		mutex_enter(&fp->f_lock);
1300 		FILE_USE(fp);
1301 		if (fp->f_type == DTYPE_SOCKET)
1302 			sorflush((struct socket *)fp->f_data);
1303 		FILE_UNUSE(fp, NULL);
1304 	}
1305 	for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
1306 		fp = *fpp;
1307 		mutex_enter(&fp->f_lock);
1308 		FILE_USE(fp);
1309 		(void) closef(fp, (struct lwp *)0);
1310 	}
1311 	kmem_free(extra_ref, nfiles * sizeof(struct file *));
1312 	unp_gcing = 0;
1313 }
1314 
1315 void
1316 unp_dispose(struct mbuf *m)
1317 {
1318 
1319 	if (m)
1320 		unp_scan(m, unp_discard, 1);
1321 }
1322 
1323 void
1324 unp_scan(struct mbuf *m0, void (*op)(struct file *), int discard)
1325 {
1326 	struct mbuf *m;
1327 	struct file **rp;
1328 	struct cmsghdr *cm;
1329 	int i;
1330 	int qfds;
1331 
1332 	while (m0) {
1333 		for (m = m0; m; m = m->m_next) {
1334 			if (m->m_type == MT_CONTROL &&
1335 			    m->m_len >= sizeof(*cm)) {
1336 				cm = mtod(m, struct cmsghdr *);
1337 				if (cm->cmsg_level != SOL_SOCKET ||
1338 				    cm->cmsg_type != SCM_RIGHTS)
1339 					continue;
1340 				qfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm)))
1341 				    / sizeof(struct file *);
1342 				rp = (struct file **)CMSG_DATA(cm);
1343 				for (i = 0; i < qfds; i++) {
1344 					struct file *fp = *rp;
1345 					if (discard)
1346 						*rp = 0;
1347 					(*op)(fp);
1348 					rp++;
1349 				}
1350 				break;		/* XXX, but saves time */
1351 			}
1352 		}
1353 		m0 = m0->m_nextpkt;
1354 	}
1355 }
1356 
1357 void
1358 unp_mark(struct file *fp)
1359 {
1360 
1361 	if (fp == NULL)
1362 		return;
1363 
1364 	/* If we're already deferred, don't screw up the defer count */
1365 	mutex_enter(&fp->f_lock);
1366 	if (fp->f_flag & (FMARK | FDEFER)) {
1367 		mutex_exit(&fp->f_lock);
1368 		return;
1369 	}
1370 
1371 	/*
1372 	 * Minimize the number of deferrals...  Sockets are the only
1373 	 * type of descriptor which can hold references to another
1374 	 * descriptor, so just mark other descriptors, and defer
1375 	 * unmarked sockets for the next pass.
1376 	 */
1377 	if (fp->f_type == DTYPE_SOCKET) {
1378 		unp_defer++;
1379 		if (fp->f_count == 0)
1380 			panic("unp_mark: queued unref");
1381 		fp->f_flag |= FDEFER;
1382 	} else {
1383 		fp->f_flag |= FMARK;
1384 	}
1385 	mutex_exit(&fp->f_lock);
1386 	return;
1387 }
1388 
1389 void
1390 unp_discard(struct file *fp)
1391 {
1392 	if (fp == NULL)
1393 		return;
1394 	mutex_enter(&fp->f_lock);
1395 	fp->f_usecount++;	/* i.e. FILE_USE(fp) sans locking */
1396 	fp->f_msgcount--;
1397 	mutex_exit(&fp->f_lock);
1398 	unp_rights--;
1399 	(void) closef(fp, (struct lwp *)0);
1400 }
1401