xref: /netbsd-src/sys/kern/uipc_usrreq.c (revision ce2c90c7c172d95d2402a5b3d96d8f8e6d138a21)
1 /*	$NetBSD: uipc_usrreq.c,v 1.93 2006/09/03 21:15:29 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2004 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the NetBSD
22  *	Foundation, Inc. and its contributors.
23  * 4. Neither the name of The NetBSD Foundation nor the names of its
24  *    contributors may be used to endorse or promote products derived
25  *    from this software without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37  * POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * Copyright (c) 1982, 1986, 1989, 1991, 1993
42  *	The Regents of the University of California.  All rights reserved.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. Neither the name of the University nor the names of its contributors
53  *    may be used to endorse or promote products derived from this software
54  *    without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66  * SUCH DAMAGE.
67  *
68  *	@(#)uipc_usrreq.c	8.9 (Berkeley) 5/14/95
69  */
70 
71 /*
72  * Copyright (c) 1997 Christopher G. Demetriou.  All rights reserved.
73  *
74  * Redistribution and use in source and binary forms, with or without
75  * modification, are permitted provided that the following conditions
76  * are met:
77  * 1. Redistributions of source code must retain the above copyright
78  *    notice, this list of conditions and the following disclaimer.
79  * 2. Redistributions in binary form must reproduce the above copyright
80  *    notice, this list of conditions and the following disclaimer in the
81  *    documentation and/or other materials provided with the distribution.
82  * 3. All advertising materials mentioning features or use of this software
83  *    must display the following acknowledgement:
84  *	This product includes software developed by the University of
85  *	California, Berkeley and its contributors.
86  * 4. Neither the name of the University nor the names of its contributors
87  *    may be used to endorse or promote products derived from this software
88  *    without specific prior written permission.
89  *
90  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
91  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
92  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
93  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
94  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
95  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
96  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
97  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
98  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
99  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
100  * SUCH DAMAGE.
101  *
102  *	@(#)uipc_usrreq.c	8.9 (Berkeley) 5/14/95
103  */
104 
105 #include <sys/cdefs.h>
106 __KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.93 2006/09/03 21:15:29 christos Exp $");
107 
108 #include <sys/param.h>
109 #include <sys/systm.h>
110 #include <sys/proc.h>
111 #include <sys/filedesc.h>
112 #include <sys/domain.h>
113 #include <sys/protosw.h>
114 #include <sys/socket.h>
115 #include <sys/socketvar.h>
116 #include <sys/unpcb.h>
117 #include <sys/un.h>
118 #include <sys/namei.h>
119 #include <sys/vnode.h>
120 #include <sys/file.h>
121 #include <sys/stat.h>
122 #include <sys/mbuf.h>
123 #include <sys/kauth.h>
124 
125 /*
126  * Unix communications domain.
127  *
128  * TODO:
129  *	SEQPACKET, RDM
130  *	rethink name space problems
131  *	need a proper out-of-band
132  */
133 const struct sockaddr_un sun_noname = {
134 	.sun_len = sizeof(sun_noname),
135 	.sun_family = AF_LOCAL,
136 };
137 ino_t	unp_ino;			/* prototype for fake inode numbers */
138 
139 struct mbuf *unp_addsockcred(struct lwp *, struct mbuf *);
140 
141 int
142 unp_output(struct mbuf *m, struct mbuf *control, struct unpcb *unp,
143 	struct lwp *l)
144 {
145 	struct socket *so2;
146 	const struct sockaddr_un *sun;
147 
148 	so2 = unp->unp_conn->unp_socket;
149 	if (unp->unp_addr)
150 		sun = unp->unp_addr;
151 	else
152 		sun = &sun_noname;
153 	if (unp->unp_conn->unp_flags & UNP_WANTCRED)
154 		control = unp_addsockcred(l, control);
155 	if (sbappendaddr(&so2->so_rcv, (const struct sockaddr *)sun, m,
156 	    control) == 0) {
157 		m_freem(control);
158 		m_freem(m);
159 		so2->so_rcv.sb_overflowed++;
160 		return (ENOBUFS);
161 	} else {
162 		sorwakeup(so2);
163 		return (0);
164 	}
165 }
166 
167 void
168 unp_setsockaddr(struct unpcb *unp, struct mbuf *nam)
169 {
170 	const struct sockaddr_un *sun;
171 
172 	if (unp->unp_addr)
173 		sun = unp->unp_addr;
174 	else
175 		sun = &sun_noname;
176 	nam->m_len = sun->sun_len;
177 	if (nam->m_len > MLEN)
178 		MEXTMALLOC(nam, nam->m_len, M_WAITOK);
179 	memcpy(mtod(nam, caddr_t), sun, (size_t)nam->m_len);
180 }
181 
182 void
183 unp_setpeeraddr(struct unpcb *unp, struct mbuf *nam)
184 {
185 	const struct sockaddr_un *sun;
186 
187 	if (unp->unp_conn && unp->unp_conn->unp_addr)
188 		sun = unp->unp_conn->unp_addr;
189 	else
190 		sun = &sun_noname;
191 	nam->m_len = sun->sun_len;
192 	if (nam->m_len > MLEN)
193 		MEXTMALLOC(nam, nam->m_len, M_WAITOK);
194 	memcpy(mtod(nam, caddr_t), sun, (size_t)nam->m_len);
195 }
196 
197 /*ARGSUSED*/
198 int
199 uipc_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
200 	struct mbuf *control, struct lwp *l)
201 {
202 	struct unpcb *unp = sotounpcb(so);
203 	struct socket *so2;
204 	struct proc *p;
205 	u_int newhiwat;
206 	int error = 0;
207 
208 	if (req == PRU_CONTROL)
209 		return (EOPNOTSUPP);
210 
211 #ifdef DIAGNOSTIC
212 	if (req != PRU_SEND && req != PRU_SENDOOB && control)
213 		panic("uipc_usrreq: unexpected control mbuf");
214 #endif
215 	p = l ? l->l_proc : NULL;
216 	if (unp == 0 && req != PRU_ATTACH) {
217 		error = EINVAL;
218 		goto release;
219 	}
220 
221 	switch (req) {
222 
223 	case PRU_ATTACH:
224 		if (unp != 0) {
225 			error = EISCONN;
226 			break;
227 		}
228 		error = unp_attach(so);
229 		break;
230 
231 	case PRU_DETACH:
232 		unp_detach(unp);
233 		break;
234 
235 	case PRU_BIND:
236 		KASSERT(l != NULL);
237 		error = unp_bind(unp, nam, l);
238 		break;
239 
240 	case PRU_LISTEN:
241 		if (unp->unp_vnode == 0)
242 			error = EINVAL;
243 		break;
244 
245 	case PRU_CONNECT:
246 		KASSERT(l != NULL);
247 		error = unp_connect(so, nam, l);
248 		break;
249 
250 	case PRU_CONNECT2:
251 		error = unp_connect2(so, (struct socket *)nam, PRU_CONNECT2);
252 		break;
253 
254 	case PRU_DISCONNECT:
255 		unp_disconnect(unp);
256 		break;
257 
258 	case PRU_ACCEPT:
259 		unp_setpeeraddr(unp, nam);
260 		/*
261 		 * Mark the initiating STREAM socket as connected *ONLY*
262 		 * after it's been accepted.  This prevents a client from
263 		 * overrunning a server and receiving ECONNREFUSED.
264 		 */
265 		if (unp->unp_conn != NULL &&
266 		    (unp->unp_conn->unp_socket->so_state & SS_ISCONNECTING))
267 			soisconnected(unp->unp_conn->unp_socket);
268 		break;
269 
270 	case PRU_SHUTDOWN:
271 		socantsendmore(so);
272 		unp_shutdown(unp);
273 		break;
274 
275 	case PRU_RCVD:
276 		switch (so->so_type) {
277 
278 		case SOCK_DGRAM:
279 			panic("uipc 1");
280 			/*NOTREACHED*/
281 
282 		case SOCK_STREAM:
283 #define	rcv (&so->so_rcv)
284 #define snd (&so2->so_snd)
285 			if (unp->unp_conn == 0)
286 				break;
287 			so2 = unp->unp_conn->unp_socket;
288 			/*
289 			 * Adjust backpressure on sender
290 			 * and wakeup any waiting to write.
291 			 */
292 			snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
293 			unp->unp_mbcnt = rcv->sb_mbcnt;
294 			newhiwat = snd->sb_hiwat + unp->unp_cc - rcv->sb_cc;
295 			(void)chgsbsize(so2->so_uidinfo,
296 			    &snd->sb_hiwat, newhiwat, RLIM_INFINITY);
297 			unp->unp_cc = rcv->sb_cc;
298 			sowwakeup(so2);
299 #undef snd
300 #undef rcv
301 			break;
302 
303 		default:
304 			panic("uipc 2");
305 		}
306 		break;
307 
308 	case PRU_SEND:
309 		/*
310 		 * Note: unp_internalize() rejects any control message
311 		 * other than SCM_RIGHTS, and only allows one.  This
312 		 * has the side-effect of preventing a caller from
313 		 * forging SCM_CREDS.
314 		 */
315 		if (control) {
316 			KASSERT(l != NULL);
317 			if ((error = unp_internalize(control, l)) != 0)
318 				goto die;
319 		}
320 		switch (so->so_type) {
321 
322 		case SOCK_DGRAM: {
323 			if (nam) {
324 				if ((so->so_state & SS_ISCONNECTED) != 0) {
325 					error = EISCONN;
326 					goto die;
327 				}
328 				KASSERT(l != NULL);
329 				error = unp_connect(so, nam, l);
330 				if (error) {
331 				die:
332 					m_freem(control);
333 					m_freem(m);
334 					break;
335 				}
336 			} else {
337 				if ((so->so_state & SS_ISCONNECTED) == 0) {
338 					error = ENOTCONN;
339 					goto die;
340 				}
341 			}
342 			KASSERT(p != NULL);
343 			error = unp_output(m, control, unp, l);
344 			if (nam)
345 				unp_disconnect(unp);
346 			break;
347 		}
348 
349 		case SOCK_STREAM:
350 #define	rcv (&so2->so_rcv)
351 #define	snd (&so->so_snd)
352 			if (unp->unp_conn == NULL) {
353 				error = ENOTCONN;
354 				break;
355 			}
356 			so2 = unp->unp_conn->unp_socket;
357 			if (unp->unp_conn->unp_flags & UNP_WANTCRED) {
358 				/*
359 				 * Credentials are passed only once on
360 				 * SOCK_STREAM.
361 				 */
362 				unp->unp_conn->unp_flags &= ~UNP_WANTCRED;
363 				control = unp_addsockcred(l, control);
364 			}
365 			/*
366 			 * Send to paired receive port, and then reduce
367 			 * send buffer hiwater marks to maintain backpressure.
368 			 * Wake up readers.
369 			 */
370 			if (control) {
371 				if (sbappendcontrol(rcv, m, control) == 0)
372 					m_freem(control);
373 			} else
374 				sbappend(rcv, m);
375 			snd->sb_mbmax -=
376 			    rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
377 			unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
378 			newhiwat = snd->sb_hiwat -
379 			    (rcv->sb_cc - unp->unp_conn->unp_cc);
380 			(void)chgsbsize(so->so_uidinfo,
381 			    &snd->sb_hiwat, newhiwat, RLIM_INFINITY);
382 			unp->unp_conn->unp_cc = rcv->sb_cc;
383 			sorwakeup(so2);
384 #undef snd
385 #undef rcv
386 			break;
387 
388 		default:
389 			panic("uipc 4");
390 		}
391 		break;
392 
393 	case PRU_ABORT:
394 		unp_drop(unp, ECONNABORTED);
395 
396 		KASSERT(so->so_head == NULL);
397 #ifdef DIAGNOSTIC
398 		if (so->so_pcb == 0)
399 			panic("uipc 5: drop killed pcb");
400 #endif
401 		unp_detach(unp);
402 		break;
403 
404 	case PRU_SENSE:
405 		((struct stat *) m)->st_blksize = so->so_snd.sb_hiwat;
406 		if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
407 			so2 = unp->unp_conn->unp_socket;
408 			((struct stat *) m)->st_blksize += so2->so_rcv.sb_cc;
409 		}
410 		((struct stat *) m)->st_dev = NODEV;
411 		if (unp->unp_ino == 0)
412 			unp->unp_ino = unp_ino++;
413 		((struct stat *) m)->st_atimespec =
414 		    ((struct stat *) m)->st_mtimespec =
415 		    ((struct stat *) m)->st_ctimespec = unp->unp_ctime;
416 		((struct stat *) m)->st_ino = unp->unp_ino;
417 		return (0);
418 
419 	case PRU_RCVOOB:
420 		error = EOPNOTSUPP;
421 		break;
422 
423 	case PRU_SENDOOB:
424 		m_freem(control);
425 		m_freem(m);
426 		error = EOPNOTSUPP;
427 		break;
428 
429 	case PRU_SOCKADDR:
430 		unp_setsockaddr(unp, nam);
431 		break;
432 
433 	case PRU_PEERADDR:
434 		unp_setpeeraddr(unp, nam);
435 		break;
436 
437 	default:
438 		panic("piusrreq");
439 	}
440 
441 release:
442 	return (error);
443 }
444 
445 /*
446  * Unix domain socket option processing.
447  */
448 int
449 uipc_ctloutput(int op, struct socket *so, int level, int optname,
450 	struct mbuf **mp)
451 {
452 	struct unpcb *unp = sotounpcb(so);
453 	struct mbuf *m = *mp;
454 	int optval = 0, error = 0;
455 
456 	if (level != 0) {
457 		error = EINVAL;
458 		if (op == PRCO_SETOPT && m)
459 			(void) m_free(m);
460 	} else switch (op) {
461 
462 	case PRCO_SETOPT:
463 		switch (optname) {
464 		case LOCAL_CREDS:
465 		case LOCAL_CONNWAIT:
466 			if (m == NULL || m->m_len != sizeof(int))
467 				error = EINVAL;
468 			else {
469 				optval = *mtod(m, int *);
470 				switch (optname) {
471 #define	OPTSET(bit) \
472 	if (optval) \
473 		unp->unp_flags |= (bit); \
474 	else \
475 		unp->unp_flags &= ~(bit);
476 
477 				case LOCAL_CREDS:
478 					OPTSET(UNP_WANTCRED);
479 					break;
480 				case LOCAL_CONNWAIT:
481 					OPTSET(UNP_CONNWAIT);
482 					break;
483 				}
484 			}
485 			break;
486 #undef OPTSET
487 
488 		default:
489 			error = ENOPROTOOPT;
490 			break;
491 		}
492 		if (m)
493 			(void) m_free(m);
494 		break;
495 
496 	case PRCO_GETOPT:
497 		switch (optname) {
498 		case LOCAL_CREDS:
499 			*mp = m = m_get(M_WAIT, MT_SOOPTS);
500 			m->m_len = sizeof(int);
501 			switch (optname) {
502 
503 #define	OPTBIT(bit)	(unp->unp_flags & (bit) ? 1 : 0)
504 
505 			case LOCAL_CREDS:
506 				optval = OPTBIT(UNP_WANTCRED);
507 				break;
508 			}
509 			*mtod(m, int *) = optval;
510 			break;
511 #undef OPTBIT
512 
513 		default:
514 			error = ENOPROTOOPT;
515 			break;
516 		}
517 		break;
518 	}
519 	return (error);
520 }
521 
522 /*
523  * Both send and receive buffers are allocated PIPSIZ bytes of buffering
524  * for stream sockets, although the total for sender and receiver is
525  * actually only PIPSIZ.
526  * Datagram sockets really use the sendspace as the maximum datagram size,
527  * and don't really want to reserve the sendspace.  Their recvspace should
528  * be large enough for at least one max-size datagram plus address.
529  */
530 #define	PIPSIZ	4096
531 u_long	unpst_sendspace = PIPSIZ;
532 u_long	unpst_recvspace = PIPSIZ;
533 u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
534 u_long	unpdg_recvspace = 4*1024;
535 
536 int	unp_rights;			/* file descriptors in flight */
537 
538 int
539 unp_attach(struct socket *so)
540 {
541 	struct unpcb *unp;
542 	int error;
543 
544 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
545 		switch (so->so_type) {
546 
547 		case SOCK_STREAM:
548 			error = soreserve(so, unpst_sendspace, unpst_recvspace);
549 			break;
550 
551 		case SOCK_DGRAM:
552 			error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
553 			break;
554 
555 		default:
556 			panic("unp_attach");
557 		}
558 		if (error)
559 			return (error);
560 	}
561 	unp = malloc(sizeof(*unp), M_PCB, M_NOWAIT);
562 	if (unp == NULL)
563 		return (ENOBUFS);
564 	memset((caddr_t)unp, 0, sizeof(*unp));
565 	unp->unp_socket = so;
566 	so->so_pcb = unp;
567 	nanotime(&unp->unp_ctime);
568 	return (0);
569 }
570 
571 void
572 unp_detach(struct unpcb *unp)
573 {
574 
575 	if (unp->unp_vnode) {
576 		unp->unp_vnode->v_socket = 0;
577 		vrele(unp->unp_vnode);
578 		unp->unp_vnode = 0;
579 	}
580 	if (unp->unp_conn)
581 		unp_disconnect(unp);
582 	while (unp->unp_refs)
583 		unp_drop(unp->unp_refs, ECONNRESET);
584 	soisdisconnected(unp->unp_socket);
585 	unp->unp_socket->so_pcb = 0;
586 	if (unp->unp_addr)
587 		free(unp->unp_addr, M_SONAME);
588 	if (unp_rights) {
589 		/*
590 		 * Normally the receive buffer is flushed later,
591 		 * in sofree, but if our receive buffer holds references
592 		 * to descriptors that are now garbage, we will dispose
593 		 * of those descriptor references after the garbage collector
594 		 * gets them (resulting in a "panic: closef: count < 0").
595 		 */
596 		sorflush(unp->unp_socket);
597 		free(unp, M_PCB);
598 		unp_gc();
599 	} else
600 		free(unp, M_PCB);
601 }
602 
603 int
604 unp_bind(struct unpcb *unp, struct mbuf *nam, struct lwp *l)
605 {
606 	struct sockaddr_un *sun;
607 	struct vnode *vp;
608 	struct mount *mp;
609 	struct vattr vattr;
610 	size_t addrlen;
611 	struct proc *p;
612 	int error;
613 	struct nameidata nd;
614 
615 	if (unp->unp_vnode != 0)
616 		return (EINVAL);
617 
618 	p = l->l_proc;
619 	/*
620 	 * Allocate the new sockaddr.  We have to allocate one
621 	 * extra byte so that we can ensure that the pathname
622 	 * is nul-terminated.
623 	 */
624 	addrlen = nam->m_len + 1;
625 	sun = malloc(addrlen, M_SONAME, M_WAITOK);
626 	m_copydata(nam, 0, nam->m_len, (caddr_t)sun);
627 	*(((char *)sun) + nam->m_len) = '\0';
628 
629 restart:
630 	NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
631 	    sun->sun_path, l);
632 
633 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
634 	if ((error = namei(&nd)) != 0)
635 		goto bad;
636 	vp = nd.ni_vp;
637 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
638 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
639 		if (nd.ni_dvp == vp)
640 			vrele(nd.ni_dvp);
641 		else
642 			vput(nd.ni_dvp);
643 		vrele(vp);
644 		if (vp != NULL) {
645 			error = EADDRINUSE;
646 			goto bad;
647 		}
648 		error = vn_start_write(NULL, &mp,
649 		    V_WAIT | V_SLEEPONLY | V_PCATCH);
650 		if (error)
651 			goto bad;
652 		goto restart;
653 	}
654 	VATTR_NULL(&vattr);
655 	vattr.va_type = VSOCK;
656 	vattr.va_mode = ACCESSPERMS & ~(p->p_cwdi->cwdi_cmask);
657 	VOP_LEASE(nd.ni_dvp, l, l->l_cred, LEASE_WRITE);
658 	error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
659 	vn_finished_write(mp, 0);
660 	if (error)
661 		goto bad;
662 	vp = nd.ni_vp;
663 	vp->v_socket = unp->unp_socket;
664 	unp->unp_vnode = vp;
665 	unp->unp_addrlen = addrlen;
666 	unp->unp_addr = sun;
667 	VOP_UNLOCK(vp, 0);
668 	return (0);
669 
670  bad:
671 	free(sun, M_SONAME);
672 	return (error);
673 }
674 
675 int
676 unp_connect(struct socket *so, struct mbuf *nam, struct lwp *l)
677 {
678 	struct sockaddr_un *sun;
679 	struct vnode *vp;
680 	struct socket *so2, *so3;
681 	struct unpcb *unp2, *unp3;
682 	size_t addrlen;
683 	int error;
684 	struct nameidata nd;
685 
686 	/*
687 	 * Allocate a temporary sockaddr.  We have to allocate one extra
688 	 * byte so that we can ensure that the pathname is nul-terminated.
689 	 * When we establish the connection, we copy the other PCB's
690 	 * sockaddr to our own.
691 	 */
692 	addrlen = nam->m_len + 1;
693 	sun = malloc(addrlen, M_SONAME, M_WAITOK);
694 	m_copydata(nam, 0, nam->m_len, (caddr_t)sun);
695 	*(((char *)sun) + nam->m_len) = '\0';
696 
697 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, sun->sun_path, l);
698 
699 	if ((error = namei(&nd)) != 0)
700 		goto bad2;
701 	vp = nd.ni_vp;
702 	if (vp->v_type != VSOCK) {
703 		error = ENOTSOCK;
704 		goto bad;
705 	}
706 	if ((error = VOP_ACCESS(vp, VWRITE, l->l_cred, l)) != 0)
707 		goto bad;
708 	so2 = vp->v_socket;
709 	if (so2 == 0) {
710 		error = ECONNREFUSED;
711 		goto bad;
712 	}
713 	if (so->so_type != so2->so_type) {
714 		error = EPROTOTYPE;
715 		goto bad;
716 	}
717 	if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
718 		if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
719 		    (so3 = sonewconn(so2, 0)) == 0) {
720 			error = ECONNREFUSED;
721 			goto bad;
722 		}
723 		unp2 = sotounpcb(so2);
724 		unp3 = sotounpcb(so3);
725 		if (unp2->unp_addr) {
726 			unp3->unp_addr = malloc(unp2->unp_addrlen,
727 			    M_SONAME, M_WAITOK);
728 			memcpy(unp3->unp_addr, unp2->unp_addr,
729 			    unp2->unp_addrlen);
730 			unp3->unp_addrlen = unp2->unp_addrlen;
731 		}
732 		unp3->unp_flags = unp2->unp_flags;
733 		so2 = so3;
734 	}
735 	error = unp_connect2(so, so2, PRU_CONNECT);
736  bad:
737 	vput(vp);
738  bad2:
739 	free(sun, M_SONAME);
740 	return (error);
741 }
742 
743 int
744 unp_connect2(struct socket *so, struct socket *so2, int req)
745 {
746 	struct unpcb *unp = sotounpcb(so);
747 	struct unpcb *unp2;
748 
749 	if (so2->so_type != so->so_type)
750 		return (EPROTOTYPE);
751 	unp2 = sotounpcb(so2);
752 	unp->unp_conn = unp2;
753 	switch (so->so_type) {
754 
755 	case SOCK_DGRAM:
756 		unp->unp_nextref = unp2->unp_refs;
757 		unp2->unp_refs = unp;
758 		soisconnected(so);
759 		break;
760 
761 	case SOCK_STREAM:
762 		unp2->unp_conn = unp;
763 		if (req == PRU_CONNECT &&
764 		    ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
765 			soisconnecting(so);
766 		else
767 			soisconnected(so);
768 		soisconnected(so2);
769 		break;
770 
771 	default:
772 		panic("unp_connect2");
773 	}
774 	return (0);
775 }
776 
777 void
778 unp_disconnect(struct unpcb *unp)
779 {
780 	struct unpcb *unp2 = unp->unp_conn;
781 
782 	if (unp2 == 0)
783 		return;
784 	unp->unp_conn = 0;
785 	switch (unp->unp_socket->so_type) {
786 
787 	case SOCK_DGRAM:
788 		if (unp2->unp_refs == unp)
789 			unp2->unp_refs = unp->unp_nextref;
790 		else {
791 			unp2 = unp2->unp_refs;
792 			for (;;) {
793 				if (unp2 == 0)
794 					panic("unp_disconnect");
795 				if (unp2->unp_nextref == unp)
796 					break;
797 				unp2 = unp2->unp_nextref;
798 			}
799 			unp2->unp_nextref = unp->unp_nextref;
800 		}
801 		unp->unp_nextref = 0;
802 		unp->unp_socket->so_state &= ~SS_ISCONNECTED;
803 		break;
804 
805 	case SOCK_STREAM:
806 		soisdisconnected(unp->unp_socket);
807 		unp2->unp_conn = 0;
808 		soisdisconnected(unp2->unp_socket);
809 		break;
810 	}
811 }
812 
813 #ifdef notdef
814 unp_abort(struct unpcb *unp)
815 {
816 	unp_detach(unp);
817 }
818 #endif
819 
820 void
821 unp_shutdown(struct unpcb *unp)
822 {
823 	struct socket *so;
824 
825 	if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn &&
826 	    (so = unp->unp_conn->unp_socket))
827 		socantrcvmore(so);
828 }
829 
830 void
831 unp_drop(struct unpcb *unp, int errno)
832 {
833 	struct socket *so = unp->unp_socket;
834 
835 	so->so_error = errno;
836 	unp_disconnect(unp);
837 	if (so->so_head) {
838 		so->so_pcb = 0;
839 		sofree(so);
840 		if (unp->unp_addr)
841 			free(unp->unp_addr, M_SONAME);
842 		free(unp, M_PCB);
843 	}
844 }
845 
846 #ifdef notdef
847 unp_drain(void)
848 {
849 
850 }
851 #endif
852 
853 int
854 unp_externalize(struct mbuf *rights, struct lwp *l)
855 {
856 	struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
857 	struct proc *p = l->l_proc;
858 	int i, *fdp;
859 	struct file **rp;
860 	struct file *fp;
861 	int nfds, error = 0;
862 
863 	nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) /
864 	    sizeof(struct file *);
865 	rp = (struct file **)CMSG_DATA(cm);
866 
867 	fdp = malloc(nfds * sizeof(int), M_TEMP, M_WAITOK);
868 
869 	/* Make sure the recipient should be able to see the descriptors.. */
870 	if (p->p_cwdi->cwdi_rdir != NULL) {
871 		rp = (struct file **)CMSG_DATA(cm);
872 		for (i = 0; i < nfds; i++) {
873 			fp = *rp++;
874 			/*
875 			 * If we are in a chroot'ed directory, and
876 			 * someone wants to pass us a directory, make
877 			 * sure it's inside the subtree we're allowed
878 			 * to access.
879 			 */
880 			if (fp->f_type == DTYPE_VNODE) {
881 				struct vnode *vp = (struct vnode *)fp->f_data;
882 				if ((vp->v_type == VDIR) &&
883 				    !vn_isunder(vp, p->p_cwdi->cwdi_rdir, l)) {
884 					error = EPERM;
885 					break;
886 				}
887 			}
888 		}
889 	}
890 
891  restart:
892 	rp = (struct file **)CMSG_DATA(cm);
893 	if (error != 0) {
894 		for (i = 0; i < nfds; i++) {
895 			fp = *rp;
896 			/*
897 			 * zero the pointer before calling unp_discard,
898 			 * since it may end up in unp_gc()..
899 			 */
900 			*rp++ = 0;
901 			unp_discard(fp);
902 		}
903 		goto out;
904 	}
905 
906 	/*
907 	 * First loop -- allocate file descriptor table slots for the
908 	 * new descriptors.
909 	 */
910 	for (i = 0; i < nfds; i++) {
911 		fp = *rp++;
912 		if ((error = fdalloc(p, 0, &fdp[i])) != 0) {
913 			/*
914 			 * Back out what we've done so far.
915 			 */
916 			for (--i; i >= 0; i--)
917 				fdremove(p->p_fd, fdp[i]);
918 
919 			if (error == ENOSPC) {
920 				fdexpand(p);
921 				error = 0;
922 			} else {
923 				/*
924 				 * This is the error that has historically
925 				 * been returned, and some callers may
926 				 * expect it.
927 				 */
928 				error = EMSGSIZE;
929 			}
930 			goto restart;
931 		}
932 
933 		/*
934 		 * Make the slot reference the descriptor so that
935 		 * fdalloc() works properly.. We finalize it all
936 		 * in the loop below.
937 		 */
938 		p->p_fd->fd_ofiles[fdp[i]] = fp;
939 	}
940 
941 	/*
942 	 * Now that adding them has succeeded, update all of the
943 	 * descriptor passing state.
944 	 */
945 	rp = (struct file **)CMSG_DATA(cm);
946 	for (i = 0; i < nfds; i++) {
947 		fp = *rp++;
948 		fp->f_msgcount--;
949 		unp_rights--;
950 	}
951 
952 	/*
953 	 * Copy temporary array to message and adjust length, in case of
954 	 * transition from large struct file pointers to ints.
955 	 */
956 	memcpy(CMSG_DATA(cm), fdp, nfds * sizeof(int));
957 	cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
958 	rights->m_len = CMSG_SPACE(nfds * sizeof(int));
959  out:
960 	free(fdp, M_TEMP);
961 	return (error);
962 }
963 
964 int
965 unp_internalize(struct mbuf *control, struct lwp *l)
966 {
967 	struct proc *p = l->l_proc;
968 	struct filedesc *fdescp = p->p_fd;
969 	struct cmsghdr *newcm, *cm = mtod(control, struct cmsghdr *);
970 	struct file **rp, **files;
971 	struct file *fp;
972 	int i, fd, *fdp;
973 	int nfds;
974 	u_int neededspace;
975 
976 	/* Sanity check the control message header */
977 	if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
978 	    cm->cmsg_len != control->m_len)
979 		return (EINVAL);
980 
981 	/* Verify that the file descriptors are valid */
982 	nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int);
983 	fdp = (int *)CMSG_DATA(cm);
984 	for (i = 0; i < nfds; i++) {
985 		fd = *fdp++;
986 		if ((fp = fd_getfile(fdescp, fd)) == NULL)
987 			return (EBADF);
988 		simple_unlock(&fp->f_slock);
989 	}
990 
991 	/* Make sure we have room for the struct file pointers */
992 	neededspace = CMSG_SPACE(nfds * sizeof(struct file *)) -
993 	    control->m_len;
994 	if (neededspace > M_TRAILINGSPACE(control)) {
995 
996 		/* allocate new space and copy header into it */
997 		newcm = malloc(
998 		    CMSG_SPACE(nfds * sizeof(struct file *)),
999 		    M_MBUF, M_WAITOK);
1000 		if (newcm == NULL)
1001 			return (E2BIG);
1002 		memcpy(newcm, cm, sizeof(struct cmsghdr));
1003 		files = (struct file **)CMSG_DATA(newcm);
1004 	} else {
1005 		/* we can convert in-place */
1006 		newcm = NULL;
1007 		files = (struct file **)CMSG_DATA(cm);
1008 	}
1009 
1010 	/*
1011 	 * Transform the file descriptors into struct file pointers, in
1012 	 * reverse order so that if pointers are bigger than ints, the
1013 	 * int won't get until we're done.
1014 	 */
1015 	fdp = (int *)CMSG_DATA(cm) + nfds - 1;
1016 	rp = files + nfds - 1;
1017 	for (i = 0; i < nfds; i++) {
1018 		fp = fdescp->fd_ofiles[*fdp--];
1019 		simple_lock(&fp->f_slock);
1020 #ifdef DIAGNOSTIC
1021 		if (fp->f_iflags & FIF_WANTCLOSE)
1022 			panic("unp_internalize: file already closed");
1023 #endif
1024 		*rp-- = fp;
1025 		fp->f_count++;
1026 		fp->f_msgcount++;
1027 		simple_unlock(&fp->f_slock);
1028 		unp_rights++;
1029 	}
1030 
1031 	if (newcm) {
1032 		if (control->m_flags & M_EXT)
1033 			MEXTREMOVE(control);
1034 		MEXTADD(control, newcm,
1035 		    CMSG_SPACE(nfds * sizeof(struct file *)),
1036 		    M_MBUF, NULL, NULL);
1037 		cm = newcm;
1038 	}
1039 
1040 	/* adjust message & mbuf to note amount of space actually used. */
1041 	cm->cmsg_len = CMSG_LEN(nfds * sizeof(struct file *));
1042 	control->m_len = CMSG_SPACE(nfds * sizeof(struct file *));
1043 
1044 	return (0);
1045 }
1046 
1047 struct mbuf *
1048 unp_addsockcred(struct lwp *l, struct mbuf *control)
1049 {
1050 	struct cmsghdr *cmp;
1051 	struct sockcred *sc;
1052 	struct mbuf *m, *n;
1053 	int len, space, i;
1054 
1055 	len = CMSG_LEN(SOCKCREDSIZE(kauth_cred_ngroups(l->l_cred)));
1056 	space = CMSG_SPACE(SOCKCREDSIZE(kauth_cred_ngroups(l->l_cred)));
1057 
1058 	m = m_get(M_WAIT, MT_CONTROL);
1059 	if (space > MLEN) {
1060 		if (space > MCLBYTES)
1061 			MEXTMALLOC(m, space, M_WAITOK);
1062 		else
1063 			m_clget(m, M_WAIT);
1064 		if ((m->m_flags & M_EXT) == 0) {
1065 			m_free(m);
1066 			return (control);
1067 		}
1068 	}
1069 
1070 	m->m_len = space;
1071 	m->m_next = NULL;
1072 	cmp = mtod(m, struct cmsghdr *);
1073 	sc = (struct sockcred *)CMSG_DATA(cmp);
1074 	cmp->cmsg_len = len;
1075 	cmp->cmsg_level = SOL_SOCKET;
1076 	cmp->cmsg_type = SCM_CREDS;
1077 	sc->sc_uid = kauth_cred_getuid(l->l_cred);
1078 	sc->sc_euid = kauth_cred_geteuid(l->l_cred);
1079 	sc->sc_gid = kauth_cred_getgid(l->l_cred);
1080 	sc->sc_egid = kauth_cred_getegid(l->l_cred);
1081 	sc->sc_ngroups = kauth_cred_ngroups(l->l_cred);
1082 	for (i = 0; i < sc->sc_ngroups; i++)
1083 		sc->sc_groups[i] = kauth_cred_group(l->l_cred, i);
1084 
1085 	/*
1086 	 * If a control message already exists, append us to the end.
1087 	 */
1088 	if (control != NULL) {
1089 		for (n = control; n->m_next != NULL; n = n->m_next)
1090 			;
1091 		n->m_next = m;
1092 	} else
1093 		control = m;
1094 
1095 	return (control);
1096 }
1097 
1098 int	unp_defer, unp_gcing;
1099 extern	struct domain unixdomain;
1100 
1101 /*
1102  * Comment added long after the fact explaining what's going on here.
1103  * Do a mark-sweep GC of file descriptors on the system, to free up
1104  * any which are caught in flight to an about-to-be-closed socket.
1105  *
1106  * Traditional mark-sweep gc's start at the "root", and mark
1107  * everything reachable from the root (which, in our case would be the
1108  * process table).  The mark bits are cleared during the sweep.
1109  *
1110  * XXX For some inexplicable reason (perhaps because the file
1111  * descriptor tables used to live in the u area which could be swapped
1112  * out and thus hard to reach), we do multiple scans over the set of
1113  * descriptors, using use *two* mark bits per object (DEFER and MARK).
1114  * Whenever we find a descriptor which references other descriptors,
1115  * the ones it references are marked with both bits, and we iterate
1116  * over the whole file table until there are no more DEFER bits set.
1117  * We also make an extra pass *before* the GC to clear the mark bits,
1118  * which could have been cleared at almost no cost during the previous
1119  * sweep.
1120  *
1121  * XXX MP: this needs to run with locks such that no other thread of
1122  * control can create or destroy references to file descriptors. it
1123  * may be necessary to defer the GC until later (when the locking
1124  * situation is more hospitable); it may be necessary to push this
1125  * into a separate thread.
1126  */
1127 void
1128 unp_gc(void)
1129 {
1130 	struct file *fp, *nextfp;
1131 	struct socket *so, *so1;
1132 	struct file **extra_ref, **fpp;
1133 	int nunref, i;
1134 
1135 	if (unp_gcing)
1136 		return;
1137 	unp_gcing = 1;
1138 	unp_defer = 0;
1139 
1140 	/* Clear mark bits */
1141 	LIST_FOREACH(fp, &filehead, f_list)
1142 		fp->f_flag &= ~(FMARK|FDEFER);
1143 
1144 	/*
1145 	 * Iterate over the set of descriptors, marking ones believed
1146 	 * (based on refcount) to be referenced from a process, and
1147 	 * marking for rescan descriptors which are queued on a socket.
1148 	 */
1149 	do {
1150 		LIST_FOREACH(fp, &filehead, f_list) {
1151 			if (fp->f_flag & FDEFER) {
1152 				fp->f_flag &= ~FDEFER;
1153 				unp_defer--;
1154 #ifdef DIAGNOSTIC
1155 				if (fp->f_count == 0)
1156 					panic("unp_gc: deferred unreferenced socket");
1157 #endif
1158 			} else {
1159 				if (fp->f_count == 0)
1160 					continue;
1161 				if (fp->f_flag & FMARK)
1162 					continue;
1163 				if (fp->f_count == fp->f_msgcount)
1164 					continue;
1165 			}
1166 			fp->f_flag |= FMARK;
1167 
1168 			if (fp->f_type != DTYPE_SOCKET ||
1169 			    (so = (struct socket *)fp->f_data) == 0)
1170 				continue;
1171 			if (so->so_proto->pr_domain != &unixdomain ||
1172 			    (so->so_proto->pr_flags&PR_RIGHTS) == 0)
1173 				continue;
1174 #ifdef notdef
1175 			if (so->so_rcv.sb_flags & SB_LOCK) {
1176 				/*
1177 				 * This is problematical; it's not clear
1178 				 * we need to wait for the sockbuf to be
1179 				 * unlocked (on a uniprocessor, at least),
1180 				 * and it's also not clear what to do
1181 				 * if sbwait returns an error due to receipt
1182 				 * of a signal.  If sbwait does return
1183 				 * an error, we'll go into an infinite
1184 				 * loop.  Delete all of this for now.
1185 				 */
1186 				(void) sbwait(&so->so_rcv);
1187 				goto restart;
1188 			}
1189 #endif
1190 			unp_scan(so->so_rcv.sb_mb, unp_mark, 0);
1191 			/*
1192 			 * mark descriptors referenced from sockets queued on the accept queue as well.
1193 			 */
1194 			if (so->so_options & SO_ACCEPTCONN) {
1195 				TAILQ_FOREACH(so1, &so->so_q0, so_qe) {
1196 					unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
1197 				}
1198 				TAILQ_FOREACH(so1, &so->so_q, so_qe) {
1199 					unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
1200 				}
1201 			}
1202 
1203 		}
1204 	} while (unp_defer);
1205 	/*
1206 	 * Sweep pass.  Find unmarked descriptors, and free them.
1207 	 *
1208 	 * We grab an extra reference to each of the file table entries
1209 	 * that are not otherwise accessible and then free the rights
1210 	 * that are stored in messages on them.
1211 	 *
1212 	 * The bug in the original code is a little tricky, so I'll describe
1213 	 * what's wrong with it here.
1214 	 *
1215 	 * It is incorrect to simply unp_discard each entry for f_msgcount
1216 	 * times -- consider the case of sockets A and B that contain
1217 	 * references to each other.  On a last close of some other socket,
1218 	 * we trigger a gc since the number of outstanding rights (unp_rights)
1219 	 * is non-zero.  If during the sweep phase the gc code un_discards,
1220 	 * we end up doing a (full) closef on the descriptor.  A closef on A
1221 	 * results in the following chain.  Closef calls soo_close, which
1222 	 * calls soclose.   Soclose calls first (through the switch
1223 	 * uipc_usrreq) unp_detach, which re-invokes unp_gc.  Unp_gc simply
1224 	 * returns because the previous instance had set unp_gcing, and
1225 	 * we return all the way back to soclose, which marks the socket
1226 	 * with SS_NOFDREF, and then calls sofree.  Sofree calls sorflush
1227 	 * to free up the rights that are queued in messages on the socket A,
1228 	 * i.e., the reference on B.  The sorflush calls via the dom_dispose
1229 	 * switch unp_dispose, which unp_scans with unp_discard.  This second
1230 	 * instance of unp_discard just calls closef on B.
1231 	 *
1232 	 * Well, a similar chain occurs on B, resulting in a sorflush on B,
1233 	 * which results in another closef on A.  Unfortunately, A is already
1234 	 * being closed, and the descriptor has already been marked with
1235 	 * SS_NOFDREF, and soclose panics at this point.
1236 	 *
1237 	 * Here, we first take an extra reference to each inaccessible
1238 	 * descriptor.  Then, if the inaccessible descriptor is a
1239 	 * socket, we call sorflush in case it is a Unix domain
1240 	 * socket.  After we destroy all the rights carried in
1241 	 * messages, we do a last closef to get rid of our extra
1242 	 * reference.  This is the last close, and the unp_detach etc
1243 	 * will shut down the socket.
1244 	 *
1245 	 * 91/09/19, bsy@cs.cmu.edu
1246 	 */
1247 	extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK);
1248 	for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; fp != 0;
1249 	    fp = nextfp) {
1250 		nextfp = LIST_NEXT(fp, f_list);
1251 		simple_lock(&fp->f_slock);
1252 		if (fp->f_count != 0 &&
1253 		    fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
1254 			*fpp++ = fp;
1255 			nunref++;
1256 			fp->f_count++;
1257 		}
1258 		simple_unlock(&fp->f_slock);
1259 	}
1260 	for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
1261 		fp = *fpp;
1262 		simple_lock(&fp->f_slock);
1263 		FILE_USE(fp);
1264 		if (fp->f_type == DTYPE_SOCKET)
1265 			sorflush((struct socket *)fp->f_data);
1266 		FILE_UNUSE(fp, NULL);
1267 	}
1268 	for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
1269 		fp = *fpp;
1270 		simple_lock(&fp->f_slock);
1271 		FILE_USE(fp);
1272 		(void) closef(fp, (struct lwp *)0);
1273 	}
1274 	free((caddr_t)extra_ref, M_FILE);
1275 	unp_gcing = 0;
1276 }
1277 
1278 void
1279 unp_dispose(struct mbuf *m)
1280 {
1281 
1282 	if (m)
1283 		unp_scan(m, unp_discard, 1);
1284 }
1285 
1286 void
1287 unp_scan(struct mbuf *m0, void (*op)(struct file *), int discard)
1288 {
1289 	struct mbuf *m;
1290 	struct file **rp;
1291 	struct cmsghdr *cm;
1292 	int i;
1293 	int qfds;
1294 
1295 	while (m0) {
1296 		for (m = m0; m; m = m->m_next) {
1297 			if (m->m_type == MT_CONTROL &&
1298 			    m->m_len >= sizeof(*cm)) {
1299 				cm = mtod(m, struct cmsghdr *);
1300 				if (cm->cmsg_level != SOL_SOCKET ||
1301 				    cm->cmsg_type != SCM_RIGHTS)
1302 					continue;
1303 				qfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm)))
1304 				    / sizeof(struct file *);
1305 				rp = (struct file **)CMSG_DATA(cm);
1306 				for (i = 0; i < qfds; i++) {
1307 					struct file *fp = *rp;
1308 					if (discard)
1309 						*rp = 0;
1310 					(*op)(fp);
1311 					rp++;
1312 				}
1313 				break;		/* XXX, but saves time */
1314 			}
1315 		}
1316 		m0 = m0->m_nextpkt;
1317 	}
1318 }
1319 
1320 void
1321 unp_mark(struct file *fp)
1322 {
1323 	if (fp == NULL)
1324 		return;
1325 
1326 	if (fp->f_flag & FMARK)
1327 		return;
1328 
1329 	/* If we're already deferred, don't screw up the defer count */
1330 	if (fp->f_flag & FDEFER)
1331 		return;
1332 
1333 	/*
1334 	 * Minimize the number of deferrals...  Sockets are the only
1335 	 * type of descriptor which can hold references to another
1336 	 * descriptor, so just mark other descriptors, and defer
1337 	 * unmarked sockets for the next pass.
1338 	 */
1339 	if (fp->f_type == DTYPE_SOCKET) {
1340 		unp_defer++;
1341 		if (fp->f_count == 0)
1342 			panic("unp_mark: queued unref");
1343 		fp->f_flag |= FDEFER;
1344 	} else {
1345 		fp->f_flag |= FMARK;
1346 	}
1347 	return;
1348 }
1349 
1350 void
1351 unp_discard(struct file *fp)
1352 {
1353 	if (fp == NULL)
1354 		return;
1355 	simple_lock(&fp->f_slock);
1356 	fp->f_usecount++;	/* i.e. FILE_USE(fp) sans locking */
1357 	fp->f_msgcount--;
1358 	simple_unlock(&fp->f_slock);
1359 	unp_rights--;
1360 	(void) closef(fp, (struct lwp *)0);
1361 }
1362