1 /* $OpenBSD: uipc_usrreq.c,v 1.43 2008/05/23 15:51:12 thib Exp $ */ 2 /* $NetBSD: uipc_usrreq.c,v 1.18 1996/02/09 19:00:50 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1989, 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 33 */ 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/proc.h> 38 #include <sys/filedesc.h> 39 #include <sys/domain.h> 40 #include <sys/protosw.h> 41 #include <sys/socket.h> 42 #include <sys/socketvar.h> 43 #include <sys/unpcb.h> 44 #include <sys/un.h> 45 #include <sys/namei.h> 46 #include <sys/vnode.h> 47 #include <sys/file.h> 48 #include <sys/stat.h> 49 #include <sys/mbuf.h> 50 51 /* 52 * Unix communications domain. 53 * 54 * TODO: 55 * SEQPACKET, RDM 56 * rethink name space problems 57 * need a proper out-of-band 58 */ 59 struct sockaddr sun_noname = { sizeof(sun_noname), AF_UNIX }; 60 ino_t unp_ino; /* prototype for fake inode numbers */ 61 62 /*ARGSUSED*/ 63 int 64 uipc_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam, 65 struct mbuf *control, struct proc *p) 66 { 67 struct unpcb *unp = sotounpcb(so); 68 struct socket *so2; 69 int error = 0; 70 71 if (req == PRU_CONTROL) 72 return (EOPNOTSUPP); 73 if (req != PRU_SEND && control && control->m_len) { 74 error = EOPNOTSUPP; 75 goto release; 76 } 77 if (unp == NULL && req != PRU_ATTACH) { 78 error = EINVAL; 79 goto release; 80 } 81 switch (req) { 82 83 case PRU_ATTACH: 84 if (unp) { 85 error = EISCONN; 86 break; 87 } 88 error = unp_attach(so); 89 break; 90 91 case PRU_DETACH: 92 unp_detach(unp); 93 break; 94 95 case PRU_BIND: 96 error = unp_bind(unp, nam, p); 97 break; 98 99 case PRU_LISTEN: 100 if (unp->unp_vnode == NULL) 101 error = EINVAL; 102 break; 103 104 case PRU_CONNECT: 105 error = unp_connect(so, nam, p); 106 break; 107 108 case PRU_CONNECT2: 109 error = unp_connect2(so, (struct socket *)nam); 110 break; 111 112 case PRU_DISCONNECT: 113 unp_disconnect(unp); 114 break; 115 116 case PRU_ACCEPT: 117 /* 118 * Pass back name of connected socket, 119 * if it was bound and we are still connected 120 * (our peer may have closed already!). 121 */ 122 if (unp->unp_conn && unp->unp_conn->unp_addr) { 123 nam->m_len = unp->unp_conn->unp_addr->m_len; 124 bcopy(mtod(unp->unp_conn->unp_addr, caddr_t), 125 mtod(nam, caddr_t), (unsigned)nam->m_len); 126 } else { 127 nam->m_len = sizeof(sun_noname); 128 *(mtod(nam, struct sockaddr *)) = sun_noname; 129 } 130 break; 131 132 case PRU_SHUTDOWN: 133 socantsendmore(so); 134 unp_shutdown(unp); 135 break; 136 137 case PRU_RCVD: 138 switch (so->so_type) { 139 140 case SOCK_DGRAM: 141 panic("uipc 1"); 142 /*NOTREACHED*/ 143 144 case SOCK_STREAM: 145 #define rcv (&so->so_rcv) 146 #define snd (&so2->so_snd) 147 if (unp->unp_conn == NULL) 148 break; 149 so2 = unp->unp_conn->unp_socket; 150 /* 151 * Adjust backpressure on sender 152 * and wakeup any waiting to write. 153 */ 154 snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt; 155 unp->unp_mbcnt = rcv->sb_mbcnt; 156 snd->sb_hiwat += unp->unp_cc - rcv->sb_cc; 157 unp->unp_cc = rcv->sb_cc; 158 sowwakeup(so2); 159 #undef snd 160 #undef rcv 161 break; 162 163 default: 164 panic("uipc 2"); 165 } 166 break; 167 168 case PRU_SEND: 169 if (control && (error = unp_internalize(control, p))) 170 break; 171 switch (so->so_type) { 172 173 case SOCK_DGRAM: { 174 struct sockaddr *from; 175 176 if (nam) { 177 if (unp->unp_conn) { 178 error = EISCONN; 179 break; 180 } 181 error = unp_connect(so, nam, p); 182 if (error) 183 break; 184 } else { 185 if (unp->unp_conn == NULL) { 186 error = ENOTCONN; 187 break; 188 } 189 } 190 so2 = unp->unp_conn->unp_socket; 191 if (unp->unp_addr) 192 from = mtod(unp->unp_addr, struct sockaddr *); 193 else 194 from = &sun_noname; 195 if (sbappendaddr(&so2->so_rcv, from, m, control)) { 196 sorwakeup(so2); 197 m = NULL; 198 control = NULL; 199 } else 200 error = ENOBUFS; 201 if (nam) 202 unp_disconnect(unp); 203 break; 204 } 205 206 case SOCK_STREAM: 207 #define rcv (&so2->so_rcv) 208 #define snd (&so->so_snd) 209 if (so->so_state & SS_CANTSENDMORE) { 210 error = EPIPE; 211 break; 212 } 213 if (unp->unp_conn == NULL) { 214 error = ENOTCONN; 215 break; 216 } 217 so2 = unp->unp_conn->unp_socket; 218 /* 219 * Send to paired receive port, and then reduce 220 * send buffer hiwater marks to maintain backpressure. 221 * Wake up readers. 222 */ 223 if (control) { 224 if (sbappendcontrol(rcv, m, control)) 225 control = NULL; 226 } else 227 sbappend(rcv, m); 228 snd->sb_mbmax -= 229 rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt; 230 unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt; 231 snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc; 232 unp->unp_conn->unp_cc = rcv->sb_cc; 233 sorwakeup(so2); 234 m = NULL; 235 #undef snd 236 #undef rcv 237 break; 238 239 default: 240 panic("uipc 4"); 241 } 242 /* we need to undo unp_internalize in case of errors */ 243 if (control && error) 244 unp_dispose(control); 245 break; 246 247 case PRU_ABORT: 248 unp_drop(unp, ECONNABORTED); 249 break; 250 251 case PRU_SENSE: 252 ((struct stat *) m)->st_blksize = so->so_snd.sb_hiwat; 253 if (so->so_type == SOCK_STREAM && unp->unp_conn != NULL) { 254 so2 = unp->unp_conn->unp_socket; 255 ((struct stat *) m)->st_blksize += so2->so_rcv.sb_cc; 256 } 257 ((struct stat *) m)->st_dev = NODEV; 258 if (unp->unp_ino == 0) 259 unp->unp_ino = unp_ino++; 260 ((struct stat *) m)->st_atimespec = 261 ((struct stat *) m)->st_mtimespec = 262 ((struct stat *) m)->st_ctimespec = unp->unp_ctime; 263 ((struct stat *) m)->st_ino = unp->unp_ino; 264 return (0); 265 266 case PRU_RCVOOB: 267 return (EOPNOTSUPP); 268 269 case PRU_SENDOOB: 270 error = EOPNOTSUPP; 271 break; 272 273 case PRU_SOCKADDR: 274 if (unp->unp_addr) { 275 nam->m_len = unp->unp_addr->m_len; 276 bcopy(mtod(unp->unp_addr, caddr_t), 277 mtod(nam, caddr_t), (unsigned)nam->m_len); 278 } else 279 nam->m_len = 0; 280 break; 281 282 case PRU_PEERADDR: 283 if (unp->unp_conn && unp->unp_conn->unp_addr) { 284 nam->m_len = unp->unp_conn->unp_addr->m_len; 285 bcopy(mtod(unp->unp_conn->unp_addr, caddr_t), 286 mtod(nam, caddr_t), (unsigned)nam->m_len); 287 } else 288 nam->m_len = 0; 289 break; 290 291 case PRU_PEEREID: 292 if (unp->unp_flags & UNP_FEIDS) { 293 nam->m_len = sizeof(struct unpcbid); 294 bcopy((caddr_t)(&(unp->unp_connid)), 295 mtod(nam, caddr_t), (unsigned)nam->m_len); 296 } else 297 nam->m_len = 0; 298 break; 299 300 case PRU_SLOWTIMO: 301 break; 302 303 default: 304 panic("piusrreq"); 305 } 306 release: 307 if (control) 308 m_freem(control); 309 if (m) 310 m_freem(m); 311 return (error); 312 } 313 314 /* 315 * Both send and receive buffers are allocated PIPSIZ bytes of buffering 316 * for stream sockets, although the total for sender and receiver is 317 * actually only PIPSIZ. 318 * Datagram sockets really use the sendspace as the maximum datagram size, 319 * and don't really want to reserve the sendspace. Their recvspace should 320 * be large enough for at least one max-size datagram plus address. 321 */ 322 #define PIPSIZ 4096 323 u_long unpst_sendspace = PIPSIZ; 324 u_long unpst_recvspace = PIPSIZ; 325 u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 326 u_long unpdg_recvspace = 4*1024; 327 328 int unp_rights; /* file descriptors in flight */ 329 330 int 331 unp_attach(struct socket *so) 332 { 333 struct unpcb *unp; 334 int error; 335 336 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 337 switch (so->so_type) { 338 339 case SOCK_STREAM: 340 error = soreserve(so, unpst_sendspace, unpst_recvspace); 341 break; 342 343 case SOCK_DGRAM: 344 error = soreserve(so, unpdg_sendspace, unpdg_recvspace); 345 break; 346 347 default: 348 panic("unp_attach"); 349 } 350 if (error) 351 return (error); 352 } 353 unp = malloc(sizeof(*unp), M_PCB, M_NOWAIT|M_ZERO); 354 if (unp == NULL) 355 return (ENOBUFS); 356 unp->unp_socket = so; 357 so->so_pcb = unp; 358 getnanotime(&unp->unp_ctime); 359 return (0); 360 } 361 362 void 363 unp_detach(struct unpcb *unp) 364 { 365 366 if (unp->unp_vnode) { 367 unp->unp_vnode->v_socket = NULL; 368 vrele(unp->unp_vnode); 369 unp->unp_vnode = NULL; 370 } 371 if (unp->unp_conn) 372 unp_disconnect(unp); 373 while (unp->unp_refs) 374 unp_drop(unp->unp_refs, ECONNRESET); 375 soisdisconnected(unp->unp_socket); 376 unp->unp_socket->so_pcb = NULL; 377 m_freem(unp->unp_addr); 378 if (unp_rights) { 379 /* 380 * Normally the receive buffer is flushed later, 381 * in sofree, but if our receive buffer holds references 382 * to descriptors that are now garbage, we will dispose 383 * of those descriptor references after the garbage collector 384 * gets them (resulting in a "panic: closef: count < 0"). 385 */ 386 sorflush(unp->unp_socket); 387 free(unp, M_PCB); 388 unp_gc(); 389 } else 390 free(unp, M_PCB); 391 } 392 393 int 394 unp_bind(struct unpcb *unp, struct mbuf *nam, struct proc *p) 395 { 396 struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *); 397 struct vnode *vp; 398 struct vattr vattr; 399 int error, namelen; 400 struct nameidata nd; 401 char buf[MLEN]; 402 403 if (unp->unp_vnode != NULL) 404 return (EINVAL); 405 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 406 if (namelen <= 0 || namelen >= MLEN) 407 return EINVAL; 408 strncpy(buf, soun->sun_path, namelen); 409 buf[namelen] = 0; /* null-terminate the string */ 410 NDINIT(&nd, CREATE, NOFOLLOW | LOCKPARENT, UIO_SYSSPACE, buf, p); 411 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */ 412 if ((error = namei(&nd)) != 0) 413 return (error); 414 vp = nd.ni_vp; 415 if (vp != NULL) { 416 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd); 417 if (nd.ni_dvp == vp) 418 vrele(nd.ni_dvp); 419 else 420 vput(nd.ni_dvp); 421 vrele(vp); 422 return (EADDRINUSE); 423 } 424 VATTR_NULL(&vattr); 425 vattr.va_type = VSOCK; 426 vattr.va_mode = ACCESSPERMS &~ p->p_fd->fd_cmask; 427 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); 428 if (error) 429 return (error); 430 vp = nd.ni_vp; 431 vp->v_socket = unp->unp_socket; 432 unp->unp_vnode = vp; 433 unp->unp_addr = m_copy(nam, 0, (int)M_COPYALL); 434 unp->unp_connid.unp_euid = p->p_ucred->cr_uid; 435 unp->unp_connid.unp_egid = p->p_ucred->cr_gid; 436 unp->unp_flags |= UNP_FEIDSBIND; 437 VOP_UNLOCK(vp, 0, p); 438 return (0); 439 } 440 441 int 442 unp_connect(struct socket *so, struct mbuf *nam, struct proc *p) 443 { 444 struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *); 445 struct vnode *vp; 446 struct socket *so2, *so3; 447 struct unpcb *unp, *unp2, *unp3; 448 int error; 449 struct nameidata nd; 450 451 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, soun->sun_path, p); 452 if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) { /* XXX */ 453 if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0) 454 return (EMSGSIZE); 455 } else 456 *(mtod(nam, caddr_t) + nam->m_len) = 0; 457 if ((error = namei(&nd)) != 0) 458 return (error); 459 vp = nd.ni_vp; 460 if (vp->v_type != VSOCK) { 461 error = ENOTSOCK; 462 goto bad; 463 } 464 if ((error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p)) != 0) 465 goto bad; 466 so2 = vp->v_socket; 467 if (so2 == NULL) { 468 error = ECONNREFUSED; 469 goto bad; 470 } 471 if (so->so_type != so2->so_type) { 472 error = EPROTOTYPE; 473 goto bad; 474 } 475 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 476 if ((so2->so_options & SO_ACCEPTCONN) == 0 || 477 (so3 = sonewconn(so2, 0)) == 0) { 478 error = ECONNREFUSED; 479 goto bad; 480 } 481 unp = sotounpcb(so); 482 unp2 = sotounpcb(so2); 483 unp3 = sotounpcb(so3); 484 if (unp2->unp_addr) 485 unp3->unp_addr = 486 m_copy(unp2->unp_addr, 0, (int)M_COPYALL); 487 unp3->unp_connid.unp_euid = p->p_ucred->cr_uid; 488 unp3->unp_connid.unp_egid = p->p_ucred->cr_gid; 489 unp3->unp_flags |= UNP_FEIDS; 490 so2 = so3; 491 if (unp2->unp_flags & UNP_FEIDSBIND) { 492 unp->unp_connid.unp_euid = unp2->unp_connid.unp_euid; 493 unp->unp_connid.unp_egid = unp2->unp_connid.unp_egid; 494 unp->unp_flags |= UNP_FEIDS; 495 } 496 } 497 error = unp_connect2(so, so2); 498 bad: 499 vput(vp); 500 return (error); 501 } 502 503 int 504 unp_connect2(struct socket *so, struct socket *so2) 505 { 506 struct unpcb *unp = sotounpcb(so); 507 struct unpcb *unp2; 508 509 if (so2->so_type != so->so_type) 510 return (EPROTOTYPE); 511 unp2 = sotounpcb(so2); 512 unp->unp_conn = unp2; 513 switch (so->so_type) { 514 515 case SOCK_DGRAM: 516 unp->unp_nextref = unp2->unp_refs; 517 unp2->unp_refs = unp; 518 soisconnected(so); 519 break; 520 521 case SOCK_STREAM: 522 unp2->unp_conn = unp; 523 soisconnected(so); 524 soisconnected(so2); 525 break; 526 527 default: 528 panic("unp_connect2"); 529 } 530 return (0); 531 } 532 533 void 534 unp_disconnect(struct unpcb *unp) 535 { 536 struct unpcb *unp2 = unp->unp_conn; 537 538 if (unp2 == NULL) 539 return; 540 unp->unp_conn = NULL; 541 switch (unp->unp_socket->so_type) { 542 543 case SOCK_DGRAM: 544 if (unp2->unp_refs == unp) 545 unp2->unp_refs = unp->unp_nextref; 546 else { 547 unp2 = unp2->unp_refs; 548 for (;;) { 549 if (unp2 == NULL) 550 panic("unp_disconnect"); 551 if (unp2->unp_nextref == unp) 552 break; 553 unp2 = unp2->unp_nextref; 554 } 555 unp2->unp_nextref = unp->unp_nextref; 556 } 557 unp->unp_nextref = NULL; 558 unp->unp_socket->so_state &= ~SS_ISCONNECTED; 559 break; 560 561 case SOCK_STREAM: 562 soisdisconnected(unp->unp_socket); 563 unp2->unp_conn = NULL; 564 soisdisconnected(unp2->unp_socket); 565 break; 566 } 567 } 568 569 #ifdef notdef 570 unp_abort(struct unpcb *unp) 571 { 572 unp_detach(unp); 573 } 574 #endif 575 576 void 577 unp_shutdown(struct unpcb *unp) 578 { 579 struct socket *so; 580 581 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn && 582 (so = unp->unp_conn->unp_socket)) 583 socantrcvmore(so); 584 } 585 586 void 587 unp_drop(struct unpcb *unp, int errno) 588 { 589 struct socket *so = unp->unp_socket; 590 591 so->so_error = errno; 592 unp_disconnect(unp); 593 if (so->so_head) { 594 so->so_pcb = NULL; 595 sofree(so); 596 m_freem(unp->unp_addr); 597 free(unp, M_PCB); 598 } 599 } 600 601 #ifdef notdef 602 unp_drain(void) 603 { 604 605 } 606 #endif 607 608 int 609 unp_externalize(struct mbuf *rights) 610 { 611 struct proc *p = curproc; /* XXX */ 612 struct cmsghdr *cm = mtod(rights, struct cmsghdr *); 613 int i, *fdp; 614 struct file **rp; 615 struct file *fp; 616 int nfds, error = 0; 617 618 nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / 619 sizeof(struct file *); 620 rp = (struct file **)CMSG_DATA(cm); 621 622 fdp = malloc(nfds * sizeof(int), M_TEMP, M_WAITOK); 623 624 /* Make sure the recipient should be able to see the descriptors.. */ 625 if (p->p_fd->fd_rdir != NULL) { 626 rp = (struct file **)CMSG_DATA(cm); 627 for (i = 0; i < nfds; i++) { 628 fp = *rp++; 629 /* 630 * No to block devices. If passing a directory, 631 * make sure that it is underneath the root. 632 */ 633 if (fp->f_type == DTYPE_VNODE) { 634 struct vnode *vp = (struct vnode *)fp->f_data; 635 636 if (vp->v_type == VBLK || 637 (vp->v_type == VDIR && 638 !vn_isunder(vp, p->p_fd->fd_rdir, p))) { 639 error = EPERM; 640 break; 641 } 642 } 643 } 644 } 645 646 restart: 647 fdplock(p->p_fd); 648 if (error != 0) { 649 rp = ((struct file **)CMSG_DATA(cm)); 650 for (i = 0; i < nfds; i++) { 651 fp = *rp; 652 /* 653 * zero the pointer before calling unp_discard, 654 * since it may end up in unp_gc().. 655 */ 656 *rp++ = NULL; 657 unp_discard(fp); 658 } 659 goto out; 660 } 661 662 /* 663 * First loop -- allocate file descriptor table slots for the 664 * new descriptors. 665 */ 666 rp = ((struct file **)CMSG_DATA(cm)); 667 for (i = 0; i < nfds; i++) { 668 bcopy(rp, &fp, sizeof(fp)); 669 rp++; 670 if ((error = fdalloc(p, 0, &fdp[i])) != 0) { 671 /* 672 * Back out what we've done so far. 673 */ 674 for (--i; i >= 0; i--) 675 fdremove(p->p_fd, fdp[i]); 676 677 if (error == ENOSPC) { 678 fdexpand(p); 679 error = 0; 680 } else { 681 /* 682 * This is the error that has historically 683 * been returned, and some callers may 684 * expect it. 685 */ 686 error = EMSGSIZE; 687 } 688 fdpunlock(p->p_fd); 689 goto restart; 690 } 691 692 /* 693 * Make the slot reference the descriptor so that 694 * fdalloc() works properly.. We finalize it all 695 * in the loop below. 696 */ 697 p->p_fd->fd_ofiles[fdp[i]] = fp; 698 } 699 700 /* 701 * Now that adding them has succeeded, update all of the 702 * descriptor passing state. 703 */ 704 rp = (struct file **)CMSG_DATA(cm); 705 for (i = 0; i < nfds; i++) { 706 fp = *rp++; 707 fp->f_msgcount--; 708 unp_rights--; 709 } 710 711 /* 712 * Copy temporary array to message and adjust length, in case of 713 * transition from large struct file pointers to ints. 714 */ 715 memcpy(CMSG_DATA(cm), fdp, nfds * sizeof(int)); 716 cm->cmsg_len = CMSG_LEN(nfds * sizeof(int)); 717 rights->m_len = CMSG_LEN(nfds * sizeof(int)); 718 out: 719 fdpunlock(p->p_fd); 720 free(fdp, M_TEMP); 721 return (error); 722 } 723 724 int 725 unp_internalize(struct mbuf *control, struct proc *p) 726 { 727 struct filedesc *fdp = p->p_fd; 728 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 729 struct file **rp, *fp; 730 int i, error; 731 int nfds, *ip, fd, neededspace; 732 733 /* 734 * Check for two potential msg_controllen values because 735 * IETF stuck their nose in a place it does not belong. 736 */ 737 if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET || 738 !(cm->cmsg_len == control->m_len || 739 control->m_len == CMSG_ALIGN(cm->cmsg_len))) 740 return (EINVAL); 741 nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof (int); 742 743 /* Make sure we have room for the struct file pointers */ 744 morespace: 745 neededspace = CMSG_SPACE(nfds * sizeof(struct file *)) - 746 control->m_len; 747 if (neededspace > M_TRAILINGSPACE(control)) { 748 /* if we already have a cluster, the message is just too big */ 749 if (control->m_flags & M_EXT) 750 return (E2BIG); 751 752 /* allocate a cluster and try again */ 753 MCLGET(control, M_WAIT); 754 if ((control->m_flags & M_EXT) == 0) 755 return (ENOBUFS); /* allocation failed */ 756 757 /* copy the data to the cluster */ 758 memcpy(mtod(control, char *), cm, cm->cmsg_len); 759 cm = mtod(control, struct cmsghdr *); 760 goto morespace; 761 } 762 763 /* adjust message & mbuf to note amount of space actually used. */ 764 cm->cmsg_len = CMSG_LEN(nfds * sizeof(struct file *)); 765 control->m_len = CMSG_SPACE(nfds * sizeof(struct file *)); 766 767 ip = ((int *)CMSG_DATA(cm)) + nfds - 1; 768 rp = ((struct file **)CMSG_DATA(cm)) + nfds - 1; 769 for (i = 0; i < nfds; i++) { 770 bcopy(ip, &fd, sizeof fd); 771 ip--; 772 if ((fp = fd_getfile(fdp, fd)) == NULL) { 773 error = EBADF; 774 goto fail; 775 } 776 if (fp->f_count == LONG_MAX-2 || 777 fp->f_msgcount == LONG_MAX-2) { 778 error = EDEADLK; 779 goto fail; 780 } 781 bcopy(&fp, rp, sizeof fp); 782 rp--; 783 fp->f_count++; 784 fp->f_msgcount++; 785 unp_rights++; 786 } 787 return (0); 788 fail: 789 /* Back out what we just did. */ 790 for ( ; i > 0; i--) { 791 rp++; 792 bcopy(rp, &fp, sizeof(fp)); 793 fp->f_count--; 794 fp->f_msgcount--; 795 unp_rights--; 796 } 797 798 return (error); 799 } 800 801 int unp_defer, unp_gcing; 802 extern struct domain unixdomain; 803 804 void 805 unp_gc(void) 806 { 807 struct file *fp, *nextfp; 808 struct socket *so; 809 struct file **extra_ref, **fpp; 810 int nunref, i; 811 812 if (unp_gcing) 813 return; 814 unp_gcing = 1; 815 unp_defer = 0; 816 LIST_FOREACH(fp, &filehead, f_list) 817 fp->f_flag &= ~(FMARK|FDEFER); 818 do { 819 LIST_FOREACH(fp, &filehead, f_list) { 820 if (fp->f_flag & FDEFER) { 821 fp->f_flag &= ~FDEFER; 822 unp_defer--; 823 } else { 824 if (fp->f_count == 0) 825 continue; 826 if (fp->f_flag & FMARK) 827 continue; 828 if (fp->f_count == fp->f_msgcount) 829 continue; 830 } 831 fp->f_flag |= FMARK; 832 833 if (fp->f_type != DTYPE_SOCKET || 834 (so = (struct socket *)fp->f_data) == NULL) 835 continue; 836 if (so->so_proto->pr_domain != &unixdomain || 837 (so->so_proto->pr_flags&PR_RIGHTS) == 0) 838 continue; 839 #ifdef notdef 840 if (so->so_rcv.sb_flags & SB_LOCK) { 841 /* 842 * This is problematical; it's not clear 843 * we need to wait for the sockbuf to be 844 * unlocked (on a uniprocessor, at least), 845 * and it's also not clear what to do 846 * if sbwait returns an error due to receipt 847 * of a signal. If sbwait does return 848 * an error, we'll go into an infinite 849 * loop. Delete all of this for now. 850 */ 851 (void) sbwait(&so->so_rcv); 852 goto restart; 853 } 854 #endif 855 unp_scan(so->so_rcv.sb_mb, unp_mark, 0); 856 } 857 } while (unp_defer); 858 /* 859 * We grab an extra reference to each of the file table entries 860 * that are not otherwise accessible and then free the rights 861 * that are stored in messages on them. 862 * 863 * The bug in the original code is a little tricky, so I'll describe 864 * what's wrong with it here. 865 * 866 * It is incorrect to simply unp_discard each entry for f_msgcount 867 * times -- consider the case of sockets A and B that contain 868 * references to each other. On a last close of some other socket, 869 * we trigger a gc since the number of outstanding rights (unp_rights) 870 * is non-zero. If during the sweep phase the gc code un_discards, 871 * we end up doing a (full) closef on the descriptor. A closef on A 872 * results in the following chain. Closef calls soo_close, which 873 * calls soclose. Soclose calls first (through the switch 874 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply 875 * returns because the previous instance had set unp_gcing, and 876 * we return all the way back to soclose, which marks the socket 877 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush 878 * to free up the rights that are queued in messages on the socket A, 879 * i.e., the reference on B. The sorflush calls via the dom_dispose 880 * switch unp_dispose, which unp_scans with unp_discard. This second 881 * instance of unp_discard just calls closef on B. 882 * 883 * Well, a similar chain occurs on B, resulting in a sorflush on B, 884 * which results in another closef on A. Unfortunately, A is already 885 * being closed, and the descriptor has already been marked with 886 * SS_NOFDREF, and soclose panics at this point. 887 * 888 * Here, we first take an extra reference to each inaccessible 889 * descriptor. Then, we call sorflush ourself, since we know 890 * it is a Unix domain socket anyhow. After we destroy all the 891 * rights carried in messages, we do a last closef to get rid 892 * of our extra reference. This is the last close, and the 893 * unp_detach etc will shut down the socket. 894 * 895 * 91/09/19, bsy@cs.cmu.edu 896 */ 897 extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK); 898 for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; 899 fp != NULL; fp = nextfp) { 900 nextfp = LIST_NEXT(fp, f_list); 901 if (fp->f_count == 0) 902 continue; 903 if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) { 904 *fpp++ = fp; 905 nunref++; 906 FREF(fp); 907 fp->f_count++; 908 } 909 } 910 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) 911 if ((*fpp)->f_type == DTYPE_SOCKET && (*fpp)->f_data != NULL) 912 sorflush((struct socket *)(*fpp)->f_data); 913 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) 914 (void) closef(*fpp, NULL); 915 free((caddr_t)extra_ref, M_FILE); 916 unp_gcing = 0; 917 } 918 919 void 920 unp_dispose(struct mbuf *m) 921 { 922 923 if (m) 924 unp_scan(m, unp_discard, 1); 925 } 926 927 void 928 unp_scan(struct mbuf *m0, void (*op)(struct file *), int discard) 929 { 930 struct mbuf *m; 931 struct file **rp, *fp; 932 struct cmsghdr *cm; 933 int i; 934 int qfds; 935 936 while (m0) { 937 for (m = m0; m; m = m->m_next) { 938 if (m->m_type == MT_CONTROL && 939 m->m_len >= sizeof(*cm)) { 940 cm = mtod(m, struct cmsghdr *); 941 if (cm->cmsg_level != SOL_SOCKET || 942 cm->cmsg_type != SCM_RIGHTS) 943 continue; 944 qfds = (cm->cmsg_len - CMSG_ALIGN(sizeof *cm)) 945 / sizeof(struct file *); 946 rp = (struct file **)CMSG_DATA(cm); 947 for (i = 0; i < qfds; i++) { 948 fp = *rp; 949 if (discard) 950 *rp = 0; 951 (*op)(fp); 952 rp++; 953 } 954 break; /* XXX, but saves time */ 955 } 956 } 957 m0 = m0->m_nextpkt; 958 } 959 } 960 961 void 962 unp_mark(struct file *fp) 963 { 964 if (fp == NULL) 965 return; 966 967 if (fp->f_flag & FMARK) 968 return; 969 970 if (fp->f_flag & FDEFER) 971 return; 972 973 if (fp->f_type == DTYPE_SOCKET) { 974 unp_defer++; 975 fp->f_flag |= FDEFER; 976 } else { 977 fp->f_flag |= FMARK; 978 } 979 } 980 981 void 982 unp_discard(struct file *fp) 983 { 984 985 if (fp == NULL) 986 return; 987 FREF(fp); 988 fp->f_msgcount--; 989 unp_rights--; 990 (void) closef(fp, NULL); 991 } 992