]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/uipc_usrreq.c
projects / apple / xnu.git / blob
? search:


202f2d8588dcda57dd3388049473c3e799ec9ef7
[apple/xnu.git] / bsd / kern / uipc_usrreq.c
1 /*
2 * Copyright (c) 2000-2008 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1989, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/domain.h>
73 #include <sys/fcntl.h>
74 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */
75 #include <sys/file_internal.h>
76 #include <sys/filedesc.h>
77 #include <sys/lock.h>
78 #include <sys/mbuf.h>
79 #include <sys/namei.h>
80 #include <sys/proc_internal.h>
81 #include <sys/kauth.h>
82 #include <sys/protosw.h>
83 #include <sys/socket.h>
84 #include <sys/socketvar.h>
85 #include <sys/stat.h>
86 #include <sys/sysctl.h>
87 #include <sys/un.h>
88 #include <sys/unpcb.h>
89 #include <sys/vnode_internal.h>
90 #include <sys/kdebug.h>
91
92 #include <kern/zalloc.h>
93 #include <kern/locks.h>
94
95 #if CONFIG_MACF
96 #include <security/mac_framework.h>
97 #endif /* CONFIG_MACF */
98
99 #define f_msgcount f_fglob->fg_msgcount
100 #define f_cred f_fglob->fg_cred
101 #define f_ops f_fglob->fg_ops
102 #define f_offset f_fglob->fg_offset
103 #define f_data f_fglob->fg_data
104 struct zone *unp_zone;
105 static unp_gen_t unp_gencnt;
106 static u_int unp_count;
107
108 static lck_attr_t *unp_mtx_attr;
109 static lck_grp_t *unp_mtx_grp;
110 static lck_grp_attr_t *unp_mtx_grp_attr;
111 static lck_rw_t *unp_list_mtx;
112
113 static lck_mtx_t *unp_disconnect_lock;
114 static lck_mtx_t *unp_connect_lock;
115 static u_int disconnect_in_progress;
116
117 extern lck_mtx_t *uipc_lock;
118 static struct unp_head unp_shead, unp_dhead;
119
120 /*
121 * Unix communications domain.
122 *
123 * TODO:
124 * SEQPACKET, RDM
125 * rethink name space problems
126 * need a proper out-of-band
127 * lock pushdown
128 */
129 static struct sockaddr sun_noname = { sizeof (sun_noname), AF_LOCAL, { 0 } };
130 static ino_t unp_ino; /* prototype for fake inode numbers */
131
132 static int unp_attach(struct socket *);
133 static void unp_detach(struct unpcb *);
134 static int unp_bind(struct unpcb *, struct sockaddr *, proc_t);
135 static int unp_connect(struct socket *, struct sockaddr *, proc_t);
136 static void unp_disconnect(struct unpcb *);
137 static void unp_shutdown(struct unpcb *);
138 static void unp_drop(struct unpcb *, int);
139 __private_extern__ void unp_gc(void);
140 static void unp_scan(struct mbuf *, void (*)(struct fileglob *));
141 static void unp_mark(struct fileglob *);
142 static void unp_discard(struct fileglob *);
143 static void unp_discard_fdlocked(struct fileglob *, proc_t);
144 static int unp_internalize(struct mbuf *, proc_t);
145 static int unp_listen(struct unpcb *, proc_t);
146 static void unpcb_to_compat(struct unpcb *, struct unpcb_compat *);
147 static void unp_get_locks_in_order(struct socket *so, struct socket *conn_so);
148
149 static void
150 unp_get_locks_in_order(struct socket *so, struct socket *conn_so)
151 {
152 if (so < conn_so) {
153 socket_lock(conn_so, 1);
154 } else {
155 struct unpcb *unp = sotounpcb(so);
156 unp->unp_flags |= UNP_DONTDISCONNECT;
157 unp->rw_thrcount++;
158 socket_unlock(so, 0);
159
160 /* Get the locks in the correct order */
161 socket_lock(conn_so, 1);
162 socket_lock(so, 0);
163 unp->rw_thrcount--;
164 if (unp->rw_thrcount == 0) {
165 unp->unp_flags &= ~UNP_DONTDISCONNECT;
166 wakeup(unp);
167 }
168 }
169 }
170
171 static int
172 uipc_abort(struct socket *so)
173 {
174 struct unpcb *unp = sotounpcb(so);
175
176 if (unp == 0)
177 return (EINVAL);
178 unp_drop(unp, ECONNABORTED);
179 unp_detach(unp);
180 sofree(so);
181 return (0);
182 }
183
184 static int
185 uipc_accept(struct socket *so, struct sockaddr **nam)
186 {
187 struct unpcb *unp = sotounpcb(so);
188
189 if (unp == 0)
190 return (EINVAL);
191
192 /*
193 * Pass back name of connected socket,
194 * if it was bound and we are still connected
195 * (our peer may have closed already!).
196 */
197 if (unp->unp_conn && unp->unp_conn->unp_addr) {
198 *nam = dup_sockaddr((struct sockaddr *)
199 unp->unp_conn->unp_addr, 1);
200 } else {
201 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
202 }
203 return (0);
204 }
205
206 /*
207 * Returns: 0 Success
208 * EISCONN
209 * unp_attach:
210 */
211 static int
212 uipc_attach(struct socket *so, __unused int proto, __unused proc_t p)
213 {
214 struct unpcb *unp = sotounpcb(so);
215
216 if (unp != 0)
217 return (EISCONN);
218 return (unp_attach(so));
219 }
220
221 static int
222 uipc_bind(struct socket *so, struct sockaddr *nam, proc_t p)
223 {
224 struct unpcb *unp = sotounpcb(so);
225
226 if (unp == 0)
227 return (EINVAL);
228
229 return (unp_bind(unp, nam, p));
230 }
231
232 /*
233 * Returns: 0 Success
234 * EINVAL
235 * unp_connect:??? [See elsewhere in this file]
236 */
237 static int
238 uipc_connect(struct socket *so, struct sockaddr *nam, proc_t p)
239 {
240 struct unpcb *unp = sotounpcb(so);
241
242 if (unp == 0)
243 return (EINVAL);
244 return (unp_connect(so, nam, p));
245 }
246
247 /*
248 * Returns: 0 Success
249 * EINVAL
250 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
251 * unp_connect2:EINVAL Invalid argument
252 */
253 static int
254 uipc_connect2(struct socket *so1, struct socket *so2)
255 {
256 struct unpcb *unp = sotounpcb(so1);
257
258 if (unp == 0)
259 return (EINVAL);
260
261 return (unp_connect2(so1, so2));
262 }
263
264 /* control is EOPNOTSUPP */
265
266 static int
267 uipc_detach(struct socket *so)
268 {
269 struct unpcb *unp = sotounpcb(so);
270
271 if (unp == 0)
272 return (EINVAL);
273
274 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
275 unp_detach(unp);
276 return (0);
277 }
278
279 static int
280 uipc_disconnect(struct socket *so)
281 {
282 struct unpcb *unp = sotounpcb(so);
283
284 if (unp == 0)
285 return (EINVAL);
286 unp_disconnect(unp);
287 return (0);
288 }
289
290 /*
291 * Returns: 0 Success
292 * EINVAL
293 */
294 static int
295 uipc_listen(struct socket *so, __unused proc_t p)
296 {
297 struct unpcb *unp = sotounpcb(so);
298
299 if (unp == 0 || unp->unp_vnode == 0)
300 return (EINVAL);
301 return (unp_listen(unp, p));
302 }
303
304 static int
305 uipc_peeraddr(struct socket *so, struct sockaddr **nam)
306 {
307 struct unpcb *unp = sotounpcb(so);
308
309 if (unp == NULL)
310 return (EINVAL);
311 if (unp->unp_conn != NULL && unp->unp_conn->unp_addr != NULL) {
312 *nam = dup_sockaddr((struct sockaddr *)
313 unp->unp_conn->unp_addr, 1);
314 } else {
315 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
316 }
317 return (0);
318 }
319
320 static int
321 uipc_rcvd(struct socket *so, __unused int flags)
322 {
323 struct unpcb *unp = sotounpcb(so);
324 struct socket *so2;
325
326 if (unp == 0)
327 return (EINVAL);
328 switch (so->so_type) {
329 case SOCK_DGRAM:
330 panic("uipc_rcvd DGRAM?");
331 /*NOTREACHED*/
332
333 case SOCK_STREAM:
334 #define rcv (&so->so_rcv)
335 #define snd (&so2->so_snd)
336 if (unp->unp_conn == 0)
337 break;
338
339 so2 = unp->unp_conn->unp_socket;
340 unp_get_locks_in_order(so, so2);
341 /*
342 * Adjust backpressure on sender
343 * and wakeup any waiting to write.
344 */
345 snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
346 unp->unp_mbcnt = rcv->sb_mbcnt;
347 snd->sb_hiwat += unp->unp_cc - rcv->sb_cc;
348 unp->unp_cc = rcv->sb_cc;
349 sowwakeup(so2);
350
351 socket_unlock(so2, 1);
352
353 #undef snd
354 #undef rcv
355 break;
356
357 default:
358 panic("uipc_rcvd unknown socktype");
359 }
360 return (0);
361 }
362
363 /* pru_rcvoob is EOPNOTSUPP */
364
365 /*
366 * Returns: 0 Success
367 * EINVAL
368 * EOPNOTSUPP
369 * EPIPE
370 * ENOTCONN
371 * EISCONN
372 * unp_internalize:EINVAL
373 * unp_internalize:EBADF
374 * unp_connect:EAFNOSUPPORT Address family not supported
375 * unp_connect:EINVAL Invalid argument
376 * unp_connect:ENOTSOCK Not a socket
377 * unp_connect:ECONNREFUSED Connection refused
378 * unp_connect:EISCONN Socket is connected
379 * unp_connect:EPROTOTYPE Protocol wrong type for socket
380 * unp_connect:???
381 * sbappendaddr:ENOBUFS [5th argument, contents modified]
382 * sbappendaddr:??? [whatever a filter author chooses]
383 */
384 static int
385 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
386 struct mbuf *control, proc_t p)
387 {
388 int error = 0;
389 struct unpcb *unp = sotounpcb(so);
390 struct socket *so2;
391
392 if (unp == 0) {
393 error = EINVAL;
394 goto release;
395 }
396 if (flags & PRUS_OOB) {
397 error = EOPNOTSUPP;
398 goto release;
399 }
400
401 if (control) {
402 /* release lock to avoid deadlock (4436174) */
403 socket_unlock(so, 0);
404 error = unp_internalize(control, p);
405 socket_lock(so, 0);
406 if (error)
407 goto release;
408 }
409
410 switch (so->so_type) {
411 case SOCK_DGRAM:
412 {
413 struct sockaddr *from;
414
415 if (nam) {
416 if (unp->unp_conn) {
417 error = EISCONN;
418 break;
419 }
420 error = unp_connect(so, nam, p);
421 if (error)
422 break;
423 } else {
424 if (unp->unp_conn == 0) {
425 error = ENOTCONN;
426 break;
427 }
428 }
429
430 so2 = unp->unp_conn->unp_socket;
431 unp_get_locks_in_order(so, so2);
432
433 if (unp->unp_addr)
434 from = (struct sockaddr *)unp->unp_addr;
435 else
436 from = &sun_noname;
437 /*
438 * sbappendaddr() will fail when the receiver runs out of
439 * space; in contrast to SOCK_STREAM, we will lose messages
440 * for the SOCK_DGRAM case when the receiver's queue overflows.
441 * SB_UNIX on the socket buffer implies that the callee will
442 * not free the control message, if any, because we would need
443 * to call unp_dispose() on it.
444 */
445 if (sbappendaddr(&so2->so_rcv, from, m, control, &error)) {
446 control = NULL;
447 sorwakeup(so2);
448 } else if (control != NULL && error == 0) {
449 /* A socket filter took control; don't touch it */
450 control = NULL;
451 }
452
453 socket_unlock(so2, 1);
454
455 m = NULL;
456 if (nam)
457 unp_disconnect(unp);
458 break;
459 }
460
461 case SOCK_STREAM: {
462 int didreceive = 0;
463 #define rcv (&so2->so_rcv)
464 #define snd (&so->so_snd)
465 /* Connect if not connected yet. */
466 /*
467 * Note: A better implementation would complain
468 * if not equal to the peer's address.
469 */
470 if ((so->so_state & SS_ISCONNECTED) == 0) {
471 if (nam) {
472 error = unp_connect(so, nam, p);
473 if (error)
474 break; /* XXX */
475 } else {
476 error = ENOTCONN;
477 break;
478 }
479 }
480
481 if (so->so_state & SS_CANTSENDMORE) {
482 error = EPIPE;
483 break;
484 }
485 if (unp->unp_conn == 0)
486 panic("uipc_send connected but no connection?");
487
488 so2 = unp->unp_conn->unp_socket;
489 unp_get_locks_in_order(so, so2);
490
491 /* Check socket state again as we might have unlocked the socket
492 * while trying to get the locks in order
493 */
494
495 if ((so->so_state & SS_CANTSENDMORE)) {
496 error = EPIPE;
497 socket_unlock(so2, 1);
498 break;
499 }
500
501 /*
502 * Send to paired receive port, and then reduce send buffer
503 * hiwater marks to maintain backpressure. Wake up readers.
504 * SB_UNIX flag will allow new record to be appended to the
505 * receiver's queue even when it is already full. It is
506 * possible, however, that append might fail. In that case,
507 * we will need to call unp_dispose() on the control message;
508 * the callee will not free it since SB_UNIX is set.
509 */
510 didreceive = control ?
511 sbappendcontrol(rcv, m, control, &error) : sbappend(rcv, m);
512
513 snd->sb_mbmax -= rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
514 unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
515 snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc;
516 unp->unp_conn->unp_cc = rcv->sb_cc;
517 if (didreceive) {
518 control = NULL;
519 sorwakeup(so2);
520 } else if (control != NULL && error == 0) {
521 /* A socket filter took control; don't touch it */
522 control = NULL;
523 }
524
525 socket_unlock(so2, 1);
526 m = NULL;
527 #undef snd
528 #undef rcv
529 }
530 break;
531
532 default:
533 panic("uipc_send unknown socktype");
534 }
535
536 /*
537 * SEND_EOF is equivalent to a SEND followed by
538 * a SHUTDOWN.
539 */
540 if (flags & PRUS_EOF) {
541 socantsendmore(so);
542 unp_shutdown(unp);
543 }
544
545 if (control && error != 0) {
546 socket_unlock(so, 0);
547 unp_dispose(control);
548 socket_lock(so, 0);
549 }
550
551 release:
552 if (control)
553 m_freem(control);
554 if (m)
555 m_freem(m);
556 return (error);
557 }
558
559 static int
560 uipc_sense(struct socket *so, void *ub, int isstat64)
561 {
562 struct unpcb *unp = sotounpcb(so);
563 struct socket *so2;
564 blksize_t blksize;
565
566 if (unp == 0)
567 return (EINVAL);
568
569 blksize = so->so_snd.sb_hiwat;
570 if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
571 so2 = unp->unp_conn->unp_socket;
572 blksize += so2->so_rcv.sb_cc;
573 }
574 if (unp->unp_ino == 0)
575 unp->unp_ino = unp_ino++;
576
577 if (isstat64 != 0) {
578 struct stat64 *sb64;
579
580 sb64 = (struct stat64 *)ub;
581 sb64->st_blksize = blksize;
582 sb64->st_dev = NODEV;
583 sb64->st_ino = (ino64_t)unp->unp_ino;
584 } else {
585 struct stat *sb;
586
587 sb = (struct stat *)ub;
588 sb->st_blksize = blksize;
589 sb->st_dev = NODEV;
590 sb->st_ino = (ino_t)(uintptr_t)unp->unp_ino;
591 }
592
593 return (0);
594 }
595
596 /*
597 * Returns: 0 Success
598 * EINVAL
599 *
600 * Notes: This is not strictly correct, as unp_shutdown() also calls
601 * socantrcvmore(). These should maybe both be conditionalized
602 * on the 'how' argument in soshutdown() as called from the
603 * shutdown() system call.
604 */
605 static int
606 uipc_shutdown(struct socket *so)
607 {
608 struct unpcb *unp = sotounpcb(so);
609
610 if (unp == 0)
611 return (EINVAL);
612 socantsendmore(so);
613 unp_shutdown(unp);
614 return (0);
615 }
616
617 /*
618 * Returns: 0 Success
619 * EINVAL Invalid argument
620 */
621 static int
622 uipc_sockaddr(struct socket *so, struct sockaddr **nam)
623 {
624 struct unpcb *unp = sotounpcb(so);
625
626 if (unp == NULL)
627 return (EINVAL);
628 if (unp->unp_addr != NULL) {
629 *nam = dup_sockaddr((struct sockaddr *)unp->unp_addr, 1);
630 } else {
631 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
632 }
633 return (0);
634 }
635
636 struct pr_usrreqs uipc_usrreqs = {
637 uipc_abort, uipc_accept, uipc_attach, uipc_bind, uipc_connect,
638 uipc_connect2, pru_control_notsupp, uipc_detach, uipc_disconnect,
639 uipc_listen, uipc_peeraddr, uipc_rcvd, pru_rcvoob_notsupp,
640 uipc_send, uipc_sense, uipc_shutdown, uipc_sockaddr,
641 sosend, soreceive, pru_sopoll_notsupp
642 };
643
644 int
645 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
646 {
647 struct unpcb *unp = sotounpcb(so);
648 int error;
649
650 switch (sopt->sopt_dir) {
651 case SOPT_GET:
652 switch (sopt->sopt_name) {
653 case LOCAL_PEERCRED:
654 if (unp->unp_flags & UNP_HAVEPC) {
655 error = sooptcopyout(sopt, &unp->unp_peercred,
656 sizeof (unp->unp_peercred));
657 } else {
658 if (so->so_type == SOCK_STREAM)
659 error = ENOTCONN;
660 else
661 error = EINVAL;
662 }
663 break;
664 default:
665 error = EOPNOTSUPP;
666 break;
667 }
668 break;
669 case SOPT_SET:
670 default:
671 error = EOPNOTSUPP;
672 break;
673 }
674 return (error);
675 }
676
677 /*
678 * Both send and receive buffers are allocated PIPSIZ bytes of buffering
679 * for stream sockets, although the total for sender and receiver is
680 * actually only PIPSIZ.
681 * Datagram sockets really use the sendspace as the maximum datagram size,
682 * and don't really want to reserve the sendspace. Their recvspace should
683 * be large enough for at least one max-size datagram plus address.
684 */
685 #ifndef PIPSIZ
686 #define PIPSIZ 8192
687 #endif
688 static u_int32_t unpst_sendspace = PIPSIZ;
689 static u_int32_t unpst_recvspace = PIPSIZ;
690 static u_int32_t unpdg_sendspace = 2*1024; /* really max datagram size */
691 static u_int32_t unpdg_recvspace = 4*1024;
692
693 static int unp_rights; /* file descriptors in flight */
694 static int unp_disposed; /* discarded file descriptors */
695
696 SYSCTL_DECL(_net_local_stream);
697 SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
698 &unpst_sendspace, 0, "");
699 SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
700 &unpst_recvspace, 0, "");
701 SYSCTL_DECL(_net_local_dgram);
702 SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
703 &unpdg_sendspace, 0, "");
704 SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
705 &unpdg_recvspace, 0, "");
706 SYSCTL_DECL(_net_local);
707 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, "");
708
709 /*
710 * Returns: 0 Success
711 * ENOBUFS
712 * soreserve:ENOBUFS
713 */
714 static int
715 unp_attach(struct socket *so)
716 {
717 struct unpcb *unp;
718 int error = 0;
719
720 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
721 switch (so->so_type) {
722
723 case SOCK_STREAM:
724 error = soreserve(so, unpst_sendspace, unpst_recvspace);
725 break;
726
727 case SOCK_DGRAM:
728 error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
729 break;
730
731 default:
732 panic("unp_attach");
733 }
734 if (error)
735 return (error);
736 }
737 unp = (struct unpcb *)zalloc(unp_zone);
738 if (unp == NULL)
739 return (ENOBUFS);
740 bzero(unp, sizeof (*unp));
741
742 unp->unp_mtx = lck_mtx_alloc_init(unp_mtx_grp, unp_mtx_attr);
743 if (unp->unp_mtx == NULL) {
744 zfree(unp_zone, unp);
745 return(ENOBUFS);
746 }
747
748 lck_rw_lock_exclusive(unp_list_mtx);
749 LIST_INIT(&unp->unp_refs);
750 unp->unp_socket = so;
751 unp->unp_gencnt = ++unp_gencnt;
752 unp_count++;
753 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ?
754 &unp_dhead : &unp_shead, unp, unp_link);
755 lck_rw_done(unp_list_mtx);
756 so->so_pcb = (caddr_t)unp;
757 /*
758 * Mark AF_UNIX socket buffers accordingly so that:
759 *
760 * a. In the SOCK_STREAM case, socket buffer append won't fail due to
761 * the lack of space; this essentially loosens the sbspace() check,
762 * since there is disconnect between sosend() and uipc_send() with
763 * respect to flow control that might result in our dropping the
764 * data in uipc_send(). By setting this, we allow for slightly
765 * more records to be appended to the receiving socket to avoid
766 * losing data (which we can't afford in the SOCK_STREAM case).
767 * Flow control still takes place since we adjust the sender's
768 * hiwat during each send. This doesn't affect the SOCK_DGRAM
769 * case and append would still fail when the queue overflows.
770 *
771 * b. In the presence of control messages containing internalized
772 * file descriptors, the append routines will not free them since
773 * we'd need to undo the work first via unp_dispose().
774 */
775 so->so_rcv.sb_flags |= SB_UNIX;
776 so->so_snd.sb_flags |= SB_UNIX;
777 return (0);
778 }
779
780 static void
781 unp_detach(struct unpcb *unp)
782 {
783 int so_locked = 1;
784
785 lck_rw_lock_exclusive(unp_list_mtx);
786 LIST_REMOVE(unp, unp_link);
787 lck_rw_done(unp_list_mtx);
788 if (unp->unp_vnode) {
789 struct vnode *tvp = NULL;
790 socket_unlock(unp->unp_socket, 0);
791
792 /* Holding unp_connect_lock will avoid a race between
793 * a thread closing the listening socket and a thread
794 * connecting to it.
795 */
796 lck_mtx_lock(unp_connect_lock);
797 socket_lock(unp->unp_socket, 0);
798 if (unp->unp_vnode) {
799 tvp = unp->unp_vnode;
800 unp->unp_vnode->v_socket = NULL;
801 unp->unp_vnode = NULL;
802 }
803 lck_mtx_unlock(unp_connect_lock);
804 if (tvp != NULL)
805 vnode_rele(tvp); /* drop the usecount */
806 }
807 if (unp->unp_conn)
808 unp_disconnect(unp);
809 while (unp->unp_refs.lh_first) {
810 struct unpcb *unp2 = NULL;
811
812 /* This datagram socket is connected to one or more
813 * sockets. In order to avoid a race condition between removing
814 * this reference and closing the connected socket, we need
815 * to check disconnect_in_progress
816 */
817 if (so_locked == 1) {
818 socket_unlock(unp->unp_socket, 0);
819 so_locked = 0;
820 }
821 lck_mtx_lock(unp_disconnect_lock);
822 while (disconnect_in_progress != 0) {
823 (void)msleep((caddr_t)&disconnect_in_progress, unp_disconnect_lock,
824 PSOCK, "disconnect", NULL);
825 }
826 disconnect_in_progress = 1;
827 lck_mtx_unlock(unp_disconnect_lock);
828
829 /* Now we are sure that any unpcb socket disconnect is not happening */
830 if (unp->unp_refs.lh_first != NULL) {
831 unp2 = unp->unp_refs.lh_first;
832 socket_lock(unp2->unp_socket, 1);
833 }
834
835 lck_mtx_lock(unp_disconnect_lock);
836 disconnect_in_progress = 0;
837 wakeup(&disconnect_in_progress);
838 lck_mtx_unlock(unp_disconnect_lock);
839
840 if (unp2 != NULL) {
841 /* We already locked this socket and have a reference on it */
842 unp_drop(unp2, ECONNRESET);
843 socket_unlock(unp2->unp_socket, 1);
844 }
845 }
846
847 if (so_locked == 0) {
848 socket_lock(unp->unp_socket, 0);
849 so_locked = 1;
850 }
851 soisdisconnected(unp->unp_socket);
852 /* makes sure we're getting dealloced */
853 unp->unp_socket->so_flags |= SOF_PCBCLEARING;
854 }
855
856 /*
857 * Returns: 0 Success
858 * EAFNOSUPPORT
859 * EINVAL
860 * EADDRINUSE
861 * namei:??? [anything namei can return]
862 * vnode_authorize:??? [anything vnode_authorize can return]
863 *
864 * Notes: p at this point is the current process, as this function is
865 * only called by sobind().
866 */
867 static int
868 unp_bind(
869 struct unpcb *unp,
870 struct sockaddr *nam,
871 proc_t p)
872 {
873 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
874 struct vnode *vp, *dvp;
875 struct vnode_attr va;
876 vfs_context_t ctx = vfs_context_current();
877 int error, namelen;
878 struct nameidata nd;
879 struct socket *so = unp->unp_socket;
880 char buf[SOCK_MAXADDRLEN];
881
882 if (nam->sa_family != 0 && nam->sa_family != AF_UNIX) {
883 return (EAFNOSUPPORT);
884 }
885
886 if (unp->unp_vnode != NULL)
887 return (EINVAL);
888 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
889 if (namelen <= 0)
890 return (EINVAL);
891
892 socket_unlock(so, 0);
893
894 strlcpy(buf, soun->sun_path, namelen+1);
895 NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
896 CAST_USER_ADDR_T(buf), ctx);
897 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
898 error = namei(&nd);
899 if (error) {
900 socket_lock(so, 0);
901 return (error);
902 }
903 dvp = nd.ni_dvp;
904 vp = nd.ni_vp;
905
906 if (vp != NULL) {
907 /*
908 * need to do this before the vnode_put of dvp
909 * since we may have to release an fs_nodelock
910 */
911 nameidone(&nd);
912
913 vnode_put(dvp);
914 vnode_put(vp);
915
916 socket_lock(so, 0);
917 return (EADDRINUSE);
918 }
919
920 VATTR_INIT(&va);
921 VATTR_SET(&va, va_type, VSOCK);
922 VATTR_SET(&va, va_mode, (ACCESSPERMS & ~p->p_fd->fd_cmask));
923
924 #if CONFIG_MACF
925 error = mac_vnode_check_create(ctx,
926 nd.ni_dvp, &nd.ni_cnd, &va);
927
928 if (error == 0)
929 #endif /* CONFIG_MACF */
930 #if CONFIG_MACF_SOCKET_SUBSET
931 error = mac_vnode_check_uipc_bind(ctx,
932 nd.ni_dvp, &nd.ni_cnd, &va);
933
934 if (error == 0)
935 #endif /* MAC_SOCKET_SUBSET */
936 /* authorize before creating */
937 error = vnode_authorize(dvp, NULL, KAUTH_VNODE_ADD_FILE, ctx);
938
939 if (!error) {
940 /* create the socket */
941 error = vn_create(dvp, &vp, &nd.ni_cnd, &va, 0, ctx);
942 }
943
944 nameidone(&nd);
945 vnode_put(dvp);
946
947 if (error) {
948 socket_lock(so, 0);
949 return (error);
950 }
951 vnode_ref(vp); /* gain a longterm reference */
952 socket_lock(so, 0);
953 vp->v_socket = unp->unp_socket;
954 unp->unp_vnode = vp;
955 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam, 1);
956 vnode_put(vp); /* drop the iocount */
957
958 return (0);
959 }
960
961
962 /*
963 * Returns: 0 Success
964 * EAFNOSUPPORT Address family not supported
965 * EINVAL Invalid argument
966 * ENOTSOCK Not a socket
967 * ECONNREFUSED Connection refused
968 * EPROTOTYPE Protocol wrong type for socket
969 * EISCONN Socket is connected
970 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
971 * unp_connect2:EINVAL Invalid argument
972 * namei:??? [anything namei can return]
973 * vnode_authorize:???? [anything vnode_authorize can return]
974 *
975 * Notes: p at this point is the current process, as this function is
976 * only called by sosend(), sendfile(), and soconnectlock().
977 */
978 static int
979 unp_connect(struct socket *so, struct sockaddr *nam, __unused proc_t p)
980 {
981 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
982 struct vnode *vp;
983 struct socket *so2, *so3, *list_so=NULL;
984 struct unpcb *unp, *unp2, *unp3;
985 vfs_context_t ctx = vfs_context_current();
986 int error, len;
987 struct nameidata nd;
988 char buf[SOCK_MAXADDRLEN];
989
990 if (nam->sa_family != 0 && nam->sa_family != AF_UNIX) {
991 return (EAFNOSUPPORT);
992 }
993
994 unp = sotounpcb(so);
995 so2 = so3 = NULL;
996
997 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
998 if (len <= 0)
999 return (EINVAL);
1000
1001 strlcpy(buf, soun->sun_path, len+1);
1002 socket_unlock(so, 0);
1003
1004 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
1005 CAST_USER_ADDR_T(buf), ctx);
1006 error = namei(&nd);
1007 if (error) {
1008 socket_lock(so, 0);
1009 return (error);
1010 }
1011 nameidone(&nd);
1012 vp = nd.ni_vp;
1013 if (vp->v_type != VSOCK) {
1014 error = ENOTSOCK;
1015 socket_lock(so, 0);
1016 goto out;
1017 }
1018
1019 #if CONFIG_MACF_SOCKET_SUBSET
1020 error = mac_vnode_check_uipc_connect(ctx, vp);
1021 if (error) {
1022 socket_lock(so, 0);
1023 goto out;
1024 }
1025 #endif /* MAC_SOCKET_SUBSET */
1026
1027 error = vnode_authorize(vp, NULL, KAUTH_VNODE_WRITE_DATA, ctx);
1028 if (error) {
1029 socket_lock(so, 0);
1030 goto out;
1031 }
1032
1033 lck_mtx_lock(unp_connect_lock);
1034
1035 if (vp->v_socket == 0) {
1036 lck_mtx_unlock(unp_connect_lock);
1037 error = ECONNREFUSED;
1038 socket_lock(so, 0);
1039 goto out;
1040 }
1041
1042 socket_lock(vp->v_socket, 1); /* Get a reference on the listening socket */
1043 so2 = vp->v_socket;
1044 lck_mtx_unlock(unp_connect_lock);
1045
1046
1047 if (so2->so_pcb == NULL) {
1048 error = ECONNREFUSED;
1049 socket_unlock(so2, 1);
1050 socket_lock(so, 0);
1051 goto out;
1052 }
1053
1054 if (so < so2) {
1055 socket_unlock(so2, 0);
1056 socket_lock(so, 0);
1057 socket_lock(so2, 0);
1058 } else {
1059 socket_lock(so, 0);
1060 }
1061 /*
1062 * Check if socket was connected while we were trying to
1063 * get the socket locks in order.
1064 * XXX - probably shouldn't return an error for SOCK_DGRAM
1065 */
1066 if ((so->so_state & SS_ISCONNECTED) != 0) {
1067 socket_unlock(so2, 1);
1068 error = EISCONN;
1069 goto out;
1070 }
1071
1072 if (so->so_type != so2->so_type) {
1073 socket_unlock(so2, 1);
1074 error = EPROTOTYPE;
1075 goto out;
1076 }
1077
1078 if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1079 /* Release the incoming socket but keep a reference */
1080 socket_unlock(so, 0);
1081
1082 if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
1083 (so3 = sonewconn(so2, 0, nam)) == 0) {
1084 error = ECONNREFUSED;
1085 socket_unlock(so2, 1);
1086 socket_lock(so, 0);
1087 goto out;
1088 }
1089 unp2 = sotounpcb(so2);
1090 unp3 = sotounpcb(so3);
1091 if (unp2->unp_addr)
1092 unp3->unp_addr = (struct sockaddr_un *)
1093 dup_sockaddr((struct sockaddr *)unp2->unp_addr, 1);
1094
1095 /*
1096 * unp_peercred management:
1097 *
1098 * The connecter's (client's) credentials are copied
1099 * from its process structure at the time of connect()
1100 * (which is now).
1101 */
1102 cru2x(vfs_context_ucred(ctx), &unp3->unp_peercred);
1103 unp3->unp_flags |= UNP_HAVEPC;
1104 /*
1105 * The receiver's (server's) credentials are copied
1106 * from the unp_peercred member of socket on which the
1107 * former called listen(); unp_listen() cached that
1108 * process's credentials at that time so we can use
1109 * them now.
1110 */
1111 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1112 ("unp_connect: listener without cached peercred"));
1113
1114 /* Here we need to have both so and so2 locks and so2
1115 * is already locked. Lock ordering is required.
1116 */
1117 if (so < so2) {
1118 socket_unlock(so2, 0);
1119 socket_lock(so, 0);
1120 socket_lock(so2, 0);
1121 } else {
1122 socket_lock(so, 0);
1123 }
1124
1125 /* Check again if the socket state changed when its lock was released */
1126 if ((so->so_state & SS_ISCONNECTED) != 0) {
1127 error = EISCONN;
1128 socket_unlock(so2, 1);
1129 socket_lock(so3, 0);
1130 sofreelastref(so3, 1);
1131 goto out;
1132 }
1133 memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1134 sizeof (unp->unp_peercred));
1135 unp->unp_flags |= UNP_HAVEPC;
1136
1137 #if CONFIG_MACF_SOCKET
1138 /* XXXMAC: recursive lock: SOCK_LOCK(so); */
1139 mac_socketpeer_label_associate_socket(so, so3);
1140 mac_socketpeer_label_associate_socket(so3, so);
1141 /* XXXMAC: SOCK_UNLOCK(so); */
1142 #endif /* MAC_SOCKET */
1143
1144 /* Hold the reference on listening socket until the end */
1145 socket_unlock(so2, 0);
1146 list_so = so2;
1147
1148 /* Lock ordering doesn't matter because so3 was just created */
1149 socket_lock(so3, 1);
1150 so2 = so3;
1151
1152 }
1153
1154 error = unp_connect2(so, so2);
1155 if (so2 != NULL) {
1156 socket_unlock(so2, 1);
1157 }
1158
1159 if (list_so != NULL) {
1160 socket_lock(list_so, 0);
1161 socket_unlock(list_so, 1);
1162 }
1163 out:
1164 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1165 vnode_put(vp);
1166 return (error);
1167 }
1168
1169 /*
1170 * Returns: 0 Success
1171 * EPROTOTYPE Protocol wrong type for socket
1172 * EINVAL Invalid argument
1173 */
1174 int
1175 unp_connect2(struct socket *so, struct socket *so2)
1176 {
1177 struct unpcb *unp = sotounpcb(so);
1178 struct unpcb *unp2;
1179
1180 if (so2->so_type != so->so_type)
1181 return (EPROTOTYPE);
1182
1183 unp2 = sotounpcb(so2);
1184
1185 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1186 lck_mtx_assert(unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1187
1188 /* Verify both sockets are still opened */
1189 if (unp == 0 || unp2 == 0)
1190 return (EINVAL);
1191
1192 unp->unp_conn = unp2;
1193 so2->so_usecount++;
1194
1195 switch (so->so_type) {
1196
1197 case SOCK_DGRAM:
1198 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1199
1200
1201 /* Avoid lock order reversals due to drop/acquire in soisconnected. */
1202 /* Keep an extra reference on so2 that will be dropped
1203 * soon after getting the locks in order
1204 */
1205 socket_unlock(so2, 0);
1206 soisconnected(so);
1207 unp_get_locks_in_order(so, so2);
1208 so2->so_usecount--;
1209
1210 break;
1211
1212 case SOCK_STREAM:
1213 /* This takes care of socketpair */
1214 if (!(unp->unp_flags & UNP_HAVEPC) &&
1215 !(unp2->unp_flags & UNP_HAVEPC)) {
1216 cru2x(kauth_cred_get(), &unp->unp_peercred);
1217 unp->unp_flags |= UNP_HAVEPC;
1218
1219 cru2x(kauth_cred_get(), &unp2->unp_peercred);
1220 unp2->unp_flags |= UNP_HAVEPC;
1221 }
1222 unp2->unp_conn = unp;
1223 so->so_usecount++;
1224
1225 /* Avoid lock order reversals due to drop/acquire in soisconnected. */
1226 socket_unlock(so, 0);
1227 soisconnected(so2);
1228
1229 /* Keep an extra reference on so2, that will be dropped soon after
1230 * getting the locks in order again.
1231 */
1232 socket_unlock(so2, 0);
1233
1234 socket_lock(so, 0);
1235 soisconnected(so);
1236
1237 unp_get_locks_in_order(so, so2);
1238 /* Decrement the extra reference left before */
1239 so2->so_usecount--;
1240 break;
1241
1242 default:
1243 panic("unknown socket type %d in unp_connect2", so->so_type);
1244 }
1245 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1246 lck_mtx_assert(unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1247 return (0);
1248 }
1249
1250 static void
1251 unp_disconnect(struct unpcb *unp)
1252 {
1253 struct unpcb *unp2 = NULL;
1254 struct socket *so2 = NULL, *so;
1255 struct socket *waitso;
1256 int so_locked = 1, strdisconn = 0;
1257
1258 so = unp->unp_socket;
1259 if (unp->unp_conn == NULL) {
1260 return;
1261 }
1262 lck_mtx_lock(unp_disconnect_lock);
1263 while (disconnect_in_progress != 0) {
1264 if (so_locked == 1) {
1265 socket_unlock(so, 0);
1266 so_locked = 0;
1267 }
1268 (void)msleep((caddr_t)&disconnect_in_progress, unp_disconnect_lock,
1269 PSOCK, "disconnect", NULL);
1270 }
1271 disconnect_in_progress = 1;
1272 lck_mtx_unlock(unp_disconnect_lock);
1273
1274 if (so_locked == 0) {
1275 socket_lock(so, 0);
1276 so_locked = 1;
1277 }
1278
1279 unp2 = unp->unp_conn;
1280
1281 if (unp2 == 0 || unp2->unp_socket == NULL) {
1282 goto out;
1283 }
1284 so2 = unp2->unp_socket;
1285
1286 try_again:
1287 if (so < so2) {
1288 if (so_locked == 0) {
1289 socket_lock(so, 0);
1290 }
1291 socket_lock(so2, 1);
1292 waitso = so2;
1293 } else {
1294 if (so_locked == 1) {
1295 socket_unlock(so, 0);
1296 }
1297 socket_lock(so2, 1);
1298 socket_lock(so, 0);
1299 waitso = so;
1300 }
1301
1302 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1303 lck_mtx_assert(unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1304
1305 /* Check for the UNP_DONTDISCONNECT flag, if it
1306 * is set, release both sockets and go to sleep
1307 */
1308
1309 if ((((struct unpcb *)waitso->so_pcb)->unp_flags & UNP_DONTDISCONNECT) != 0) {
1310 socket_unlock(so2, 1);
1311 so_locked = 0;
1312
1313 (void)msleep(waitso->so_pcb, unp->unp_mtx,
1314 PSOCK | PDROP, "unpdisconnect", NULL);
1315 goto try_again;
1316 }
1317
1318 if (unp->unp_conn == NULL) {
1319 panic("unp_conn became NULL after sleep");
1320 }
1321
1322 unp->unp_conn = NULL;
1323 so2->so_usecount--;
1324
1325 switch (unp->unp_socket->so_type) {
1326
1327 case SOCK_DGRAM:
1328 LIST_REMOVE(unp, unp_reflink);
1329 unp->unp_socket->so_state &= ~SS_ISCONNECTED;
1330 socket_unlock(so2, 1);
1331 break;
1332
1333 case SOCK_STREAM:
1334 unp2->unp_conn = NULL;
1335 so->so_usecount--;
1336
1337 /* Set the socket state correctly but do a wakeup later when
1338 * we release all locks except the socket lock, this will avoid
1339 * a deadlock.
1340 */
1341 unp->unp_socket->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
1342 unp->unp_socket->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
1343
1344 unp2->unp_socket->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
1345 unp->unp_socket->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
1346 strdisconn = 1;
1347 break;
1348 default:
1349 panic("unknown socket type %d", so->so_type);
1350 }
1351 out:
1352 lck_mtx_lock(unp_disconnect_lock);
1353 disconnect_in_progress = 0;
1354 wakeup(&disconnect_in_progress);
1355 lck_mtx_unlock(unp_disconnect_lock);
1356
1357 if (strdisconn) {
1358 socket_unlock(so, 0);
1359 soisdisconnected(so2);
1360 socket_unlock(so2, 1);
1361
1362 socket_lock(so,0);
1363 soisdisconnected(so);
1364 }
1365 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1366 return;
1367 }
1368
1369 /*
1370 * unpcb_to_compat copies specific bits of a unpcb to a unpcb_compat format.
1371 * The unpcb_compat data structure is passed to user space and must not change.
1372 */
1373 static void
1374 unpcb_to_compat(struct unpcb *up, struct unpcb_compat *cp)
1375 {
1376 #if defined(__LP64__)
1377 cp->unp_link.le_next = (u_int32_t)(uintptr_t)up->unp_link.le_next;
1378 cp->unp_link.le_prev = (u_int32_t)(uintptr_t)up->unp_link.le_prev;
1379 #else
1380 cp->unp_link.le_next = (struct unpcb_compat *)up->unp_link.le_next;
1381 cp->unp_link.le_prev = (struct unpcb_compat **)up->unp_link.le_prev;
1382 #endif
1383 cp->unp_socket = (_UNPCB_PTR(struct socket *))(uintptr_t)up->unp_socket;
1384 cp->unp_vnode = (_UNPCB_PTR(struct vnode *))(uintptr_t)up->unp_vnode;
1385 cp->unp_ino = up->unp_ino;
1386 cp->unp_conn = (_UNPCB_PTR(struct unpcb_compat *))
1387 (uintptr_t)up->unp_conn;
1388 cp->unp_refs = (u_int32_t)(uintptr_t)up->unp_refs.lh_first;
1389 #if defined(__LP64__)
1390 cp->unp_reflink.le_next =
1391 (u_int32_t)(uintptr_t)up->unp_reflink.le_next;
1392 cp->unp_reflink.le_prev =
1393 (u_int32_t)(uintptr_t)up->unp_reflink.le_prev;
1394 #else
1395 cp->unp_reflink.le_next =
1396 (struct unpcb_compat *)up->unp_reflink.le_next;
1397 cp->unp_reflink.le_prev =
1398 (struct unpcb_compat **)up->unp_reflink.le_prev;
1399 #endif
1400 cp->unp_addr = (_UNPCB_PTR(struct sockaddr_un *))
1401 (uintptr_t)up->unp_addr;
1402 cp->unp_cc = up->unp_cc;
1403 cp->unp_mbcnt = up->unp_mbcnt;
1404 cp->unp_gencnt = up->unp_gencnt;
1405 }
1406
1407 static int
1408 unp_pcblist SYSCTL_HANDLER_ARGS
1409 {
1410 #pragma unused(oidp,arg2)
1411 int error, i, n;
1412 struct unpcb *unp, **unp_list;
1413 unp_gen_t gencnt;
1414 struct xunpgen xug;
1415 struct unp_head *head;
1416
1417 lck_rw_lock_shared(unp_list_mtx);
1418 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
1419
1420 /*
1421 * The process of preparing the PCB list is too time-consuming and
1422 * resource-intensive to repeat twice on every request.
1423 */
1424 if (req->oldptr == USER_ADDR_NULL) {
1425 n = unp_count;
1426 req->oldidx = 2 * sizeof (xug) + (n + n / 8) *
1427 sizeof (struct xunpcb);
1428 lck_rw_done(unp_list_mtx);
1429 return (0);
1430 }
1431
1432 if (req->newptr != USER_ADDR_NULL) {
1433 lck_rw_done(unp_list_mtx);
1434 return (EPERM);
1435 }
1436
1437 /*
1438 * OK, now we're committed to doing something.
1439 */
1440 gencnt = unp_gencnt;
1441 n = unp_count;
1442
1443 bzero(&xug, sizeof (xug));
1444 xug.xug_len = sizeof (xug);
1445 xug.xug_count = n;
1446 xug.xug_gen = gencnt;
1447 xug.xug_sogen = so_gencnt;
1448 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1449 if (error) {
1450 lck_rw_done(unp_list_mtx);
1451 return (error);
1452 }
1453
1454 /*
1455 * We are done if there is no pcb
1456 */
1457 if (n == 0) {
1458 lck_rw_done(unp_list_mtx);
1459 return (0);
1460 }
1461
1462 MALLOC(unp_list, struct unpcb **, n * sizeof (*unp_list),
1463 M_TEMP, M_WAITOK);
1464 if (unp_list == 0) {
1465 lck_rw_done(unp_list_mtx);
1466 return (ENOMEM);
1467 }
1468
1469 for (unp = head->lh_first, i = 0; unp && i < n;
1470 unp = unp->unp_link.le_next) {
1471 if (unp->unp_gencnt <= gencnt)
1472 unp_list[i++] = unp;
1473 }
1474 n = i; /* in case we lost some during malloc */
1475
1476 error = 0;
1477 for (i = 0; i < n; i++) {
1478 unp = unp_list[i];
1479 if (unp->unp_gencnt <= gencnt) {
1480 struct xunpcb xu;
1481
1482 bzero(&xu, sizeof (xu));
1483 xu.xu_len = sizeof (xu);
1484 xu.xu_unpp = (_UNPCB_PTR(struct unpcb_compat *))
1485 (uintptr_t)unp;
1486 /*
1487 * XXX - need more locking here to protect against
1488 * connect/disconnect races for SMP.
1489 */
1490 if (unp->unp_addr)
1491 bcopy(unp->unp_addr, &xu.xu_addr,
1492 unp->unp_addr->sun_len);
1493 if (unp->unp_conn && unp->unp_conn->unp_addr)
1494 bcopy(unp->unp_conn->unp_addr,
1495 &xu.xu_caddr,
1496 unp->unp_conn->unp_addr->sun_len);
1497 unpcb_to_compat(unp, &xu.xu_unp);
1498 sotoxsocket(unp->unp_socket, &xu.xu_socket);
1499 error = SYSCTL_OUT(req, &xu, sizeof (xu));
1500 }
1501 }
1502 if (!error) {
1503 /*
1504 * Give the user an updated idea of our state.
1505 * If the generation differs from what we told
1506 * her before, she knows that something happened
1507 * while we were processing this request, and it
1508 * might be necessary to retry.
1509 */
1510 bzero(&xug, sizeof (xug));
1511 xug.xug_len = sizeof (xug);
1512 xug.xug_gen = unp_gencnt;
1513 xug.xug_sogen = so_gencnt;
1514 xug.xug_count = unp_count;
1515 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1516 }
1517 FREE(unp_list, M_TEMP);
1518 lck_rw_done(unp_list_mtx);
1519 return (error);
1520 }
1521
1522 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD,
1523 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
1524 "List of active local datagram sockets");
1525 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD,
1526 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
1527 "List of active local stream sockets");
1528
1529 #if !CONFIG_EMBEDDED
1530
1531 static int
1532 unp_pcblist64 SYSCTL_HANDLER_ARGS
1533 {
1534 #pragma unused(oidp,arg2)
1535 int error, i, n;
1536 struct unpcb *unp, **unp_list;
1537 unp_gen_t gencnt;
1538 struct xunpgen xug;
1539 struct unp_head *head;
1540
1541 lck_rw_lock_shared(unp_list_mtx);
1542 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
1543
1544 /*
1545 * The process of preparing the PCB list is too time-consuming and
1546 * resource-intensive to repeat twice on every request.
1547 */
1548 if (req->oldptr == USER_ADDR_NULL) {
1549 n = unp_count;
1550 req->oldidx = 2 * sizeof (xug) + (n + n / 8) *
1551 (sizeof (struct xunpcb64));
1552 lck_rw_done(unp_list_mtx);
1553 return (0);
1554 }
1555
1556 if (req->newptr != USER_ADDR_NULL) {
1557 lck_rw_done(unp_list_mtx);
1558 return (EPERM);
1559 }
1560
1561 /*
1562 * OK, now we're committed to doing something.
1563 */
1564 gencnt = unp_gencnt;
1565 n = unp_count;
1566
1567 bzero(&xug, sizeof (xug));
1568 xug.xug_len = sizeof (xug);
1569 xug.xug_count = n;
1570 xug.xug_gen = gencnt;
1571 xug.xug_sogen = so_gencnt;
1572 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1573 if (error) {
1574 lck_rw_done(unp_list_mtx);
1575 return (error);
1576 }
1577
1578 /*
1579 * We are done if there is no pcb
1580 */
1581 if (n == 0) {
1582 lck_rw_done(unp_list_mtx);
1583 return (0);
1584 }
1585
1586 MALLOC(unp_list, struct unpcb **, n * sizeof (*unp_list),
1587 M_TEMP, M_WAITOK);
1588 if (unp_list == 0) {
1589 lck_rw_done(unp_list_mtx);
1590 return (ENOMEM);
1591 }
1592
1593 for (unp = head->lh_first, i = 0; unp && i < n;
1594 unp = unp->unp_link.le_next) {
1595 if (unp->unp_gencnt <= gencnt)
1596 unp_list[i++] = unp;
1597 }
1598 n = i; /* in case we lost some during malloc */
1599
1600 error = 0;
1601 for (i = 0; i < n; i++) {
1602 unp = unp_list[i];
1603 if (unp->unp_gencnt <= gencnt) {
1604 struct xunpcb64 xu;
1605 size_t xu_len = sizeof(struct xunpcb64);
1606
1607 bzero(&xu, xu_len);
1608 xu.xu_len = xu_len;
1609 xu.xu_unpp = (u_int64_t)(uintptr_t)unp;
1610 xu.xunp_link.le_next =
1611 (u_int64_t)(uintptr_t)unp->unp_link.le_next;
1612 xu.xunp_link.le_prev =
1613 (u_int64_t)(uintptr_t)unp->unp_link.le_prev;
1614 xu.xunp_socket = (u_int64_t)(uintptr_t)unp->unp_socket;
1615 xu.xunp_vnode = (u_int64_t)(uintptr_t)unp->unp_vnode;
1616 xu.xunp_ino = unp->unp_ino;
1617 xu.xunp_conn = (u_int64_t)(uintptr_t)unp->unp_conn;
1618 xu.xunp_refs = (u_int64_t)(uintptr_t)unp->unp_refs.lh_first;
1619 xu.xunp_reflink.le_next =
1620 (u_int64_t)(uintptr_t)unp->unp_reflink.le_next;
1621 xu.xunp_reflink.le_prev =
1622 (u_int64_t)(uintptr_t)unp->unp_reflink.le_prev;
1623 xu.xunp_cc = unp->unp_cc;
1624 xu.xunp_mbcnt = unp->unp_mbcnt;
1625 xu.xunp_gencnt = unp->unp_gencnt;
1626
1627 if (unp->unp_socket)
1628 sotoxsocket64(unp->unp_socket, &xu.xu_socket);
1629
1630 /*
1631 * XXX - need more locking here to protect against
1632 * connect/disconnect races for SMP.
1633 */
1634 if (unp->unp_addr)
1635 bcopy(unp->unp_addr, &xu.xunp_addr,
1636 unp->unp_addr->sun_len);
1637 if (unp->unp_conn && unp->unp_conn->unp_addr)
1638 bcopy(unp->unp_conn->unp_addr,
1639 &xu.xunp_caddr,
1640 unp->unp_conn->unp_addr->sun_len);
1641
1642 error = SYSCTL_OUT(req, &xu, xu_len);
1643 }
1644 }
1645 if (!error) {
1646 /*
1647 * Give the user an updated idea of our state.
1648 * If the generation differs from what we told
1649 * her before, she knows that something happened
1650 * while we were processing this request, and it
1651 * might be necessary to retry.
1652 */
1653 bzero(&xug, sizeof (xug));
1654 xug.xug_len = sizeof (xug);
1655 xug.xug_gen = unp_gencnt;
1656 xug.xug_sogen = so_gencnt;
1657 xug.xug_count = unp_count;
1658 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1659 }
1660 FREE(unp_list, M_TEMP);
1661 lck_rw_done(unp_list_mtx);
1662 return (error);
1663 }
1664
1665 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist64, CTLFLAG_RD,
1666 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist64, "S,xunpcb64",
1667 "List of active local datagram sockets 64 bit");
1668 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist64, CTLFLAG_RD,
1669 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist64, "S,xunpcb64",
1670 "List of active local stream sockets 64 bit");
1671
1672 #endif /* !CONFIG_EMBEDDED */
1673
1674 static void
1675 unp_shutdown(struct unpcb *unp)
1676 {
1677 struct socket *so = unp->unp_socket;
1678 struct socket *so2;
1679 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn) {
1680 so2 = unp->unp_conn->unp_socket;
1681 unp_get_locks_in_order(so, so2);
1682 socantrcvmore(so2);
1683 socket_unlock(so2, 1);
1684 }
1685 }
1686
1687 static void
1688 unp_drop(struct unpcb *unp, int errno)
1689 {
1690 struct socket *so = unp->unp_socket;
1691
1692 so->so_error = errno;
1693 unp_disconnect(unp);
1694 }
1695
1696 /*
1697 * Returns: 0 Success
1698 * EMSGSIZE The new fd's will not fit
1699 * ENOBUFS Cannot alloc struct fileproc
1700 */
1701 int
1702 unp_externalize(struct mbuf *rights)
1703 {
1704 proc_t p = current_proc(); /* XXX */
1705 int i;
1706 struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
1707 struct fileglob **rp = (struct fileglob **)(cm + 1);
1708 int *fds = (int *)(cm + 1);
1709 struct fileproc *fp;
1710 struct fileglob *fg;
1711 int newfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
1712 int f;
1713
1714 proc_fdlock(p);
1715
1716 /*
1717 * if the new FD's will not fit, then we free them all
1718 */
1719 if (!fdavail(p, newfds)) {
1720 for (i = 0; i < newfds; i++) {
1721 fg = *rp;
1722 unp_discard_fdlocked(fg, p);
1723 *rp++ = NULL;
1724 }
1725 proc_fdunlock(p);
1726
1727 return (EMSGSIZE);
1728 }
1729 /*
1730 * now change each pointer to an fd in the global table to
1731 * an integer that is the index to the local fd table entry
1732 * that we set up to point to the global one we are transferring.
1733 * XXX (1) this assumes a pointer and int are the same size,
1734 * XXX or the mbuf can hold the expansion
1735 * XXX (2) allocation failures should be non-fatal
1736 */
1737 for (i = 0; i < newfds; i++) {
1738 #if CONFIG_MACF_SOCKET
1739 /*
1740 * If receive access is denied, don't pass along
1741 * and error message, just discard the descriptor.
1742 */
1743 if (mac_file_check_receive(kauth_cred_get(), *rp)) {
1744 fg = *rp;
1745 *rp++ = 0;
1746 unp_discard_fdlocked(fg, p);
1747 continue;
1748 }
1749 #endif
1750 if (fdalloc(p, 0, &f))
1751 panic("unp_externalize:fdalloc");
1752 fg = rp[i];
1753 MALLOC_ZONE(fp, struct fileproc *, sizeof (struct fileproc),
1754 M_FILEPROC, M_WAITOK);
1755 if (fp == NULL)
1756 panic("unp_externalize: MALLOC_ZONE");
1757 bzero(fp, sizeof (struct fileproc));
1758 fp->f_iocount = 0;
1759 fp->f_fglob = fg;
1760 fg_removeuipc(fg);
1761 procfdtbl_releasefd(p, f, fp);
1762 (void) OSAddAtomic(-1, &unp_rights);
1763 fds[i] = f;
1764 }
1765 proc_fdunlock(p);
1766
1767 return (0);
1768 }
1769
1770 void
1771 unp_init(void)
1772 {
1773 unp_zone = zinit(sizeof (struct unpcb),
1774 (nmbclusters * sizeof (struct unpcb)), 4096, "unpzone");
1775
1776 if (unp_zone == 0)
1777 panic("unp_init");
1778 LIST_INIT(&unp_dhead);
1779 LIST_INIT(&unp_shead);
1780
1781 /*
1782 * allocate lock group attribute and group for udp pcb mutexes
1783 */
1784 unp_mtx_grp_attr = lck_grp_attr_alloc_init();
1785
1786 unp_mtx_grp = lck_grp_alloc_init("unp_list", unp_mtx_grp_attr);
1787
1788 unp_mtx_attr = lck_attr_alloc_init();
1789
1790 if ((unp_list_mtx = lck_rw_alloc_init(unp_mtx_grp,
1791 unp_mtx_attr)) == NULL)
1792 return; /* pretty much dead if this fails... */
1793
1794 if ((unp_disconnect_lock = lck_mtx_alloc_init(unp_mtx_grp,
1795 unp_mtx_attr)) == NULL)
1796 return;
1797
1798 if ((unp_connect_lock = lck_mtx_alloc_init(unp_mtx_grp,
1799 unp_mtx_attr)) == NULL)
1800 return;
1801 }
1802
1803 #ifndef MIN
1804 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
1805 #endif
1806
1807 /*
1808 * Returns: 0 Success
1809 * EINVAL
1810 * fdgetf_noref:EBADF
1811 */
1812 static int
1813 unp_internalize(struct mbuf *control, proc_t p)
1814 {
1815 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1816 int *fds;
1817 struct fileglob **rp;
1818 struct fileproc *fp;
1819 int i, error;
1820 int oldfds;
1821
1822 /* 64bit: cmsg_len is 'uint32_t', m_len is 'long' */
1823 if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
1824 (socklen_t)cm->cmsg_len != (socklen_t)control->m_len) {
1825 return (EINVAL);
1826 }
1827 oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
1828
1829 proc_fdlock(p);
1830 fds = (int *)(cm + 1);
1831
1832 for (i = 0; i < oldfds; i++) {
1833 struct fileproc *tmpfp;
1834 if (((error = fdgetf_noref(p, fds[i], &tmpfp)) != 0)) {
1835 proc_fdunlock(p);
1836 return (error);
1837 } else if (!filetype_issendable(tmpfp->f_fglob->fg_type)) {
1838 proc_fdunlock(p);
1839 return (EINVAL);
1840 }
1841 }
1842 rp = (struct fileglob **)(cm + 1);
1843
1844 /* On K64 we need to walk backwards because a fileglob * is twice the size of an fd
1845 * and doing them in-order would result in stomping over unprocessed fd's
1846 */
1847 for (i = (oldfds - 1); i >= 0; i--) {
1848 (void) fdgetf_noref(p, fds[i], &fp);
1849 fg_insertuipc(fp->f_fglob);
1850 rp[i] = fp->f_fglob;
1851 (void) OSAddAtomic(1, &unp_rights);
1852 }
1853 proc_fdunlock(p);
1854
1855 return (0);
1856 }
1857
1858 static int unp_defer, unp_gcing, unp_gcwait;
1859 static thread_t unp_gcthread = NULL;
1860
1861 /* always called under uipc_lock */
1862 void
1863 unp_gc_wait(void)
1864 {
1865 if (unp_gcthread == current_thread())
1866 return;
1867
1868 while (unp_gcing != 0) {
1869 unp_gcwait = 1;
1870 msleep(&unp_gcing, uipc_lock, 0 , "unp_gc_wait", NULL);
1871 }
1872 }
1873
1874
1875 __private_extern__ void
1876 unp_gc(void)
1877 {
1878 struct fileglob *fg, *nextfg;
1879 struct socket *so;
1880 static struct fileglob **extra_ref;
1881 struct fileglob **fpp;
1882 int nunref, i;
1883 int need_gcwakeup = 0;
1884
1885 lck_mtx_lock(uipc_lock);
1886 if (unp_gcing) {
1887 lck_mtx_unlock(uipc_lock);
1888 return;
1889 }
1890 unp_gcing = 1;
1891 unp_defer = 0;
1892 unp_gcthread = current_thread();
1893 lck_mtx_unlock(uipc_lock);
1894 /*
1895 * before going through all this, set all FDs to
1896 * be NOT defered and NOT externally accessible
1897 */
1898 for (fg = fmsghead.lh_first; fg != 0; fg = fg->f_msglist.le_next) {
1899 lck_mtx_lock(&fg->fg_lock);
1900 fg->fg_flag &= ~(FMARK|FDEFER);
1901 lck_mtx_unlock(&fg->fg_lock);
1902 }
1903 do {
1904 for (fg = fmsghead.lh_first; fg != 0;
1905 fg = fg->f_msglist.le_next) {
1906 lck_mtx_lock(&fg->fg_lock);
1907 /*
1908 * If the file is not open, skip it
1909 */
1910 if (fg->fg_count == 0) {
1911 lck_mtx_unlock(&fg->fg_lock);
1912 continue;
1913 }
1914 /*
1915 * If we already marked it as 'defer' in a
1916 * previous pass, then try process it this time
1917 * and un-mark it
1918 */
1919 if (fg->fg_flag & FDEFER) {
1920 fg->fg_flag &= ~FDEFER;
1921 unp_defer--;
1922 } else {
1923 /*
1924 * if it's not defered, then check if it's
1925 * already marked.. if so skip it
1926 */
1927 if (fg->fg_flag & FMARK) {
1928 lck_mtx_unlock(&fg->fg_lock);
1929 continue;
1930 }
1931 /*
1932 * If all references are from messages
1933 * in transit, then skip it. it's not
1934 * externally accessible.
1935 */
1936 if (fg->fg_count == fg->fg_msgcount) {
1937 lck_mtx_unlock(&fg->fg_lock);
1938 continue;
1939 }
1940 /*
1941 * If it got this far then it must be
1942 * externally accessible.
1943 */
1944 fg->fg_flag |= FMARK;
1945 }
1946 /*
1947 * either it was defered, or it is externally
1948 * accessible and not already marked so.
1949 * Now check if it is possibly one of OUR sockets.
1950 */
1951 if (fg->fg_type != DTYPE_SOCKET ||
1952 (so = (struct socket *)fg->fg_data) == 0) {
1953 lck_mtx_unlock(&fg->fg_lock);
1954 continue;
1955 }
1956 if (so->so_proto->pr_domain != &localdomain ||
1957 (so->so_proto->pr_flags&PR_RIGHTS) == 0) {
1958 lck_mtx_unlock(&fg->fg_lock);
1959 continue;
1960 }
1961 #ifdef notdef
1962 /*
1963 * if this code is enabled need to run
1964 * under network funnel
1965 */
1966 if (so->so_rcv.sb_flags & SB_LOCK) {
1967 /*
1968 * This is problematical; it's not clear
1969 * we need to wait for the sockbuf to be
1970 * unlocked (on a uniprocessor, at least),
1971 * and it's also not clear what to do
1972 * if sbwait returns an error due to receipt
1973 * of a signal. If sbwait does return
1974 * an error, we'll go into an infinite
1975 * loop. Delete all of this for now.
1976 */
1977 (void) sbwait(&so->so_rcv);
1978 goto restart;
1979 }
1980 #endif
1981 /*
1982 * So, Ok, it's one of our sockets and it IS externally
1983 * accessible (or was defered). Now we look
1984 * to see if we hold any file descriptors in its
1985 * message buffers. Follow those links and mark them
1986 * as accessible too.
1987 *
1988 * In case a file is passed onto itself we need to
1989 * release the file lock.
1990 */
1991 lck_mtx_unlock(&fg->fg_lock);
1992
1993 unp_scan(so->so_rcv.sb_mb, unp_mark);
1994 }
1995 } while (unp_defer);
1996 /*
1997 * We grab an extra reference to each of the file table entries
1998 * that are not otherwise accessible and then free the rights
1999 * that are stored in messages on them.
2000 *
2001 * The bug in the orginal code is a little tricky, so I'll describe
2002 * what's wrong with it here.
2003 *
2004 * It is incorrect to simply unp_discard each entry for f_msgcount
2005 * times -- consider the case of sockets A and B that contain
2006 * references to each other. On a last close of some other socket,
2007 * we trigger a gc since the number of outstanding rights (unp_rights)
2008 * is non-zero. If during the sweep phase the gc code un_discards,
2009 * we end up doing a (full) closef on the descriptor. A closef on A
2010 * results in the following chain. Closef calls soo_close, which
2011 * calls soclose. Soclose calls first (through the switch
2012 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
2013 * returns because the previous instance had set unp_gcing, and
2014 * we return all the way back to soclose, which marks the socket
2015 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
2016 * to free up the rights that are queued in messages on the socket A,
2017 * i.e., the reference on B. The sorflush calls via the dom_dispose
2018 * switch unp_dispose, which unp_scans with unp_discard. This second
2019 * instance of unp_discard just calls closef on B.
2020 *
2021 * Well, a similar chain occurs on B, resulting in a sorflush on B,
2022 * which results in another closef on A. Unfortunately, A is already
2023 * being closed, and the descriptor has already been marked with
2024 * SS_NOFDREF, and soclose panics at this point.
2025 *
2026 * Here, we first take an extra reference to each inaccessible
2027 * descriptor. Then, we call sorflush ourself, since we know
2028 * it is a Unix domain socket anyhow. After we destroy all the
2029 * rights carried in messages, we do a last closef to get rid
2030 * of our extra reference. This is the last close, and the
2031 * unp_detach etc will shut down the socket.
2032 *
2033 * 91/09/19, bsy@cs.cmu.edu
2034 */
2035 extra_ref = _MALLOC(nfiles * sizeof (struct fileglob *),
2036 M_FILEGLOB, M_WAITOK);
2037 if (extra_ref == NULL)
2038 goto bail;
2039 for (nunref = 0, fg = fmsghead.lh_first, fpp = extra_ref; fg != 0;
2040 fg = nextfg) {
2041 lck_mtx_lock(&fg->fg_lock);
2042
2043 nextfg = fg->f_msglist.le_next;
2044 /*
2045 * If it's not open, skip it
2046 */
2047 if (fg->fg_count == 0) {
2048 lck_mtx_unlock(&fg->fg_lock);
2049 continue;
2050 }
2051 /*
2052 * If all refs are from msgs, and it's not marked accessible
2053 * then it must be referenced from some unreachable cycle
2054 * of (shut-down) FDs, so include it in our
2055 * list of FDs to remove
2056 */
2057 if (fg->fg_count == fg->fg_msgcount && !(fg->fg_flag & FMARK)) {
2058 fg->fg_count++;
2059 *fpp++ = fg;
2060 nunref++;
2061 }
2062 lck_mtx_unlock(&fg->fg_lock);
2063 }
2064 /*
2065 * for each FD on our hit list, do the following two things
2066 */
2067 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
2068 struct fileglob *tfg;
2069
2070 tfg = *fpp;
2071
2072 if (tfg->fg_type == DTYPE_SOCKET && tfg->fg_data != NULL) {
2073 so = (struct socket *)(tfg->fg_data);
2074
2075 socket_lock(so, 0);
2076
2077 sorflush(so);
2078
2079 socket_unlock(so, 0);
2080 }
2081 }
2082 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
2083 closef_locked((struct fileproc *)0, *fpp, (proc_t)NULL);
2084
2085 FREE((caddr_t)extra_ref, M_FILEGLOB);
2086 bail:
2087 lck_mtx_lock(uipc_lock);
2088 unp_gcing = 0;
2089 unp_gcthread = NULL;
2090
2091 if (unp_gcwait != 0) {
2092 unp_gcwait = 0;
2093 need_gcwakeup = 1;
2094 }
2095 lck_mtx_unlock(uipc_lock);
2096
2097 if (need_gcwakeup != 0)
2098 wakeup(&unp_gcing);
2099 }
2100
2101 void
2102 unp_dispose(struct mbuf *m)
2103 {
2104 if (m) {
2105 unp_scan(m, unp_discard);
2106 }
2107 }
2108
2109 /*
2110 * Returns: 0 Success
2111 */
2112 static int
2113 unp_listen(struct unpcb *unp, proc_t p)
2114 {
2115 kauth_cred_t safecred = kauth_cred_proc_ref(p);
2116 cru2x(safecred, &unp->unp_peercred);
2117 kauth_cred_unref(&safecred);
2118 unp->unp_flags |= UNP_HAVEPCCACHED;
2119 return (0);
2120 }
2121
2122 /* should run under kernel funnel */
2123 static void
2124 unp_scan(struct mbuf *m0, void (*op)(struct fileglob *))
2125 {
2126 struct mbuf *m;
2127 struct fileglob **rp;
2128 struct cmsghdr *cm;
2129 int i;
2130 int qfds;
2131
2132 while (m0) {
2133 for (m = m0; m; m = m->m_next)
2134 if (m->m_type == MT_CONTROL &&
2135 (size_t)m->m_len >= sizeof (*cm)) {
2136 cm = mtod(m, struct cmsghdr *);
2137 if (cm->cmsg_level != SOL_SOCKET ||
2138 cm->cmsg_type != SCM_RIGHTS)
2139 continue;
2140 qfds = (cm->cmsg_len - sizeof (*cm)) /
2141 sizeof (int);
2142 rp = (struct fileglob **)(cm + 1);
2143 for (i = 0; i < qfds; i++)
2144 (*op)(*rp++);
2145 break; /* XXX, but saves time */
2146 }
2147 m0 = m0->m_act;
2148 }
2149 }
2150
2151 /* should run under kernel funnel */
2152 static void
2153 unp_mark(struct fileglob *fg)
2154 {
2155 lck_mtx_lock(&fg->fg_lock);
2156
2157 if (fg->fg_flag & FMARK) {
2158 lck_mtx_unlock(&fg->fg_lock);
2159 return;
2160 }
2161 fg->fg_flag |= (FMARK|FDEFER);
2162
2163 lck_mtx_unlock(&fg->fg_lock);
2164
2165 unp_defer++;
2166 }
2167
2168 /* should run under kernel funnel */
2169 static void
2170 unp_discard(struct fileglob *fg)
2171 {
2172 proc_t p = current_proc(); /* XXX */
2173
2174 (void) OSAddAtomic(1, &unp_disposed);
2175
2176 proc_fdlock(p);
2177 unp_discard_fdlocked(fg, p);
2178 proc_fdunlock(p);
2179 }
2180 static void
2181 unp_discard_fdlocked(struct fileglob *fg, proc_t p)
2182 {
2183 fg_removeuipc(fg);
2184
2185 (void) OSAddAtomic(-1, &unp_rights);
2186 (void) closef_locked((struct fileproc *)0, fg, p);
2187 }
2188
2189 int
2190 unp_lock(struct socket *so, int refcount, void * lr)
2191 {
2192 void * lr_saved;
2193 if (lr == 0)
2194 lr_saved = (void *) __builtin_return_address(0);
2195 else lr_saved = lr;
2196
2197 if (so->so_pcb) {
2198 lck_mtx_lock(((struct unpcb *)so->so_pcb)->unp_mtx);
2199 } else {
2200 panic("unp_lock: so=%p NO PCB! lr=%p ref=0x%x\n",
2201 so, lr_saved, so->so_usecount);
2202 }
2203
2204 if (so->so_usecount < 0)
2205 panic("unp_lock: so=%p so_pcb=%p lr=%p ref=0x%x\n",
2206 so, so->so_pcb, lr_saved, so->so_usecount);
2207
2208 if (refcount)
2209 so->so_usecount++;
2210
2211 so->lock_lr[so->next_lock_lr] = lr_saved;
2212 so->next_lock_lr = (so->next_lock_lr+1) % SO_LCKDBG_MAX;
2213 return (0);
2214 }
2215
2216 int
2217 unp_unlock(struct socket *so, int refcount, void * lr)
2218 {
2219 void * lr_saved;
2220 lck_mtx_t * mutex_held = NULL;
2221 struct unpcb *unp = sotounpcb(so);
2222
2223 if (lr == 0)
2224 lr_saved = (void *) __builtin_return_address(0);
2225 else lr_saved = lr;
2226
2227 if (refcount)
2228 so->so_usecount--;
2229
2230 if (so->so_usecount < 0)
2231 panic("unp_unlock: so=%p usecount=%x\n", so, so->so_usecount);
2232 if (so->so_pcb == NULL) {
2233 panic("unp_unlock: so=%p NO PCB usecount=%x\n", so, so->so_usecount);
2234 } else {
2235 mutex_held = ((struct unpcb *)so->so_pcb)->unp_mtx;
2236 }
2237 lck_mtx_assert(mutex_held, LCK_MTX_ASSERT_OWNED);
2238 so->unlock_lr[so->next_unlock_lr] = lr_saved;
2239 so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
2240
2241 if (so->so_usecount == 0 && (so->so_flags & SOF_PCBCLEARING)) {
2242 sofreelastref(so, 1);
2243
2244 if (unp->unp_addr)
2245 FREE(unp->unp_addr, M_SONAME);
2246
2247 lck_mtx_unlock(mutex_held);
2248 if (unp->unp_mtx)
2249 lck_mtx_free(unp->unp_mtx, unp_mtx_grp);
2250
2251 unp->unp_gencnt = ++unp_gencnt;
2252 zfree(unp_zone, unp);
2253 --unp_count;
2254
2255 unp_gc();
2256 } else {
2257 lck_mtx_unlock(mutex_held);
2258 }
2259
2260 return (0);
2261 }
2262
2263 lck_mtx_t *
2264 unp_getlock(struct socket *so, __unused int locktype)
2265 {
2266 struct unpcb *unp = (struct unpcb *)so->so_pcb;
2267
2268
2269 if (so->so_pcb) {
2270 if (so->so_usecount < 0)
2271 panic("unp_getlock: so=%p usecount=%x\n", so, so->so_usecount);
2272 return(unp->unp_mtx);
2273 } else {
2274 panic("unp_getlock: so=%p NULL so_pcb\n", so);
2275 return (so->so_proto->pr_domain->dom_mtx);
2276 }
2277 }
2278
mirror of XNU