]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/uipc_usrreq.c
projects / apple / xnu.git / blob
? search:


26f38c8f5238edce4f38790a7bf02fbd551ed2b7
[apple/xnu.git] / bsd / kern / uipc_usrreq.c
1 /*
2 * Copyright (c) 2000-2008 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1989, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/domain.h>
73 #include <sys/fcntl.h>
74 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */
75 #include <sys/file_internal.h>
76 #include <sys/filedesc.h>
77 #include <sys/lock.h>
78 #include <sys/mbuf.h>
79 #include <sys/namei.h>
80 #include <sys/proc_internal.h>
81 #include <sys/kauth.h>
82 #include <sys/protosw.h>
83 #include <sys/socket.h>
84 #include <sys/socketvar.h>
85 #include <sys/stat.h>
86 #include <sys/sysctl.h>
87 #include <sys/un.h>
88 #include <sys/unpcb.h>
89 #include <sys/vnode_internal.h>
90 #include <sys/kdebug.h>
91
92 #include <kern/zalloc.h>
93 #include <kern/locks.h>
94
95 #if CONFIG_MACF
96 #include <security/mac_framework.h>
97 #endif /* CONFIG_MACF */
98
99 #define f_msgcount f_fglob->fg_msgcount
100 #define f_cred f_fglob->fg_cred
101 #define f_ops f_fglob->fg_ops
102 #define f_offset f_fglob->fg_offset
103 #define f_data f_fglob->fg_data
104 struct zone *unp_zone;
105 static unp_gen_t unp_gencnt;
106 static u_int unp_count;
107
108 static lck_attr_t *unp_mtx_attr;
109 static lck_grp_t *unp_mtx_grp;
110 static lck_grp_attr_t *unp_mtx_grp_attr;
111 static lck_rw_t *unp_list_mtx;
112
113 static lck_mtx_t *unp_disconnect_lock;
114 static lck_mtx_t *unp_connect_lock;
115 static u_int disconnect_in_progress;
116
117 extern lck_mtx_t *uipc_lock;
118 static struct unp_head unp_shead, unp_dhead;
119
120 /*
121 * Unix communications domain.
122 *
123 * TODO:
124 * SEQPACKET, RDM
125 * rethink name space problems
126 * need a proper out-of-band
127 * lock pushdown
128 */
129 static struct sockaddr sun_noname = { sizeof (sun_noname), AF_LOCAL, { 0 } };
130 static ino_t unp_ino; /* prototype for fake inode numbers */
131
132 static int unp_attach(struct socket *);
133 static void unp_detach(struct unpcb *);
134 static int unp_bind(struct unpcb *, struct sockaddr *, proc_t);
135 static int unp_connect(struct socket *, struct sockaddr *, proc_t);
136 static void unp_disconnect(struct unpcb *);
137 static void unp_shutdown(struct unpcb *);
138 static void unp_drop(struct unpcb *, int);
139 __private_extern__ void unp_gc(void);
140 static void unp_scan(struct mbuf *, void (*)(struct fileglob *));
141 static void unp_mark(struct fileglob *);
142 static void unp_discard(struct fileglob *);
143 static void unp_discard_fdlocked(struct fileglob *, proc_t);
144 static int unp_internalize(struct mbuf *, proc_t);
145 static int unp_listen(struct unpcb *, proc_t);
146 static void unpcb_to_compat(struct unpcb *, struct unpcb_compat *);
147 static void unp_get_locks_in_order(struct socket *so, struct socket *conn_so);
148
149 static void
150 unp_get_locks_in_order(struct socket *so, struct socket *conn_so)
151 {
152 if (so < conn_so) {
153 socket_lock(conn_so, 1);
154 } else {
155 struct unpcb *unp = sotounpcb(so);
156 unp->unp_flags |= UNP_DONTDISCONNECT;
157 unp->rw_thrcount++;
158 socket_unlock(so, 0);
159
160 /* Get the locks in the correct order */
161 socket_lock(conn_so, 1);
162 socket_lock(so, 0);
163 unp->rw_thrcount--;
164 if (unp->rw_thrcount == 0) {
165 unp->unp_flags &= ~UNP_DONTDISCONNECT;
166 wakeup(unp);
167 }
168 }
169 }
170
171 static int
172 uipc_abort(struct socket *so)
173 {
174 struct unpcb *unp = sotounpcb(so);
175
176 if (unp == 0)
177 return (EINVAL);
178 unp_drop(unp, ECONNABORTED);
179 unp_detach(unp);
180 sofree(so);
181 return (0);
182 }
183
184 static int
185 uipc_accept(struct socket *so, struct sockaddr **nam)
186 {
187 struct unpcb *unp = sotounpcb(so);
188
189 if (unp == 0)
190 return (EINVAL);
191
192 /*
193 * Pass back name of connected socket,
194 * if it was bound and we are still connected
195 * (our peer may have closed already!).
196 */
197 if (unp->unp_conn && unp->unp_conn->unp_addr) {
198 *nam = dup_sockaddr((struct sockaddr *)
199 unp->unp_conn->unp_addr, 1);
200 } else {
201 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
202 }
203 return (0);
204 }
205
206 /*
207 * Returns: 0 Success
208 * EISCONN
209 * unp_attach:
210 */
211 static int
212 uipc_attach(struct socket *so, __unused int proto, __unused proc_t p)
213 {
214 struct unpcb *unp = sotounpcb(so);
215
216 if (unp != 0)
217 return (EISCONN);
218 return (unp_attach(so));
219 }
220
221 static int
222 uipc_bind(struct socket *so, struct sockaddr *nam, proc_t p)
223 {
224 struct unpcb *unp = sotounpcb(so);
225
226 if (unp == 0)
227 return (EINVAL);
228
229 return (unp_bind(unp, nam, p));
230 }
231
232 /*
233 * Returns: 0 Success
234 * EINVAL
235 * unp_connect:??? [See elsewhere in this file]
236 */
237 static int
238 uipc_connect(struct socket *so, struct sockaddr *nam, proc_t p)
239 {
240 struct unpcb *unp = sotounpcb(so);
241
242 if (unp == 0)
243 return (EINVAL);
244 return (unp_connect(so, nam, p));
245 }
246
247 /*
248 * Returns: 0 Success
249 * EINVAL
250 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
251 * unp_connect2:EINVAL Invalid argument
252 */
253 static int
254 uipc_connect2(struct socket *so1, struct socket *so2)
255 {
256 struct unpcb *unp = sotounpcb(so1);
257
258 if (unp == 0)
259 return (EINVAL);
260
261 return (unp_connect2(so1, so2));
262 }
263
264 /* control is EOPNOTSUPP */
265
266 static int
267 uipc_detach(struct socket *so)
268 {
269 struct unpcb *unp = sotounpcb(so);
270
271 if (unp == 0)
272 return (EINVAL);
273
274 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
275 unp_detach(unp);
276 return (0);
277 }
278
279 static int
280 uipc_disconnect(struct socket *so)
281 {
282 struct unpcb *unp = sotounpcb(so);
283
284 if (unp == 0)
285 return (EINVAL);
286 unp_disconnect(unp);
287 return (0);
288 }
289
290 /*
291 * Returns: 0 Success
292 * EINVAL
293 */
294 static int
295 uipc_listen(struct socket *so, __unused proc_t p)
296 {
297 struct unpcb *unp = sotounpcb(so);
298
299 if (unp == 0 || unp->unp_vnode == 0)
300 return (EINVAL);
301 return (unp_listen(unp, p));
302 }
303
304 static int
305 uipc_peeraddr(struct socket *so, struct sockaddr **nam)
306 {
307 struct unpcb *unp = sotounpcb(so);
308
309 if (unp == NULL)
310 return (EINVAL);
311 if (unp->unp_conn != NULL && unp->unp_conn->unp_addr != NULL) {
312 *nam = dup_sockaddr((struct sockaddr *)
313 unp->unp_conn->unp_addr, 1);
314 } else {
315 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
316 }
317 return (0);
318 }
319
320 static int
321 uipc_rcvd(struct socket *so, __unused int flags)
322 {
323 struct unpcb *unp = sotounpcb(so);
324 struct socket *so2;
325
326 if (unp == 0)
327 return (EINVAL);
328 switch (so->so_type) {
329 case SOCK_DGRAM:
330 panic("uipc_rcvd DGRAM?");
331 /*NOTREACHED*/
332
333 case SOCK_STREAM:
334 #define rcv (&so->so_rcv)
335 #define snd (&so2->so_snd)
336 if (unp->unp_conn == 0)
337 break;
338
339 so2 = unp->unp_conn->unp_socket;
340 unp_get_locks_in_order(so, so2);
341 /*
342 * Adjust backpressure on sender
343 * and wakeup any waiting to write.
344 */
345 snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
346 unp->unp_mbcnt = rcv->sb_mbcnt;
347 snd->sb_hiwat += unp->unp_cc - rcv->sb_cc;
348 unp->unp_cc = rcv->sb_cc;
349 sowwakeup(so2);
350
351 socket_unlock(so2, 1);
352
353 #undef snd
354 #undef rcv
355 break;
356
357 default:
358 panic("uipc_rcvd unknown socktype");
359 }
360 return (0);
361 }
362
363 /* pru_rcvoob is EOPNOTSUPP */
364
365 /*
366 * Returns: 0 Success
367 * EINVAL
368 * EOPNOTSUPP
369 * EPIPE
370 * ENOTCONN
371 * EISCONN
372 * unp_internalize:EINVAL
373 * unp_internalize:EBADF
374 * unp_connect:EAFNOSUPPORT Address family not supported
375 * unp_connect:EINVAL Invalid argument
376 * unp_connect:ENOTSOCK Not a socket
377 * unp_connect:ECONNREFUSED Connection refused
378 * unp_connect:EISCONN Socket is connected
379 * unp_connect:EPROTOTYPE Protocol wrong type for socket
380 * unp_connect:???
381 * sbappendaddr:ENOBUFS [5th argument, contents modified]
382 * sbappendaddr:??? [whatever a filter author chooses]
383 */
384 static int
385 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
386 struct mbuf *control, proc_t p)
387 {
388 int error = 0;
389 struct unpcb *unp = sotounpcb(so);
390 struct socket *so2;
391
392 if (unp == 0) {
393 error = EINVAL;
394 goto release;
395 }
396 if (flags & PRUS_OOB) {
397 error = EOPNOTSUPP;
398 goto release;
399 }
400
401 if (control) {
402 /* release lock to avoid deadlock (4436174) */
403 socket_unlock(so, 0);
404 error = unp_internalize(control, p);
405 socket_lock(so, 0);
406 if (error)
407 goto release;
408 }
409
410 switch (so->so_type) {
411 case SOCK_DGRAM:
412 {
413 struct sockaddr *from;
414
415 if (nam) {
416 if (unp->unp_conn) {
417 error = EISCONN;
418 break;
419 }
420 error = unp_connect(so, nam, p);
421 if (error)
422 break;
423 } else {
424 if (unp->unp_conn == 0) {
425 error = ENOTCONN;
426 break;
427 }
428 }
429
430 so2 = unp->unp_conn->unp_socket;
431 unp_get_locks_in_order(so, so2);
432
433 if (unp->unp_addr)
434 from = (struct sockaddr *)unp->unp_addr;
435 else
436 from = &sun_noname;
437 /*
438 * sbappendaddr() will fail when the receiver runs out of
439 * space; in contrast to SOCK_STREAM, we will lose messages
440 * for the SOCK_DGRAM case when the receiver's queue overflows.
441 * SB_UNIX on the socket buffer implies that the callee will
442 * not free the control message, if any, because we would need
443 * to call unp_dispose() on it.
444 */
445 if (sbappendaddr(&so2->so_rcv, from, m, control, &error)) {
446 control = NULL;
447 sorwakeup(so2);
448 } else if (control != NULL && error == 0) {
449 /* A socket filter took control; don't touch it */
450 control = NULL;
451 }
452
453 socket_unlock(so2, 1);
454
455 m = NULL;
456 if (nam)
457 unp_disconnect(unp);
458 break;
459 }
460
461 case SOCK_STREAM: {
462 int didreceive = 0;
463 #define rcv (&so2->so_rcv)
464 #define snd (&so->so_snd)
465 /* Connect if not connected yet. */
466 /*
467 * Note: A better implementation would complain
468 * if not equal to the peer's address.
469 */
470 if ((so->so_state & SS_ISCONNECTED) == 0) {
471 if (nam) {
472 error = unp_connect(so, nam, p);
473 if (error)
474 break; /* XXX */
475 } else {
476 error = ENOTCONN;
477 break;
478 }
479 }
480
481 if (so->so_state & SS_CANTSENDMORE) {
482 error = EPIPE;
483 break;
484 }
485 if (unp->unp_conn == 0)
486 panic("uipc_send connected but no connection?");
487
488 so2 = unp->unp_conn->unp_socket;
489 unp_get_locks_in_order(so, so2);
490
491 /* Check socket state again as we might have unlocked the socket
492 * while trying to get the locks in order
493 */
494
495 if ((so->so_state & SS_CANTSENDMORE)) {
496 error = EPIPE;
497 socket_unlock(so2, 1);
498 break;
499 }
500
501 /*
502 * Send to paired receive port, and then reduce send buffer
503 * hiwater marks to maintain backpressure. Wake up readers.
504 * SB_UNIX flag will allow new record to be appended to the
505 * receiver's queue even when it is already full. It is
506 * possible, however, that append might fail. In that case,
507 * we will need to call unp_dispose() on the control message;
508 * the callee will not free it since SB_UNIX is set.
509 */
510 didreceive = control ?
511 sbappendcontrol(rcv, m, control, &error) : sbappend(rcv, m);
512
513 snd->sb_mbmax -= rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
514 unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
515 snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc;
516 unp->unp_conn->unp_cc = rcv->sb_cc;
517 if (didreceive) {
518 control = NULL;
519 sorwakeup(so2);
520 } else if (control != NULL && error == 0) {
521 /* A socket filter took control; don't touch it */
522 control = NULL;
523 }
524
525 socket_unlock(so2, 1);
526 m = NULL;
527 #undef snd
528 #undef rcv
529 }
530 break;
531
532 default:
533 panic("uipc_send unknown socktype");
534 }
535
536 /*
537 * SEND_EOF is equivalent to a SEND followed by
538 * a SHUTDOWN.
539 */
540 if (flags & PRUS_EOF) {
541 socantsendmore(so);
542 unp_shutdown(unp);
543 }
544
545 if (control && error != 0) {
546 socket_unlock(so, 0);
547 unp_dispose(control);
548 socket_lock(so, 0);
549 }
550
551 release:
552 if (control)
553 m_freem(control);
554 if (m)
555 m_freem(m);
556 return (error);
557 }
558
559 static int
560 uipc_sense(struct socket *so, void *ub, int isstat64)
561 {
562 struct unpcb *unp = sotounpcb(so);
563 struct socket *so2;
564 blksize_t blksize;
565
566 if (unp == 0)
567 return (EINVAL);
568
569 blksize = so->so_snd.sb_hiwat;
570 if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
571 so2 = unp->unp_conn->unp_socket;
572 blksize += so2->so_rcv.sb_cc;
573 }
574 if (unp->unp_ino == 0)
575 unp->unp_ino = unp_ino++;
576
577 if (isstat64 != 0) {
578 struct stat64 *sb64;
579
580 sb64 = (struct stat64 *)ub;
581 sb64->st_blksize = blksize;
582 sb64->st_dev = NODEV;
583 sb64->st_ino = (ino64_t)unp->unp_ino;
584 } else {
585 struct stat *sb;
586
587 sb = (struct stat *)ub;
588 sb->st_blksize = blksize;
589 sb->st_dev = NODEV;
590 sb->st_ino = (ino_t)(uintptr_t)unp->unp_ino;
591 }
592
593 return (0);
594 }
595
596 /*
597 * Returns: 0 Success
598 * EINVAL
599 *
600 * Notes: This is not strictly correct, as unp_shutdown() also calls
601 * socantrcvmore(). These should maybe both be conditionalized
602 * on the 'how' argument in soshutdown() as called from the
603 * shutdown() system call.
604 */
605 static int
606 uipc_shutdown(struct socket *so)
607 {
608 struct unpcb *unp = sotounpcb(so);
609
610 if (unp == 0)
611 return (EINVAL);
612 socantsendmore(so);
613 unp_shutdown(unp);
614 return (0);
615 }
616
617 /*
618 * Returns: 0 Success
619 * EINVAL Invalid argument
620 */
621 static int
622 uipc_sockaddr(struct socket *so, struct sockaddr **nam)
623 {
624 struct unpcb *unp = sotounpcb(so);
625
626 if (unp == NULL)
627 return (EINVAL);
628 if (unp->unp_addr != NULL) {
629 *nam = dup_sockaddr((struct sockaddr *)unp->unp_addr, 1);
630 } else {
631 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
632 }
633 return (0);
634 }
635
636 struct pr_usrreqs uipc_usrreqs = {
637 uipc_abort, uipc_accept, uipc_attach, uipc_bind, uipc_connect,
638 uipc_connect2, pru_control_notsupp, uipc_detach, uipc_disconnect,
639 uipc_listen, uipc_peeraddr, uipc_rcvd, pru_rcvoob_notsupp,
640 uipc_send, uipc_sense, uipc_shutdown, uipc_sockaddr,
641 sosend, soreceive, pru_sopoll_notsupp
642 };
643
644 int
645 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
646 {
647 struct unpcb *unp = sotounpcb(so);
648 int error;
649
650 switch (sopt->sopt_dir) {
651 case SOPT_GET:
652 switch (sopt->sopt_name) {
653 case LOCAL_PEERCRED:
654 if (unp->unp_flags & UNP_HAVEPC) {
655 error = sooptcopyout(sopt, &unp->unp_peercred,
656 sizeof (unp->unp_peercred));
657 } else {
658 if (so->so_type == SOCK_STREAM)
659 error = ENOTCONN;
660 else
661 error = EINVAL;
662 }
663 break;
664 default:
665 error = EOPNOTSUPP;
666 break;
667 }
668 break;
669 case SOPT_SET:
670 default:
671 error = EOPNOTSUPP;
672 break;
673 }
674 return (error);
675 }
676
677 /*
678 * Both send and receive buffers are allocated PIPSIZ bytes of buffering
679 * for stream sockets, although the total for sender and receiver is
680 * actually only PIPSIZ.
681 * Datagram sockets really use the sendspace as the maximum datagram size,
682 * and don't really want to reserve the sendspace. Their recvspace should
683 * be large enough for at least one max-size datagram plus address.
684 */
685 #ifndef PIPSIZ
686 #define PIPSIZ 8192
687 #endif
688 static u_int32_t unpst_sendspace = PIPSIZ;
689 static u_int32_t unpst_recvspace = PIPSIZ;
690 static u_int32_t unpdg_sendspace = 2*1024; /* really max datagram size */
691 static u_int32_t unpdg_recvspace = 4*1024;
692
693 static int unp_rights; /* file descriptors in flight */
694 static int unp_disposed; /* discarded file descriptors */
695
696 SYSCTL_DECL(_net_local_stream);
697 SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
698 &unpst_sendspace, 0, "");
699 SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
700 &unpst_recvspace, 0, "");
701 SYSCTL_DECL(_net_local_dgram);
702 SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
703 &unpdg_sendspace, 0, "");
704 SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
705 &unpdg_recvspace, 0, "");
706 SYSCTL_DECL(_net_local);
707 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, "");
708
709 /*
710 * Returns: 0 Success
711 * ENOBUFS
712 * soreserve:ENOBUFS
713 */
714 static int
715 unp_attach(struct socket *so)
716 {
717 struct unpcb *unp;
718 int error = 0;
719
720 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
721 switch (so->so_type) {
722
723 case SOCK_STREAM:
724 error = soreserve(so, unpst_sendspace, unpst_recvspace);
725 break;
726
727 case SOCK_DGRAM:
728 error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
729 break;
730
731 default:
732 panic("unp_attach");
733 }
734 if (error)
735 return (error);
736 }
737 unp = (struct unpcb *)zalloc(unp_zone);
738 if (unp == NULL)
739 return (ENOBUFS);
740 bzero(unp, sizeof (*unp));
741
742 unp->unp_mtx = lck_mtx_alloc_init(unp_mtx_grp, unp_mtx_attr);
743 if (unp->unp_mtx == NULL) {
744 zfree(unp_zone, unp);
745 return(ENOBUFS);
746 }
747
748 lck_rw_lock_exclusive(unp_list_mtx);
749 LIST_INIT(&unp->unp_refs);
750 unp->unp_socket = so;
751 unp->unp_gencnt = ++unp_gencnt;
752 unp_count++;
753 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ?
754 &unp_dhead : &unp_shead, unp, unp_link);
755 lck_rw_done(unp_list_mtx);
756 so->so_pcb = (caddr_t)unp;
757 /*
758 * Mark AF_UNIX socket buffers accordingly so that:
759 *
760 * a. In the SOCK_STREAM case, socket buffer append won't fail due to
761 * the lack of space; this essentially loosens the sbspace() check,
762 * since there is disconnect between sosend() and uipc_send() with
763 * respect to flow control that might result in our dropping the
764 * data in uipc_send(). By setting this, we allow for slightly
765 * more records to be appended to the receiving socket to avoid
766 * losing data (which we can't afford in the SOCK_STREAM case).
767 * Flow control still takes place since we adjust the sender's
768 * hiwat during each send. This doesn't affect the SOCK_DGRAM
769 * case and append would still fail when the queue overflows.
770 *
771 * b. In the presence of control messages containing internalized
772 * file descriptors, the append routines will not free them since
773 * we'd need to undo the work first via unp_dispose().
774 */
775 so->so_rcv.sb_flags |= SB_UNIX;
776 so->so_snd.sb_flags |= SB_UNIX;
777 return (0);
778 }
779
780 static void
781 unp_detach(struct unpcb *unp)
782 {
783 lck_rw_lock_exclusive(unp_list_mtx);
784 LIST_REMOVE(unp, unp_link);
785 lck_rw_done(unp_list_mtx);
786 if (unp->unp_vnode) {
787 struct vnode *tvp = NULL;
788 socket_unlock(unp->unp_socket, 0);
789
790 /* Holding unp_connect_lock will avoid a race between
791 * a thread closing the listening socket and a thread
792 * connecting to it.
793 */
794 lck_mtx_lock(unp_connect_lock);
795 socket_lock(unp->unp_socket, 0);
796 if (unp->unp_vnode) {
797 tvp = unp->unp_vnode;
798 unp->unp_vnode->v_socket = NULL;
799 unp->unp_vnode = NULL;
800 }
801 lck_mtx_unlock(unp_connect_lock);
802 if (tvp != NULL)
803 vnode_rele(tvp); /* drop the usecount */
804 }
805 if (unp->unp_conn)
806 unp_disconnect(unp);
807 while (unp->unp_refs.lh_first) {
808 struct unpcb *unp2 = unp->unp_refs.lh_first;
809 socket_unlock(unp->unp_socket, 0);
810
811 socket_lock(unp2->unp_socket, 1);
812 unp_drop(unp2, ECONNRESET);
813 socket_unlock(unp2->unp_socket, 1);
814 socket_lock(unp->unp_socket, 0);
815 }
816 soisdisconnected(unp->unp_socket);
817 /* makes sure we're getting dealloced */
818 unp->unp_socket->so_flags |= SOF_PCBCLEARING;
819 }
820
821 /*
822 * Returns: 0 Success
823 * EAFNOSUPPORT
824 * EINVAL
825 * EADDRINUSE
826 * namei:??? [anything namei can return]
827 * vnode_authorize:??? [anything vnode_authorize can return]
828 *
829 * Notes: p at this point is the current process, as this function is
830 * only called by sobind().
831 */
832 static int
833 unp_bind(
834 struct unpcb *unp,
835 struct sockaddr *nam,
836 proc_t p)
837 {
838 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
839 struct vnode *vp, *dvp;
840 struct vnode_attr va;
841 vfs_context_t ctx = vfs_context_current();
842 int error, namelen;
843 struct nameidata nd;
844 struct socket *so = unp->unp_socket;
845 char buf[SOCK_MAXADDRLEN];
846
847 if (nam->sa_family != 0 && nam->sa_family != AF_UNIX) {
848 return (EAFNOSUPPORT);
849 }
850
851 if (unp->unp_vnode != NULL)
852 return (EINVAL);
853 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
854 if (namelen <= 0)
855 return (EINVAL);
856
857 socket_unlock(so, 0);
858
859 strlcpy(buf, soun->sun_path, namelen+1);
860 NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
861 CAST_USER_ADDR_T(buf), ctx);
862 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
863 error = namei(&nd);
864 if (error) {
865 socket_lock(so, 0);
866 return (error);
867 }
868 dvp = nd.ni_dvp;
869 vp = nd.ni_vp;
870
871 if (vp != NULL) {
872 /*
873 * need to do this before the vnode_put of dvp
874 * since we may have to release an fs_nodelock
875 */
876 nameidone(&nd);
877
878 vnode_put(dvp);
879 vnode_put(vp);
880
881 socket_lock(so, 0);
882 return (EADDRINUSE);
883 }
884
885 VATTR_INIT(&va);
886 VATTR_SET(&va, va_type, VSOCK);
887 VATTR_SET(&va, va_mode, (ACCESSPERMS & ~p->p_fd->fd_cmask));
888
889 #if CONFIG_MACF
890 error = mac_vnode_check_create(ctx,
891 nd.ni_dvp, &nd.ni_cnd, &va);
892
893 if (error == 0)
894 #endif /* CONFIG_MACF */
895 #if CONFIG_MACF_SOCKET_SUBSET
896 error = mac_vnode_check_uipc_bind(ctx,
897 nd.ni_dvp, &nd.ni_cnd, &va);
898
899 if (error == 0)
900 #endif /* MAC_SOCKET_SUBSET */
901 /* authorize before creating */
902 error = vnode_authorize(dvp, NULL, KAUTH_VNODE_ADD_FILE, ctx);
903
904 if (!error) {
905 /* create the socket */
906 error = vn_create(dvp, &vp, &nd.ni_cnd, &va, 0, ctx);
907 }
908
909 nameidone(&nd);
910 vnode_put(dvp);
911
912 if (error) {
913 socket_lock(so, 0);
914 return (error);
915 }
916 vnode_ref(vp); /* gain a longterm reference */
917 socket_lock(so, 0);
918 vp->v_socket = unp->unp_socket;
919 unp->unp_vnode = vp;
920 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam, 1);
921 vnode_put(vp); /* drop the iocount */
922
923 return (0);
924 }
925
926
927 /*
928 * Returns: 0 Success
929 * EAFNOSUPPORT Address family not supported
930 * EINVAL Invalid argument
931 * ENOTSOCK Not a socket
932 * ECONNREFUSED Connection refused
933 * EPROTOTYPE Protocol wrong type for socket
934 * EISCONN Socket is connected
935 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
936 * unp_connect2:EINVAL Invalid argument
937 * namei:??? [anything namei can return]
938 * vnode_authorize:???? [anything vnode_authorize can return]
939 *
940 * Notes: p at this point is the current process, as this function is
941 * only called by sosend(), sendfile(), and soconnectlock().
942 */
943 static int
944 unp_connect(struct socket *so, struct sockaddr *nam, __unused proc_t p)
945 {
946 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
947 struct vnode *vp;
948 struct socket *so2, *so3, *list_so=NULL;
949 struct unpcb *unp, *unp2, *unp3;
950 vfs_context_t ctx = vfs_context_current();
951 int error, len;
952 struct nameidata nd;
953 char buf[SOCK_MAXADDRLEN];
954
955 if (nam->sa_family != 0 && nam->sa_family != AF_UNIX) {
956 return (EAFNOSUPPORT);
957 }
958
959 unp = sotounpcb(so);
960 so2 = so3 = NULL;
961
962 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
963 if (len <= 0)
964 return (EINVAL);
965
966 strlcpy(buf, soun->sun_path, len+1);
967 socket_unlock(so, 0);
968
969 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
970 CAST_USER_ADDR_T(buf), ctx);
971 error = namei(&nd);
972 if (error) {
973 socket_lock(so, 0);
974 return (error);
975 }
976 nameidone(&nd);
977 vp = nd.ni_vp;
978 if (vp->v_type != VSOCK) {
979 error = ENOTSOCK;
980 socket_lock(so, 0);
981 goto out;
982 }
983
984 #if CONFIG_MACF_SOCKET_SUBSET
985 error = mac_vnode_check_uipc_connect(ctx, vp);
986 if (error) {
987 socket_lock(so, 0);
988 goto out;
989 }
990 #endif /* MAC_SOCKET_SUBSET */
991
992 error = vnode_authorize(vp, NULL, KAUTH_VNODE_WRITE_DATA, ctx);
993 if (error) {
994 socket_lock(so, 0);
995 goto out;
996 }
997
998 lck_mtx_lock(unp_connect_lock);
999
1000 if (vp->v_socket == 0) {
1001 lck_mtx_unlock(unp_connect_lock);
1002 error = ECONNREFUSED;
1003 socket_lock(so, 0);
1004 goto out;
1005 }
1006
1007 socket_lock(vp->v_socket, 1); /* Get a reference on the listening socket */
1008 so2 = vp->v_socket;
1009 lck_mtx_unlock(unp_connect_lock);
1010
1011
1012 if (so2->so_pcb == NULL) {
1013 error = ECONNREFUSED;
1014 socket_unlock(so2, 1);
1015 socket_lock(so, 0);
1016 goto out;
1017 }
1018
1019 if (so < so2) {
1020 socket_unlock(so2, 0);
1021 socket_lock(so, 0);
1022 socket_lock(so2, 0);
1023 } else {
1024 socket_lock(so, 0);
1025 }
1026 /*
1027 * Check if socket was connected while we were trying to
1028 * get the socket locks in order.
1029 * XXX - probably shouldn't return an error for SOCK_DGRAM
1030 */
1031 if ((so->so_state & SS_ISCONNECTED) != 0) {
1032 socket_unlock(so2, 1);
1033 error = EISCONN;
1034 goto out;
1035 }
1036
1037 if (so->so_type != so2->so_type) {
1038 socket_unlock(so2, 1);
1039 error = EPROTOTYPE;
1040 goto out;
1041 }
1042
1043 if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1044 /* Release the incoming socket but keep a reference */
1045 socket_unlock(so, 0);
1046
1047 if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
1048 (so3 = sonewconn(so2, 0, nam)) == 0) {
1049 error = ECONNREFUSED;
1050 socket_unlock(so2, 1);
1051 socket_lock(so, 0);
1052 goto out;
1053 }
1054 unp2 = sotounpcb(so2);
1055 unp3 = sotounpcb(so3);
1056 if (unp2->unp_addr)
1057 unp3->unp_addr = (struct sockaddr_un *)
1058 dup_sockaddr((struct sockaddr *)unp2->unp_addr, 1);
1059
1060 /*
1061 * unp_peercred management:
1062 *
1063 * The connecter's (client's) credentials are copied
1064 * from its process structure at the time of connect()
1065 * (which is now).
1066 */
1067 cru2x(vfs_context_ucred(ctx), &unp3->unp_peercred);
1068 unp3->unp_flags |= UNP_HAVEPC;
1069 /*
1070 * The receiver's (server's) credentials are copied
1071 * from the unp_peercred member of socket on which the
1072 * former called listen(); unp_listen() cached that
1073 * process's credentials at that time so we can use
1074 * them now.
1075 */
1076 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1077 ("unp_connect: listener without cached peercred"));
1078
1079 /* Here we need to have both so and so2 locks and so2
1080 * is already locked. Lock ordering is required.
1081 */
1082 if (so < so2) {
1083 socket_unlock(so2, 0);
1084 socket_lock(so, 0);
1085 socket_lock(so2, 0);
1086 } else {
1087 socket_lock(so, 0);
1088 }
1089
1090 /* Check again if the socket state changed when its lock was released */
1091 if ((so->so_state & SS_ISCONNECTED) != 0) {
1092 error = EISCONN;
1093 socket_unlock(so2, 1);
1094 socket_lock(so3, 0);
1095 sofreelastref(so3, 1);
1096 goto out;
1097 }
1098 memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1099 sizeof (unp->unp_peercred));
1100 unp->unp_flags |= UNP_HAVEPC;
1101
1102 #if CONFIG_MACF_SOCKET
1103 /* XXXMAC: recursive lock: SOCK_LOCK(so); */
1104 mac_socketpeer_label_associate_socket(so, so3);
1105 mac_socketpeer_label_associate_socket(so3, so);
1106 /* XXXMAC: SOCK_UNLOCK(so); */
1107 #endif /* MAC_SOCKET */
1108
1109 /* Hold the reference on listening socket until the end */
1110 socket_unlock(so2, 0);
1111 list_so = so2;
1112
1113 /* Lock ordering doesn't matter because so3 was just created */
1114 socket_lock(so3, 1);
1115 so2 = so3;
1116
1117 }
1118
1119 error = unp_connect2(so, so2);
1120 if (so2 != NULL) {
1121 socket_unlock(so2, 1);
1122 }
1123
1124 if (list_so != NULL) {
1125 socket_lock(list_so, 0);
1126 socket_unlock(list_so, 1);
1127 }
1128 out:
1129 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1130 vnode_put(vp);
1131 return (error);
1132 }
1133
1134 /*
1135 * Returns: 0 Success
1136 * EPROTOTYPE Protocol wrong type for socket
1137 * EINVAL Invalid argument
1138 */
1139 int
1140 unp_connect2(struct socket *so, struct socket *so2)
1141 {
1142 struct unpcb *unp = sotounpcb(so);
1143 struct unpcb *unp2;
1144
1145 if (so2->so_type != so->so_type)
1146 return (EPROTOTYPE);
1147
1148 unp2 = sotounpcb(so2);
1149
1150 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1151 lck_mtx_assert(unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1152
1153 /* Verify both sockets are still opened */
1154 if (unp == 0 || unp2 == 0)
1155 return (EINVAL);
1156
1157 unp->unp_conn = unp2;
1158 so2->so_usecount++;
1159
1160 switch (so->so_type) {
1161
1162 case SOCK_DGRAM:
1163 lck_rw_lock_exclusive(unp_list_mtx);
1164 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1165 lck_rw_done(unp_list_mtx);
1166
1167
1168 /* Avoid lock order reversals due to drop/acquire in soisconnected. */
1169 /* Keep an extra reference on so2 that will be dropped
1170 * soon after getting the locks in order
1171 */
1172 socket_unlock(so2, 0);
1173 soisconnected(so);
1174 unp_get_locks_in_order(so, so2);
1175 so2->so_usecount--;
1176
1177 break;
1178
1179 case SOCK_STREAM:
1180 /* This takes care of socketpair */
1181 if (!(unp->unp_flags & UNP_HAVEPC) &&
1182 !(unp2->unp_flags & UNP_HAVEPC)) {
1183 cru2x(kauth_cred_get(), &unp->unp_peercred);
1184 unp->unp_flags |= UNP_HAVEPC;
1185
1186 cru2x(kauth_cred_get(), &unp2->unp_peercred);
1187 unp2->unp_flags |= UNP_HAVEPC;
1188 }
1189 unp2->unp_conn = unp;
1190 so->so_usecount++;
1191
1192 /* Avoid lock order reversals due to drop/acquire in soisconnected. */
1193 socket_unlock(so, 0);
1194 soisconnected(so2);
1195
1196 /* Keep an extra reference on so2, that will be dropped soon after
1197 * getting the locks in order again.
1198 */
1199 socket_unlock(so2, 0);
1200
1201 socket_lock(so, 0);
1202 soisconnected(so);
1203
1204 unp_get_locks_in_order(so, so2);
1205 /* Decrement the extra reference left before */
1206 so2->so_usecount--;
1207 break;
1208
1209 default:
1210 panic("unknown socket type %d in unp_connect2", so->so_type);
1211 }
1212 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1213 lck_mtx_assert(unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1214 return (0);
1215 }
1216
1217 static void
1218 unp_disconnect(struct unpcb *unp)
1219 {
1220 struct unpcb *unp2 = NULL;
1221 struct socket *so2 = NULL, *so;
1222 struct socket *waitso;
1223 int so_locked = 1, strdisconn = 0;
1224
1225 so = unp->unp_socket;
1226 if (unp->unp_conn == NULL) {
1227 return;
1228 }
1229 lck_mtx_lock(unp_disconnect_lock);
1230 while (disconnect_in_progress != 0) {
1231 if (so_locked == 1) {
1232 socket_unlock(so, 0);
1233 so_locked = 0;
1234 }
1235 (void)msleep((caddr_t)&disconnect_in_progress, unp_disconnect_lock,
1236 PSOCK, "disconnect", NULL);
1237 }
1238 disconnect_in_progress = 1;
1239 lck_mtx_unlock(unp_disconnect_lock);
1240
1241 if (so_locked == 0) {
1242 socket_lock(so, 0);
1243 so_locked = 1;
1244 }
1245
1246 unp2 = unp->unp_conn;
1247
1248 if (unp2 == 0 || unp2->unp_socket == NULL) {
1249 goto out;
1250 }
1251 so2 = unp2->unp_socket;
1252
1253 try_again:
1254 if (so < so2) {
1255 if (so_locked == 0) {
1256 socket_lock(so, 0);
1257 }
1258 socket_lock(so2, 1);
1259 waitso = so2;
1260 } else {
1261 if (so_locked == 1) {
1262 socket_unlock(so, 0);
1263 }
1264 socket_lock(so2, 1);
1265 socket_lock(so, 0);
1266 waitso = so;
1267 }
1268
1269 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1270 lck_mtx_assert(unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1271
1272 /* Check for the UNP_DONTDISCONNECT flag, if it
1273 * is set, release both sockets and go to sleep
1274 */
1275
1276 if ((((struct unpcb *)waitso->so_pcb)->unp_flags & UNP_DONTDISCONNECT) != 0) {
1277 socket_unlock(so2, 1);
1278 so_locked = 0;
1279
1280 (void)msleep(waitso->so_pcb, unp->unp_mtx,
1281 PSOCK | PDROP, "unpdisconnect", NULL);
1282 goto try_again;
1283 }
1284
1285 if (unp->unp_conn == NULL) {
1286 panic("unp_conn became NULL after sleep");
1287 }
1288
1289 unp->unp_conn = NULL;
1290 so2->so_usecount--;
1291
1292 switch (unp->unp_socket->so_type) {
1293
1294 case SOCK_DGRAM:
1295 lck_rw_lock_exclusive(unp_list_mtx);
1296 LIST_REMOVE(unp, unp_reflink);
1297 lck_rw_done(unp_list_mtx);
1298 unp->unp_socket->so_state &= ~SS_ISCONNECTED;
1299 socket_unlock(so2, 1);
1300 break;
1301
1302 case SOCK_STREAM:
1303 unp2->unp_conn = NULL;
1304 so->so_usecount--;
1305
1306 /* Set the socket state correctly but do a wakeup later when
1307 * we release all locks except the socket lock, this will avoid
1308 * a deadlock.
1309 */
1310 unp->unp_socket->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
1311 unp->unp_socket->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
1312
1313 unp2->unp_socket->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
1314 unp->unp_socket->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
1315 strdisconn = 1;
1316 break;
1317 default:
1318 panic("unknown socket type %d", so->so_type);
1319 }
1320 out:
1321 lck_mtx_lock(unp_disconnect_lock);
1322 disconnect_in_progress = 0;
1323 wakeup(&disconnect_in_progress);
1324 lck_mtx_unlock(unp_disconnect_lock);
1325
1326 if (strdisconn) {
1327 socket_unlock(so, 0);
1328 soisdisconnected(so2);
1329 socket_unlock(so2, 1);
1330
1331 socket_lock(so,0);
1332 soisdisconnected(so);
1333 }
1334 lck_mtx_assert(unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1335 return;
1336 }
1337
1338 /*
1339 * unpcb_to_compat copies specific bits of a unpcb to a unpcb_compat format.
1340 * The unpcb_compat data structure is passed to user space and must not change.
1341 */
1342 static void
1343 unpcb_to_compat(struct unpcb *up, struct unpcb_compat *cp)
1344 {
1345 #if defined(__LP64__)
1346 cp->unp_link.le_next = (u_int32_t)(uintptr_t)up->unp_link.le_next;
1347 cp->unp_link.le_prev = (u_int32_t)(uintptr_t)up->unp_link.le_prev;
1348 #else
1349 cp->unp_link.le_next = (struct unpcb_compat *)up->unp_link.le_next;
1350 cp->unp_link.le_prev = (struct unpcb_compat **)up->unp_link.le_prev;
1351 #endif
1352 cp->unp_socket = (_UNPCB_PTR(struct socket *))(uintptr_t)up->unp_socket;
1353 cp->unp_vnode = (_UNPCB_PTR(struct vnode *))(uintptr_t)up->unp_vnode;
1354 cp->unp_ino = up->unp_ino;
1355 cp->unp_conn = (_UNPCB_PTR(struct unpcb_compat *))
1356 (uintptr_t)up->unp_conn;
1357 cp->unp_refs = (u_int32_t)(uintptr_t)up->unp_refs.lh_first;
1358 #if defined(__LP64__)
1359 cp->unp_reflink.le_next =
1360 (u_int32_t)(uintptr_t)up->unp_reflink.le_next;
1361 cp->unp_reflink.le_prev =
1362 (u_int32_t)(uintptr_t)up->unp_reflink.le_prev;
1363 #else
1364 cp->unp_reflink.le_next =
1365 (struct unpcb_compat *)up->unp_reflink.le_next;
1366 cp->unp_reflink.le_prev =
1367 (struct unpcb_compat **)up->unp_reflink.le_prev;
1368 #endif
1369 cp->unp_addr = (_UNPCB_PTR(struct sockaddr_un *))
1370 (uintptr_t)up->unp_addr;
1371 cp->unp_cc = up->unp_cc;
1372 cp->unp_mbcnt = up->unp_mbcnt;
1373 cp->unp_gencnt = up->unp_gencnt;
1374 }
1375
1376 static int
1377 unp_pcblist SYSCTL_HANDLER_ARGS
1378 {
1379 #pragma unused(oidp,arg2)
1380 int error, i, n;
1381 struct unpcb *unp, **unp_list;
1382 unp_gen_t gencnt;
1383 struct xunpgen xug;
1384 struct unp_head *head;
1385
1386 lck_rw_lock_shared(unp_list_mtx);
1387 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
1388
1389 /*
1390 * The process of preparing the PCB list is too time-consuming and
1391 * resource-intensive to repeat twice on every request.
1392 */
1393 if (req->oldptr == USER_ADDR_NULL) {
1394 n = unp_count;
1395 req->oldidx = 2 * sizeof (xug) + (n + n / 8) *
1396 sizeof (struct xunpcb);
1397 lck_rw_done(unp_list_mtx);
1398 return (0);
1399 }
1400
1401 if (req->newptr != USER_ADDR_NULL) {
1402 lck_rw_done(unp_list_mtx);
1403 return (EPERM);
1404 }
1405
1406 /*
1407 * OK, now we're committed to doing something.
1408 */
1409 gencnt = unp_gencnt;
1410 n = unp_count;
1411
1412 bzero(&xug, sizeof (xug));
1413 xug.xug_len = sizeof (xug);
1414 xug.xug_count = n;
1415 xug.xug_gen = gencnt;
1416 xug.xug_sogen = so_gencnt;
1417 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1418 if (error) {
1419 lck_rw_done(unp_list_mtx);
1420 return (error);
1421 }
1422
1423 /*
1424 * We are done if there is no pcb
1425 */
1426 if (n == 0) {
1427 lck_rw_done(unp_list_mtx);
1428 return (0);
1429 }
1430
1431 MALLOC(unp_list, struct unpcb **, n * sizeof (*unp_list),
1432 M_TEMP, M_WAITOK);
1433 if (unp_list == 0) {
1434 lck_rw_done(unp_list_mtx);
1435 return (ENOMEM);
1436 }
1437
1438 for (unp = head->lh_first, i = 0; unp && i < n;
1439 unp = unp->unp_link.le_next) {
1440 if (unp->unp_gencnt <= gencnt)
1441 unp_list[i++] = unp;
1442 }
1443 n = i; /* in case we lost some during malloc */
1444
1445 error = 0;
1446 for (i = 0; i < n; i++) {
1447 unp = unp_list[i];
1448 if (unp->unp_gencnt <= gencnt) {
1449 struct xunpcb xu;
1450
1451 bzero(&xu, sizeof (xu));
1452 xu.xu_len = sizeof (xu);
1453 xu.xu_unpp = (_UNPCB_PTR(struct unpcb_compat *))
1454 (uintptr_t)unp;
1455 /*
1456 * XXX - need more locking here to protect against
1457 * connect/disconnect races for SMP.
1458 */
1459 if (unp->unp_addr)
1460 bcopy(unp->unp_addr, &xu.xu_addr,
1461 unp->unp_addr->sun_len);
1462 if (unp->unp_conn && unp->unp_conn->unp_addr)
1463 bcopy(unp->unp_conn->unp_addr,
1464 &xu.xu_caddr,
1465 unp->unp_conn->unp_addr->sun_len);
1466 unpcb_to_compat(unp, &xu.xu_unp);
1467 sotoxsocket(unp->unp_socket, &xu.xu_socket);
1468 error = SYSCTL_OUT(req, &xu, sizeof (xu));
1469 }
1470 }
1471 if (!error) {
1472 /*
1473 * Give the user an updated idea of our state.
1474 * If the generation differs from what we told
1475 * her before, she knows that something happened
1476 * while we were processing this request, and it
1477 * might be necessary to retry.
1478 */
1479 bzero(&xug, sizeof (xug));
1480 xug.xug_len = sizeof (xug);
1481 xug.xug_gen = unp_gencnt;
1482 xug.xug_sogen = so_gencnt;
1483 xug.xug_count = unp_count;
1484 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1485 }
1486 FREE(unp_list, M_TEMP);
1487 lck_rw_done(unp_list_mtx);
1488 return (error);
1489 }
1490
1491 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD,
1492 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
1493 "List of active local datagram sockets");
1494 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD,
1495 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
1496 "List of active local stream sockets");
1497
1498 #if !CONFIG_EMBEDDED
1499
1500 static int
1501 unp_pcblist64 SYSCTL_HANDLER_ARGS
1502 {
1503 #pragma unused(oidp,arg2)
1504 int error, i, n;
1505 struct unpcb *unp, **unp_list;
1506 unp_gen_t gencnt;
1507 struct xunpgen xug;
1508 struct unp_head *head;
1509
1510 lck_rw_lock_shared(unp_list_mtx);
1511 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
1512
1513 /*
1514 * The process of preparing the PCB list is too time-consuming and
1515 * resource-intensive to repeat twice on every request.
1516 */
1517 if (req->oldptr == USER_ADDR_NULL) {
1518 n = unp_count;
1519 req->oldidx = 2 * sizeof (xug) + (n + n / 8) *
1520 (sizeof (struct xunpcb64));
1521 lck_rw_done(unp_list_mtx);
1522 return (0);
1523 }
1524
1525 if (req->newptr != USER_ADDR_NULL) {
1526 lck_rw_done(unp_list_mtx);
1527 return (EPERM);
1528 }
1529
1530 /*
1531 * OK, now we're committed to doing something.
1532 */
1533 gencnt = unp_gencnt;
1534 n = unp_count;
1535
1536 bzero(&xug, sizeof (xug));
1537 xug.xug_len = sizeof (xug);
1538 xug.xug_count = n;
1539 xug.xug_gen = gencnt;
1540 xug.xug_sogen = so_gencnt;
1541 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1542 if (error) {
1543 lck_rw_done(unp_list_mtx);
1544 return (error);
1545 }
1546
1547 /*
1548 * We are done if there is no pcb
1549 */
1550 if (n == 0) {
1551 lck_rw_done(unp_list_mtx);
1552 return (0);
1553 }
1554
1555 MALLOC(unp_list, struct unpcb **, n * sizeof (*unp_list),
1556 M_TEMP, M_WAITOK);
1557 if (unp_list == 0) {
1558 lck_rw_done(unp_list_mtx);
1559 return (ENOMEM);
1560 }
1561
1562 for (unp = head->lh_first, i = 0; unp && i < n;
1563 unp = unp->unp_link.le_next) {
1564 if (unp->unp_gencnt <= gencnt)
1565 unp_list[i++] = unp;
1566 }
1567 n = i; /* in case we lost some during malloc */
1568
1569 error = 0;
1570 for (i = 0; i < n; i++) {
1571 unp = unp_list[i];
1572 if (unp->unp_gencnt <= gencnt) {
1573 struct xunpcb64 xu;
1574 size_t xu_len = sizeof(struct xunpcb64);
1575
1576 bzero(&xu, xu_len);
1577 xu.xu_len = xu_len;
1578 xu.xu_unpp = (u_int64_t)(uintptr_t)unp;
1579 xu.xunp_link.le_next =
1580 (u_int64_t)(uintptr_t)unp->unp_link.le_next;
1581 xu.xunp_link.le_prev =
1582 (u_int64_t)(uintptr_t)unp->unp_link.le_prev;
1583 xu.xunp_socket = (u_int64_t)(uintptr_t)unp->unp_socket;
1584 xu.xunp_vnode = (u_int64_t)(uintptr_t)unp->unp_vnode;
1585 xu.xunp_ino = unp->unp_ino;
1586 xu.xunp_conn = (u_int64_t)(uintptr_t)unp->unp_conn;
1587 xu.xunp_refs = (u_int64_t)(uintptr_t)unp->unp_refs.lh_first;
1588 xu.xunp_reflink.le_next =
1589 (u_int64_t)(uintptr_t)unp->unp_reflink.le_next;
1590 xu.xunp_reflink.le_prev =
1591 (u_int64_t)(uintptr_t)unp->unp_reflink.le_prev;
1592 xu.xunp_cc = unp->unp_cc;
1593 xu.xunp_mbcnt = unp->unp_mbcnt;
1594 xu.xunp_gencnt = unp->unp_gencnt;
1595
1596 if (unp->unp_socket)
1597 sotoxsocket64(unp->unp_socket, &xu.xu_socket);
1598
1599 /*
1600 * XXX - need more locking here to protect against
1601 * connect/disconnect races for SMP.
1602 */
1603 if (unp->unp_addr)
1604 bcopy(unp->unp_addr, &xu.xunp_addr,
1605 unp->unp_addr->sun_len);
1606 if (unp->unp_conn && unp->unp_conn->unp_addr)
1607 bcopy(unp->unp_conn->unp_addr,
1608 &xu.xunp_caddr,
1609 unp->unp_conn->unp_addr->sun_len);
1610
1611 error = SYSCTL_OUT(req, &xu, xu_len);
1612 }
1613 }
1614 if (!error) {
1615 /*
1616 * Give the user an updated idea of our state.
1617 * If the generation differs from what we told
1618 * her before, she knows that something happened
1619 * while we were processing this request, and it
1620 * might be necessary to retry.
1621 */
1622 bzero(&xug, sizeof (xug));
1623 xug.xug_len = sizeof (xug);
1624 xug.xug_gen = unp_gencnt;
1625 xug.xug_sogen = so_gencnt;
1626 xug.xug_count = unp_count;
1627 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1628 }
1629 FREE(unp_list, M_TEMP);
1630 lck_rw_done(unp_list_mtx);
1631 return (error);
1632 }
1633
1634 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist64, CTLFLAG_RD,
1635 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist64, "S,xunpcb64",
1636 "List of active local datagram sockets 64 bit");
1637 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist64, CTLFLAG_RD,
1638 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist64, "S,xunpcb64",
1639 "List of active local stream sockets 64 bit");
1640
1641 #endif /* !CONFIG_EMBEDDED */
1642
1643 static void
1644 unp_shutdown(struct unpcb *unp)
1645 {
1646 struct socket *so = unp->unp_socket;
1647 struct socket *so2;
1648 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn) {
1649 so2 = unp->unp_conn->unp_socket;
1650 unp_get_locks_in_order(so, so2);
1651 socantrcvmore(so2);
1652 socket_unlock(so2, 1);
1653 }
1654 }
1655
1656 static void
1657 unp_drop(struct unpcb *unp, int errno)
1658 {
1659 struct socket *so = unp->unp_socket;
1660
1661 so->so_error = errno;
1662 unp_disconnect(unp);
1663 }
1664
1665 /*
1666 * Returns: 0 Success
1667 * EMSGSIZE The new fd's will not fit
1668 * ENOBUFS Cannot alloc struct fileproc
1669 */
1670 int
1671 unp_externalize(struct mbuf *rights)
1672 {
1673 proc_t p = current_proc(); /* XXX */
1674 int i;
1675 struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
1676 struct fileglob **rp = (struct fileglob **)(cm + 1);
1677 int *fds = (int *)(cm + 1);
1678 struct fileproc *fp;
1679 struct fileglob *fg;
1680 int newfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
1681 int f;
1682
1683 proc_fdlock(p);
1684
1685 /*
1686 * if the new FD's will not fit, then we free them all
1687 */
1688 if (!fdavail(p, newfds)) {
1689 for (i = 0; i < newfds; i++) {
1690 fg = *rp;
1691 unp_discard_fdlocked(fg, p);
1692 *rp++ = NULL;
1693 }
1694 proc_fdunlock(p);
1695
1696 return (EMSGSIZE);
1697 }
1698 /*
1699 * now change each pointer to an fd in the global table to
1700 * an integer that is the index to the local fd table entry
1701 * that we set up to point to the global one we are transferring.
1702 * XXX (1) this assumes a pointer and int are the same size,
1703 * XXX or the mbuf can hold the expansion
1704 * XXX (2) allocation failures should be non-fatal
1705 */
1706 for (i = 0; i < newfds; i++) {
1707 #if CONFIG_MACF_SOCKET
1708 /*
1709 * If receive access is denied, don't pass along
1710 * and error message, just discard the descriptor.
1711 */
1712 if (mac_file_check_receive(kauth_cred_get(), *rp)) {
1713 fg = *rp;
1714 *rp++ = 0;
1715 unp_discard_fdlocked(fg, p);
1716 continue;
1717 }
1718 #endif
1719 if (fdalloc(p, 0, &f))
1720 panic("unp_externalize:fdalloc");
1721 fg = rp[i];
1722 MALLOC_ZONE(fp, struct fileproc *, sizeof (struct fileproc),
1723 M_FILEPROC, M_WAITOK);
1724 if (fp == NULL)
1725 panic("unp_externalize: MALLOC_ZONE");
1726 bzero(fp, sizeof (struct fileproc));
1727 fp->f_iocount = 0;
1728 fp->f_fglob = fg;
1729 fg_removeuipc(fg);
1730 procfdtbl_releasefd(p, f, fp);
1731 (void) OSAddAtomic(-1, &unp_rights);
1732 fds[i] = f;
1733 }
1734 proc_fdunlock(p);
1735
1736 return (0);
1737 }
1738
1739 void
1740 unp_init(void)
1741 {
1742 unp_zone = zinit(sizeof (struct unpcb),
1743 (nmbclusters * sizeof (struct unpcb)), 4096, "unpzone");
1744
1745 if (unp_zone == 0)
1746 panic("unp_init");
1747 LIST_INIT(&unp_dhead);
1748 LIST_INIT(&unp_shead);
1749
1750 /*
1751 * allocate lock group attribute and group for udp pcb mutexes
1752 */
1753 unp_mtx_grp_attr = lck_grp_attr_alloc_init();
1754
1755 unp_mtx_grp = lck_grp_alloc_init("unp_list", unp_mtx_grp_attr);
1756
1757 unp_mtx_attr = lck_attr_alloc_init();
1758
1759 if ((unp_list_mtx = lck_rw_alloc_init(unp_mtx_grp,
1760 unp_mtx_attr)) == NULL)
1761 return; /* pretty much dead if this fails... */
1762
1763 if ((unp_disconnect_lock = lck_mtx_alloc_init(unp_mtx_grp,
1764 unp_mtx_attr)) == NULL)
1765 return;
1766
1767 if ((unp_connect_lock = lck_mtx_alloc_init(unp_mtx_grp,
1768 unp_mtx_attr)) == NULL)
1769 return;
1770 }
1771
1772 #ifndef MIN
1773 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
1774 #endif
1775
1776 /*
1777 * Returns: 0 Success
1778 * EINVAL
1779 * fdgetf_noref:EBADF
1780 */
1781 static int
1782 unp_internalize(struct mbuf *control, proc_t p)
1783 {
1784 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1785 int *fds;
1786 struct fileglob **rp;
1787 struct fileproc *fp;
1788 int i, error;
1789 int oldfds;
1790
1791 /* 64bit: cmsg_len is 'uint32_t', m_len is 'long' */
1792 if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
1793 (socklen_t)cm->cmsg_len != (socklen_t)control->m_len) {
1794 return (EINVAL);
1795 }
1796 oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
1797
1798 proc_fdlock(p);
1799 fds = (int *)(cm + 1);
1800
1801 for (i = 0; i < oldfds; i++) {
1802 struct fileproc *tmpfp;
1803 if (((error = fdgetf_noref(p, fds[i], &tmpfp)) != 0)) {
1804 proc_fdunlock(p);
1805 return (error);
1806 } else if (!filetype_issendable(tmpfp->f_fglob->fg_type)) {
1807 proc_fdunlock(p);
1808 return (EINVAL);
1809 }
1810 }
1811 rp = (struct fileglob **)(cm + 1);
1812
1813 /* On K64 we need to walk backwards because a fileglob * is twice the size of an fd
1814 * and doing them in-order would result in stomping over unprocessed fd's
1815 */
1816 for (i = (oldfds - 1); i >= 0; i--) {
1817 (void) fdgetf_noref(p, fds[i], &fp);
1818 fg_insertuipc(fp->f_fglob);
1819 rp[i] = fp->f_fglob;
1820 (void) OSAddAtomic(1, &unp_rights);
1821 }
1822 proc_fdunlock(p);
1823
1824 return (0);
1825 }
1826
1827 static int unp_defer, unp_gcing, unp_gcwait;
1828 static thread_t unp_gcthread = NULL;
1829
1830 /* always called under uipc_lock */
1831 void
1832 unp_gc_wait(void)
1833 {
1834 if (unp_gcthread == current_thread())
1835 return;
1836
1837 while (unp_gcing != 0) {
1838 unp_gcwait = 1;
1839 msleep(&unp_gcing, uipc_lock, 0 , "unp_gc_wait", NULL);
1840 }
1841 }
1842
1843
1844 __private_extern__ void
1845 unp_gc(void)
1846 {
1847 struct fileglob *fg, *nextfg;
1848 struct socket *so;
1849 static struct fileglob **extra_ref;
1850 struct fileglob **fpp;
1851 int nunref, i;
1852 int need_gcwakeup = 0;
1853
1854 lck_mtx_lock(uipc_lock);
1855 if (unp_gcing) {
1856 lck_mtx_unlock(uipc_lock);
1857 return;
1858 }
1859 unp_gcing = 1;
1860 unp_defer = 0;
1861 unp_gcthread = current_thread();
1862 lck_mtx_unlock(uipc_lock);
1863 /*
1864 * before going through all this, set all FDs to
1865 * be NOT defered and NOT externally accessible
1866 */
1867 for (fg = fmsghead.lh_first; fg != 0; fg = fg->f_msglist.le_next) {
1868 lck_mtx_lock(&fg->fg_lock);
1869 fg->fg_flag &= ~(FMARK|FDEFER);
1870 lck_mtx_unlock(&fg->fg_lock);
1871 }
1872 do {
1873 for (fg = fmsghead.lh_first; fg != 0;
1874 fg = fg->f_msglist.le_next) {
1875 lck_mtx_lock(&fg->fg_lock);
1876 /*
1877 * If the file is not open, skip it
1878 */
1879 if (fg->fg_count == 0) {
1880 lck_mtx_unlock(&fg->fg_lock);
1881 continue;
1882 }
1883 /*
1884 * If we already marked it as 'defer' in a
1885 * previous pass, then try process it this time
1886 * and un-mark it
1887 */
1888 if (fg->fg_flag & FDEFER) {
1889 fg->fg_flag &= ~FDEFER;
1890 unp_defer--;
1891 } else {
1892 /*
1893 * if it's not defered, then check if it's
1894 * already marked.. if so skip it
1895 */
1896 if (fg->fg_flag & FMARK) {
1897 lck_mtx_unlock(&fg->fg_lock);
1898 continue;
1899 }
1900 /*
1901 * If all references are from messages
1902 * in transit, then skip it. it's not
1903 * externally accessible.
1904 */
1905 if (fg->fg_count == fg->fg_msgcount) {
1906 lck_mtx_unlock(&fg->fg_lock);
1907 continue;
1908 }
1909 /*
1910 * If it got this far then it must be
1911 * externally accessible.
1912 */
1913 fg->fg_flag |= FMARK;
1914 }
1915 /*
1916 * either it was defered, or it is externally
1917 * accessible and not already marked so.
1918 * Now check if it is possibly one of OUR sockets.
1919 */
1920 if (fg->fg_type != DTYPE_SOCKET ||
1921 (so = (struct socket *)fg->fg_data) == 0) {
1922 lck_mtx_unlock(&fg->fg_lock);
1923 continue;
1924 }
1925 if (so->so_proto->pr_domain != &localdomain ||
1926 (so->so_proto->pr_flags&PR_RIGHTS) == 0) {
1927 lck_mtx_unlock(&fg->fg_lock);
1928 continue;
1929 }
1930 #ifdef notdef
1931 /*
1932 * if this code is enabled need to run
1933 * under network funnel
1934 */
1935 if (so->so_rcv.sb_flags & SB_LOCK) {
1936 /*
1937 * This is problematical; it's not clear
1938 * we need to wait for the sockbuf to be
1939 * unlocked (on a uniprocessor, at least),
1940 * and it's also not clear what to do
1941 * if sbwait returns an error due to receipt
1942 * of a signal. If sbwait does return
1943 * an error, we'll go into an infinite
1944 * loop. Delete all of this for now.
1945 */
1946 (void) sbwait(&so->so_rcv);
1947 goto restart;
1948 }
1949 #endif
1950 /*
1951 * So, Ok, it's one of our sockets and it IS externally
1952 * accessible (or was defered). Now we look
1953 * to see if we hold any file descriptors in its
1954 * message buffers. Follow those links and mark them
1955 * as accessible too.
1956 *
1957 * In case a file is passed onto itself we need to
1958 * release the file lock.
1959 */
1960 lck_mtx_unlock(&fg->fg_lock);
1961
1962 unp_scan(so->so_rcv.sb_mb, unp_mark);
1963 }
1964 } while (unp_defer);
1965 /*
1966 * We grab an extra reference to each of the file table entries
1967 * that are not otherwise accessible and then free the rights
1968 * that are stored in messages on them.
1969 *
1970 * The bug in the orginal code is a little tricky, so I'll describe
1971 * what's wrong with it here.
1972 *
1973 * It is incorrect to simply unp_discard each entry for f_msgcount
1974 * times -- consider the case of sockets A and B that contain
1975 * references to each other. On a last close of some other socket,
1976 * we trigger a gc since the number of outstanding rights (unp_rights)
1977 * is non-zero. If during the sweep phase the gc code un_discards,
1978 * we end up doing a (full) closef on the descriptor. A closef on A
1979 * results in the following chain. Closef calls soo_close, which
1980 * calls soclose. Soclose calls first (through the switch
1981 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
1982 * returns because the previous instance had set unp_gcing, and
1983 * we return all the way back to soclose, which marks the socket
1984 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
1985 * to free up the rights that are queued in messages on the socket A,
1986 * i.e., the reference on B. The sorflush calls via the dom_dispose
1987 * switch unp_dispose, which unp_scans with unp_discard. This second
1988 * instance of unp_discard just calls closef on B.
1989 *
1990 * Well, a similar chain occurs on B, resulting in a sorflush on B,
1991 * which results in another closef on A. Unfortunately, A is already
1992 * being closed, and the descriptor has already been marked with
1993 * SS_NOFDREF, and soclose panics at this point.
1994 *
1995 * Here, we first take an extra reference to each inaccessible
1996 * descriptor. Then, we call sorflush ourself, since we know
1997 * it is a Unix domain socket anyhow. After we destroy all the
1998 * rights carried in messages, we do a last closef to get rid
1999 * of our extra reference. This is the last close, and the
2000 * unp_detach etc will shut down the socket.
2001 *
2002 * 91/09/19, bsy@cs.cmu.edu
2003 */
2004 extra_ref = _MALLOC(nfiles * sizeof (struct fileglob *),
2005 M_FILEGLOB, M_WAITOK);
2006 if (extra_ref == NULL)
2007 goto bail;
2008 for (nunref = 0, fg = fmsghead.lh_first, fpp = extra_ref; fg != 0;
2009 fg = nextfg) {
2010 lck_mtx_lock(&fg->fg_lock);
2011
2012 nextfg = fg->f_msglist.le_next;
2013 /*
2014 * If it's not open, skip it
2015 */
2016 if (fg->fg_count == 0) {
2017 lck_mtx_unlock(&fg->fg_lock);
2018 continue;
2019 }
2020 /*
2021 * If all refs are from msgs, and it's not marked accessible
2022 * then it must be referenced from some unreachable cycle
2023 * of (shut-down) FDs, so include it in our
2024 * list of FDs to remove
2025 */
2026 if (fg->fg_count == fg->fg_msgcount && !(fg->fg_flag & FMARK)) {
2027 fg->fg_count++;
2028 *fpp++ = fg;
2029 nunref++;
2030 }
2031 lck_mtx_unlock(&fg->fg_lock);
2032 }
2033 /*
2034 * for each FD on our hit list, do the following two things
2035 */
2036 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
2037 struct fileglob *tfg;
2038
2039 tfg = *fpp;
2040
2041 if (tfg->fg_type == DTYPE_SOCKET && tfg->fg_data != NULL) {
2042 so = (struct socket *)(tfg->fg_data);
2043
2044 socket_lock(so, 0);
2045
2046 sorflush(so);
2047
2048 socket_unlock(so, 0);
2049 }
2050 }
2051 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
2052 closef_locked((struct fileproc *)0, *fpp, (proc_t)NULL);
2053
2054 FREE((caddr_t)extra_ref, M_FILEGLOB);
2055 bail:
2056 lck_mtx_lock(uipc_lock);
2057 unp_gcing = 0;
2058 unp_gcthread = NULL;
2059
2060 if (unp_gcwait != 0) {
2061 unp_gcwait = 0;
2062 need_gcwakeup = 1;
2063 }
2064 lck_mtx_unlock(uipc_lock);
2065
2066 if (need_gcwakeup != 0)
2067 wakeup(&unp_gcing);
2068 }
2069
2070 void
2071 unp_dispose(struct mbuf *m)
2072 {
2073 if (m) {
2074 unp_scan(m, unp_discard);
2075 }
2076 }
2077
2078 /*
2079 * Returns: 0 Success
2080 */
2081 static int
2082 unp_listen(struct unpcb *unp, proc_t p)
2083 {
2084 kauth_cred_t safecred = kauth_cred_proc_ref(p);
2085 cru2x(safecred, &unp->unp_peercred);
2086 kauth_cred_unref(&safecred);
2087 unp->unp_flags |= UNP_HAVEPCCACHED;
2088 return (0);
2089 }
2090
2091 /* should run under kernel funnel */
2092 static void
2093 unp_scan(struct mbuf *m0, void (*op)(struct fileglob *))
2094 {
2095 struct mbuf *m;
2096 struct fileglob **rp;
2097 struct cmsghdr *cm;
2098 int i;
2099 int qfds;
2100
2101 while (m0) {
2102 for (m = m0; m; m = m->m_next)
2103 if (m->m_type == MT_CONTROL &&
2104 (size_t)m->m_len >= sizeof (*cm)) {
2105 cm = mtod(m, struct cmsghdr *);
2106 if (cm->cmsg_level != SOL_SOCKET ||
2107 cm->cmsg_type != SCM_RIGHTS)
2108 continue;
2109 qfds = (cm->cmsg_len - sizeof (*cm)) /
2110 sizeof (int);
2111 rp = (struct fileglob **)(cm + 1);
2112 for (i = 0; i < qfds; i++)
2113 (*op)(*rp++);
2114 break; /* XXX, but saves time */
2115 }
2116 m0 = m0->m_act;
2117 }
2118 }
2119
2120 /* should run under kernel funnel */
2121 static void
2122 unp_mark(struct fileglob *fg)
2123 {
2124 lck_mtx_lock(&fg->fg_lock);
2125
2126 if (fg->fg_flag & FMARK) {
2127 lck_mtx_unlock(&fg->fg_lock);
2128 return;
2129 }
2130 fg->fg_flag |= (FMARK|FDEFER);
2131
2132 lck_mtx_unlock(&fg->fg_lock);
2133
2134 unp_defer++;
2135 }
2136
2137 /* should run under kernel funnel */
2138 static void
2139 unp_discard(struct fileglob *fg)
2140 {
2141 proc_t p = current_proc(); /* XXX */
2142
2143 (void) OSAddAtomic(1, &unp_disposed);
2144
2145 proc_fdlock(p);
2146 unp_discard_fdlocked(fg, p);
2147 proc_fdunlock(p);
2148 }
2149 static void
2150 unp_discard_fdlocked(struct fileglob *fg, proc_t p)
2151 {
2152 fg_removeuipc(fg);
2153
2154 (void) OSAddAtomic(-1, &unp_rights);
2155 (void) closef_locked((struct fileproc *)0, fg, p);
2156 }
2157
2158 int
2159 unp_lock(struct socket *so, int refcount, void * lr)
2160 {
2161 void * lr_saved;
2162 if (lr == 0)
2163 lr_saved = (void *) __builtin_return_address(0);
2164 else lr_saved = lr;
2165
2166 if (so->so_pcb) {
2167 lck_mtx_lock(((struct unpcb *)so->so_pcb)->unp_mtx);
2168 } else {
2169 panic("unp_lock: so=%p NO PCB! lr=%p ref=0x%x\n",
2170 so, lr_saved, so->so_usecount);
2171 }
2172
2173 if (so->so_usecount < 0)
2174 panic("unp_lock: so=%p so_pcb=%p lr=%p ref=0x%x\n",
2175 so, so->so_pcb, lr_saved, so->so_usecount);
2176
2177 if (refcount)
2178 so->so_usecount++;
2179
2180 so->lock_lr[so->next_lock_lr] = lr_saved;
2181 so->next_lock_lr = (so->next_lock_lr+1) % SO_LCKDBG_MAX;
2182 return (0);
2183 }
2184
2185 int
2186 unp_unlock(struct socket *so, int refcount, void * lr)
2187 {
2188 void * lr_saved;
2189 lck_mtx_t * mutex_held = NULL;
2190 struct unpcb *unp = sotounpcb(so);
2191
2192 if (lr == 0)
2193 lr_saved = (void *) __builtin_return_address(0);
2194 else lr_saved = lr;
2195
2196 if (refcount)
2197 so->so_usecount--;
2198
2199 if (so->so_usecount < 0)
2200 panic("unp_unlock: so=%p usecount=%x\n", so, so->so_usecount);
2201 if (so->so_pcb == NULL) {
2202 panic("unp_unlock: so=%p NO PCB usecount=%x\n", so, so->so_usecount);
2203 } else {
2204 mutex_held = ((struct unpcb *)so->so_pcb)->unp_mtx;
2205 }
2206 lck_mtx_assert(mutex_held, LCK_MTX_ASSERT_OWNED);
2207 so->unlock_lr[so->next_unlock_lr] = lr_saved;
2208 so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
2209
2210 if (so->so_usecount == 0 && (so->so_flags & SOF_PCBCLEARING)) {
2211 sofreelastref(so, 1);
2212
2213 if (unp->unp_addr)
2214 FREE(unp->unp_addr, M_SONAME);
2215
2216 lck_mtx_unlock(mutex_held);
2217 if (unp->unp_mtx)
2218 lck_mtx_free(unp->unp_mtx, unp_mtx_grp);
2219
2220 unp->unp_gencnt = ++unp_gencnt;
2221 zfree(unp_zone, unp);
2222 --unp_count;
2223
2224 unp_gc();
2225 } else {
2226 lck_mtx_unlock(mutex_held);
2227 }
2228
2229 return (0);
2230 }
2231
2232 lck_mtx_t *
2233 unp_getlock(struct socket *so, __unused int locktype)
2234 {
2235 struct unpcb *unp = (struct unpcb *)so->so_pcb;
2236
2237
2238 if (so->so_pcb) {
2239 if (so->so_usecount < 0)
2240 panic("unp_getlock: so=%p usecount=%x\n", so, so->so_usecount);
2241 return(unp->unp_mtx);
2242 } else {
2243 panic("unp_getlock: so=%p NULL so_pcb\n", so);
2244 return (so->so_proto->pr_domain->dom_mtx);
2245 }
2246 }
2247
mirror of XNU