/*
- * Copyright (c) 2000-2013 Apple Inc. All rights reserved.
+ * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
#include <sys/malloc.h>
#include <sys/mcache.h>
#include <sys/mbuf.h>
-#include <kern/lock.h>
+#include <kern/locks.h>
#include <sys/domain.h>
#include <sys/protosw.h>
#include <sys/signalvar.h>
#include <sys/kauth.h>
#include <kern/task.h>
#include <sys/priv.h>
+#include <sys/sysctl.h>
#include <security/audit/audit.h>
#define f_offset f_fglob->fg_offset
#define f_data f_fglob->fg_data
-
#define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETSOCK, 0)
#define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETSOCK, 2)
#define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETSOCK, 1)
#define DBG_FNC_SENDFILE_WAIT NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 1))
#define DBG_FNC_SENDFILE_READ NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 2))
#define DBG_FNC_SENDFILE_SEND NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 3))
+#define DBG_FNC_SENDMSG_X NETDBG_CODE(DBG_NETSOCK, (11 << 8))
+#define DBG_FNC_RECVMSG_X NETDBG_CODE(DBG_NETSOCK, (12 << 8))
+#if DEBUG || DEVELOPMENT
+#define DEBUG_KERNEL_ADDRPERM(_v) (_v)
+#define DBG_PRINTF(...) printf(__VA_ARGS__)
+#else
+#define DEBUG_KERNEL_ADDRPERM(_v) VM_KERNEL_ADDRPERM(_v)
+#define DBG_PRINTF(...) do { } while (0)
+#endif
/* TODO: should be in header file */
int falloc_locked(proc_t, struct fileproc **, int *, vfs_context_t, int);
-static int sendit(struct proc *, int, struct user_msghdr *, uio_t, int,
- int32_t *);
+static int sendit(struct proc *, struct socket *, struct user_msghdr *, uio_t,
+ int, int32_t *);
static int recvit(struct proc *, int, struct user_msghdr *, uio_t, user_addr_t,
int32_t *);
static int connectit(struct socket *, struct sockaddr *);
#endif /* SENDFILE */
static int connectx_nocancel(struct proc *, struct connectx_args *, int *);
static int connectitx(struct socket *, struct sockaddr_list **,
- struct sockaddr_list **, struct proc *, uint32_t, associd_t, connid_t *);
+ struct sockaddr_list **, struct proc *, uint32_t, sae_associd_t,
+ sae_connid_t *, uio_t, unsigned int, user_ssize_t *);
static int peeloff_nocancel(struct proc *, struct peeloff_args *, int *);
static int disconnectx_nocancel(struct proc *, struct disconnectx_args *,
int *);
static int socket_common(struct proc *, int, int, int, pid_t, int32_t *, int);
+static int internalize_user_msghdr_array(const void *, int, int, u_int,
+ struct user_msghdr_x *, struct uio **);
+static u_int externalize_user_msghdr_array(void *, int, int, u_int,
+ const struct user_msghdr_x *, struct uio **);
+
+static void free_uio_array(struct uio **, u_int);
+static int uio_array_is_valid(struct uio **, u_int);
+static int recv_msg_array_is_valid(struct recv_msg_elem *, u_int);
+static int internalize_recv_msghdr_array(const void *, int, int,
+ u_int, struct user_msghdr_x *, struct recv_msg_elem *);
+static u_int externalize_recv_msghdr_array(void *, int, int, u_int,
+ const struct user_msghdr_x *, struct recv_msg_elem *);
+static struct recv_msg_elem *alloc_recv_msg_array(u_int count);
+static void free_recv_msg_array(struct recv_msg_elem *, u_int);
+
+SYSCTL_DECL(_kern_ipc);
+
+static u_int somaxsendmsgx = 100;
+SYSCTL_UINT(_kern_ipc, OID_AUTO, maxsendmsgx,
+ CTLFLAG_RW | CTLFLAG_LOCKED, &somaxsendmsgx, 0, "");
+static u_int somaxrecvmsgx = 100;
+SYSCTL_UINT(_kern_ipc, OID_AUTO, maxrecvmsgx,
+ CTLFLAG_RW | CTLFLAG_LOCKED, &somaxrecvmsgx, 0, "");
+
/*
* System call interface to the socket abstraction.
*/
proc_fdunlock(p);
*retval = fd;
+ if (ENTR_SHOULDTRACE) {
+ KERNEL_ENERGYTRACE(kEnTrActKernSocket, DBG_FUNC_START,
+ fd, 0, (int64_t)VM_KERNEL_ADDRPERM(so));
+ }
}
return (error);
}
fp->f_flag = fflag;
fp->f_ops = &socketops;
fp->f_data = (caddr_t)so;
+
socket_lock(head, 0);
if (dosocklock)
socket_lock(so, 1);
+
so->so_state &= ~SS_COMP;
so->so_head = NULL;
+
+ /* Sync socket non-blocking/async state with file flags */
+ if (fp->f_flag & FNONBLOCK) {
+ so->so_state |= SS_NBIO;
+ } else {
+ so->so_state &= ~SS_NBIO;
+ }
+
+ if (fp->f_flag & FASYNC) {
+ so->so_state |= SS_ASYNC;
+ so->so_rcv.sb_flags |= SB_ASYNC;
+ so->so_snd.sb_flags |= SB_ASYNC;
+ } else {
+ so->so_state &= ~SS_ASYNC;
+ so->so_rcv.sb_flags &= ~SB_ASYNC;
+ so->so_snd.sb_flags &= ~SB_ASYNC;
+ }
+
(void) soacceptlock(so, &sa, 0);
socket_unlock(head, 1);
if (sa == NULL) {
out:
file_drop(fd);
+
+ if (error == 0 && ENTR_SHOULDTRACE) {
+ KERNEL_ENERGYTRACE(kEnTrActKernSocket, DBG_FUNC_START,
+ newfd, 0, (int64_t)VM_KERNEL_ADDRPERM(so));
+ }
return (error);
}
accept(struct proc *p, struct accept_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return(accept_nocancel(p, (struct accept_nocancel_args *)uap, retval));
+ return (accept_nocancel(p, (struct accept_nocancel_args *)uap,
+ retval));
}
/*
connect(struct proc *p, struct connect_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return(connect_nocancel(p, (struct connect_nocancel_args *)uap, retval));
+ return (connect_nocancel(p, (struct connect_nocancel_args *)uap,
+ retval));
}
int
#pragma unused(p, retval)
struct sockaddr_list *src_sl = NULL, *dst_sl = NULL;
struct socket *so;
- int error, fd = uap->s;
+ int error, error1, fd = uap->socket;
boolean_t dgram;
- connid_t cid = CONNID_ANY;
+ sae_connid_t cid = SAE_CONNID_ANY;
+ struct user32_sa_endpoints ep32;
+ struct user64_sa_endpoints ep64;
+ struct user_sa_endpoints ep;
+ user_ssize_t bytes_written = 0;
+ struct user_iovec *iovp;
+ uio_t auio = NULL;
- AUDIT_ARG(fd, uap->s);
+ AUDIT_ARG(fd, uap->socket);
error = file_socket(fd, &so);
if (error != 0)
return (error);
goto out;
}
+ if (uap->endpoints == USER_ADDR_NULL) {
+ error = EINVAL;
+ goto out;
+ }
+
+ if (IS_64BIT_PROCESS(p)) {
+ error = copyin(uap->endpoints, (caddr_t)&ep64, sizeof(ep64));
+ if (error != 0)
+ goto out;
+
+ ep.sae_srcif = ep64.sae_srcif;
+ ep.sae_srcaddr = ep64.sae_srcaddr;
+ ep.sae_srcaddrlen = ep64.sae_srcaddrlen;
+ ep.sae_dstaddr = ep64.sae_dstaddr;
+ ep.sae_dstaddrlen = ep64.sae_dstaddrlen;
+ } else {
+ error = copyin(uap->endpoints, (caddr_t)&ep32, sizeof(ep32));
+ if (error != 0)
+ goto out;
+
+ ep.sae_srcif = ep32.sae_srcif;
+ ep.sae_srcaddr = ep32.sae_srcaddr;
+ ep.sae_srcaddrlen = ep32.sae_srcaddrlen;
+ ep.sae_dstaddr = ep32.sae_dstaddr;
+ ep.sae_dstaddrlen = ep32.sae_dstaddrlen;
+ }
+
/*
* Ask getsockaddr{_s} to not translate AF_UNSPEC to AF_INET
* if this is a datagram socket; translate for other types.
* sockaddr_list for src address for convenience, if present,
* even though it won't hold more than one.
*/
- if (uap->src != USER_ADDR_NULL && (error = getsockaddrlist(so,
- &src_sl, uap->src, uap->srclen, dgram)) != 0)
+ if (ep.sae_srcaddr != USER_ADDR_NULL && (error = getsockaddrlist(so,
+ &src_sl, (user_addr_t)(caddr_t)ep.sae_srcaddr, ep.sae_srcaddrlen,
+ dgram)) != 0)
+ goto out;
+
+ if (ep.sae_dstaddr == USER_ADDR_NULL) {
+ error = EINVAL;
goto out;
+ }
- error = getsockaddrlist(so, &dst_sl, uap->dsts, uap->dstlen, dgram);
+ error = getsockaddrlist(so, &dst_sl, (user_addr_t)(caddr_t)ep.sae_dstaddr,
+ ep.sae_dstaddrlen, dgram);
if (error != 0)
goto out;
VERIFY(dst_sl != NULL &&
!TAILQ_EMPTY(&dst_sl->sl_head) && dst_sl->sl_cnt > 0);
- error = connectitx(so, &src_sl, &dst_sl, p, uap->ifscope,
- uap->aid, &cid);
+ if (uap->iov != USER_ADDR_NULL) {
+ /* Verify range before calling uio_create() */
+ if (uap->iovcnt <= 0 || uap->iovcnt > UIO_MAXIOV)
+ return (EINVAL);
+
+ if (uap->len == USER_ADDR_NULL)
+ return (EINVAL);
+
+ /* allocate a uio to hold the number of iovecs passed */
+ auio = uio_create(uap->iovcnt, 0,
+ (IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
+ UIO_WRITE);
+
+ if (auio == NULL) {
+ error = ENOMEM;
+ goto out;
+ }
+
+ /*
+ * get location of iovecs within the uio.
+ * then copyin the iovecs from user space.
+ */
+ iovp = uio_iovsaddr(auio);
+ if (iovp == NULL) {
+ error = ENOMEM;
+ goto out;
+ }
+ error = copyin_user_iovec_array(uap->iov,
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ uap->iovcnt, iovp);
+ if (error != 0)
+ goto out;
+
+ /* finish setup of uio_t */
+ error = uio_calculateresid(auio);
+ if (error != 0) {
+ goto out;
+ }
+ }
+
+ error = connectitx(so, &src_sl, &dst_sl, p, ep.sae_srcif, uap->associd,
+ &cid, auio, uap->flags, &bytes_written);
if (error == ERESTART)
error = EINTR;
- if (uap->cid != USER_ADDR_NULL)
- (void) copyout(&cid, uap->cid, sizeof (cid));
+ if (uap->len != USER_ADDR_NULL) {
+ error1 = copyout(&bytes_written, uap->len, sizeof (uap->len));
+ /* give precedence to connectitx errors */
+ if ((error1 != 0) && (error == 0))
+ error = error1;
+ }
+ if (uap->connid != USER_ADDR_NULL) {
+ error1 = copyout(&cid, uap->connid, sizeof (cid));
+ /* give precedence to connectitx errors */
+ if ((error1 != 0) && (error == 0))
+ error = error1;
+ }
out:
file_drop(fd);
+ if (auio != NULL) {
+ uio_free(auio);
+ }
if (src_sl != NULL)
sockaddrlist_free(src_sl);
if (dst_sl != NULL)
static int
connectitx(struct socket *so, struct sockaddr_list **src_sl,
struct sockaddr_list **dst_sl, struct proc *p, uint32_t ifscope,
- associd_t aid, connid_t *pcid)
+ sae_associd_t aid, sae_connid_t *pcid, uio_t auio, unsigned int flags,
+ user_ssize_t *bytes_written)
{
struct sockaddr_entry *se;
int error;
+#pragma unused (flags)
VERIFY(dst_sl != NULL && *dst_sl != NULL);
error = EALREADY;
goto out;
}
+
+ if ((so->so_proto->pr_flags & PR_DATA_IDEMPOTENT) &&
+ (flags & CONNECT_DATA_IDEMPOTENT))
+ so->so_flags1 |= SOF1_DATA_IDEMPOTENT;
+
+ /*
+ * Case 1: CONNECT_RESUME_ON_READ_WRITE set, no data.
+ * Case 2: CONNECT_RESUME_ON_READ_WRITE set, with data (user error)
+ * Case 3: CONNECT_RESUME_ON_READ_WRITE not set, with data
+ * Case 3 allows user to combine write with connect even if they have
+ * no use for TFO (such as regular TCP, and UDP).
+ * Case 4: CONNECT_RESUME_ON_READ_WRITE not set, no data (regular case)
+ */
+ if ((so->so_proto->pr_flags & PR_PRECONN_WRITE) &&
+ ((flags & CONNECT_RESUME_ON_READ_WRITE) || auio))
+ so->so_flags1 |= SOF1_PRECONNECT_DATA;
+
+ /*
+ * If a user sets data idempotent and does not pass an uio, or
+ * sets CONNECT_RESUME_ON_READ_WRITE, this is an error, reset
+ * SOF1_DATA_IDEMPOTENT.
+ */
+ if (!(so->so_flags1 & SOF1_PRECONNECT_DATA) &&
+ (so->so_flags1 & SOF1_DATA_IDEMPOTENT)) {
+ /* We should return EINVAL instead perhaps. */
+ so->so_flags1 &= ~SOF1_DATA_IDEMPOTENT;
+ }
+
error = soconnectxlocked(so, src_sl, dst_sl, p, ifscope,
- aid, pcid, 0, NULL, 0);
+ aid, pcid, 0, NULL, 0, auio, bytes_written);
if (error != 0) {
so->so_state &= ~SS_ISCONNECTING;
goto out;
}
+ /*
+ * If, after the call to soconnectxlocked the flag is still set (in case
+ * data has been queued and the connect() has actually been triggered,
+ * it will have been unset by the transport), we exit immediately. There
+ * is no reason to wait on any event.
+ */
+ if (so->so_flags1 & SOF1_PRECONNECT_DATA) {
+ error = 0;
+ goto out;
+ }
if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) {
error = EINPROGRESS;
goto out;
* sockargs:???
*/
static int
-sendit(struct proc *p, int s, struct user_msghdr *mp, uio_t uiop,
+sendit(struct proc *p, struct socket *so, struct user_msghdr *mp, uio_t uiop,
int flags, int32_t *retval)
{
struct mbuf *control = NULL;
struct sockaddr *to = NULL;
boolean_t want_free = TRUE;
int error;
- struct socket *so;
user_ssize_t len;
KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
- error = file_socket(s, &so);
- if (error) {
- KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
- }
- if (so == NULL) {
- error = EBADF;
- goto out;
- }
if (mp->msg_name != USER_ADDR_NULL) {
if (mp->msg_namelen > sizeof (ss)) {
error = getsockaddr(so, &to, mp->msg_name,
/*
* We check the state without holding the socket lock;
* if a race condition occurs, it would simply result
- * in an extra call to the MAC check function.
+ * in an extra call to the MAC check function.
*/
- if ( to != NULL &&
+ if (to != NULL &&
!(so->so_state & SS_DEFUNCT) &&
(error = mac_socket_check_send(kauth_cred_get(), so, to)) != 0)
goto bad;
FREE(to, M_SONAME);
out:
KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_END, error, 0, 0, 0, 0);
- file_drop(s);
+
return (error);
}
struct user_msghdr msg;
int error;
uio_t auio = NULL;
+ struct socket *so;
KERNEL_DEBUG(DBG_FNC_SENDTO | DBG_FUNC_START, 0, 0, 0, 0, 0);
AUDIT_ARG(fd, uap->s);
(IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
UIO_WRITE);
if (auio == NULL) {
- return (ENOMEM);
+ error = ENOMEM;
+ goto done;
}
uio_addiov(auio, uap->buf, uap->len);
msg.msg_control = 0;
msg.msg_flags = 0;
- error = sendit(p, uap->s, &msg, auio, uap->flags, retval);
+ error = file_socket(uap->s, &so);
+ if (error)
+ goto done;
- if (auio != NULL) {
- uio_free(auio);
+ if (so == NULL) {
+ error = EBADF;
+ } else {
+ error = sendit(p, so, &msg, auio, uap->flags, retval);
}
+ file_drop(uap->s);
+done:
+ if (auio != NULL)
+ uio_free(auio);
+
KERNEL_DEBUG(DBG_FNC_SENDTO | DBG_FUNC_END, error, *retval, 0, 0, 0);
return (error);
sendmsg(struct proc *p, struct sendmsg_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (sendmsg_nocancel(p, (struct sendmsg_nocancel_args *)uap, retval));
+ return (sendmsg_nocancel(p, (struct sendmsg_nocancel_args *)uap,
+ retval));
}
int
-sendmsg_nocancel(struct proc *p, struct sendmsg_nocancel_args *uap, int32_t *retval)
+sendmsg_nocancel(struct proc *p, struct sendmsg_nocancel_args *uap,
+ int32_t *retval)
{
struct user32_msghdr msg32;
struct user64_msghdr msg64;
int error;
uio_t auio = NULL;
struct user_iovec *iovp;
+ struct socket *so;
KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_START, 0, 0, 0, 0, 0);
AUDIT_ARG(fd, uap->s);
/* msg_flags is ignored for send */
user_msg.msg_flags = 0;
- error = sendit(p, uap->s, &user_msg, auio, uap->flags, retval);
+ error = file_socket(uap->s, &so);
+ if (error) {
+ goto done;
+ }
+ if (so == NULL) {
+ error = EBADF;
+ } else {
+ error = sendit(p, so, &user_msg, auio, uap->flags, retval);
+ }
+ file_drop(uap->s);
done:
if (auio != NULL) {
uio_free(auio);
return (error);
}
-/*
- * Returns: 0 Success
- * ENOTSOCK
- * EINVAL
- * EBADF
- * EACCES Mandatory Access Control failure
- * copyout:EFAULT
- * fp_lookup:EBADF
- * <pru_soreceive>:ENOBUFS
- * <pru_soreceive>:ENOTCONN
- * <pru_soreceive>:EWOULDBLOCK
- * <pru_soreceive>:EFAULT
- * <pru_soreceive>:EINTR
- * <pru_soreceive>:EBADF
- * <pru_soreceive>:EINVAL
- * <pru_soreceive>:EMSGSIZE
- * <pru_soreceive>:???
- *
- * Notes: Additional return values from calls through <pru_soreceive>
- * depend on protocols other than TCP or AF_UNIX, which are
- * documented above.
- */
-static int
-recvit(struct proc *p, int s, struct user_msghdr *mp, uio_t uiop,
- user_addr_t namelenp, int32_t *retval)
+int
+sendmsg_x(struct proc *p, struct sendmsg_x_args *uap, user_ssize_t *retval)
{
- ssize_t len;
- int error;
- struct mbuf *m, *control = 0;
- user_addr_t ctlbuf;
+ int error = 0;
+ struct user_msghdr_x *user_msg_x = NULL;
+ struct uio **uiop = NULL;
struct socket *so;
- struct sockaddr *fromsa = 0;
- struct fileproc *fp;
+ u_int i;
+ struct sockaddr *to = NULL;
+ user_ssize_t len_before = 0, len_after;
+ int need_drop = 0;
+ size_t size_of_msghdr;
+ void *umsgp = NULL;
+ u_int uiocnt;
+ int has_addr_or_ctl = 0;
- KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
- proc_fdlock(p);
- if ((error = fp_lookup(p, s, &fp, 1))) {
- KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, error, 0, 0, 0, 0);
- proc_fdunlock(p);
- return (error);
- }
- if (fp->f_type != DTYPE_SOCKET) {
- fp_drop(p, s, fp, 1);
- proc_fdunlock(p);
- return (ENOTSOCK);
- }
+ KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
- so = (struct socket *)fp->f_data;
+ error = file_socket(uap->s, &so);
+ if (error) {
+ goto out;
+ }
+ need_drop = 1;
if (so == NULL) {
- fp_drop(p, s, fp, 1);
- proc_fdunlock(p);
- return (EBADF);
+ error = EBADF;
+ goto out;
}
- proc_fdunlock(p);
-
-#if CONFIG_MACF_SOCKET_SUBSET
/*
- * We check the state without holding the socket lock;
- * if a race condition occurs, it would simply result
- * in an extra call to the MAC check function.
+ * Input parameter range check
*/
- if (!(so->so_state & SS_DEFUNCT) &&
- !(so->so_state & SS_ISCONNECTED) &&
- !(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
- (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0)
- goto out1;
-#endif /* MAC_SOCKET_SUBSET */
- if (uio_resid(uiop) < 0) {
- KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, EINVAL, 0, 0, 0, 0);
+ if (uap->cnt == 0 || uap->cnt > UIO_MAXIOV) {
error = EINVAL;
- goto out1;
+ goto out;
}
+ /*
+ * Clip to max currently allowed
+ */
+ if (uap->cnt > somaxsendmsgx)
+ uap->cnt = somaxsendmsgx;
- len = uio_resid(uiop);
- error = so->so_proto->pr_usrreqs->pru_soreceive(so, &fromsa, uiop,
- (struct mbuf **)0, mp->msg_control ? &control : (struct mbuf **)0,
- &mp->msg_flags);
- if (fromsa)
- AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()),
- fromsa);
- if (error) {
- if (uio_resid(uiop) != len && (error == ERESTART ||
- error == EINTR || error == EWOULDBLOCK))
- error = 0;
+ user_msg_x = _MALLOC(uap->cnt * sizeof(struct user_msghdr_x),
+ M_TEMP, M_WAITOK | M_ZERO);
+ if (user_msg_x == NULL) {
+ DBG_PRINTF("%s _MALLOC() user_msg_x failed\n", __func__);
+ error = ENOMEM;
+ goto out;
+ }
+ uiop = _MALLOC(uap->cnt * sizeof(struct uio *),
+ M_TEMP, M_WAITOK | M_ZERO);
+ if (uiop == NULL) {
+ DBG_PRINTF("%s _MALLOC() uiop failed\n", __func__);
+ error = ENOMEM;
+ goto out;
}
- if (error)
+ size_of_msghdr = IS_64BIT_PROCESS(p) ?
+ sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
+
+ umsgp = _MALLOC(uap->cnt * size_of_msghdr,
+ M_TEMP, M_WAITOK | M_ZERO);
+ if (umsgp == NULL) {
+ printf("%s _MALLOC() user_msg_x failed\n", __func__);
+ error = ENOMEM;
+ goto out;
+ }
+ error = copyin(uap->msgp, umsgp, uap->cnt * size_of_msghdr);
+ if (error) {
+ DBG_PRINTF("%s copyin() failed\n", __func__);
+ goto out;
+ }
+ error = internalize_user_msghdr_array(umsgp,
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ UIO_WRITE, uap->cnt, user_msg_x, uiop);
+ if (error) {
+ DBG_PRINTF("%s copyin_user_msghdr_array() failed\n", __func__);
+ goto out;
+ }
+ /*
+ * Make sure the size of each message iovec and
+ * the aggregate size of all the iovec is valid
+ */
+ if (uio_array_is_valid(uiop, uap->cnt) == 0) {
+ error = EINVAL;
goto out;
+ }
- *retval = len - uio_resid(uiop);
- if (mp->msg_name) {
- socklen_t sa_len = 0;
+ /*
+ * Sanity check on passed arguments
+ */
+ for (i = 0; i < uap->cnt; i++) {
+ struct user_msghdr_x *mp = user_msg_x + i;
- len = mp->msg_namelen;
- if (len <= 0 || fromsa == 0) {
- len = 0;
- } else {
-#ifndef MIN
-#define MIN(a, b) ((a) > (b) ? (b) : (a))
-#endif
- sa_len = fromsa->sa_len;
- len = MIN((unsigned int)len, sa_len);
- error = copyout(fromsa, mp->msg_name, (unsigned)len);
- if (error)
- goto out;
- }
- mp->msg_namelen = sa_len;
- /* return the actual, untruncated address length */
- if (namelenp &&
- (error = copyout((caddr_t)&sa_len, namelenp,
- sizeof (int)))) {
+ /*
+ * No flags on send message
+ */
+ if (mp->msg_flags != 0) {
+ error = EINVAL;
goto out;
}
+ /*
+ * No support for address or ancillary data (yet)
+ */
+ if (mp->msg_name != USER_ADDR_NULL || mp->msg_namelen != 0)
+ has_addr_or_ctl = 1;
+
+ if (mp->msg_control != USER_ADDR_NULL ||
+ mp->msg_controllen != 0)
+ has_addr_or_ctl = 1;
+
+#if CONFIG_MACF_SOCKET_SUBSET
+ /*
+ * We check the state without holding the socket lock;
+ * if a race condition occurs, it would simply result
+ * in an extra call to the MAC check function.
+ *
+ * Note: The following check is never true taken with the
+ * current limitation that we do not accept to pass an address,
+ * this is effectively placeholder code. If we add support for
+ * addresses, we will have to check every address.
+ */
+ if (to != NULL &&
+ !(so->so_state & SS_DEFUNCT) &&
+ (error = mac_socket_check_send(kauth_cred_get(), so, to))
+ != 0)
+ goto out;
+#endif /* MAC_SOCKET_SUBSET */
}
- if (mp->msg_control) {
- len = mp->msg_controllen;
- m = control;
- mp->msg_controllen = 0;
- ctlbuf = mp->msg_control;
-
- while (m && len > 0) {
- unsigned int tocopy;
- struct cmsghdr *cp = mtod(m, struct cmsghdr *);
- int cp_size = CMSG_ALIGN(cp->cmsg_len);
- int buflen = m->m_len;
-
- while (buflen > 0 && len > 0) {
-
- /*
- SCM_TIMESTAMP hack because struct timeval has a
- * different size for 32 bits and 64 bits processes
- */
- if (cp->cmsg_level == SOL_SOCKET && cp->cmsg_type == SCM_TIMESTAMP) {
- unsigned char tmp_buffer[CMSG_SPACE(sizeof(struct user64_timeval))];
- struct cmsghdr *tmp_cp = (struct cmsghdr *)(void *)tmp_buffer;
- int tmp_space;
- struct timeval *tv = (struct timeval *)(void *)CMSG_DATA(cp);
-
- tmp_cp->cmsg_level = SOL_SOCKET;
- tmp_cp->cmsg_type = SCM_TIMESTAMP;
-
- if (proc_is64bit(p)) {
- struct user64_timeval *tv64 = (struct user64_timeval *)(void *)CMSG_DATA(tmp_cp);
-
- tv64->tv_sec = tv->tv_sec;
- tv64->tv_usec = tv->tv_usec;
-
- tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user64_timeval));
- tmp_space = CMSG_SPACE(sizeof(struct user64_timeval));
- } else {
- struct user32_timeval *tv32 = (struct user32_timeval *)(void *)CMSG_DATA(tmp_cp);
-
- tv32->tv_sec = tv->tv_sec;
- tv32->tv_usec = tv->tv_usec;
-
- tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user32_timeval));
- tmp_space = CMSG_SPACE(sizeof(struct user32_timeval));
- }
- if (len >= tmp_space) {
- tocopy = tmp_space;
- } else {
- mp->msg_flags |= MSG_CTRUNC;
- tocopy = len;
- }
- error = copyout(tmp_buffer, ctlbuf, tocopy);
- if (error)
- goto out;
- } else {
+ len_before = uio_array_resid(uiop, uap->cnt);
- if (cp_size > buflen) {
- panic("cp_size > buflen, something wrong with alignment!");
- }
-
- if (len >= cp_size) {
- tocopy = cp_size;
- } else {
- mp->msg_flags |= MSG_CTRUNC;
- tocopy = len;
- }
-
- error = copyout((caddr_t) cp, ctlbuf,
- tocopy);
- if (error)
- goto out;
- }
+ /*
+ * Feed list of packets at once only for connected socket without
+ * control message
+ */
+ if (so->so_proto->pr_usrreqs->pru_sosend_list !=
+ pru_sosend_list_notsupp &&
+ has_addr_or_ctl == 0 && somaxsendmsgx == 0) {
+ error = so->so_proto->pr_usrreqs->pru_sosend_list(so, uiop,
+ uap->cnt, uap->flags);
+ } else {
+ for (i = 0; i < uap->cnt; i++) {
+ struct user_msghdr_x *mp = user_msg_x + i;
+ struct user_msghdr user_msg;
+ uio_t auio = uiop[i];
+ int32_t tmpval;
+
+ user_msg.msg_flags = mp->msg_flags;
+ user_msg.msg_controllen = mp->msg_controllen;
+ user_msg.msg_control = mp->msg_control;
+ user_msg.msg_iovlen = mp->msg_iovlen;
+ user_msg.msg_iov = mp->msg_iov;
+ user_msg.msg_namelen = mp->msg_namelen;
+ user_msg.msg_name = mp->msg_name;
+
+ error = sendit(p, so, &user_msg, auio, uap->flags,
+ &tmpval);
+ if (error != 0)
+ break;
+ }
+ }
+ len_after = uio_array_resid(uiop, uap->cnt);
+
+ VERIFY(len_after <= len_before);
+
+ if (error != 0) {
+ if (len_after != len_before && (error == ERESTART ||
+ error == EINTR || error == EWOULDBLOCK ||
+ error == ENOBUFS))
+ error = 0;
+ /* Generation of SIGPIPE can be controlled per socket */
+ if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE))
+ psignal(p, SIGPIPE);
+ }
+ if (error == 0) {
+ uiocnt = externalize_user_msghdr_array(umsgp,
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ UIO_WRITE, uap->cnt, user_msg_x, uiop);
+
+ *retval = (int)(uiocnt);
+ }
+out:
+ if (need_drop)
+ file_drop(uap->s);
+ if (umsgp != NULL)
+ _FREE(umsgp, M_TEMP);
+ if (uiop != NULL) {
+ free_uio_array(uiop, uap->cnt);
+ _FREE(uiop, M_TEMP);
+ }
+ if (user_msg_x != NULL)
+ _FREE(user_msg_x, M_TEMP);
+
+ KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
+
+ return (error);
+}
+
+
+static int
+copyout_sa(struct sockaddr *fromsa, user_addr_t name, socklen_t *namelen)
+{
+ int error = 0;
+ socklen_t sa_len = 0;
+ ssize_t len;
+
+ len = *namelen;
+ if (len <= 0 || fromsa == 0) {
+ len = 0;
+ } else {
+#ifndef MIN
+#define MIN(a, b) ((a) > (b) ? (b) : (a))
+#endif
+ sa_len = fromsa->sa_len;
+ len = MIN((unsigned int)len, sa_len);
+ error = copyout(fromsa, name, (unsigned)len);
+ if (error)
+ goto out;
+ }
+ *namelen = sa_len;
+out:
+ return (0);
+}
+
+static int
+copyout_control(struct proc *p, struct mbuf *m, user_addr_t control,
+ socklen_t *controllen, int *flags)
+{
+ int error = 0;
+ ssize_t len;
+ user_addr_t ctlbuf;
+
+ len = *controllen;
+ *controllen = 0;
+ ctlbuf = control;
+
+ while (m && len > 0) {
+ unsigned int tocopy;
+ struct cmsghdr *cp = mtod(m, struct cmsghdr *);
+ int cp_size = CMSG_ALIGN(cp->cmsg_len);
+ int buflen = m->m_len;
+
+ while (buflen > 0 && len > 0) {
+ /*
+ * SCM_TIMESTAMP hack because struct timeval has a
+ * different size for 32 bits and 64 bits processes
+ */
+ if (cp->cmsg_level == SOL_SOCKET && cp->cmsg_type == SCM_TIMESTAMP) {
+ unsigned char tmp_buffer[CMSG_SPACE(sizeof(struct user64_timeval))];
+ struct cmsghdr *tmp_cp = (struct cmsghdr *)(void *)tmp_buffer;
+ int tmp_space;
+ struct timeval *tv = (struct timeval *)(void *)CMSG_DATA(cp);
+
+ tmp_cp->cmsg_level = SOL_SOCKET;
+ tmp_cp->cmsg_type = SCM_TIMESTAMP;
+
+ if (proc_is64bit(p)) {
+ struct user64_timeval *tv64 = (struct user64_timeval *)(void *)CMSG_DATA(tmp_cp);
+ tv64->tv_sec = tv->tv_sec;
+ tv64->tv_usec = tv->tv_usec;
- ctlbuf += tocopy;
- len -= tocopy;
+ tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user64_timeval));
+ tmp_space = CMSG_SPACE(sizeof(struct user64_timeval));
+ } else {
+ struct user32_timeval *tv32 = (struct user32_timeval *)(void *)CMSG_DATA(tmp_cp);
+
+ tv32->tv_sec = tv->tv_sec;
+ tv32->tv_usec = tv->tv_usec;
- buflen -= cp_size;
- cp = (struct cmsghdr *)(void *)((unsigned char *) cp + cp_size);
- cp_size = CMSG_ALIGN(cp->cmsg_len);
+ tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user32_timeval));
+ tmp_space = CMSG_SPACE(sizeof(struct user32_timeval));
+ }
+ if (len >= tmp_space) {
+ tocopy = tmp_space;
+ } else {
+ *flags |= MSG_CTRUNC;
+ tocopy = len;
+ }
+ error = copyout(tmp_buffer, ctlbuf, tocopy);
+ if (error)
+ goto out;
+ } else {
+ if (cp_size > buflen) {
+ panic("cp_size > buflen, something"
+ "wrong with alignment!");
+ }
+ if (len >= cp_size) {
+ tocopy = cp_size;
+ } else {
+ *flags |= MSG_CTRUNC;
+ tocopy = len;
+ }
+ error = copyout((caddr_t) cp, ctlbuf, tocopy);
+ if (error)
+ goto out;
}
- m = m->m_next;
+ ctlbuf += tocopy;
+ len -= tocopy;
+
+ buflen -= cp_size;
+ cp = (struct cmsghdr *)(void *)
+ ((unsigned char *) cp + cp_size);
+ cp_size = CMSG_ALIGN(cp->cmsg_len);
+ }
+
+ m = m->m_next;
+ }
+ *controllen = ctlbuf - control;
+out:
+ return (error);
+}
+
+/*
+ * Returns: 0 Success
+ * ENOTSOCK
+ * EINVAL
+ * EBADF
+ * EACCES Mandatory Access Control failure
+ * copyout:EFAULT
+ * fp_lookup:EBADF
+ * <pru_soreceive>:ENOBUFS
+ * <pru_soreceive>:ENOTCONN
+ * <pru_soreceive>:EWOULDBLOCK
+ * <pru_soreceive>:EFAULT
+ * <pru_soreceive>:EINTR
+ * <pru_soreceive>:EBADF
+ * <pru_soreceive>:EINVAL
+ * <pru_soreceive>:EMSGSIZE
+ * <pru_soreceive>:???
+ *
+ * Notes: Additional return values from calls through <pru_soreceive>
+ * depend on protocols other than TCP or AF_UNIX, which are
+ * documented above.
+ */
+static int
+recvit(struct proc *p, int s, struct user_msghdr *mp, uio_t uiop,
+ user_addr_t namelenp, int32_t *retval)
+{
+ ssize_t len;
+ int error;
+ struct mbuf *control = 0;
+ struct socket *so;
+ struct sockaddr *fromsa = 0;
+ struct fileproc *fp;
+
+ KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
+ proc_fdlock(p);
+ if ((error = fp_lookup(p, s, &fp, 1))) {
+ KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, error, 0, 0, 0, 0);
+ proc_fdunlock(p);
+ return (error);
+ }
+ if (fp->f_type != DTYPE_SOCKET) {
+ fp_drop(p, s, fp, 1);
+ proc_fdunlock(p);
+ return (ENOTSOCK);
+ }
+
+ so = (struct socket *)fp->f_data;
+ if (so == NULL) {
+ fp_drop(p, s, fp, 1);
+ proc_fdunlock(p);
+ return (EBADF);
+ }
+
+ proc_fdunlock(p);
+
+#if CONFIG_MACF_SOCKET_SUBSET
+ /*
+ * We check the state without holding the socket lock;
+ * if a race condition occurs, it would simply result
+ * in an extra call to the MAC check function.
+ */
+ if (!(so->so_state & SS_DEFUNCT) &&
+ !(so->so_state & SS_ISCONNECTED) &&
+ !(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
+ (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0)
+ goto out1;
+#endif /* MAC_SOCKET_SUBSET */
+ if (uio_resid(uiop) < 0) {
+ KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, EINVAL, 0, 0, 0, 0);
+ error = EINVAL;
+ goto out1;
+ }
+
+ len = uio_resid(uiop);
+ error = so->so_proto->pr_usrreqs->pru_soreceive(so, &fromsa, uiop,
+ (struct mbuf **)0, mp->msg_control ? &control : (struct mbuf **)0,
+ &mp->msg_flags);
+ if (fromsa)
+ AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()),
+ fromsa);
+ if (error) {
+ if (uio_resid(uiop) != len && (error == ERESTART ||
+ error == EINTR || error == EWOULDBLOCK))
+ error = 0;
+ }
+ if (error)
+ goto out;
+
+ *retval = len - uio_resid(uiop);
+
+ if (mp->msg_name) {
+ error = copyout_sa(fromsa, mp->msg_name, &mp->msg_namelen);
+ if (error)
+ goto out;
+ /* return the actual, untruncated address length */
+ if (namelenp &&
+ (error = copyout((caddr_t)&mp->msg_namelen, namelenp,
+ sizeof (int)))) {
+ goto out;
}
- mp->msg_controllen = ctlbuf - mp->msg_control;
+ }
+
+ if (mp->msg_control) {
+ error = copyout_control(p, control, mp->msg_control,
+ &mp->msg_controllen, &mp->msg_flags);
}
out:
if (fromsa)
recvfrom(struct proc *p, struct recvfrom_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return(recvfrom_nocancel(p, (struct recvfrom_nocancel_args *)uap, retval));
+ return (recvfrom_nocancel(p, (struct recvfrom_nocancel_args *)uap,
+ retval));
}
int
-recvfrom_nocancel(struct proc *p, struct recvfrom_nocancel_args *uap, int32_t *retval)
+recvfrom_nocancel(struct proc *p, struct recvfrom_nocancel_args *uap,
+ int32_t *retval)
{
struct user_msghdr msg;
int error;
recvmsg(struct proc *p, struct recvmsg_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return(recvmsg_nocancel(p, (struct recvmsg_nocancel_args *)uap, retval));
+ return (recvmsg_nocancel(p, (struct recvmsg_nocancel_args *)uap,
+ retval));
}
int
-recvmsg_nocancel(struct proc *p, struct recvmsg_nocancel_args *uap, int32_t *retval)
+recvmsg_nocancel(struct proc *p, struct recvmsg_nocancel_args *uap,
+ int32_t *retval)
{
struct user32_msghdr msg32;
struct user64_msghdr msg64;
return (error);
}
+int
+recvmsg_x(struct proc *p, struct recvmsg_x_args *uap, user_ssize_t *retval)
+{
+ int error = EOPNOTSUPP;
+ struct user_msghdr_x *user_msg_x = NULL;
+ struct recv_msg_elem *recv_msg_array = NULL;
+ struct socket *so;
+ user_ssize_t len_before = 0, len_after;
+ int need_drop = 0;
+ size_t size_of_msghdr;
+ void *umsgp = NULL;
+ u_int i;
+ u_int uiocnt;
+
+ KERNEL_DEBUG(DBG_FNC_RECVMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
+
+ error = file_socket(uap->s, &so);
+ if (error) {
+ goto out;
+ }
+ need_drop = 1;
+ if (so == NULL) {
+ error = EBADF;
+ goto out;
+ }
+ /*
+ * Input parameter range check
+ */
+ if (uap->cnt == 0 || uap->cnt > UIO_MAXIOV) {
+ error = EINVAL;
+ goto out;
+ }
+ if (uap->cnt > somaxrecvmsgx)
+ uap->cnt = somaxrecvmsgx;
+
+ user_msg_x = _MALLOC(uap->cnt * sizeof(struct user_msghdr_x),
+ M_TEMP, M_WAITOK | M_ZERO);
+ if (user_msg_x == NULL) {
+ DBG_PRINTF("%s _MALLOC() user_msg_x failed\n", __func__);
+ error = ENOMEM;
+ goto out;
+ }
+ recv_msg_array = alloc_recv_msg_array(uap->cnt);
+ if (recv_msg_array == NULL) {
+ DBG_PRINTF("%s alloc_recv_msg_array() failed\n", __func__);
+ error = ENOMEM;
+ goto out;
+ }
+ size_of_msghdr = IS_64BIT_PROCESS(p) ?
+ sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
+
+ umsgp = _MALLOC(uap->cnt * size_of_msghdr, M_TEMP, M_WAITOK | M_ZERO);
+ if (umsgp == NULL) {
+ DBG_PRINTF("%s _MALLOC() umsgp failed\n", __func__);
+ error = ENOMEM;
+ goto out;
+ }
+ error = copyin(uap->msgp, umsgp, uap->cnt * size_of_msghdr);
+ if (error) {
+ DBG_PRINTF("%s copyin() failed\n", __func__);
+ goto out;
+ }
+ error = internalize_recv_msghdr_array(umsgp,
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ UIO_READ, uap->cnt, user_msg_x, recv_msg_array);
+ if (error) {
+ DBG_PRINTF("%s copyin_user_msghdr_array() failed\n", __func__);
+ goto out;
+ }
+ /*
+ * Make sure the size of each message iovec and
+ * the aggregate size of all the iovec is valid
+ */
+ if (recv_msg_array_is_valid(recv_msg_array, uap->cnt) == 0) {
+ error = EINVAL;
+ goto out;
+ }
+ /*
+ * Sanity check on passed arguments
+ */
+ for (i = 0; i < uap->cnt; i++) {
+ struct user_msghdr_x *mp = user_msg_x + i;
+
+ if (mp->msg_flags != 0) {
+ error = EINVAL;
+ goto out;
+ }
+ }
+#if CONFIG_MACF_SOCKET_SUBSET
+ /*
+ * We check the state without holding the socket lock;
+ * if a race condition occurs, it would simply result
+ * in an extra call to the MAC check function.
+ */
+ if (!(so->so_state & SS_DEFUNCT) &&
+ !(so->so_state & SS_ISCONNECTED) &&
+ !(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
+ (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0)
+ goto out;
+#endif /* MAC_SOCKET_SUBSET */
+
+ len_before = recv_msg_array_resid(recv_msg_array, uap->cnt);
+
+ if (so->so_proto->pr_usrreqs->pru_soreceive_list !=
+ pru_soreceive_list_notsupp &&
+ somaxrecvmsgx == 0) {
+ error = so->so_proto->pr_usrreqs->pru_soreceive_list(so,
+ recv_msg_array, uap->cnt, &uap->flags);
+ } else {
+ int flags = uap->flags;
+
+ for (i = 0; i < uap->cnt; i++) {
+ struct recv_msg_elem *recv_msg_elem;
+ uio_t auio;
+ struct sockaddr **psa;
+ struct mbuf **controlp;
+
+ recv_msg_elem = recv_msg_array + i;
+ auio = recv_msg_elem->uio;
+
+ /*
+ * Do not block if we got at least one packet
+ */
+ if (i > 0)
+ flags |= MSG_DONTWAIT;
+
+ psa = (recv_msg_elem->which & SOCK_MSG_SA) ?
+ &recv_msg_elem->psa : NULL;
+ controlp = (recv_msg_elem->which & SOCK_MSG_CONTROL) ?
+ &recv_msg_elem->controlp : NULL;
+
+ error = so->so_proto->pr_usrreqs->pru_soreceive(so, psa,
+ auio, (struct mbuf **)0, controlp, &flags);
+ if (error)
+ break;
+ /*
+ * We have some data
+ */
+ recv_msg_elem->which |= SOCK_MSG_DATA;
+ /*
+ * Stop on partial copy
+ */
+ if (flags & (MSG_RCVMORE | MSG_TRUNC))
+ break;
+ }
+ if ((uap->flags & MSG_DONTWAIT) == 0)
+ flags &= ~MSG_DONTWAIT;
+ uap->flags = flags;
+ }
+
+ len_after = recv_msg_array_resid(recv_msg_array, uap->cnt);
+
+ if (error) {
+ if (len_after != len_before && (error == ERESTART ||
+ error == EINTR || error == EWOULDBLOCK))
+ error = 0;
+ else
+ goto out;
+ }
+
+ uiocnt = externalize_recv_msghdr_array(umsgp,
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ UIO_READ, uap->cnt, user_msg_x, recv_msg_array);
+
+ error = copyout(umsgp, uap->msgp, uap->cnt * size_of_msghdr);
+ if (error) {
+ DBG_PRINTF("%s copyout() failed\n", __func__);
+ goto out;
+ }
+ *retval = (int)(uiocnt);
+
+ for (i = 0; i < uap->cnt; i++) {
+ struct user_msghdr_x *mp = user_msg_x + i;
+ struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
+ struct sockaddr *fromsa = recv_msg_elem->psa;
+
+ if (mp->msg_name) {
+ error = copyout_sa(fromsa, mp->msg_name,
+ &mp->msg_namelen);
+ if (error)
+ goto out;
+ }
+ if (mp->msg_control) {
+ error = copyout_control(p, recv_msg_elem->controlp,
+ mp->msg_control, &mp->msg_controllen,
+ &mp->msg_flags);
+ if (error)
+ goto out;
+ }
+ }
+out:
+ if (need_drop)
+ file_drop(uap->s);
+ if (umsgp != NULL)
+ _FREE(umsgp, M_TEMP);
+ if (recv_msg_array != NULL)
+ free_recv_msg_array(recv_msg_array, uap->cnt);
+ if (user_msg_x != NULL)
+ _FREE(user_msg_x, M_TEMP);
+
+ KERNEL_DEBUG(DBG_FNC_RECVMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
+
+ return (error);
+}
+
/*
* Returns: 0 Success
* EBADF
size_t alloc_buflen = (size_t)buflen;
- if(alloc_buflen > INT_MAX/2)
+ if (alloc_buflen > INT_MAX/2)
return (EINVAL);
#ifdef __LP64__
- /* The fd's in the buffer must expand to be pointers, thus we need twice as much space */
- if(type == MT_CONTROL)
- alloc_buflen = ((buflen - sizeof(struct cmsghdr))*2) + sizeof(struct cmsghdr);
+ /*
+ * The fd's in the buffer must expand to be pointers, thus we need twice
+ * as much space
+ */
+ if (type == MT_CONTROL)
+ alloc_buflen = ((buflen - sizeof(struct cmsghdr))*2) +
+ sizeof(struct cmsghdr);
#endif
if (alloc_buflen > MLEN) {
if (type == MT_SONAME && alloc_buflen <= 112)
- alloc_buflen = MLEN; /* unix domain compat. hack */
+ alloc_buflen = MLEN; /* unix domain compat. hack */
else if (alloc_buflen > MCLBYTES)
return (EINVAL);
}
return (ENOBUFS);
}
}
- /* K64: We still copyin the original buflen because it gets expanded later
- * and we lie about the size of the mbuf because it only affects unp_* functions
+ /*
+ * K64: We still copyin the original buflen because it gets expanded
+ * later and we lie about the size of the mbuf because it only affects
+ * unp_* functions
*/
m->m_len = buflen;
error = copyin(data, mtod(m, caddr_t), (u_int)buflen);
{
struct sockaddr *sa;
int error;
+ size_t alloclen;
if (len > SOCK_MAXADDRLEN)
return (ENAMETOOLONG);
if (len < offsetof(struct sockaddr, sa_data[0]))
return (EINVAL);
- MALLOC(sa, struct sockaddr *, len, M_SONAME, M_WAITOK | M_ZERO);
+ /*
+ * Workaround for rdar://23362120
+ * Allways allocate a buffer that can hold an IPv6 socket address
+ */
+ alloclen = MAX(len, sizeof(struct sockaddr_in6));
+ MALLOC(sa, struct sockaddr *, alloclen, M_SONAME, M_WAITOK | M_ZERO);
if (sa == NULL) {
return (ENOMEM);
}
return (error);
}
+int
+internalize_user_msghdr_array(const void *src, int spacetype, int direction,
+ u_int count, struct user_msghdr_x *dst, struct uio **uiop)
+{
+ int error = 0;
+ u_int i;
+ u_int namecnt = 0;
+ u_int ctlcnt = 0;
+
+ for (i = 0; i < count; i++) {
+ uio_t auio;
+ struct user_iovec *iovp;
+ struct user_msghdr_x *user_msg = dst + i;
+
+ if (spacetype == UIO_USERSPACE64) {
+ const struct user64_msghdr_x *msghdr64;
+
+ msghdr64 = ((const struct user64_msghdr_x *)src) + i;
+
+ user_msg->msg_name = msghdr64->msg_name;
+ user_msg->msg_namelen = msghdr64->msg_namelen;
+ user_msg->msg_iov = msghdr64->msg_iov;
+ user_msg->msg_iovlen = msghdr64->msg_iovlen;
+ user_msg->msg_control = msghdr64->msg_control;
+ user_msg->msg_controllen = msghdr64->msg_controllen;
+ user_msg->msg_flags = msghdr64->msg_flags;
+ user_msg->msg_datalen = msghdr64->msg_datalen;
+ } else {
+ const struct user32_msghdr_x *msghdr32;
+
+ msghdr32 = ((const struct user32_msghdr_x *)src) + i;
+
+ user_msg->msg_name = msghdr32->msg_name;
+ user_msg->msg_namelen = msghdr32->msg_namelen;
+ user_msg->msg_iov = msghdr32->msg_iov;
+ user_msg->msg_iovlen = msghdr32->msg_iovlen;
+ user_msg->msg_control = msghdr32->msg_control;
+ user_msg->msg_controllen = msghdr32->msg_controllen;
+ user_msg->msg_flags = msghdr32->msg_flags;
+ user_msg->msg_datalen = msghdr32->msg_datalen;
+ }
+
+ if (user_msg->msg_iovlen <= 0 ||
+ user_msg->msg_iovlen > UIO_MAXIOV) {
+ error = EMSGSIZE;
+ goto done;
+ }
+ auio = uio_create(user_msg->msg_iovlen, 0, spacetype,
+ direction);
+ if (auio == NULL) {
+ error = ENOMEM;
+ goto done;
+ }
+ uiop[i] = auio;
+
+ iovp = uio_iovsaddr(auio);
+ if (iovp == NULL) {
+ error = ENOMEM;
+ goto done;
+ }
+ error = copyin_user_iovec_array(user_msg->msg_iov,
+ spacetype, user_msg->msg_iovlen, iovp);
+ if (error)
+ goto done;
+ user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
+
+ error = uio_calculateresid(auio);
+ if (error)
+ goto done;
+ user_msg->msg_datalen = uio_resid(auio);
+
+ if (user_msg->msg_name && user_msg->msg_namelen)
+ namecnt++;
+ if (user_msg->msg_control && user_msg->msg_controllen)
+ ctlcnt++;
+ }
+done:
+
+ return (error);
+}
+
+int
+internalize_recv_msghdr_array(const void *src, int spacetype, int direction,
+ u_int count, struct user_msghdr_x *dst,
+ struct recv_msg_elem *recv_msg_array)
+{
+ int error = 0;
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ struct user_iovec *iovp;
+ struct user_msghdr_x *user_msg = dst + i;
+ struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
+
+ if (spacetype == UIO_USERSPACE64) {
+ const struct user64_msghdr_x *msghdr64;
+
+ msghdr64 = ((const struct user64_msghdr_x *)src) + i;
+
+ user_msg->msg_name = msghdr64->msg_name;
+ user_msg->msg_namelen = msghdr64->msg_namelen;
+ user_msg->msg_iov = msghdr64->msg_iov;
+ user_msg->msg_iovlen = msghdr64->msg_iovlen;
+ user_msg->msg_control = msghdr64->msg_control;
+ user_msg->msg_controllen = msghdr64->msg_controllen;
+ user_msg->msg_flags = msghdr64->msg_flags;
+ user_msg->msg_datalen = msghdr64->msg_datalen;
+ } else {
+ const struct user32_msghdr_x *msghdr32;
+
+ msghdr32 = ((const struct user32_msghdr_x *)src) + i;
+
+ user_msg->msg_name = msghdr32->msg_name;
+ user_msg->msg_namelen = msghdr32->msg_namelen;
+ user_msg->msg_iov = msghdr32->msg_iov;
+ user_msg->msg_iovlen = msghdr32->msg_iovlen;
+ user_msg->msg_control = msghdr32->msg_control;
+ user_msg->msg_controllen = msghdr32->msg_controllen;
+ user_msg->msg_flags = msghdr32->msg_flags;
+ user_msg->msg_datalen = msghdr32->msg_datalen;
+ }
+
+ if (user_msg->msg_iovlen <= 0 ||
+ user_msg->msg_iovlen > UIO_MAXIOV) {
+ error = EMSGSIZE;
+ goto done;
+ }
+ recv_msg_elem->uio = uio_create(user_msg->msg_iovlen, 0,
+ spacetype, direction);
+ if (recv_msg_elem->uio == NULL) {
+ error = ENOMEM;
+ goto done;
+ }
+
+ iovp = uio_iovsaddr(recv_msg_elem->uio);
+ if (iovp == NULL) {
+ error = ENOMEM;
+ goto done;
+ }
+ error = copyin_user_iovec_array(user_msg->msg_iov,
+ spacetype, user_msg->msg_iovlen, iovp);
+ if (error)
+ goto done;
+ user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
+
+ error = uio_calculateresid(recv_msg_elem->uio);
+ if (error)
+ goto done;
+ user_msg->msg_datalen = uio_resid(recv_msg_elem->uio);
+
+ if (user_msg->msg_name && user_msg->msg_namelen)
+ recv_msg_elem->which |= SOCK_MSG_SA;
+ if (user_msg->msg_control && user_msg->msg_controllen)
+ recv_msg_elem->which |= SOCK_MSG_CONTROL;
+ }
+done:
+
+ return (error);
+}
+
+u_int
+externalize_user_msghdr_array(void *dst, int spacetype, int direction,
+ u_int count, const struct user_msghdr_x *src, struct uio **uiop)
+{
+#pragma unused(direction)
+ u_int i;
+ int seenlast = 0;
+ u_int retcnt = 0;
+
+ for (i = 0; i < count; i++) {
+ const struct user_msghdr_x *user_msg = src + i;
+ uio_t auio = uiop[i];
+ user_ssize_t len = user_msg->msg_datalen - uio_resid(auio);
+
+ if (user_msg->msg_datalen != 0 && len == 0)
+ seenlast = 1;
+
+ if (seenlast == 0)
+ retcnt ++;
+
+ if (spacetype == UIO_USERSPACE64) {
+ struct user64_msghdr_x *msghdr64;
+
+ msghdr64 = ((struct user64_msghdr_x *)dst) + i;
+
+ msghdr64->msg_flags = user_msg->msg_flags;
+ msghdr64->msg_datalen = len;
+
+ } else {
+ struct user32_msghdr_x *msghdr32;
+
+ msghdr32 = ((struct user32_msghdr_x *)dst) + i;
+
+ msghdr32->msg_flags = user_msg->msg_flags;
+ msghdr32->msg_datalen = len;
+ }
+ }
+ return (retcnt);
+}
+
+u_int
+externalize_recv_msghdr_array(void *dst, int spacetype, int direction,
+ u_int count, const struct user_msghdr_x *src,
+ struct recv_msg_elem *recv_msg_array)
+{
+ u_int i;
+ int seenlast = 0;
+ u_int retcnt = 0;
+
+ for (i = 0; i < count; i++) {
+ const struct user_msghdr_x *user_msg = src + i;
+ struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
+ user_ssize_t len;
+
+ len = user_msg->msg_datalen - uio_resid(recv_msg_elem->uio);
+
+ if (direction == UIO_READ) {
+ if ((recv_msg_elem->which & SOCK_MSG_DATA) == 0)
+ seenlast = 1;
+ } else {
+ if (user_msg->msg_datalen != 0 && len == 0)
+ seenlast = 1;
+ }
+
+ if (seenlast == 0)
+ retcnt ++;
+
+ if (spacetype == UIO_USERSPACE64) {
+ struct user64_msghdr_x *msghdr64;
+
+ msghdr64 = ((struct user64_msghdr_x *)dst) + i;
+
+ msghdr64->msg_flags = user_msg->msg_flags;
+ msghdr64->msg_datalen = len;
+
+ } else {
+ struct user32_msghdr_x *msghdr32;
+
+ msghdr32 = ((struct user32_msghdr_x *)dst) + i;
+
+ msghdr32->msg_flags = user_msg->msg_flags;
+ msghdr32->msg_datalen = len;
+ }
+ }
+ return (retcnt);
+}
+
+void
+free_uio_array(struct uio **uiop, u_int count)
+{
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ if (uiop[i] != NULL)
+ uio_free(uiop[i]);
+ }
+}
+
+__private_extern__ user_ssize_t
+uio_array_resid(struct uio **uiop, u_int count)
+{
+ user_ssize_t len = 0;
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ struct uio *auio = uiop[i];
+
+ if (auio != NULL)
+ len += uio_resid(auio);
+ }
+ return (len);
+}
+
+int
+uio_array_is_valid(struct uio **uiop, u_int count)
+{
+ user_ssize_t len = 0;
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ struct uio *auio = uiop[i];
+
+ if (auio != NULL) {
+ user_ssize_t resid = uio_resid(auio);
+
+ /*
+ * Sanity check on the validity of the iovec:
+ * no point of going over sb_max
+ */
+ if (resid < 0 || (u_int32_t)resid > sb_max)
+ return (0);
+
+ len += resid;
+ if (len < 0 || (u_int32_t)len > sb_max)
+ return (0);
+ }
+ }
+ return (1);
+}
+
+
+struct recv_msg_elem *
+alloc_recv_msg_array(u_int count)
+{
+ struct recv_msg_elem *recv_msg_array;
+
+ recv_msg_array = _MALLOC(count * sizeof(struct recv_msg_elem),
+ M_TEMP, M_WAITOK | M_ZERO);
+
+ return (recv_msg_array);
+}
+
+void
+free_recv_msg_array(struct recv_msg_elem *recv_msg_array, u_int count)
+{
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
+
+ if (recv_msg_elem->uio != NULL)
+ uio_free(recv_msg_elem->uio);
+ if (recv_msg_elem->psa != NULL)
+ _FREE(recv_msg_elem->psa, M_TEMP);
+ if (recv_msg_elem->controlp != NULL)
+ m_freem(recv_msg_elem->controlp);
+ }
+ _FREE(recv_msg_array, M_TEMP);
+}
+
+
+__private_extern__ user_ssize_t
+recv_msg_array_resid(struct recv_msg_elem *recv_msg_array, u_int count)
+{
+ user_ssize_t len = 0;
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
+
+ if (recv_msg_elem->uio != NULL)
+ len += uio_resid(recv_msg_elem->uio);
+ }
+ return (len);
+}
+
+int
+recv_msg_array_is_valid(struct recv_msg_elem *recv_msg_array, u_int count)
+{
+ user_ssize_t len = 0;
+ u_int i;
+
+ for (i = 0; i < count; i++) {
+ struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
+
+ if (recv_msg_elem->uio != NULL) {
+ user_ssize_t resid = uio_resid(recv_msg_elem->uio);
+
+ /*
+ * Sanity check on the validity of the iovec:
+ * no point of going over sb_max
+ */
+ if (resid < 0 || (u_int32_t)resid > sb_max)
+ return (0);
+
+ len += resid;
+ if (len < 0 || (u_int32_t)len > sb_max)
+ return (0);
+ }
+ }
+ return (1);
+}
+
#if SENDFILE
#define SFUIOBUFS 64
/* Macros to compute the number of mbufs needed depending on cluster size */
-#define HOWMANY_16K(n) ((((unsigned int)(n) - 1) >> (PGSHIFT + 2)) + 1)
-#define HOWMANY_4K(n) ((((unsigned int)(n) - 1) >> PGSHIFT) + 1)
+#define HOWMANY_16K(n) ((((unsigned int)(n) - 1) >> M16KCLSHIFT) + 1)
+#define HOWMANY_4K(n) ((((unsigned int)(n) - 1) >> MBIGCLSHIFT) + 1)
/* Upper send limit in bytes (SFUIOBUFS * PAGESIZE) */
-#define SENDFILE_MAX_BYTES (SFUIOBUFS << PGSHIFT)
+#define SENDFILE_MAX_BYTES (SFUIOBUFS << PGSHIFT)
/* Upper send limit in the number of mbuf clusters */
#define SENDFILE_MAX_16K HOWMANY_16K(SENDFILE_MAX_BYTES)
#define SENDFILE_MAX_4K HOWMANY_4K(SENDFILE_MAX_BYTES)
-size_t mbuf_pkt_maxlen(mbuf_t m);
-
-__private_extern__ size_t
-mbuf_pkt_maxlen(mbuf_t m)
-{
- size_t maxlen = 0;
-
- while (m) {
- maxlen += mbuf_maxlen(m);
- m = mbuf_next(m);
- }
- return (maxlen);
-}
-
static void
alloc_sendpkt(int how, size_t pktlen, unsigned int *maxchunks,
struct mbuf **m, boolean_t jumbocl)
size_t sizeof_hdtr;
off_t file_size;
struct vfs_context context = *vfs_context_current();
-#define ENXIO_10146739_DBG(err_str) { \
- if (error == ENXIO) { \
- printf(err_str, \
- __func__, \
- "File a radar related to rdar://10146739 \n"); \
- } \
-}
+
KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE | DBG_FUNC_START), uap->s,
0, 0, 0, 0);
* type and connected socket out, positive offset.
*/
if ((error = fp_getfvp(p, uap->fd, &fp, &vp))) {
- ENXIO_10146739_DBG("%s: fp_getfvp error. %s");
goto done;
}
if ((fp->f_flag & FREAD) == 0) {
}
error = file_socket(uap->s, &so);
if (error) {
- ENXIO_10146739_DBG("%s: file_socket error. %s");
goto done1;
}
if (so == NULL) {
nuap.iovcnt = user_hdtr.hdr_cnt;
error = writev_nocancel(p, &nuap, &writev_retval);
if (error) {
- ENXIO_10146739_DBG("%s: writev_nocancel error. %s");
goto done2;
}
sbytes += writev_retval;
* 2. We don't want to read past the end of file
*/
if ((error = vnode_size(vp, &file_size, vfs_context_current())) != 0) {
- ENXIO_10146739_DBG("%s: vnode_size error. %s");
goto done2;
}
socket_unlock(so, 0);
alloc_sendpkt(M_WAIT, xfsize, &nbufs, &m0, jumbocl);
- pktlen = mbuf_pkt_maxlen(m0);
+ pktlen = mbuf_pkthdr_maxlen(m0);
if (pktlen < (size_t)xfsize)
xfsize = pktlen;
error == EINTR || error == EWOULDBLOCK)) {
error = 0;
} else {
- ENXIO_10146739_DBG("%s: fo_read error. %s");
mbuf_freem(m0);
goto done3;
}
(unsigned int)(xfsize & 0x0ffffffff), 0, 0);
if (xfsize == 0) {
- //printf("sendfile: fo_read 0 bytes, EOF\n");
+ // printf("sendfile: fo_read 0 bytes, EOF\n");
break;
}
if (xfsize + off > file_size)
so->so_error = 0;
}
m_freem(m0);
- ENXIO_10146739_DBG("%s: Unexpected socket error. %s");
goto done3;
}
/*
error = 0;
continue;
}
- ENXIO_10146739_DBG("%s: sflt_data_out error. %s");
goto done3;
}
/*
KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_SEND | DBG_FUNC_START),
uap->s, 0, 0, 0, 0);
if (error) {
- ENXIO_10146739_DBG("%s: pru_send error. %s");
goto done3;
}
}
nuap.iovcnt = user_hdtr.trl_cnt;
error = writev_nocancel(p, &nuap, &writev_retval);
if (error) {
- ENXIO_10146739_DBG("%s: writev_nocancel error. %s");
goto done2;
}
sbytes += writev_retval;
projects / apple / xnu.git / blobdiff