#include <kern/task.h>
#include <sys/priv.h>
#include <sys/sysctl.h>
+#include <sys/sys_domain.h>
#include <security/audit/audit.h>
#include <net/route.h>
#include <netinet/in_pcb.h>
+#include <os/ptrtools.h>
+
#if CONFIG_MACF_SOCKET_SUBSET
#include <security/mac_framework.h>
#endif /* MAC_SOCKET_SUBSET */
-#define f_flag f_fglob->fg_flag
-#define f_type f_fglob->fg_ops->fo_type
-#define f_msgcount f_fglob->fg_msgcount
-#define f_cred f_fglob->fg_cred
-#define f_ops f_fglob->fg_ops
-#define f_offset f_fglob->fg_offset
-#define f_data f_fglob->fg_data
-
-#define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETSOCK, 0)
-#define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETSOCK, 2)
-#define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETSOCK, 1)
-#define DBG_LAYER_OUT_END NETDBG_CODE(DBG_NETSOCK, 3)
-#define DBG_FNC_SENDMSG NETDBG_CODE(DBG_NETSOCK, (1 << 8) | 1)
-#define DBG_FNC_SENDTO NETDBG_CODE(DBG_NETSOCK, (2 << 8) | 1)
-#define DBG_FNC_SENDIT NETDBG_CODE(DBG_NETSOCK, (3 << 8) | 1)
-#define DBG_FNC_RECVFROM NETDBG_CODE(DBG_NETSOCK, (5 << 8))
-#define DBG_FNC_RECVMSG NETDBG_CODE(DBG_NETSOCK, (6 << 8))
-#define DBG_FNC_RECVIT NETDBG_CODE(DBG_NETSOCK, (7 << 8))
-#define DBG_FNC_SENDFILE NETDBG_CODE(DBG_NETSOCK, (10 << 8))
-#define DBG_FNC_SENDFILE_WAIT NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 1))
-#define DBG_FNC_SENDFILE_READ NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 2))
-#define DBG_FNC_SENDFILE_SEND NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 3))
-#define DBG_FNC_SENDMSG_X NETDBG_CODE(DBG_NETSOCK, (11 << 8))
-#define DBG_FNC_RECVMSG_X NETDBG_CODE(DBG_NETSOCK, (12 << 8))
+#define f_flag fp_glob->fg_flag
+#define f_ops fp_glob->fg_ops
+#define f_data fp_glob->fg_data
+
+#define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETSOCK, 0)
+#define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETSOCK, 2)
+#define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETSOCK, 1)
+#define DBG_LAYER_OUT_END NETDBG_CODE(DBG_NETSOCK, 3)
+#define DBG_FNC_SENDMSG NETDBG_CODE(DBG_NETSOCK, (1 << 8) | 1)
+#define DBG_FNC_SENDTO NETDBG_CODE(DBG_NETSOCK, (2 << 8) | 1)
+#define DBG_FNC_SENDIT NETDBG_CODE(DBG_NETSOCK, (3 << 8) | 1)
+#define DBG_FNC_RECVFROM NETDBG_CODE(DBG_NETSOCK, (5 << 8))
+#define DBG_FNC_RECVMSG NETDBG_CODE(DBG_NETSOCK, (6 << 8))
+#define DBG_FNC_RECVIT NETDBG_CODE(DBG_NETSOCK, (7 << 8))
+#define DBG_FNC_SENDFILE NETDBG_CODE(DBG_NETSOCK, (10 << 8))
+#define DBG_FNC_SENDFILE_WAIT NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 1))
+#define DBG_FNC_SENDFILE_READ NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 2))
+#define DBG_FNC_SENDFILE_SEND NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 3))
+#define DBG_FNC_SENDMSG_X NETDBG_CODE(DBG_NETSOCK, (11 << 8))
+#define DBG_FNC_RECVMSG_X NETDBG_CODE(DBG_NETSOCK, (12 << 8))
#if DEBUG || DEVELOPMENT
-#define DEBUG_KERNEL_ADDRPERM(_v) (_v)
-#define DBG_PRINTF(...) printf(__VA_ARGS__)
+#define DEBUG_KERNEL_ADDRPERM(_v) (_v)
+#define DBG_PRINTF(...) printf(__VA_ARGS__)
#else
-#define DEBUG_KERNEL_ADDRPERM(_v) VM_KERNEL_ADDRPERM(_v)
-#define DBG_PRINTF(...) do { } while (0)
+#define DEBUG_KERNEL_ADDRPERM(_v) VM_KERNEL_ADDRPERM(_v)
+#define DBG_PRINTF(...) do { } while (0)
#endif
-/* TODO: should be in header file */
-int falloc_locked(proc_t, struct fileproc **, int *, vfs_context_t, int);
-
static int sendit(struct proc *, struct socket *, struct user_msghdr *, uio_t,
int, int32_t *);
static int recvit(struct proc *, int, struct user_msghdr *, uio_t, user_addr_t,
const struct user_msghdr_x *, struct uio **);
static void free_uio_array(struct uio **, u_int);
-static int uio_array_is_valid(struct uio **, u_int);
+static boolean_t uio_array_is_valid(struct uio **, u_int);
static int recv_msg_array_is_valid(struct recv_msg_elem *, u_int);
static int internalize_recv_msghdr_array(const void *, int, int,
u_int, struct user_msghdr_x *, struct recv_msg_elem *);
-static u_int externalize_recv_msghdr_array(void *, int, int, u_int,
- const struct user_msghdr_x *, struct recv_msg_elem *);
+static u_int externalize_recv_msghdr_array(struct proc *, struct socket *, void *, u_int,
+ struct user_msghdr_x *, struct recv_msg_elem *, int *);
static struct recv_msg_elem *alloc_recv_msg_array(u_int count);
static void free_recv_msg_array(struct recv_msg_elem *, u_int);
static u_int somaxsendmsgx = 100;
SYSCTL_UINT(_kern_ipc, OID_AUTO, maxsendmsgx,
- CTLFLAG_RW | CTLFLAG_LOCKED, &somaxsendmsgx, 0, "");
+ CTLFLAG_RW | CTLFLAG_LOCKED, &somaxsendmsgx, 0, "");
static u_int somaxrecvmsgx = 100;
SYSCTL_UINT(_kern_ipc, OID_AUTO, maxrecvmsgx,
- CTLFLAG_RW | CTLFLAG_LOCKED, &somaxrecvmsgx, 0, "");
+ CTLFLAG_RW | CTLFLAG_LOCKED, &somaxrecvmsgx, 0, "");
/*
* System call interface to the socket abstraction.
*/
int
socket(struct proc *p,
- struct socket_args *uap,
- int32_t *retval)
+ struct socket_args *uap,
+ int32_t *retval)
{
- return (socket_common(p, uap->domain, uap->type, uap->protocol,
- proc_selfpid(), retval, 0));
+ return socket_common(p, uap->domain, uap->type, uap->protocol,
+ proc_selfpid(), retval, 0);
}
int
socket_delegate(struct proc *p,
- struct socket_delegate_args *uap,
- int32_t *retval)
+ struct socket_delegate_args *uap,
+ int32_t *retval)
{
return socket_common(p, uap->domain, uap->type, uap->protocol,
- uap->epid, retval, 1);
+ uap->epid, retval, 1);
}
static int
socket_common(struct proc *p,
- int domain,
- int type,
- int protocol,
- pid_t epid,
- int32_t *retval,
- int delegate)
+ int domain,
+ int type,
+ int protocol,
+ pid_t epid,
+ int32_t *retval,
+ int delegate)
{
struct socket *so;
struct fileproc *fp;
AUDIT_ARG(socket, domain, type, protocol);
#if CONFIG_MACF_SOCKET_SUBSET
if ((error = mac_socket_check_create(kauth_cred_get(), domain,
- type, protocol)) != 0)
- return (error);
+ type, protocol)) != 0) {
+ return error;
+ }
#endif /* MAC_SOCKET_SUBSET */
if (delegate) {
error = priv_check_cred(kauth_cred_get(),
PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0);
- if (error)
- return (EACCES);
+ if (error) {
+ return EACCES;
+ }
}
error = falloc(p, &fp, &fd, vfs_context_current());
if (error) {
- return (error);
+ return error;
}
- fp->f_flag = FREAD|FWRITE;
+ fp->f_flag = FREAD | FWRITE;
fp->f_ops = &socketops;
- if (delegate)
+ if (delegate) {
error = socreate_delegate(domain, &so, type, protocol, epid);
- else
+ } else {
error = socreate(domain, &so, type, protocol);
+ }
if (error) {
fp_free(p, fd, fp);
fd, 0, (int64_t)VM_KERNEL_ADDRPERM(so));
}
}
- return (error);
+ return error;
}
/*
AUDIT_ARG(fd, uap->s);
error = file_socket(uap->s, &so);
- if (error != 0)
- return (error);
+ if (error != 0) {
+ return error;
+ }
if (so == NULL) {
error = EBADF;
goto out;
error = EDESTADDRREQ;
goto out;
}
- if (uap->namelen > sizeof (ss)) {
+ if (uap->namelen > sizeof(ss)) {
error = getsockaddr(so, &sa, uap->name, uap->namelen, TRUE);
} else {
error = getsockaddr_s(so, &ss, uap->name, uap->namelen, TRUE);
want_free = FALSE;
}
}
- if (error != 0)
+ if (error != 0) {
goto out;
+ }
AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), sa);
#if CONFIG_MACF_SOCKET_SUBSET
- if ((error = mac_socket_check_bind(kauth_cred_get(), so, sa)) == 0)
- error = sobindlock(so, sa, 1); /* will lock socket */
+ if ((sa != NULL && sa->sa_family == AF_SYSTEM) ||
+ (error = mac_socket_check_bind(kauth_cred_get(), so, sa)) == 0) {
+ error = sobindlock(so, sa, 1); /* will lock socket */
+ }
#else
- error = sobindlock(so, sa, 1); /* will lock socket */
+ error = sobindlock(so, sa, 1); /* will lock socket */
#endif /* MAC_SOCKET_SUBSET */
- if (want_free)
+ if (want_free) {
FREE(sa, M_SONAME);
+ }
out:
file_drop(uap->s);
- return (error);
+ return error;
}
/*
AUDIT_ARG(fd, uap->s);
error = file_socket(uap->s, &so);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
if (so != NULL)
#if CONFIG_MACF_SOCKET_SUBSET
{
error = mac_socket_check_listen(kauth_cred_get(), so);
- if (error == 0)
+ if (error == 0) {
error = solisten(so, uap->backlog);
+ }
}
#else
- error = solisten(so, uap->backlog);
+ { error = solisten(so, uap->backlog);}
#endif /* MAC_SOCKET_SUBSET */
- else
+ else {
error = EBADF;
+ }
file_drop(uap->s);
- return (error);
+ return error;
}
/*
- * Returns: fp_getfsock:EBADF Bad file descriptor
- * fp_getfsock:EOPNOTSUPP ...
- * xlate => :ENOTSOCK Socket operation on non-socket
+ * Returns: fp_get_ftype:EBADF Bad file descriptor
+ * fp_get_ftype:ENOTSOCK Socket operation on non-socket
* :EFAULT Bad address on copyin/copyout
* :EBADF Bad file descriptor
* :EOPNOTSUPP Operation not supported on socket
* :ECONNABORTED Connection aborted
* :EINTR Interrupted function
* :EACCES Mandatory Access Control failure
- * falloc_locked:ENFILE Too many files open in system
- * falloc_locked::EMFILE Too many open files
- * falloc_locked::ENOMEM Not enough space
+ * falloc:ENFILE Too many files open in system
+ * falloc:EMFILE Too many open files
+ * falloc:ENOMEM Not enough space
* 0 Success
*/
int
lck_mtx_t *mutex_held;
int fd = uap->s;
int newfd;
- short fflag; /* type must match fp->f_flag */
+ unsigned int fflag;
int dosocklock = 0;
*retval = -1;
if (uap->name) {
error = copyin(uap->anamelen, (caddr_t)&namelen,
- sizeof (socklen_t));
- if (error)
- return (error);
+ sizeof(socklen_t));
+ if (error) {
+ return error;
+ }
}
- error = fp_getfsock(p, fd, &fp, &head);
+ error = fp_get_ftype(p, fd, DTYPE_SOCKET, ENOTSOCK, &fp);
if (error) {
- if (error == EOPNOTSUPP)
- error = ENOTSOCK;
- return (error);
- }
- if (head == NULL) {
- error = EBADF;
- goto out;
+ return error;
}
+ head = fp->f_data;
+
#if CONFIG_MACF_SOCKET_SUBSET
- if ((error = mac_socket_check_accept(kauth_cred_get(), head)) != 0)
+ if ((error = mac_socket_check_accept(kauth_cred_get(), head)) != 0) {
goto out;
+ }
#endif /* MAC_SOCKET_SUBSET */
socket_lock(head, 1);
- if (head->so_proto->pr_getlock != NULL) {
+ if (head->so_proto->pr_getlock != NULL) {
mutex_held = (*head->so_proto->pr_getlock)(head, PR_F_WILLUNLOCK);
dosocklock = 1;
} else {
head->so_error = ECONNABORTED;
break;
}
- if (head->so_usecount < 1)
+ if (head->so_usecount < 1) {
panic("accept: head=%p refcount=%d\n", head,
head->so_usecount);
+ }
error = msleep((caddr_t)&head->so_timeo, mutex_held,
PSOCK | PCATCH, "accept", 0);
- if (head->so_usecount < 1)
+ if (head->so_usecount < 1) {
panic("accept: 2 head=%p refcount=%d\n", head,
head->so_usecount);
+ }
if ((head->so_state & SS_DRAINING)) {
error = ECONNABORTED;
}
fp->f_data = (caddr_t)so;
socket_lock(head, 0);
- if (dosocklock)
+ if (dosocklock) {
socket_lock(so, 1);
+ }
/* Sync socket non-blocking/async state with file flags */
if (fp->f_flag & FNONBLOCK) {
socket_unlock(head, 1);
if (sa == NULL) {
namelen = 0;
- if (uap->name)
+ if (uap->name) {
goto gotnoname;
+ }
error = 0;
goto releasefd;
}
AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), sa);
if (uap->name) {
- socklen_t sa_len;
+ socklen_t sa_len;
/* save sa_len before it is destroyed */
sa_len = sa->sa_len;
namelen = MIN(namelen, sa_len);
error = copyout(sa, uap->name, namelen);
- if (!error)
+ if (!error) {
/* return the actual, untruncated address length */
namelen = sa_len;
+ }
gotnoname:
error = copyout((caddr_t)&namelen, uap->anamelen,
- sizeof (socklen_t));
+ sizeof(socklen_t));
}
FREE(sa, M_SONAME);
SHUTDOWN_SOCKET_LEVEL_DISCONNECT_INTERNAL);
}
- if (dosocklock)
+ if (dosocklock) {
socket_unlock(so, 1);
+ }
proc_fdlock(p);
procfdtbl_releasefd(p, newfd, NULL);
KERNEL_ENERGYTRACE(kEnTrActKernSocket, DBG_FUNC_START,
newfd, 0, (int64_t)VM_KERNEL_ADDRPERM(so));
}
- return (error);
+ return error;
}
int
accept(struct proc *p, struct accept_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (accept_nocancel(p, (struct accept_nocancel_args *)uap,
- retval));
+ return accept_nocancel(p, (struct accept_nocancel_args *)uap,
+ retval);
}
/*
connect(struct proc *p, struct connect_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (connect_nocancel(p, (struct connect_nocancel_args *)uap,
- retval));
+ return connect_nocancel(p, (struct connect_nocancel_args *)uap,
+ retval);
}
int
AUDIT_ARG(fd, uap->s);
error = file_socket(fd, &so);
- if (error != 0)
- return (error);
+ if (error != 0) {
+ return error;
+ }
if (so == NULL) {
error = EBADF;
goto out;
dgram = (so->so_type == SOCK_DGRAM);
/* Get socket address now before we obtain socket lock */
- if (uap->namelen > sizeof (ss)) {
+ if (uap->namelen > sizeof(ss)) {
error = getsockaddr(so, &sa, uap->name, uap->namelen, !dgram);
} else {
error = getsockaddr_s(so, &ss, uap->name, uap->namelen, !dgram);
- if (error == 0)
+ if (error == 0) {
sa = (struct sockaddr *)&ss;
+ }
}
- if (error != 0)
+ if (error != 0) {
goto out;
+ }
error = connectit(so, sa);
- if (sa != NULL && sa != SA(&ss))
+ if (sa != NULL && sa != SA(&ss)) {
FREE(sa, M_SONAME);
- if (error == ERESTART)
+ }
+ if (error == ERESTART) {
error = EINTR;
+ }
out:
file_drop(fd);
- return (error);
+ return error;
}
static int
AUDIT_ARG(fd, uap->socket);
error = file_socket(fd, &so);
- if (error != 0)
- return (error);
+ if (error != 0) {
+ return error;
+ }
if (so == NULL) {
error = EBADF;
goto out;
if (IS_64BIT_PROCESS(p)) {
error = copyin(uap->endpoints, (caddr_t)&ep64, sizeof(ep64));
- if (error != 0)
+ if (error != 0) {
goto out;
+ }
ep.sae_srcif = ep64.sae_srcif;
- ep.sae_srcaddr = ep64.sae_srcaddr;
+ ep.sae_srcaddr = (user_addr_t)ep64.sae_srcaddr;
ep.sae_srcaddrlen = ep64.sae_srcaddrlen;
- ep.sae_dstaddr = ep64.sae_dstaddr;
+ ep.sae_dstaddr = (user_addr_t)ep64.sae_dstaddr;
ep.sae_dstaddrlen = ep64.sae_dstaddrlen;
} else {
error = copyin(uap->endpoints, (caddr_t)&ep32, sizeof(ep32));
- if (error != 0)
+ if (error != 0) {
goto out;
+ }
ep.sae_srcif = ep32.sae_srcif;
ep.sae_srcaddr = ep32.sae_srcaddr;
/* Get socket address now before we obtain socket lock */
if (ep.sae_srcaddr != USER_ADDR_NULL) {
- if (ep.sae_srcaddrlen > sizeof (ss)) {
+ if (ep.sae_srcaddrlen > sizeof(ss)) {
error = getsockaddr(so, &src, ep.sae_srcaddr, ep.sae_srcaddrlen, dgram);
} else {
error = getsockaddr_s(so, &ss, ep.sae_srcaddr, ep.sae_srcaddrlen, dgram);
- if (error == 0)
+ if (error == 0) {
src = (struct sockaddr *)&ss;
+ }
}
- if (error)
+ if (error) {
goto out;
+ }
}
if (ep.sae_dstaddr == USER_ADDR_NULL) {
}
/* Get socket address now before we obtain socket lock */
- if (ep.sae_dstaddrlen > sizeof (sd)) {
+ if (ep.sae_dstaddrlen > sizeof(sd)) {
error = getsockaddr(so, &dst, ep.sae_dstaddr, ep.sae_dstaddrlen, dgram);
} else {
error = getsockaddr_s(so, &sd, ep.sae_dstaddr, ep.sae_dstaddrlen, dgram);
- if (error == 0)
+ if (error == 0) {
dst = (struct sockaddr *)&sd;
+ }
}
- if (error)
+ if (error) {
goto out;
+ }
VERIFY(dst != NULL);
if (uap->iov != USER_ADDR_NULL) {
/* Verify range before calling uio_create() */
- if (uap->iovcnt <= 0 || uap->iovcnt > UIO_MAXIOV)
- return (EINVAL);
+ if (uap->iovcnt <= 0 || uap->iovcnt > UIO_MAXIOV) {
+ error = EINVAL;
+ goto out;
+ }
- if (uap->len == USER_ADDR_NULL)
- return (EINVAL);
+ if (uap->len == USER_ADDR_NULL) {
+ error = EINVAL;
+ goto out;
+ }
/* allocate a uio to hold the number of iovecs passed */
auio = uio_create(uap->iovcnt, 0,
goto out;
}
error = copyin_user_iovec_array(uap->iov,
- IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
- uap->iovcnt, iovp);
- if (error != 0)
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ uap->iovcnt, iovp);
+ if (error != 0) {
goto out;
+ }
/* finish setup of uio_t */
error = uio_calculateresid(auio);
error = connectitx(so, src, dst, p, ep.sae_srcif, uap->associd,
&cid, auio, uap->flags, &bytes_written);
- if (error == ERESTART)
+ if (error == ERESTART) {
error = EINTR;
+ }
if (uap->len != USER_ADDR_NULL) {
- error1 = copyout(&bytes_written, uap->len, sizeof (uap->len));
+ error1 = copyout(&bytes_written, uap->len, sizeof(uap->len));
/* give precedence to connectitx errors */
- if ((error1 != 0) && (error == 0))
+ if ((error1 != 0) && (error == 0)) {
error = error1;
+ }
}
if (uap->connid != USER_ADDR_NULL) {
- error1 = copyout(&cid, uap->connid, sizeof (cid));
+ error1 = copyout(&cid, uap->connid, sizeof(cid));
/* give precedence to connectitx errors */
- if ((error1 != 0) && (error == 0))
+ if ((error1 != 0) && (error == 0)) {
error = error1;
+ }
}
out:
file_drop(fd);
if (auio != NULL) {
uio_free(auio);
}
- if (src != NULL && src != SA(&ss))
+ if (src != NULL && src != SA(&ss)) {
FREE(src, M_SONAME);
- if (dst != NULL && dst != SA(&sd))
+ }
+ if (dst != NULL && dst != SA(&sd)) {
FREE(dst, M_SONAME);
- return (error);
+ }
+ return error;
}
int
* an unofficial cancellation point.
*/
__pthread_testcancel(1);
- return (connectx_nocancel(p, uap, retval));
+ return connectx_nocancel(p, uap, retval);
}
static int
AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), sa);
#if CONFIG_MACF_SOCKET_SUBSET
- if ((error = mac_socket_check_connect(kauth_cred_get(), so, sa)) != 0)
- return (error);
+ if ((error = mac_socket_check_connect(kauth_cred_get(), so, sa)) != 0) {
+ return error;
+ }
#endif /* MAC_SOCKET_SUBSET */
socket_lock(so, 1);
}
error = soconnectlock(so, sa, 0);
if (error != 0) {
- so->so_state &= ~SS_ISCONNECTING;
goto out;
}
if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) {
while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
lck_mtx_t *mutex_held;
- if (so->so_proto->pr_getlock != NULL)
+ if (so->so_proto->pr_getlock != NULL) {
mutex_held = (*so->so_proto->pr_getlock)(so, PR_F_WILLUNLOCK);
- else
+ } else {
mutex_held = so->so_proto->pr_domain->dom_mtx;
+ }
error = msleep((caddr_t)&so->so_timeo, mutex_held,
PSOCK | PCATCH, __func__, 0);
if (so->so_state & SS_DRAINING) {
error = ECONNABORTED;
}
- if (error != 0)
+ if (error != 0) {
break;
+ }
}
if (error == 0) {
error = so->so_error;
}
out:
socket_unlock(so, 1);
- return (error);
+ return error;
}
static int
user_ssize_t *bytes_written)
{
int error;
-#pragma unused (flags)
VERIFY(dst != NULL);
AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), dst);
#if CONFIG_MACF_SOCKET_SUBSET
- if ((error = mac_socket_check_connect(kauth_cred_get(), so, dst)) != 0)
- return (error);
+ if ((error = mac_socket_check_connect(kauth_cred_get(), so, dst)) != 0) {
+ return error;
+ }
+
+ if (auio != NULL) {
+ if ((error = mac_socket_check_send(kauth_cred_get(), so, dst)) != 0) {
+ return error;
+ }
+ }
#endif /* MAC_SOCKET_SUBSET */
socket_lock(so, 1);
goto out;
}
- if ((so->so_proto->pr_flags & PR_DATA_IDEMPOTENT) &&
- (flags & CONNECT_DATA_IDEMPOTENT)) {
- so->so_flags1 |= SOF1_DATA_IDEMPOTENT;
-
- if (flags & CONNECT_DATA_AUTHENTICATED)
- so->so_flags1 |= SOF1_DATA_AUTHENTICATED;
- }
-
- /*
- * Case 1: CONNECT_RESUME_ON_READ_WRITE set, no data.
- * Case 2: CONNECT_RESUME_ON_READ_WRITE set, with data (user error)
- * Case 3: CONNECT_RESUME_ON_READ_WRITE not set, with data
- * Case 3 allows user to combine write with connect even if they have
- * no use for TFO (such as regular TCP, and UDP).
- * Case 4: CONNECT_RESUME_ON_READ_WRITE not set, no data (regular case)
- */
- if ((so->so_proto->pr_flags & PR_PRECONN_WRITE) &&
- ((flags & CONNECT_RESUME_ON_READ_WRITE) || auio))
- so->so_flags1 |= SOF1_PRECONNECT_DATA;
-
- /*
- * If a user sets data idempotent and does not pass an uio, or
- * sets CONNECT_RESUME_ON_READ_WRITE, this is an error, reset
- * SOF1_DATA_IDEMPOTENT.
- */
- if (!(so->so_flags1 & SOF1_PRECONNECT_DATA) &&
- (so->so_flags1 & SOF1_DATA_IDEMPOTENT)) {
- /* We should return EINVAL instead perhaps. */
- so->so_flags1 &= ~SOF1_DATA_IDEMPOTENT;
- }
-
error = soconnectxlocked(so, src, dst, p, ifscope,
- aid, pcid, 0, NULL, 0, auio, bytes_written);
+ aid, pcid, flags, NULL, 0, auio, bytes_written);
if (error != 0) {
- so->so_state &= ~SS_ISCONNECTING;
goto out;
}
/*
while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
lck_mtx_t *mutex_held;
- if (so->so_proto->pr_getlock != NULL)
+ if (so->so_proto->pr_getlock != NULL) {
mutex_held = (*so->so_proto->pr_getlock)(so, PR_F_WILLUNLOCK);
- else
+ } else {
mutex_held = so->so_proto->pr_domain->dom_mtx;
+ }
error = msleep((caddr_t)&so->so_timeo, mutex_held,
PSOCK | PCATCH, __func__, 0);
if (so->so_state & SS_DRAINING) {
error = ECONNABORTED;
}
- if (error != 0)
+ if (error != 0) {
break;
+ }
}
if (error == 0) {
error = so->so_error;
}
out:
socket_unlock(so, 1);
- return (error);
+ return error;
}
int
* an unofficial cancellation point.
*/
__pthread_testcancel(1);
- return (0);
+ return 0;
}
int
* an unofficial cancellation point.
*/
__pthread_testcancel(1);
- return (disconnectx_nocancel(p, uap, retval));
+ return disconnectx_nocancel(p, uap, retval);
}
static int
int error;
error = file_socket(fd, &so);
- if (error != 0)
- return (error);
+ if (error != 0) {
+ return error;
+ }
if (so == NULL) {
error = EBADF;
goto out;
error = sodisconnectx(so, uap->aid, uap->cid);
out:
file_drop(fd);
- return (error);
+ return error;
}
/*
AUDIT_ARG(socket, uap->domain, uap->type, uap->protocol);
error = socreate(uap->domain, &so1, uap->type, uap->protocol);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
error = socreate(uap->domain, &so2, uap->type, uap->protocol);
- if (error)
+ if (error) {
goto free1;
+ }
error = falloc(p, &fp1, &fd, vfs_context_current());
if (error) {
goto free2;
}
- fp1->f_flag = FREAD|FWRITE;
+ fp1->f_flag = FREAD | FWRITE;
fp1->f_ops = &socketops;
fp1->f_data = (caddr_t)so1;
sv[0] = fd;
if (error) {
goto free3;
}
- fp2->f_flag = FREAD|FWRITE;
+ fp2->f_flag = FREAD | FWRITE;
fp2->f_ops = &socketops;
fp2->f_data = (caddr_t)so2;
sv[1] = fd;
}
}
- if ((error = copyout(sv, uap->rsv, 2 * sizeof (int))) != 0)
+ if ((error = copyout(sv, uap->rsv, 2 * sizeof(int))) != 0) {
goto free4;
+ }
proc_fdlock(p);
procfdtbl_releasefd(p, sv[0], NULL);
fp_drop(p, sv[1], fp2, 1);
proc_fdunlock(p);
- return (0);
+ return 0;
free4:
fp_free(p, sv[1], fp2);
free3:
(void) soclose(so2);
free1:
(void) soclose(so1);
- return (error);
+ return error;
}
/*
KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
if (mp->msg_name != USER_ADDR_NULL) {
- if (mp->msg_namelen > sizeof (ss)) {
+ if (mp->msg_namelen > sizeof(ss)) {
error = getsockaddr(so, &to, mp->msg_name,
mp->msg_namelen, TRUE);
} else {
want_free = FALSE;
}
}
- if (error != 0)
+ if (error != 0) {
goto out;
+ }
AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), to);
}
if (mp->msg_control != USER_ADDR_NULL) {
- if (mp->msg_controllen < sizeof (struct cmsghdr)) {
+ if (mp->msg_controllen < sizeof(struct cmsghdr)) {
error = EINVAL;
goto bad;
}
error = sockargs(&control, mp->msg_control,
mp->msg_controllen, MT_CONTROL);
- if (error != 0)
+ if (error != 0) {
goto bad;
+ }
}
#if CONFIG_MACF_SOCKET_SUBSET
*/
if (to != NULL &&
!(so->so_state & SS_DEFUNCT) &&
- (error = mac_socket_check_send(kauth_cred_get(), so, to)) != 0)
+ (error = mac_socket_check_send(kauth_cred_get(), so, to)) != 0) {
goto bad;
+ }
#endif /* MAC_SOCKET_SUBSET */
len = uio_resid(uiop);
error = so->so_proto->pr_usrreqs->pru_sosend(so, to, uiop, 0,
- control, flags);
+ control, flags);
if (error != 0) {
if (uio_resid(uiop) != len && (error == ERESTART ||
- error == EINTR || error == EWOULDBLOCK))
+ error == EINTR || error == EWOULDBLOCK)) {
error = 0;
+ }
/* Generation of SIGPIPE can be controlled per socket */
- if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE))
+ if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE) &&
+ !(flags & MSG_NOSIGNAL)) {
psignal(p, SIGPIPE);
+ }
}
- if (error == 0)
+ if (error == 0) {
*retval = (int)(len - uio_resid(uiop));
+ }
bad:
- if (to != NULL && want_free)
+ if (want_free) {
FREE(to, M_SONAME);
+ }
out:
KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
/*
sendto(struct proc *p, struct sendto_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (sendto_nocancel(p, (struct sendto_nocancel_args *)uap, retval));
+ return sendto_nocancel(p, (struct sendto_nocancel_args *)uap, retval);
}
int
sendto_nocancel(struct proc *p,
- struct sendto_nocancel_args *uap,
- int32_t *retval)
+ struct sendto_nocancel_args *uap,
+ int32_t *retval)
{
struct user_msghdr msg;
int error;
KERNEL_DEBUG(DBG_FNC_SENDTO | DBG_FUNC_START, 0, 0, 0, 0, 0);
AUDIT_ARG(fd, uap->s);
+ if (uap->flags & MSG_SKIPCFIL) {
+ error = EPERM;
+ goto done;
+ }
+
+ if (uap->len > LONG_MAX) {
+ error = EINVAL;
+ goto done;
+ }
+
auio = uio_create(1, 0,
(IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
UIO_WRITE);
msg.msg_flags = 0;
error = file_socket(uap->s, &so);
- if (error)
+ if (error) {
goto done;
+ }
if (so == NULL) {
error = EBADF;
file_drop(uap->s);
done:
- if (auio != NULL)
+ if (auio != NULL) {
uio_free(auio);
+ }
KERNEL_DEBUG(DBG_FNC_SENDTO | DBG_FUNC_END, error, *retval, 0, 0, 0);
- return (error);
+ return error;
}
/*
sendmsg(struct proc *p, struct sendmsg_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (sendmsg_nocancel(p, (struct sendmsg_nocancel_args *)uap,
- retval));
+ return sendmsg_nocancel(p, (struct sendmsg_nocancel_args *)uap,
+ retval);
}
int
struct user64_msghdr msg64;
struct user_msghdr user_msg;
caddr_t msghdrp;
- int size_of_msghdr;
+ int size_of_msghdr;
int error;
uio_t auio = NULL;
struct user_iovec *iovp;
KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_START, 0, 0, 0, 0, 0);
AUDIT_ARG(fd, uap->s);
+
+ if (uap->flags & MSG_SKIPCFIL) {
+ error = EPERM;
+ goto done;
+ }
+
if (IS_64BIT_PROCESS(p)) {
msghdrp = (caddr_t)&msg64;
- size_of_msghdr = sizeof (msg64);
+ size_of_msghdr = sizeof(msg64);
} else {
msghdrp = (caddr_t)&msg32;
- size_of_msghdr = sizeof (msg32);
+ size_of_msghdr = sizeof(msg32);
}
error = copyin(uap->msg, msghdrp, size_of_msghdr);
if (error) {
KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
if (IS_64BIT_PROCESS(p)) {
user_msg.msg_flags = msg64.msg_flags;
user_msg.msg_controllen = msg64.msg_controllen;
- user_msg.msg_control = msg64.msg_control;
+ user_msg.msg_control = (user_addr_t)msg64.msg_control;
user_msg.msg_iovlen = msg64.msg_iovlen;
- user_msg.msg_iov = msg64.msg_iov;
+ user_msg.msg_iov = (user_addr_t)msg64.msg_iov;
user_msg.msg_namelen = msg64.msg_namelen;
- user_msg.msg_name = msg64.msg_name;
+ user_msg.msg_name = (user_addr_t)msg64.msg_name;
} else {
user_msg.msg_flags = msg32.msg_flags;
user_msg.msg_controllen = msg32.msg_controllen;
if (user_msg.msg_iovlen <= 0 || user_msg.msg_iovlen > UIO_MAXIOV) {
KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_END, EMSGSIZE,
0, 0, 0, 0);
- return (EMSGSIZE);
+ return EMSGSIZE;
}
/* allocate a uio large enough to hold the number of iovecs passed */
goto done;
}
error = copyin_user_iovec_array(user_msg.msg_iov,
- IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
- user_msg.msg_iovlen, iovp);
- if (error)
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ user_msg.msg_iovlen, iovp);
+ if (error) {
goto done;
+ }
user_msg.msg_iov = CAST_USER_ADDR_T(iovp);
/* finish setup of uio_t */
}
KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
int
KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
+ size_of_msghdr = IS_64BIT_PROCESS(p) ?
+ sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
+
+ if (uap->flags & MSG_SKIPCFIL) {
+ error = EPERM;
+ goto out;
+ }
+
error = file_socket(uap->s, &so);
if (error) {
goto out;
/*
* Clip to max currently allowed
*/
- if (uap->cnt > somaxsendmsgx)
+ if (uap->cnt > somaxsendmsgx) {
uap->cnt = somaxsendmsgx;
+ }
- user_msg_x = _MALLOC(uap->cnt * sizeof(struct user_msghdr_x),
- M_TEMP, M_WAITOK | M_ZERO);
+ user_msg_x = kheap_alloc(KHEAP_TEMP,
+ uap->cnt * sizeof(struct user_msghdr_x), Z_WAITOK | Z_ZERO);
if (user_msg_x == NULL) {
- DBG_PRINTF("%s _MALLOC() user_msg_x failed\n", __func__);
+ DBG_PRINTF("%s kheap_alloc user_msg_x failed\n", __func__);
error = ENOMEM;
goto out;
}
- uiop = _MALLOC(uap->cnt * sizeof(struct uio *),
- M_TEMP, M_WAITOK | M_ZERO);
+ uiop = kheap_alloc(KHEAP_TEMP,
+ uap->cnt * sizeof(struct uio *), Z_WAITOK | Z_ZERO);
if (uiop == NULL) {
- DBG_PRINTF("%s _MALLOC() uiop failed\n", __func__);
+ DBG_PRINTF("%s kheap_alloc uiop failed\n", __func__);
error = ENOMEM;
goto out;
}
- size_of_msghdr = IS_64BIT_PROCESS(p) ?
- sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
-
- umsgp = _MALLOC(uap->cnt * size_of_msghdr,
- M_TEMP, M_WAITOK | M_ZERO);
+ umsgp = kheap_alloc(KHEAP_TEMP,
+ uap->cnt * size_of_msghdr, Z_WAITOK | Z_ZERO);
if (umsgp == NULL) {
- printf("%s _MALLOC() user_msg_x failed\n", __func__);
+ printf("%s kheap_alloc user_msg_x failed\n", __func__);
error = ENOMEM;
goto out;
}
goto out;
}
error = internalize_user_msghdr_array(umsgp,
- IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
- UIO_WRITE, uap->cnt, user_msg_x, uiop);
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ UIO_WRITE, uap->cnt, user_msg_x, uiop);
if (error) {
DBG_PRINTF("%s copyin_user_msghdr_array() failed\n", __func__);
goto out;
* Make sure the size of each message iovec and
* the aggregate size of all the iovec is valid
*/
- if (uio_array_is_valid(uiop, uap->cnt) == 0) {
+ if (uio_array_is_valid(uiop, uap->cnt) == false) {
error = EINVAL;
goto out;
}
/*
* No support for address or ancillary data (yet)
*/
- if (mp->msg_name != USER_ADDR_NULL || mp->msg_namelen != 0)
+ if (mp->msg_name != USER_ADDR_NULL || mp->msg_namelen != 0) {
has_addr_or_ctl = 1;
+ }
if (mp->msg_control != USER_ADDR_NULL ||
- mp->msg_controllen != 0)
+ mp->msg_controllen != 0) {
has_addr_or_ctl = 1;
+ }
#if CONFIG_MACF_SOCKET_SUBSET
/*
if (to != NULL &&
!(so->so_state & SS_DEFUNCT) &&
(error = mac_socket_check_send(kauth_cred_get(), so, to))
- != 0)
+ != 0) {
goto out;
+ }
#endif /* MAC_SOCKET_SUBSET */
}
error = sendit(p, so, &user_msg, auio, uap->flags,
&tmpval);
- if (error != 0)
+ if (error != 0) {
break;
+ }
}
}
len_after = uio_array_resid(uiop, uap->cnt);
if (error != 0) {
if (len_after != len_before && (error == ERESTART ||
error == EINTR || error == EWOULDBLOCK ||
- error == ENOBUFS))
+ error == ENOBUFS)) {
error = 0;
+ }
/* Generation of SIGPIPE can be controlled per socket */
- if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE))
+ if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE) &&
+ !(uap->flags & MSG_NOSIGNAL)) {
psignal(p, SIGPIPE);
+ }
}
if (error == 0) {
uiocnt = externalize_user_msghdr_array(umsgp,
*retval = (int)(uiocnt);
}
out:
- if (need_drop)
+ if (need_drop) {
file_drop(uap->s);
- if (umsgp != NULL)
- _FREE(umsgp, M_TEMP);
+ }
+ kheap_free(KHEAP_TEMP, umsgp, uap->cnt * size_of_msghdr);
if (uiop != NULL) {
free_uio_array(uiop, uap->cnt);
- _FREE(uiop, M_TEMP);
+ kheap_free(KHEAP_TEMP, uiop,
+ uap->cnt * sizeof(struct uio *));
}
- if (user_msg_x != NULL)
- _FREE(user_msg_x, M_TEMP);
+ kheap_free(KHEAP_TEMP, user_msg_x,
+ uap->cnt * sizeof(struct user_msghdr_x));
KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
len = 0;
} else {
#ifndef MIN
-#define MIN(a, b) ((a) > (b) ? (b) : (a))
+#define MIN(a, b) ((a) > (b) ? (b) : (a))
#endif
sa_len = fromsa->sa_len;
len = MIN((unsigned int)len, sa_len);
error = copyout(fromsa, name, (unsigned)len);
- if (error)
+ if (error) {
goto out;
+ }
}
*namelen = sa_len;
out:
- return (0);
+ return 0;
}
static int
copyout_control(struct proc *p, struct mbuf *m, user_addr_t control,
- socklen_t *controllen, int *flags)
+ socklen_t *controllen, int *flags, struct socket *so)
{
int error = 0;
- ssize_t len;
+ socklen_t len;
user_addr_t ctlbuf;
+ struct inpcb *inp = so ? sotoinpcb(so) : NULL;
len = *controllen;
*controllen = 0;
ctlbuf = control;
while (m && len > 0) {
- unsigned int tocopy;
+ socklen_t tocopy;
struct cmsghdr *cp = mtod(m, struct cmsghdr *);
- int cp_size = CMSG_ALIGN(cp->cmsg_len);
- int buflen = m->m_len;
+ socklen_t cp_size = CMSG_ALIGN(cp->cmsg_len);
+ socklen_t buflen = m->m_len;
while (buflen > 0 && len > 0) {
/*
* different size for 32 bits and 64 bits processes
*/
if (cp->cmsg_level == SOL_SOCKET && cp->cmsg_type == SCM_TIMESTAMP) {
- unsigned char tmp_buffer[CMSG_SPACE(sizeof(struct user64_timeval))];
+ unsigned char tmp_buffer[CMSG_SPACE(sizeof(struct user64_timeval))] = {};
struct cmsghdr *tmp_cp = (struct cmsghdr *)(void *)tmp_buffer;
- int tmp_space;
+ socklen_t tmp_space;
struct timeval *tv = (struct timeval *)(void *)CMSG_DATA(cp);
tmp_cp->cmsg_level = SOL_SOCKET;
if (proc_is64bit(p)) {
struct user64_timeval *tv64 = (struct user64_timeval *)(void *)CMSG_DATA(tmp_cp);
- tv64->tv_sec = tv->tv_sec;
- tv64->tv_usec = tv->tv_usec;
+ os_unaligned_deref(&tv64->tv_sec) = tv->tv_sec;
+ os_unaligned_deref(&tv64->tv_usec) = tv->tv_usec;
tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user64_timeval));
tmp_space = CMSG_SPACE(sizeof(struct user64_timeval));
} else {
struct user32_timeval *tv32 = (struct user32_timeval *)(void *)CMSG_DATA(tmp_cp);
- tv32->tv_sec = tv->tv_sec;
+ tv32->tv_sec = (user32_time_t)tv->tv_sec;
tv32->tv_usec = tv->tv_usec;
tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user32_timeval));
tocopy = len;
}
error = copyout(tmp_buffer, ctlbuf, tocopy);
- if (error)
+ if (error) {
goto out;
- } else {
- if (cp_size > buflen) {
- panic("cp_size > buflen, something"
- "wrong with alignment!");
}
- if (len >= cp_size) {
- tocopy = cp_size;
- } else {
- *flags |= MSG_CTRUNC;
- tocopy = len;
+ } else {
+#if CONTENT_FILTER
+ /* If socket is attached to Content Filter and socket did not request address, ignore it */
+ if ((so != NULL) && (so->so_cfil_db != NULL) &&
+ ((cp->cmsg_level == IPPROTO_IP && cp->cmsg_type == IP_RECVDSTADDR && inp &&
+ !(inp->inp_flags & INP_RECVDSTADDR)) ||
+ (cp->cmsg_level == IPPROTO_IPV6 && (cp->cmsg_type == IPV6_PKTINFO || cp->cmsg_type == IPV6_2292PKTINFO) && inp &&
+ !(inp->inp_flags & IN6P_PKTINFO)))) {
+ tocopy = 0;
+ } else
+#endif
+ {
+ if (cp_size > buflen) {
+ panic("cp_size > buflen, something"
+ "wrong with alignment!");
+ }
+ if (len >= cp_size) {
+ tocopy = cp_size;
+ } else {
+ *flags |= MSG_CTRUNC;
+ tocopy = len;
+ }
+ error = copyout((caddr_t) cp, ctlbuf, tocopy);
+ if (error) {
+ goto out;
+ }
}
- error = copyout((caddr_t) cp, ctlbuf, tocopy);
- if (error)
- goto out;
}
ctlbuf += tocopy;
m = m->m_next;
}
- *controllen = ctlbuf - control;
+ *controllen = (socklen_t)(ctlbuf - control);
out:
- return (error);
+ return error;
}
/*
struct fileproc *fp;
KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
- proc_fdlock(p);
- if ((error = fp_lookup(p, s, &fp, 1))) {
+ if ((error = fp_get_ftype(p, s, DTYPE_SOCKET, ENOTSOCK, &fp))) {
KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, error, 0, 0, 0, 0);
- proc_fdunlock(p);
- return (error);
- }
- if (fp->f_type != DTYPE_SOCKET) {
- fp_drop(p, s, fp, 1);
- proc_fdunlock(p);
- return (ENOTSOCK);
- }
-
- so = (struct socket *)fp->f_data;
- if (so == NULL) {
- fp_drop(p, s, fp, 1);
- proc_fdunlock(p);
- return (EBADF);
+ return error;
}
-
- proc_fdunlock(p);
+ so = fp->f_data;
#if CONFIG_MACF_SOCKET_SUBSET
/*
if (!(so->so_state & SS_DEFUNCT) &&
!(so->so_state & SS_ISCONNECTED) &&
!(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
- (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0)
+ (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0) {
goto out1;
+ }
#endif /* MAC_SOCKET_SUBSET */
- if (uio_resid(uiop) < 0) {
+ if (uio_resid(uiop) < 0 || uio_resid(uiop) > INT_MAX) {
KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, EINVAL, 0, 0, 0, 0);
error = EINVAL;
goto out1;
error = so->so_proto->pr_usrreqs->pru_soreceive(so, &fromsa, uiop,
(struct mbuf **)0, mp->msg_control ? &control : (struct mbuf **)0,
&mp->msg_flags);
- if (fromsa)
+ if (fromsa) {
AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()),
fromsa);
+ }
if (error) {
if (uio_resid(uiop) != len && (error == ERESTART ||
- error == EINTR || error == EWOULDBLOCK))
+ error == EINTR || error == EWOULDBLOCK)) {
error = 0;
+ }
}
- if (error)
+ if (error) {
goto out;
+ }
- *retval = len - uio_resid(uiop);
+ *retval = (int32_t)(len - uio_resid(uiop));
if (mp->msg_name) {
error = copyout_sa(fromsa, mp->msg_name, &mp->msg_namelen);
- if (error)
+ if (error) {
goto out;
+ }
/* return the actual, untruncated address length */
if (namelenp &&
(error = copyout((caddr_t)&mp->msg_namelen, namelenp,
- sizeof (int)))) {
+ sizeof(int)))) {
goto out;
}
}
if (mp->msg_control) {
error = copyout_control(p, control, mp->msg_control,
- &mp->msg_controllen, &mp->msg_flags);
+ &mp->msg_controllen, &mp->msg_flags, so);
}
out:
- if (fromsa)
- FREE(fromsa, M_SONAME);
- if (control)
+ FREE(fromsa, M_SONAME);
+ if (control) {
m_freem(control);
+ }
KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, error, 0, 0, 0, 0);
out1:
fp_drop(p, s, fp, 0);
- return (error);
+ return error;
}
/*
recvfrom(struct proc *p, struct recvfrom_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (recvfrom_nocancel(p, (struct recvfrom_nocancel_args *)uap,
- retval));
+ return recvfrom_nocancel(p, (struct recvfrom_nocancel_args *)uap,
+ retval);
}
int
if (uap->fromlenaddr) {
error = copyin(uap->fromlenaddr,
- (caddr_t)&msg.msg_namelen, sizeof (msg.msg_namelen));
- if (error)
- return (error);
+ (caddr_t)&msg.msg_namelen, sizeof(msg.msg_namelen));
+ if (error) {
+ return error;
+ }
} else {
msg.msg_namelen = 0;
}
(IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
UIO_READ);
if (auio == NULL) {
- return (ENOMEM);
+ return ENOMEM;
}
uio_addiov(auio, uap->buf, uap->len);
KERNEL_DEBUG(DBG_FNC_RECVFROM | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
/*
recvmsg(struct proc *p, struct recvmsg_args *uap, int32_t *retval)
{
__pthread_testcancel(1);
- return (recvmsg_nocancel(p, (struct recvmsg_nocancel_args *)uap,
- retval));
+ return recvmsg_nocancel(p, (struct recvmsg_nocancel_args *)uap,
+ retval);
}
int
struct user64_msghdr msg64;
struct user_msghdr user_msg;
caddr_t msghdrp;
- int size_of_msghdr;
+ int size_of_msghdr;
user_addr_t uiov;
int error;
uio_t auio = NULL;
AUDIT_ARG(fd, uap->s);
if (IS_64BIT_PROCESS(p)) {
msghdrp = (caddr_t)&msg64;
- size_of_msghdr = sizeof (msg64);
+ size_of_msghdr = sizeof(msg64);
} else {
msghdrp = (caddr_t)&msg32;
- size_of_msghdr = sizeof (msg32);
+ size_of_msghdr = sizeof(msg32);
}
error = copyin(uap->msg, msghdrp, size_of_msghdr);
if (error) {
KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
/* only need to copy if user process is not 64-bit */
if (IS_64BIT_PROCESS(p)) {
user_msg.msg_flags = msg64.msg_flags;
user_msg.msg_controllen = msg64.msg_controllen;
- user_msg.msg_control = msg64.msg_control;
+ user_msg.msg_control = (user_addr_t)msg64.msg_control;
user_msg.msg_iovlen = msg64.msg_iovlen;
- user_msg.msg_iov = msg64.msg_iov;
+ user_msg.msg_iov = (user_addr_t)msg64.msg_iov;
user_msg.msg_namelen = msg64.msg_namelen;
- user_msg.msg_name = msg64.msg_name;
+ user_msg.msg_name = (user_addr_t)msg64.msg_name;
} else {
user_msg.msg_flags = msg32.msg_flags;
user_msg.msg_controllen = msg32.msg_controllen;
if (user_msg.msg_iovlen <= 0 || user_msg.msg_iovlen > UIO_MAXIOV) {
KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_END, EMSGSIZE,
0, 0, 0, 0);
- return (EMSGSIZE);
+ return EMSGSIZE;
}
user_msg.msg_flags = uap->flags;
uiov = user_msg.msg_iov;
user_msg.msg_iov = CAST_USER_ADDR_T(iovp);
error = copyin_user_iovec_array(uiov,
- IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
- user_msg.msg_iovlen, iovp);
- if (error)
+ IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
+ user_msg.msg_iovlen, iovp);
+ if (error) {
goto done;
+ }
/* finish setup of uio_t */
error = uio_calculateresid(auio);
} else {
msg32.msg_flags = user_msg.msg_flags;
msg32.msg_controllen = user_msg.msg_controllen;
- msg32.msg_control = user_msg.msg_control;
+ msg32.msg_control = (user32_addr_t)user_msg.msg_control;
msg32.msg_iovlen = user_msg.msg_iovlen;
- msg32.msg_iov = user_msg.msg_iov;
+ msg32.msg_iov = (user32_addr_t)user_msg.msg_iov;
msg32.msg_namelen = user_msg.msg_namelen;
- msg32.msg_name = user_msg.msg_name;
+ msg32.msg_name = (user32_addr_t)user_msg.msg_name;
}
error = copyout(msghdrp, uap->msg, size_of_msghdr);
}
uio_free(auio);
}
KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
int
KERNEL_DEBUG(DBG_FNC_RECVMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
+ size_of_msghdr = IS_64BIT_PROCESS(p) ?
+ sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
+
error = file_socket(uap->s, &so);
if (error) {
goto out;
error = EBADF;
goto out;
}
+ /*
+ * Support only a subset of message flags
+ */
+ if (uap->flags & ~(MSG_PEEK | MSG_WAITALL | MSG_DONTWAIT | MSG_NEEDSA | MSG_NBIO)) {
+ return EOPNOTSUPP;
+ }
/*
* Input parameter range check
*/
error = EINVAL;
goto out;
}
- if (uap->cnt > somaxrecvmsgx)
+ if (uap->cnt > somaxrecvmsgx) {
uap->cnt = somaxrecvmsgx;
+ }
- user_msg_x = _MALLOC(uap->cnt * sizeof(struct user_msghdr_x),
- M_TEMP, M_WAITOK | M_ZERO);
+ user_msg_x = kheap_alloc(KHEAP_TEMP,
+ uap->cnt * sizeof(struct user_msghdr_x), Z_WAITOK | Z_ZERO);
if (user_msg_x == NULL) {
- DBG_PRINTF("%s _MALLOC() user_msg_x failed\n", __func__);
+ DBG_PRINTF("%s kheap_alloc user_msg_x failed\n", __func__);
error = ENOMEM;
goto out;
}
error = ENOMEM;
goto out;
}
- size_of_msghdr = IS_64BIT_PROCESS(p) ?
- sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
- umsgp = _MALLOC(uap->cnt * size_of_msghdr, M_TEMP, M_WAITOK | M_ZERO);
+ umsgp = kheap_alloc(KHEAP_TEMP,
+ uap->cnt * size_of_msghdr, Z_WAITOK | Z_ZERO);
if (umsgp == NULL) {
- DBG_PRINTF("%s _MALLOC() umsgp failed\n", __func__);
+ DBG_PRINTF("%s kheap_alloc umsgp failed\n", __func__);
error = ENOMEM;
goto out;
}
if (!(so->so_state & SS_DEFUNCT) &&
!(so->so_state & SS_ISCONNECTED) &&
!(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
- (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0)
+ (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0) {
goto out;
+ }
#endif /* MAC_SOCKET_SUBSET */
len_before = recv_msg_array_resid(recv_msg_array, uap->cnt);
/*
* Do not block if we got at least one packet
*/
- if (i > 0)
+ if (i > 0) {
flags |= MSG_DONTWAIT;
+ }
psa = (recv_msg_elem->which & SOCK_MSG_SA) ?
&recv_msg_elem->psa : NULL;
&recv_msg_elem->controlp : NULL;
error = so->so_proto->pr_usrreqs->pru_soreceive(so, psa,
- auio, (struct mbuf **)0, controlp, &flags);
- if (error)
+ auio, (struct mbuf **)NULL, controlp, &flags);
+ if (error) {
break;
+ }
/*
* We have some data
*/
recv_msg_elem->which |= SOCK_MSG_DATA;
+ /*
+ * Set the messages flags for this packet
+ */
+ flags &= ~MSG_DONTWAIT;
+ recv_msg_elem->flags = flags;
/*
* Stop on partial copy
*/
- if (flags & (MSG_RCVMORE | MSG_TRUNC))
+ if (recv_msg_elem->flags & (MSG_RCVMORE | MSG_TRUNC)) {
break;
+ }
}
- if ((uap->flags & MSG_DONTWAIT) == 0)
- flags &= ~MSG_DONTWAIT;
- uap->flags = flags;
}
len_after = recv_msg_array_resid(recv_msg_array, uap->cnt);
if (error) {
if (len_after != len_before && (error == ERESTART ||
- error == EINTR || error == EWOULDBLOCK))
+ error == EINTR || error == EWOULDBLOCK)) {
error = 0;
- else
+ } else {
goto out;
+ }
}
- uiocnt = externalize_recv_msghdr_array(umsgp,
- IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
- UIO_READ, uap->cnt, user_msg_x, recv_msg_array);
+ uiocnt = externalize_recv_msghdr_array(p, so, umsgp,
+ uap->cnt, user_msg_x, recv_msg_array, &error);
+ if (error != 0) {
+ goto out;
+ }
error = copyout(umsgp, uap->msgp, uap->cnt * size_of_msghdr);
if (error) {
}
*retval = (int)(uiocnt);
- for (i = 0; i < uap->cnt; i++) {
- struct user_msghdr_x *mp = user_msg_x + i;
- struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
- struct sockaddr *fromsa = recv_msg_elem->psa;
-
- if (mp->msg_name) {
- error = copyout_sa(fromsa, mp->msg_name,
- &mp->msg_namelen);
- if (error)
- goto out;
- }
- if (mp->msg_control) {
- error = copyout_control(p, recv_msg_elem->controlp,
- mp->msg_control, &mp->msg_controllen,
- &mp->msg_flags);
- if (error)
- goto out;
- }
- }
out:
- if (need_drop)
+ if (need_drop) {
file_drop(uap->s);
- if (umsgp != NULL)
- _FREE(umsgp, M_TEMP);
- if (recv_msg_array != NULL)
- free_recv_msg_array(recv_msg_array, uap->cnt);
- if (user_msg_x != NULL)
- _FREE(user_msg_x, M_TEMP);
+ }
+ kheap_free(KHEAP_TEMP, umsgp, uap->cnt * size_of_msghdr);
+ free_recv_msg_array(recv_msg_array, uap->cnt);
+ kheap_free(KHEAP_TEMP, user_msg_x,
+ uap->cnt * sizeof(struct user_msghdr_x));
KERNEL_DEBUG(DBG_FNC_RECVMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
- return (error);
+ return error;
}
/*
AUDIT_ARG(fd, uap->s);
error = file_socket(uap->s, &so);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
if (so == NULL) {
error = EBADF;
goto out;
error = soshutdown((struct socket *)so, uap->how);
out:
file_drop(uap->s);
- return (error);
+ return error;
}
/*
int error;
AUDIT_ARG(fd, uap->s);
- if (uap->val == 0 && uap->valsize != 0)
- return (EFAULT);
+ if (uap->val == 0 && uap->valsize != 0) {
+ return EFAULT;
+ }
/* No bounds checking on size (it's unsigned) */
error = file_socket(uap->s, &so);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
sopt.sopt_dir = SOPT_SET;
sopt.sopt_level = uap->level;
}
#if CONFIG_MACF_SOCKET_SUBSET
if ((error = mac_socket_check_setsockopt(kauth_cred_get(), so,
- &sopt)) != 0)
+ &sopt)) != 0) {
goto out;
+ }
#endif /* MAC_SOCKET_SUBSET */
- error = sosetoptlock(so, &sopt, 1); /* will lock socket */
+ error = sosetoptlock(so, &sopt, 1); /* will lock socket */
out:
file_drop(uap->s);
- return (error);
+ return error;
}
getsockopt(struct proc *p, struct getsockopt_args *uap,
__unused int32_t *retval)
{
- int error;
- socklen_t valsize;
- struct sockopt sopt;
+ int error;
+ socklen_t valsize;
+ struct sockopt sopt;
struct socket *so;
error = file_socket(uap->s, &so);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
if (uap->val) {
error = copyin(uap->avalsize, (caddr_t)&valsize,
- sizeof (valsize));
- if (error)
+ sizeof(valsize));
+ if (error) {
goto out;
+ }
/* No bounds checking on size (it's unsigned) */
} else {
valsize = 0;
}
#if CONFIG_MACF_SOCKET_SUBSET
if ((error = mac_socket_check_getsockopt(kauth_cred_get(), so,
- &sopt)) != 0)
+ &sopt)) != 0) {
goto out;
+ }
#endif /* MAC_SOCKET_SUBSET */
- error = sogetoptlock((struct socket *)so, &sopt, 1); /* will lock */
+ error = sogetoptlock((struct socket *)so, &sopt, 1); /* will lock */
if (error == 0) {
- valsize = sopt.sopt_valsize;
+ valsize = (socklen_t)sopt.sopt_valsize;
error = copyout((caddr_t)&valsize, uap->avalsize,
- sizeof (valsize));
+ sizeof(valsize));
}
out:
file_drop(uap->s);
- return (error);
+ return error;
}
int error;
error = file_socket(uap->fdes, &so);
- if (error)
- return (error);
- error = copyin(uap->alen, (caddr_t)&len, sizeof (socklen_t));
- if (error)
+ if (error) {
+ return error;
+ }
+ error = copyin(uap->alen, (caddr_t)&len, sizeof(socklen_t));
+ if (error) {
goto out;
+ }
if (so == NULL) {
error = EBADF;
goto out;
error = (*so->so_proto->pr_usrreqs->pru_sockaddr)(so, &sa);
if (error == 0) {
error = sflt_getsockname(so, &sa);
- if (error == EJUSTRETURN)
+ if (error == EJUSTRETURN) {
error = 0;
+ }
}
socket_unlock(so, 1);
- if (error)
+ if (error) {
goto bad;
+ }
if (sa == 0) {
len = 0;
goto gotnothing;
sa_len = sa->sa_len;
len = MIN(len, sa_len);
error = copyout((caddr_t)sa, uap->asa, len);
- if (error)
+ if (error) {
goto bad;
+ }
/* return the actual, untruncated address length */
len = sa_len;
gotnothing:
- error = copyout((caddr_t)&len, uap->alen, sizeof (socklen_t));
+ error = copyout((caddr_t)&len, uap->alen, sizeof(socklen_t));
bad:
- if (sa)
- FREE(sa, M_SONAME);
+ FREE(sa, M_SONAME);
out:
file_drop(uap->fdes);
- return (error);
+ return error;
}
/*
int error;
error = file_socket(uap->fdes, &so);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
if (so == NULL) {
error = EBADF;
goto out;
goto out;
}
- if ((so->so_state & (SS_ISCONNECTED|SS_ISCONFIRMING)) == 0) {
+ if ((so->so_state & (SS_ISCONNECTED | SS_ISCONFIRMING)) == 0) {
socket_unlock(so, 1);
error = ENOTCONN;
goto out;
}
- error = copyin(uap->alen, (caddr_t)&len, sizeof (socklen_t));
+ error = copyin(uap->alen, (caddr_t)&len, sizeof(socklen_t));
if (error) {
socket_unlock(so, 1);
goto out;
error = (*so->so_proto->pr_usrreqs->pru_peeraddr)(so, &sa);
if (error == 0) {
error = sflt_getpeername(so, &sa);
- if (error == EJUSTRETURN)
+ if (error == EJUSTRETURN) {
error = 0;
+ }
}
socket_unlock(so, 1);
- if (error)
+ if (error) {
goto bad;
+ }
if (sa == 0) {
len = 0;
goto gotnothing;
sa_len = sa->sa_len;
len = MIN(len, sa_len);
error = copyout(sa, uap->asa, len);
- if (error)
+ if (error) {
goto bad;
+ }
/* return the actual, untruncated address length */
len = sa_len;
gotnothing:
- error = copyout((caddr_t)&len, uap->alen, sizeof (socklen_t));
+ error = copyout((caddr_t)&len, uap->alen, sizeof(socklen_t));
bad:
- if (sa) FREE(sa, M_SONAME);
+ FREE(sa, M_SONAME);
out:
file_drop(uap->fdes);
- return (error);
+ return error;
}
int
-sockargs(struct mbuf **mp, user_addr_t data, int buflen, int type)
+sockargs(struct mbuf **mp, user_addr_t data, socklen_t buflen, int type)
{
struct sockaddr *sa;
struct mbuf *m;
int error;
+ socklen_t alloc_buflen = buflen;
- size_t alloc_buflen = (size_t)buflen;
+ if (buflen > INT_MAX / 2) {
+ return EINVAL;
+ }
+ if (type == MT_SONAME && buflen > SOCK_MAXADDRLEN) {
+ return EINVAL;
+ }
- if (alloc_buflen > INT_MAX/2)
- return (EINVAL);
#ifdef __LP64__
/*
* The fd's in the buffer must expand to be pointers, thus we need twice
* as much space
*/
- if (type == MT_CONTROL)
- alloc_buflen = ((buflen - sizeof(struct cmsghdr))*2) +
+ if (type == MT_CONTROL) {
+ alloc_buflen = ((buflen - sizeof(struct cmsghdr)) * 2) +
sizeof(struct cmsghdr);
+ }
#endif
if (alloc_buflen > MLEN) {
- if (type == MT_SONAME && alloc_buflen <= 112)
- alloc_buflen = MLEN; /* unix domain compat. hack */
- else if (alloc_buflen > MCLBYTES)
- return (EINVAL);
+ if (type == MT_SONAME && alloc_buflen <= 112) {
+ alloc_buflen = MLEN; /* unix domain compat. hack */
+ } else if (alloc_buflen > MCLBYTES) {
+ return EINVAL;
+ }
}
m = m_get(M_WAIT, type);
- if (m == NULL)
- return (ENOBUFS);
+ if (m == NULL) {
+ return ENOBUFS;
+ }
if (alloc_buflen > MLEN) {
MCLGET(m, M_WAIT);
if ((m->m_flags & M_EXT) == 0) {
m_free(m);
- return (ENOBUFS);
+ return ENOBUFS;
}
}
/*
*mp = m;
if (type == MT_SONAME) {
sa = mtod(m, struct sockaddr *);
- sa->sa_len = buflen;
+ VERIFY(buflen <= SOCK_MAXADDRLEN);
+ sa->sa_len = (__uint8_t)buflen;
}
}
- return (error);
+ return error;
}
/*
struct sockaddr *sa;
int error;
- if (len > SOCK_MAXADDRLEN)
- return (ENAMETOOLONG);
+ if (len > SOCK_MAXADDRLEN) {
+ return ENAMETOOLONG;
+ }
- if (len < offsetof(struct sockaddr, sa_data[0]))
- return (EINVAL);
+ if (len < offsetof(struct sockaddr, sa_data[0])) {
+ return EINVAL;
+ }
MALLOC(sa, struct sockaddr *, len, M_SONAME, M_WAITOK | M_ZERO);
if (sa == NULL) {
- return (ENOMEM);
+ return ENOMEM;
}
error = copyin(uaddr, (caddr_t)sa, len);
if (error) {
*/
if (translate_unspec && sa->sa_family == AF_UNSPEC &&
SOCK_CHECK_DOM(so, PF_INET) &&
- len == sizeof (struct sockaddr_in))
+ len == sizeof(struct sockaddr_in)) {
sa->sa_family = AF_INET;
-
- sa->sa_len = len;
+ }
+ VERIFY(len <= SOCK_MAXADDRLEN);
+ sa->sa_len = (__uint8_t)len;
*namp = sa;
}
- return (error);
+ return error;
}
static int
int error;
if (ss == NULL || uaddr == USER_ADDR_NULL ||
- len < offsetof(struct sockaddr, sa_data[0]))
- return (EINVAL);
+ len < offsetof(struct sockaddr, sa_data[0])) {
+ return EINVAL;
+ }
/*
* sockaddr_storage size is less than SOCK_MAXADDRLEN,
* so the check here is inclusive.
*/
- if (len > sizeof (*ss))
- return (ENAMETOOLONG);
+ if (len > sizeof(*ss)) {
+ return ENAMETOOLONG;
+ }
- bzero(ss, sizeof (*ss));
+ bzero(ss, sizeof(*ss));
error = copyin(uaddr, (caddr_t)ss, len);
if (error == 0) {
/*
*/
if (translate_unspec && ss->ss_family == AF_UNSPEC &&
SOCK_CHECK_DOM(so, PF_INET) &&
- len == sizeof (struct sockaddr_in))
+ len == sizeof(struct sockaddr_in)) {
ss->ss_family = AF_INET;
+ }
- ss->ss_len = len;
+ ss->ss_len = (__uint8_t)len;
}
- return (error);
+ return error;
}
int
msghdr64 = ((const struct user64_msghdr_x *)src) + i;
- user_msg->msg_name = msghdr64->msg_name;
+ user_msg->msg_name = (user_addr_t)msghdr64->msg_name;
user_msg->msg_namelen = msghdr64->msg_namelen;
- user_msg->msg_iov = msghdr64->msg_iov;
+ user_msg->msg_iov = (user_addr_t)msghdr64->msg_iov;
user_msg->msg_iovlen = msghdr64->msg_iovlen;
- user_msg->msg_control = msghdr64->msg_control;
+ user_msg->msg_control = (user_addr_t)msghdr64->msg_control;
user_msg->msg_controllen = msghdr64->msg_controllen;
user_msg->msg_flags = msghdr64->msg_flags;
- user_msg->msg_datalen = msghdr64->msg_datalen;
+ user_msg->msg_datalen = (size_t)msghdr64->msg_datalen;
} else {
const struct user32_msghdr_x *msghdr32;
goto done;
}
error = copyin_user_iovec_array(user_msg->msg_iov,
- spacetype, user_msg->msg_iovlen, iovp);
- if (error)
+ spacetype, user_msg->msg_iovlen, iovp);
+ if (error) {
goto done;
+ }
user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
error = uio_calculateresid(auio);
- if (error)
+ if (error) {
goto done;
+ }
user_msg->msg_datalen = uio_resid(auio);
- if (user_msg->msg_name && user_msg->msg_namelen)
+ if (user_msg->msg_name && user_msg->msg_namelen) {
namecnt++;
- if (user_msg->msg_control && user_msg->msg_controllen)
+ }
+ if (user_msg->msg_control && user_msg->msg_controllen) {
ctlcnt++;
+ }
}
done:
- return (error);
+ return error;
}
int
msghdr64 = ((const struct user64_msghdr_x *)src) + i;
- user_msg->msg_name = msghdr64->msg_name;
+ user_msg->msg_name = (user_addr_t)msghdr64->msg_name;
user_msg->msg_namelen = msghdr64->msg_namelen;
- user_msg->msg_iov = msghdr64->msg_iov;
+ user_msg->msg_iov = (user_addr_t)msghdr64->msg_iov;
user_msg->msg_iovlen = msghdr64->msg_iovlen;
- user_msg->msg_control = msghdr64->msg_control;
+ user_msg->msg_control = (user_addr_t)msghdr64->msg_control;
user_msg->msg_controllen = msghdr64->msg_controllen;
user_msg->msg_flags = msghdr64->msg_flags;
- user_msg->msg_datalen = msghdr64->msg_datalen;
+ user_msg->msg_datalen = (size_t)msghdr64->msg_datalen;
} else {
const struct user32_msghdr_x *msghdr32;
goto done;
}
error = copyin_user_iovec_array(user_msg->msg_iov,
- spacetype, user_msg->msg_iovlen, iovp);
- if (error)
+ spacetype, user_msg->msg_iovlen, iovp);
+ if (error) {
goto done;
+ }
user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
error = uio_calculateresid(recv_msg_elem->uio);
- if (error)
+ if (error) {
goto done;
+ }
user_msg->msg_datalen = uio_resid(recv_msg_elem->uio);
- if (user_msg->msg_name && user_msg->msg_namelen)
+ if (user_msg->msg_name && user_msg->msg_namelen) {
recv_msg_elem->which |= SOCK_MSG_SA;
- if (user_msg->msg_control && user_msg->msg_controllen)
+ }
+ if (user_msg->msg_control && user_msg->msg_controllen) {
recv_msg_elem->which |= SOCK_MSG_CONTROL;
+ }
}
done:
- return (error);
+ return error;
}
u_int
uio_t auio = uiop[i];
user_ssize_t len = user_msg->msg_datalen - uio_resid(auio);
- if (user_msg->msg_datalen != 0 && len == 0)
+ if (user_msg->msg_datalen != 0 && len == 0) {
seenlast = 1;
+ }
- if (seenlast == 0)
- retcnt ++;
+ if (seenlast == 0) {
+ retcnt++;
+ }
if (spacetype == UIO_USERSPACE64) {
struct user64_msghdr_x *msghdr64;
msghdr64->msg_flags = user_msg->msg_flags;
msghdr64->msg_datalen = len;
-
} else {
struct user32_msghdr_x *msghdr32;
msghdr32 = ((struct user32_msghdr_x *)dst) + i;
msghdr32->msg_flags = user_msg->msg_flags;
- msghdr32->msg_datalen = len;
+ msghdr32->msg_datalen = (user32_size_t)len;
}
}
- return (retcnt);
+ return retcnt;
}
u_int
-externalize_recv_msghdr_array(void *dst, int spacetype, int direction,
- u_int count, const struct user_msghdr_x *src,
- struct recv_msg_elem *recv_msg_array)
+externalize_recv_msghdr_array(struct proc *p, struct socket *so, void *dst,
+ u_int count, struct user_msghdr_x *src,
+ struct recv_msg_elem *recv_msg_array, int *ret_error)
{
u_int i;
- int seenlast = 0;
u_int retcnt = 0;
+ int spacetype = IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
+
+ *ret_error = 0;
for (i = 0; i < count; i++) {
- const struct user_msghdr_x *user_msg = src + i;
+ struct user_msghdr_x *user_msg = src + i;
struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
- user_ssize_t len;
+ user_ssize_t len = 0;
+ int error;
len = user_msg->msg_datalen - uio_resid(recv_msg_elem->uio);
- if (direction == UIO_READ) {
- if ((recv_msg_elem->which & SOCK_MSG_DATA) == 0)
- seenlast = 1;
- } else {
- if (user_msg->msg_datalen != 0 && len == 0)
- seenlast = 1;
- }
+ if ((recv_msg_elem->which & SOCK_MSG_DATA)) {
+ retcnt++;
- if (seenlast == 0)
- retcnt ++;
- if (spacetype == UIO_USERSPACE64) {
- struct user64_msghdr_x *msghdr64;
+ if (recv_msg_elem->which & SOCK_MSG_SA) {
+ error = copyout_sa(recv_msg_elem->psa, user_msg->msg_name,
+ &user_msg->msg_namelen);
+ if (error != 0) {
+ *ret_error = error;
+ return 0;
+ }
+ }
+ if (recv_msg_elem->which & SOCK_MSG_CONTROL) {
+ error = copyout_control(p, recv_msg_elem->controlp,
+ user_msg->msg_control, &user_msg->msg_controllen,
+ &recv_msg_elem->flags, so);
+ if (error != 0) {
+ *ret_error = error;
+ return 0;
+ }
+ }
+ }
- msghdr64 = ((struct user64_msghdr_x *)dst) + i;
+ if (spacetype == UIO_USERSPACE64) {
+ struct user64_msghdr_x *msghdr64 = ((struct user64_msghdr_x *)dst) + i;
- msghdr64->msg_flags = user_msg->msg_flags;
+ msghdr64->msg_namelen = user_msg->msg_namelen;
+ msghdr64->msg_controllen = user_msg->msg_controllen;
+ msghdr64->msg_flags = recv_msg_elem->flags;
msghdr64->msg_datalen = len;
-
} else {
- struct user32_msghdr_x *msghdr32;
+ struct user32_msghdr_x *msghdr32 = ((struct user32_msghdr_x *)dst) + i;
- msghdr32 = ((struct user32_msghdr_x *)dst) + i;
-
- msghdr32->msg_flags = user_msg->msg_flags;
- msghdr32->msg_datalen = len;
+ msghdr32->msg_namelen = user_msg->msg_namelen;
+ msghdr32->msg_controllen = user_msg->msg_controllen;
+ msghdr32->msg_flags = recv_msg_elem->flags;
+ msghdr32->msg_datalen = (user32_size_t)len;
}
}
- return (retcnt);
+ return retcnt;
}
void
u_int i;
for (i = 0; i < count; i++) {
- if (uiop[i] != NULL)
+ if (uiop[i] != NULL) {
uio_free(uiop[i]);
+ }
}
}
for (i = 0; i < count; i++) {
struct uio *auio = uiop[i];
- if (auio != NULL)
+ if (auio != NULL) {
len += uio_resid(auio);
+ }
}
- return (len);
+ return len;
}
-int
+static boolean_t
uio_array_is_valid(struct uio **uiop, u_int count)
{
user_ssize_t len = 0;
* Sanity check on the validity of the iovec:
* no point of going over sb_max
*/
- if (resid < 0 || (u_int32_t)resid > sb_max)
- return (0);
+ if (resid < 0 || resid > (user_ssize_t)sb_max) {
+ return false;
+ }
len += resid;
- if (len < 0 || (u_int32_t)len > sb_max)
- return (0);
+ if (len < 0 || len > (user_ssize_t)sb_max) {
+ return false;
+ }
}
}
- return (1);
+ return true;
}
struct recv_msg_elem *
alloc_recv_msg_array(u_int count)
{
- struct recv_msg_elem *recv_msg_array;
-
- recv_msg_array = _MALLOC(count * sizeof(struct recv_msg_elem),
- M_TEMP, M_WAITOK | M_ZERO);
-
- return (recv_msg_array);
+ return kheap_alloc(KHEAP_TEMP,
+ count * sizeof(struct recv_msg_elem), Z_WAITOK | Z_ZERO);
}
void
free_recv_msg_array(struct recv_msg_elem *recv_msg_array, u_int count)
{
- u_int i;
-
- for (i = 0; i < count; i++) {
+ if (recv_msg_array == NULL) {
+ return;
+ }
+ for (uint32_t i = 0; i < count; i++) {
struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
- if (recv_msg_elem->uio != NULL)
+ if (recv_msg_elem->uio != NULL) {
uio_free(recv_msg_elem->uio);
- if (recv_msg_elem->psa != NULL)
- _FREE(recv_msg_elem->psa, M_TEMP);
- if (recv_msg_elem->controlp != NULL)
+ }
+ _FREE(recv_msg_elem->psa, M_TEMP);
+ if (recv_msg_elem->controlp != NULL) {
m_freem(recv_msg_elem->controlp);
+ }
}
- _FREE(recv_msg_array, M_TEMP);
+ kheap_free(KHEAP_TEMP, recv_msg_array,
+ count * sizeof(struct recv_msg_elem));
}
for (i = 0; i < count; i++) {
struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
- if (recv_msg_elem->uio != NULL)
+ if (recv_msg_elem->uio != NULL) {
len += uio_resid(recv_msg_elem->uio);
+ }
}
- return (len);
+ return len;
}
int
* Sanity check on the validity of the iovec:
* no point of going over sb_max
*/
- if (resid < 0 || (u_int32_t)resid > sb_max)
- return (0);
+ if (resid < 0 || (u_int32_t)resid > sb_max) {
+ return 0;
+ }
len += resid;
- if (len < 0 || (u_int32_t)len > sb_max)
- return (0);
+ if (len < 0 || (u_int32_t)len > sb_max) {
+ return 0;
+ }
}
}
- return (1);
+ return 1;
}
#if SENDFILE
-#define SFUIOBUFS 64
+#define SFUIOBUFS 64
/* Macros to compute the number of mbufs needed depending on cluster size */
-#define HOWMANY_16K(n) ((((unsigned int)(n) - 1) >> M16KCLSHIFT) + 1)
-#define HOWMANY_4K(n) ((((unsigned int)(n) - 1) >> MBIGCLSHIFT) + 1)
+#define HOWMANY_16K(n) ((((unsigned int)(n) - 1) >> M16KCLSHIFT) + 1)
+#define HOWMANY_4K(n) ((((unsigned int)(n) - 1) >> MBIGCLSHIFT) + 1)
/* Upper send limit in bytes (SFUIOBUFS * PAGESIZE) */
-#define SENDFILE_MAX_BYTES (SFUIOBUFS << PGSHIFT)
+#define SENDFILE_MAX_BYTES (SFUIOBUFS << PGSHIFT)
/* Upper send limit in the number of mbuf clusters */
-#define SENDFILE_MAX_16K HOWMANY_16K(SENDFILE_MAX_BYTES)
-#define SENDFILE_MAX_4K HOWMANY_4K(SENDFILE_MAX_BYTES)
+#define SENDFILE_MAX_16K HOWMANY_16K(SENDFILE_MAX_BYTES)
+#define SENDFILE_MAX_4K HOWMANY_4K(SENDFILE_MAX_BYTES)
static void
alloc_sendpkt(int how, size_t pktlen, unsigned int *maxchunks,
{
unsigned int needed;
- if (pktlen == 0)
+ if (pktlen == 0) {
panic("%s: pktlen (%ld) must be non-zero\n", __func__, pktlen);
+ }
/*
* Try to allocate for the whole thing. Since we want full control
needed = 1;
*m = m_getpackets_internal(&needed, 1, M_WAIT, 1, MBIGCLBYTES);
}
- if (*m == NULL)
+ if (*m == NULL) {
panic("%s: blocking allocation returned NULL\n", __func__);
+ }
*maxchunks = needed;
}
goto done2;
}
- context.vc_ucred = fp->f_fglob->fg_cred;
+ context.vc_ucred = fp->fp_glob->fg_cred;
#if CONFIG_MACF_SOCKET_SUBSET
/* JMM - fetch connected sockaddr? */
error = mac_socket_check_send(context.vc_ucred, so, NULL);
- if (error)
+ if (error) {
goto done2;
+ }
#endif
/*
* Get number of bytes to send
* Should it applies to size of header and trailer?
- * JMM - error handling?
*/
- copyin(uap->nbytes, &nbytes, sizeof (off_t));
+ error = copyin(uap->nbytes, &nbytes, sizeof(off_t));
+ if (error) {
+ goto done2;
+ }
/*
* If specified, get the pointer to the sf_hdtr struct for
if (uap->hdtr != USER_ADDR_NULL) {
caddr_t hdtrp;
- bzero(&user_hdtr, sizeof (user_hdtr));
+ bzero(&user_hdtr, sizeof(user_hdtr));
if (IS_64BIT_PROCESS(p)) {
hdtrp = (caddr_t)&user64_hdtr;
- sizeof_hdtr = sizeof (user64_hdtr);
+ sizeof_hdtr = sizeof(user64_hdtr);
} else {
hdtrp = (caddr_t)&user32_hdtr;
- sizeof_hdtr = sizeof (user32_hdtr);
+ sizeof_hdtr = sizeof(user32_hdtr);
}
error = copyin(uap->hdtr, hdtrp, sizeof_hdtr);
- if (error)
+ if (error) {
goto done2;
+ }
if (IS_64BIT_PROCESS(p)) {
user_hdtr.headers = user64_hdtr.headers;
user_hdtr.hdr_cnt = user64_hdtr.hdr_cnt;
* Send any headers. Wimp out and use writev(2).
*/
if (user_hdtr.headers != USER_ADDR_NULL) {
- bzero(&nuap, sizeof (struct writev_args));
+ bzero(&nuap, sizeof(struct writev_args));
nuap.fd = uap->s;
nuap.iovp = user_hdtr.headers;
nuap.iovcnt = user_hdtr.hdr_cnt;
socket_unlock(so, 1);
goto done2;
}
- for (off = uap->offset; ; off += xfsize, sbytes += xfsize) {
- mbuf_t m0 = NULL, m;
- unsigned int nbufs = SFUIOBUFS, i;
- uio_t auio;
- char uio_buf[UIO_SIZEOF(SFUIOBUFS)]; /* 1 KB !!! */
- size_t uiolen;
- user_ssize_t rlen;
- off_t pgoff;
- size_t pktlen;
+ for (off = uap->offset;; off += xfsize, sbytes += xfsize) {
+ mbuf_t m0 = NULL, m;
+ unsigned int nbufs = SFUIOBUFS, i;
+ uio_t auio;
+ char uio_buf[UIO_SIZEOF(SFUIOBUFS)]; /* 1 KB !!! */
+ size_t uiolen;
+ user_ssize_t rlen;
+ off_t pgoff;
+ size_t pktlen;
boolean_t jumbocl;
/*
}
}
- if (xfsize > SENDFILE_MAX_BYTES)
+ if (xfsize > SENDFILE_MAX_BYTES) {
xfsize = SENDFILE_MAX_BYTES;
- else if (xfsize > PAGE_SIZE)
+ } else if (xfsize > PAGE_SIZE) {
xfsize = trunc_page(xfsize);
+ }
pgoff = off & PAGE_MASK_64;
- if (pgoff > 0 && PAGE_SIZE - pgoff < xfsize)
+ if (pgoff > 0 && PAGE_SIZE - pgoff < xfsize) {
xfsize = PAGE_SIZE_64 - pgoff;
- if (nbytes && xfsize > (nbytes - sbytes))
+ }
+ if (nbytes && xfsize > (nbytes - sbytes)) {
xfsize = nbytes - sbytes;
- if (xfsize <= 0)
+ }
+ if (xfsize <= 0) {
break;
- if (off + xfsize > file_size)
+ }
+ if (off + xfsize > file_size) {
xfsize = file_size - off;
- if (xfsize <= 0)
+ }
+ if (xfsize <= 0) {
break;
+ }
/*
* Attempt to use larger than system page-size clusters for
socket_unlock(so, 0);
alloc_sendpkt(M_WAIT, xfsize, &nbufs, &m0, jumbocl);
pktlen = mbuf_pkthdr_maxlen(m0);
- if (pktlen < (size_t)xfsize)
+ if (pktlen < (size_t)xfsize) {
xfsize = pktlen;
+ }
auio = uio_createwithbuffer(nbufs, off, UIO_SYSSPACE,
- UIO_READ, &uio_buf[0], sizeof (uio_buf));
+ UIO_READ, &uio_buf[0], sizeof(uio_buf));
if (auio == NULL) {
printf("sendfile failed. nbufs = %d. %s", nbufs,
- "File a radar related to rdar://10146739.\n");
+ "File a radar related to rdar://10146739.\n");
mbuf_freem(m0);
error = ENXIO;
socket_lock(so, 0);
i++, m = mbuf_next(m)) {
size_t mlen = mbuf_maxlen(m);
- if (mlen + uiolen > (size_t)xfsize)
+ if (mlen + uiolen > (size_t)xfsize) {
mlen = xfsize - uiolen;
+ }
mbuf_setlen(m, mlen);
uio_addiov(auio, CAST_USER_ADDR_T(mbuf_datastart(m)),
mlen);
uiolen += mlen;
}
- if (xfsize != uio_resid(auio))
+ if (xfsize != uio_resid(auio)) {
printf("sendfile: xfsize: %lld != uio_resid(auio): "
- "%lld\n", xfsize, (long long)uio_resid(auio));
+ "%lld\n", xfsize, (long long)uio_resid(auio));
+ }
KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_READ | DBG_FUNC_START),
uap->s, (unsigned int)((xfsize >> 32) & 0x0ffffffff),
// printf("sendfile: fo_read 0 bytes, EOF\n");
break;
}
- if (xfsize + off > file_size)
+ if (xfsize + off > file_size) {
printf("sendfile: xfsize: %lld + off: %lld > file_size:"
"%lld\n", xfsize, off, file_size);
+ }
for (i = 0, m = m0, rlen = 0;
i < nbufs && m != NULL && rlen < xfsize;
i++, m = mbuf_next(m)) {
size_t mlen = mbuf_maxlen(m);
- if (rlen + mlen > (size_t)xfsize)
+ if (rlen + mlen > (size_t)xfsize) {
mlen = xfsize - rlen;
+ }
mbuf_setlen(m, mlen);
rlen += mlen;
KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_WAIT |
DBG_FUNC_START), uap->s, 0, 0, 0, 0);
error = sbwait(&so->so_snd);
- KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_WAIT|
+ KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_WAIT |
DBG_FUNC_END), uap->s, 0, 0, 0, 0);
/*
* An error from sbwait usually indicates that we've
goto done3;
}
}
- sbunlock(&so->so_snd, FALSE); /* will unlock socket */
+ sbunlock(&so->so_snd, FALSE); /* will unlock socket */
/*
* Send trailers. Wimp out and use writev(2).
*/
if (uap->hdtr != USER_ADDR_NULL &&
user_hdtr.trailers != USER_ADDR_NULL) {
- bzero(&nuap, sizeof (struct writev_args));
+ bzero(&nuap, sizeof(struct writev_args));
nuap.fd = uap->s;
nuap.iovp = user_hdtr.trailers;
nuap.iovcnt = user_hdtr.trl_cnt;
done:
if (uap->nbytes != USER_ADDR_NULL) {
/* XXX this appears bogus for some early failure conditions */
- copyout(&sbytes, uap->nbytes, sizeof (off_t));
+ copyout(&sbytes, uap->nbytes, sizeof(off_t));
}
KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE | DBG_FUNC_END), uap->s,
(unsigned int)((sbytes >> 32) & 0x0ffffffff),
(unsigned int)(sbytes & 0x0ffffffff), error, 0);
- return (error);
+ return error;
done3:
- sbunlock(&so->so_snd, FALSE); /* will unlock socket */
+ sbunlock(&so->so_snd, FALSE); /* will unlock socket */
goto done2;
}
projects / apple / xnu.git / blobdiff