![[BACK]](/icons/back.gif){kind=icon}
Return to uipc_usrreq.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / kern|
Return to uipc_usrreq.c CVS log | Up to [local] / sys / kern |
1.1 nbrk 1: /* $OpenBSD: uipc_usrreq.c,v 1.34 2007/01/16 17:52:18 thib Exp $ */
2: /* $NetBSD: uipc_usrreq.c,v 1.18 1996/02/09 19:00:50 christos Exp $ */
3:
4: /*
5: * Copyright (c) 1982, 1986, 1989, 1991, 1993
6: * The Regents of the University of California. All rights reserved.
7: *
8: * Redistribution and use in source and binary forms, with or without
9: * modification, are permitted provided that the following conditions
10: * are met:
11: * 1. Redistributions of source code must retain the above copyright
12: * notice, this list of conditions and the following disclaimer.
13: * 2. Redistributions in binary form must reproduce the above copyright
14: * notice, this list of conditions and the following disclaimer in the
15: * documentation and/or other materials provided with the distribution.
16: * 3. Neither the name of the University nor the names of its contributors
17: * may be used to endorse or promote products derived from this software
18: * without specific prior written permission.
19: *
20: * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23: * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30: * SUCH DAMAGE.
31: *
32: * @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
33: */
34:
35: #include <sys/param.h>
36: #include <sys/systm.h>
37: #include <sys/proc.h>
38: #include <sys/filedesc.h>
39: #include <sys/domain.h>
40: #include <sys/protosw.h>
41: #include <sys/socket.h>
42: #include <sys/socketvar.h>
43: #include <sys/unpcb.h>
44: #include <sys/un.h>
45: #include <sys/namei.h>
46: #include <sys/vnode.h>
47: #include <sys/file.h>
48: #include <sys/stat.h>
49: #include <sys/mbuf.h>
50:
51: /*
52: * Unix communications domain.
53: *
54: * TODO:
55: * SEQPACKET, RDM
56: * rethink name space problems
57: * need a proper out-of-band
58: */
59: struct sockaddr sun_noname = { sizeof(sun_noname), AF_UNIX };
60: ino_t unp_ino; /* prototype for fake inode numbers */
61:
62: /*ARGSUSED*/
63: int
64: uipc_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
65: struct mbuf *control)
66: {
67: struct unpcb *unp = sotounpcb(so);
68: struct socket *so2;
69: int error = 0;
70: struct proc *p = curproc; /* XXX */
71:
72: if (req == PRU_CONTROL)
73: return (EOPNOTSUPP);
74: if (req != PRU_SEND && control && control->m_len) {
75: error = EOPNOTSUPP;
76: goto release;
77: }
78: if (unp == NULL && req != PRU_ATTACH) {
79: error = EINVAL;
80: goto release;
81: }
82: switch (req) {
83:
84: case PRU_ATTACH:
85: if (unp) {
86: error = EISCONN;
87: break;
88: }
89: error = unp_attach(so);
90: break;
91:
92: case PRU_DETACH:
93: unp_detach(unp);
94: break;
95:
96: case PRU_BIND:
97: error = unp_bind(unp, nam, p);
98: break;
99:
100: case PRU_LISTEN:
101: if (unp->unp_vnode == NULL)
102: error = EINVAL;
103: break;
104:
105: case PRU_CONNECT:
106: error = unp_connect(so, nam, p);
107: break;
108:
109: case PRU_CONNECT2:
110: error = unp_connect2(so, (struct socket *)nam);
111: break;
112:
113: case PRU_DISCONNECT:
114: unp_disconnect(unp);
115: break;
116:
117: case PRU_ACCEPT:
118: /*
119: * Pass back name of connected socket,
120: * if it was bound and we are still connected
121: * (our peer may have closed already!).
122: */
123: if (unp->unp_conn && unp->unp_conn->unp_addr) {
124: nam->m_len = unp->unp_conn->unp_addr->m_len;
125: bcopy(mtod(unp->unp_conn->unp_addr, caddr_t),
126: mtod(nam, caddr_t), (unsigned)nam->m_len);
127: } else {
128: nam->m_len = sizeof(sun_noname);
129: *(mtod(nam, struct sockaddr *)) = sun_noname;
130: }
131: break;
132:
133: case PRU_SHUTDOWN:
134: socantsendmore(so);
135: unp_shutdown(unp);
136: break;
137:
138: case PRU_RCVD:
139: switch (so->so_type) {
140:
141: case SOCK_DGRAM:
142: panic("uipc 1");
143: /*NOTREACHED*/
144:
145: case SOCK_STREAM:
146: #define rcv (&so->so_rcv)
147: #define snd (&so2->so_snd)
148: if (unp->unp_conn == NULL)
149: break;
150: so2 = unp->unp_conn->unp_socket;
151: /*
152: * Adjust backpressure on sender
153: * and wakeup any waiting to write.
154: */
155: snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
156: unp->unp_mbcnt = rcv->sb_mbcnt;
157: snd->sb_hiwat += unp->unp_cc - rcv->sb_cc;
158: unp->unp_cc = rcv->sb_cc;
159: sowwakeup(so2);
160: #undef snd
161: #undef rcv
162: break;
163:
164: default:
165: panic("uipc 2");
166: }
167: break;
168:
169: case PRU_SEND:
170: if (control && (error = unp_internalize(control, p)))
171: break;
172: switch (so->so_type) {
173:
174: case SOCK_DGRAM: {
175: struct sockaddr *from;
176:
177: if (nam) {
178: if (unp->unp_conn) {
179: error = EISCONN;
180: break;
181: }
182: error = unp_connect(so, nam, p);
183: if (error)
184: break;
185: } else {
186: if (unp->unp_conn == NULL) {
187: error = ENOTCONN;
188: break;
189: }
190: }
191: so2 = unp->unp_conn->unp_socket;
192: if (unp->unp_addr)
193: from = mtod(unp->unp_addr, struct sockaddr *);
194: else
195: from = &sun_noname;
196: if (sbappendaddr(&so2->so_rcv, from, m, control)) {
197: sorwakeup(so2);
198: m = NULL;
199: control = NULL;
200: } else
201: error = ENOBUFS;
202: if (nam)
203: unp_disconnect(unp);
204: break;
205: }
206:
207: case SOCK_STREAM:
208: #define rcv (&so2->so_rcv)
209: #define snd (&so->so_snd)
210: if (so->so_state & SS_CANTSENDMORE) {
211: error = EPIPE;
212: break;
213: }
214: if (unp->unp_conn == NULL) {
215: error = ENOTCONN;
216: break;
217: }
218: so2 = unp->unp_conn->unp_socket;
219: /*
220: * Send to paired receive port, and then reduce
221: * send buffer hiwater marks to maintain backpressure.
222: * Wake up readers.
223: */
224: if (control) {
225: if (sbappendcontrol(rcv, m, control))
226: control = NULL;
227: } else
228: sbappend(rcv, m);
229: snd->sb_mbmax -=
230: rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
231: unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
232: snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc;
233: unp->unp_conn->unp_cc = rcv->sb_cc;
234: sorwakeup(so2);
235: m = NULL;
236: #undef snd
237: #undef rcv
238: break;
239:
240: default:
241: panic("uipc 4");
242: }
243: /* we need to undo unp_internalize in case of errors */
244: if (control && error)
245: unp_dispose(control);
246: break;
247:
248: case PRU_ABORT:
249: unp_drop(unp, ECONNABORTED);
250: break;
251:
252: case PRU_SENSE:
253: ((struct stat *) m)->st_blksize = so->so_snd.sb_hiwat;
254: if (so->so_type == SOCK_STREAM && unp->unp_conn != NULL) {
255: so2 = unp->unp_conn->unp_socket;
256: ((struct stat *) m)->st_blksize += so2->so_rcv.sb_cc;
257: }
258: ((struct stat *) m)->st_dev = NODEV;
259: if (unp->unp_ino == 0)
260: unp->unp_ino = unp_ino++;
261: ((struct stat *) m)->st_atimespec =
262: ((struct stat *) m)->st_mtimespec =
263: ((struct stat *) m)->st_ctimespec = unp->unp_ctime;
264: ((struct stat *) m)->st_ino = unp->unp_ino;
265: return (0);
266:
267: case PRU_RCVOOB:
268: return (EOPNOTSUPP);
269:
270: case PRU_SENDOOB:
271: error = EOPNOTSUPP;
272: break;
273:
274: case PRU_SOCKADDR:
275: if (unp->unp_addr) {
276: nam->m_len = unp->unp_addr->m_len;
277: bcopy(mtod(unp->unp_addr, caddr_t),
278: mtod(nam, caddr_t), (unsigned)nam->m_len);
279: } else
280: nam->m_len = 0;
281: break;
282:
283: case PRU_PEERADDR:
284: if (unp->unp_conn && unp->unp_conn->unp_addr) {
285: nam->m_len = unp->unp_conn->unp_addr->m_len;
286: bcopy(mtod(unp->unp_conn->unp_addr, caddr_t),
287: mtod(nam, caddr_t), (unsigned)nam->m_len);
288: } else
289: nam->m_len = 0;
290: break;
291:
292: case PRU_PEEREID:
293: if (unp->unp_flags & UNP_FEIDS) {
294: nam->m_len = sizeof(struct unpcbid);
295: bcopy((caddr_t)(&(unp->unp_connid)),
296: mtod(nam, caddr_t), (unsigned)nam->m_len);
297: } else
298: nam->m_len = 0;
299: break;
300:
301: case PRU_SLOWTIMO:
302: break;
303:
304: default:
305: panic("piusrreq");
306: }
307: release:
308: if (control)
309: m_freem(control);
310: if (m)
311: m_freem(m);
312: return (error);
313: }
314:
315: /*
316: * Both send and receive buffers are allocated PIPSIZ bytes of buffering
317: * for stream sockets, although the total for sender and receiver is
318: * actually only PIPSIZ.
319: * Datagram sockets really use the sendspace as the maximum datagram size,
320: * and don't really want to reserve the sendspace. Their recvspace should
321: * be large enough for at least one max-size datagram plus address.
322: */
323: #define PIPSIZ 4096
324: u_long unpst_sendspace = PIPSIZ;
325: u_long unpst_recvspace = PIPSIZ;
326: u_long unpdg_sendspace = 2*1024; /* really max datagram size */
327: u_long unpdg_recvspace = 4*1024;
328:
329: int unp_rights; /* file descriptors in flight */
330:
331: int
332: unp_attach(struct socket *so)
333: {
334: struct unpcb *unp;
335: int error;
336:
337: if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
338: switch (so->so_type) {
339:
340: case SOCK_STREAM:
341: error = soreserve(so, unpst_sendspace, unpst_recvspace);
342: break;
343:
344: case SOCK_DGRAM:
345: error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
346: break;
347:
348: default:
349: panic("unp_attach");
350: }
351: if (error)
352: return (error);
353: }
354: unp = malloc(sizeof(*unp), M_PCB, M_NOWAIT);
355: if (unp == NULL)
356: return (ENOBUFS);
357: bzero((caddr_t)unp, sizeof(*unp));
358: unp->unp_socket = so;
359: so->so_pcb = unp;
360: nanotime(&unp->unp_ctime);
361: return (0);
362: }
363:
364: void
365: unp_detach(struct unpcb *unp)
366: {
367:
368: if (unp->unp_vnode) {
369: unp->unp_vnode->v_socket = NULL;
370: vrele(unp->unp_vnode);
371: unp->unp_vnode = NULL;
372: }
373: if (unp->unp_conn)
374: unp_disconnect(unp);
375: while (unp->unp_refs)
376: unp_drop(unp->unp_refs, ECONNRESET);
377: soisdisconnected(unp->unp_socket);
378: unp->unp_socket->so_pcb = NULL;
379: m_freem(unp->unp_addr);
380: if (unp_rights) {
381: /*
382: * Normally the receive buffer is flushed later,
383: * in sofree, but if our receive buffer holds references
384: * to descriptors that are now garbage, we will dispose
385: * of those descriptor references after the garbage collector
386: * gets them (resulting in a "panic: closef: count < 0").
387: */
388: sorflush(unp->unp_socket);
389: free(unp, M_PCB);
390: unp_gc();
391: } else
392: free(unp, M_PCB);
393: }
394:
395: int
396: unp_bind(struct unpcb *unp, struct mbuf *nam, struct proc *p)
397: {
398: struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
399: struct vnode *vp;
400: struct vattr vattr;
401: int error, namelen;
402: struct nameidata nd;
403: char buf[MLEN];
404:
405: if (unp->unp_vnode != NULL)
406: return (EINVAL);
407: namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
408: if (namelen <= 0 || namelen >= MLEN)
409: return EINVAL;
410: strncpy(buf, soun->sun_path, namelen);
411: buf[namelen] = 0; /* null-terminate the string */
412: NDINIT(&nd, CREATE, NOFOLLOW | LOCKPARENT, UIO_SYSSPACE, buf, p);
413: /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
414: if ((error = namei(&nd)) != 0)
415: return (error);
416: vp = nd.ni_vp;
417: if (vp != NULL) {
418: VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
419: if (nd.ni_dvp == vp)
420: vrele(nd.ni_dvp);
421: else
422: vput(nd.ni_dvp);
423: vrele(vp);
424: return (EADDRINUSE);
425: }
426: VATTR_NULL(&vattr);
427: vattr.va_type = VSOCK;
428: vattr.va_mode = ACCESSPERMS &~ p->p_fd->fd_cmask;
429: error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
430: if (error)
431: return (error);
432: vp = nd.ni_vp;
433: vp->v_socket = unp->unp_socket;
434: unp->unp_vnode = vp;
435: unp->unp_addr = m_copy(nam, 0, (int)M_COPYALL);
436: unp->unp_connid.unp_euid = p->p_ucred->cr_uid;
437: unp->unp_connid.unp_egid = p->p_ucred->cr_gid;
438: unp->unp_flags |= UNP_FEIDSBIND;
439: VOP_UNLOCK(vp, 0, p);
440: return (0);
441: }
442:
443: int
444: unp_connect(struct socket *so, struct mbuf *nam, struct proc *p)
445: {
446: struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
447: struct vnode *vp;
448: struct socket *so2, *so3;
449: struct unpcb *unp, *unp2, *unp3;
450: int error;
451: struct nameidata nd;
452:
453: NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, soun->sun_path, p);
454: if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) { /* XXX */
455: if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0)
456: return (EMSGSIZE);
457: } else
458: *(mtod(nam, caddr_t) + nam->m_len) = 0;
459: if ((error = namei(&nd)) != 0)
460: return (error);
461: vp = nd.ni_vp;
462: if (vp->v_type != VSOCK) {
463: error = ENOTSOCK;
464: goto bad;
465: }
466: if ((error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p)) != 0)
467: goto bad;
468: so2 = vp->v_socket;
469: if (so2 == NULL) {
470: error = ECONNREFUSED;
471: goto bad;
472: }
473: if (so->so_type != so2->so_type) {
474: error = EPROTOTYPE;
475: goto bad;
476: }
477: if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
478: if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
479: (so3 = sonewconn(so2, 0)) == 0) {
480: error = ECONNREFUSED;
481: goto bad;
482: }
483: unp = sotounpcb(so);
484: unp2 = sotounpcb(so2);
485: unp3 = sotounpcb(so3);
486: if (unp2->unp_addr)
487: unp3->unp_addr =
488: m_copy(unp2->unp_addr, 0, (int)M_COPYALL);
489: unp3->unp_connid.unp_euid = p->p_ucred->cr_uid;
490: unp3->unp_connid.unp_egid = p->p_ucred->cr_gid;
491: unp3->unp_flags |= UNP_FEIDS;
492: so2 = so3;
493: if (unp2->unp_flags & UNP_FEIDSBIND) {
494: unp->unp_connid.unp_euid = unp2->unp_connid.unp_euid;
495: unp->unp_connid.unp_egid = unp2->unp_connid.unp_egid;
496: unp->unp_flags |= UNP_FEIDS;
497: }
498: }
499: error = unp_connect2(so, so2);
500: bad:
501: vput(vp);
502: return (error);
503: }
504:
505: int
506: unp_connect2(struct socket *so, struct socket *so2)
507: {
508: struct unpcb *unp = sotounpcb(so);
509: struct unpcb *unp2;
510:
511: if (so2->so_type != so->so_type)
512: return (EPROTOTYPE);
513: unp2 = sotounpcb(so2);
514: unp->unp_conn = unp2;
515: switch (so->so_type) {
516:
517: case SOCK_DGRAM:
518: unp->unp_nextref = unp2->unp_refs;
519: unp2->unp_refs = unp;
520: soisconnected(so);
521: break;
522:
523: case SOCK_STREAM:
524: unp2->unp_conn = unp;
525: soisconnected(so);
526: soisconnected(so2);
527: break;
528:
529: default:
530: panic("unp_connect2");
531: }
532: return (0);
533: }
534:
535: void
536: unp_disconnect(struct unpcb *unp)
537: {
538: struct unpcb *unp2 = unp->unp_conn;
539:
540: if (unp2 == NULL)
541: return;
542: unp->unp_conn = NULL;
543: switch (unp->unp_socket->so_type) {
544:
545: case SOCK_DGRAM:
546: if (unp2->unp_refs == unp)
547: unp2->unp_refs = unp->unp_nextref;
548: else {
549: unp2 = unp2->unp_refs;
550: for (;;) {
551: if (unp2 == NULL)
552: panic("unp_disconnect");
553: if (unp2->unp_nextref == unp)
554: break;
555: unp2 = unp2->unp_nextref;
556: }
557: unp2->unp_nextref = unp->unp_nextref;
558: }
559: unp->unp_nextref = NULL;
560: unp->unp_socket->so_state &= ~SS_ISCONNECTED;
561: break;
562:
563: case SOCK_STREAM:
564: soisdisconnected(unp->unp_socket);
565: unp2->unp_conn = NULL;
566: soisdisconnected(unp2->unp_socket);
567: break;
568: }
569: }
570:
571: #ifdef notdef
572: unp_abort(struct unpcb *unp)
573: {
574: unp_detach(unp);
575: }
576: #endif
577:
578: void
579: unp_shutdown(struct unpcb *unp)
580: {
581: struct socket *so;
582:
583: if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn &&
584: (so = unp->unp_conn->unp_socket))
585: socantrcvmore(so);
586: }
587:
588: void
589: unp_drop(struct unpcb *unp, int errno)
590: {
591: struct socket *so = unp->unp_socket;
592:
593: so->so_error = errno;
594: unp_disconnect(unp);
595: if (so->so_head) {
596: so->so_pcb = NULL;
597: sofree(so);
598: m_freem(unp->unp_addr);
599: free(unp, M_PCB);
600: }
601: }
602:
603: #ifdef notdef
604: unp_drain(void)
605: {
606:
607: }
608: #endif
609:
610: int
611: unp_externalize(struct mbuf *rights)
612: {
613: struct proc *p = curproc; /* XXX */
614: struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
615: int i, *fdp;
616: struct file **rp;
617: struct file *fp;
618: int nfds, error = 0;
619:
620: nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) /
621: sizeof(struct file *);
622: rp = (struct file **)CMSG_DATA(cm);
623:
624: fdp = malloc(nfds * sizeof(int), M_TEMP, M_WAITOK);
625:
626: #ifdef notyet
627: /* Make sure the recipient should be able to see the descriptors.. */
628: if (p->p_cwdi->cwdi_rdir != NULL) {
629: rp = (struct file **)CMSG_DATA(cm);
630: for (i = 0; i < nfds; i++) {
631: fp = *rp++;
632: /*
633: * If we are in a chroot'ed directory, and
634: * someone wants to pass us a directory, make
635: * sure it's inside the subtree we're allowed
636: * to access.
637: */
638: if (fp->f_type == DTYPE_VNODE) {
639: struct vnode *vp = (struct vnode *)fp->f_data;
640: if ((vp->v_type == VDIR) &&
641: !vn_isunder(vp, p->p_cwdi->cwdi_rdir, p)) {
642: error = EPERM;
643: break;
644: }
645: }
646: }
647: }
648: #endif
649:
650: restart:
651: fdplock(p->p_fd);
652: if (error != 0) {
653: rp = ((struct file **)CMSG_DATA(cm));
654: for (i = 0; i < nfds; i++) {
655: fp = *rp;
656: /*
657: * zero the pointer before calling unp_discard,
658: * since it may end up in unp_gc()..
659: */
660: *rp++ = NULL;
661: unp_discard(fp);
662: }
663: goto out;
664: }
665:
666: /*
667: * First loop -- allocate file descriptor table slots for the
668: * new descriptors.
669: */
670: rp = ((struct file **)CMSG_DATA(cm));
671: for (i = 0; i < nfds; i++) {
672: bcopy(rp, &fp, sizeof(fp));
673: rp++;
674: if ((error = fdalloc(p, 0, &fdp[i])) != 0) {
675: /*
676: * Back out what we've done so far.
677: */
678: for (--i; i >= 0; i--)
679: fdremove(p->p_fd, fdp[i]);
680:
681: if (error == ENOSPC) {
682: fdexpand(p);
683: error = 0;
684: } else {
685: /*
686: * This is the error that has historically
687: * been returned, and some callers may
688: * expect it.
689: */
690: error = EMSGSIZE;
691: }
692: fdpunlock(p->p_fd);
693: goto restart;
694: }
695:
696: /*
697: * Make the slot reference the descriptor so that
698: * fdalloc() works properly.. We finalize it all
699: * in the loop below.
700: */
701: p->p_fd->fd_ofiles[fdp[i]] = fp;
702: }
703:
704: /*
705: * Now that adding them has succeeded, update all of the
706: * descriptor passing state.
707: */
708: rp = (struct file **)CMSG_DATA(cm);
709: for (i = 0; i < nfds; i++) {
710: fp = *rp++;
711: fp->f_msgcount--;
712: unp_rights--;
713: }
714:
715: /*
716: * Copy temporary array to message and adjust length, in case of
717: * transition from large struct file pointers to ints.
718: */
719: memcpy(CMSG_DATA(cm), fdp, nfds * sizeof(int));
720: cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
721: rights->m_len = CMSG_SPACE(nfds * sizeof(int));
722: out:
723: fdpunlock(p->p_fd);
724: free(fdp, M_TEMP);
725: return (error);
726: }
727:
728: int
729: unp_internalize(struct mbuf *control, struct proc *p)
730: {
731: struct filedesc *fdp = p->p_fd;
732: struct cmsghdr *cm = mtod(control, struct cmsghdr *);
733: struct file **rp, *fp;
734: int i, error;
735: int nfds, *ip, fd, neededspace;
736:
737: if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
738: cm->cmsg_len != control->m_len)
739: return (EINVAL);
740: nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof (int);
741:
742: /* Make sure we have room for the struct file pointers */
743: morespace:
744: neededspace = CMSG_SPACE(nfds * sizeof(struct file *)) -
745: control->m_len;
746: if (neededspace > M_TRAILINGSPACE(control)) {
747: /* if we already have a cluster, the message is just too big */
748: if (control->m_flags & M_EXT)
749: return (E2BIG);
750:
751: /* allocate a cluster and try again */
752: MCLGET(control, M_WAIT);
753: if ((control->m_flags & M_EXT) == 0)
754: return (ENOBUFS); /* allocation failed */
755:
756: /* copy the data to the cluster */
757: memcpy(mtod(control, char *), cm, cm->cmsg_len);
758: cm = mtod(control, struct cmsghdr *);
759: goto morespace;
760: }
761:
762: /* adjust message & mbuf to note amount of space actually used. */
763: cm->cmsg_len = CMSG_LEN(nfds * sizeof(struct file *));
764: control->m_len = CMSG_SPACE(nfds * sizeof(struct file *));
765:
766: ip = ((int *)CMSG_DATA(cm)) + nfds - 1;
767: rp = ((struct file **)CMSG_DATA(cm)) + nfds - 1;
768: for (i = 0; i < nfds; i++) {
769: bcopy(ip, &fd, sizeof fd);
770: ip--;
771: if ((fp = fd_getfile(fdp, fd)) == NULL) {
772: error = EBADF;
773: goto fail;
774: }
775: if (fp->f_count == LONG_MAX-2 ||
776: fp->f_msgcount == LONG_MAX-2) {
777: error = EDEADLK;
778: goto fail;
779: }
780: bcopy(&fp, rp, sizeof fp);
781: rp--;
782: fp->f_count++;
783: fp->f_msgcount++;
784: unp_rights++;
785: }
786: return (0);
787: fail:
788: /* Back out what we just did. */
789: for ( ; i > 0; i--) {
790: bcopy(rp, &fp, sizeof(fp));
791: rp++;
792: fp->f_count--;
793: fp->f_msgcount--;
794: unp_rights--;
795: }
796:
797: return (error);
798: }
799:
800: int unp_defer, unp_gcing;
801: extern struct domain unixdomain;
802:
803: void
804: unp_gc(void)
805: {
806: struct file *fp, *nextfp;
807: struct socket *so;
808: struct file **extra_ref, **fpp;
809: int nunref, i;
810:
811: if (unp_gcing)
812: return;
813: unp_gcing = 1;
814: unp_defer = 0;
815: LIST_FOREACH(fp, &filehead, f_list)
816: fp->f_flag &= ~(FMARK|FDEFER);
817: do {
818: LIST_FOREACH(fp, &filehead, f_list) {
819: if (fp->f_flag & FDEFER) {
820: fp->f_flag &= ~FDEFER;
821: unp_defer--;
822: } else {
823: if (fp->f_count == 0)
824: continue;
825: if (fp->f_flag & FMARK)
826: continue;
827: if (fp->f_count == fp->f_msgcount)
828: continue;
829: }
830: fp->f_flag |= FMARK;
831:
832: if (fp->f_type != DTYPE_SOCKET ||
833: (so = (struct socket *)fp->f_data) == NULL)
834: continue;
835: if (so->so_proto->pr_domain != &unixdomain ||
836: (so->so_proto->pr_flags&PR_RIGHTS) == 0)
837: continue;
838: #ifdef notdef
839: if (so->so_rcv.sb_flags & SB_LOCK) {
840: /*
841: * This is problematical; it's not clear
842: * we need to wait for the sockbuf to be
843: * unlocked (on a uniprocessor, at least),
844: * and it's also not clear what to do
845: * if sbwait returns an error due to receipt
846: * of a signal. If sbwait does return
847: * an error, we'll go into an infinite
848: * loop. Delete all of this for now.
849: */
850: (void) sbwait(&so->so_rcv);
851: goto restart;
852: }
853: #endif
854: unp_scan(so->so_rcv.sb_mb, unp_mark, 0);
855: }
856: } while (unp_defer);
857: /*
858: * We grab an extra reference to each of the file table entries
859: * that are not otherwise accessible and then free the rights
860: * that are stored in messages on them.
861: *
862: * The bug in the original code is a little tricky, so I'll describe
863: * what's wrong with it here.
864: *
865: * It is incorrect to simply unp_discard each entry for f_msgcount
866: * times -- consider the case of sockets A and B that contain
867: * references to each other. On a last close of some other socket,
868: * we trigger a gc since the number of outstanding rights (unp_rights)
869: * is non-zero. If during the sweep phase the gc code un_discards,
870: * we end up doing a (full) closef on the descriptor. A closef on A
871: * results in the following chain. Closef calls soo_close, which
872: * calls soclose. Soclose calls first (through the switch
873: * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
874: * returns because the previous instance had set unp_gcing, and
875: * we return all the way back to soclose, which marks the socket
876: * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
877: * to free up the rights that are queued in messages on the socket A,
878: * i.e., the reference on B. The sorflush calls via the dom_dispose
879: * switch unp_dispose, which unp_scans with unp_discard. This second
880: * instance of unp_discard just calls closef on B.
881: *
882: * Well, a similar chain occurs on B, resulting in a sorflush on B,
883: * which results in another closef on A. Unfortunately, A is already
884: * being closed, and the descriptor has already been marked with
885: * SS_NOFDREF, and soclose panics at this point.
886: *
887: * Here, we first take an extra reference to each inaccessible
888: * descriptor. Then, we call sorflush ourself, since we know
889: * it is a Unix domain socket anyhow. After we destroy all the
890: * rights carried in messages, we do a last closef to get rid
891: * of our extra reference. This is the last close, and the
892: * unp_detach etc will shut down the socket.
893: *
894: * 91/09/19, bsy@cs.cmu.edu
895: */
896: extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK);
897: for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref;
898: fp != NULL; fp = nextfp) {
899: nextfp = LIST_NEXT(fp, f_list);
900: if (fp->f_count == 0)
901: continue;
902: if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
903: *fpp++ = fp;
904: nunref++;
905: FREF(fp);
906: fp->f_count++;
907: }
908: }
909: for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
910: if ((*fpp)->f_type == DTYPE_SOCKET && (*fpp)->f_data != NULL)
911: sorflush((struct socket *)(*fpp)->f_data);
912: for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
913: (void) closef(*fpp, NULL);
914: free((caddr_t)extra_ref, M_FILE);
915: unp_gcing = 0;
916: }
917:
918: void
919: unp_dispose(struct mbuf *m)
920: {
921:
922: if (m)
923: unp_scan(m, unp_discard, 1);
924: }
925:
926: void
927: unp_scan(struct mbuf *m0, void (*op)(struct file *), int discard)
928: {
929: struct mbuf *m;
930: struct file **rp, *fp;
931: struct cmsghdr *cm;
932: int i;
933: int qfds;
934:
935: while (m0) {
936: for (m = m0; m; m = m->m_next) {
937: if (m->m_type == MT_CONTROL &&
938: m->m_len >= sizeof(*cm)) {
939: cm = mtod(m, struct cmsghdr *);
940: if (cm->cmsg_level != SOL_SOCKET ||
941: cm->cmsg_type != SCM_RIGHTS)
942: continue;
943: qfds = (cm->cmsg_len - CMSG_ALIGN(sizeof *cm))
944: / sizeof(struct file *);
945: rp = (struct file **)CMSG_DATA(cm);
946: for (i = 0; i < qfds; i++) {
947: fp = *rp;
948: if (discard)
949: *rp = 0;
950: (*op)(fp);
951: rp++;
952: }
953: break; /* XXX, but saves time */
954: }
955: }
956: m0 = m0->m_nextpkt;
957: }
958: }
959:
960: void
961: unp_mark(struct file *fp)
962: {
963: if (fp == NULL)
964: return;
965:
966: if (fp->f_flag & FMARK)
967: return;
968:
969: if (fp->f_flag & FDEFER)
970: return;
971:
972: if (fp->f_type == DTYPE_SOCKET) {
973: unp_defer++;
974: fp->f_flag |= FDEFER;
975: } else {
976: fp->f_flag |= FMARK;
977: }
978: }
979:
980: void
981: unp_discard(struct file *fp)
982: {
983:
984: if (fp == NULL)
985: return;
986: FREF(fp);
987: fp->f_msgcount--;
988: unp_rights--;
989: (void) closef(fp, NULL);
990: }