1 /* $NetBSD: uipc_syscalls.c,v 1.217 2026/09/25 01:10:58 riastradh Exp $ */ 2 3 /*- 4 * Copyright (c) 2008, 2009, 2023 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Andrew Doran. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 1982, 1986, 1989, 1990, 1993 34 * The Regents of the University of California. All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. Neither the name of the University nor the names of its contributors 45 * may be used to endorse or promote products derived from this software 46 * without specific prior written permission. 47 * 48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 58 * SUCH DAMAGE. 59 * 60 * @(#)uipc_syscalls.c 8.6 (Berkeley) 2/14/95 61 */ 62 63 #define MBUFTYPES 64 65 #include <sys/cdefs.h> 66 __KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.217 2026/09/25 01:10:58 riastradh Exp $"); 67 68 #ifdef _KERNEL_OPT 69 #include "opt_pipe.h" 70 #include "opt_sctp.h" 71 #endif 72 73 #include <sys/param.h> 74 #include <sys/types.h> 75 76 #include <sys/atomic.h> 77 #include <sys/buf.h> 78 #include <sys/event.h> 79 #include <sys/file.h> 80 #include <sys/filedesc.h> 81 #include <sys/kauth.h> 82 #include <sys/ktrace.h> 83 #include <sys/mbuf.h> 84 #include <sys/mount.h> 85 #include <sys/proc.h> 86 #include <sys/protosw.h> 87 #include <sys/sdt.h> 88 #include <sys/signalvar.h> 89 #include <sys/socket.h> 90 #include <sys/socketvar.h> 91 #include <sys/syscallargs.h> 92 #include <sys/systm.h> 93 #include <sys/un.h> 94 95 #ifdef SCTP 96 #include <netinet/sctp_peeloff.h> 97 #include <netinet/sctp_uio.h> 98 #endif 99 100 /* 101 * System call interface to the socket abstraction. 102 */ 103 extern const struct fileops socketops; 104 105 static int sockargs_sb(struct sockaddr_big *, const void *, socklen_t); 106 107 int 108 sys___socket30(struct lwp *l, const struct sys___socket30_args *uap, 109 register_t *retval) 110 { 111 /* { 112 syscallarg(int) domain; 113 syscallarg(int) type; 114 syscallarg(int) protocol; 115 } */ 116 int fd, error; 117 file_t *fp; 118 119 error = fsocreate(SCARG(uap, domain), NULL, SCARG(uap, type), 120 SCARG(uap, protocol), &fd, &fp, NULL); 121 if (error == 0) { 122 fd_affix(l->l_proc, fp, fd); 123 *retval = fd; 124 } 125 return error; 126 } 127 128 int 129 sys_bind(struct lwp *l, const struct sys_bind_args *uap, register_t *retval) 130 { 131 /* { 132 syscallarg(int) s; 133 syscallarg(const struct sockaddr *) name; 134 syscallarg(unsigned int) namelen; 135 } */ 136 int error; 137 struct sockaddr_big sb; 138 139 error = sockargs_sb(&sb, SCARG(uap, name), SCARG(uap, namelen)); 140 if (error) 141 return error; 142 143 return do_sys_bind(l, SCARG(uap, s), (struct sockaddr *)&sb); 144 } 145 146 int 147 do_sys_bind(struct lwp *l, int fd, struct sockaddr *nam) 148 { 149 struct socket *so; 150 int error; 151 152 if ((error = fd_getsock(fd, &so)) != 0) 153 return error; 154 error = sobind(so, nam, l); 155 fd_putfile(fd); 156 return error; 157 } 158 159 int 160 sys_listen(struct lwp *l, const struct sys_listen_args *uap, register_t *retval) 161 { 162 /* { 163 syscallarg(int) s; 164 syscallarg(int) backlog; 165 } */ 166 struct socket *so; 167 int error; 168 169 if ((error = fd_getsock(SCARG(uap, s), &so)) != 0) 170 return (error); 171 error = solisten(so, SCARG(uap, backlog), l); 172 fd_putfile(SCARG(uap, s)); 173 return error; 174 } 175 176 int 177 do_sys_accept(struct lwp *l, int sock, struct sockaddr *name, 178 register_t *new_sock, const sigset_t *mask, int flags, int clrflags) 179 { 180 file_t *fp, *fp2; 181 int error, fd; 182 struct socket *so, *so2; 183 short wakeup_state = 0; 184 185 if ((fp = fd_getfile(sock)) == NULL) 186 return SET_ERROR(EBADF); 187 if (fp->f_type != DTYPE_SOCKET) { 188 fd_putfile(sock); 189 return SET_ERROR(ENOTSOCK); 190 } 191 if ((error = fd_allocfile(&fp2, &fd)) != 0) { 192 fd_putfile(sock); 193 return error; 194 } 195 *new_sock = fd; 196 so = fp->f_socket; 197 solock(so); 198 199 if (__predict_false(mask)) 200 sigsuspendsetup(l, mask); 201 202 if (!(so->so_proto->pr_flags & PR_LISTEN)) { 203 error = SET_ERROR(EOPNOTSUPP); 204 goto bad; 205 } 206 if ((so->so_options & SO_ACCEPTCONN) == 0) { 207 error = SET_ERROR(EINVAL); 208 goto bad; 209 } 210 if ((so->so_state & SS_NBIO) && so->so_qlen == 0) { 211 error = SET_ERROR(EWOULDBLOCK); 212 goto bad; 213 } 214 while (so->so_qlen == 0 && so->so_error == 0) { 215 if (so->so_state & SS_CANTRCVMORE) { 216 so->so_error = SET_ERROR(ECONNABORTED); 217 break; 218 } 219 if (wakeup_state & SS_RESTARTSYS) { 220 error = SET_ERROR(ERESTART); 221 goto bad; 222 } 223 error = sowait(so, true, 0); 224 if (error) { 225 goto bad; 226 } 227 wakeup_state = so->so_state; 228 } 229 if (so->so_error) { 230 error = SET_ERROR(so->so_error); 231 so->so_error = 0; 232 goto bad; 233 } 234 /* connection has been removed from the listen queue */ 235 KNOTE(&so->so_rcv.sb_sel.sel_klist, NOTE_SUBMIT); 236 so2 = TAILQ_FIRST(&so->so_q); 237 if (soqremque(so2, 1) == 0) 238 panic("accept"); 239 fp2->f_type = DTYPE_SOCKET; 240 fp2->f_flag = (fp->f_flag & ~clrflags) | 241 ((flags & SOCK_NONBLOCK) ? FNONBLOCK : 0)| 242 ((flags & SOCK_NOSIGPIPE) ? FNOSIGPIPE : 0); 243 fp2->f_ops = &socketops; 244 fp2->f_socket = so2; 245 if (fp2->f_flag & FNONBLOCK) 246 so2->so_state |= SS_NBIO; 247 else 248 so2->so_state &= ~SS_NBIO; 249 error = soaccept(so2, name); 250 so2->so_cred = kauth_cred_hold(so->so_cred); 251 sounlock(so); 252 if (error) { 253 /* an error occurred, free the file descriptor and mbuf */ 254 mutex_enter(&fp2->f_lock); 255 fp2->f_count++; 256 mutex_exit(&fp2->f_lock); 257 closef(fp2); 258 fd_abort(curproc, NULL, fd); 259 } else { 260 fd_set_exclose(l, fd, (flags & SOCK_CLOEXEC) != 0); 261 fd_set_foclose(l, fd, (flags & SOCK_CLOFORK) != 0); 262 fd_affix(curproc, fp2, fd); 263 } 264 fd_putfile(sock); 265 if (__predict_false(mask)) 266 sigsuspendteardown(l); 267 return error; 268 bad: 269 sounlock(so); 270 fd_putfile(sock); 271 fd_abort(curproc, fp2, fd); 272 if (__predict_false(mask)) 273 sigsuspendteardown(l); 274 return error; 275 } 276 277 int 278 sys_accept(struct lwp *l, const struct sys_accept_args *uap, register_t *retval) 279 { 280 /* { 281 syscallarg(int) s; 282 syscallarg(struct sockaddr *) name; 283 syscallarg(unsigned int *) anamelen; 284 } */ 285 int error, fd; 286 struct sockaddr_big name; 287 288 name.sb_len = UCHAR_MAX; 289 error = do_sys_accept(l, SCARG(uap, s), (struct sockaddr *)&name, 290 retval, NULL, 0, 0); 291 if (error != 0) 292 return error; 293 error = copyout_sockname_sb(SCARG(uap, name), SCARG(uap, anamelen), 294 MSG_LENUSRSPACE, &name); 295 if (error != 0) { 296 fd = (int)*retval; 297 if (fd_getfile(fd) != NULL) 298 (void)fd_close(fd); 299 } 300 return error; 301 } 302 303 int 304 sys_paccept(struct lwp *l, const struct sys_paccept_args *uap, 305 register_t *retval) 306 { 307 /* { 308 syscallarg(int) s; 309 syscallarg(struct sockaddr *) name; 310 syscallarg(unsigned int *) anamelen; 311 syscallarg(const sigset_t *) mask; 312 syscallarg(int) flags; 313 } */ 314 int error, fd; 315 struct sockaddr_big name; 316 sigset_t *mask, amask; 317 318 if (SCARG(uap, mask) != NULL) { 319 error = copyin(SCARG(uap, mask), &amask, sizeof(amask)); 320 if (error) 321 return error; 322 mask = &amask; 323 } else 324 mask = NULL; 325 326 name.sb_len = UCHAR_MAX; 327 error = do_sys_accept(l, SCARG(uap, s), (struct sockaddr *)&name, 328 retval, mask, SCARG(uap, flags), FNONBLOCK); 329 if (error != 0) 330 return error; 331 error = copyout_sockname_sb(SCARG(uap, name), SCARG(uap, anamelen), 332 MSG_LENUSRSPACE, &name); 333 if (error != 0) { 334 fd = (int)*retval; 335 if (fd_getfile(fd) != NULL) 336 (void)fd_close(fd); 337 } 338 return error; 339 } 340 341 int 342 sys_connect(struct lwp *l, const struct sys_connect_args *uap, 343 register_t *retval) 344 { 345 /* { 346 syscallarg(int) s; 347 syscallarg(const struct sockaddr *) name; 348 syscallarg(unsigned int) namelen; 349 } */ 350 int error; 351 struct sockaddr_big sbig; 352 353 error = sockargs_sb(&sbig, SCARG(uap, name), SCARG(uap, namelen)); 354 if (error) 355 return error; 356 return do_sys_connect(l, SCARG(uap, s), (struct sockaddr *)&sbig); 357 } 358 359 int 360 do_sys_connect(struct lwp *l, int fd, struct sockaddr *nam) 361 { 362 struct socket *so; 363 int error; 364 int interrupted = 0; 365 366 if ((error = fd_getsock(fd, &so)) != 0) { 367 return (error); 368 } 369 solock(so); 370 if ((so->so_state & SS_ISCONNECTING) != 0) { 371 error = SET_ERROR(EALREADY); 372 goto out; 373 } 374 375 error = soconnect(so, nam, l); 376 if (error) 377 goto bad; 378 if ((so->so_state & (SS_NBIO|SS_ISCONNECTING)) == 379 (SS_NBIO|SS_ISCONNECTING)) { 380 error = SET_ERROR(EINPROGRESS); 381 goto out; 382 } 383 while (((so->so_state & (SS_ISCONNECTING|SS_RESTARTSYS)) == 384 SS_ISCONNECTING) && 385 so->so_error == 0) { 386 error = sowait(so, true, 0); 387 if (error) { 388 if (error == EINTR || error == ERESTART) 389 interrupted = 1; 390 break; 391 } 392 } 393 if (error) 394 goto bad; 395 if (so->so_error) { 396 error = SET_ERROR(so->so_error); 397 so->so_error = 0; 398 goto bad; 399 } 400 if (so->so_state & SS_RESTARTSYS) { 401 so->so_state &= ~SS_ISCONNECTING; 402 error = ERESTART; 403 goto out; 404 } 405 bad: 406 if (!interrupted) 407 so->so_state &= ~SS_ISCONNECTING; 408 if (error == ERESTART) 409 error = SET_ERROR(EINTR); 410 out: 411 sounlock(so); 412 fd_putfile(fd); 413 return error; 414 } 415 416 int 417 sys_socketpair(struct lwp *l, const struct sys_socketpair_args *uap, 418 register_t *retval) 419 { 420 /* { 421 syscallarg(int) domain; 422 syscallarg(int) type; 423 syscallarg(int) protocol; 424 syscallarg(int *) rsv; 425 } */ 426 file_t *fp1, *fp2; 427 struct socket *so1, *so2; 428 int fd, error, sv[2]; 429 proc_t *p = curproc; 430 int flags = SCARG(uap, type) & SOCK_FLAGS_MASK; 431 int type = SCARG(uap, type) & ~SOCK_FLAGS_MASK; 432 int domain = SCARG(uap, domain); 433 int proto = SCARG(uap, protocol); 434 435 error = fsocreate(domain, &so1, type|flags, proto, &fd, &fp1, NULL); 436 if (error) 437 return error; 438 sv[0] = fd; 439 440 error = fsocreate(domain, &so2, type|flags, proto, &fd, &fp2, so1); 441 if (error) 442 goto out; 443 sv[1] = fd; 444 445 solock(so1); 446 error = soconnect2(so1, so2); 447 if (error == 0 && type == SOCK_DGRAM) { 448 /* 449 * Datagram socket connection is asymmetric. 450 */ 451 error = soconnect2(so2, so1); 452 } 453 sounlock(so1); 454 455 if (error == 0) 456 error = copyout(sv, SCARG(uap, rsv), sizeof(sv)); 457 if (error == 0) { 458 fd_affix(p, fp2, sv[1]); 459 fd_affix(p, fp1, sv[0]); 460 return 0; 461 } 462 fd_abort(p, fp2, sv[1]); 463 (void)soclose(so2); 464 out: 465 fd_abort(p, fp1, sv[0]); 466 (void)soclose(so1); 467 return error; 468 } 469 470 int 471 sys_sendto(struct lwp *l, const struct sys_sendto_args *uap, 472 register_t *retval) 473 { 474 /* { 475 syscallarg(int) s; 476 syscallarg(const void *) buf; 477 syscallarg(size_t) len; 478 syscallarg(int) flags; 479 syscallarg(const struct sockaddr *) to; 480 syscallarg(unsigned int) tolen; 481 } */ 482 struct msghdr msg = {0}; 483 struct iovec aiov; 484 485 msg.msg_name = __UNCONST(SCARG(uap, to)); /* XXXUNCONST kills const */ 486 msg.msg_namelen = SCARG(uap, tolen); 487 msg.msg_iov = &aiov; 488 msg.msg_iovlen = 1; 489 msg.msg_control = NULL; 490 msg.msg_flags = 0; 491 aiov.iov_base = __UNCONST(SCARG(uap, buf)); /* XXXUNCONST kills const */ 492 aiov.iov_len = SCARG(uap, len); 493 return do_sys_sendmsg(l, SCARG(uap, s), &msg, SCARG(uap, flags), 494 retval); 495 } 496 497 int 498 sys_sendmsg(struct lwp *l, const struct sys_sendmsg_args *uap, 499 register_t *retval) 500 { 501 /* { 502 syscallarg(int) s; 503 syscallarg(const struct msghdr *) msg; 504 syscallarg(int) flags; 505 } */ 506 struct msghdr msg; 507 int error; 508 509 error = copyin(SCARG(uap, msg), &msg, sizeof(msg)); 510 if (error) 511 return (error); 512 513 msg.msg_flags = MSG_IOVUSRSPACE; 514 return do_sys_sendmsg(l, SCARG(uap, s), &msg, SCARG(uap, flags), 515 retval); 516 } 517 518 int 519 do_sys_sendmsg_so(struct lwp *l, int s, struct socket *so, file_t *fp, 520 struct msghdr *mp, int flags, register_t *retsize) 521 { 522 523 struct iovec aiov[UIO_SMALLIOV], *iov = aiov, *tiov, *ktriov = NULL; 524 struct sockaddr *sa = NULL; 525 struct mbuf *to, *control; 526 struct uio auio; 527 size_t len, iovsz; 528 int i, error; 529 530 ktrkuser("msghdr", mp, sizeof(*mp)); 531 532 /* If the caller passed us stuff in mbufs, we must free them. */ 533 to = (mp->msg_flags & MSG_NAMEMBUF) ? mp->msg_name : NULL; 534 control = (mp->msg_flags & MSG_CONTROLMBUF) ? mp->msg_control : NULL; 535 iovsz = mp->msg_iovlen * sizeof(struct iovec); 536 537 if (mp->msg_flags & MSG_IOVUSRSPACE) { 538 if ((unsigned int)mp->msg_iovlen > UIO_SMALLIOV) { 539 if ((unsigned int)mp->msg_iovlen > IOV_MAX) { 540 error = SET_ERROR(EMSGSIZE); 541 goto bad; 542 } 543 iov = kmem_alloc(iovsz, KM_SLEEP); 544 } 545 if (mp->msg_iovlen != 0) { 546 error = copyin(mp->msg_iov, iov, iovsz); 547 if (error) 548 goto bad; 549 } 550 auio.uio_iov = iov; 551 } else 552 auio.uio_iov = mp->msg_iov; 553 554 auio.uio_iovcnt = mp->msg_iovlen; 555 auio.uio_rw = UIO_WRITE; 556 auio.uio_offset = 0; /* XXX */ 557 auio.uio_resid = 0; 558 KASSERT(l == curlwp); 559 auio.uio_vmspace = l->l_proc->p_vmspace; 560 561 tiov = auio.uio_iov; 562 for (i = 0; i < auio.uio_iovcnt; i++, tiov++) { 563 /* 564 * Writes return ssize_t because -1 is returned on error. 565 * Therefore, we must restrict the length to SSIZE_MAX to 566 * avoid garbage return values. 567 */ 568 auio.uio_resid += tiov->iov_len; 569 if (tiov->iov_len > SSIZE_MAX || auio.uio_resid > SSIZE_MAX) { 570 error = SET_ERROR(EINVAL); 571 goto bad; 572 } 573 } 574 575 if (mp->msg_name && to == NULL) { 576 error = sockargs(&to, mp->msg_name, mp->msg_namelen, 577 UIO_USERSPACE, MT_SONAME); 578 if (error) 579 goto bad; 580 } 581 582 if (mp->msg_control) { 583 if (mp->msg_controllen < CMSG_ALIGN(sizeof(struct cmsghdr))) { 584 error = SET_ERROR(EINVAL); 585 goto bad; 586 } 587 if (control == NULL) { 588 error = sockargs(&control, mp->msg_control, 589 mp->msg_controllen, UIO_USERSPACE, MT_CONTROL); 590 if (error) 591 goto bad; 592 } 593 } 594 595 if (ktrpoint(KTR_GENIO) && iovsz > 0) { 596 ktriov = kmem_alloc(iovsz, KM_SLEEP); 597 memcpy(ktriov, auio.uio_iov, iovsz); 598 } 599 600 if (mp->msg_name) 601 MCLAIM(to, so->so_mowner); 602 if (mp->msg_control) 603 MCLAIM(control, so->so_mowner); 604 605 if (to) { 606 sa = mtod(to, struct sockaddr *); 607 } 608 609 len = auio.uio_resid; 610 error = (*so->so_send)(so, sa, &auio, NULL, control, flags, l); 611 /* Protocol is responsible for freeing 'control' */ 612 control = NULL; 613 614 if (error) { 615 if (auio.uio_resid != len && (error == ERESTART || 616 error == EINTR || error == EWOULDBLOCK)) 617 error = 0; 618 if (error == EPIPE && (fp->f_flag & FNOSIGPIPE) == 0 && 619 (flags & MSG_NOSIGNAL) == 0) { 620 mutex_enter(&proc_lock); 621 psignal(l->l_proc, SIGPIPE); 622 mutex_exit(&proc_lock); 623 } 624 } 625 if (error == 0) 626 *retsize = len - auio.uio_resid; 627 628 bad: 629 if (ktriov != NULL) { 630 ktrgeniov(s, UIO_WRITE, ktriov, *retsize, error); 631 kmem_free(ktriov, iovsz); 632 } 633 634 if (iov != aiov) 635 kmem_free(iov, iovsz); 636 m_freem(to); 637 m_freem(control); 638 639 return error; 640 } 641 642 int 643 do_sys_sendmsg(struct lwp *l, int s, struct msghdr *mp, int flags, 644 register_t *retsize) 645 { 646 int error; 647 struct socket *so; 648 file_t *fp; 649 650 if ((error = fd_getsock1(s, &so, &fp)) != 0) { 651 /* We have to free msg_name and msg_control ourselves */ 652 if (mp->msg_flags & MSG_NAMEMBUF) 653 m_freem(mp->msg_name); 654 if (mp->msg_flags & MSG_CONTROLMBUF) 655 m_freem(mp->msg_control); 656 return error; 657 } 658 error = do_sys_sendmsg_so(l, s, so, fp, mp, flags, retsize); 659 /* msg_name and msg_control freed */ 660 fd_putfile(s); 661 return error; 662 } 663 664 int 665 sys_recvfrom(struct lwp *l, const struct sys_recvfrom_args *uap, 666 register_t *retval) 667 { 668 /* { 669 syscallarg(int) s; 670 syscallarg(void *) buf; 671 syscallarg(size_t) len; 672 syscallarg(int) flags; 673 syscallarg(struct sockaddr *) from; 674 syscallarg(unsigned int *) fromlenaddr; 675 } */ 676 struct msghdr msg = {0}; 677 struct iovec aiov; 678 int error; 679 struct mbuf *from; 680 681 msg.msg_name = NULL; 682 msg.msg_iov = &aiov; 683 msg.msg_iovlen = 1; 684 aiov.iov_base = SCARG(uap, buf); 685 aiov.iov_len = SCARG(uap, len); 686 msg.msg_control = NULL; 687 msg.msg_flags = SCARG(uap, flags) & MSG_USERFLAGS; 688 689 error = do_sys_recvmsg(l, SCARG(uap, s), &msg, &from, NULL, retval); 690 if (error != 0) 691 return error; 692 693 error = copyout_sockname(SCARG(uap, from), SCARG(uap, fromlenaddr), 694 MSG_LENUSRSPACE, from); 695 if (from != NULL) 696 m_free(from); 697 return error; 698 } 699 700 int 701 sys_recvmsg(struct lwp *l, const struct sys_recvmsg_args *uap, 702 register_t *retval) 703 { 704 /* { 705 syscallarg(int) s; 706 syscallarg(struct msghdr *) msg; 707 syscallarg(int) flags; 708 } */ 709 struct msghdr msg; 710 int error; 711 struct mbuf *from, *control; 712 713 error = copyin(SCARG(uap, msg), &msg, sizeof(msg)); 714 if (error) 715 return error; 716 717 msg.msg_flags = (SCARG(uap, flags) & MSG_USERFLAGS) | MSG_IOVUSRSPACE; 718 719 error = do_sys_recvmsg(l, SCARG(uap, s), &msg, &from, 720 msg.msg_control != NULL ? &control : NULL, retval); 721 if (error != 0) 722 return error; 723 724 if (msg.msg_control != NULL) 725 error = copyout_msg_control(l, &msg, control); 726 727 if (error == 0) 728 error = copyout_sockname(msg.msg_name, &msg.msg_namelen, 0, 729 from); 730 if (from != NULL) 731 m_free(from); 732 if (error == 0) { 733 ktrkuser("msghdr", &msg, sizeof(msg)); 734 error = copyout(&msg, SCARG(uap, msg), sizeof(msg)); 735 } 736 737 return error; 738 } 739 740 int 741 sys_sendmmsg(struct lwp *l, const struct sys_sendmmsg_args *uap, 742 register_t *retval) 743 { 744 /* { 745 syscallarg(int) s; 746 syscallarg(struct mmsghdr *) mmsg; 747 syscallarg(unsigned int) vlen; 748 syscallarg(unsigned int) flags; 749 } */ 750 struct mmsghdr mmsg; 751 struct socket *so; 752 file_t *fp; 753 struct msghdr *msg = &mmsg.msg_hdr; 754 int error, s; 755 unsigned int vlen, flags, dg; 756 757 s = SCARG(uap, s); 758 if ((error = fd_getsock1(s, &so, &fp)) != 0) 759 return error; 760 761 vlen = SCARG(uap, vlen); 762 if (vlen > 1024) 763 vlen = 1024; 764 765 flags = (SCARG(uap, flags) & MSG_USERFLAGS) | MSG_IOVUSRSPACE; 766 767 for (dg = 0; dg < vlen;) { 768 error = copyin(SCARG(uap, mmsg) + dg, &mmsg, sizeof(mmsg)); 769 if (error) 770 break; 771 772 msg->msg_flags = flags; 773 774 error = do_sys_sendmsg_so(l, s, so, fp, msg, flags, retval); 775 if (error) 776 break; 777 778 ktrkuser("msghdr", msg, sizeof(*msg)); 779 mmsg.msg_len = *retval; 780 error = copyout(&mmsg, SCARG(uap, mmsg) + dg, sizeof(mmsg)); 781 if (error) 782 break; 783 dg++; 784 785 } 786 787 *retval = dg; 788 789 fd_putfile(s); 790 791 /* 792 * If we succeeded at least once, return 0. 793 */ 794 if (dg) 795 return 0; 796 return error; 797 } 798 799 /* 800 * Adjust for a truncated SCM_RIGHTS control message. 801 * This means closing any file descriptors that aren't present 802 * in the returned buffer. 803 * m is the mbuf holding the (already externalized) SCM_RIGHTS message. 804 */ 805 static void 806 free_rights(struct mbuf *m) 807 { 808 struct cmsghdr *cm; 809 int *fdv; 810 unsigned int nfds, i; 811 812 KASSERT(sizeof(*cm) <= m->m_len); 813 cm = mtod(m, struct cmsghdr *); 814 815 KASSERT(CMSG_ALIGN(sizeof(*cm)) <= cm->cmsg_len); 816 KASSERT(cm->cmsg_len <= m->m_len); 817 nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int); 818 fdv = (int *)CMSG_DATA(cm); 819 820 for (i = 0; i < nfds; i++) 821 if (fd_getfile(fdv[i]) != NULL) 822 (void)fd_close(fdv[i]); 823 } 824 825 void 826 free_control_mbuf(struct lwp *l, struct mbuf *control, struct mbuf *uncopied) 827 { 828 struct mbuf *next; 829 struct cmsghdr *cmsg; 830 bool do_free_rights = false; 831 832 while (control != NULL) { 833 cmsg = mtod(control, struct cmsghdr *); 834 if (control == uncopied) 835 do_free_rights = true; 836 if (do_free_rights && cmsg->cmsg_level == SOL_SOCKET 837 && cmsg->cmsg_type == SCM_RIGHTS) 838 free_rights(control); 839 next = control->m_next; 840 m_free(control); 841 control = next; 842 } 843 } 844 845 /* Copy socket control/CMSG data to user buffer, frees the mbuf */ 846 int 847 copyout_msg_control(struct lwp *l, struct msghdr *mp, struct mbuf *control) 848 { 849 int i, len, error = 0; 850 struct cmsghdr *cmsg; 851 struct mbuf *m; 852 char *q; 853 854 len = mp->msg_controllen; 855 if (len <= 0 || control == 0) { 856 mp->msg_controllen = 0; 857 free_control_mbuf(l, control, control); 858 return 0; 859 } 860 861 q = (char *)mp->msg_control; 862 863 for (m = control; m != NULL; ) { 864 cmsg = mtod(m, struct cmsghdr *); 865 i = m->m_len; 866 if (len < i) { 867 mp->msg_flags |= MSG_CTRUNC; 868 if (cmsg->cmsg_level == SOL_SOCKET 869 && cmsg->cmsg_type == SCM_RIGHTS) 870 /* Do not truncate me ... */ 871 break; 872 i = len; 873 } 874 error = copyout(mtod(m, void *), q, i); 875 ktrkuser(mbuftypes[MT_CONTROL], cmsg, cmsg->cmsg_len); 876 if (error != 0) { 877 /* We must free all the SCM_RIGHTS */ 878 m = control; 879 break; 880 } 881 m = m->m_next; 882 if (m) 883 i = ALIGN(i); 884 q += i; 885 len -= i; 886 if (len <= 0) 887 break; 888 } 889 890 free_control_mbuf(l, control, m); 891 892 mp->msg_controllen = q - (char *)mp->msg_control; 893 return error; 894 } 895 896 int 897 do_sys_recvmsg_so(struct lwp *l, int s, struct socket *so, struct msghdr *mp, 898 struct mbuf **from, struct mbuf **control, register_t *retsize) 899 { 900 struct iovec aiov[UIO_SMALLIOV], *iov = aiov, *tiov, *ktriov = NULL; 901 struct uio auio; 902 size_t len, iovsz; 903 int i, error; 904 905 ktrkuser("msghdr", mp, sizeof(*mp)); 906 907 *from = NULL; 908 if (control != NULL) 909 *control = NULL; 910 911 iovsz = mp->msg_iovlen * sizeof(struct iovec); 912 913 if (mp->msg_flags & MSG_IOVUSRSPACE) { 914 if ((unsigned int)mp->msg_iovlen > UIO_SMALLIOV) { 915 if ((unsigned int)mp->msg_iovlen > IOV_MAX) { 916 error = SET_ERROR(EMSGSIZE); 917 goto out; 918 } 919 iov = kmem_alloc(iovsz, KM_SLEEP); 920 } 921 if (mp->msg_iovlen != 0) { 922 error = copyin(mp->msg_iov, iov, iovsz); 923 if (error) 924 goto out; 925 } 926 auio.uio_iov = iov; 927 } else 928 auio.uio_iov = mp->msg_iov; 929 auio.uio_iovcnt = mp->msg_iovlen; 930 auio.uio_rw = UIO_READ; 931 auio.uio_offset = 0; /* XXX */ 932 auio.uio_resid = 0; 933 KASSERT(l == curlwp); 934 auio.uio_vmspace = l->l_proc->p_vmspace; 935 936 tiov = auio.uio_iov; 937 for (i = 0; i < auio.uio_iovcnt; i++, tiov++) { 938 /* 939 * Reads return ssize_t because -1 is returned on error. 940 * Therefore we must restrict the length to SSIZE_MAX to 941 * avoid garbage return values. 942 */ 943 auio.uio_resid += tiov->iov_len; 944 if (tiov->iov_len > SSIZE_MAX || auio.uio_resid > SSIZE_MAX) { 945 error = SET_ERROR(EINVAL); 946 goto out; 947 } 948 } 949 950 if (ktrpoint(KTR_GENIO) && iovsz > 0) { 951 ktriov = kmem_alloc(iovsz, KM_SLEEP); 952 memcpy(ktriov, auio.uio_iov, iovsz); 953 } 954 955 len = auio.uio_resid; 956 mp->msg_flags &= MSG_USERFLAGS; 957 error = (*so->so_receive)(so, from, &auio, NULL, control, 958 &mp->msg_flags); 959 KASSERT(*from == NULL || (*from)->m_next == NULL); 960 len -= auio.uio_resid; 961 *retsize = len; 962 if (error != 0 && len != 0 963 && (error == ERESTART || error == EINTR || error == EWOULDBLOCK)) 964 /* Some data transferred */ 965 error = 0; 966 967 if (ktriov != NULL) { 968 ktrgeniov(s, UIO_READ, ktriov, len, error); 969 kmem_free(ktriov, iovsz); 970 } 971 972 if (error != 0) { 973 m_freem(*from); 974 *from = NULL; 975 if (control != NULL) { 976 free_control_mbuf(l, *control, *control); 977 *control = NULL; 978 } 979 } 980 out: 981 if (iov != aiov) 982 kmem_free(iov, iovsz); 983 return error; 984 } 985 986 987 int 988 do_sys_recvmsg(struct lwp *l, int s, struct msghdr *mp, 989 struct mbuf **from, struct mbuf **control, register_t *retsize) 990 { 991 int error; 992 struct socket *so; 993 994 if ((error = fd_getsock(s, &so)) != 0) 995 return error; 996 error = do_sys_recvmsg_so(l, s, so, mp, from, control, retsize); 997 fd_putfile(s); 998 return error; 999 } 1000 1001 int 1002 sys_recvmmsg(struct lwp *l, const struct sys_recvmmsg_args *uap, 1003 register_t *retval) 1004 { 1005 /* { 1006 syscallarg(int) s; 1007 syscallarg(struct mmsghdr *) mmsg; 1008 syscallarg(unsigned int) vlen; 1009 syscallarg(unsigned int) flags; 1010 syscallarg(struct timespec *) timeout; 1011 } */ 1012 struct mmsghdr mmsg; 1013 struct socket *so; 1014 struct msghdr *msg = &mmsg.msg_hdr; 1015 int error, s; 1016 struct mbuf *from, *control; 1017 struct timespec ts, now; 1018 unsigned int vlen, flags, dg; 1019 1020 if (SCARG(uap, timeout)) { 1021 if ((error = copyin(SCARG(uap, timeout), &ts, sizeof(ts))) != 0) 1022 return error; 1023 if (ts.tv_nsec < 0 || ts.tv_nsec >= 1000000000L) 1024 return SET_ERROR(EINVAL); 1025 getnanotime(&now); 1026 if (timespecaddok(&now, &ts)) { 1027 timespecadd(&now, &ts, &ts); 1028 } else { 1029 ts.tv_sec = __type_max(time_t); 1030 ts.tv_nsec = 999999999L; 1031 } 1032 } 1033 1034 s = SCARG(uap, s); 1035 if ((error = fd_getsock(s, &so)) != 0) 1036 return error; 1037 1038 /* 1039 * If so->so_rerror holds a deferred error return it now. 1040 */ 1041 if (so->so_rerror) { 1042 error = SET_ERROR(so->so_rerror); 1043 so->so_rerror = 0; 1044 fd_putfile(s); 1045 return error; 1046 } 1047 1048 vlen = SCARG(uap, vlen); 1049 if (vlen > 1024) 1050 vlen = 1024; 1051 1052 from = NULL; 1053 flags = (SCARG(uap, flags) & MSG_USERFLAGS) | MSG_IOVUSRSPACE; 1054 1055 for (dg = 0; dg < vlen;) { 1056 error = copyin(SCARG(uap, mmsg) + dg, &mmsg, sizeof(mmsg)); 1057 if (error) 1058 break; 1059 1060 msg->msg_flags = flags & ~MSG_WAITFORONE; 1061 1062 if (from != NULL) { 1063 m_free(from); 1064 from = NULL; 1065 } 1066 1067 error = do_sys_recvmsg_so(l, s, so, msg, &from, 1068 msg->msg_control != NULL ? &control : NULL, retval); 1069 if (error) { 1070 if (error == EAGAIN && dg > 0) 1071 error = 0; 1072 break; 1073 } 1074 1075 if (msg->msg_control != NULL) 1076 error = copyout_msg_control(l, msg, control); 1077 if (error) 1078 break; 1079 1080 error = copyout_sockname(msg->msg_name, &msg->msg_namelen, 0, 1081 from); 1082 if (error) 1083 break; 1084 1085 ktrkuser("msghdr", msg, sizeof *msg); 1086 mmsg.msg_len = *retval; 1087 1088 error = copyout(&mmsg, SCARG(uap, mmsg) + dg, sizeof(mmsg)); 1089 if (error) 1090 break; 1091 1092 dg++; 1093 if (msg->msg_flags & MSG_OOB) 1094 break; 1095 1096 if (SCARG(uap, timeout)) { 1097 getnanotime(&now); 1098 if (timespeccmp(&ts, &now, <)) 1099 break; 1100 } 1101 1102 if (flags & MSG_WAITFORONE) 1103 flags |= MSG_DONTWAIT; 1104 1105 } 1106 1107 if (from != NULL) 1108 m_free(from); 1109 1110 *retval = dg; 1111 1112 /* 1113 * If we succeeded at least once, return 0, hopefully so->so_rerror 1114 * will catch it next time. 1115 */ 1116 if (error && dg > 0) { 1117 so->so_rerror = error; 1118 error = 0; 1119 } 1120 1121 fd_putfile(s); 1122 1123 return error; 1124 } 1125 1126 int 1127 sys_shutdown(struct lwp *l, const struct sys_shutdown_args *uap, 1128 register_t *retval) 1129 { 1130 /* { 1131 syscallarg(int) s; 1132 syscallarg(int) how; 1133 } */ 1134 struct socket *so; 1135 int error; 1136 1137 if ((error = fd_getsock(SCARG(uap, s), &so)) != 0) 1138 return error; 1139 solock(so); 1140 error = soshutdown(so, SCARG(uap, how)); 1141 sounlock(so); 1142 fd_putfile(SCARG(uap, s)); 1143 return error; 1144 } 1145 1146 int 1147 sys_setsockopt(struct lwp *l, const struct sys_setsockopt_args *uap, 1148 register_t *retval) 1149 { 1150 /* { 1151 syscallarg(int) s; 1152 syscallarg(int) level; 1153 syscallarg(int) name; 1154 syscallarg(const void *) val; 1155 syscallarg(unsigned int) valsize; 1156 } */ 1157 struct sockopt sopt; 1158 struct socket *so; 1159 file_t *fp; 1160 int error; 1161 unsigned int len; 1162 1163 len = SCARG(uap, valsize); 1164 if (len > 0 && SCARG(uap, val) == NULL) 1165 return SET_ERROR(EINVAL); 1166 1167 if (len > MCLBYTES) 1168 return SET_ERROR(EINVAL); 1169 1170 if ((error = fd_getsock1(SCARG(uap, s), &so, &fp)) != 0) 1171 return (error); 1172 1173 sockopt_init(&sopt, SCARG(uap, level), SCARG(uap, name), len); 1174 1175 if (len > 0) { 1176 error = copyin(SCARG(uap, val), sopt.sopt_data, len); 1177 if (error) 1178 goto out; 1179 } 1180 1181 error = sosetopt(so, &sopt); 1182 if (so->so_options & SO_NOSIGPIPE) 1183 atomic_or_uint(&fp->f_flag, FNOSIGPIPE); 1184 else 1185 atomic_and_uint(&fp->f_flag, ~FNOSIGPIPE); 1186 1187 out: 1188 sockopt_destroy(&sopt); 1189 fd_putfile(SCARG(uap, s)); 1190 return error; 1191 } 1192 1193 static int 1194 getsockopt(struct lwp *l, const struct sys_getsockopt_args *uap, 1195 register_t *retval, bool copyarg) 1196 { 1197 struct sockopt sopt; 1198 struct socket *so; 1199 file_t *fp; 1200 unsigned int valsize, len; 1201 int error; 1202 1203 if (SCARG(uap, val) != NULL) { 1204 error = copyin(SCARG(uap, avalsize), &valsize, sizeof(valsize)); 1205 if (error) 1206 return error; 1207 } else 1208 valsize = 0; 1209 1210 if (valsize > MCLBYTES) 1211 return SET_ERROR(EINVAL); 1212 1213 if ((error = fd_getsock1(SCARG(uap, s), &so, &fp)) != 0) 1214 return error; 1215 1216 sockopt_init(&sopt, SCARG(uap, level), SCARG(uap, name), valsize); 1217 if (copyarg && valsize > 0) { 1218 error = copyin(SCARG(uap, val), sopt.sopt_data, valsize); 1219 if (error) 1220 goto out; 1221 } 1222 1223 if (fp->f_flag & FNOSIGPIPE) 1224 so->so_options |= SO_NOSIGPIPE; 1225 else 1226 so->so_options &= ~SO_NOSIGPIPE; 1227 1228 error = sogetopt(so, &sopt); 1229 if (error || valsize == 0) 1230 goto out; 1231 1232 len = uimin(valsize, sopt.sopt_retsize); 1233 error = copyout(sopt.sopt_data, SCARG(uap, val), len); 1234 if (error) 1235 goto out; 1236 1237 error = copyout(&len, SCARG(uap, avalsize), sizeof(len)); 1238 out: 1239 sockopt_destroy(&sopt); 1240 fd_putfile(SCARG(uap, s)); 1241 return error; 1242 } 1243 1244 int 1245 sys_getsockopt(struct lwp *l, const struct sys_getsockopt_args *uap, 1246 register_t *retval) 1247 { 1248 /* { 1249 syscallarg(int) s; 1250 syscallarg(int) level; 1251 syscallarg(int) name; 1252 syscallarg(void *) val; 1253 syscallarg(unsigned int *) avalsize; 1254 } */ 1255 return getsockopt(l, uap, retval, false); 1256 } 1257 1258 int 1259 sys_getsockopt2(struct lwp *l, const struct sys_getsockopt2_args *uap, 1260 register_t *retval) 1261 { 1262 /* { 1263 syscallarg(int) s; 1264 syscallarg(int) level; 1265 syscallarg(int) name; 1266 syscallarg(void *) val; 1267 syscallarg(unsigned int *) avalsize; 1268 } */ 1269 return getsockopt(l, (const struct sys_getsockopt_args *) uap, retval, true); 1270 } 1271 1272 #ifdef PIPE_SOCKETPAIR 1273 1274 int 1275 pipe1(struct lwp *l, int *fildes, int flags) 1276 { 1277 file_t *rf, *wf; 1278 struct socket *rso, *wso; 1279 int error, soflags = 0; 1280 unsigned rfd, wfd; 1281 proc_t *p = l->l_proc; 1282 1283 if (flags & ~(O_CLOEXEC|O_CLOFORK|O_NONBLOCK|O_NOSIGPIPE)) 1284 return SET_ERROR(EINVAL); 1285 if (flags & O_CLOEXEC) 1286 soflags |= SOCK_CLOEXEC; 1287 if (flags & O_CLOFORK) 1288 soflags |= SOCK_CLOFORK; 1289 if (flags & O_NONBLOCK) 1290 soflags |= SOCK_NONBLOCK; 1291 if (flags & O_NOSIGPIPE) 1292 soflags |= SOCK_NOSIGPIPE; 1293 1294 error = fsocreate(AF_LOCAL, &rso, SOCK_STREAM|soflags, 0, &rfd, &rf, 1295 NULL); 1296 if (error) 1297 goto free1; 1298 error = fsocreate(AF_LOCAL, &wso, SOCK_STREAM|soflags, 0, &wfd, &wf, 1299 rso); 1300 if (error) 1301 goto free2; 1302 1303 /* make sure the descriptors are uni-directional */ 1304 rf->f_type = rf->f_type & ~(FWRITE); 1305 wf->f_type = wf->f_type & ~(FREAD); 1306 1307 /* remember this socket pair implements a pipe */ 1308 rso->so_state |= SS_ISAPIPE; 1309 wso->so_state |= SS_ISAPIPE; 1310 1311 solock(wso); 1312 /* 1313 * Pipes must be readable when there is at least 1 1314 * byte of data available in the receive buffer. 1315 * 1316 * Pipes must be writable when there is space for 1317 * at least PIPE_BUF bytes in the send buffer. 1318 * If we're increasing the low water mark for the 1319 * send buffer, then mimic how soreserve() would 1320 * have set the high water mark. 1321 */ 1322 rso->so_rcv.sb_lowat = 1; 1323 if (wso->so_snd.sb_lowat < PIPE_BUF) { 1324 wso->so_snd.sb_hiwat = PIPE_BUF * 2; 1325 } 1326 wso->so_snd.sb_lowat = PIPE_BUF; 1327 error = unp_connect2(wso, rso); 1328 sounlock(wso); 1329 1330 if (error != 0) 1331 goto free3; 1332 1333 fd_affix(p, wf, wfd); 1334 fd_affix(p, rf, rfd); 1335 fildes[0] = rfd; 1336 fildes[1] = wfd; 1337 return (0); 1338 free3: 1339 (void)soclose(wso); 1340 fd_abort(p, wf, wfd); 1341 free2: 1342 (void)soclose(rso); 1343 fd_abort(p, rf, rfd); 1344 free1: 1345 return error; 1346 } 1347 #endif /* PIPE_SOCKETPAIR */ 1348 1349 /* 1350 * Get peer socket name. 1351 */ 1352 int 1353 do_sys_getpeername(int fd, struct sockaddr *nam) 1354 { 1355 struct socket *so; 1356 int error; 1357 1358 if ((error = fd_getsock(fd, &so)) != 0) 1359 return error; 1360 1361 solock(so); 1362 if ((so->so_state & SS_ISCONNECTED) == 0) 1363 error = SET_ERROR(ENOTCONN); 1364 else { 1365 error = (*so->so_proto->pr_usrreqs->pr_peeraddr)(so, nam); 1366 } 1367 sounlock(so); 1368 fd_putfile(fd); 1369 return error; 1370 } 1371 1372 /* 1373 * Get local socket name. 1374 */ 1375 int 1376 do_sys_getsockname(int fd, struct sockaddr *nam) 1377 { 1378 struct socket *so; 1379 int error; 1380 1381 if ((error = fd_getsock(fd, &so)) != 0) 1382 return error; 1383 1384 solock(so); 1385 error = (*so->so_proto->pr_usrreqs->pr_sockaddr)(so, nam); 1386 sounlock(so); 1387 fd_putfile(fd); 1388 return error; 1389 } 1390 1391 int 1392 copyout_sockname_sb(struct sockaddr *asa, unsigned int *alen, int flags, 1393 struct sockaddr_big *addr) 1394 { 1395 unsigned int len; 1396 int error; 1397 1398 if (asa == NULL) 1399 /* Assume application not interested */ 1400 return 0; 1401 1402 if (flags & MSG_LENUSRSPACE) { 1403 error = copyin(alen, &len, sizeof(len)); 1404 if (error) 1405 return error; 1406 } else 1407 len = *alen; 1408 1409 if (addr == NULL) { 1410 len = 0; 1411 error = 0; 1412 } else { 1413 if (len > addr->sb_len) 1414 len = addr->sb_len; 1415 /* XXX addr isn't an mbuf... */ 1416 ktrkuser(mbuftypes[MT_SONAME], addr, len); 1417 error = copyout(addr, asa, len); 1418 } 1419 1420 if (error == 0) { 1421 if (flags & MSG_LENUSRSPACE) 1422 error = copyout(&len, alen, sizeof(len)); 1423 else 1424 *alen = len; 1425 } 1426 1427 return error; 1428 } 1429 1430 int 1431 copyout_sockname(struct sockaddr *asa, unsigned int *alen, int flags, 1432 struct mbuf *addr) 1433 { 1434 int len; 1435 int error; 1436 1437 if (asa == NULL) 1438 /* Assume application not interested */ 1439 return 0; 1440 1441 if (flags & MSG_LENUSRSPACE) { 1442 error = copyin(alen, &len, sizeof(len)); 1443 if (error) 1444 return error; 1445 } else 1446 len = *alen; 1447 if (len < 0) 1448 return SET_ERROR(EINVAL); 1449 1450 if (addr == NULL) { 1451 len = 0; 1452 error = 0; 1453 } else { 1454 if (len > addr->m_len) 1455 len = addr->m_len; 1456 /* Maybe this ought to copy a chain ? */ 1457 ktrkuser(mbuftypes[MT_SONAME], mtod(addr, void *), len); 1458 error = copyout(mtod(addr, void *), asa, len); 1459 } 1460 1461 if (error == 0) { 1462 if (flags & MSG_LENUSRSPACE) 1463 error = copyout(&len, alen, sizeof(len)); 1464 else 1465 *alen = len; 1466 } 1467 1468 return error; 1469 } 1470 1471 /* 1472 * Get socket name. 1473 */ 1474 int 1475 sys_getsockname(struct lwp *l, const struct sys_getsockname_args *uap, 1476 register_t *retval) 1477 { 1478 /* { 1479 syscallarg(int) fdes; 1480 syscallarg(struct sockaddr *) asa; 1481 syscallarg(unsigned int *) alen; 1482 } */ 1483 struct sockaddr_big sbig; 1484 int error; 1485 1486 sbig.sb_len = UCHAR_MAX; 1487 error = do_sys_getsockname(SCARG(uap, fdes), (struct sockaddr *)&sbig); 1488 if (error != 0) 1489 return error; 1490 1491 error = copyout_sockname_sb(SCARG(uap, asa), SCARG(uap, alen), 1492 MSG_LENUSRSPACE, &sbig); 1493 return error; 1494 } 1495 1496 /* 1497 * Get name of peer for connected socket. 1498 */ 1499 int 1500 sys_getpeername(struct lwp *l, const struct sys_getpeername_args *uap, 1501 register_t *retval) 1502 { 1503 /* { 1504 syscallarg(int) fdes; 1505 syscallarg(struct sockaddr *) asa; 1506 syscallarg(unsigned int *) alen; 1507 } */ 1508 struct sockaddr_big sbig; 1509 int error; 1510 1511 sbig.sb_len = UCHAR_MAX; 1512 error = do_sys_getpeername(SCARG(uap, fdes), (struct sockaddr *)&sbig); 1513 if (error != 0) 1514 return error; 1515 1516 error = copyout_sockname_sb(SCARG(uap, asa), SCARG(uap, alen), 1517 MSG_LENUSRSPACE, &sbig); 1518 return error; 1519 } 1520 1521 static int 1522 sockargs_sb(struct sockaddr_big *sb, const void *name, socklen_t buflen) 1523 { 1524 int error; 1525 1526 /* 1527 * We can't allow socket names > UCHAR_MAX in length, since that 1528 * will overflow sb_len. Further no reasonable buflen is <= 1529 * offsetof(sockaddr_big, sb_data) since it shall be at least 1530 * the size of the preamble sb_len and sb_family members. 1531 */ 1532 if (buflen > UCHAR_MAX || 1533 buflen <= offsetof(struct sockaddr_big, sb_data)) 1534 return SET_ERROR(EINVAL); 1535 1536 error = copyin(name, (void *)sb, buflen); 1537 if (error) 1538 return error; 1539 1540 ktrkuser(mbuftypes[MT_SONAME], sb, buflen); 1541 #if BYTE_ORDER != BIG_ENDIAN 1542 /* 1543 * 4.3BSD compat thing - need to stay, since bind(2), 1544 * connect(2), sendto(2) were not versioned for COMPAT_43. 1545 */ 1546 if (sb->sb_family == 0 && sb->sb_len < AF_MAX) 1547 sb->sb_family = sb->sb_len; 1548 #endif 1549 sb->sb_len = buflen; 1550 return 0; 1551 } 1552 1553 /* 1554 * XXX In a perfect world, we wouldn't pass around socket control 1555 * XXX arguments in mbufs, and this could go away. 1556 */ 1557 int 1558 sockargs(struct mbuf **mp, const void *bf, size_t buflen, enum uio_seg seg, 1559 int type) 1560 { 1561 struct mbuf *m; 1562 int error; 1563 1564 /* 1565 * We can't allow socket names > UCHAR_MAX in length, since that 1566 * will overflow sa_len. Control data more than a page size in 1567 * length is just too much. 1568 */ 1569 if (buflen > (type == MT_SONAME ? UCHAR_MAX : PAGE_SIZE)) 1570 return SET_ERROR(EINVAL); 1571 1572 /* 1573 * length must greater than sizeof(sa_family) + sizeof(sa_len) 1574 */ 1575 if (type == MT_SONAME && buflen <= 2) 1576 return SET_ERROR(EINVAL); 1577 1578 /* Allocate an mbuf to hold the arguments. */ 1579 m = m_get(M_WAIT, type); 1580 /* can't claim. don't who to assign it to. */ 1581 if (buflen > MLEN) { 1582 /* 1583 * Won't fit into a regular mbuf, so we allocate just 1584 * enough external storage to hold the argument. 1585 */ 1586 MEXTMALLOC(m, buflen, M_WAITOK); 1587 } 1588 m->m_len = buflen; 1589 if (seg == UIO_USERSPACE) { 1590 error = copyin(bf, mtod(m, void *), buflen); 1591 if (error) { 1592 (void)m_free(m); 1593 return error; 1594 } 1595 } else { 1596 memcpy(mtod(m, void *), bf, buflen); 1597 } 1598 *mp = m; 1599 switch (type) { 1600 case MT_SONAME: 1601 ktrkuser(mbuftypes[type], mtod(m, void *), buflen); 1602 1603 struct sockaddr *sa = mtod(m, struct sockaddr *); 1604 #if BYTE_ORDER != BIG_ENDIAN 1605 /* 1606 * 4.3BSD compat thing - need to stay, since bind(2), 1607 * connect(2), sendto(2) were not versioned for COMPAT_43. 1608 */ 1609 if (sa->sa_family == 0 && sa->sa_len < AF_MAX) 1610 sa->sa_family = sa->sa_len; 1611 #endif 1612 sa->sa_len = buflen; 1613 return 0; 1614 case MT_CONTROL: 1615 if (!KTRPOINT(curproc, KTR_USER)) 1616 return 0; 1617 1618 struct msghdr mhdr; 1619 mhdr.msg_control = mtod(m, void *); 1620 mhdr.msg_controllen = buflen; 1621 for (struct cmsghdr *cmsg = CMSG_FIRSTHDR(&mhdr); cmsg; 1622 cmsg = CMSG_NXTHDR(&mhdr, cmsg)) { 1623 KASSERT(((char *)cmsg - mtod(m, char *)) <= buflen); 1624 if (cmsg->cmsg_len > 1625 buflen - ((char *)cmsg - mtod(m, char *))) 1626 break; 1627 ktrkuser(mbuftypes[type], cmsg, cmsg->cmsg_len); 1628 } 1629 return 0; 1630 default: 1631 return SET_ERROR(EINVAL); 1632 } 1633 } 1634 1635 int 1636 do_sys_peeloff(struct socket *head, void *data) 1637 { 1638 #ifdef SCTP 1639 /*file_t *lfp = NULL;*/ 1640 file_t *nfp = NULL; 1641 int error; 1642 struct socket *so; 1643 int fd; 1644 uint32_t name; 1645 /*short fflag;*/ /* type must match fp->f_flag */ 1646 1647 name = *(uint32_t *) data; 1648 error = sctp_can_peel_off(head, name); 1649 if (error) { 1650 printf("peeloff failed\n"); 1651 return error; 1652 } 1653 /* 1654 * At this point we know we do have a assoc to pull 1655 * we proceed to get the fd setup. This may block 1656 * but that is ok. 1657 */ 1658 error = fd_allocfile(&nfp, &fd); 1659 if (error) { 1660 /* 1661 * Probably ran out of file descriptors. Put the 1662 * unaccepted connection back onto the queue and 1663 * do another wakeup so some other process might 1664 * have a chance at it. 1665 */ 1666 return error; 1667 } 1668 *(int *) data = fd; 1669 1670 so = sctp_get_peeloff(head, name, &error); 1671 if (so == NULL) { 1672 /* 1673 * Either someone else peeled it off OR 1674 * we can't get a socket. 1675 * close the new descriptor, assuming someone hasn't ripped it 1676 * out from under us. 1677 */ 1678 mutex_enter(&nfp->f_lock); 1679 nfp->f_count++; 1680 mutex_exit(&nfp->f_lock); 1681 fd_abort(curlwp->l_proc, nfp, fd); 1682 return error; 1683 } 1684 so->so_state &= ~SS_NOFDREF; 1685 so->so_state &= ~SS_ISCONNECTING; 1686 so->so_head = NULL; 1687 so->so_cred = kauth_cred_hold(head->so_cred); 1688 nfp->f_socket = so; 1689 nfp->f_flag = FREAD|FWRITE; 1690 nfp->f_ops = &socketops; 1691 nfp->f_type = DTYPE_SOCKET; 1692 1693 fd_affix(curlwp->l_proc, nfp, fd); 1694 1695 return error; 1696 #else 1697 return SET_ERROR(EOPNOTSUPP); 1698 #endif 1699 } 1700
Indexes created Sun Oct 25 00:26:45 UTC 2026