1 /* $NetBSD: uipc_syscalls.c,v 1.215 2025/07/16 19:14:13 kre Exp $ */ 2 3 /*- 4 * Copyright (c) 2008, 2009, 2023 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Andrew Doran. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (c) 1982, 1986, 1989, 1990, 1993 34 * The Regents of the University of California. All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. Neither the name of the University nor the names of its contributors 45 * may be used to endorse or promote products derived from this software 46 * without specific prior written permission. 47 * 48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 58 * SUCH DAMAGE. 59 * 60 * @(#)uipc_syscalls.c 8.6 (Berkeley) 2/14/95 61 */ 62 63 #define MBUFTYPES 64 65 #include <sys/cdefs.h> 66 __KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.215 2025/07/16 19:14:13 kre Exp $"); 67 68 #ifdef _KERNEL_OPT 69 #include "opt_pipe.h" 70 #include "opt_sctp.h" 71 #endif 72 73 #include <sys/param.h> 74 #include <sys/types.h> 75 76 #include <sys/atomic.h> 77 #include <sys/buf.h> 78 #include <sys/event.h> 79 #include <sys/file.h> 80 #include <sys/filedesc.h> 81 #include <sys/kauth.h> 82 #include <sys/ktrace.h> 83 #include <sys/mbuf.h> 84 #include <sys/mount.h> 85 #include <sys/proc.h> 86 #include <sys/protosw.h> 87 #include <sys/sdt.h> 88 #include <sys/signalvar.h> 89 #include <sys/socket.h> 90 #include <sys/socketvar.h> 91 #include <sys/syscallargs.h> 92 #include <sys/systm.h> 93 #include <sys/un.h> 94 95 #ifdef SCTP 96 #include <netinet/sctp_peeloff.h> 97 #include <netinet/sctp_uio.h> 98 #endif 99 100 /* 101 * System call interface to the socket abstraction. 102 */ 103 extern const struct fileops socketops; 104 105 static int sockargs_sb(struct sockaddr_big *, const void *, socklen_t); 106 107 int 108 sys___socket30(struct lwp *l, const struct sys___socket30_args *uap, 109 register_t *retval) 110 { 111 /* { 112 syscallarg(int) domain; 113 syscallarg(int) type; 114 syscallarg(int) protocol; 115 } */ 116 int fd, error; 117 file_t *fp; 118 119 error = fsocreate(SCARG(uap, domain), NULL, SCARG(uap, type), 120 SCARG(uap, protocol), &fd, &fp, NULL); 121 if (error == 0) { 122 fd_affix(l->l_proc, fp, fd); 123 *retval = fd; 124 } 125 return error; 126 } 127 128 int 129 sys_bind(struct lwp *l, const struct sys_bind_args *uap, register_t *retval) 130 { 131 /* { 132 syscallarg(int) s; 133 syscallarg(const struct sockaddr *) name; 134 syscallarg(unsigned int) namelen; 135 } */ 136 int error; 137 struct sockaddr_big sb; 138 139 error = sockargs_sb(&sb, SCARG(uap, name), SCARG(uap, namelen)); 140 if (error) 141 return error; 142 143 return do_sys_bind(l, SCARG(uap, s), (struct sockaddr *)&sb); 144 } 145 146 int 147 do_sys_bind(struct lwp *l, int fd, struct sockaddr *nam) 148 { 149 struct socket *so; 150 int error; 151 152 if ((error = fd_getsock(fd, &so)) != 0) 153 return error; 154 error = sobind(so, nam, l); 155 fd_putfile(fd); 156 return error; 157 } 158 159 int 160 sys_listen(struct lwp *l, const struct sys_listen_args *uap, register_t *retval) 161 { 162 /* { 163 syscallarg(int) s; 164 syscallarg(int) backlog; 165 } */ 166 struct socket *so; 167 int error; 168 169 if ((error = fd_getsock(SCARG(uap, s), &so)) != 0) 170 return (error); 171 error = solisten(so, SCARG(uap, backlog), l); 172 fd_putfile(SCARG(uap, s)); 173 return error; 174 } 175 176 int 177 do_sys_accept(struct lwp *l, int sock, struct sockaddr *name, 178 register_t *new_sock, const sigset_t *mask, int flags, int clrflags) 179 { 180 file_t *fp, *fp2; 181 int error, fd; 182 struct socket *so, *so2; 183 short wakeup_state = 0; 184 185 if ((fp = fd_getfile(sock)) == NULL) 186 return SET_ERROR(EBADF); 187 if (fp->f_type != DTYPE_SOCKET) { 188 fd_putfile(sock); 189 return SET_ERROR(ENOTSOCK); 190 } 191 if ((error = fd_allocfile(&fp2, &fd)) != 0) { 192 fd_putfile(sock); 193 return error; 194 } 195 *new_sock = fd; 196 so = fp->f_socket; 197 solock(so); 198 199 if (__predict_false(mask)) 200 sigsuspendsetup(l, mask); 201 202 if (!(so->so_proto->pr_flags & PR_LISTEN)) { 203 error = SET_ERROR(EOPNOTSUPP); 204 goto bad; 205 } 206 if ((so->so_options & SO_ACCEPTCONN) == 0) { 207 error = SET_ERROR(EINVAL); 208 goto bad; 209 } 210 if ((so->so_state & SS_NBIO) && so->so_qlen == 0) { 211 error = SET_ERROR(EWOULDBLOCK); 212 goto bad; 213 } 214 while (so->so_qlen == 0 && so->so_error == 0) { 215 if (so->so_state & SS_CANTRCVMORE) { 216 so->so_error = SET_ERROR(ECONNABORTED); 217 break; 218 } 219 if (wakeup_state & SS_RESTARTSYS) { 220 error = SET_ERROR(ERESTART); 221 goto bad; 222 } 223 error = sowait(so, true, 0); 224 if (error) { 225 goto bad; 226 } 227 wakeup_state = so->so_state; 228 } 229 if (so->so_error) { 230 error = SET_ERROR(so->so_error); 231 so->so_error = 0; 232 goto bad; 233 } 234 /* connection has been removed from the listen queue */ 235 KNOTE(&so->so_rcv.sb_sel.sel_klist, NOTE_SUBMIT); 236 so2 = TAILQ_FIRST(&so->so_q); 237 if (soqremque(so2, 1) == 0) 238 panic("accept"); 239 fp2->f_type = DTYPE_SOCKET; 240 fp2->f_flag = (fp->f_flag & ~clrflags) | 241 ((flags & SOCK_NONBLOCK) ? FNONBLOCK : 0)| 242 ((flags & SOCK_NOSIGPIPE) ? FNOSIGPIPE : 0); 243 fp2->f_ops = &socketops; 244 fp2->f_socket = so2; 245 if (fp2->f_flag & FNONBLOCK) 246 so2->so_state |= SS_NBIO; 247 else 248 so2->so_state &= ~SS_NBIO; 249 error = soaccept(so2, name); 250 so2->so_cred = kauth_cred_hold(so->so_cred); 251 sounlock(so); 252 if (error) { 253 /* an error occurred, free the file descriptor and mbuf */ 254 mutex_enter(&fp2->f_lock); 255 fp2->f_count++; 256 mutex_exit(&fp2->f_lock); 257 closef(fp2); 258 fd_abort(curproc, NULL, fd); 259 } else { 260 fd_set_exclose(l, fd, (flags & SOCK_CLOEXEC) != 0); 261 fd_set_foclose(l, fd, (flags & SOCK_CLOFORK) != 0); 262 fd_affix(curproc, fp2, fd); 263 } 264 fd_putfile(sock); 265 if (__predict_false(mask)) 266 sigsuspendteardown(l); 267 return error; 268 bad: 269 sounlock(so); 270 fd_putfile(sock); 271 fd_abort(curproc, fp2, fd); 272 if (__predict_false(mask)) 273 sigsuspendteardown(l); 274 return error; 275 } 276 277 int 278 sys_accept(struct lwp *l, const struct sys_accept_args *uap, register_t *retval) 279 { 280 /* { 281 syscallarg(int) s; 282 syscallarg(struct sockaddr *) name; 283 syscallarg(unsigned int *) anamelen; 284 } */ 285 int error, fd; 286 struct sockaddr_big name; 287 288 name.sb_len = UCHAR_MAX; 289 error = do_sys_accept(l, SCARG(uap, s), (struct sockaddr *)&name, 290 retval, NULL, 0, 0); 291 if (error != 0) 292 return error; 293 error = copyout_sockname_sb(SCARG(uap, name), SCARG(uap, anamelen), 294 MSG_LENUSRSPACE, &name); 295 if (error != 0) { 296 fd = (int)*retval; 297 if (fd_getfile(fd) != NULL) 298 (void)fd_close(fd); 299 } 300 return error; 301 } 302 303 int 304 sys_paccept(struct lwp *l, const struct sys_paccept_args *uap, 305 register_t *retval) 306 { 307 /* { 308 syscallarg(int) s; 309 syscallarg(struct sockaddr *) name; 310 syscallarg(unsigned int *) anamelen; 311 syscallarg(const sigset_t *) mask; 312 syscallarg(int) flags; 313 } */ 314 int error, fd; 315 struct sockaddr_big name; 316 sigset_t *mask, amask; 317 318 if (SCARG(uap, mask) != NULL) { 319 error = copyin(SCARG(uap, mask), &amask, sizeof(amask)); 320 if (error) 321 return error; 322 mask = &amask; 323 } else 324 mask = NULL; 325 326 name.sb_len = UCHAR_MAX; 327 error = do_sys_accept(l, SCARG(uap, s), (struct sockaddr *)&name, 328 retval, mask, SCARG(uap, flags), FNONBLOCK); 329 if (error != 0) 330 return error; 331 error = copyout_sockname_sb(SCARG(uap, name), SCARG(uap, anamelen), 332 MSG_LENUSRSPACE, &name); 333 if (error != 0) { 334 fd = (int)*retval; 335 if (fd_getfile(fd) != NULL) 336 (void)fd_close(fd); 337 } 338 return error; 339 } 340 341 int 342 sys_connect(struct lwp *l, const struct sys_connect_args *uap, 343 register_t *retval) 344 { 345 /* { 346 syscallarg(int) s; 347 syscallarg(const struct sockaddr *) name; 348 syscallarg(unsigned int) namelen; 349 } */ 350 int error; 351 struct sockaddr_big sbig; 352 353 error = sockargs_sb(&sbig, SCARG(uap, name), SCARG(uap, namelen)); 354 if (error) 355 return error; 356 return do_sys_connect(l, SCARG(uap, s), (struct sockaddr *)&sbig); 357 } 358 359 int 360 do_sys_connect(struct lwp *l, int fd, struct sockaddr *nam) 361 { 362 struct socket *so; 363 int error; 364 int interrupted = 0; 365 366 if ((error = fd_getsock(fd, &so)) != 0) { 367 return (error); 368 } 369 solock(so); 370 if ((so->so_state & SS_ISCONNECTING) != 0) { 371 error = SET_ERROR(EALREADY); 372 goto out; 373 } 374 375 error = soconnect(so, nam, l); 376 if (error) 377 goto bad; 378 if ((so->so_state & (SS_NBIO|SS_ISCONNECTING)) == 379 (SS_NBIO|SS_ISCONNECTING)) { 380 error = SET_ERROR(EINPROGRESS); 381 goto out; 382 } 383 while ((so->so_state & SS_ISCONNECTING) != 0 && so->so_error == 0) { 384 error = sowait(so, true, 0); 385 if (__predict_false((so->so_state & SS_ISABORTING) != 0)) { 386 error = SET_ERROR(EPIPE); 387 interrupted = 1; 388 break; 389 } 390 if (error) { 391 if (error == EINTR || error == ERESTART) 392 interrupted = 1; 393 break; 394 } 395 } 396 if (error == 0) { 397 error = SET_ERROR(so->so_error); 398 so->so_error = 0; 399 } 400 bad: 401 if (!interrupted) 402 so->so_state &= ~SS_ISCONNECTING; 403 if (error == ERESTART) 404 error = SET_ERROR(EINTR); 405 out: 406 sounlock(so); 407 fd_putfile(fd); 408 return error; 409 } 410 411 int 412 sys_socketpair(struct lwp *l, const struct sys_socketpair_args *uap, 413 register_t *retval) 414 { 415 /* { 416 syscallarg(int) domain; 417 syscallarg(int) type; 418 syscallarg(int) protocol; 419 syscallarg(int *) rsv; 420 } */ 421 file_t *fp1, *fp2; 422 struct socket *so1, *so2; 423 int fd, error, sv[2]; 424 proc_t *p = curproc; 425 int flags = SCARG(uap, type) & SOCK_FLAGS_MASK; 426 int type = SCARG(uap, type) & ~SOCK_FLAGS_MASK; 427 int domain = SCARG(uap, domain); 428 int proto = SCARG(uap, protocol); 429 430 error = fsocreate(domain, &so1, type|flags, proto, &fd, &fp1, NULL); 431 if (error) 432 return error; 433 sv[0] = fd; 434 435 error = fsocreate(domain, &so2, type|flags, proto, &fd, &fp2, so1); 436 if (error) 437 goto out; 438 sv[1] = fd; 439 440 solock(so1); 441 error = soconnect2(so1, so2); 442 if (error == 0 && type == SOCK_DGRAM) { 443 /* 444 * Datagram socket connection is asymmetric. 445 */ 446 error = soconnect2(so2, so1); 447 } 448 sounlock(so1); 449 450 if (error == 0) 451 error = copyout(sv, SCARG(uap, rsv), sizeof(sv)); 452 if (error == 0) { 453 fd_affix(p, fp2, sv[1]); 454 fd_affix(p, fp1, sv[0]); 455 return 0; 456 } 457 fd_abort(p, fp2, sv[1]); 458 (void)soclose(so2); 459 out: 460 fd_abort(p, fp1, sv[0]); 461 (void)soclose(so1); 462 return error; 463 } 464 465 int 466 sys_sendto(struct lwp *l, const struct sys_sendto_args *uap, 467 register_t *retval) 468 { 469 /* { 470 syscallarg(int) s; 471 syscallarg(const void *) buf; 472 syscallarg(size_t) len; 473 syscallarg(int) flags; 474 syscallarg(const struct sockaddr *) to; 475 syscallarg(unsigned int) tolen; 476 } */ 477 struct msghdr msg = {0}; 478 struct iovec aiov; 479 480 msg.msg_name = __UNCONST(SCARG(uap, to)); /* XXXUNCONST kills const */ 481 msg.msg_namelen = SCARG(uap, tolen); 482 msg.msg_iov = &aiov; 483 msg.msg_iovlen = 1; 484 msg.msg_control = NULL; 485 msg.msg_flags = 0; 486 aiov.iov_base = __UNCONST(SCARG(uap, buf)); /* XXXUNCONST kills const */ 487 aiov.iov_len = SCARG(uap, len); 488 return do_sys_sendmsg(l, SCARG(uap, s), &msg, SCARG(uap, flags), 489 retval); 490 } 491 492 int 493 sys_sendmsg(struct lwp *l, const struct sys_sendmsg_args *uap, 494 register_t *retval) 495 { 496 /* { 497 syscallarg(int) s; 498 syscallarg(const struct msghdr *) msg; 499 syscallarg(int) flags; 500 } */ 501 struct msghdr msg; 502 int error; 503 504 error = copyin(SCARG(uap, msg), &msg, sizeof(msg)); 505 if (error) 506 return (error); 507 508 msg.msg_flags = MSG_IOVUSRSPACE; 509 return do_sys_sendmsg(l, SCARG(uap, s), &msg, SCARG(uap, flags), 510 retval); 511 } 512 513 int 514 do_sys_sendmsg_so(struct lwp *l, int s, struct socket *so, file_t *fp, 515 struct msghdr *mp, int flags, register_t *retsize) 516 { 517 518 struct iovec aiov[UIO_SMALLIOV], *iov = aiov, *tiov, *ktriov = NULL; 519 struct sockaddr *sa = NULL; 520 struct mbuf *to, *control; 521 struct uio auio; 522 size_t len, iovsz; 523 int i, error; 524 525 ktrkuser("msghdr", mp, sizeof(*mp)); 526 527 /* If the caller passed us stuff in mbufs, we must free them. */ 528 to = (mp->msg_flags & MSG_NAMEMBUF) ? mp->msg_name : NULL; 529 control = (mp->msg_flags & MSG_CONTROLMBUF) ? mp->msg_control : NULL; 530 iovsz = mp->msg_iovlen * sizeof(struct iovec); 531 532 if (mp->msg_flags & MSG_IOVUSRSPACE) { 533 if ((unsigned int)mp->msg_iovlen > UIO_SMALLIOV) { 534 if ((unsigned int)mp->msg_iovlen > IOV_MAX) { 535 error = SET_ERROR(EMSGSIZE); 536 goto bad; 537 } 538 iov = kmem_alloc(iovsz, KM_SLEEP); 539 } 540 if (mp->msg_iovlen != 0) { 541 error = copyin(mp->msg_iov, iov, iovsz); 542 if (error) 543 goto bad; 544 } 545 auio.uio_iov = iov; 546 } else 547 auio.uio_iov = mp->msg_iov; 548 549 auio.uio_iovcnt = mp->msg_iovlen; 550 auio.uio_rw = UIO_WRITE; 551 auio.uio_offset = 0; /* XXX */ 552 auio.uio_resid = 0; 553 KASSERT(l == curlwp); 554 auio.uio_vmspace = l->l_proc->p_vmspace; 555 556 tiov = auio.uio_iov; 557 for (i = 0; i < auio.uio_iovcnt; i++, tiov++) { 558 /* 559 * Writes return ssize_t because -1 is returned on error. 560 * Therefore, we must restrict the length to SSIZE_MAX to 561 * avoid garbage return values. 562 */ 563 auio.uio_resid += tiov->iov_len; 564 if (tiov->iov_len > SSIZE_MAX || auio.uio_resid > SSIZE_MAX) { 565 error = SET_ERROR(EINVAL); 566 goto bad; 567 } 568 } 569 570 if (mp->msg_name && to == NULL) { 571 error = sockargs(&to, mp->msg_name, mp->msg_namelen, 572 UIO_USERSPACE, MT_SONAME); 573 if (error) 574 goto bad; 575 } 576 577 if (mp->msg_control) { 578 if (mp->msg_controllen < CMSG_ALIGN(sizeof(struct cmsghdr))) { 579 error = SET_ERROR(EINVAL); 580 goto bad; 581 } 582 if (control == NULL) { 583 error = sockargs(&control, mp->msg_control, 584 mp->msg_controllen, UIO_USERSPACE, MT_CONTROL); 585 if (error) 586 goto bad; 587 } 588 } 589 590 if (ktrpoint(KTR_GENIO) && iovsz > 0) { 591 ktriov = kmem_alloc(iovsz, KM_SLEEP); 592 memcpy(ktriov, auio.uio_iov, iovsz); 593 } 594 595 if (mp->msg_name) 596 MCLAIM(to, so->so_mowner); 597 if (mp->msg_control) 598 MCLAIM(control, so->so_mowner); 599 600 if (to) { 601 sa = mtod(to, struct sockaddr *); 602 } 603 604 len = auio.uio_resid; 605 error = (*so->so_send)(so, sa, &auio, NULL, control, flags, l); 606 /* Protocol is responsible for freeing 'control' */ 607 control = NULL; 608 609 if (error) { 610 if (auio.uio_resid != len && (error == ERESTART || 611 error == EINTR || error == EWOULDBLOCK)) 612 error = 0; 613 if (error == EPIPE && (fp->f_flag & FNOSIGPIPE) == 0 && 614 (flags & MSG_NOSIGNAL) == 0) { 615 mutex_enter(&proc_lock); 616 psignal(l->l_proc, SIGPIPE); 617 mutex_exit(&proc_lock); 618 } 619 } 620 if (error == 0) 621 *retsize = len - auio.uio_resid; 622 623 bad: 624 if (ktriov != NULL) { 625 ktrgeniov(s, UIO_WRITE, ktriov, *retsize, error); 626 kmem_free(ktriov, iovsz); 627 } 628 629 if (iov != aiov) 630 kmem_free(iov, iovsz); 631 m_freem(to); 632 m_freem(control); 633 634 return error; 635 } 636 637 int 638 do_sys_sendmsg(struct lwp *l, int s, struct msghdr *mp, int flags, 639 register_t *retsize) 640 { 641 int error; 642 struct socket *so; 643 file_t *fp; 644 645 if ((error = fd_getsock1(s, &so, &fp)) != 0) { 646 /* We have to free msg_name and msg_control ourselves */ 647 if (mp->msg_flags & MSG_NAMEMBUF) 648 m_freem(mp->msg_name); 649 if (mp->msg_flags & MSG_CONTROLMBUF) 650 m_freem(mp->msg_control); 651 return error; 652 } 653 error = do_sys_sendmsg_so(l, s, so, fp, mp, flags, retsize); 654 /* msg_name and msg_control freed */ 655 fd_putfile(s); 656 return error; 657 } 658 659 int 660 sys_recvfrom(struct lwp *l, const struct sys_recvfrom_args *uap, 661 register_t *retval) 662 { 663 /* { 664 syscallarg(int) s; 665 syscallarg(void *) buf; 666 syscallarg(size_t) len; 667 syscallarg(int) flags; 668 syscallarg(struct sockaddr *) from; 669 syscallarg(unsigned int *) fromlenaddr; 670 } */ 671 struct msghdr msg = {0}; 672 struct iovec aiov; 673 int error; 674 struct mbuf *from; 675 676 msg.msg_name = NULL; 677 msg.msg_iov = &aiov; 678 msg.msg_iovlen = 1; 679 aiov.iov_base = SCARG(uap, buf); 680 aiov.iov_len = SCARG(uap, len); 681 msg.msg_control = NULL; 682 msg.msg_flags = SCARG(uap, flags) & MSG_USERFLAGS; 683 684 error = do_sys_recvmsg(l, SCARG(uap, s), &msg, &from, NULL, retval); 685 if (error != 0) 686 return error; 687 688 error = copyout_sockname(SCARG(uap, from), SCARG(uap, fromlenaddr), 689 MSG_LENUSRSPACE, from); 690 if (from != NULL) 691 m_free(from); 692 return error; 693 } 694 695 int 696 sys_recvmsg(struct lwp *l, const struct sys_recvmsg_args *uap, 697 register_t *retval) 698 { 699 /* { 700 syscallarg(int) s; 701 syscallarg(struct msghdr *) msg; 702 syscallarg(int) flags; 703 } */ 704 struct msghdr msg; 705 int error; 706 struct mbuf *from, *control; 707 708 error = copyin(SCARG(uap, msg), &msg, sizeof(msg)); 709 if (error) 710 return error; 711 712 msg.msg_flags = (SCARG(uap, flags) & MSG_USERFLAGS) | MSG_IOVUSRSPACE; 713 714 error = do_sys_recvmsg(l, SCARG(uap, s), &msg, &from, 715 msg.msg_control != NULL ? &control : NULL, retval); 716 if (error != 0) 717 return error; 718 719 if (msg.msg_control != NULL) 720 error = copyout_msg_control(l, &msg, control); 721 722 if (error == 0) 723 error = copyout_sockname(msg.msg_name, &msg.msg_namelen, 0, 724 from); 725 if (from != NULL) 726 m_free(from); 727 if (error == 0) { 728 ktrkuser("msghdr", &msg, sizeof(msg)); 729 error = copyout(&msg, SCARG(uap, msg), sizeof(msg)); 730 } 731 732 return error; 733 } 734 735 int 736 sys_sendmmsg(struct lwp *l, const struct sys_sendmmsg_args *uap, 737 register_t *retval) 738 { 739 /* { 740 syscallarg(int) s; 741 syscallarg(struct mmsghdr *) mmsg; 742 syscallarg(unsigned int) vlen; 743 syscallarg(unsigned int) flags; 744 } */ 745 struct mmsghdr mmsg; 746 struct socket *so; 747 file_t *fp; 748 struct msghdr *msg = &mmsg.msg_hdr; 749 int error, s; 750 unsigned int vlen, flags, dg; 751 752 s = SCARG(uap, s); 753 if ((error = fd_getsock1(s, &so, &fp)) != 0) 754 return error; 755 756 vlen = SCARG(uap, vlen); 757 if (vlen > 1024) 758 vlen = 1024; 759 760 flags = (SCARG(uap, flags) & MSG_USERFLAGS) | MSG_IOVUSRSPACE; 761 762 for (dg = 0; dg < vlen;) { 763 error = copyin(SCARG(uap, mmsg) + dg, &mmsg, sizeof(mmsg)); 764 if (error) 765 break; 766 767 msg->msg_flags = flags; 768 769 error = do_sys_sendmsg_so(l, s, so, fp, msg, flags, retval); 770 if (error) 771 break; 772 773 ktrkuser("msghdr", msg, sizeof(*msg)); 774 mmsg.msg_len = *retval; 775 error = copyout(&mmsg, SCARG(uap, mmsg) + dg, sizeof(mmsg)); 776 if (error) 777 break; 778 dg++; 779 780 } 781 782 *retval = dg; 783 784 fd_putfile(s); 785 786 /* 787 * If we succeeded at least once, return 0. 788 */ 789 if (dg) 790 return 0; 791 return error; 792 } 793 794 /* 795 * Adjust for a truncated SCM_RIGHTS control message. 796 * This means closing any file descriptors that aren't present 797 * in the returned buffer. 798 * m is the mbuf holding the (already externalized) SCM_RIGHTS message. 799 */ 800 static void 801 free_rights(struct mbuf *m) 802 { 803 struct cmsghdr *cm; 804 int *fdv; 805 unsigned int nfds, i; 806 807 KASSERT(sizeof(*cm) <= m->m_len); 808 cm = mtod(m, struct cmsghdr *); 809 810 KASSERT(CMSG_ALIGN(sizeof(*cm)) <= cm->cmsg_len); 811 KASSERT(cm->cmsg_len <= m->m_len); 812 nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int); 813 fdv = (int *)CMSG_DATA(cm); 814 815 for (i = 0; i < nfds; i++) 816 if (fd_getfile(fdv[i]) != NULL) 817 (void)fd_close(fdv[i]); 818 } 819 820 void 821 free_control_mbuf(struct lwp *l, struct mbuf *control, struct mbuf *uncopied) 822 { 823 struct mbuf *next; 824 struct cmsghdr *cmsg; 825 bool do_free_rights = false; 826 827 while (control != NULL) { 828 cmsg = mtod(control, struct cmsghdr *); 829 if (control == uncopied) 830 do_free_rights = true; 831 if (do_free_rights && cmsg->cmsg_level == SOL_SOCKET 832 && cmsg->cmsg_type == SCM_RIGHTS) 833 free_rights(control); 834 next = control->m_next; 835 m_free(control); 836 control = next; 837 } 838 } 839 840 /* Copy socket control/CMSG data to user buffer, frees the mbuf */ 841 int 842 copyout_msg_control(struct lwp *l, struct msghdr *mp, struct mbuf *control) 843 { 844 int i, len, error = 0; 845 struct cmsghdr *cmsg; 846 struct mbuf *m; 847 char *q; 848 849 len = mp->msg_controllen; 850 if (len <= 0 || control == 0) { 851 mp->msg_controllen = 0; 852 free_control_mbuf(l, control, control); 853 return 0; 854 } 855 856 q = (char *)mp->msg_control; 857 858 for (m = control; m != NULL; ) { 859 cmsg = mtod(m, struct cmsghdr *); 860 i = m->m_len; 861 if (len < i) { 862 mp->msg_flags |= MSG_CTRUNC; 863 if (cmsg->cmsg_level == SOL_SOCKET 864 && cmsg->cmsg_type == SCM_RIGHTS) 865 /* Do not truncate me ... */ 866 break; 867 i = len; 868 } 869 error = copyout(mtod(m, void *), q, i); 870 ktrkuser(mbuftypes[MT_CONTROL], cmsg, cmsg->cmsg_len); 871 if (error != 0) { 872 /* We must free all the SCM_RIGHTS */ 873 m = control; 874 break; 875 } 876 m = m->m_next; 877 if (m) 878 i = ALIGN(i); 879 q += i; 880 len -= i; 881 if (len <= 0) 882 break; 883 } 884 885 free_control_mbuf(l, control, m); 886 887 mp->msg_controllen = q - (char *)mp->msg_control; 888 return error; 889 } 890 891 int 892 do_sys_recvmsg_so(struct lwp *l, int s, struct socket *so, struct msghdr *mp, 893 struct mbuf **from, struct mbuf **control, register_t *retsize) 894 { 895 struct iovec aiov[UIO_SMALLIOV], *iov = aiov, *tiov, *ktriov = NULL; 896 struct uio auio; 897 size_t len, iovsz; 898 int i, error; 899 900 ktrkuser("msghdr", mp, sizeof(*mp)); 901 902 *from = NULL; 903 if (control != NULL) 904 *control = NULL; 905 906 iovsz = mp->msg_iovlen * sizeof(struct iovec); 907 908 if (mp->msg_flags & MSG_IOVUSRSPACE) { 909 if ((unsigned int)mp->msg_iovlen > UIO_SMALLIOV) { 910 if ((unsigned int)mp->msg_iovlen > IOV_MAX) { 911 error = SET_ERROR(EMSGSIZE); 912 goto out; 913 } 914 iov = kmem_alloc(iovsz, KM_SLEEP); 915 } 916 if (mp->msg_iovlen != 0) { 917 error = copyin(mp->msg_iov, iov, iovsz); 918 if (error) 919 goto out; 920 } 921 auio.uio_iov = iov; 922 } else 923 auio.uio_iov = mp->msg_iov; 924 auio.uio_iovcnt = mp->msg_iovlen; 925 auio.uio_rw = UIO_READ; 926 auio.uio_offset = 0; /* XXX */ 927 auio.uio_resid = 0; 928 KASSERT(l == curlwp); 929 auio.uio_vmspace = l->l_proc->p_vmspace; 930 931 tiov = auio.uio_iov; 932 for (i = 0; i < auio.uio_iovcnt; i++, tiov++) { 933 /* 934 * Reads return ssize_t because -1 is returned on error. 935 * Therefore we must restrict the length to SSIZE_MAX to 936 * avoid garbage return values. 937 */ 938 auio.uio_resid += tiov->iov_len; 939 if (tiov->iov_len > SSIZE_MAX || auio.uio_resid > SSIZE_MAX) { 940 error = SET_ERROR(EINVAL); 941 goto out; 942 } 943 } 944 945 if (ktrpoint(KTR_GENIO) && iovsz > 0) { 946 ktriov = kmem_alloc(iovsz, KM_SLEEP); 947 memcpy(ktriov, auio.uio_iov, iovsz); 948 } 949 950 len = auio.uio_resid; 951 mp->msg_flags &= MSG_USERFLAGS; 952 error = (*so->so_receive)(so, from, &auio, NULL, control, 953 &mp->msg_flags); 954 KASSERT(*from == NULL || (*from)->m_next == NULL); 955 len -= auio.uio_resid; 956 *retsize = len; 957 if (error != 0 && len != 0 958 && (error == ERESTART || error == EINTR || error == EWOULDBLOCK)) 959 /* Some data transferred */ 960 error = 0; 961 962 if (ktriov != NULL) { 963 ktrgeniov(s, UIO_READ, ktriov, len, error); 964 kmem_free(ktriov, iovsz); 965 } 966 967 if (error != 0) { 968 m_freem(*from); 969 *from = NULL; 970 if (control != NULL) { 971 free_control_mbuf(l, *control, *control); 972 *control = NULL; 973 } 974 } 975 out: 976 if (iov != aiov) 977 kmem_free(iov, iovsz); 978 return error; 979 } 980 981 982 int 983 do_sys_recvmsg(struct lwp *l, int s, struct msghdr *mp, 984 struct mbuf **from, struct mbuf **control, register_t *retsize) 985 { 986 int error; 987 struct socket *so; 988 989 if ((error = fd_getsock(s, &so)) != 0) 990 return error; 991 error = do_sys_recvmsg_so(l, s, so, mp, from, control, retsize); 992 fd_putfile(s); 993 return error; 994 } 995 996 int 997 sys_recvmmsg(struct lwp *l, const struct sys_recvmmsg_args *uap, 998 register_t *retval) 999 { 1000 /* { 1001 syscallarg(int) s; 1002 syscallarg(struct mmsghdr *) mmsg; 1003 syscallarg(unsigned int) vlen; 1004 syscallarg(unsigned int) flags; 1005 syscallarg(struct timespec *) timeout; 1006 } */ 1007 struct mmsghdr mmsg; 1008 struct socket *so; 1009 struct msghdr *msg = &mmsg.msg_hdr; 1010 int error, s; 1011 struct mbuf *from, *control; 1012 struct timespec ts, now; 1013 unsigned int vlen, flags, dg; 1014 1015 if (SCARG(uap, timeout)) { 1016 if ((error = copyin(SCARG(uap, timeout), &ts, sizeof(ts))) != 0) 1017 return error; 1018 if (ts.tv_nsec < 0 || ts.tv_nsec >= 1000000000L) 1019 return SET_ERROR(EINVAL); 1020 getnanotime(&now); 1021 if (timespecaddok(&now, &ts)) { 1022 timespecadd(&now, &ts, &ts); 1023 } else { 1024 ts.tv_sec = __type_max(time_t); 1025 ts.tv_nsec = 999999999L; 1026 } 1027 } 1028 1029 s = SCARG(uap, s); 1030 if ((error = fd_getsock(s, &so)) != 0) 1031 return error; 1032 1033 /* 1034 * If so->so_rerror holds a deferred error return it now. 1035 */ 1036 if (so->so_rerror) { 1037 error = SET_ERROR(so->so_rerror); 1038 so->so_rerror = 0; 1039 fd_putfile(s); 1040 return error; 1041 } 1042 1043 vlen = SCARG(uap, vlen); 1044 if (vlen > 1024) 1045 vlen = 1024; 1046 1047 from = NULL; 1048 flags = (SCARG(uap, flags) & MSG_USERFLAGS) | MSG_IOVUSRSPACE; 1049 1050 for (dg = 0; dg < vlen;) { 1051 error = copyin(SCARG(uap, mmsg) + dg, &mmsg, sizeof(mmsg)); 1052 if (error) 1053 break; 1054 1055 msg->msg_flags = flags & ~MSG_WAITFORONE; 1056 1057 if (from != NULL) { 1058 m_free(from); 1059 from = NULL; 1060 } 1061 1062 error = do_sys_recvmsg_so(l, s, so, msg, &from, 1063 msg->msg_control != NULL ? &control : NULL, retval); 1064 if (error) { 1065 if (error == EAGAIN && dg > 0) 1066 error = 0; 1067 break; 1068 } 1069 1070 if (msg->msg_control != NULL) 1071 error = copyout_msg_control(l, msg, control); 1072 if (error) 1073 break; 1074 1075 error = copyout_sockname(msg->msg_name, &msg->msg_namelen, 0, 1076 from); 1077 if (error) 1078 break; 1079 1080 ktrkuser("msghdr", msg, sizeof *msg); 1081 mmsg.msg_len = *retval; 1082 1083 error = copyout(&mmsg, SCARG(uap, mmsg) + dg, sizeof(mmsg)); 1084 if (error) 1085 break; 1086 1087 dg++; 1088 if (msg->msg_flags & MSG_OOB) 1089 break; 1090 1091 if (SCARG(uap, timeout)) { 1092 getnanotime(&now); 1093 if (timespeccmp(&ts, &now, <)) 1094 break; 1095 } 1096 1097 if (flags & MSG_WAITFORONE) 1098 flags |= MSG_DONTWAIT; 1099 1100 } 1101 1102 if (from != NULL) 1103 m_free(from); 1104 1105 *retval = dg; 1106 1107 /* 1108 * If we succeeded at least once, return 0, hopefully so->so_rerror 1109 * will catch it next time. 1110 */ 1111 if (error && dg > 0) { 1112 so->so_rerror = error; 1113 error = 0; 1114 } 1115 1116 fd_putfile(s); 1117 1118 return error; 1119 } 1120 1121 int 1122 sys_shutdown(struct lwp *l, const struct sys_shutdown_args *uap, 1123 register_t *retval) 1124 { 1125 /* { 1126 syscallarg(int) s; 1127 syscallarg(int) how; 1128 } */ 1129 struct socket *so; 1130 int error; 1131 1132 if ((error = fd_getsock(SCARG(uap, s), &so)) != 0) 1133 return error; 1134 solock(so); 1135 error = soshutdown(so, SCARG(uap, how)); 1136 sounlock(so); 1137 fd_putfile(SCARG(uap, s)); 1138 return error; 1139 } 1140 1141 int 1142 sys_setsockopt(struct lwp *l, const struct sys_setsockopt_args *uap, 1143 register_t *retval) 1144 { 1145 /* { 1146 syscallarg(int) s; 1147 syscallarg(int) level; 1148 syscallarg(int) name; 1149 syscallarg(const void *) val; 1150 syscallarg(unsigned int) valsize; 1151 } */ 1152 struct sockopt sopt; 1153 struct socket *so; 1154 file_t *fp; 1155 int error; 1156 unsigned int len; 1157 1158 len = SCARG(uap, valsize); 1159 if (len > 0 && SCARG(uap, val) == NULL) 1160 return SET_ERROR(EINVAL); 1161 1162 if (len > MCLBYTES) 1163 return SET_ERROR(EINVAL); 1164 1165 if ((error = fd_getsock1(SCARG(uap, s), &so, &fp)) != 0) 1166 return (error); 1167 1168 sockopt_init(&sopt, SCARG(uap, level), SCARG(uap, name), len); 1169 1170 if (len > 0) { 1171 error = copyin(SCARG(uap, val), sopt.sopt_data, len); 1172 if (error) 1173 goto out; 1174 } 1175 1176 error = sosetopt(so, &sopt); 1177 if (so->so_options & SO_NOSIGPIPE) 1178 atomic_or_uint(&fp->f_flag, FNOSIGPIPE); 1179 else 1180 atomic_and_uint(&fp->f_flag, ~FNOSIGPIPE); 1181 1182 out: 1183 sockopt_destroy(&sopt); 1184 fd_putfile(SCARG(uap, s)); 1185 return error; 1186 } 1187 1188 static int 1189 getsockopt(struct lwp *l, const struct sys_getsockopt_args *uap, 1190 register_t *retval, bool copyarg) 1191 { 1192 struct sockopt sopt; 1193 struct socket *so; 1194 file_t *fp; 1195 unsigned int valsize, len; 1196 int error; 1197 1198 if (SCARG(uap, val) != NULL) { 1199 error = copyin(SCARG(uap, avalsize), &valsize, sizeof(valsize)); 1200 if (error) 1201 return error; 1202 } else 1203 valsize = 0; 1204 1205 if (valsize > MCLBYTES) 1206 return SET_ERROR(EINVAL); 1207 1208 if ((error = fd_getsock1(SCARG(uap, s), &so, &fp)) != 0) 1209 return error; 1210 1211 sockopt_init(&sopt, SCARG(uap, level), SCARG(uap, name), valsize); 1212 if (copyarg && valsize > 0) { 1213 error = copyin(SCARG(uap, val), sopt.sopt_data, valsize); 1214 if (error) 1215 goto out; 1216 } 1217 1218 if (fp->f_flag & FNOSIGPIPE) 1219 so->so_options |= SO_NOSIGPIPE; 1220 else 1221 so->so_options &= ~SO_NOSIGPIPE; 1222 1223 error = sogetopt(so, &sopt); 1224 if (error || valsize == 0) 1225 goto out; 1226 1227 len = uimin(valsize, sopt.sopt_retsize); 1228 error = copyout(sopt.sopt_data, SCARG(uap, val), len); 1229 if (error) 1230 goto out; 1231 1232 error = copyout(&len, SCARG(uap, avalsize), sizeof(len)); 1233 out: 1234 sockopt_destroy(&sopt); 1235 fd_putfile(SCARG(uap, s)); 1236 return error; 1237 } 1238 1239 int 1240 sys_getsockopt(struct lwp *l, const struct sys_getsockopt_args *uap, 1241 register_t *retval) 1242 { 1243 /* { 1244 syscallarg(int) s; 1245 syscallarg(int) level; 1246 syscallarg(int) name; 1247 syscallarg(void *) val; 1248 syscallarg(unsigned int *) avalsize; 1249 } */ 1250 return getsockopt(l, uap, retval, false); 1251 } 1252 1253 int 1254 sys_getsockopt2(struct lwp *l, const struct sys_getsockopt2_args *uap, 1255 register_t *retval) 1256 { 1257 /* { 1258 syscallarg(int) s; 1259 syscallarg(int) level; 1260 syscallarg(int) name; 1261 syscallarg(void *) val; 1262 syscallarg(unsigned int *) avalsize; 1263 } */ 1264 return getsockopt(l, (const struct sys_getsockopt_args *) uap, retval, true); 1265 } 1266 1267 #ifdef PIPE_SOCKETPAIR 1268 1269 int 1270 pipe1(struct lwp *l, int *fildes, int flags) 1271 { 1272 file_t *rf, *wf; 1273 struct socket *rso, *wso; 1274 int error, soflags = 0; 1275 unsigned rfd, wfd; 1276 proc_t *p = l->l_proc; 1277 1278 if (flags & ~(O_CLOEXEC|O_CLOFORK|O_NONBLOCK|O_NOSIGPIPE)) 1279 return SET_ERROR(EINVAL); 1280 if (flags & O_CLOEXEC) 1281 soflags |= SOCK_CLOEXEC; 1282 if (flags & O_CLOFORK) 1283 soflags |= SOCK_CLOFORK; 1284 if (flags & O_NONBLOCK) 1285 soflags |= SOCK_NONBLOCK; 1286 if (flags & O_NOSIGPIPE) 1287 soflags |= SOCK_NOSIGPIPE; 1288 1289 error = fsocreate(AF_LOCAL, &rso, SOCK_STREAM|soflags, 0, &rfd, &rf, 1290 NULL); 1291 if (error) 1292 goto free1; 1293 error = fsocreate(AF_LOCAL, &wso, SOCK_STREAM|soflags, 0, &wfd, &wf, 1294 rso); 1295 if (error) 1296 goto free2; 1297 1298 /* make sure the descriptors are uni-directional */ 1299 rf->f_type = rf->f_type & ~(FWRITE); 1300 wf->f_type = wf->f_type & ~(FREAD); 1301 1302 /* remember this socket pair implements a pipe */ 1303 rso->so_state |= SS_ISAPIPE; 1304 wso->so_state |= SS_ISAPIPE; 1305 1306 solock(wso); 1307 /* 1308 * Pipes must be readable when there is at least 1 1309 * byte of data available in the receive buffer. 1310 * 1311 * Pipes must be writable when there is space for 1312 * at least PIPE_BUF bytes in the send buffer. 1313 * If we're increasing the low water mark for the 1314 * send buffer, then mimic how soreserve() would 1315 * have set the high water mark. 1316 */ 1317 rso->so_rcv.sb_lowat = 1; 1318 if (wso->so_snd.sb_lowat < PIPE_BUF) { 1319 wso->so_snd.sb_hiwat = PIPE_BUF * 2; 1320 } 1321 wso->so_snd.sb_lowat = PIPE_BUF; 1322 error = unp_connect2(wso, rso); 1323 sounlock(wso); 1324 1325 if (error != 0) 1326 goto free3; 1327 1328 fd_affix(p, wf, wfd); 1329 fd_affix(p, rf, rfd); 1330 fildes[0] = rfd; 1331 fildes[1] = wfd; 1332 return (0); 1333 free3: 1334 (void)soclose(wso); 1335 fd_abort(p, wf, wfd); 1336 free2: 1337 (void)soclose(rso); 1338 fd_abort(p, rf, rfd); 1339 free1: 1340 return error; 1341 } 1342 #endif /* PIPE_SOCKETPAIR */ 1343 1344 /* 1345 * Get peer socket name. 1346 */ 1347 int 1348 do_sys_getpeername(int fd, struct sockaddr *nam) 1349 { 1350 struct socket *so; 1351 int error; 1352 1353 if ((error = fd_getsock(fd, &so)) != 0) 1354 return error; 1355 1356 solock(so); 1357 if ((so->so_state & SS_ISCONNECTED) == 0) 1358 error = SET_ERROR(ENOTCONN); 1359 else { 1360 error = (*so->so_proto->pr_usrreqs->pr_peeraddr)(so, nam); 1361 } 1362 sounlock(so); 1363 fd_putfile(fd); 1364 return error; 1365 } 1366 1367 /* 1368 * Get local socket name. 1369 */ 1370 int 1371 do_sys_getsockname(int fd, struct sockaddr *nam) 1372 { 1373 struct socket *so; 1374 int error; 1375 1376 if ((error = fd_getsock(fd, &so)) != 0) 1377 return error; 1378 1379 solock(so); 1380 error = (*so->so_proto->pr_usrreqs->pr_sockaddr)(so, nam); 1381 sounlock(so); 1382 fd_putfile(fd); 1383 return error; 1384 } 1385 1386 int 1387 copyout_sockname_sb(struct sockaddr *asa, unsigned int *alen, int flags, 1388 struct sockaddr_big *addr) 1389 { 1390 unsigned int len; 1391 int error; 1392 1393 if (asa == NULL) 1394 /* Assume application not interested */ 1395 return 0; 1396 1397 if (flags & MSG_LENUSRSPACE) { 1398 error = copyin(alen, &len, sizeof(len)); 1399 if (error) 1400 return error; 1401 } else 1402 len = *alen; 1403 1404 if (addr == NULL) { 1405 len = 0; 1406 error = 0; 1407 } else { 1408 if (len > addr->sb_len) 1409 len = addr->sb_len; 1410 /* XXX addr isn't an mbuf... */ 1411 ktrkuser(mbuftypes[MT_SONAME], addr, len); 1412 error = copyout(addr, asa, len); 1413 } 1414 1415 if (error == 0) { 1416 if (flags & MSG_LENUSRSPACE) 1417 error = copyout(&len, alen, sizeof(len)); 1418 else 1419 *alen = len; 1420 } 1421 1422 return error; 1423 } 1424 1425 int 1426 copyout_sockname(struct sockaddr *asa, unsigned int *alen, int flags, 1427 struct mbuf *addr) 1428 { 1429 int len; 1430 int error; 1431 1432 if (asa == NULL) 1433 /* Assume application not interested */ 1434 return 0; 1435 1436 if (flags & MSG_LENUSRSPACE) { 1437 error = copyin(alen, &len, sizeof(len)); 1438 if (error) 1439 return error; 1440 } else 1441 len = *alen; 1442 if (len < 0) 1443 return SET_ERROR(EINVAL); 1444 1445 if (addr == NULL) { 1446 len = 0; 1447 error = 0; 1448 } else { 1449 if (len > addr->m_len) 1450 len = addr->m_len; 1451 /* Maybe this ought to copy a chain ? */ 1452 ktrkuser(mbuftypes[MT_SONAME], mtod(addr, void *), len); 1453 error = copyout(mtod(addr, void *), asa, len); 1454 } 1455 1456 if (error == 0) { 1457 if (flags & MSG_LENUSRSPACE) 1458 error = copyout(&len, alen, sizeof(len)); 1459 else 1460 *alen = len; 1461 } 1462 1463 return error; 1464 } 1465 1466 /* 1467 * Get socket name. 1468 */ 1469 int 1470 sys_getsockname(struct lwp *l, const struct sys_getsockname_args *uap, 1471 register_t *retval) 1472 { 1473 /* { 1474 syscallarg(int) fdes; 1475 syscallarg(struct sockaddr *) asa; 1476 syscallarg(unsigned int *) alen; 1477 } */ 1478 struct sockaddr_big sbig; 1479 int error; 1480 1481 sbig.sb_len = UCHAR_MAX; 1482 error = do_sys_getsockname(SCARG(uap, fdes), (struct sockaddr *)&sbig); 1483 if (error != 0) 1484 return error; 1485 1486 error = copyout_sockname_sb(SCARG(uap, asa), SCARG(uap, alen), 1487 MSG_LENUSRSPACE, &sbig); 1488 return error; 1489 } 1490 1491 /* 1492 * Get name of peer for connected socket. 1493 */ 1494 int 1495 sys_getpeername(struct lwp *l, const struct sys_getpeername_args *uap, 1496 register_t *retval) 1497 { 1498 /* { 1499 syscallarg(int) fdes; 1500 syscallarg(struct sockaddr *) asa; 1501 syscallarg(unsigned int *) alen; 1502 } */ 1503 struct sockaddr_big sbig; 1504 int error; 1505 1506 sbig.sb_len = UCHAR_MAX; 1507 error = do_sys_getpeername(SCARG(uap, fdes), (struct sockaddr *)&sbig); 1508 if (error != 0) 1509 return error; 1510 1511 error = copyout_sockname_sb(SCARG(uap, asa), SCARG(uap, alen), 1512 MSG_LENUSRSPACE, &sbig); 1513 return error; 1514 } 1515 1516 static int 1517 sockargs_sb(struct sockaddr_big *sb, const void *name, socklen_t buflen) 1518 { 1519 int error; 1520 1521 /* 1522 * We can't allow socket names > UCHAR_MAX in length, since that 1523 * will overflow sb_len. Further no reasonable buflen is <= 1524 * offsetof(sockaddr_big, sb_data) since it shall be at least 1525 * the size of the preamble sb_len and sb_family members. 1526 */ 1527 if (buflen > UCHAR_MAX || 1528 buflen <= offsetof(struct sockaddr_big, sb_data)) 1529 return SET_ERROR(EINVAL); 1530 1531 error = copyin(name, (void *)sb, buflen); 1532 if (error) 1533 return error; 1534 1535 ktrkuser(mbuftypes[MT_SONAME], sb, buflen); 1536 #if BYTE_ORDER != BIG_ENDIAN 1537 /* 1538 * 4.3BSD compat thing - need to stay, since bind(2), 1539 * connect(2), sendto(2) were not versioned for COMPAT_43. 1540 */ 1541 if (sb->sb_family == 0 && sb->sb_len < AF_MAX) 1542 sb->sb_family = sb->sb_len; 1543 #endif 1544 sb->sb_len = buflen; 1545 return 0; 1546 } 1547 1548 /* 1549 * XXX In a perfect world, we wouldn't pass around socket control 1550 * XXX arguments in mbufs, and this could go away. 1551 */ 1552 int 1553 sockargs(struct mbuf **mp, const void *bf, size_t buflen, enum uio_seg seg, 1554 int type) 1555 { 1556 struct mbuf *m; 1557 int error; 1558 1559 /* 1560 * We can't allow socket names > UCHAR_MAX in length, since that 1561 * will overflow sa_len. Control data more than a page size in 1562 * length is just too much. 1563 */ 1564 if (buflen > (type == MT_SONAME ? UCHAR_MAX : PAGE_SIZE)) 1565 return SET_ERROR(EINVAL); 1566 1567 /* 1568 * length must greater than sizeof(sa_family) + sizeof(sa_len) 1569 */ 1570 if (type == MT_SONAME && buflen <= 2) 1571 return SET_ERROR(EINVAL); 1572 1573 /* Allocate an mbuf to hold the arguments. */ 1574 m = m_get(M_WAIT, type); 1575 /* can't claim. don't who to assign it to. */ 1576 if (buflen > MLEN) { 1577 /* 1578 * Won't fit into a regular mbuf, so we allocate just 1579 * enough external storage to hold the argument. 1580 */ 1581 MEXTMALLOC(m, buflen, M_WAITOK); 1582 } 1583 m->m_len = buflen; 1584 if (seg == UIO_USERSPACE) { 1585 error = copyin(bf, mtod(m, void *), buflen); 1586 if (error) { 1587 (void)m_free(m); 1588 return error; 1589 } 1590 } else { 1591 memcpy(mtod(m, void *), bf, buflen); 1592 } 1593 *mp = m; 1594 switch (type) { 1595 case MT_SONAME: 1596 ktrkuser(mbuftypes[type], mtod(m, void *), buflen); 1597 1598 struct sockaddr *sa = mtod(m, struct sockaddr *); 1599 #if BYTE_ORDER != BIG_ENDIAN 1600 /* 1601 * 4.3BSD compat thing - need to stay, since bind(2), 1602 * connect(2), sendto(2) were not versioned for COMPAT_43. 1603 */ 1604 if (sa->sa_family == 0 && sa->sa_len < AF_MAX) 1605 sa->sa_family = sa->sa_len; 1606 #endif 1607 sa->sa_len = buflen; 1608 return 0; 1609 case MT_CONTROL: 1610 if (!KTRPOINT(curproc, KTR_USER)) 1611 return 0; 1612 1613 struct msghdr mhdr; 1614 mhdr.msg_control = mtod(m, void *); 1615 mhdr.msg_controllen = buflen; 1616 for (struct cmsghdr *cmsg = CMSG_FIRSTHDR(&mhdr); cmsg; 1617 cmsg = CMSG_NXTHDR(&mhdr, cmsg)) { 1618 KASSERT(((char *)cmsg - mtod(m, char *)) <= buflen); 1619 if (cmsg->cmsg_len > 1620 buflen - ((char *)cmsg - mtod(m, char *))) 1621 break; 1622 ktrkuser(mbuftypes[type], cmsg, cmsg->cmsg_len); 1623 } 1624 return 0; 1625 default: 1626 return SET_ERROR(EINVAL); 1627 } 1628 } 1629 1630 int 1631 do_sys_peeloff(struct socket *head, void *data) 1632 { 1633 #ifdef SCTP 1634 /*file_t *lfp = NULL;*/ 1635 file_t *nfp = NULL; 1636 int error; 1637 struct socket *so; 1638 int fd; 1639 uint32_t name; 1640 /*short fflag;*/ /* type must match fp->f_flag */ 1641 1642 name = *(uint32_t *) data; 1643 error = sctp_can_peel_off(head, name); 1644 if (error) { 1645 printf("peeloff failed\n"); 1646 return error; 1647 } 1648 /* 1649 * At this point we know we do have a assoc to pull 1650 * we proceed to get the fd setup. This may block 1651 * but that is ok. 1652 */ 1653 error = fd_allocfile(&nfp, &fd); 1654 if (error) { 1655 /* 1656 * Probably ran out of file descriptors. Put the 1657 * unaccepted connection back onto the queue and 1658 * do another wakeup so some other process might 1659 * have a chance at it. 1660 */ 1661 return error; 1662 } 1663 *(int *) data = fd; 1664 1665 so = sctp_get_peeloff(head, name, &error); 1666 if (so == NULL) { 1667 /* 1668 * Either someone else peeled it off OR 1669 * we can't get a socket. 1670 * close the new descriptor, assuming someone hasn't ripped it 1671 * out from under us. 1672 */ 1673 mutex_enter(&nfp->f_lock); 1674 nfp->f_count++; 1675 mutex_exit(&nfp->f_lock); 1676 fd_abort(curlwp->l_proc, nfp, fd); 1677 return error; 1678 } 1679 so->so_state &= ~SS_NOFDREF; 1680 so->so_state &= ~SS_ISCONNECTING; 1681 so->so_head = NULL; 1682 so->so_cred = kauth_cred_hold(head->so_cred); 1683 nfp->f_socket = so; 1684 nfp->f_flag = FREAD|FWRITE; 1685 nfp->f_ops = &socketops; 1686 nfp->f_type = DTYPE_SOCKET; 1687 1688 fd_affix(curlwp->l_proc, nfp, fd); 1689 1690 return error; 1691 #else 1692 return SET_ERROR(EOPNOTSUPP); 1693 #endif 1694 } 1695
Indexes created Sat Sep 20 22:09:52 GMT 2025