uipc_usrreq.c revision 1.26
1 /* $NetBSD: uipc_usrreq.c,v 1.26 1997/06/24 19:12:55 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 1997 Christopher G. Demetriou. All rights reserved. 5 * Copyright (c) 1982, 1986, 1989, 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by the University of 19 * California, Berkeley and its contributors. 20 * 4. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 37 */ 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/proc.h> 42 #include <sys/filedesc.h> 43 #include <sys/domain.h> 44 #include <sys/protosw.h> 45 #include <sys/socket.h> 46 #include <sys/socketvar.h> 47 #include <sys/unpcb.h> 48 #include <sys/un.h> 49 #include <sys/namei.h> 50 #include <sys/vnode.h> 51 #include <sys/file.h> 52 #include <sys/stat.h> 53 #include <sys/mbuf.h> 54 55 /* 56 * Unix communications domain. 57 * 58 * TODO: 59 * SEQPACKET, RDM 60 * rethink name space problems 61 * need a proper out-of-band 62 */ 63 struct sockaddr_un sun_noname = { sizeof(sun_noname), AF_UNIX }; 64 ino_t unp_ino; /* prototype for fake inode numbers */ 65 66 int 67 unp_output(m, control, unp) 68 struct mbuf *m, *control; 69 struct unpcb *unp; 70 { 71 struct socket *so2; 72 struct sockaddr_un *sun; 73 74 so2 = unp->unp_conn->unp_socket; 75 if (unp->unp_addr) 76 sun = unp->unp_addr; 77 else 78 sun = &sun_noname; 79 if (sbappendaddr(&so2->so_rcv, (struct sockaddr *)sun, m, 80 control) == 0) { 81 m_freem(control); 82 m_freem(m); 83 return (EINVAL); 84 } else { 85 sorwakeup(so2); 86 return (0); 87 } 88 } 89 90 void 91 unp_setsockaddr(unp, nam) 92 register struct unpcb *unp; 93 struct mbuf *nam; 94 { 95 struct sockaddr_un *sun; 96 97 if (unp->unp_addr) 98 sun = unp->unp_addr; 99 else 100 sun = &sun_noname; 101 nam->m_len = sun->sun_len; 102 bcopy(sun, mtod(nam, caddr_t), (size_t)nam->m_len); 103 } 104 105 void 106 unp_setpeeraddr(unp, nam) 107 register struct unpcb *unp; 108 struct mbuf *nam; 109 { 110 struct sockaddr_un *sun; 111 112 if (unp->unp_conn && unp->unp_conn->unp_addr) 113 sun = unp->unp_conn->unp_addr; 114 else 115 sun = &sun_noname; 116 nam->m_len = sun->sun_len; 117 bcopy(sun, mtod(nam, caddr_t), (size_t)nam->m_len); 118 } 119 120 /*ARGSUSED*/ 121 int 122 uipc_usrreq(so, req, m, nam, control, p) 123 struct socket *so; 124 int req; 125 struct mbuf *m, *nam, *control; 126 struct proc *p; 127 { 128 struct unpcb *unp = sotounpcb(so); 129 register struct socket *so2; 130 register int error = 0; 131 132 if (req == PRU_CONTROL) 133 return (EOPNOTSUPP); 134 135 #ifdef DIAGNOSTIC 136 if (req != PRU_SEND && req != PRU_SENDOOB && control) 137 panic("uipc_usrreq: unexpected control mbuf"); 138 #endif 139 if (unp == 0 && req != PRU_ATTACH) { 140 error = EINVAL; 141 goto release; 142 } 143 144 switch (req) { 145 146 case PRU_ATTACH: 147 if (unp != 0) { 148 error = EISCONN; 149 break; 150 } 151 error = unp_attach(so); 152 break; 153 154 case PRU_DETACH: 155 unp_detach(unp); 156 break; 157 158 case PRU_BIND: 159 error = unp_bind(unp, nam, p); 160 break; 161 162 case PRU_LISTEN: 163 if (unp->unp_vnode == 0) 164 error = EINVAL; 165 break; 166 167 case PRU_CONNECT: 168 error = unp_connect(so, nam, p); 169 break; 170 171 case PRU_CONNECT2: 172 error = unp_connect2(so, (struct socket *)nam); 173 break; 174 175 case PRU_DISCONNECT: 176 unp_disconnect(unp); 177 break; 178 179 case PRU_ACCEPT: 180 unp_setpeeraddr(unp, nam); 181 break; 182 183 case PRU_SHUTDOWN: 184 socantsendmore(so); 185 unp_shutdown(unp); 186 break; 187 188 case PRU_RCVD: 189 switch (so->so_type) { 190 191 case SOCK_DGRAM: 192 panic("uipc 1"); 193 /*NOTREACHED*/ 194 195 case SOCK_STREAM: 196 #define rcv (&so->so_rcv) 197 #define snd (&so2->so_snd) 198 if (unp->unp_conn == 0) 199 break; 200 so2 = unp->unp_conn->unp_socket; 201 /* 202 * Adjust backpressure on sender 203 * and wakeup any waiting to write. 204 */ 205 snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt; 206 unp->unp_mbcnt = rcv->sb_mbcnt; 207 snd->sb_hiwat += unp->unp_cc - rcv->sb_cc; 208 unp->unp_cc = rcv->sb_cc; 209 sowwakeup(so2); 210 #undef snd 211 #undef rcv 212 break; 213 214 default: 215 panic("uipc 2"); 216 } 217 break; 218 219 case PRU_SEND: 220 if (control && (error = unp_internalize(control, p))) 221 break; 222 switch (so->so_type) { 223 224 case SOCK_DGRAM: { 225 if (nam) { 226 if ((so->so_state & SS_ISCONNECTED) != 0) { 227 error = EISCONN; 228 goto die; 229 } 230 error = unp_connect(so, nam, p); 231 if (error) { 232 die: 233 m_freem(control); 234 m_freem(m); 235 break; 236 } 237 } else { 238 if ((so->so_state & SS_ISCONNECTED) == 0) { 239 error = ENOTCONN; 240 goto die; 241 } 242 } 243 error = unp_output(m, control, unp); 244 if (nam) 245 unp_disconnect(unp); 246 break; 247 } 248 249 case SOCK_STREAM: 250 #define rcv (&so2->so_rcv) 251 #define snd (&so->so_snd) 252 if (unp->unp_conn == 0) 253 panic("uipc 3"); 254 so2 = unp->unp_conn->unp_socket; 255 /* 256 * Send to paired receive port, and then reduce 257 * send buffer hiwater marks to maintain backpressure. 258 * Wake up readers. 259 */ 260 if (control) { 261 if (sbappendcontrol(rcv, m, control) == 0) 262 m_freem(control); 263 } else 264 sbappend(rcv, m); 265 snd->sb_mbmax -= 266 rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt; 267 unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt; 268 snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc; 269 unp->unp_conn->unp_cc = rcv->sb_cc; 270 sorwakeup(so2); 271 #undef snd 272 #undef rcv 273 break; 274 275 default: 276 panic("uipc 4"); 277 } 278 break; 279 280 case PRU_ABORT: 281 unp_drop(unp, ECONNABORTED); 282 break; 283 284 case PRU_SENSE: 285 ((struct stat *) m)->st_blksize = so->so_snd.sb_hiwat; 286 if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) { 287 so2 = unp->unp_conn->unp_socket; 288 ((struct stat *) m)->st_blksize += so2->so_rcv.sb_cc; 289 } 290 ((struct stat *) m)->st_dev = NODEV; 291 if (unp->unp_ino == 0) 292 unp->unp_ino = unp_ino++; 293 ((struct stat *) m)->st_atimespec = 294 ((struct stat *) m)->st_mtimespec = 295 ((struct stat *) m)->st_ctimespec = unp->unp_ctime; 296 ((struct stat *) m)->st_ino = unp->unp_ino; 297 return (0); 298 299 case PRU_RCVOOB: 300 error = EOPNOTSUPP; 301 break; 302 303 case PRU_SENDOOB: 304 m_freem(control); 305 m_freem(m); 306 error = EOPNOTSUPP; 307 break; 308 309 case PRU_SOCKADDR: 310 unp_setsockaddr(unp, nam); 311 break; 312 313 case PRU_PEERADDR: 314 unp_setpeeraddr(unp, nam); 315 break; 316 317 default: 318 panic("piusrreq"); 319 } 320 321 release: 322 return (error); 323 } 324 325 /* 326 * Both send and receive buffers are allocated PIPSIZ bytes of buffering 327 * for stream sockets, although the total for sender and receiver is 328 * actually only PIPSIZ. 329 * Datagram sockets really use the sendspace as the maximum datagram size, 330 * and don't really want to reserve the sendspace. Their recvspace should 331 * be large enough for at least one max-size datagram plus address. 332 */ 333 #define PIPSIZ 4096 334 u_long unpst_sendspace = PIPSIZ; 335 u_long unpst_recvspace = PIPSIZ; 336 u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 337 u_long unpdg_recvspace = 4*1024; 338 339 int unp_rights; /* file descriptors in flight */ 340 341 int 342 unp_attach(so) 343 struct socket *so; 344 { 345 register struct unpcb *unp; 346 struct timeval tv; 347 int error; 348 349 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 350 switch (so->so_type) { 351 352 case SOCK_STREAM: 353 error = soreserve(so, unpst_sendspace, unpst_recvspace); 354 break; 355 356 case SOCK_DGRAM: 357 error = soreserve(so, unpdg_sendspace, unpdg_recvspace); 358 break; 359 360 default: 361 panic("unp_attach"); 362 } 363 if (error) 364 return (error); 365 } 366 unp = malloc(sizeof(*unp), M_PCB, M_NOWAIT); 367 if (unp == NULL) 368 return (ENOBUFS); 369 bzero((caddr_t)unp, sizeof(*unp)); 370 unp->unp_socket = so; 371 so->so_pcb = unp; 372 microtime(&tv); 373 TIMEVAL_TO_TIMESPEC(&tv, &unp->unp_ctime); 374 return (0); 375 } 376 377 void 378 unp_detach(unp) 379 register struct unpcb *unp; 380 { 381 382 if (unp->unp_vnode) { 383 unp->unp_vnode->v_socket = 0; 384 vrele(unp->unp_vnode); 385 unp->unp_vnode = 0; 386 } 387 if (unp->unp_conn) 388 unp_disconnect(unp); 389 while (unp->unp_refs) 390 unp_drop(unp->unp_refs, ECONNRESET); 391 soisdisconnected(unp->unp_socket); 392 unp->unp_socket->so_pcb = 0; 393 if (unp->unp_addr) 394 free(unp->unp_addr, M_SONAME); 395 if (unp_rights) { 396 /* 397 * Normally the receive buffer is flushed later, 398 * in sofree, but if our receive buffer holds references 399 * to descriptors that are now garbage, we will dispose 400 * of those descriptor references after the garbage collector 401 * gets them (resulting in a "panic: closef: count < 0"). 402 */ 403 sorflush(unp->unp_socket); 404 free(unp, M_PCB); 405 unp_gc(); 406 } else 407 free(unp, M_PCB); 408 } 409 410 int 411 unp_bind(unp, nam, p) 412 struct unpcb *unp; 413 struct mbuf *nam; 414 struct proc *p; 415 { 416 struct sockaddr_un *sun = mtod(nam, struct sockaddr_un *); 417 register struct vnode *vp; 418 struct vattr vattr; 419 int error; 420 struct nameidata nd; 421 422 if (nam->m_len > sizeof(struct sockaddr_un)) 423 return (EINVAL); 424 if (unp->unp_vnode != 0) 425 return (EINVAL); 426 NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE, 427 sun->sun_path, p); 428 if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) { /* XXX */ 429 if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0) 430 return (EINVAL); 431 } else 432 *(mtod(nam, caddr_t) + nam->m_len) = 0; 433 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */ 434 if ((error = namei(&nd)) != 0) 435 return (error); 436 vp = nd.ni_vp; 437 if (vp != NULL) { 438 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd); 439 if (nd.ni_dvp == vp) 440 vrele(nd.ni_dvp); 441 else 442 vput(nd.ni_dvp); 443 vrele(vp); 444 return (EADDRINUSE); 445 } 446 VATTR_NULL(&vattr); 447 vattr.va_type = VSOCK; 448 vattr.va_mode = ACCESSPERMS; 449 VOP_LEASE(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE); 450 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); 451 if (error) 452 return (error); 453 vp = nd.ni_vp; 454 vp->v_socket = unp->unp_socket; 455 unp->unp_vnode = vp; 456 unp->unp_addrlen = nam->m_len; 457 unp->unp_addr = malloc(unp->unp_addrlen, M_SONAME, M_WAITOK); 458 m_copydata(nam, 0, unp->unp_addrlen, (caddr_t)unp->unp_addr); 459 VOP_UNLOCK(vp); 460 return (0); 461 } 462 463 int 464 unp_connect(so, nam, p) 465 struct socket *so; 466 struct mbuf *nam; 467 struct proc *p; 468 { 469 register struct sockaddr_un *sun = mtod(nam, struct sockaddr_un *); 470 register struct vnode *vp; 471 register struct socket *so2, *so3; 472 struct unpcb *unp2, *unp3; 473 int error; 474 struct nameidata nd; 475 476 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, sun->sun_path, p); 477 if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) { /* XXX */ 478 if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0) 479 return (EINVAL); 480 } else 481 *(mtod(nam, caddr_t) + nam->m_len) = 0; 482 if ((error = namei(&nd)) != 0) 483 return (error); 484 vp = nd.ni_vp; 485 if (vp->v_type != VSOCK) { 486 error = ENOTSOCK; 487 goto bad; 488 } 489 if ((error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p)) != 0) 490 goto bad; 491 so2 = vp->v_socket; 492 if (so2 == 0) { 493 error = ECONNREFUSED; 494 goto bad; 495 } 496 if (so->so_type != so2->so_type) { 497 error = EPROTOTYPE; 498 goto bad; 499 } 500 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 501 if ((so2->so_options & SO_ACCEPTCONN) == 0 || 502 (so3 = sonewconn(so2, 0)) == 0) { 503 error = ECONNREFUSED; 504 goto bad; 505 } 506 unp2 = sotounpcb(so2); 507 unp3 = sotounpcb(so3); 508 if (unp2->unp_addr) { 509 unp3->unp_addr = malloc(unp2->unp_addrlen, 510 M_SONAME, M_WAITOK); 511 bcopy(unp2->unp_addr, unp3->unp_addr, 512 unp2->unp_addrlen); 513 unp3->unp_addrlen = unp2->unp_addrlen; 514 } 515 so2 = so3; 516 } 517 error = unp_connect2(so, so2); 518 bad: 519 vput(vp); 520 return (error); 521 } 522 523 int 524 unp_connect2(so, so2) 525 register struct socket *so; 526 register struct socket *so2; 527 { 528 register struct unpcb *unp = sotounpcb(so); 529 register struct unpcb *unp2; 530 531 if (so2->so_type != so->so_type) 532 return (EPROTOTYPE); 533 unp2 = sotounpcb(so2); 534 unp->unp_conn = unp2; 535 switch (so->so_type) { 536 537 case SOCK_DGRAM: 538 unp->unp_nextref = unp2->unp_refs; 539 unp2->unp_refs = unp; 540 soisconnected(so); 541 break; 542 543 case SOCK_STREAM: 544 unp2->unp_conn = unp; 545 soisconnected(so); 546 soisconnected(so2); 547 break; 548 549 default: 550 panic("unp_connect2"); 551 } 552 return (0); 553 } 554 555 void 556 unp_disconnect(unp) 557 struct unpcb *unp; 558 { 559 register struct unpcb *unp2 = unp->unp_conn; 560 561 if (unp2 == 0) 562 return; 563 unp->unp_conn = 0; 564 switch (unp->unp_socket->so_type) { 565 566 case SOCK_DGRAM: 567 if (unp2->unp_refs == unp) 568 unp2->unp_refs = unp->unp_nextref; 569 else { 570 unp2 = unp2->unp_refs; 571 for (;;) { 572 if (unp2 == 0) 573 panic("unp_disconnect"); 574 if (unp2->unp_nextref == unp) 575 break; 576 unp2 = unp2->unp_nextref; 577 } 578 unp2->unp_nextref = unp->unp_nextref; 579 } 580 unp->unp_nextref = 0; 581 unp->unp_socket->so_state &= ~SS_ISCONNECTED; 582 break; 583 584 case SOCK_STREAM: 585 soisdisconnected(unp->unp_socket); 586 unp2->unp_conn = 0; 587 soisdisconnected(unp2->unp_socket); 588 break; 589 } 590 } 591 592 #ifdef notdef 593 unp_abort(unp) 594 struct unpcb *unp; 595 { 596 597 unp_detach(unp); 598 } 599 #endif 600 601 void 602 unp_shutdown(unp) 603 struct unpcb *unp; 604 { 605 struct socket *so; 606 607 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn && 608 (so = unp->unp_conn->unp_socket)) 609 socantrcvmore(so); 610 } 611 612 void 613 unp_drop(unp, errno) 614 struct unpcb *unp; 615 int errno; 616 { 617 struct socket *so = unp->unp_socket; 618 619 so->so_error = errno; 620 unp_disconnect(unp); 621 if (so->so_head) { 622 so->so_pcb = 0; 623 sofree(so); 624 if (unp->unp_addr) 625 free(unp->unp_addr, M_SONAME); 626 free(unp, M_PCB); 627 } 628 } 629 630 #ifdef notdef 631 unp_drain() 632 { 633 634 } 635 #endif 636 637 int 638 unp_externalize(rights) 639 struct mbuf *rights; 640 { 641 struct proc *p = curproc; /* XXX */ 642 register struct cmsghdr *cm = mtod(rights, struct cmsghdr *); 643 register int i, *fdp = (int *)(cm + 1); 644 register struct file **rp = (struct file **)ALIGN(cm + 1); 645 register struct file *fp; 646 int nfds = (cm->cmsg_len - ALIGN(sizeof(*cm))) / sizeof (struct file *); 647 int f; 648 649 /* Make sure that the recipient has space */ 650 if (!fdavail(p, nfds)) { 651 for (i = 0; i < nfds; i++) { 652 fp = *rp; 653 unp_discard(fp); 654 *rp++ = 0; 655 } 656 return (EMSGSIZE); 657 } 658 659 /* 660 * Add file to the recipient's open file table, converting them 661 * to integer file descriptors as we go. Done in forward order 662 * because an integer will always come in the same place or before 663 * its corresponding struct file pointer. 664 */ 665 for (i = 0; i < nfds; i++) { 666 if (fdalloc(p, 0, &f)) 667 panic("unp_externalize"); 668 fp = *rp; 669 p->p_fd->fd_ofiles[f] = fp; 670 fp->f_msgcount--; 671 unp_rights--; 672 *fdp++ = f; 673 } 674 675 /* 676 * Adjust length, in case of transition from large struct file 677 * pointers to ints. 678 */ 679 cm->cmsg_len = sizeof(*cm) + (nfds * sizeof(int)); 680 rights->m_len = cm->cmsg_len; 681 return (0); 682 } 683 684 int 685 unp_internalize(control, p) 686 struct mbuf *control; 687 struct proc *p; 688 { 689 struct filedesc *fdescp = p->p_fd; 690 register struct cmsghdr *cm = mtod(control, struct cmsghdr *); 691 register struct file **rp; 692 register struct file *fp; 693 register int i, fd, *fdp; 694 int nfds; 695 u_int neededspace; 696 697 /* Sanity check the control message header */ 698 if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET || 699 cm->cmsg_len != control->m_len) 700 return (EINVAL); 701 702 /* Verify that the file descriptors are valid */ 703 nfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int); 704 fdp = (int *)(cm + 1); 705 for (i = 0; i < nfds; i++) { 706 fd = *fdp++; 707 if ((unsigned)fd >= fdescp->fd_nfiles || 708 fdescp->fd_ofiles[fd] == NULL) 709 return (EBADF); 710 } 711 712 /* Make sure we have room for the struct file pointers */ 713 morespace: 714 neededspace = (ALIGN(sizeof (*cm)) + nfds * sizeof (struct file *)) - 715 control->m_len; 716 if (neededspace > M_TRAILINGSPACE(control)) { 717 718 /* if we already have a cluster, the message is just too big */ 719 if (control->m_flags & M_EXT) 720 return (E2BIG); 721 722 /* allocate a cluster and try again */ 723 MCLGET(control, M_WAIT); 724 if ((control->m_flags & M_EXT) == 0) 725 return (ENOBUFS); /* allocation failed */ 726 727 /* copy the data to the cluster */ 728 bcopy(cm, mtod(control, char *), cm->cmsg_len); 729 cm = mtod(control, struct cmsghdr *); 730 goto morespace; 731 } 732 733 /* adjust message & mbuf to note amount of space actually used. */ 734 cm->cmsg_len += neededspace; 735 control->m_len = cm->cmsg_len; 736 737 /* 738 * Transform the file descriptors into struct file pointers, in 739 * reverse order so that if pointers are bigger than ints, the 740 * int won't get until we're done. 741 */ 742 fdp = ((int *)(cm + 1)) + nfds - 1; 743 rp = ((struct file **)ALIGN(cm + 1)) + nfds - 1; 744 for (i = 0; i < nfds; i++) { 745 fp = fdescp->fd_ofiles[*fdp]; 746 *rp-- = fp; 747 fp->f_count++; 748 fp->f_msgcount++; 749 unp_rights++; 750 } 751 return (0); 752 } 753 754 int unp_defer, unp_gcing; 755 extern struct domain unixdomain; 756 757 void 758 unp_gc() 759 { 760 register struct file *fp, *nextfp; 761 register struct socket *so; 762 struct file **extra_ref, **fpp; 763 int nunref, i; 764 765 if (unp_gcing) 766 return; 767 unp_gcing = 1; 768 unp_defer = 0; 769 for (fp = filehead.lh_first; fp != 0; fp = fp->f_list.le_next) 770 fp->f_flag &= ~(FMARK|FDEFER); 771 do { 772 for (fp = filehead.lh_first; fp != 0; fp = fp->f_list.le_next) { 773 if (fp->f_count == 0) 774 continue; 775 if (fp->f_flag & FDEFER) { 776 fp->f_flag &= ~FDEFER; 777 unp_defer--; 778 } else { 779 if (fp->f_flag & FMARK) 780 continue; 781 if (fp->f_count == fp->f_msgcount) 782 continue; 783 fp->f_flag |= FMARK; 784 } 785 if (fp->f_type != DTYPE_SOCKET || 786 (so = (struct socket *)fp->f_data) == 0) 787 continue; 788 if (so->so_proto->pr_domain != &unixdomain || 789 (so->so_proto->pr_flags&PR_RIGHTS) == 0) 790 continue; 791 #ifdef notdef 792 if (so->so_rcv.sb_flags & SB_LOCK) { 793 /* 794 * This is problematical; it's not clear 795 * we need to wait for the sockbuf to be 796 * unlocked (on a uniprocessor, at least), 797 * and it's also not clear what to do 798 * if sbwait returns an error due to receipt 799 * of a signal. If sbwait does return 800 * an error, we'll go into an infinite 801 * loop. Delete all of this for now. 802 */ 803 (void) sbwait(&so->so_rcv); 804 goto restart; 805 } 806 #endif 807 unp_scan(so->so_rcv.sb_mb, unp_mark); 808 } 809 } while (unp_defer); 810 /* 811 * We grab an extra reference to each of the file table entries 812 * that are not otherwise accessible and then free the rights 813 * that are stored in messages on them. 814 * 815 * The bug in the orginal code is a little tricky, so I'll describe 816 * what's wrong with it here. 817 * 818 * It is incorrect to simply unp_discard each entry for f_msgcount 819 * times -- consider the case of sockets A and B that contain 820 * references to each other. On a last close of some other socket, 821 * we trigger a gc since the number of outstanding rights (unp_rights) 822 * is non-zero. If during the sweep phase the gc code un_discards, 823 * we end up doing a (full) closef on the descriptor. A closef on A 824 * results in the following chain. Closef calls soo_close, which 825 * calls soclose. Soclose calls first (through the switch 826 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply 827 * returns because the previous instance had set unp_gcing, and 828 * we return all the way back to soclose, which marks the socket 829 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush 830 * to free up the rights that are queued in messages on the socket A, 831 * i.e., the reference on B. The sorflush calls via the dom_dispose 832 * switch unp_dispose, which unp_scans with unp_discard. This second 833 * instance of unp_discard just calls closef on B. 834 * 835 * Well, a similar chain occurs on B, resulting in a sorflush on B, 836 * which results in another closef on A. Unfortunately, A is already 837 * being closed, and the descriptor has already been marked with 838 * SS_NOFDREF, and soclose panics at this point. 839 * 840 * Here, we first take an extra reference to each inaccessible 841 * descriptor. Then, we call sorflush ourself, since we know 842 * it is a Unix domain socket anyhow. After we destroy all the 843 * rights carried in messages, we do a last closef to get rid 844 * of our extra reference. This is the last close, and the 845 * unp_detach etc will shut down the socket. 846 * 847 * 91/09/19, bsy (at) cs.cmu.edu 848 */ 849 extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK); 850 for (nunref = 0, fp = filehead.lh_first, fpp = extra_ref; fp != 0; 851 fp = nextfp) { 852 nextfp = fp->f_list.le_next; 853 if (fp->f_count == 0) 854 continue; 855 if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) { 856 *fpp++ = fp; 857 nunref++; 858 fp->f_count++; 859 } 860 } 861 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) 862 sorflush((struct socket *)(*fpp)->f_data); 863 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) 864 (void) closef(*fpp, (struct proc *)0); 865 free((caddr_t)extra_ref, M_FILE); 866 unp_gcing = 0; 867 } 868 869 void 870 unp_dispose(m) 871 struct mbuf *m; 872 { 873 874 if (m) 875 unp_scan(m, unp_discard); 876 } 877 878 void 879 unp_scan(m0, op) 880 register struct mbuf *m0; 881 void (*op) __P((struct file *)); 882 { 883 register struct mbuf *m; 884 register struct file **rp; 885 register struct cmsghdr *cm; 886 register int i; 887 int qfds; 888 889 while (m0) { 890 for (m = m0; m; m = m->m_next) 891 if (m->m_type == MT_CONTROL && 892 m->m_len >= sizeof(*cm)) { 893 cm = mtod(m, struct cmsghdr *); 894 if (cm->cmsg_level != SOL_SOCKET || 895 cm->cmsg_type != SCM_RIGHTS) 896 continue; 897 qfds = (cm->cmsg_len - sizeof *cm) 898 / sizeof (struct file *); 899 rp = (struct file **)(cm + 1); 900 for (i = 0; i < qfds; i++) 901 (*op)(*rp++); 902 break; /* XXX, but saves time */ 903 } 904 m0 = m0->m_act; 905 } 906 } 907 908 void 909 unp_mark(fp) 910 struct file *fp; 911 { 912 913 if (fp->f_flag & FMARK) 914 return; 915 unp_defer++; 916 fp->f_flag |= (FMARK|FDEFER); 917 } 918 919 void 920 unp_discard(fp) 921 struct file *fp; 922 { 923 924 fp->f_msgcount--; 925 unp_rights--; 926 (void) closef(fp, (struct proc *)0); 927 } 928
Indexes created Sun Sep 21 15:09:59 GMT 2025