/*
- * Copyright (c) 1982, 1986 Regents of the University of California.
- * All rights reserved. The Berkeley software License Agreement
- * specifies the terms and conditions for redistribution.
*
- * @(#)uipc_usrreq.c 7.1 (Berkeley) %G%
+ * %sccs.include.redist.c%
+ *
+ * @(#)uipc_usrreq.c 8.2 (Berkeley) %G%
*/
-#include "param.h"
-#include "dir.h"
-#include "user.h"
-#include "mbuf.h"
-#include "domain.h"
-#include "protosw.h"
-#include "socket.h"
-#include "socketvar.h"
-#include "unpcb.h"
-#include "un.h"
-#include "inode.h"
-#include "file.h"
-#include "stat.h"
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/proc.h>
+#include <sys/filedesc.h>
+#include <sys/domain.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/unpcb.h>
+#include <sys/un.h>
+#include <sys/namei.h>
+#include <sys/vnode.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <sys/mbuf.h>
/*
* Unix communications domain.
* rethink name space problems
* need a proper out-of-band
*/
-struct sockaddr sun_noname = { AF_UNIX };
+struct sockaddr sun_noname = { sizeof(sun_noname), AF_UNIX };
ino_t unp_ino; /* prototype for fake inode numbers */
/*ARGSUSED*/
-uipc_usrreq(so, req, m, nam, rights)
+uipc_usrreq(so, req, m, nam, control)
struct socket *so;
int req;
- struct mbuf *m, *nam, *rights;
+ struct mbuf *m, *nam, *control;
{
struct unpcb *unp = sotounpcb(so);
register struct socket *so2;
- int error = 0;
+ register int error = 0;
+ struct proc *p = curproc; /* XXX */
if (req == PRU_CONTROL)
return (EOPNOTSUPP);
- if (req != PRU_SEND && rights && rights->m_len) {
+ if (req != PRU_SEND && control && control->m_len) {
error = EOPNOTSUPP;
goto release;
}
break;
case PRU_BIND:
- error = unp_bind(unp, nam);
+ error = unp_bind(unp, nam, p);
break;
case PRU_LISTEN:
- if (unp->unp_inode == 0)
+ if (unp->unp_vnode == 0)
error = EINVAL;
break;
case PRU_CONNECT:
- error = unp_connect(so, nam);
+ error = unp_connect(so, nam, p);
break;
case PRU_CONNECT2:
case PRU_SHUTDOWN:
socantsendmore(so);
- unp_usrclosed(unp);
+ unp_shutdown(unp);
break;
case PRU_RCVD:
break;
case PRU_SEND:
- if (rights) {
- error = unp_internalize(rights);
- if (error)
- break;
- }
+ if (control && (error = unp_internalize(control, p)))
+ break;
switch (so->so_type) {
case SOCK_DGRAM: {
error = EISCONN;
break;
}
- error = unp_connect(so, nam);
+ error = unp_connect(so, nam, p);
if (error)
break;
} else {
from = mtod(unp->unp_addr, struct sockaddr *);
else
from = &sun_noname;
- if (sbspace(&so2->so_rcv) > 0 &&
- sbappendaddr(&so2->so_rcv, from, m, rights)) {
+ if (sbappendaddr(&so2->so_rcv, from, m, control)) {
sorwakeup(so2);
m = 0;
+ control = 0;
} else
error = ENOBUFS;
if (nam)
* send buffer hiwater marks to maintain backpressure.
* Wake up readers.
*/
- if (rights)
- (void)sbappendrights(rcv, m, rights);
- else
+ if (control) {
+ if (sbappendcontrol(rcv, m, control))
+ control = 0;
+ } else
sbappend(rcv, m);
snd->sb_mbmax -=
rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
break;
case PRU_SOCKADDR:
+ if (unp->unp_addr) {
+ nam->m_len = unp->unp_addr->m_len;
+ bcopy(mtod(unp->unp_addr, caddr_t),
+ mtod(nam, caddr_t), (unsigned)nam->m_len);
+ } else
+ nam->m_len = 0;
break;
case PRU_PEERADDR:
if (unp->unp_conn && unp->unp_conn->unp_addr) {
nam->m_len = unp->unp_conn->unp_addr->m_len;
bcopy(mtod(unp->unp_conn->unp_addr, caddr_t),
- mtod(m, caddr_t), (unsigned)m->m_len);
- }
+ mtod(nam, caddr_t), (unsigned)nam->m_len);
+ } else
+ nam->m_len = 0;
break;
case PRU_SLOWTIMO:
panic("piusrreq");
}
release:
+ if (control)
+ m_freem(control);
if (m)
m_freem(m);
return (error);
* be large enough for at least one max-size datagram plus address.
*/
#define PIPSIZ 4096
-int unpst_sendspace = PIPSIZ;
-int unpst_recvspace = PIPSIZ;
-int unpdg_sendspace = 2*1024; /* really max datagram size */
-int unpdg_recvspace = 4*1024;
+u_long unpst_sendspace = PIPSIZ;
+u_long unpst_recvspace = PIPSIZ;
+u_long unpdg_sendspace = 2*1024; /* really max datagram size */
+u_long unpdg_recvspace = 4*1024;
int unp_rights; /* file descriptors in flight */
register struct unpcb *unp;
int error;
- switch (so->so_type) {
+ if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
+ switch (so->so_type) {
- case SOCK_STREAM:
- error = soreserve(so, unpst_sendspace, unpst_recvspace);
- break;
+ case SOCK_STREAM:
+ error = soreserve(so, unpst_sendspace, unpst_recvspace);
+ break;
- case SOCK_DGRAM:
- error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
- break;
+ case SOCK_DGRAM:
+ error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
+ break;
+
+ default:
+ panic("unp_attach");
+ }
+ if (error)
+ return (error);
}
- if (error)
- return (error);
m = m_getclr(M_DONTWAIT, MT_PCB);
if (m == NULL)
return (ENOBUFS);
register struct unpcb *unp;
{
- if (unp->unp_inode) {
- unp->unp_inode->i_socket = 0;
- irele(unp->unp_inode);
- unp->unp_inode = 0;
+ if (unp->unp_vnode) {
+ unp->unp_vnode->v_socket = 0;
+ vrele(unp->unp_vnode);
+ unp->unp_vnode = 0;
}
if (unp->unp_conn)
unp_disconnect(unp);
unp->unp_socket->so_pcb = 0;
m_freem(unp->unp_addr);
(void) m_free(dtom(unp));
- if (unp_rights)
+ if (unp_rights) {
+ /*
+ * Normally the receive buffer is flushed later,
+ * in sofree, but if our receive buffer holds references
+ * to descriptors that are now garbage, we will dispose
+ * of those descriptor references after the garbage collector
+ * gets them (resulting in a "panic: closef: count < 0").
+ */
+ sorflush(unp->unp_socket);
unp_gc();
+ }
}
-unp_bind(unp, nam)
+unp_bind(unp, nam, p)
struct unpcb *unp;
struct mbuf *nam;
+ struct proc *p;
{
struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
- register struct inode *ip;
- register struct nameidata *ndp = &u.u_nd;
+ register struct vnode *vp;
+ struct vattr vattr;
int error;
+ struct nameidata nd;
- ndp->ni_dirp = soun->sun_path;
- if (unp->unp_inode != NULL || nam->m_len == MLEN)
+ NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
+ soun->sun_path, p);
+ if (unp->unp_vnode != NULL)
return (EINVAL);
- *(mtod(nam, caddr_t) + nam->m_len) = 0;
+ if (nam->m_len == MLEN) {
+ if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0)
+ return (EINVAL);
+ } else
+ *(mtod(nam, caddr_t) + nam->m_len) = 0;
/* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
- ndp->ni_nameiop = CREATE | FOLLOW;
- ndp->ni_segflg = UIO_SYSSPACE;
- ip = namei(ndp);
- if (ip) {
- iput(ip);
- return (EADDRINUSE);
- }
- if (error = u.u_error) {
- u.u_error = 0; /* XXX */
+ if (error = namei(&nd))
return (error);
+ vp = nd.ni_vp;
+ if (vp != NULL) {
+ VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
+ if (nd.ni_dvp == vp)
+ vrele(nd.ni_dvp);
+ else
+ vput(nd.ni_dvp);
+ vrele(vp);
+ return (EADDRINUSE);
}
- ip = maknode(IFSOCK | 0777, ndp);
- if (ip == NULL) {
- error = u.u_error; /* XXX */
- u.u_error = 0; /* XXX */
+ VATTR_NULL(&vattr);
+ vattr.va_type = VSOCK;
+ vattr.va_mode = ACCESSPERMS;
+ LEASE_CHECK(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE);
+ if (error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr))
return (error);
- }
- ip->i_socket = unp->unp_socket;
- unp->unp_inode = ip;
+ vp = nd.ni_vp;
+ vp->v_socket = unp->unp_socket;
+ unp->unp_vnode = vp;
unp->unp_addr = m_copy(nam, 0, (int)M_COPYALL);
- iunlock(ip); /* but keep reference */
+ VOP_UNLOCK(vp);
return (0);
}
-unp_connect(so, nam)
+unp_connect(so, nam, p)
struct socket *so;
struct mbuf *nam;
+ struct proc *p;
{
register struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
- register struct inode *ip;
+ register struct vnode *vp;
+ register struct socket *so2, *so3;
+ struct unpcb *unp2, *unp3;
int error;
- register struct socket *so2;
- register struct nameidata *ndp = &u.u_nd;
-
- ndp->ni_dirp = soun->sun_path;
- if (nam->m_len + (nam->m_off - MMINOFF) == MLEN)
- return (EMSGSIZE);
- *(mtod(nam, caddr_t) + nam->m_len) = 0;
- ndp->ni_nameiop = LOOKUP | FOLLOW;
- ndp->ni_segflg = UIO_SYSSPACE;
- ip = namei(ndp);
- if (ip == 0) {
- error = u.u_error;
- u.u_error = 0;
- return (error); /* XXX */
- }
- if (access(ip, IWRITE)) {
- error = u.u_error;
- u.u_error = 0; /* XXX */
- goto bad;
- }
- if ((ip->i_mode&IFMT) != IFSOCK) {
+ struct nameidata nd;
+
+ NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, soun->sun_path, p);
+ if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) { /* XXX */
+ if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0)
+ return (EMSGSIZE);
+ } else
+ *(mtod(nam, caddr_t) + nam->m_len) = 0;
+ if (error = namei(&nd))
+ return (error);
+ vp = nd.ni_vp;
+ if (vp->v_type != VSOCK) {
error = ENOTSOCK;
goto bad;
}
- so2 = ip->i_socket;
+ if (error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p))
+ goto bad;
+ so2 = vp->v_socket;
if (so2 == 0) {
error = ECONNREFUSED;
goto bad;
error = EPROTOTYPE;
goto bad;
}
- if (so->so_proto->pr_flags & PR_CONNREQUIRED &&
- ((so2->so_options&SO_ACCEPTCONN) == 0 ||
- (so2 = sonewconn(so2)) == 0)) {
- error = ECONNREFUSED;
- goto bad;
+ if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
+ if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
+ (so3 = sonewconn(so2, 0)) == 0) {
+ error = ECONNREFUSED;
+ goto bad;
+ }
+ unp2 = sotounpcb(so2);
+ unp3 = sotounpcb(so3);
+ if (unp2->unp_addr)
+ unp3->unp_addr =
+ m_copy(unp2->unp_addr, 0, (int)M_COPYALL);
+ so2 = so3;
}
error = unp_connect2(so, so2);
bad:
- iput(ip);
+ vput(vp);
return (error);
}
case SOCK_STREAM:
unp2->unp_conn = unp;
- soisconnected(so2);
soisconnected(so);
+ soisconnected(so2);
break;
default:
}
#endif
-/*ARGSUSED*/
-unp_usrclosed(unp)
+unp_shutdown(unp)
struct unpcb *unp;
{
+ struct socket *so;
+ if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn &&
+ (so = unp->unp_conn->unp_socket))
+ socantrcvmore(so);
}
unp_drop(unp, errno)
unp_externalize(rights)
struct mbuf *rights;
{
- int newfds = rights->m_len / sizeof (int);
+ struct proc *p = curproc; /* XXX */
register int i;
- register struct file **rp = mtod(rights, struct file **);
+ register struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
+ register struct file **rp = (struct file **)(cm + 1);
register struct file *fp;
+ int newfds = (cm->cmsg_len - sizeof(*cm)) / sizeof (int);
int f;
- if (newfds > ufavail()) {
+ if (!fdavail(p, newfds)) {
for (i = 0; i < newfds; i++) {
fp = *rp;
unp_discard(fp);
return (EMSGSIZE);
}
for (i = 0; i < newfds; i++) {
- f = ufalloc(0);
- if (f < 0)
+ if (fdalloc(p, 0, &f))
panic("unp_externalize");
fp = *rp;
- u.u_ofile[f] = fp;
+ p->p_fd->fd_ofiles[f] = fp;
fp->f_msgcount--;
unp_rights--;
*(int *)rp++ = f;
return (0);
}
-unp_internalize(rights)
- struct mbuf *rights;
+unp_internalize(control, p)
+ struct mbuf *control;
+ struct proc *p;
{
+ struct filedesc *fdp = p->p_fd;
+ register struct cmsghdr *cm = mtod(control, struct cmsghdr *);
register struct file **rp;
- int oldfds = rights->m_len / sizeof (int);
- register int i;
register struct file *fp;
+ register int i, fd;
+ int oldfds;
- rp = mtod(rights, struct file **);
- for (i = 0; i < oldfds; i++)
- if (getf(*(int *)rp++) == 0)
+ if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
+ cm->cmsg_len != control->m_len)
+ return (EINVAL);
+ oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
+ rp = (struct file **)(cm + 1);
+ for (i = 0; i < oldfds; i++) {
+ fd = *(int *)rp++;
+ if ((unsigned)fd >= fdp->fd_nfiles ||
+ fdp->fd_ofiles[fd] == NULL)
return (EBADF);
- rp = mtod(rights, struct file **);
+ }
+ rp = (struct file **)(cm + 1);
for (i = 0; i < oldfds; i++) {
- fp = getf(*(int *)rp);
+ fp = fdp->fd_ofiles[*(int *)rp];
*rp++ = fp;
fp->f_count++;
fp->f_msgcount++;
unp_gc()
{
- register struct file *fp;
+ register struct file *fp, *nextfp;
register struct socket *so;
+ struct file **extra_ref, **fpp;
+ int nunref, i;
if (unp_gcing)
return;
unp_gcing = 1;
restart:
unp_defer = 0;
- for (fp = file; fp < fileNFILE; fp++)
+ for (fp = filehead; fp; fp = fp->f_filef)
fp->f_flag &= ~(FMARK|FDEFER);
do {
- for (fp = file; fp < fileNFILE; fp++) {
+ for (fp = filehead; fp; fp = fp->f_filef) {
if (fp->f_count == 0)
continue;
if (fp->f_flag & FDEFER) {
continue;
fp->f_flag |= FMARK;
}
- if (fp->f_type != DTYPE_SOCKET)
+ if (fp->f_type != DTYPE_SOCKET ||
+ (so = (struct socket *)fp->f_data) == 0)
continue;
- so = (struct socket *)fp->f_data;
if (so->so_proto->pr_domain != &unixdomain ||
(so->so_proto->pr_flags&PR_RIGHTS) == 0)
continue;
+#ifdef notdef
if (so->so_rcv.sb_flags & SB_LOCK) {
- sbwait(&so->so_rcv);
+ /*
+ * This is problematical; it's not clear
+ * we need to wait for the sockbuf to be
+ * unlocked (on a uniprocessor, at least),
+ * and it's also not clear what to do
+ * if sbwait returns an error due to receipt
+ * of a signal. If sbwait does return
+ * an error, we'll go into an infinite
+ * loop. Delete all of this for now.
+ */
+ (void) sbwait(&so->so_rcv);
goto restart;
}
+#endif
unp_scan(so->so_rcv.sb_mb, unp_mark);
}
} while (unp_defer);
- for (fp = file; fp < fileNFILE; fp++) {
+ /*
+ * We grab an extra reference to each of the file table entries
+ * that are not otherwise accessible and then free the rights
+ * that are stored in messages on them.
+ *
+ * The bug in the orginal code is a little tricky, so I'll describe
+ * what's wrong with it here.
+ *
+ * It is incorrect to simply unp_discard each entry for f_msgcount
+ * times -- consider the case of sockets A and B that contain
+ * references to each other. On a last close of some other socket,
+ * we trigger a gc since the number of outstanding rights (unp_rights)
+ * is non-zero. If during the sweep phase the gc code un_discards,
+ * we end up doing a (full) closef on the descriptor. A closef on A
+ * results in the following chain. Closef calls soo_close, which
+ * calls soclose. Soclose calls first (through the switch
+ * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
+ * returns because the previous instance had set unp_gcing, and
+ * we return all the way back to soclose, which marks the socket
+ * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
+ * to free up the rights that are queued in messages on the socket A,
+ * i.e., the reference on B. The sorflush calls via the dom_dispose
+ * switch unp_dispose, which unp_scans with unp_discard. This second
+ * instance of unp_discard just calls closef on B.
+ *
+ * Well, a similar chain occurs on B, resulting in a sorflush on B,
+ * which results in another closef on A. Unfortunately, A is already
+ * being closed, and the descriptor has already been marked with
+ * SS_NOFDREF, and soclose panics at this point.
+ *
+ * Here, we first take an extra reference to each inaccessible
+ * descriptor. Then, we call sorflush ourself, since we know
+ * it is a Unix domain socket anyhow. After we destroy all the
+ * rights carried in messages, we do a last closef to get rid
+ * of our extra reference. This is the last close, and the
+ * unp_detach etc will shut down the socket.
+ *
+ * 91/09/19, bsy@cs.cmu.edu
+ */
+ extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK);
+ for (nunref = 0, fp = filehead, fpp = extra_ref; fp; fp = nextfp) {
+ nextfp = fp->f_filef;
if (fp->f_count == 0)
continue;
- if (fp->f_count == fp->f_msgcount && (fp->f_flag & FMARK) == 0)
- while (fp->f_msgcount)
- unp_discard(fp);
+ if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
+ *fpp++ = fp;
+ nunref++;
+ fp->f_count++;
+ }
}
+ for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
+ sorflush((struct socket *)(*fpp)->f_data);
+ for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
+ closef(*fpp);
+ free((caddr_t)extra_ref, M_FILE);
unp_gcing = 0;
}
{
register struct mbuf *m;
register struct file **rp;
+ register struct cmsghdr *cm;
register int i;
int qfds;
while (m0) {
for (m = m0; m; m = m->m_next)
- if (m->m_type == MT_RIGHTS && m->m_len) {
- qfds = m->m_len / sizeof (struct file *);
- rp = mtod(m, struct file **);
+ if (m->m_type == MT_CONTROL &&
+ m->m_len >= sizeof(*cm)) {
+ cm = mtod(m, struct cmsghdr *);
+ if (cm->cmsg_level != SOL_SOCKET ||
+ cm->cmsg_type != SCM_RIGHTS)
+ continue;
+ qfds = (cm->cmsg_len - sizeof *cm)
+ / sizeof (struct file *);
+ rp = (struct file **)(cm + 1);
for (i = 0; i < qfds; i++)
(*op)(*rp++);
break; /* XXX, but saves time */
fp->f_msgcount--;
unp_rights--;
- closef(fp);
+ (void) closef(fp, (struct proc *)NULL);
}