fix bug that can cause recursive .forward files to fail

[unix-history] / usr / src / sys / kern / uipc_usrreq.c

diff --git a/usr/src/sys/kern/uipc_usrreq.c b/usr/src/sys/kern/uipc_usrreq.c
index 005b7a7..04b723b 100644 (file)
--- a/usr/src/sys/kern/uipc_usrreq.c
+++ b/usr/src/sys/kern/uipc_usrreq.c
@@ -2,21 +2,24 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)uipc_usrreq.c       7.21 (Berkeley) %G%
+ *     @(#)uipc_usrreq.c       8.2 (Berkeley) %G%

  */
 
  */
 

-#include "param.h"
-#include "user.h"
-#include "domain.h"
-#include "protosw.h"
-#include "socket.h"
-#include "socketvar.h"
-#include "unpcb.h"
-#include "un.h"
-#include "vnode.h"
-#include "file.h"
-#include "stat.h"
-#include "mbuf.h"
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/proc.h>
+#include <sys/filedesc.h>
+#include <sys/domain.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/unpcb.h>
+#include <sys/un.h>
+#include <sys/namei.h>
+#include <sys/vnode.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <sys/mbuf.h>

 
 /*
  * Unix communications domain.
 
 /*
  * Unix communications domain.


@@ -38,6 +41,7 @@ uipc_usrreq(so, req, m, nam, control)
        struct unpcb *unp = sotounpcb(so);
        register struct socket *so2;
        register int error = 0;
        struct unpcb *unp = sotounpcb(so);
        register struct socket *so2;
        register int error = 0;

+       struct proc *p = curproc;       /* XXX */

 
        if (req == PRU_CONTROL)
                return (EOPNOTSUPP);
 
        if (req == PRU_CONTROL)
                return (EOPNOTSUPP);


@@ -64,7 +68,7 @@ uipc_usrreq(so, req, m, nam, control)
                break;
 
        case PRU_BIND:
                break;
 
        case PRU_BIND:

-               error = unp_bind(unp, nam);
+               error = unp_bind(unp, nam, p);

                break;
 
        case PRU_LISTEN:
                break;
 
        case PRU_LISTEN:


@@ -73,7 +77,7 @@ uipc_usrreq(so, req, m, nam, control)
                break;
 
        case PRU_CONNECT:
                break;
 
        case PRU_CONNECT:

-               error = unp_connect(so, nam);
+               error = unp_connect(so, nam, p);

                break;
 
        case PRU_CONNECT2:
                break;
 
        case PRU_CONNECT2:


@@ -137,7 +141,7 @@ uipc_usrreq(so, req, m, nam, control)
                break;
 
        case PRU_SEND:
                break;
 
        case PRU_SEND:

-               if (control && (error = unp_internalize(control)))
+               if (control && (error = unp_internalize(control, p)))

                        break;
                switch (so->so_type) {
 
                        break;
                switch (so->so_type) {
 


@@ -149,7 +153,7 @@ uipc_usrreq(so, req, m, nam, control)
                                        error = EISCONN;
                                        break;
                                }
                                        error = EISCONN;
                                        break;
                                }

-                               error = unp_connect(so, nam);
+                               error = unp_connect(so, nam, p);

                                if (error)
                                        break;
                        } else {
                                if (error)
                                        break;
                        } else {


@@ -298,6 +302,9 @@ unp_attach(so)
                case SOCK_DGRAM:
                        error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
                        break;
                case SOCK_DGRAM:
                        error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
                        break;

+
+               default:
+                       panic("unp_attach");

                }
                if (error)
                        return (error);
                }
                if (error)
                        return (error);


@@ -328,21 +335,32 @@ unp_detach(unp)
        unp->unp_socket->so_pcb = 0;
        m_freem(unp->unp_addr);
        (void) m_free(dtom(unp));
        unp->unp_socket->so_pcb = 0;
        m_freem(unp->unp_addr);
        (void) m_free(dtom(unp));

-       if (unp_rights)
+       if (unp_rights) {
+               /*
+                * Normally the receive buffer is flushed later,
+                * in sofree, but if our receive buffer holds references
+                * to descriptors that are now garbage, we will dispose
+                * of those descriptor references after the garbage collector
+                * gets them (resulting in a "panic: closef: count < 0").
+                */
+               sorflush(unp->unp_socket);

                unp_gc();
                unp_gc();

+       }

 }
 
 }
 

-unp_bind(unp, nam)
+unp_bind(unp, nam, p)

        struct unpcb *unp;
        struct mbuf *nam;
        struct unpcb *unp;
        struct mbuf *nam;

+       struct proc *p;

 {
        struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
        register struct vnode *vp;
 {
        struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
        register struct vnode *vp;

-       register struct nameidata *ndp = &u.u_nd;

        struct vattr vattr;
        int error;
        struct vattr vattr;
        int error;

+       struct nameidata nd;

 
 

-       ndp->ni_dirp = soun->sun_path;
+       NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
+               soun->sun_path, p);

        if (unp->unp_vnode != NULL)
                return (EINVAL);
        if (nam->m_len == MLEN) {
        if (unp->unp_vnode != NULL)
                return (EINVAL);
        if (nam->m_len == MLEN) {


@@ -351,26 +369,25 @@ unp_bind(unp, nam)
        } else
                *(mtod(nam, caddr_t) + nam->m_len) = 0;
 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
        } else
                *(mtod(nam, caddr_t) + nam->m_len) = 0;
 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */

-       ndp->ni_nameiop = CREATE | FOLLOW | LOCKPARENT;
-       ndp->ni_segflg = UIO_SYSSPACE;
-       if (error = namei(ndp))
+       if (error = namei(&nd))

                return (error);
                return (error);

-       vp = ndp->ni_vp;
+       vp = nd.ni_vp;

        if (vp != NULL) {
        if (vp != NULL) {

-               VOP_ABORTOP(ndp);
-               if (ndp->ni_dvp == vp)
-                       vrele(ndp->ni_dvp);
+               VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
+               if (nd.ni_dvp == vp)
+                       vrele(nd.ni_dvp);

                else
                else

-                       vput(ndp->ni_dvp);
+                       vput(nd.ni_dvp);

                vrele(vp);
                return (EADDRINUSE);
        }
        VATTR_NULL(&vattr);
        vattr.va_type = VSOCK;
                vrele(vp);
                return (EADDRINUSE);
        }
        VATTR_NULL(&vattr);
        vattr.va_type = VSOCK;

-       vattr.va_mode = 0777;
-       if (error = VOP_CREATE(ndp, &vattr))
+       vattr.va_mode = ACCESSPERMS;
+       LEASE_CHECK(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE);
+       if (error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr))

                return (error);
                return (error);

-       vp = ndp->ni_vp;
+       vp = nd.ni_vp;

        vp->v_socket = unp->unp_socket;
        unp->unp_vnode = vp;
        unp->unp_addr = m_copy(nam, 0, (int)M_COPYALL);
        vp->v_socket = unp->unp_socket;
        unp->unp_vnode = vp;
        unp->unp_addr = m_copy(nam, 0, (int)M_COPYALL);


@@ -378,33 +395,32 @@ unp_bind(unp, nam)
        return (0);
 }
 
        return (0);
 }
 

-unp_connect(so, nam)
+unp_connect(so, nam, p)

        struct socket *so;
        struct mbuf *nam;
        struct socket *so;
        struct mbuf *nam;

+       struct proc *p;

 {
        register struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
        register struct vnode *vp;
        register struct socket *so2, *so3;
 {
        register struct sockaddr_un *soun = mtod(nam, struct sockaddr_un *);
        register struct vnode *vp;
        register struct socket *so2, *so3;

-       register struct nameidata *ndp = &u.u_nd;

        struct unpcb *unp2, *unp3;
        int error;
        struct unpcb *unp2, *unp3;
        int error;

+       struct nameidata nd;

 
 

-       ndp->ni_dirp = soun->sun_path;
+       NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, soun->sun_path, p);

        if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) {    /* XXX */
                if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0)
                        return (EMSGSIZE);
        } else
                *(mtod(nam, caddr_t) + nam->m_len) = 0;
        if (nam->m_data + nam->m_len == &nam->m_dat[MLEN]) {    /* XXX */
                if (*(mtod(nam, caddr_t) + nam->m_len - 1) != 0)
                        return (EMSGSIZE);
        } else
                *(mtod(nam, caddr_t) + nam->m_len) = 0;

-       ndp->ni_nameiop = LOOKUP | FOLLOW | LOCKLEAF;
-       ndp->ni_segflg = UIO_SYSSPACE;
-       if (error = namei(ndp))
+       if (error = namei(&nd))

                return (error);
                return (error);

-       vp = ndp->ni_vp;
+       vp = nd.ni_vp;

        if (vp->v_type != VSOCK) {
                error = ENOTSOCK;
                goto bad;
        }
        if (vp->v_type != VSOCK) {
                error = ENOTSOCK;
                goto bad;
        }

-       if (error = VOP_ACCESS(vp, VWRITE, ndp->ni_cred))
+       if (error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p))

                goto bad;
        so2 = vp->v_socket;
        if (so2 == 0) {
                goto bad;
        so2 = vp->v_socket;
        if (so2 == 0) {


@@ -546,6 +562,7 @@ unp_drain()
 unp_externalize(rights)
        struct mbuf *rights;
 {
 unp_externalize(rights)
        struct mbuf *rights;
 {

+       struct proc *p = curproc;               /* XXX */

        register int i;
        register struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
        register struct file **rp = (struct file **)(cm + 1);
        register int i;
        register struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
        register struct file **rp = (struct file **)(cm + 1);


@@ -553,7 +570,7 @@ unp_externalize(rights)
        int newfds = (cm->cmsg_len - sizeof(*cm)) / sizeof (int);
        int f;
 
        int newfds = (cm->cmsg_len - sizeof(*cm)) / sizeof (int);
        int f;
 

-       if (newfds > ufavail()) {
+       if (!fdavail(p, newfds)) {

                for (i = 0; i < newfds; i++) {
                        fp = *rp;
                        unp_discard(fp);
                for (i = 0; i < newfds; i++) {
                        fp = *rp;
                        unp_discard(fp);


@@ -562,10 +579,10 @@ unp_externalize(rights)
                return (EMSGSIZE);
        }
        for (i = 0; i < newfds; i++) {
                return (EMSGSIZE);
        }
        for (i = 0; i < newfds; i++) {

-               if (ufalloc(0, &f))
+               if (fdalloc(p, 0, &f))

                        panic("unp_externalize");
                fp = *rp;
                        panic("unp_externalize");
                fp = *rp;

-               u.u_ofile[f] = fp;
+               p->p_fd->fd_ofiles[f] = fp;

                fp->f_msgcount--;
                unp_rights--;
                *(int *)rp++ = f;
                fp->f_msgcount--;
                unp_rights--;
                *(int *)rp++ = f;


@@ -573,9 +590,11 @@ unp_externalize(rights)
        return (0);
 }
 
        return (0);
 }
 

-unp_internalize(control)
+unp_internalize(control, p)

        struct mbuf *control;
        struct mbuf *control;

+       struct proc *p;

 {
 {

+       struct filedesc *fdp = p->p_fd;

        register struct cmsghdr *cm = mtod(control, struct cmsghdr *);
        register struct file **rp;
        register struct file *fp;
        register struct cmsghdr *cm = mtod(control, struct cmsghdr *);
        register struct file **rp;
        register struct file *fp;


@@ -589,12 +608,13 @@ unp_internalize(control)
        rp = (struct file **)(cm + 1);
        for (i = 0; i < oldfds; i++) {
                fd = *(int *)rp++;
        rp = (struct file **)(cm + 1);
        for (i = 0; i < oldfds; i++) {
                fd = *(int *)rp++;

-               if ((unsigned)fd >= NOFILE || u.u_ofile[fd] == NULL)
+               if ((unsigned)fd >= fdp->fd_nfiles ||
+                   fdp->fd_ofiles[fd] == NULL)

                        return (EBADF);
        }
        rp = (struct file **)(cm + 1);
        for (i = 0; i < oldfds; i++) {
                        return (EBADF);
        }
        rp = (struct file **)(cm + 1);
        for (i = 0; i < oldfds; i++) {

-               fp = u.u_ofile[*(int *)rp];
+               fp = fdp->fd_ofiles[*(int *)rp];

                *rp++ = fp;
                fp->f_count++;
                fp->f_msgcount++;
                *rp++ = fp;
                fp->f_count++;
                fp->f_msgcount++;


@@ -609,18 +629,20 @@ extern    struct domain unixdomain;
 
 unp_gc()
 {
 
 unp_gc()
 {

-       register struct file *fp;
+       register struct file *fp, *nextfp;

        register struct socket *so;
        register struct socket *so;

+       struct file **extra_ref, **fpp;
+       int nunref, i;

 
        if (unp_gcing)
                return;
        unp_gcing = 1;
 restart:
        unp_defer = 0;
 
        if (unp_gcing)
                return;
        unp_gcing = 1;
 restart:
        unp_defer = 0;

-       for (fp = file; fp < fileNFILE; fp++)
+       for (fp = filehead; fp; fp = fp->f_filef)

                fp->f_flag &= ~(FMARK|FDEFER);
        do {
                fp->f_flag &= ~(FMARK|FDEFER);
        do {

-               for (fp = file; fp < fileNFILE; fp++) {
+               for (fp = filehead; fp; fp = fp->f_filef) {

                        if (fp->f_count == 0)
                                continue;
                        if (fp->f_flag & FDEFER) {
                        if (fp->f_count == 0)
                                continue;
                        if (fp->f_flag & FDEFER) {


@@ -658,13 +680,61 @@ restart:
                        unp_scan(so->so_rcv.sb_mb, unp_mark);
                }
        } while (unp_defer);
                        unp_scan(so->so_rcv.sb_mb, unp_mark);
                }
        } while (unp_defer);

-       for (fp = file; fp < fileNFILE; fp++) {
+       /*
+        * We grab an extra reference to each of the file table entries
+        * that are not otherwise accessible and then free the rights
+        * that are stored in messages on them.
+        *
+        * The bug in the orginal code is a little tricky, so I'll describe
+        * what's wrong with it here.
+        *
+        * It is incorrect to simply unp_discard each entry for f_msgcount
+        * times -- consider the case of sockets A and B that contain
+        * references to each other.  On a last close of some other socket,
+        * we trigger a gc since the number of outstanding rights (unp_rights)
+        * is non-zero.  If during the sweep phase the gc code un_discards,
+        * we end up doing a (full) closef on the descriptor.  A closef on A
+        * results in the following chain.  Closef calls soo_close, which
+        * calls soclose.   Soclose calls first (through the switch
+        * uipc_usrreq) unp_detach, which re-invokes unp_gc.  Unp_gc simply
+        * returns because the previous instance had set unp_gcing, and
+        * we return all the way back to soclose, which marks the socket
+        * with SS_NOFDREF, and then calls sofree.  Sofree calls sorflush
+        * to free up the rights that are queued in messages on the socket A,
+        * i.e., the reference on B.  The sorflush calls via the dom_dispose
+        * switch unp_dispose, which unp_scans with unp_discard.  This second
+        * instance of unp_discard just calls closef on B.
+        *
+        * Well, a similar chain occurs on B, resulting in a sorflush on B,
+        * which results in another closef on A.  Unfortunately, A is already
+        * being closed, and the descriptor has already been marked with
+        * SS_NOFDREF, and soclose panics at this point.
+        *
+        * Here, we first take an extra reference to each inaccessible
+        * descriptor.  Then, we call sorflush ourself, since we know
+        * it is a Unix domain socket anyhow.  After we destroy all the
+        * rights carried in messages, we do a last closef to get rid
+        * of our extra reference.  This is the last close, and the
+        * unp_detach etc will shut down the socket.
+        *
+        * 91/09/19, bsy@cs.cmu.edu
+        */
+       extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK);
+       for (nunref = 0, fp = filehead, fpp = extra_ref; fp; fp = nextfp) {
+               nextfp = fp->f_filef;

                if (fp->f_count == 0)
                        continue;
                if (fp->f_count == 0)
                        continue;

-               if (fp->f_count == fp->f_msgcount && (fp->f_flag & FMARK) == 0)
-                       while (fp->f_msgcount)
-                               unp_discard(fp);
+               if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
+                       *fpp++ = fp;
+                       nunref++;
+                       fp->f_count++;
+               }

        }
        }

+       for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
+               sorflush((struct socket *)(*fpp)->f_data);
+       for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
+               closef(*fpp);
+       free((caddr_t)extra_ref, M_FILE);

        unp_gcing = 0;
 }
 
        unp_gcing = 0;
 }
 


@@ -722,5 +792,5 @@ unp_discard(fp)
 
        fp->f_msgcount--;
        unp_rights--;
 
        fp->f_msgcount--;
        unp_rights--;

-       (void) closef(fp);
+       (void) closef(fp, (struct proc *)NULL);

 }
 }