2 * NET4: Implementation of BSD Unix domain sockets.
4 * Authors: Alan Cox, <alan@lxorguk.ukuu.org.uk>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 * Linus Torvalds : Assorted bug cures.
13 * Niibe Yutaka : async I/O support.
14 * Carsten Paeth : PF_UNIX check, address fixes.
15 * Alan Cox : Limit size of allocated blocks.
16 * Alan Cox : Fixed the stupid socketpair bug.
17 * Alan Cox : BSD compatibility fine tuning.
18 * Alan Cox : Fixed a bug in connect when interrupted.
19 * Alan Cox : Sorted out a proper draft version of
20 * file descriptor passing hacked up from
22 * Marty Leisner : Fixes to fd passing
23 * Nick Nevin : recvmsg bugfix.
24 * Alan Cox : Started proper garbage collector
25 * Heiko EiBfeldt : Missing verify_area check
26 * Alan Cox : Started POSIXisms
27 * Andreas Schwab : Replace inode by dentry for proper
29 * Kirk Petersen : Made this a module
30 * Christoph Rohland : Elegant non-blocking accept/connect algorithm.
32 * Alexey Kuznetosv : Repaired (I hope) bugs introduces
33 * by above two patches.
34 * Andrea Arcangeli : If possible we block in connect(2)
35 * if the max backlog of the listen socket
36 * is been reached. This won't break
37 * old apps and it will avoid huge amount
38 * of socks hashed (this for unix_gc()
39 * performances reasons).
40 * Security fix that limits the max
41 * number of socks to 2*max_files and
42 * the number of skb queueable in the
44 * Artur Skawina : Hash function optimizations
45 * Alexey Kuznetsov : Full scale SMP. Lot of bugs are introduced 8)
46 * Malcolm Beattie : Set peercred for socketpair
47 * Michal Ostrowski : Module initialization cleanup.
48 * Arnaldo C. Melo : Remove MOD_{INC,DEC}_USE_COUNT,
49 * the core infrastructure is doing that
50 * for all net proto families now (2.5.69+)
53 * Known differences from reference BSD that was tested:
56 * ECONNREFUSED is not returned from one end of a connected() socket to the
57 * other the moment one end closes.
58 * fstat() doesn't return st_dev=0, and give the blksize as high water mark
59 * and a fake inode identifier (nor the BSD first socket fstat twice bug).
61 * accept() returns a path name even if the connecting socket has closed
62 * in the meantime (BSD loses the path and gives up).
63 * accept() returns 0 length path for an unbound connector. BSD returns 16
64 * and a null first byte in the path (but not for gethost/peername - BSD bug ??)
65 * socketpair(...SOCK_RAW..) doesn't panic the kernel.
66 * BSD af_unix apparently has connect forgetting to block properly.
67 * (need to check this with the POSIX spec in detail)
69 * Differences from 2.0.0-11-... (ANK)
70 * Bug fixes and improvements.
71 * - client shutdown killed server socket.
72 * - removed all useless cli/sti pairs.
74 * Semantic changes/extensions.
75 * - generic control message passing.
76 * - SCM_CREDENTIALS control message.
77 * - "Abstract" (not FS based) socket bindings.
78 * Abstract names are sequences of bytes (not zero terminated)
79 * started by 0, so that this name space does not intersect
83 #include <linux/module.h>
84 #include <linux/kernel.h>
85 #include <linux/signal.h>
86 #include <linux/sched.h>
87 #include <linux/errno.h>
88 #include <linux/string.h>
89 #include <linux/stat.h>
90 #include <linux/dcache.h>
91 #include <linux/namei.h>
92 #include <linux/socket.h>
94 #include <linux/fcntl.h>
95 #include <linux/termios.h>
96 #include <linux/sockios.h>
97 #include <linux/net.h>
100 #include <linux/slab.h>
101 #include <asm/uaccess.h>
102 #include <linux/skbuff.h>
103 #include <linux/netdevice.h>
104 #include <net/net_namespace.h>
105 #include <net/sock.h>
106 #include <net/tcp_states.h>
107 #include <net/af_unix.h>
108 #include <linux/proc_fs.h>
109 #include <linux/seq_file.h>
111 #include <linux/init.h>
112 #include <linux/poll.h>
113 #include <linux/rtnetlink.h>
114 #include <linux/mount.h>
115 #include <net/checksum.h>
116 #include <linux/security.h>
118 static struct hlist_head unix_socket_table
[UNIX_HASH_SIZE
+ 1];
119 static DEFINE_SPINLOCK(unix_table_lock
);
120 static atomic_t unix_nr_socks
= ATOMIC_INIT(0);
122 #define unix_sockets_unbound (&unix_socket_table[UNIX_HASH_SIZE])
124 #define UNIX_ABSTRACT(sk) (unix_sk(sk)->addr->hash != UNIX_HASH_SIZE)
126 #ifdef CONFIG_SECURITY_NETWORK
127 static void unix_get_secdata(struct scm_cookie
*scm
, struct sk_buff
*skb
)
129 memcpy(UNIXSID(skb
), &scm
->secid
, sizeof(u32
));
132 static inline void unix_set_secdata(struct scm_cookie
*scm
, struct sk_buff
*skb
)
134 scm
->secid
= *UNIXSID(skb
);
137 static inline void unix_get_secdata(struct scm_cookie
*scm
, struct sk_buff
*skb
)
140 static inline void unix_set_secdata(struct scm_cookie
*scm
, struct sk_buff
*skb
)
142 #endif /* CONFIG_SECURITY_NETWORK */
145 * SMP locking strategy:
146 * hash table is protected with spinlock unix_table_lock
147 * each socket state is protected by separate rwlock.
150 static inline unsigned unix_hash_fold(__wsum n
)
152 unsigned hash
= (__force
unsigned)n
;
155 return hash
&(UNIX_HASH_SIZE
-1);
158 #define unix_peer(sk) (unix_sk(sk)->peer)
160 static inline int unix_our_peer(struct sock
*sk
, struct sock
*osk
)
162 return unix_peer(osk
) == sk
;
165 static inline int unix_may_send(struct sock
*sk
, struct sock
*osk
)
167 return unix_peer(osk
) == NULL
|| unix_our_peer(sk
, osk
);
170 static inline int unix_recvq_full(struct sock
const *sk
)
172 return skb_queue_len(&sk
->sk_receive_queue
) > sk
->sk_max_ack_backlog
;
175 static struct sock
*unix_peer_get(struct sock
*s
)
183 unix_state_unlock(s
);
187 static inline void unix_release_addr(struct unix_address
*addr
)
189 if (atomic_dec_and_test(&addr
->refcnt
))
194 * Check unix socket name:
195 * - should be not zero length.
196 * - if started by not zero, should be NULL terminated (FS object)
197 * - if started by zero, it is abstract name.
200 static int unix_mkname(struct sockaddr_un
*sunaddr
, int len
, unsigned *hashp
)
202 if (len
<= sizeof(short) || len
> sizeof(*sunaddr
))
204 if (!sunaddr
|| sunaddr
->sun_family
!= AF_UNIX
)
206 if (sunaddr
->sun_path
[0]) {
208 * This may look like an off by one error but it is a bit more
209 * subtle. 108 is the longest valid AF_UNIX path for a binding.
210 * sun_path[108] doesnt as such exist. However in kernel space
211 * we are guaranteed that it is a valid memory location in our
212 * kernel address buffer.
214 ((char *)sunaddr
)[len
] = 0;
215 len
= strlen(sunaddr
->sun_path
)+1+sizeof(short);
219 *hashp
= unix_hash_fold(csum_partial(sunaddr
, len
, 0));
223 static void __unix_remove_socket(struct sock
*sk
)
225 sk_del_node_init(sk
);
228 static void __unix_insert_socket(struct hlist_head
*list
, struct sock
*sk
)
230 WARN_ON(!sk_unhashed(sk
));
231 sk_add_node(sk
, list
);
234 static inline void unix_remove_socket(struct sock
*sk
)
236 spin_lock(&unix_table_lock
);
237 __unix_remove_socket(sk
);
238 spin_unlock(&unix_table_lock
);
241 static inline void unix_insert_socket(struct hlist_head
*list
, struct sock
*sk
)
243 spin_lock(&unix_table_lock
);
244 __unix_insert_socket(list
, sk
);
245 spin_unlock(&unix_table_lock
);
248 static struct sock
*__unix_find_socket_byname(struct net
*net
,
249 struct sockaddr_un
*sunname
,
250 int len
, int type
, unsigned hash
)
253 struct hlist_node
*node
;
255 sk_for_each(s
, node
, &unix_socket_table
[hash
^ type
]) {
256 struct unix_sock
*u
= unix_sk(s
);
258 if (!net_eq(sock_net(s
), net
))
261 if (u
->addr
->len
== len
&&
262 !memcmp(u
->addr
->name
, sunname
, len
))
270 static inline struct sock
*unix_find_socket_byname(struct net
*net
,
271 struct sockaddr_un
*sunname
,
277 spin_lock(&unix_table_lock
);
278 s
= __unix_find_socket_byname(net
, sunname
, len
, type
, hash
);
281 spin_unlock(&unix_table_lock
);
285 static struct sock
*unix_find_socket_byinode(struct net
*net
, struct inode
*i
)
288 struct hlist_node
*node
;
290 spin_lock(&unix_table_lock
);
292 &unix_socket_table
[i
->i_ino
& (UNIX_HASH_SIZE
- 1)]) {
293 struct dentry
*dentry
= unix_sk(s
)->dentry
;
295 if (!net_eq(sock_net(s
), net
))
298 if (dentry
&& dentry
->d_inode
== i
) {
305 spin_unlock(&unix_table_lock
);
309 static inline int unix_writable(struct sock
*sk
)
311 return (atomic_read(&sk
->sk_wmem_alloc
) << 2) <= sk
->sk_sndbuf
;
314 static void unix_write_space(struct sock
*sk
)
316 read_lock(&sk
->sk_callback_lock
);
317 if (unix_writable(sk
)) {
318 if (sk
->sk_sleep
&& waitqueue_active(sk
->sk_sleep
))
319 wake_up_interruptible_sync(sk
->sk_sleep
);
320 sk_wake_async(sk
, SOCK_WAKE_SPACE
, POLL_OUT
);
322 read_unlock(&sk
->sk_callback_lock
);
325 /* When dgram socket disconnects (or changes its peer), we clear its receive
326 * queue of packets arrived from previous peer. First, it allows to do
327 * flow control based only on wmem_alloc; second, sk connected to peer
328 * may receive messages only from that peer. */
329 static void unix_dgram_disconnected(struct sock
*sk
, struct sock
*other
)
331 if (!skb_queue_empty(&sk
->sk_receive_queue
)) {
332 skb_queue_purge(&sk
->sk_receive_queue
);
333 wake_up_interruptible_all(&unix_sk(sk
)->peer_wait
);
335 /* If one link of bidirectional dgram pipe is disconnected,
336 * we signal error. Messages are lost. Do not make this,
337 * when peer was not connected to us.
339 if (!sock_flag(other
, SOCK_DEAD
) && unix_peer(other
) == sk
) {
340 other
->sk_err
= ECONNRESET
;
341 other
->sk_error_report(other
);
346 static void unix_sock_destructor(struct sock
*sk
)
348 struct unix_sock
*u
= unix_sk(sk
);
350 skb_queue_purge(&sk
->sk_receive_queue
);
352 WARN_ON(atomic_read(&sk
->sk_wmem_alloc
));
353 WARN_ON(!sk_unhashed(sk
));
354 WARN_ON(sk
->sk_socket
);
355 if (!sock_flag(sk
, SOCK_DEAD
)) {
356 printk(KERN_DEBUG
"Attempt to release alive unix socket: %p\n", sk
);
361 unix_release_addr(u
->addr
);
363 atomic_dec(&unix_nr_socks
);
364 sock_prot_inuse_add(sock_net(sk
), sk
->sk_prot
, -1);
365 #ifdef UNIX_REFCNT_DEBUG
366 printk(KERN_DEBUG
"UNIX %p is destroyed, %d are still alive.\n", sk
,
367 atomic_read(&unix_nr_socks
));
371 static int unix_release_sock(struct sock
*sk
, int embrion
)
373 struct unix_sock
*u
= unix_sk(sk
);
374 struct dentry
*dentry
;
375 struct vfsmount
*mnt
;
380 unix_remove_socket(sk
);
385 sk
->sk_shutdown
= SHUTDOWN_MASK
;
390 state
= sk
->sk_state
;
391 sk
->sk_state
= TCP_CLOSE
;
392 unix_state_unlock(sk
);
394 wake_up_interruptible_all(&u
->peer_wait
);
396 skpair
= unix_peer(sk
);
398 if (skpair
!= NULL
) {
399 if (sk
->sk_type
== SOCK_STREAM
|| sk
->sk_type
== SOCK_SEQPACKET
) {
400 unix_state_lock(skpair
);
402 skpair
->sk_shutdown
= SHUTDOWN_MASK
;
403 if (!skb_queue_empty(&sk
->sk_receive_queue
) || embrion
)
404 skpair
->sk_err
= ECONNRESET
;
405 unix_state_unlock(skpair
);
406 skpair
->sk_state_change(skpair
);
407 read_lock(&skpair
->sk_callback_lock
);
408 sk_wake_async(skpair
, SOCK_WAKE_WAITD
, POLL_HUP
);
409 read_unlock(&skpair
->sk_callback_lock
);
411 sock_put(skpair
); /* It may now die */
412 unix_peer(sk
) = NULL
;
415 /* Try to flush out this socket. Throw out buffers at least */
417 while ((skb
= skb_dequeue(&sk
->sk_receive_queue
)) != NULL
) {
418 if (state
== TCP_LISTEN
)
419 unix_release_sock(skb
->sk
, 1);
420 /* passed fds are erased in the kfree_skb hook */
431 /* ---- Socket is dead now and most probably destroyed ---- */
434 * Fixme: BSD difference: In BSD all sockets connected to use get
435 * ECONNRESET and we die on the spot. In Linux we behave
436 * like files and pipes do and wait for the last
439 * Can't we simply set sock->err?
441 * What the above comment does talk about? --ANK(980817)
444 if (unix_tot_inflight
)
445 unix_gc(); /* Garbage collect fds */
450 static int unix_listen(struct socket
*sock
, int backlog
)
453 struct sock
*sk
= sock
->sk
;
454 struct unix_sock
*u
= unix_sk(sk
);
457 if (sock
->type
!= SOCK_STREAM
&& sock
->type
!= SOCK_SEQPACKET
)
458 goto out
; /* Only stream/seqpacket sockets accept */
461 goto out
; /* No listens on an unbound socket */
463 if (sk
->sk_state
!= TCP_CLOSE
&& sk
->sk_state
!= TCP_LISTEN
)
465 if (backlog
> sk
->sk_max_ack_backlog
)
466 wake_up_interruptible_all(&u
->peer_wait
);
467 sk
->sk_max_ack_backlog
= backlog
;
468 sk
->sk_state
= TCP_LISTEN
;
469 /* set credentials so connect can copy them */
470 sk
->sk_peercred
.pid
= task_tgid_vnr(current
);
471 sk
->sk_peercred
.uid
= current
->euid
;
472 sk
->sk_peercred
.gid
= current
->egid
;
476 unix_state_unlock(sk
);
481 static int unix_release(struct socket
*);
482 static int unix_bind(struct socket
*, struct sockaddr
*, int);
483 static int unix_stream_connect(struct socket
*, struct sockaddr
*,
484 int addr_len
, int flags
);
485 static int unix_socketpair(struct socket
*, struct socket
*);
486 static int unix_accept(struct socket
*, struct socket
*, int);
487 static int unix_getname(struct socket
*, struct sockaddr
*, int *, int);
488 static unsigned int unix_poll(struct file
*, struct socket
*, poll_table
*);
489 static unsigned int unix_dgram_poll(struct file
*, struct socket
*,
491 static int unix_ioctl(struct socket
*, unsigned int, unsigned long);
492 static int unix_shutdown(struct socket
*, int);
493 static int unix_stream_sendmsg(struct kiocb
*, struct socket
*,
494 struct msghdr
*, size_t);
495 static int unix_stream_recvmsg(struct kiocb
*, struct socket
*,
496 struct msghdr
*, size_t, int);
497 static int unix_dgram_sendmsg(struct kiocb
*, struct socket
*,
498 struct msghdr
*, size_t);
499 static int unix_dgram_recvmsg(struct kiocb
*, struct socket
*,
500 struct msghdr
*, size_t, int);
501 static int unix_dgram_connect(struct socket
*, struct sockaddr
*,
503 static int unix_seqpacket_sendmsg(struct kiocb
*, struct socket
*,
504 struct msghdr
*, size_t);
506 static const struct proto_ops unix_stream_ops
= {
508 .owner
= THIS_MODULE
,
509 .release
= unix_release
,
511 .connect
= unix_stream_connect
,
512 .socketpair
= unix_socketpair
,
513 .accept
= unix_accept
,
514 .getname
= unix_getname
,
517 .listen
= unix_listen
,
518 .shutdown
= unix_shutdown
,
519 .setsockopt
= sock_no_setsockopt
,
520 .getsockopt
= sock_no_getsockopt
,
521 .sendmsg
= unix_stream_sendmsg
,
522 .recvmsg
= unix_stream_recvmsg
,
523 .mmap
= sock_no_mmap
,
524 .sendpage
= sock_no_sendpage
,
527 static const struct proto_ops unix_dgram_ops
= {
529 .owner
= THIS_MODULE
,
530 .release
= unix_release
,
532 .connect
= unix_dgram_connect
,
533 .socketpair
= unix_socketpair
,
534 .accept
= sock_no_accept
,
535 .getname
= unix_getname
,
536 .poll
= unix_dgram_poll
,
538 .listen
= sock_no_listen
,
539 .shutdown
= unix_shutdown
,
540 .setsockopt
= sock_no_setsockopt
,
541 .getsockopt
= sock_no_getsockopt
,
542 .sendmsg
= unix_dgram_sendmsg
,
543 .recvmsg
= unix_dgram_recvmsg
,
544 .mmap
= sock_no_mmap
,
545 .sendpage
= sock_no_sendpage
,
548 static const struct proto_ops unix_seqpacket_ops
= {
550 .owner
= THIS_MODULE
,
551 .release
= unix_release
,
553 .connect
= unix_stream_connect
,
554 .socketpair
= unix_socketpair
,
555 .accept
= unix_accept
,
556 .getname
= unix_getname
,
557 .poll
= unix_dgram_poll
,
559 .listen
= unix_listen
,
560 .shutdown
= unix_shutdown
,
561 .setsockopt
= sock_no_setsockopt
,
562 .getsockopt
= sock_no_getsockopt
,
563 .sendmsg
= unix_seqpacket_sendmsg
,
564 .recvmsg
= unix_dgram_recvmsg
,
565 .mmap
= sock_no_mmap
,
566 .sendpage
= sock_no_sendpage
,
569 static struct proto unix_proto
= {
571 .owner
= THIS_MODULE
,
572 .sockets_allocated
= &unix_nr_socks
,
573 .obj_size
= sizeof(struct unix_sock
),
577 * AF_UNIX sockets do not interact with hardware, hence they
578 * dont trigger interrupts - so it's safe for them to have
579 * bh-unsafe locking for their sk_receive_queue.lock. Split off
580 * this special lock-class by reinitializing the spinlock key:
582 static struct lock_class_key af_unix_sk_receive_queue_lock_key
;
584 static struct sock
*unix_create1(struct net
*net
, struct socket
*sock
)
586 struct sock
*sk
= NULL
;
589 atomic_inc(&unix_nr_socks
);
590 if (atomic_read(&unix_nr_socks
) > 2 * get_max_files())
593 sk
= sk_alloc(net
, PF_UNIX
, GFP_KERNEL
, &unix_proto
);
597 sock_init_data(sock
, sk
);
598 lockdep_set_class(&sk
->sk_receive_queue
.lock
,
599 &af_unix_sk_receive_queue_lock_key
);
601 sk
->sk_write_space
= unix_write_space
;
602 sk
->sk_max_ack_backlog
= net
->unx
.sysctl_max_dgram_qlen
;
603 sk
->sk_destruct
= unix_sock_destructor
;
607 spin_lock_init(&u
->lock
);
608 atomic_long_set(&u
->inflight
, 0);
609 INIT_LIST_HEAD(&u
->link
);
610 mutex_init(&u
->readlock
); /* single task reading lock */
611 init_waitqueue_head(&u
->peer_wait
);
612 unix_insert_socket(unix_sockets_unbound
, sk
);
615 atomic_dec(&unix_nr_socks
);
617 sock_prot_inuse_add(sock_net(sk
), sk
->sk_prot
, 1);
622 static int unix_create(struct net
*net
, struct socket
*sock
, int protocol
)
624 if (protocol
&& protocol
!= PF_UNIX
)
625 return -EPROTONOSUPPORT
;
627 sock
->state
= SS_UNCONNECTED
;
629 switch (sock
->type
) {
631 sock
->ops
= &unix_stream_ops
;
634 * Believe it or not BSD has AF_UNIX, SOCK_RAW though
638 sock
->type
= SOCK_DGRAM
;
640 sock
->ops
= &unix_dgram_ops
;
643 sock
->ops
= &unix_seqpacket_ops
;
646 return -ESOCKTNOSUPPORT
;
649 return unix_create1(net
, sock
) ? 0 : -ENOMEM
;
652 static int unix_release(struct socket
*sock
)
654 struct sock
*sk
= sock
->sk
;
661 return unix_release_sock(sk
, 0);
664 static int unix_autobind(struct socket
*sock
)
666 struct sock
*sk
= sock
->sk
;
667 struct net
*net
= sock_net(sk
);
668 struct unix_sock
*u
= unix_sk(sk
);
669 static u32 ordernum
= 1;
670 struct unix_address
*addr
;
673 mutex_lock(&u
->readlock
);
680 addr
= kzalloc(sizeof(*addr
) + sizeof(short) + 16, GFP_KERNEL
);
684 addr
->name
->sun_family
= AF_UNIX
;
685 atomic_set(&addr
->refcnt
, 1);
688 addr
->len
= sprintf(addr
->name
->sun_path
+1, "%05x", ordernum
) + 1 + sizeof(short);
689 addr
->hash
= unix_hash_fold(csum_partial(addr
->name
, addr
->len
, 0));
691 spin_lock(&unix_table_lock
);
692 ordernum
= (ordernum
+1)&0xFFFFF;
694 if (__unix_find_socket_byname(net
, addr
->name
, addr
->len
, sock
->type
,
696 spin_unlock(&unix_table_lock
);
697 /* Sanity yield. It is unusual case, but yet... */
698 if (!(ordernum
&0xFF))
702 addr
->hash
^= sk
->sk_type
;
704 __unix_remove_socket(sk
);
706 __unix_insert_socket(&unix_socket_table
[addr
->hash
], sk
);
707 spin_unlock(&unix_table_lock
);
710 out
: mutex_unlock(&u
->readlock
);
714 static struct sock
*unix_find_other(struct net
*net
,
715 struct sockaddr_un
*sunname
, int len
,
716 int type
, unsigned hash
, int *error
)
722 if (sunname
->sun_path
[0]) {
724 err
= kern_path(sunname
->sun_path
, LOOKUP_FOLLOW
, &path
);
727 inode
= path
.dentry
->d_inode
;
728 err
= inode_permission(inode
, MAY_WRITE
);
733 if (!S_ISSOCK(inode
->i_mode
))
735 u
= unix_find_socket_byinode(net
, inode
);
739 if (u
->sk_type
== type
)
740 touch_atime(path
.mnt
, path
.dentry
);
745 if (u
->sk_type
!= type
) {
751 u
= unix_find_socket_byname(net
, sunname
, len
, type
, hash
);
753 struct dentry
*dentry
;
754 dentry
= unix_sk(u
)->dentry
;
756 touch_atime(unix_sk(u
)->mnt
, dentry
);
770 static int unix_bind(struct socket
*sock
, struct sockaddr
*uaddr
, int addr_len
)
772 struct sock
*sk
= sock
->sk
;
773 struct net
*net
= sock_net(sk
);
774 struct unix_sock
*u
= unix_sk(sk
);
775 struct sockaddr_un
*sunaddr
= (struct sockaddr_un
*)uaddr
;
776 struct dentry
*dentry
= NULL
;
780 struct unix_address
*addr
;
781 struct hlist_head
*list
;
784 if (sunaddr
->sun_family
!= AF_UNIX
)
787 if (addr_len
== sizeof(short)) {
788 err
= unix_autobind(sock
);
792 err
= unix_mkname(sunaddr
, addr_len
, &hash
);
797 mutex_lock(&u
->readlock
);
804 addr
= kmalloc(sizeof(*addr
)+addr_len
, GFP_KERNEL
);
808 memcpy(addr
->name
, sunaddr
, addr_len
);
809 addr
->len
= addr_len
;
810 addr
->hash
= hash
^ sk
->sk_type
;
811 atomic_set(&addr
->refcnt
, 1);
813 if (sunaddr
->sun_path
[0]) {
817 * Get the parent directory, calculate the hash for last
820 err
= path_lookup(sunaddr
->sun_path
, LOOKUP_PARENT
, &nd
);
822 goto out_mknod_parent
;
824 dentry
= lookup_create(&nd
, 0);
825 err
= PTR_ERR(dentry
);
827 goto out_mknod_unlock
;
830 * All right, let's create it.
833 (SOCK_INODE(sock
)->i_mode
& ~current
->fs
->umask
);
834 err
= mnt_want_write(nd
.path
.mnt
);
837 err
= vfs_mknod(nd
.path
.dentry
->d_inode
, dentry
, mode
, 0);
838 mnt_drop_write(nd
.path
.mnt
);
841 mutex_unlock(&nd
.path
.dentry
->d_inode
->i_mutex
);
842 dput(nd
.path
.dentry
);
843 nd
.path
.dentry
= dentry
;
845 addr
->hash
= UNIX_HASH_SIZE
;
848 spin_lock(&unix_table_lock
);
850 if (!sunaddr
->sun_path
[0]) {
852 if (__unix_find_socket_byname(net
, sunaddr
, addr_len
,
853 sk
->sk_type
, hash
)) {
854 unix_release_addr(addr
);
858 list
= &unix_socket_table
[addr
->hash
];
860 list
= &unix_socket_table
[dentry
->d_inode
->i_ino
& (UNIX_HASH_SIZE
-1)];
861 u
->dentry
= nd
.path
.dentry
;
862 u
->mnt
= nd
.path
.mnt
;
866 __unix_remove_socket(sk
);
868 __unix_insert_socket(list
, sk
);
871 spin_unlock(&unix_table_lock
);
873 mutex_unlock(&u
->readlock
);
880 mutex_unlock(&nd
.path
.dentry
->d_inode
->i_mutex
);
885 unix_release_addr(addr
);
889 static void unix_state_double_lock(struct sock
*sk1
, struct sock
*sk2
)
891 if (unlikely(sk1
== sk2
) || !sk2
) {
892 unix_state_lock(sk1
);
896 unix_state_lock(sk1
);
897 unix_state_lock_nested(sk2
);
899 unix_state_lock(sk2
);
900 unix_state_lock_nested(sk1
);
904 static void unix_state_double_unlock(struct sock
*sk1
, struct sock
*sk2
)
906 if (unlikely(sk1
== sk2
) || !sk2
) {
907 unix_state_unlock(sk1
);
910 unix_state_unlock(sk1
);
911 unix_state_unlock(sk2
);
914 static int unix_dgram_connect(struct socket
*sock
, struct sockaddr
*addr
,
917 struct sock
*sk
= sock
->sk
;
918 struct net
*net
= sock_net(sk
);
919 struct sockaddr_un
*sunaddr
= (struct sockaddr_un
*)addr
;
924 if (addr
->sa_family
!= AF_UNSPEC
) {
925 err
= unix_mkname(sunaddr
, alen
, &hash
);
930 if (test_bit(SOCK_PASSCRED
, &sock
->flags
) &&
931 !unix_sk(sk
)->addr
&& (err
= unix_autobind(sock
)) != 0)
935 other
= unix_find_other(net
, sunaddr
, alen
, sock
->type
, hash
, &err
);
939 unix_state_double_lock(sk
, other
);
941 /* Apparently VFS overslept socket death. Retry. */
942 if (sock_flag(other
, SOCK_DEAD
)) {
943 unix_state_double_unlock(sk
, other
);
949 if (!unix_may_send(sk
, other
))
952 err
= security_unix_may_send(sk
->sk_socket
, other
->sk_socket
);
958 * 1003.1g breaking connected state with AF_UNSPEC
961 unix_state_double_lock(sk
, other
);
965 * If it was connected, reconnect.
968 struct sock
*old_peer
= unix_peer(sk
);
969 unix_peer(sk
) = other
;
970 unix_state_double_unlock(sk
, other
);
972 if (other
!= old_peer
)
973 unix_dgram_disconnected(sk
, old_peer
);
976 unix_peer(sk
) = other
;
977 unix_state_double_unlock(sk
, other
);
982 unix_state_double_unlock(sk
, other
);
988 static long unix_wait_for_peer(struct sock
*other
, long timeo
)
990 struct unix_sock
*u
= unix_sk(other
);
994 prepare_to_wait_exclusive(&u
->peer_wait
, &wait
, TASK_INTERRUPTIBLE
);
996 sched
= !sock_flag(other
, SOCK_DEAD
) &&
997 !(other
->sk_shutdown
& RCV_SHUTDOWN
) &&
998 unix_recvq_full(other
);
1000 unix_state_unlock(other
);
1003 timeo
= schedule_timeout(timeo
);
1005 finish_wait(&u
->peer_wait
, &wait
);
1009 static int unix_stream_connect(struct socket
*sock
, struct sockaddr
*uaddr
,
1010 int addr_len
, int flags
)
1012 struct sockaddr_un
*sunaddr
= (struct sockaddr_un
*)uaddr
;
1013 struct sock
*sk
= sock
->sk
;
1014 struct net
*net
= sock_net(sk
);
1015 struct unix_sock
*u
= unix_sk(sk
), *newu
, *otheru
;
1016 struct sock
*newsk
= NULL
;
1017 struct sock
*other
= NULL
;
1018 struct sk_buff
*skb
= NULL
;
1024 err
= unix_mkname(sunaddr
, addr_len
, &hash
);
1029 if (test_bit(SOCK_PASSCRED
, &sock
->flags
)
1030 && !u
->addr
&& (err
= unix_autobind(sock
)) != 0)
1033 timeo
= sock_sndtimeo(sk
, flags
& O_NONBLOCK
);
1035 /* First of all allocate resources.
1036 If we will make it after state is locked,
1037 we will have to recheck all again in any case.
1042 /* create new sock for complete connection */
1043 newsk
= unix_create1(sock_net(sk
), NULL
);
1047 /* Allocate skb for sending to listening sock */
1048 skb
= sock_wmalloc(newsk
, 1, 0, GFP_KERNEL
);
1053 /* Find listening sock. */
1054 other
= unix_find_other(net
, sunaddr
, addr_len
, sk
->sk_type
, hash
, &err
);
1058 /* Latch state of peer */
1059 unix_state_lock(other
);
1061 /* Apparently VFS overslept socket death. Retry. */
1062 if (sock_flag(other
, SOCK_DEAD
)) {
1063 unix_state_unlock(other
);
1068 err
= -ECONNREFUSED
;
1069 if (other
->sk_state
!= TCP_LISTEN
)
1072 if (unix_recvq_full(other
)) {
1077 timeo
= unix_wait_for_peer(other
, timeo
);
1079 err
= sock_intr_errno(timeo
);
1080 if (signal_pending(current
))
1088 It is tricky place. We need to grab write lock and cannot
1089 drop lock on peer. It is dangerous because deadlock is
1090 possible. Connect to self case and simultaneous
1091 attempt to connect are eliminated by checking socket
1092 state. other is TCP_LISTEN, if sk is TCP_LISTEN we
1093 check this before attempt to grab lock.
1095 Well, and we have to recheck the state after socket locked.
1101 /* This is ok... continue with connect */
1103 case TCP_ESTABLISHED
:
1104 /* Socket is already connected */
1112 unix_state_lock_nested(sk
);
1114 if (sk
->sk_state
!= st
) {
1115 unix_state_unlock(sk
);
1116 unix_state_unlock(other
);
1121 err
= security_unix_stream_connect(sock
, other
->sk_socket
, newsk
);
1123 unix_state_unlock(sk
);
1127 /* The way is open! Fastly set all the necessary fields... */
1130 unix_peer(newsk
) = sk
;
1131 newsk
->sk_state
= TCP_ESTABLISHED
;
1132 newsk
->sk_type
= sk
->sk_type
;
1133 newsk
->sk_peercred
.pid
= task_tgid_vnr(current
);
1134 newsk
->sk_peercred
.uid
= current
->euid
;
1135 newsk
->sk_peercred
.gid
= current
->egid
;
1136 newu
= unix_sk(newsk
);
1137 newsk
->sk_sleep
= &newu
->peer_wait
;
1138 otheru
= unix_sk(other
);
1140 /* copy address information from listening to new sock*/
1142 atomic_inc(&otheru
->addr
->refcnt
);
1143 newu
->addr
= otheru
->addr
;
1145 if (otheru
->dentry
) {
1146 newu
->dentry
= dget(otheru
->dentry
);
1147 newu
->mnt
= mntget(otheru
->mnt
);
1150 /* Set credentials */
1151 sk
->sk_peercred
= other
->sk_peercred
;
1153 sock
->state
= SS_CONNECTED
;
1154 sk
->sk_state
= TCP_ESTABLISHED
;
1157 smp_mb__after_atomic_inc(); /* sock_hold() does an atomic_inc() */
1158 unix_peer(sk
) = newsk
;
1160 unix_state_unlock(sk
);
1162 /* take ten and and send info to listening sock */
1163 spin_lock(&other
->sk_receive_queue
.lock
);
1164 __skb_queue_tail(&other
->sk_receive_queue
, skb
);
1165 spin_unlock(&other
->sk_receive_queue
.lock
);
1166 unix_state_unlock(other
);
1167 other
->sk_data_ready(other
, 0);
1173 unix_state_unlock(other
);
1179 unix_release_sock(newsk
, 0);
1185 static int unix_socketpair(struct socket
*socka
, struct socket
*sockb
)
1187 struct sock
*ska
= socka
->sk
, *skb
= sockb
->sk
;
1189 /* Join our sockets back to back */
1192 unix_peer(ska
) = skb
;
1193 unix_peer(skb
) = ska
;
1194 ska
->sk_peercred
.pid
= skb
->sk_peercred
.pid
= task_tgid_vnr(current
);
1195 ska
->sk_peercred
.uid
= skb
->sk_peercred
.uid
= current
->euid
;
1196 ska
->sk_peercred
.gid
= skb
->sk_peercred
.gid
= current
->egid
;
1198 if (ska
->sk_type
!= SOCK_DGRAM
) {
1199 ska
->sk_state
= TCP_ESTABLISHED
;
1200 skb
->sk_state
= TCP_ESTABLISHED
;
1201 socka
->state
= SS_CONNECTED
;
1202 sockb
->state
= SS_CONNECTED
;
1207 static int unix_accept(struct socket
*sock
, struct socket
*newsock
, int flags
)
1209 struct sock
*sk
= sock
->sk
;
1211 struct sk_buff
*skb
;
1215 if (sock
->type
!= SOCK_STREAM
&& sock
->type
!= SOCK_SEQPACKET
)
1219 if (sk
->sk_state
!= TCP_LISTEN
)
1222 /* If socket state is TCP_LISTEN it cannot change (for now...),
1223 * so that no locks are necessary.
1226 skb
= skb_recv_datagram(sk
, 0, flags
&O_NONBLOCK
, &err
);
1228 /* This means receive shutdown. */
1235 skb_free_datagram(sk
, skb
);
1236 wake_up_interruptible(&unix_sk(sk
)->peer_wait
);
1238 /* attach accepted sock to socket */
1239 unix_state_lock(tsk
);
1240 newsock
->state
= SS_CONNECTED
;
1241 sock_graft(tsk
, newsock
);
1242 unix_state_unlock(tsk
);
1250 static int unix_getname(struct socket
*sock
, struct sockaddr
*uaddr
, int *uaddr_len
, int peer
)
1252 struct sock
*sk
= sock
->sk
;
1253 struct unix_sock
*u
;
1254 struct sockaddr_un
*sunaddr
= (struct sockaddr_un
*)uaddr
;
1258 sk
= unix_peer_get(sk
);
1269 unix_state_lock(sk
);
1271 sunaddr
->sun_family
= AF_UNIX
;
1272 sunaddr
->sun_path
[0] = 0;
1273 *uaddr_len
= sizeof(short);
1275 struct unix_address
*addr
= u
->addr
;
1277 *uaddr_len
= addr
->len
;
1278 memcpy(sunaddr
, addr
->name
, *uaddr_len
);
1280 unix_state_unlock(sk
);
1286 static void unix_detach_fds(struct scm_cookie
*scm
, struct sk_buff
*skb
)
1290 scm
->fp
= UNIXCB(skb
).fp
;
1291 skb
->destructor
= sock_wfree
;
1292 UNIXCB(skb
).fp
= NULL
;
1294 for (i
= scm
->fp
->count
-1; i
>= 0; i
--)
1295 unix_notinflight(scm
->fp
->fp
[i
]);
1298 static void unix_destruct_fds(struct sk_buff
*skb
)
1300 struct scm_cookie scm
;
1301 memset(&scm
, 0, sizeof(scm
));
1302 unix_detach_fds(&scm
, skb
);
1304 /* Alas, it calls VFS */
1305 /* So fscking what? fput() had been SMP-safe since the last Summer */
1310 static int unix_attach_fds(struct scm_cookie
*scm
, struct sk_buff
*skb
)
1315 * Need to duplicate file references for the sake of garbage
1316 * collection. Otherwise a socket in the fps might become a
1317 * candidate for GC while the skb is not yet queued.
1319 UNIXCB(skb
).fp
= scm_fp_dup(scm
->fp
);
1320 if (!UNIXCB(skb
).fp
)
1323 for (i
= scm
->fp
->count
-1; i
>= 0; i
--)
1324 unix_inflight(scm
->fp
->fp
[i
]);
1325 skb
->destructor
= unix_destruct_fds
;
1330 * Send AF_UNIX data.
1333 static int unix_dgram_sendmsg(struct kiocb
*kiocb
, struct socket
*sock
,
1334 struct msghdr
*msg
, size_t len
)
1336 struct sock_iocb
*siocb
= kiocb_to_siocb(kiocb
);
1337 struct sock
*sk
= sock
->sk
;
1338 struct net
*net
= sock_net(sk
);
1339 struct unix_sock
*u
= unix_sk(sk
);
1340 struct sockaddr_un
*sunaddr
= msg
->msg_name
;
1341 struct sock
*other
= NULL
;
1342 int namelen
= 0; /* fake GCC */
1345 struct sk_buff
*skb
;
1347 struct scm_cookie tmp_scm
;
1349 if (NULL
== siocb
->scm
)
1350 siocb
->scm
= &tmp_scm
;
1351 err
= scm_send(sock
, msg
, siocb
->scm
);
1356 if (msg
->msg_flags
&MSG_OOB
)
1359 if (msg
->msg_namelen
) {
1360 err
= unix_mkname(sunaddr
, msg
->msg_namelen
, &hash
);
1367 other
= unix_peer_get(sk
);
1372 if (test_bit(SOCK_PASSCRED
, &sock
->flags
)
1373 && !u
->addr
&& (err
= unix_autobind(sock
)) != 0)
1377 if (len
> sk
->sk_sndbuf
- 32)
1380 skb
= sock_alloc_send_skb(sk
, len
, msg
->msg_flags
&MSG_DONTWAIT
, &err
);
1384 memcpy(UNIXCREDS(skb
), &siocb
->scm
->creds
, sizeof(struct ucred
));
1385 if (siocb
->scm
->fp
) {
1386 err
= unix_attach_fds(siocb
->scm
, skb
);
1390 unix_get_secdata(siocb
->scm
, skb
);
1392 skb_reset_transport_header(skb
);
1393 err
= memcpy_fromiovec(skb_put(skb
, len
), msg
->msg_iov
, len
);
1397 timeo
= sock_sndtimeo(sk
, msg
->msg_flags
& MSG_DONTWAIT
);
1402 if (sunaddr
== NULL
)
1405 other
= unix_find_other(net
, sunaddr
, namelen
, sk
->sk_type
,
1411 unix_state_lock(other
);
1413 if (!unix_may_send(sk
, other
))
1416 if (sock_flag(other
, SOCK_DEAD
)) {
1418 * Check with 1003.1g - what should
1421 unix_state_unlock(other
);
1425 unix_state_lock(sk
);
1426 if (unix_peer(sk
) == other
) {
1427 unix_peer(sk
) = NULL
;
1428 unix_state_unlock(sk
);
1430 unix_dgram_disconnected(sk
, other
);
1432 err
= -ECONNREFUSED
;
1434 unix_state_unlock(sk
);
1444 if (other
->sk_shutdown
& RCV_SHUTDOWN
)
1447 if (sk
->sk_type
!= SOCK_SEQPACKET
) {
1448 err
= security_unix_may_send(sk
->sk_socket
, other
->sk_socket
);
1453 if (unix_peer(other
) != sk
&& unix_recvq_full(other
)) {
1459 timeo
= unix_wait_for_peer(other
, timeo
);
1461 err
= sock_intr_errno(timeo
);
1462 if (signal_pending(current
))
1468 skb_queue_tail(&other
->sk_receive_queue
, skb
);
1469 unix_state_unlock(other
);
1470 other
->sk_data_ready(other
, len
);
1472 scm_destroy(siocb
->scm
);
1476 unix_state_unlock(other
);
1482 scm_destroy(siocb
->scm
);
1487 static int unix_stream_sendmsg(struct kiocb
*kiocb
, struct socket
*sock
,
1488 struct msghdr
*msg
, size_t len
)
1490 struct sock_iocb
*siocb
= kiocb_to_siocb(kiocb
);
1491 struct sock
*sk
= sock
->sk
;
1492 struct sock
*other
= NULL
;
1493 struct sockaddr_un
*sunaddr
= msg
->msg_name
;
1495 struct sk_buff
*skb
;
1497 struct scm_cookie tmp_scm
;
1499 if (NULL
== siocb
->scm
)
1500 siocb
->scm
= &tmp_scm
;
1501 err
= scm_send(sock
, msg
, siocb
->scm
);
1506 if (msg
->msg_flags
&MSG_OOB
)
1509 if (msg
->msg_namelen
) {
1510 err
= sk
->sk_state
== TCP_ESTABLISHED
? -EISCONN
: -EOPNOTSUPP
;
1515 other
= unix_peer(sk
);
1520 if (sk
->sk_shutdown
& SEND_SHUTDOWN
)
1523 while (sent
< len
) {
1525 * Optimisation for the fact that under 0.01% of X
1526 * messages typically need breaking up.
1531 /* Keep two messages in the pipe so it schedules better */
1532 if (size
> ((sk
->sk_sndbuf
>> 1) - 64))
1533 size
= (sk
->sk_sndbuf
>> 1) - 64;
1535 if (size
> SKB_MAX_ALLOC
)
1536 size
= SKB_MAX_ALLOC
;
1542 skb
= sock_alloc_send_skb(sk
, size
, msg
->msg_flags
&MSG_DONTWAIT
,
1549 * If you pass two values to the sock_alloc_send_skb
1550 * it tries to grab the large buffer with GFP_NOFS
1551 * (which can fail easily), and if it fails grab the
1552 * fallback size buffer which is under a page and will
1555 size
= min_t(int, size
, skb_tailroom(skb
));
1557 memcpy(UNIXCREDS(skb
), &siocb
->scm
->creds
, sizeof(struct ucred
));
1558 if (siocb
->scm
->fp
) {
1559 err
= unix_attach_fds(siocb
->scm
, skb
);
1566 err
= memcpy_fromiovec(skb_put(skb
, size
), msg
->msg_iov
, size
);
1572 unix_state_lock(other
);
1574 if (sock_flag(other
, SOCK_DEAD
) ||
1575 (other
->sk_shutdown
& RCV_SHUTDOWN
))
1578 skb_queue_tail(&other
->sk_receive_queue
, skb
);
1579 unix_state_unlock(other
);
1580 other
->sk_data_ready(other
, size
);
1584 scm_destroy(siocb
->scm
);
1590 unix_state_unlock(other
);
1593 if (sent
== 0 && !(msg
->msg_flags
&MSG_NOSIGNAL
))
1594 send_sig(SIGPIPE
, current
, 0);
1597 scm_destroy(siocb
->scm
);
1599 return sent
? : err
;
1602 static int unix_seqpacket_sendmsg(struct kiocb
*kiocb
, struct socket
*sock
,
1603 struct msghdr
*msg
, size_t len
)
1606 struct sock
*sk
= sock
->sk
;
1608 err
= sock_error(sk
);
1612 if (sk
->sk_state
!= TCP_ESTABLISHED
)
1615 if (msg
->msg_namelen
)
1616 msg
->msg_namelen
= 0;
1618 return unix_dgram_sendmsg(kiocb
, sock
, msg
, len
);
1621 static void unix_copy_addr(struct msghdr
*msg
, struct sock
*sk
)
1623 struct unix_sock
*u
= unix_sk(sk
);
1625 msg
->msg_namelen
= 0;
1627 msg
->msg_namelen
= u
->addr
->len
;
1628 memcpy(msg
->msg_name
, u
->addr
->name
, u
->addr
->len
);
1632 static int unix_dgram_recvmsg(struct kiocb
*iocb
, struct socket
*sock
,
1633 struct msghdr
*msg
, size_t size
,
1636 struct sock_iocb
*siocb
= kiocb_to_siocb(iocb
);
1637 struct scm_cookie tmp_scm
;
1638 struct sock
*sk
= sock
->sk
;
1639 struct unix_sock
*u
= unix_sk(sk
);
1640 int noblock
= flags
& MSG_DONTWAIT
;
1641 struct sk_buff
*skb
;
1648 msg
->msg_namelen
= 0;
1650 mutex_lock(&u
->readlock
);
1652 skb
= skb_recv_datagram(sk
, flags
, noblock
, &err
);
1654 unix_state_lock(sk
);
1655 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
1656 if (sk
->sk_type
== SOCK_SEQPACKET
&& err
== -EAGAIN
&&
1657 (sk
->sk_shutdown
& RCV_SHUTDOWN
))
1659 unix_state_unlock(sk
);
1663 wake_up_interruptible_sync(&u
->peer_wait
);
1666 unix_copy_addr(msg
, skb
->sk
);
1668 if (size
> skb
->len
)
1670 else if (size
< skb
->len
)
1671 msg
->msg_flags
|= MSG_TRUNC
;
1673 err
= skb_copy_datagram_iovec(skb
, 0, msg
->msg_iov
, size
);
1678 siocb
->scm
= &tmp_scm
;
1679 memset(&tmp_scm
, 0, sizeof(tmp_scm
));
1681 siocb
->scm
->creds
= *UNIXCREDS(skb
);
1682 unix_set_secdata(siocb
->scm
, skb
);
1684 if (!(flags
& MSG_PEEK
)) {
1686 unix_detach_fds(siocb
->scm
, skb
);
1688 /* It is questionable: on PEEK we could:
1689 - do not return fds - good, but too simple 8)
1690 - return fds, and do not return them on read (old strategy,
1692 - clone fds (I chose it for now, it is the most universal
1695 POSIX 1003.1g does not actually define this clearly
1696 at all. POSIX 1003.1g doesn't define a lot of things
1701 siocb
->scm
->fp
= scm_fp_dup(UNIXCB(skb
).fp
);
1705 scm_recv(sock
, msg
, siocb
->scm
, flags
);
1708 skb_free_datagram(sk
, skb
);
1710 mutex_unlock(&u
->readlock
);
1716 * Sleep until data has arrive. But check for races..
1719 static long unix_stream_data_wait(struct sock
*sk
, long timeo
)
1723 unix_state_lock(sk
);
1726 prepare_to_wait(sk
->sk_sleep
, &wait
, TASK_INTERRUPTIBLE
);
1728 if (!skb_queue_empty(&sk
->sk_receive_queue
) ||
1730 (sk
->sk_shutdown
& RCV_SHUTDOWN
) ||
1731 signal_pending(current
) ||
1735 set_bit(SOCK_ASYNC_WAITDATA
, &sk
->sk_socket
->flags
);
1736 unix_state_unlock(sk
);
1737 timeo
= schedule_timeout(timeo
);
1738 unix_state_lock(sk
);
1739 clear_bit(SOCK_ASYNC_WAITDATA
, &sk
->sk_socket
->flags
);
1742 finish_wait(sk
->sk_sleep
, &wait
);
1743 unix_state_unlock(sk
);
1749 static int unix_stream_recvmsg(struct kiocb
*iocb
, struct socket
*sock
,
1750 struct msghdr
*msg
, size_t size
,
1753 struct sock_iocb
*siocb
= kiocb_to_siocb(iocb
);
1754 struct scm_cookie tmp_scm
;
1755 struct sock
*sk
= sock
->sk
;
1756 struct unix_sock
*u
= unix_sk(sk
);
1757 struct sockaddr_un
*sunaddr
= msg
->msg_name
;
1759 int check_creds
= 0;
1765 if (sk
->sk_state
!= TCP_ESTABLISHED
)
1772 target
= sock_rcvlowat(sk
, flags
&MSG_WAITALL
, size
);
1773 timeo
= sock_rcvtimeo(sk
, flags
&MSG_DONTWAIT
);
1775 msg
->msg_namelen
= 0;
1777 /* Lock the socket to prevent queue disordering
1778 * while sleeps in memcpy_tomsg
1782 siocb
->scm
= &tmp_scm
;
1783 memset(&tmp_scm
, 0, sizeof(tmp_scm
));
1786 mutex_lock(&u
->readlock
);
1790 struct sk_buff
*skb
;
1792 unix_state_lock(sk
);
1793 skb
= skb_dequeue(&sk
->sk_receive_queue
);
1795 if (copied
>= target
)
1799 * POSIX 1003.1g mandates this order.
1802 err
= sock_error(sk
);
1805 if (sk
->sk_shutdown
& RCV_SHUTDOWN
)
1808 unix_state_unlock(sk
);
1812 mutex_unlock(&u
->readlock
);
1814 timeo
= unix_stream_data_wait(sk
, timeo
);
1816 if (signal_pending(current
)) {
1817 err
= sock_intr_errno(timeo
);
1820 mutex_lock(&u
->readlock
);
1823 unix_state_unlock(sk
);
1826 unix_state_unlock(sk
);
1829 /* Never glue messages from different writers */
1830 if (memcmp(UNIXCREDS(skb
), &siocb
->scm
->creds
,
1831 sizeof(siocb
->scm
->creds
)) != 0) {
1832 skb_queue_head(&sk
->sk_receive_queue
, skb
);
1836 /* Copy credentials */
1837 siocb
->scm
->creds
= *UNIXCREDS(skb
);
1841 /* Copy address just once */
1843 unix_copy_addr(msg
, skb
->sk
);
1847 chunk
= min_t(unsigned int, skb
->len
, size
);
1848 if (memcpy_toiovec(msg
->msg_iov
, skb
->data
, chunk
)) {
1849 skb_queue_head(&sk
->sk_receive_queue
, skb
);
1857 /* Mark read part of skb as used */
1858 if (!(flags
& MSG_PEEK
)) {
1859 skb_pull(skb
, chunk
);
1862 unix_detach_fds(siocb
->scm
, skb
);
1864 /* put the skb back if we didn't use it up.. */
1866 skb_queue_head(&sk
->sk_receive_queue
, skb
);
1875 /* It is questionable, see note in unix_dgram_recvmsg.
1878 siocb
->scm
->fp
= scm_fp_dup(UNIXCB(skb
).fp
);
1880 /* put message back and return */
1881 skb_queue_head(&sk
->sk_receive_queue
, skb
);
1886 mutex_unlock(&u
->readlock
);
1887 scm_recv(sock
, msg
, siocb
->scm
, flags
);
1889 return copied
? : err
;
1892 static int unix_shutdown(struct socket
*sock
, int mode
)
1894 struct sock
*sk
= sock
->sk
;
1897 mode
= (mode
+1)&(RCV_SHUTDOWN
|SEND_SHUTDOWN
);
1900 unix_state_lock(sk
);
1901 sk
->sk_shutdown
|= mode
;
1902 other
= unix_peer(sk
);
1905 unix_state_unlock(sk
);
1906 sk
->sk_state_change(sk
);
1909 (sk
->sk_type
== SOCK_STREAM
|| sk
->sk_type
== SOCK_SEQPACKET
)) {
1913 if (mode
&RCV_SHUTDOWN
)
1914 peer_mode
|= SEND_SHUTDOWN
;
1915 if (mode
&SEND_SHUTDOWN
)
1916 peer_mode
|= RCV_SHUTDOWN
;
1917 unix_state_lock(other
);
1918 other
->sk_shutdown
|= peer_mode
;
1919 unix_state_unlock(other
);
1920 other
->sk_state_change(other
);
1921 read_lock(&other
->sk_callback_lock
);
1922 if (peer_mode
== SHUTDOWN_MASK
)
1923 sk_wake_async(other
, SOCK_WAKE_WAITD
, POLL_HUP
);
1924 else if (peer_mode
& RCV_SHUTDOWN
)
1925 sk_wake_async(other
, SOCK_WAKE_WAITD
, POLL_IN
);
1926 read_unlock(&other
->sk_callback_lock
);
1934 static int unix_ioctl(struct socket
*sock
, unsigned int cmd
, unsigned long arg
)
1936 struct sock
*sk
= sock
->sk
;
1942 amount
= atomic_read(&sk
->sk_wmem_alloc
);
1943 err
= put_user(amount
, (int __user
*)arg
);
1947 struct sk_buff
*skb
;
1949 if (sk
->sk_state
== TCP_LISTEN
) {
1954 spin_lock(&sk
->sk_receive_queue
.lock
);
1955 if (sk
->sk_type
== SOCK_STREAM
||
1956 sk
->sk_type
== SOCK_SEQPACKET
) {
1957 skb_queue_walk(&sk
->sk_receive_queue
, skb
)
1960 skb
= skb_peek(&sk
->sk_receive_queue
);
1964 spin_unlock(&sk
->sk_receive_queue
.lock
);
1965 err
= put_user(amount
, (int __user
*)arg
);
1976 static unsigned int unix_poll(struct file
*file
, struct socket
*sock
, poll_table
*wait
)
1978 struct sock
*sk
= sock
->sk
;
1981 poll_wait(file
, sk
->sk_sleep
, wait
);
1984 /* exceptional events? */
1987 if (sk
->sk_shutdown
== SHUTDOWN_MASK
)
1989 if (sk
->sk_shutdown
& RCV_SHUTDOWN
)
1993 if (!skb_queue_empty(&sk
->sk_receive_queue
) ||
1994 (sk
->sk_shutdown
& RCV_SHUTDOWN
))
1995 mask
|= POLLIN
| POLLRDNORM
;
1997 /* Connection-based need to check for termination and startup */
1998 if ((sk
->sk_type
== SOCK_STREAM
|| sk
->sk_type
== SOCK_SEQPACKET
) &&
1999 sk
->sk_state
== TCP_CLOSE
)
2003 * we set writable also when the other side has shut down the
2004 * connection. This prevents stuck sockets.
2006 if (unix_writable(sk
))
2007 mask
|= POLLOUT
| POLLWRNORM
| POLLWRBAND
;
2012 static unsigned int unix_dgram_poll(struct file
*file
, struct socket
*sock
,
2015 struct sock
*sk
= sock
->sk
, *other
;
2016 unsigned int mask
, writable
;
2018 poll_wait(file
, sk
->sk_sleep
, wait
);
2021 /* exceptional events? */
2022 if (sk
->sk_err
|| !skb_queue_empty(&sk
->sk_error_queue
))
2024 if (sk
->sk_shutdown
& RCV_SHUTDOWN
)
2026 if (sk
->sk_shutdown
== SHUTDOWN_MASK
)
2030 if (!skb_queue_empty(&sk
->sk_receive_queue
) ||
2031 (sk
->sk_shutdown
& RCV_SHUTDOWN
))
2032 mask
|= POLLIN
| POLLRDNORM
;
2034 /* Connection-based need to check for termination and startup */
2035 if (sk
->sk_type
== SOCK_SEQPACKET
) {
2036 if (sk
->sk_state
== TCP_CLOSE
)
2038 /* connection hasn't started yet? */
2039 if (sk
->sk_state
== TCP_SYN_SENT
)
2044 writable
= unix_writable(sk
);
2046 other
= unix_peer_get(sk
);
2048 if (unix_peer(other
) != sk
) {
2049 poll_wait(file
, &unix_sk(other
)->peer_wait
,
2051 if (unix_recvq_full(other
))
2060 mask
|= POLLOUT
| POLLWRNORM
| POLLWRBAND
;
2062 set_bit(SOCK_ASYNC_NOSPACE
, &sk
->sk_socket
->flags
);
2067 #ifdef CONFIG_PROC_FS
2068 static struct sock
*first_unix_socket(int *i
)
2070 for (*i
= 0; *i
<= UNIX_HASH_SIZE
; (*i
)++) {
2071 if (!hlist_empty(&unix_socket_table
[*i
]))
2072 return __sk_head(&unix_socket_table
[*i
]);
2077 static struct sock
*next_unix_socket(int *i
, struct sock
*s
)
2079 struct sock
*next
= sk_next(s
);
2080 /* More in this chain? */
2083 /* Look for next non-empty chain. */
2084 for ((*i
)++; *i
<= UNIX_HASH_SIZE
; (*i
)++) {
2085 if (!hlist_empty(&unix_socket_table
[*i
]))
2086 return __sk_head(&unix_socket_table
[*i
]);
2091 struct unix_iter_state
{
2092 struct seq_net_private p
;
2096 static struct sock
*unix_seq_idx(struct seq_file
*seq
, loff_t pos
)
2098 struct unix_iter_state
*iter
= seq
->private;
2102 for (s
= first_unix_socket(&iter
->i
); s
; s
= next_unix_socket(&iter
->i
, s
)) {
2103 if (sock_net(s
) != seq_file_net(seq
))
2112 static void *unix_seq_start(struct seq_file
*seq
, loff_t
*pos
)
2113 __acquires(unix_table_lock
)
2115 spin_lock(&unix_table_lock
);
2116 return *pos
? unix_seq_idx(seq
, *pos
- 1) : SEQ_START_TOKEN
;
2119 static void *unix_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
2121 struct unix_iter_state
*iter
= seq
->private;
2122 struct sock
*sk
= v
;
2125 if (v
== SEQ_START_TOKEN
)
2126 sk
= first_unix_socket(&iter
->i
);
2128 sk
= next_unix_socket(&iter
->i
, sk
);
2129 while (sk
&& (sock_net(sk
) != seq_file_net(seq
)))
2130 sk
= next_unix_socket(&iter
->i
, sk
);
2134 static void unix_seq_stop(struct seq_file
*seq
, void *v
)
2135 __releases(unix_table_lock
)
2137 spin_unlock(&unix_table_lock
);
2140 static int unix_seq_show(struct seq_file
*seq
, void *v
)
2143 if (v
== SEQ_START_TOKEN
)
2144 seq_puts(seq
, "Num RefCount Protocol Flags Type St "
2148 struct unix_sock
*u
= unix_sk(s
);
2151 seq_printf(seq
, "%p: %08X %08X %08X %04X %02X %5lu",
2153 atomic_read(&s
->sk_refcnt
),
2155 s
->sk_state
== TCP_LISTEN
? __SO_ACCEPTCON
: 0,
2158 (s
->sk_state
== TCP_ESTABLISHED
? SS_CONNECTED
: SS_UNCONNECTED
) :
2159 (s
->sk_state
== TCP_ESTABLISHED
? SS_CONNECTING
: SS_DISCONNECTING
),
2167 len
= u
->addr
->len
- sizeof(short);
2168 if (!UNIX_ABSTRACT(s
))
2174 for ( ; i
< len
; i
++)
2175 seq_putc(seq
, u
->addr
->name
->sun_path
[i
]);
2177 unix_state_unlock(s
);
2178 seq_putc(seq
, '\n');
2184 static const struct seq_operations unix_seq_ops
= {
2185 .start
= unix_seq_start
,
2186 .next
= unix_seq_next
,
2187 .stop
= unix_seq_stop
,
2188 .show
= unix_seq_show
,
2191 static int unix_seq_open(struct inode
*inode
, struct file
*file
)
2193 return seq_open_net(inode
, file
, &unix_seq_ops
,
2194 sizeof(struct unix_iter_state
));
2197 static const struct file_operations unix_seq_fops
= {
2198 .owner
= THIS_MODULE
,
2199 .open
= unix_seq_open
,
2201 .llseek
= seq_lseek
,
2202 .release
= seq_release_net
,
2207 static struct net_proto_family unix_family_ops
= {
2209 .create
= unix_create
,
2210 .owner
= THIS_MODULE
,
2214 static int unix_net_init(struct net
*net
)
2216 int error
= -ENOMEM
;
2218 net
->unx
.sysctl_max_dgram_qlen
= 10;
2219 if (unix_sysctl_register(net
))
2222 #ifdef CONFIG_PROC_FS
2223 if (!proc_net_fops_create(net
, "unix", 0, &unix_seq_fops
)) {
2224 unix_sysctl_unregister(net
);
2233 static void unix_net_exit(struct net
*net
)
2235 unix_sysctl_unregister(net
);
2236 proc_net_remove(net
, "unix");
2239 static struct pernet_operations unix_net_ops
= {
2240 .init
= unix_net_init
,
2241 .exit
= unix_net_exit
,
2244 static int __init
af_unix_init(void)
2247 struct sk_buff
*dummy_skb
;
2249 BUILD_BUG_ON(sizeof(struct unix_skb_parms
) > sizeof(dummy_skb
->cb
));
2251 rc
= proto_register(&unix_proto
, 1);
2253 printk(KERN_CRIT
"%s: Cannot create unix_sock SLAB cache!\n",
2258 sock_register(&unix_family_ops
);
2259 register_pernet_subsys(&unix_net_ops
);
2264 static void __exit
af_unix_exit(void)
2266 sock_unregister(PF_UNIX
);
2267 proto_unregister(&unix_proto
);
2268 unregister_pernet_subsys(&unix_net_ops
);
2271 /* Earlier than device_initcall() so that other drivers invoking
2272 request_module() don't end up in a loop when modprobe tries
2273 to use a UNIX socket. But later than subsys_initcall() because
2274 we depend on stuff initialised there */
2275 fs_initcall(af_unix_init
);
2276 module_exit(af_unix_exit
);
2278 MODULE_LICENSE("GPL");
2279 MODULE_ALIAS_NETPROTO(PF_UNIX
);