xref: /openbmc/linux/net/unix/af_unix.c (revision a2cce7a9)
1 /*
2  * NET4:	Implementation of BSD Unix domain sockets.
3  *
4  * Authors:	Alan Cox, <alan@lxorguk.ukuu.org.uk>
5  *
6  *		This program is free software; you can redistribute it and/or
7  *		modify it under the terms of the GNU General Public License
8  *		as published by the Free Software Foundation; either version
9  *		2 of the License, or (at your option) any later version.
10  *
11  * Fixes:
12  *		Linus Torvalds	:	Assorted bug cures.
13  *		Niibe Yutaka	:	async I/O support.
14  *		Carsten Paeth	:	PF_UNIX check, address fixes.
15  *		Alan Cox	:	Limit size of allocated blocks.
16  *		Alan Cox	:	Fixed the stupid socketpair bug.
17  *		Alan Cox	:	BSD compatibility fine tuning.
18  *		Alan Cox	:	Fixed a bug in connect when interrupted.
19  *		Alan Cox	:	Sorted out a proper draft version of
20  *					file descriptor passing hacked up from
21  *					Mike Shaver's work.
22  *		Marty Leisner	:	Fixes to fd passing
23  *		Nick Nevin	:	recvmsg bugfix.
24  *		Alan Cox	:	Started proper garbage collector
25  *		Heiko EiBfeldt	:	Missing verify_area check
26  *		Alan Cox	:	Started POSIXisms
27  *		Andreas Schwab	:	Replace inode by dentry for proper
28  *					reference counting
29  *		Kirk Petersen	:	Made this a module
30  *	    Christoph Rohland	:	Elegant non-blocking accept/connect algorithm.
31  *					Lots of bug fixes.
32  *	     Alexey Kuznetosv	:	Repaired (I hope) bugs introduces
33  *					by above two patches.
34  *	     Andrea Arcangeli	:	If possible we block in connect(2)
35  *					if the max backlog of the listen socket
36  *					is been reached. This won't break
37  *					old apps and it will avoid huge amount
38  *					of socks hashed (this for unix_gc()
39  *					performances reasons).
40  *					Security fix that limits the max
41  *					number of socks to 2*max_files and
42  *					the number of skb queueable in the
43  *					dgram receiver.
44  *		Artur Skawina   :	Hash function optimizations
45  *	     Alexey Kuznetsov   :	Full scale SMP. Lot of bugs are introduced 8)
46  *	      Malcolm Beattie   :	Set peercred for socketpair
47  *	     Michal Ostrowski   :       Module initialization cleanup.
48  *	     Arnaldo C. Melo	:	Remove MOD_{INC,DEC}_USE_COUNT,
49  *	     				the core infrastructure is doing that
50  *	     				for all net proto families now (2.5.69+)
51  *
52  *
53  * Known differences from reference BSD that was tested:
54  *
55  *	[TO FIX]
56  *	ECONNREFUSED is not returned from one end of a connected() socket to the
57  *		other the moment one end closes.
58  *	fstat() doesn't return st_dev=0, and give the blksize as high water mark
59  *		and a fake inode identifier (nor the BSD first socket fstat twice bug).
60  *	[NOT TO FIX]
61  *	accept() returns a path name even if the connecting socket has closed
62  *		in the meantime (BSD loses the path and gives up).
63  *	accept() returns 0 length path for an unbound connector. BSD returns 16
64  *		and a null first byte in the path (but not for gethost/peername - BSD bug ??)
65  *	socketpair(...SOCK_RAW..) doesn't panic the kernel.
66  *	BSD af_unix apparently has connect forgetting to block properly.
67  *		(need to check this with the POSIX spec in detail)
68  *
69  * Differences from 2.0.0-11-... (ANK)
70  *	Bug fixes and improvements.
71  *		- client shutdown killed server socket.
72  *		- removed all useless cli/sti pairs.
73  *
74  *	Semantic changes/extensions.
75  *		- generic control message passing.
76  *		- SCM_CREDENTIALS control message.
77  *		- "Abstract" (not FS based) socket bindings.
78  *		  Abstract names are sequences of bytes (not zero terminated)
79  *		  started by 0, so that this name space does not intersect
80  *		  with BSD names.
81  */
82 
83 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
84 
85 #include <linux/module.h>
86 #include <linux/kernel.h>
87 #include <linux/signal.h>
88 #include <linux/sched.h>
89 #include <linux/errno.h>
90 #include <linux/string.h>
91 #include <linux/stat.h>
92 #include <linux/dcache.h>
93 #include <linux/namei.h>
94 #include <linux/socket.h>
95 #include <linux/un.h>
96 #include <linux/fcntl.h>
97 #include <linux/termios.h>
98 #include <linux/sockios.h>
99 #include <linux/net.h>
100 #include <linux/in.h>
101 #include <linux/fs.h>
102 #include <linux/slab.h>
103 #include <asm/uaccess.h>
104 #include <linux/skbuff.h>
105 #include <linux/netdevice.h>
106 #include <net/net_namespace.h>
107 #include <net/sock.h>
108 #include <net/tcp_states.h>
109 #include <net/af_unix.h>
110 #include <linux/proc_fs.h>
111 #include <linux/seq_file.h>
112 #include <net/scm.h>
113 #include <linux/init.h>
114 #include <linux/poll.h>
115 #include <linux/rtnetlink.h>
116 #include <linux/mount.h>
117 #include <net/checksum.h>
118 #include <linux/security.h>
119 #include <linux/freezer.h>
120 
121 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
122 EXPORT_SYMBOL_GPL(unix_socket_table);
123 DEFINE_SPINLOCK(unix_table_lock);
124 EXPORT_SYMBOL_GPL(unix_table_lock);
125 static atomic_long_t unix_nr_socks;
126 
127 
128 static struct hlist_head *unix_sockets_unbound(void *addr)
129 {
130 	unsigned long hash = (unsigned long)addr;
131 
132 	hash ^= hash >> 16;
133 	hash ^= hash >> 8;
134 	hash %= UNIX_HASH_SIZE;
135 	return &unix_socket_table[UNIX_HASH_SIZE + hash];
136 }
137 
138 #define UNIX_ABSTRACT(sk)	(unix_sk(sk)->addr->hash < UNIX_HASH_SIZE)
139 
140 #ifdef CONFIG_SECURITY_NETWORK
141 static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
142 {
143 	UNIXCB(skb).secid = scm->secid;
144 }
145 
146 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
147 {
148 	scm->secid = UNIXCB(skb).secid;
149 }
150 
151 static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb)
152 {
153 	return (scm->secid == UNIXCB(skb).secid);
154 }
155 #else
156 static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
157 { }
158 
159 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
160 { }
161 
162 static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb)
163 {
164 	return true;
165 }
166 #endif /* CONFIG_SECURITY_NETWORK */
167 
168 /*
169  *  SMP locking strategy:
170  *    hash table is protected with spinlock unix_table_lock
171  *    each socket state is protected by separate spin lock.
172  */
173 
174 static inline unsigned int unix_hash_fold(__wsum n)
175 {
176 	unsigned int hash = (__force unsigned int)csum_fold(n);
177 
178 	hash ^= hash>>8;
179 	return hash&(UNIX_HASH_SIZE-1);
180 }
181 
182 #define unix_peer(sk) (unix_sk(sk)->peer)
183 
184 static inline int unix_our_peer(struct sock *sk, struct sock *osk)
185 {
186 	return unix_peer(osk) == sk;
187 }
188 
189 static inline int unix_may_send(struct sock *sk, struct sock *osk)
190 {
191 	return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
192 }
193 
194 static inline int unix_recvq_full(struct sock const *sk)
195 {
196 	return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
197 }
198 
199 struct sock *unix_peer_get(struct sock *s)
200 {
201 	struct sock *peer;
202 
203 	unix_state_lock(s);
204 	peer = unix_peer(s);
205 	if (peer)
206 		sock_hold(peer);
207 	unix_state_unlock(s);
208 	return peer;
209 }
210 EXPORT_SYMBOL_GPL(unix_peer_get);
211 
212 static inline void unix_release_addr(struct unix_address *addr)
213 {
214 	if (atomic_dec_and_test(&addr->refcnt))
215 		kfree(addr);
216 }
217 
218 /*
219  *	Check unix socket name:
220  *		- should be not zero length.
221  *	        - if started by not zero, should be NULL terminated (FS object)
222  *		- if started by zero, it is abstract name.
223  */
224 
225 static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
226 {
227 	if (len <= sizeof(short) || len > sizeof(*sunaddr))
228 		return -EINVAL;
229 	if (!sunaddr || sunaddr->sun_family != AF_UNIX)
230 		return -EINVAL;
231 	if (sunaddr->sun_path[0]) {
232 		/*
233 		 * This may look like an off by one error but it is a bit more
234 		 * subtle. 108 is the longest valid AF_UNIX path for a binding.
235 		 * sun_path[108] doesn't as such exist.  However in kernel space
236 		 * we are guaranteed that it is a valid memory location in our
237 		 * kernel address buffer.
238 		 */
239 		((char *)sunaddr)[len] = 0;
240 		len = strlen(sunaddr->sun_path)+1+sizeof(short);
241 		return len;
242 	}
243 
244 	*hashp = unix_hash_fold(csum_partial(sunaddr, len, 0));
245 	return len;
246 }
247 
248 static void __unix_remove_socket(struct sock *sk)
249 {
250 	sk_del_node_init(sk);
251 }
252 
253 static void __unix_insert_socket(struct hlist_head *list, struct sock *sk)
254 {
255 	WARN_ON(!sk_unhashed(sk));
256 	sk_add_node(sk, list);
257 }
258 
259 static inline void unix_remove_socket(struct sock *sk)
260 {
261 	spin_lock(&unix_table_lock);
262 	__unix_remove_socket(sk);
263 	spin_unlock(&unix_table_lock);
264 }
265 
266 static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk)
267 {
268 	spin_lock(&unix_table_lock);
269 	__unix_insert_socket(list, sk);
270 	spin_unlock(&unix_table_lock);
271 }
272 
273 static struct sock *__unix_find_socket_byname(struct net *net,
274 					      struct sockaddr_un *sunname,
275 					      int len, int type, unsigned int hash)
276 {
277 	struct sock *s;
278 
279 	sk_for_each(s, &unix_socket_table[hash ^ type]) {
280 		struct unix_sock *u = unix_sk(s);
281 
282 		if (!net_eq(sock_net(s), net))
283 			continue;
284 
285 		if (u->addr->len == len &&
286 		    !memcmp(u->addr->name, sunname, len))
287 			goto found;
288 	}
289 	s = NULL;
290 found:
291 	return s;
292 }
293 
294 static inline struct sock *unix_find_socket_byname(struct net *net,
295 						   struct sockaddr_un *sunname,
296 						   int len, int type,
297 						   unsigned int hash)
298 {
299 	struct sock *s;
300 
301 	spin_lock(&unix_table_lock);
302 	s = __unix_find_socket_byname(net, sunname, len, type, hash);
303 	if (s)
304 		sock_hold(s);
305 	spin_unlock(&unix_table_lock);
306 	return s;
307 }
308 
309 static struct sock *unix_find_socket_byinode(struct inode *i)
310 {
311 	struct sock *s;
312 
313 	spin_lock(&unix_table_lock);
314 	sk_for_each(s,
315 		    &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
316 		struct dentry *dentry = unix_sk(s)->path.dentry;
317 
318 		if (dentry && d_backing_inode(dentry) == i) {
319 			sock_hold(s);
320 			goto found;
321 		}
322 	}
323 	s = NULL;
324 found:
325 	spin_unlock(&unix_table_lock);
326 	return s;
327 }
328 
329 static inline int unix_writable(struct sock *sk)
330 {
331 	return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
332 }
333 
334 static void unix_write_space(struct sock *sk)
335 {
336 	struct socket_wq *wq;
337 
338 	rcu_read_lock();
339 	if (unix_writable(sk)) {
340 		wq = rcu_dereference(sk->sk_wq);
341 		if (wq_has_sleeper(wq))
342 			wake_up_interruptible_sync_poll(&wq->wait,
343 				POLLOUT | POLLWRNORM | POLLWRBAND);
344 		sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
345 	}
346 	rcu_read_unlock();
347 }
348 
349 /* When dgram socket disconnects (or changes its peer), we clear its receive
350  * queue of packets arrived from previous peer. First, it allows to do
351  * flow control based only on wmem_alloc; second, sk connected to peer
352  * may receive messages only from that peer. */
353 static void unix_dgram_disconnected(struct sock *sk, struct sock *other)
354 {
355 	if (!skb_queue_empty(&sk->sk_receive_queue)) {
356 		skb_queue_purge(&sk->sk_receive_queue);
357 		wake_up_interruptible_all(&unix_sk(sk)->peer_wait);
358 
359 		/* If one link of bidirectional dgram pipe is disconnected,
360 		 * we signal error. Messages are lost. Do not make this,
361 		 * when peer was not connected to us.
362 		 */
363 		if (!sock_flag(other, SOCK_DEAD) && unix_peer(other) == sk) {
364 			other->sk_err = ECONNRESET;
365 			other->sk_error_report(other);
366 		}
367 	}
368 }
369 
370 static void unix_sock_destructor(struct sock *sk)
371 {
372 	struct unix_sock *u = unix_sk(sk);
373 
374 	skb_queue_purge(&sk->sk_receive_queue);
375 
376 	WARN_ON(atomic_read(&sk->sk_wmem_alloc));
377 	WARN_ON(!sk_unhashed(sk));
378 	WARN_ON(sk->sk_socket);
379 	if (!sock_flag(sk, SOCK_DEAD)) {
380 		pr_info("Attempt to release alive unix socket: %p\n", sk);
381 		return;
382 	}
383 
384 	if (u->addr)
385 		unix_release_addr(u->addr);
386 
387 	atomic_long_dec(&unix_nr_socks);
388 	local_bh_disable();
389 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
390 	local_bh_enable();
391 #ifdef UNIX_REFCNT_DEBUG
392 	pr_debug("UNIX %p is destroyed, %ld are still alive.\n", sk,
393 		atomic_long_read(&unix_nr_socks));
394 #endif
395 }
396 
397 static void unix_release_sock(struct sock *sk, int embrion)
398 {
399 	struct unix_sock *u = unix_sk(sk);
400 	struct path path;
401 	struct sock *skpair;
402 	struct sk_buff *skb;
403 	int state;
404 
405 	unix_remove_socket(sk);
406 
407 	/* Clear state */
408 	unix_state_lock(sk);
409 	sock_orphan(sk);
410 	sk->sk_shutdown = SHUTDOWN_MASK;
411 	path	     = u->path;
412 	u->path.dentry = NULL;
413 	u->path.mnt = NULL;
414 	state = sk->sk_state;
415 	sk->sk_state = TCP_CLOSE;
416 	unix_state_unlock(sk);
417 
418 	wake_up_interruptible_all(&u->peer_wait);
419 
420 	skpair = unix_peer(sk);
421 
422 	if (skpair != NULL) {
423 		if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
424 			unix_state_lock(skpair);
425 			/* No more writes */
426 			skpair->sk_shutdown = SHUTDOWN_MASK;
427 			if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
428 				skpair->sk_err = ECONNRESET;
429 			unix_state_unlock(skpair);
430 			skpair->sk_state_change(skpair);
431 			sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
432 		}
433 		sock_put(skpair); /* It may now die */
434 		unix_peer(sk) = NULL;
435 	}
436 
437 	/* Try to flush out this socket. Throw out buffers at least */
438 
439 	while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
440 		if (state == TCP_LISTEN)
441 			unix_release_sock(skb->sk, 1);
442 		/* passed fds are erased in the kfree_skb hook	      */
443 		kfree_skb(skb);
444 	}
445 
446 	if (path.dentry)
447 		path_put(&path);
448 
449 	sock_put(sk);
450 
451 	/* ---- Socket is dead now and most probably destroyed ---- */
452 
453 	/*
454 	 * Fixme: BSD difference: In BSD all sockets connected to us get
455 	 *	  ECONNRESET and we die on the spot. In Linux we behave
456 	 *	  like files and pipes do and wait for the last
457 	 *	  dereference.
458 	 *
459 	 * Can't we simply set sock->err?
460 	 *
461 	 *	  What the above comment does talk about? --ANK(980817)
462 	 */
463 
464 	if (unix_tot_inflight)
465 		unix_gc();		/* Garbage collect fds */
466 }
467 
468 static void init_peercred(struct sock *sk)
469 {
470 	put_pid(sk->sk_peer_pid);
471 	if (sk->sk_peer_cred)
472 		put_cred(sk->sk_peer_cred);
473 	sk->sk_peer_pid  = get_pid(task_tgid(current));
474 	sk->sk_peer_cred = get_current_cred();
475 }
476 
477 static void copy_peercred(struct sock *sk, struct sock *peersk)
478 {
479 	put_pid(sk->sk_peer_pid);
480 	if (sk->sk_peer_cred)
481 		put_cred(sk->sk_peer_cred);
482 	sk->sk_peer_pid  = get_pid(peersk->sk_peer_pid);
483 	sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
484 }
485 
486 static int unix_listen(struct socket *sock, int backlog)
487 {
488 	int err;
489 	struct sock *sk = sock->sk;
490 	struct unix_sock *u = unix_sk(sk);
491 	struct pid *old_pid = NULL;
492 
493 	err = -EOPNOTSUPP;
494 	if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
495 		goto out;	/* Only stream/seqpacket sockets accept */
496 	err = -EINVAL;
497 	if (!u->addr)
498 		goto out;	/* No listens on an unbound socket */
499 	unix_state_lock(sk);
500 	if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
501 		goto out_unlock;
502 	if (backlog > sk->sk_max_ack_backlog)
503 		wake_up_interruptible_all(&u->peer_wait);
504 	sk->sk_max_ack_backlog	= backlog;
505 	sk->sk_state		= TCP_LISTEN;
506 	/* set credentials so connect can copy them */
507 	init_peercred(sk);
508 	err = 0;
509 
510 out_unlock:
511 	unix_state_unlock(sk);
512 	put_pid(old_pid);
513 out:
514 	return err;
515 }
516 
517 static int unix_release(struct socket *);
518 static int unix_bind(struct socket *, struct sockaddr *, int);
519 static int unix_stream_connect(struct socket *, struct sockaddr *,
520 			       int addr_len, int flags);
521 static int unix_socketpair(struct socket *, struct socket *);
522 static int unix_accept(struct socket *, struct socket *, int);
523 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
524 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
525 static unsigned int unix_dgram_poll(struct file *, struct socket *,
526 				    poll_table *);
527 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
528 static int unix_shutdown(struct socket *, int);
529 static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);
530 static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int);
531 static ssize_t unix_stream_sendpage(struct socket *, struct page *, int offset,
532 				    size_t size, int flags);
533 static ssize_t unix_stream_splice_read(struct socket *,  loff_t *ppos,
534 				       struct pipe_inode_info *, size_t size,
535 				       unsigned int flags);
536 static int unix_dgram_sendmsg(struct socket *, struct msghdr *, size_t);
537 static int unix_dgram_recvmsg(struct socket *, struct msghdr *, size_t, int);
538 static int unix_dgram_connect(struct socket *, struct sockaddr *,
539 			      int, int);
540 static int unix_seqpacket_sendmsg(struct socket *, struct msghdr *, size_t);
541 static int unix_seqpacket_recvmsg(struct socket *, struct msghdr *, size_t,
542 				  int);
543 
544 static int unix_set_peek_off(struct sock *sk, int val)
545 {
546 	struct unix_sock *u = unix_sk(sk);
547 
548 	if (mutex_lock_interruptible(&u->readlock))
549 		return -EINTR;
550 
551 	sk->sk_peek_off = val;
552 	mutex_unlock(&u->readlock);
553 
554 	return 0;
555 }
556 
557 
558 static const struct proto_ops unix_stream_ops = {
559 	.family =	PF_UNIX,
560 	.owner =	THIS_MODULE,
561 	.release =	unix_release,
562 	.bind =		unix_bind,
563 	.connect =	unix_stream_connect,
564 	.socketpair =	unix_socketpair,
565 	.accept =	unix_accept,
566 	.getname =	unix_getname,
567 	.poll =		unix_poll,
568 	.ioctl =	unix_ioctl,
569 	.listen =	unix_listen,
570 	.shutdown =	unix_shutdown,
571 	.setsockopt =	sock_no_setsockopt,
572 	.getsockopt =	sock_no_getsockopt,
573 	.sendmsg =	unix_stream_sendmsg,
574 	.recvmsg =	unix_stream_recvmsg,
575 	.mmap =		sock_no_mmap,
576 	.sendpage =	unix_stream_sendpage,
577 	.splice_read =	unix_stream_splice_read,
578 	.set_peek_off =	unix_set_peek_off,
579 };
580 
581 static const struct proto_ops unix_dgram_ops = {
582 	.family =	PF_UNIX,
583 	.owner =	THIS_MODULE,
584 	.release =	unix_release,
585 	.bind =		unix_bind,
586 	.connect =	unix_dgram_connect,
587 	.socketpair =	unix_socketpair,
588 	.accept =	sock_no_accept,
589 	.getname =	unix_getname,
590 	.poll =		unix_dgram_poll,
591 	.ioctl =	unix_ioctl,
592 	.listen =	sock_no_listen,
593 	.shutdown =	unix_shutdown,
594 	.setsockopt =	sock_no_setsockopt,
595 	.getsockopt =	sock_no_getsockopt,
596 	.sendmsg =	unix_dgram_sendmsg,
597 	.recvmsg =	unix_dgram_recvmsg,
598 	.mmap =		sock_no_mmap,
599 	.sendpage =	sock_no_sendpage,
600 	.set_peek_off =	unix_set_peek_off,
601 };
602 
603 static const struct proto_ops unix_seqpacket_ops = {
604 	.family =	PF_UNIX,
605 	.owner =	THIS_MODULE,
606 	.release =	unix_release,
607 	.bind =		unix_bind,
608 	.connect =	unix_stream_connect,
609 	.socketpair =	unix_socketpair,
610 	.accept =	unix_accept,
611 	.getname =	unix_getname,
612 	.poll =		unix_dgram_poll,
613 	.ioctl =	unix_ioctl,
614 	.listen =	unix_listen,
615 	.shutdown =	unix_shutdown,
616 	.setsockopt =	sock_no_setsockopt,
617 	.getsockopt =	sock_no_getsockopt,
618 	.sendmsg =	unix_seqpacket_sendmsg,
619 	.recvmsg =	unix_seqpacket_recvmsg,
620 	.mmap =		sock_no_mmap,
621 	.sendpage =	sock_no_sendpage,
622 	.set_peek_off =	unix_set_peek_off,
623 };
624 
625 static struct proto unix_proto = {
626 	.name			= "UNIX",
627 	.owner			= THIS_MODULE,
628 	.obj_size		= sizeof(struct unix_sock),
629 };
630 
631 /*
632  * AF_UNIX sockets do not interact with hardware, hence they
633  * dont trigger interrupts - so it's safe for them to have
634  * bh-unsafe locking for their sk_receive_queue.lock. Split off
635  * this special lock-class by reinitializing the spinlock key:
636  */
637 static struct lock_class_key af_unix_sk_receive_queue_lock_key;
638 
639 static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
640 {
641 	struct sock *sk = NULL;
642 	struct unix_sock *u;
643 
644 	atomic_long_inc(&unix_nr_socks);
645 	if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files())
646 		goto out;
647 
648 	sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto, kern);
649 	if (!sk)
650 		goto out;
651 
652 	sock_init_data(sock, sk);
653 	lockdep_set_class(&sk->sk_receive_queue.lock,
654 				&af_unix_sk_receive_queue_lock_key);
655 
656 	sk->sk_write_space	= unix_write_space;
657 	sk->sk_max_ack_backlog	= net->unx.sysctl_max_dgram_qlen;
658 	sk->sk_destruct		= unix_sock_destructor;
659 	u	  = unix_sk(sk);
660 	u->path.dentry = NULL;
661 	u->path.mnt = NULL;
662 	spin_lock_init(&u->lock);
663 	atomic_long_set(&u->inflight, 0);
664 	INIT_LIST_HEAD(&u->link);
665 	mutex_init(&u->readlock); /* single task reading lock */
666 	init_waitqueue_head(&u->peer_wait);
667 	unix_insert_socket(unix_sockets_unbound(sk), sk);
668 out:
669 	if (sk == NULL)
670 		atomic_long_dec(&unix_nr_socks);
671 	else {
672 		local_bh_disable();
673 		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
674 		local_bh_enable();
675 	}
676 	return sk;
677 }
678 
679 static int unix_create(struct net *net, struct socket *sock, int protocol,
680 		       int kern)
681 {
682 	if (protocol && protocol != PF_UNIX)
683 		return -EPROTONOSUPPORT;
684 
685 	sock->state = SS_UNCONNECTED;
686 
687 	switch (sock->type) {
688 	case SOCK_STREAM:
689 		sock->ops = &unix_stream_ops;
690 		break;
691 		/*
692 		 *	Believe it or not BSD has AF_UNIX, SOCK_RAW though
693 		 *	nothing uses it.
694 		 */
695 	case SOCK_RAW:
696 		sock->type = SOCK_DGRAM;
697 	case SOCK_DGRAM:
698 		sock->ops = &unix_dgram_ops;
699 		break;
700 	case SOCK_SEQPACKET:
701 		sock->ops = &unix_seqpacket_ops;
702 		break;
703 	default:
704 		return -ESOCKTNOSUPPORT;
705 	}
706 
707 	return unix_create1(net, sock, kern) ? 0 : -ENOMEM;
708 }
709 
710 static int unix_release(struct socket *sock)
711 {
712 	struct sock *sk = sock->sk;
713 
714 	if (!sk)
715 		return 0;
716 
717 	unix_release_sock(sk, 0);
718 	sock->sk = NULL;
719 
720 	return 0;
721 }
722 
723 static int unix_autobind(struct socket *sock)
724 {
725 	struct sock *sk = sock->sk;
726 	struct net *net = sock_net(sk);
727 	struct unix_sock *u = unix_sk(sk);
728 	static u32 ordernum = 1;
729 	struct unix_address *addr;
730 	int err;
731 	unsigned int retries = 0;
732 
733 	err = mutex_lock_interruptible(&u->readlock);
734 	if (err)
735 		return err;
736 
737 	err = 0;
738 	if (u->addr)
739 		goto out;
740 
741 	err = -ENOMEM;
742 	addr = kzalloc(sizeof(*addr) + sizeof(short) + 16, GFP_KERNEL);
743 	if (!addr)
744 		goto out;
745 
746 	addr->name->sun_family = AF_UNIX;
747 	atomic_set(&addr->refcnt, 1);
748 
749 retry:
750 	addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short);
751 	addr->hash = unix_hash_fold(csum_partial(addr->name, addr->len, 0));
752 
753 	spin_lock(&unix_table_lock);
754 	ordernum = (ordernum+1)&0xFFFFF;
755 
756 	if (__unix_find_socket_byname(net, addr->name, addr->len, sock->type,
757 				      addr->hash)) {
758 		spin_unlock(&unix_table_lock);
759 		/*
760 		 * __unix_find_socket_byname() may take long time if many names
761 		 * are already in use.
762 		 */
763 		cond_resched();
764 		/* Give up if all names seems to be in use. */
765 		if (retries++ == 0xFFFFF) {
766 			err = -ENOSPC;
767 			kfree(addr);
768 			goto out;
769 		}
770 		goto retry;
771 	}
772 	addr->hash ^= sk->sk_type;
773 
774 	__unix_remove_socket(sk);
775 	u->addr = addr;
776 	__unix_insert_socket(&unix_socket_table[addr->hash], sk);
777 	spin_unlock(&unix_table_lock);
778 	err = 0;
779 
780 out:	mutex_unlock(&u->readlock);
781 	return err;
782 }
783 
784 static struct sock *unix_find_other(struct net *net,
785 				    struct sockaddr_un *sunname, int len,
786 				    int type, unsigned int hash, int *error)
787 {
788 	struct sock *u;
789 	struct path path;
790 	int err = 0;
791 
792 	if (sunname->sun_path[0]) {
793 		struct inode *inode;
794 		err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
795 		if (err)
796 			goto fail;
797 		inode = d_backing_inode(path.dentry);
798 		err = inode_permission(inode, MAY_WRITE);
799 		if (err)
800 			goto put_fail;
801 
802 		err = -ECONNREFUSED;
803 		if (!S_ISSOCK(inode->i_mode))
804 			goto put_fail;
805 		u = unix_find_socket_byinode(inode);
806 		if (!u)
807 			goto put_fail;
808 
809 		if (u->sk_type == type)
810 			touch_atime(&path);
811 
812 		path_put(&path);
813 
814 		err = -EPROTOTYPE;
815 		if (u->sk_type != type) {
816 			sock_put(u);
817 			goto fail;
818 		}
819 	} else {
820 		err = -ECONNREFUSED;
821 		u = unix_find_socket_byname(net, sunname, len, type, hash);
822 		if (u) {
823 			struct dentry *dentry;
824 			dentry = unix_sk(u)->path.dentry;
825 			if (dentry)
826 				touch_atime(&unix_sk(u)->path);
827 		} else
828 			goto fail;
829 	}
830 	return u;
831 
832 put_fail:
833 	path_put(&path);
834 fail:
835 	*error = err;
836 	return NULL;
837 }
838 
839 static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
840 {
841 	struct dentry *dentry;
842 	struct path path;
843 	int err = 0;
844 	/*
845 	 * Get the parent directory, calculate the hash for last
846 	 * component.
847 	 */
848 	dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
849 	err = PTR_ERR(dentry);
850 	if (IS_ERR(dentry))
851 		return err;
852 
853 	/*
854 	 * All right, let's create it.
855 	 */
856 	err = security_path_mknod(&path, dentry, mode, 0);
857 	if (!err) {
858 		err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
859 		if (!err) {
860 			res->mnt = mntget(path.mnt);
861 			res->dentry = dget(dentry);
862 		}
863 	}
864 	done_path_create(&path, dentry);
865 	return err;
866 }
867 
868 static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
869 {
870 	struct sock *sk = sock->sk;
871 	struct net *net = sock_net(sk);
872 	struct unix_sock *u = unix_sk(sk);
873 	struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
874 	char *sun_path = sunaddr->sun_path;
875 	int err;
876 	unsigned int hash;
877 	struct unix_address *addr;
878 	struct hlist_head *list;
879 
880 	err = -EINVAL;
881 	if (sunaddr->sun_family != AF_UNIX)
882 		goto out;
883 
884 	if (addr_len == sizeof(short)) {
885 		err = unix_autobind(sock);
886 		goto out;
887 	}
888 
889 	err = unix_mkname(sunaddr, addr_len, &hash);
890 	if (err < 0)
891 		goto out;
892 	addr_len = err;
893 
894 	err = mutex_lock_interruptible(&u->readlock);
895 	if (err)
896 		goto out;
897 
898 	err = -EINVAL;
899 	if (u->addr)
900 		goto out_up;
901 
902 	err = -ENOMEM;
903 	addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
904 	if (!addr)
905 		goto out_up;
906 
907 	memcpy(addr->name, sunaddr, addr_len);
908 	addr->len = addr_len;
909 	addr->hash = hash ^ sk->sk_type;
910 	atomic_set(&addr->refcnt, 1);
911 
912 	if (sun_path[0]) {
913 		struct path path;
914 		umode_t mode = S_IFSOCK |
915 		       (SOCK_INODE(sock)->i_mode & ~current_umask());
916 		err = unix_mknod(sun_path, mode, &path);
917 		if (err) {
918 			if (err == -EEXIST)
919 				err = -EADDRINUSE;
920 			unix_release_addr(addr);
921 			goto out_up;
922 		}
923 		addr->hash = UNIX_HASH_SIZE;
924 		hash = d_backing_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE-1);
925 		spin_lock(&unix_table_lock);
926 		u->path = path;
927 		list = &unix_socket_table[hash];
928 	} else {
929 		spin_lock(&unix_table_lock);
930 		err = -EADDRINUSE;
931 		if (__unix_find_socket_byname(net, sunaddr, addr_len,
932 					      sk->sk_type, hash)) {
933 			unix_release_addr(addr);
934 			goto out_unlock;
935 		}
936 
937 		list = &unix_socket_table[addr->hash];
938 	}
939 
940 	err = 0;
941 	__unix_remove_socket(sk);
942 	u->addr = addr;
943 	__unix_insert_socket(list, sk);
944 
945 out_unlock:
946 	spin_unlock(&unix_table_lock);
947 out_up:
948 	mutex_unlock(&u->readlock);
949 out:
950 	return err;
951 }
952 
953 static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
954 {
955 	if (unlikely(sk1 == sk2) || !sk2) {
956 		unix_state_lock(sk1);
957 		return;
958 	}
959 	if (sk1 < sk2) {
960 		unix_state_lock(sk1);
961 		unix_state_lock_nested(sk2);
962 	} else {
963 		unix_state_lock(sk2);
964 		unix_state_lock_nested(sk1);
965 	}
966 }
967 
968 static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
969 {
970 	if (unlikely(sk1 == sk2) || !sk2) {
971 		unix_state_unlock(sk1);
972 		return;
973 	}
974 	unix_state_unlock(sk1);
975 	unix_state_unlock(sk2);
976 }
977 
978 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
979 			      int alen, int flags)
980 {
981 	struct sock *sk = sock->sk;
982 	struct net *net = sock_net(sk);
983 	struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
984 	struct sock *other;
985 	unsigned int hash;
986 	int err;
987 
988 	if (addr->sa_family != AF_UNSPEC) {
989 		err = unix_mkname(sunaddr, alen, &hash);
990 		if (err < 0)
991 			goto out;
992 		alen = err;
993 
994 		if (test_bit(SOCK_PASSCRED, &sock->flags) &&
995 		    !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0)
996 			goto out;
997 
998 restart:
999 		other = unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
1000 		if (!other)
1001 			goto out;
1002 
1003 		unix_state_double_lock(sk, other);
1004 
1005 		/* Apparently VFS overslept socket death. Retry. */
1006 		if (sock_flag(other, SOCK_DEAD)) {
1007 			unix_state_double_unlock(sk, other);
1008 			sock_put(other);
1009 			goto restart;
1010 		}
1011 
1012 		err = -EPERM;
1013 		if (!unix_may_send(sk, other))
1014 			goto out_unlock;
1015 
1016 		err = security_unix_may_send(sk->sk_socket, other->sk_socket);
1017 		if (err)
1018 			goto out_unlock;
1019 
1020 	} else {
1021 		/*
1022 		 *	1003.1g breaking connected state with AF_UNSPEC
1023 		 */
1024 		other = NULL;
1025 		unix_state_double_lock(sk, other);
1026 	}
1027 
1028 	/*
1029 	 * If it was connected, reconnect.
1030 	 */
1031 	if (unix_peer(sk)) {
1032 		struct sock *old_peer = unix_peer(sk);
1033 		unix_peer(sk) = other;
1034 		unix_state_double_unlock(sk, other);
1035 
1036 		if (other != old_peer)
1037 			unix_dgram_disconnected(sk, old_peer);
1038 		sock_put(old_peer);
1039 	} else {
1040 		unix_peer(sk) = other;
1041 		unix_state_double_unlock(sk, other);
1042 	}
1043 	return 0;
1044 
1045 out_unlock:
1046 	unix_state_double_unlock(sk, other);
1047 	sock_put(other);
1048 out:
1049 	return err;
1050 }
1051 
1052 static long unix_wait_for_peer(struct sock *other, long timeo)
1053 {
1054 	struct unix_sock *u = unix_sk(other);
1055 	int sched;
1056 	DEFINE_WAIT(wait);
1057 
1058 	prepare_to_wait_exclusive(&u->peer_wait, &wait, TASK_INTERRUPTIBLE);
1059 
1060 	sched = !sock_flag(other, SOCK_DEAD) &&
1061 		!(other->sk_shutdown & RCV_SHUTDOWN) &&
1062 		unix_recvq_full(other);
1063 
1064 	unix_state_unlock(other);
1065 
1066 	if (sched)
1067 		timeo = schedule_timeout(timeo);
1068 
1069 	finish_wait(&u->peer_wait, &wait);
1070 	return timeo;
1071 }
1072 
1073 static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
1074 			       int addr_len, int flags)
1075 {
1076 	struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
1077 	struct sock *sk = sock->sk;
1078 	struct net *net = sock_net(sk);
1079 	struct unix_sock *u = unix_sk(sk), *newu, *otheru;
1080 	struct sock *newsk = NULL;
1081 	struct sock *other = NULL;
1082 	struct sk_buff *skb = NULL;
1083 	unsigned int hash;
1084 	int st;
1085 	int err;
1086 	long timeo;
1087 
1088 	err = unix_mkname(sunaddr, addr_len, &hash);
1089 	if (err < 0)
1090 		goto out;
1091 	addr_len = err;
1092 
1093 	if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr &&
1094 	    (err = unix_autobind(sock)) != 0)
1095 		goto out;
1096 
1097 	timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
1098 
1099 	/* First of all allocate resources.
1100 	   If we will make it after state is locked,
1101 	   we will have to recheck all again in any case.
1102 	 */
1103 
1104 	err = -ENOMEM;
1105 
1106 	/* create new sock for complete connection */
1107 	newsk = unix_create1(sock_net(sk), NULL, 0);
1108 	if (newsk == NULL)
1109 		goto out;
1110 
1111 	/* Allocate skb for sending to listening sock */
1112 	skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL);
1113 	if (skb == NULL)
1114 		goto out;
1115 
1116 restart:
1117 	/*  Find listening sock. */
1118 	other = unix_find_other(net, sunaddr, addr_len, sk->sk_type, hash, &err);
1119 	if (!other)
1120 		goto out;
1121 
1122 	/* Latch state of peer */
1123 	unix_state_lock(other);
1124 
1125 	/* Apparently VFS overslept socket death. Retry. */
1126 	if (sock_flag(other, SOCK_DEAD)) {
1127 		unix_state_unlock(other);
1128 		sock_put(other);
1129 		goto restart;
1130 	}
1131 
1132 	err = -ECONNREFUSED;
1133 	if (other->sk_state != TCP_LISTEN)
1134 		goto out_unlock;
1135 	if (other->sk_shutdown & RCV_SHUTDOWN)
1136 		goto out_unlock;
1137 
1138 	if (unix_recvq_full(other)) {
1139 		err = -EAGAIN;
1140 		if (!timeo)
1141 			goto out_unlock;
1142 
1143 		timeo = unix_wait_for_peer(other, timeo);
1144 
1145 		err = sock_intr_errno(timeo);
1146 		if (signal_pending(current))
1147 			goto out;
1148 		sock_put(other);
1149 		goto restart;
1150 	}
1151 
1152 	/* Latch our state.
1153 
1154 	   It is tricky place. We need to grab our state lock and cannot
1155 	   drop lock on peer. It is dangerous because deadlock is
1156 	   possible. Connect to self case and simultaneous
1157 	   attempt to connect are eliminated by checking socket
1158 	   state. other is TCP_LISTEN, if sk is TCP_LISTEN we
1159 	   check this before attempt to grab lock.
1160 
1161 	   Well, and we have to recheck the state after socket locked.
1162 	 */
1163 	st = sk->sk_state;
1164 
1165 	switch (st) {
1166 	case TCP_CLOSE:
1167 		/* This is ok... continue with connect */
1168 		break;
1169 	case TCP_ESTABLISHED:
1170 		/* Socket is already connected */
1171 		err = -EISCONN;
1172 		goto out_unlock;
1173 	default:
1174 		err = -EINVAL;
1175 		goto out_unlock;
1176 	}
1177 
1178 	unix_state_lock_nested(sk);
1179 
1180 	if (sk->sk_state != st) {
1181 		unix_state_unlock(sk);
1182 		unix_state_unlock(other);
1183 		sock_put(other);
1184 		goto restart;
1185 	}
1186 
1187 	err = security_unix_stream_connect(sk, other, newsk);
1188 	if (err) {
1189 		unix_state_unlock(sk);
1190 		goto out_unlock;
1191 	}
1192 
1193 	/* The way is open! Fastly set all the necessary fields... */
1194 
1195 	sock_hold(sk);
1196 	unix_peer(newsk)	= sk;
1197 	newsk->sk_state		= TCP_ESTABLISHED;
1198 	newsk->sk_type		= sk->sk_type;
1199 	init_peercred(newsk);
1200 	newu = unix_sk(newsk);
1201 	RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
1202 	otheru = unix_sk(other);
1203 
1204 	/* copy address information from listening to new sock*/
1205 	if (otheru->addr) {
1206 		atomic_inc(&otheru->addr->refcnt);
1207 		newu->addr = otheru->addr;
1208 	}
1209 	if (otheru->path.dentry) {
1210 		path_get(&otheru->path);
1211 		newu->path = otheru->path;
1212 	}
1213 
1214 	/* Set credentials */
1215 	copy_peercred(sk, other);
1216 
1217 	sock->state	= SS_CONNECTED;
1218 	sk->sk_state	= TCP_ESTABLISHED;
1219 	sock_hold(newsk);
1220 
1221 	smp_mb__after_atomic();	/* sock_hold() does an atomic_inc() */
1222 	unix_peer(sk)	= newsk;
1223 
1224 	unix_state_unlock(sk);
1225 
1226 	/* take ten and and send info to listening sock */
1227 	spin_lock(&other->sk_receive_queue.lock);
1228 	__skb_queue_tail(&other->sk_receive_queue, skb);
1229 	spin_unlock(&other->sk_receive_queue.lock);
1230 	unix_state_unlock(other);
1231 	other->sk_data_ready(other);
1232 	sock_put(other);
1233 	return 0;
1234 
1235 out_unlock:
1236 	if (other)
1237 		unix_state_unlock(other);
1238 
1239 out:
1240 	kfree_skb(skb);
1241 	if (newsk)
1242 		unix_release_sock(newsk, 0);
1243 	if (other)
1244 		sock_put(other);
1245 	return err;
1246 }
1247 
1248 static int unix_socketpair(struct socket *socka, struct socket *sockb)
1249 {
1250 	struct sock *ska = socka->sk, *skb = sockb->sk;
1251 
1252 	/* Join our sockets back to back */
1253 	sock_hold(ska);
1254 	sock_hold(skb);
1255 	unix_peer(ska) = skb;
1256 	unix_peer(skb) = ska;
1257 	init_peercred(ska);
1258 	init_peercred(skb);
1259 
1260 	if (ska->sk_type != SOCK_DGRAM) {
1261 		ska->sk_state = TCP_ESTABLISHED;
1262 		skb->sk_state = TCP_ESTABLISHED;
1263 		socka->state  = SS_CONNECTED;
1264 		sockb->state  = SS_CONNECTED;
1265 	}
1266 	return 0;
1267 }
1268 
1269 static void unix_sock_inherit_flags(const struct socket *old,
1270 				    struct socket *new)
1271 {
1272 	if (test_bit(SOCK_PASSCRED, &old->flags))
1273 		set_bit(SOCK_PASSCRED, &new->flags);
1274 	if (test_bit(SOCK_PASSSEC, &old->flags))
1275 		set_bit(SOCK_PASSSEC, &new->flags);
1276 }
1277 
1278 static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
1279 {
1280 	struct sock *sk = sock->sk;
1281 	struct sock *tsk;
1282 	struct sk_buff *skb;
1283 	int err;
1284 
1285 	err = -EOPNOTSUPP;
1286 	if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
1287 		goto out;
1288 
1289 	err = -EINVAL;
1290 	if (sk->sk_state != TCP_LISTEN)
1291 		goto out;
1292 
1293 	/* If socket state is TCP_LISTEN it cannot change (for now...),
1294 	 * so that no locks are necessary.
1295 	 */
1296 
1297 	skb = skb_recv_datagram(sk, 0, flags&O_NONBLOCK, &err);
1298 	if (!skb) {
1299 		/* This means receive shutdown. */
1300 		if (err == 0)
1301 			err = -EINVAL;
1302 		goto out;
1303 	}
1304 
1305 	tsk = skb->sk;
1306 	skb_free_datagram(sk, skb);
1307 	wake_up_interruptible(&unix_sk(sk)->peer_wait);
1308 
1309 	/* attach accepted sock to socket */
1310 	unix_state_lock(tsk);
1311 	newsock->state = SS_CONNECTED;
1312 	unix_sock_inherit_flags(sock, newsock);
1313 	sock_graft(tsk, newsock);
1314 	unix_state_unlock(tsk);
1315 	return 0;
1316 
1317 out:
1318 	return err;
1319 }
1320 
1321 
1322 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer)
1323 {
1324 	struct sock *sk = sock->sk;
1325 	struct unix_sock *u;
1326 	DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
1327 	int err = 0;
1328 
1329 	if (peer) {
1330 		sk = unix_peer_get(sk);
1331 
1332 		err = -ENOTCONN;
1333 		if (!sk)
1334 			goto out;
1335 		err = 0;
1336 	} else {
1337 		sock_hold(sk);
1338 	}
1339 
1340 	u = unix_sk(sk);
1341 	unix_state_lock(sk);
1342 	if (!u->addr) {
1343 		sunaddr->sun_family = AF_UNIX;
1344 		sunaddr->sun_path[0] = 0;
1345 		*uaddr_len = sizeof(short);
1346 	} else {
1347 		struct unix_address *addr = u->addr;
1348 
1349 		*uaddr_len = addr->len;
1350 		memcpy(sunaddr, addr->name, *uaddr_len);
1351 	}
1352 	unix_state_unlock(sk);
1353 	sock_put(sk);
1354 out:
1355 	return err;
1356 }
1357 
1358 static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1359 {
1360 	int i;
1361 
1362 	scm->fp = UNIXCB(skb).fp;
1363 	UNIXCB(skb).fp = NULL;
1364 
1365 	for (i = scm->fp->count-1; i >= 0; i--)
1366 		unix_notinflight(scm->fp->fp[i]);
1367 }
1368 
1369 static void unix_destruct_scm(struct sk_buff *skb)
1370 {
1371 	struct scm_cookie scm;
1372 	memset(&scm, 0, sizeof(scm));
1373 	scm.pid  = UNIXCB(skb).pid;
1374 	if (UNIXCB(skb).fp)
1375 		unix_detach_fds(&scm, skb);
1376 
1377 	/* Alas, it calls VFS */
1378 	/* So fscking what? fput() had been SMP-safe since the last Summer */
1379 	scm_destroy(&scm);
1380 	sock_wfree(skb);
1381 }
1382 
1383 #define MAX_RECURSION_LEVEL 4
1384 
1385 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1386 {
1387 	int i;
1388 	unsigned char max_level = 0;
1389 	int unix_sock_count = 0;
1390 
1391 	for (i = scm->fp->count - 1; i >= 0; i--) {
1392 		struct sock *sk = unix_get_socket(scm->fp->fp[i]);
1393 
1394 		if (sk) {
1395 			unix_sock_count++;
1396 			max_level = max(max_level,
1397 					unix_sk(sk)->recursion_level);
1398 		}
1399 	}
1400 	if (unlikely(max_level > MAX_RECURSION_LEVEL))
1401 		return -ETOOMANYREFS;
1402 
1403 	/*
1404 	 * Need to duplicate file references for the sake of garbage
1405 	 * collection.  Otherwise a socket in the fps might become a
1406 	 * candidate for GC while the skb is not yet queued.
1407 	 */
1408 	UNIXCB(skb).fp = scm_fp_dup(scm->fp);
1409 	if (!UNIXCB(skb).fp)
1410 		return -ENOMEM;
1411 
1412 	if (unix_sock_count) {
1413 		for (i = scm->fp->count - 1; i >= 0; i--)
1414 			unix_inflight(scm->fp->fp[i]);
1415 	}
1416 	return max_level;
1417 }
1418 
1419 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
1420 {
1421 	int err = 0;
1422 
1423 	UNIXCB(skb).pid  = get_pid(scm->pid);
1424 	UNIXCB(skb).uid = scm->creds.uid;
1425 	UNIXCB(skb).gid = scm->creds.gid;
1426 	UNIXCB(skb).fp = NULL;
1427 	unix_get_secdata(scm, skb);
1428 	if (scm->fp && send_fds)
1429 		err = unix_attach_fds(scm, skb);
1430 
1431 	skb->destructor = unix_destruct_scm;
1432 	return err;
1433 }
1434 
1435 /*
1436  * Some apps rely on write() giving SCM_CREDENTIALS
1437  * We include credentials if source or destination socket
1438  * asserted SOCK_PASSCRED.
1439  */
1440 static void maybe_add_creds(struct sk_buff *skb, const struct socket *sock,
1441 			    const struct sock *other)
1442 {
1443 	if (UNIXCB(skb).pid)
1444 		return;
1445 	if (test_bit(SOCK_PASSCRED, &sock->flags) ||
1446 	    !other->sk_socket ||
1447 	    test_bit(SOCK_PASSCRED, &other->sk_socket->flags)) {
1448 		UNIXCB(skb).pid  = get_pid(task_tgid(current));
1449 		current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
1450 	}
1451 }
1452 
1453 /*
1454  *	Send AF_UNIX data.
1455  */
1456 
1457 static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
1458 			      size_t len)
1459 {
1460 	struct sock *sk = sock->sk;
1461 	struct net *net = sock_net(sk);
1462 	struct unix_sock *u = unix_sk(sk);
1463 	DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, msg->msg_name);
1464 	struct sock *other = NULL;
1465 	int namelen = 0; /* fake GCC */
1466 	int err;
1467 	unsigned int hash;
1468 	struct sk_buff *skb;
1469 	long timeo;
1470 	struct scm_cookie scm;
1471 	int max_level;
1472 	int data_len = 0;
1473 
1474 	wait_for_unix_gc();
1475 	err = scm_send(sock, msg, &scm, false);
1476 	if (err < 0)
1477 		return err;
1478 
1479 	err = -EOPNOTSUPP;
1480 	if (msg->msg_flags&MSG_OOB)
1481 		goto out;
1482 
1483 	if (msg->msg_namelen) {
1484 		err = unix_mkname(sunaddr, msg->msg_namelen, &hash);
1485 		if (err < 0)
1486 			goto out;
1487 		namelen = err;
1488 	} else {
1489 		sunaddr = NULL;
1490 		err = -ENOTCONN;
1491 		other = unix_peer_get(sk);
1492 		if (!other)
1493 			goto out;
1494 	}
1495 
1496 	if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr
1497 	    && (err = unix_autobind(sock)) != 0)
1498 		goto out;
1499 
1500 	err = -EMSGSIZE;
1501 	if (len > sk->sk_sndbuf - 32)
1502 		goto out;
1503 
1504 	if (len > SKB_MAX_ALLOC) {
1505 		data_len = min_t(size_t,
1506 				 len - SKB_MAX_ALLOC,
1507 				 MAX_SKB_FRAGS * PAGE_SIZE);
1508 		data_len = PAGE_ALIGN(data_len);
1509 
1510 		BUILD_BUG_ON(SKB_MAX_ALLOC < PAGE_SIZE);
1511 	}
1512 
1513 	skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
1514 				   msg->msg_flags & MSG_DONTWAIT, &err,
1515 				   PAGE_ALLOC_COSTLY_ORDER);
1516 	if (skb == NULL)
1517 		goto out;
1518 
1519 	err = unix_scm_to_skb(&scm, skb, true);
1520 	if (err < 0)
1521 		goto out_free;
1522 	max_level = err + 1;
1523 
1524 	skb_put(skb, len - data_len);
1525 	skb->data_len = data_len;
1526 	skb->len = len;
1527 	err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, len);
1528 	if (err)
1529 		goto out_free;
1530 
1531 	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1532 
1533 restart:
1534 	if (!other) {
1535 		err = -ECONNRESET;
1536 		if (sunaddr == NULL)
1537 			goto out_free;
1538 
1539 		other = unix_find_other(net, sunaddr, namelen, sk->sk_type,
1540 					hash, &err);
1541 		if (other == NULL)
1542 			goto out_free;
1543 	}
1544 
1545 	if (sk_filter(other, skb) < 0) {
1546 		/* Toss the packet but do not return any error to the sender */
1547 		err = len;
1548 		goto out_free;
1549 	}
1550 
1551 	unix_state_lock(other);
1552 	err = -EPERM;
1553 	if (!unix_may_send(sk, other))
1554 		goto out_unlock;
1555 
1556 	if (sock_flag(other, SOCK_DEAD)) {
1557 		/*
1558 		 *	Check with 1003.1g - what should
1559 		 *	datagram error
1560 		 */
1561 		unix_state_unlock(other);
1562 		sock_put(other);
1563 
1564 		err = 0;
1565 		unix_state_lock(sk);
1566 		if (unix_peer(sk) == other) {
1567 			unix_peer(sk) = NULL;
1568 			unix_state_unlock(sk);
1569 
1570 			unix_dgram_disconnected(sk, other);
1571 			sock_put(other);
1572 			err = -ECONNREFUSED;
1573 		} else {
1574 			unix_state_unlock(sk);
1575 		}
1576 
1577 		other = NULL;
1578 		if (err)
1579 			goto out_free;
1580 		goto restart;
1581 	}
1582 
1583 	err = -EPIPE;
1584 	if (other->sk_shutdown & RCV_SHUTDOWN)
1585 		goto out_unlock;
1586 
1587 	if (sk->sk_type != SOCK_SEQPACKET) {
1588 		err = security_unix_may_send(sk->sk_socket, other->sk_socket);
1589 		if (err)
1590 			goto out_unlock;
1591 	}
1592 
1593 	if (unix_peer(other) != sk && unix_recvq_full(other)) {
1594 		if (!timeo) {
1595 			err = -EAGAIN;
1596 			goto out_unlock;
1597 		}
1598 
1599 		timeo = unix_wait_for_peer(other, timeo);
1600 
1601 		err = sock_intr_errno(timeo);
1602 		if (signal_pending(current))
1603 			goto out_free;
1604 
1605 		goto restart;
1606 	}
1607 
1608 	if (sock_flag(other, SOCK_RCVTSTAMP))
1609 		__net_timestamp(skb);
1610 	maybe_add_creds(skb, sock, other);
1611 	skb_queue_tail(&other->sk_receive_queue, skb);
1612 	if (max_level > unix_sk(other)->recursion_level)
1613 		unix_sk(other)->recursion_level = max_level;
1614 	unix_state_unlock(other);
1615 	other->sk_data_ready(other);
1616 	sock_put(other);
1617 	scm_destroy(&scm);
1618 	return len;
1619 
1620 out_unlock:
1621 	unix_state_unlock(other);
1622 out_free:
1623 	kfree_skb(skb);
1624 out:
1625 	if (other)
1626 		sock_put(other);
1627 	scm_destroy(&scm);
1628 	return err;
1629 }
1630 
1631 /* We use paged skbs for stream sockets, and limit occupancy to 32768
1632  * bytes, and a minimun of a full page.
1633  */
1634 #define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768))
1635 
1636 static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
1637 			       size_t len)
1638 {
1639 	struct sock *sk = sock->sk;
1640 	struct sock *other = NULL;
1641 	int err, size;
1642 	struct sk_buff *skb;
1643 	int sent = 0;
1644 	struct scm_cookie scm;
1645 	bool fds_sent = false;
1646 	int max_level;
1647 	int data_len;
1648 
1649 	wait_for_unix_gc();
1650 	err = scm_send(sock, msg, &scm, false);
1651 	if (err < 0)
1652 		return err;
1653 
1654 	err = -EOPNOTSUPP;
1655 	if (msg->msg_flags&MSG_OOB)
1656 		goto out_err;
1657 
1658 	if (msg->msg_namelen) {
1659 		err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
1660 		goto out_err;
1661 	} else {
1662 		err = -ENOTCONN;
1663 		other = unix_peer(sk);
1664 		if (!other)
1665 			goto out_err;
1666 	}
1667 
1668 	if (sk->sk_shutdown & SEND_SHUTDOWN)
1669 		goto pipe_err;
1670 
1671 	while (sent < len) {
1672 		size = len - sent;
1673 
1674 		/* Keep two messages in the pipe so it schedules better */
1675 		size = min_t(int, size, (sk->sk_sndbuf >> 1) - 64);
1676 
1677 		/* allow fallback to order-0 allocations */
1678 		size = min_t(int, size, SKB_MAX_HEAD(0) + UNIX_SKB_FRAGS_SZ);
1679 
1680 		data_len = max_t(int, 0, size - SKB_MAX_HEAD(0));
1681 
1682 		data_len = min_t(size_t, size, PAGE_ALIGN(data_len));
1683 
1684 		skb = sock_alloc_send_pskb(sk, size - data_len, data_len,
1685 					   msg->msg_flags & MSG_DONTWAIT, &err,
1686 					   get_order(UNIX_SKB_FRAGS_SZ));
1687 		if (!skb)
1688 			goto out_err;
1689 
1690 		/* Only send the fds in the first buffer */
1691 		err = unix_scm_to_skb(&scm, skb, !fds_sent);
1692 		if (err < 0) {
1693 			kfree_skb(skb);
1694 			goto out_err;
1695 		}
1696 		max_level = err + 1;
1697 		fds_sent = true;
1698 
1699 		skb_put(skb, size - data_len);
1700 		skb->data_len = data_len;
1701 		skb->len = size;
1702 		err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, size);
1703 		if (err) {
1704 			kfree_skb(skb);
1705 			goto out_err;
1706 		}
1707 
1708 		unix_state_lock(other);
1709 
1710 		if (sock_flag(other, SOCK_DEAD) ||
1711 		    (other->sk_shutdown & RCV_SHUTDOWN))
1712 			goto pipe_err_free;
1713 
1714 		maybe_add_creds(skb, sock, other);
1715 		skb_queue_tail(&other->sk_receive_queue, skb);
1716 		if (max_level > unix_sk(other)->recursion_level)
1717 			unix_sk(other)->recursion_level = max_level;
1718 		unix_state_unlock(other);
1719 		other->sk_data_ready(other);
1720 		sent += size;
1721 	}
1722 
1723 	scm_destroy(&scm);
1724 
1725 	return sent;
1726 
1727 pipe_err_free:
1728 	unix_state_unlock(other);
1729 	kfree_skb(skb);
1730 pipe_err:
1731 	if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
1732 		send_sig(SIGPIPE, current, 0);
1733 	err = -EPIPE;
1734 out_err:
1735 	scm_destroy(&scm);
1736 	return sent ? : err;
1737 }
1738 
1739 static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
1740 				    int offset, size_t size, int flags)
1741 {
1742 	int err = 0;
1743 	bool send_sigpipe = true;
1744 	struct sock *other, *sk = socket->sk;
1745 	struct sk_buff *skb, *newskb = NULL, *tail = NULL;
1746 
1747 	if (flags & MSG_OOB)
1748 		return -EOPNOTSUPP;
1749 
1750 	other = unix_peer(sk);
1751 	if (!other || sk->sk_state != TCP_ESTABLISHED)
1752 		return -ENOTCONN;
1753 
1754 	if (false) {
1755 alloc_skb:
1756 		unix_state_unlock(other);
1757 		mutex_unlock(&unix_sk(other)->readlock);
1758 		newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
1759 					      &err, 0);
1760 		if (!newskb)
1761 			return err;
1762 	}
1763 
1764 	/* we must acquire readlock as we modify already present
1765 	 * skbs in the sk_receive_queue and mess with skb->len
1766 	 */
1767 	err = mutex_lock_interruptible(&unix_sk(other)->readlock);
1768 	if (err) {
1769 		err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS;
1770 		send_sigpipe = false;
1771 		goto err;
1772 	}
1773 
1774 	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1775 		err = -EPIPE;
1776 		goto err_unlock;
1777 	}
1778 
1779 	unix_state_lock(other);
1780 
1781 	if (sock_flag(other, SOCK_DEAD) ||
1782 	    other->sk_shutdown & RCV_SHUTDOWN) {
1783 		err = -EPIPE;
1784 		goto err_state_unlock;
1785 	}
1786 
1787 	skb = skb_peek_tail(&other->sk_receive_queue);
1788 	if (tail && tail == skb) {
1789 		skb = newskb;
1790 	} else if (!skb) {
1791 		if (newskb)
1792 			skb = newskb;
1793 		else
1794 			goto alloc_skb;
1795 	} else if (newskb) {
1796 		/* this is fast path, we don't necessarily need to
1797 		 * call to kfree_skb even though with newskb == NULL
1798 		 * this - does no harm
1799 		 */
1800 		consume_skb(newskb);
1801 	}
1802 
1803 	if (skb_append_pagefrags(skb, page, offset, size)) {
1804 		tail = skb;
1805 		goto alloc_skb;
1806 	}
1807 
1808 	skb->len += size;
1809 	skb->data_len += size;
1810 	skb->truesize += size;
1811 	atomic_add(size, &sk->sk_wmem_alloc);
1812 
1813 	if (newskb)
1814 		__skb_queue_tail(&other->sk_receive_queue, newskb);
1815 
1816 	unix_state_unlock(other);
1817 	mutex_unlock(&unix_sk(other)->readlock);
1818 
1819 	other->sk_data_ready(other);
1820 
1821 	return size;
1822 
1823 err_state_unlock:
1824 	unix_state_unlock(other);
1825 err_unlock:
1826 	mutex_unlock(&unix_sk(other)->readlock);
1827 err:
1828 	kfree_skb(newskb);
1829 	if (send_sigpipe && !(flags & MSG_NOSIGNAL))
1830 		send_sig(SIGPIPE, current, 0);
1831 	return err;
1832 }
1833 
1834 static int unix_seqpacket_sendmsg(struct socket *sock, struct msghdr *msg,
1835 				  size_t len)
1836 {
1837 	int err;
1838 	struct sock *sk = sock->sk;
1839 
1840 	err = sock_error(sk);
1841 	if (err)
1842 		return err;
1843 
1844 	if (sk->sk_state != TCP_ESTABLISHED)
1845 		return -ENOTCONN;
1846 
1847 	if (msg->msg_namelen)
1848 		msg->msg_namelen = 0;
1849 
1850 	return unix_dgram_sendmsg(sock, msg, len);
1851 }
1852 
1853 static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg,
1854 				  size_t size, int flags)
1855 {
1856 	struct sock *sk = sock->sk;
1857 
1858 	if (sk->sk_state != TCP_ESTABLISHED)
1859 		return -ENOTCONN;
1860 
1861 	return unix_dgram_recvmsg(sock, msg, size, flags);
1862 }
1863 
1864 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
1865 {
1866 	struct unix_sock *u = unix_sk(sk);
1867 
1868 	if (u->addr) {
1869 		msg->msg_namelen = u->addr->len;
1870 		memcpy(msg->msg_name, u->addr->name, u->addr->len);
1871 	}
1872 }
1873 
1874 static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
1875 			      size_t size, int flags)
1876 {
1877 	struct scm_cookie scm;
1878 	struct sock *sk = sock->sk;
1879 	struct unix_sock *u = unix_sk(sk);
1880 	int noblock = flags & MSG_DONTWAIT;
1881 	struct sk_buff *skb;
1882 	int err;
1883 	int peeked, skip;
1884 
1885 	err = -EOPNOTSUPP;
1886 	if (flags&MSG_OOB)
1887 		goto out;
1888 
1889 	err = mutex_lock_interruptible(&u->readlock);
1890 	if (unlikely(err)) {
1891 		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
1892 		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
1893 		 */
1894 		err = noblock ? -EAGAIN : -ERESTARTSYS;
1895 		goto out;
1896 	}
1897 
1898 	skip = sk_peek_offset(sk, flags);
1899 
1900 	skb = __skb_recv_datagram(sk, flags, &peeked, &skip, &err);
1901 	if (!skb) {
1902 		unix_state_lock(sk);
1903 		/* Signal EOF on disconnected non-blocking SEQPACKET socket. */
1904 		if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
1905 		    (sk->sk_shutdown & RCV_SHUTDOWN))
1906 			err = 0;
1907 		unix_state_unlock(sk);
1908 		goto out_unlock;
1909 	}
1910 
1911 	wake_up_interruptible_sync_poll(&u->peer_wait,
1912 					POLLOUT | POLLWRNORM | POLLWRBAND);
1913 
1914 	if (msg->msg_name)
1915 		unix_copy_addr(msg, skb->sk);
1916 
1917 	if (size > skb->len - skip)
1918 		size = skb->len - skip;
1919 	else if (size < skb->len - skip)
1920 		msg->msg_flags |= MSG_TRUNC;
1921 
1922 	err = skb_copy_datagram_msg(skb, skip, msg, size);
1923 	if (err)
1924 		goto out_free;
1925 
1926 	if (sock_flag(sk, SOCK_RCVTSTAMP))
1927 		__sock_recv_timestamp(msg, sk, skb);
1928 
1929 	memset(&scm, 0, sizeof(scm));
1930 
1931 	scm_set_cred(&scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
1932 	unix_set_secdata(&scm, skb);
1933 
1934 	if (!(flags & MSG_PEEK)) {
1935 		if (UNIXCB(skb).fp)
1936 			unix_detach_fds(&scm, skb);
1937 
1938 		sk_peek_offset_bwd(sk, skb->len);
1939 	} else {
1940 		/* It is questionable: on PEEK we could:
1941 		   - do not return fds - good, but too simple 8)
1942 		   - return fds, and do not return them on read (old strategy,
1943 		     apparently wrong)
1944 		   - clone fds (I chose it for now, it is the most universal
1945 		     solution)
1946 
1947 		   POSIX 1003.1g does not actually define this clearly
1948 		   at all. POSIX 1003.1g doesn't define a lot of things
1949 		   clearly however!
1950 
1951 		*/
1952 
1953 		sk_peek_offset_fwd(sk, size);
1954 
1955 		if (UNIXCB(skb).fp)
1956 			scm.fp = scm_fp_dup(UNIXCB(skb).fp);
1957 	}
1958 	err = (flags & MSG_TRUNC) ? skb->len - skip : size;
1959 
1960 	scm_recv(sock, msg, &scm, flags);
1961 
1962 out_free:
1963 	skb_free_datagram(sk, skb);
1964 out_unlock:
1965 	mutex_unlock(&u->readlock);
1966 out:
1967 	return err;
1968 }
1969 
1970 /*
1971  *	Sleep until more data has arrived. But check for races..
1972  */
1973 static long unix_stream_data_wait(struct sock *sk, long timeo,
1974 				  struct sk_buff *last, unsigned int last_len)
1975 {
1976 	struct sk_buff *tail;
1977 	DEFINE_WAIT(wait);
1978 
1979 	unix_state_lock(sk);
1980 
1981 	for (;;) {
1982 		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1983 
1984 		tail = skb_peek_tail(&sk->sk_receive_queue);
1985 		if (tail != last ||
1986 		    (tail && tail->len != last_len) ||
1987 		    sk->sk_err ||
1988 		    (sk->sk_shutdown & RCV_SHUTDOWN) ||
1989 		    signal_pending(current) ||
1990 		    !timeo)
1991 			break;
1992 
1993 		set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
1994 		unix_state_unlock(sk);
1995 		timeo = freezable_schedule_timeout(timeo);
1996 		unix_state_lock(sk);
1997 
1998 		if (sock_flag(sk, SOCK_DEAD))
1999 			break;
2000 
2001 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
2002 	}
2003 
2004 	finish_wait(sk_sleep(sk), &wait);
2005 	unix_state_unlock(sk);
2006 	return timeo;
2007 }
2008 
2009 static unsigned int unix_skb_len(const struct sk_buff *skb)
2010 {
2011 	return skb->len - UNIXCB(skb).consumed;
2012 }
2013 
2014 struct unix_stream_read_state {
2015 	int (*recv_actor)(struct sk_buff *, int, int,
2016 			  struct unix_stream_read_state *);
2017 	struct socket *socket;
2018 	struct msghdr *msg;
2019 	struct pipe_inode_info *pipe;
2020 	size_t size;
2021 	int flags;
2022 	unsigned int splice_flags;
2023 };
2024 
2025 static int unix_stream_read_generic(struct unix_stream_read_state *state)
2026 {
2027 	struct scm_cookie scm;
2028 	struct socket *sock = state->socket;
2029 	struct sock *sk = sock->sk;
2030 	struct unix_sock *u = unix_sk(sk);
2031 	int copied = 0;
2032 	int flags = state->flags;
2033 	int noblock = flags & MSG_DONTWAIT;
2034 	bool check_creds = false;
2035 	int target;
2036 	int err = 0;
2037 	long timeo;
2038 	int skip;
2039 	size_t size = state->size;
2040 	unsigned int last_len;
2041 
2042 	err = -EINVAL;
2043 	if (sk->sk_state != TCP_ESTABLISHED)
2044 		goto out;
2045 
2046 	err = -EOPNOTSUPP;
2047 	if (flags & MSG_OOB)
2048 		goto out;
2049 
2050 	target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
2051 	timeo = sock_rcvtimeo(sk, noblock);
2052 
2053 	memset(&scm, 0, sizeof(scm));
2054 
2055 	/* Lock the socket to prevent queue disordering
2056 	 * while sleeps in memcpy_tomsg
2057 	 */
2058 	err = mutex_lock_interruptible(&u->readlock);
2059 	if (unlikely(err)) {
2060 		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
2061 		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
2062 		 */
2063 		err = noblock ? -EAGAIN : -ERESTARTSYS;
2064 		goto out;
2065 	}
2066 
2067 	do {
2068 		int chunk;
2069 		struct sk_buff *skb, *last;
2070 
2071 		unix_state_lock(sk);
2072 		if (sock_flag(sk, SOCK_DEAD)) {
2073 			err = -ECONNRESET;
2074 			goto unlock;
2075 		}
2076 		last = skb = skb_peek(&sk->sk_receive_queue);
2077 		last_len = last ? last->len : 0;
2078 again:
2079 		if (skb == NULL) {
2080 			unix_sk(sk)->recursion_level = 0;
2081 			if (copied >= target)
2082 				goto unlock;
2083 
2084 			/*
2085 			 *	POSIX 1003.1g mandates this order.
2086 			 */
2087 
2088 			err = sock_error(sk);
2089 			if (err)
2090 				goto unlock;
2091 			if (sk->sk_shutdown & RCV_SHUTDOWN)
2092 				goto unlock;
2093 
2094 			unix_state_unlock(sk);
2095 			err = -EAGAIN;
2096 			if (!timeo)
2097 				break;
2098 			mutex_unlock(&u->readlock);
2099 
2100 			timeo = unix_stream_data_wait(sk, timeo, last,
2101 						      last_len);
2102 
2103 			if (signal_pending(current) ||
2104 			    mutex_lock_interruptible(&u->readlock)) {
2105 				err = sock_intr_errno(timeo);
2106 				goto out;
2107 			}
2108 
2109 			continue;
2110 unlock:
2111 			unix_state_unlock(sk);
2112 			break;
2113 		}
2114 
2115 		skip = sk_peek_offset(sk, flags);
2116 		while (skip >= unix_skb_len(skb)) {
2117 			skip -= unix_skb_len(skb);
2118 			last = skb;
2119 			last_len = skb->len;
2120 			skb = skb_peek_next(skb, &sk->sk_receive_queue);
2121 			if (!skb)
2122 				goto again;
2123 		}
2124 
2125 		unix_state_unlock(sk);
2126 
2127 		if (check_creds) {
2128 			/* Never glue messages from different writers */
2129 			if ((UNIXCB(skb).pid  != scm.pid) ||
2130 			    !uid_eq(UNIXCB(skb).uid, scm.creds.uid) ||
2131 			    !gid_eq(UNIXCB(skb).gid, scm.creds.gid) ||
2132 			    !unix_secdata_eq(&scm, skb))
2133 				break;
2134 		} else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
2135 			/* Copy credentials */
2136 			scm_set_cred(&scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
2137 			unix_set_secdata(&scm, skb);
2138 			check_creds = true;
2139 		}
2140 
2141 		/* Copy address just once */
2142 		if (state->msg && state->msg->msg_name) {
2143 			DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr,
2144 					 state->msg->msg_name);
2145 			unix_copy_addr(state->msg, skb->sk);
2146 			sunaddr = NULL;
2147 		}
2148 
2149 		chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
2150 		chunk = state->recv_actor(skb, skip, chunk, state);
2151 		if (chunk < 0) {
2152 			if (copied == 0)
2153 				copied = -EFAULT;
2154 			break;
2155 		}
2156 		copied += chunk;
2157 		size -= chunk;
2158 
2159 		/* Mark read part of skb as used */
2160 		if (!(flags & MSG_PEEK)) {
2161 			UNIXCB(skb).consumed += chunk;
2162 
2163 			sk_peek_offset_bwd(sk, chunk);
2164 
2165 			if (UNIXCB(skb).fp)
2166 				unix_detach_fds(&scm, skb);
2167 
2168 			if (unix_skb_len(skb))
2169 				break;
2170 
2171 			skb_unlink(skb, &sk->sk_receive_queue);
2172 			consume_skb(skb);
2173 
2174 			if (scm.fp)
2175 				break;
2176 		} else {
2177 			/* It is questionable, see note in unix_dgram_recvmsg.
2178 			 */
2179 			if (UNIXCB(skb).fp)
2180 				scm.fp = scm_fp_dup(UNIXCB(skb).fp);
2181 
2182 			if (skip) {
2183 				sk_peek_offset_fwd(sk, chunk);
2184 				skip -= chunk;
2185 			}
2186 
2187 			if (UNIXCB(skb).fp)
2188 				break;
2189 
2190 			last = skb;
2191 			last_len = skb->len;
2192 			unix_state_lock(sk);
2193 			skb = skb_peek_next(skb, &sk->sk_receive_queue);
2194 			if (skb)
2195 				goto again;
2196 			unix_state_unlock(sk);
2197 			break;
2198 		}
2199 	} while (size);
2200 
2201 	mutex_unlock(&u->readlock);
2202 	if (state->msg)
2203 		scm_recv(sock, state->msg, &scm, flags);
2204 	else
2205 		scm_destroy(&scm);
2206 out:
2207 	return copied ? : err;
2208 }
2209 
2210 static int unix_stream_read_actor(struct sk_buff *skb,
2211 				  int skip, int chunk,
2212 				  struct unix_stream_read_state *state)
2213 {
2214 	int ret;
2215 
2216 	ret = skb_copy_datagram_msg(skb, UNIXCB(skb).consumed + skip,
2217 				    state->msg, chunk);
2218 	return ret ?: chunk;
2219 }
2220 
2221 static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg,
2222 			       size_t size, int flags)
2223 {
2224 	struct unix_stream_read_state state = {
2225 		.recv_actor = unix_stream_read_actor,
2226 		.socket = sock,
2227 		.msg = msg,
2228 		.size = size,
2229 		.flags = flags
2230 	};
2231 
2232 	return unix_stream_read_generic(&state);
2233 }
2234 
2235 static ssize_t skb_unix_socket_splice(struct sock *sk,
2236 				      struct pipe_inode_info *pipe,
2237 				      struct splice_pipe_desc *spd)
2238 {
2239 	int ret;
2240 	struct unix_sock *u = unix_sk(sk);
2241 
2242 	mutex_unlock(&u->readlock);
2243 	ret = splice_to_pipe(pipe, spd);
2244 	mutex_lock(&u->readlock);
2245 
2246 	return ret;
2247 }
2248 
2249 static int unix_stream_splice_actor(struct sk_buff *skb,
2250 				    int skip, int chunk,
2251 				    struct unix_stream_read_state *state)
2252 {
2253 	return skb_splice_bits(skb, state->socket->sk,
2254 			       UNIXCB(skb).consumed + skip,
2255 			       state->pipe, chunk, state->splice_flags,
2256 			       skb_unix_socket_splice);
2257 }
2258 
2259 static ssize_t unix_stream_splice_read(struct socket *sock,  loff_t *ppos,
2260 				       struct pipe_inode_info *pipe,
2261 				       size_t size, unsigned int flags)
2262 {
2263 	struct unix_stream_read_state state = {
2264 		.recv_actor = unix_stream_splice_actor,
2265 		.socket = sock,
2266 		.pipe = pipe,
2267 		.size = size,
2268 		.splice_flags = flags,
2269 	};
2270 
2271 	if (unlikely(*ppos))
2272 		return -ESPIPE;
2273 
2274 	if (sock->file->f_flags & O_NONBLOCK ||
2275 	    flags & SPLICE_F_NONBLOCK)
2276 		state.flags = MSG_DONTWAIT;
2277 
2278 	return unix_stream_read_generic(&state);
2279 }
2280 
2281 static int unix_shutdown(struct socket *sock, int mode)
2282 {
2283 	struct sock *sk = sock->sk;
2284 	struct sock *other;
2285 
2286 	if (mode < SHUT_RD || mode > SHUT_RDWR)
2287 		return -EINVAL;
2288 	/* This maps:
2289 	 * SHUT_RD   (0) -> RCV_SHUTDOWN  (1)
2290 	 * SHUT_WR   (1) -> SEND_SHUTDOWN (2)
2291 	 * SHUT_RDWR (2) -> SHUTDOWN_MASK (3)
2292 	 */
2293 	++mode;
2294 
2295 	unix_state_lock(sk);
2296 	sk->sk_shutdown |= mode;
2297 	other = unix_peer(sk);
2298 	if (other)
2299 		sock_hold(other);
2300 	unix_state_unlock(sk);
2301 	sk->sk_state_change(sk);
2302 
2303 	if (other &&
2304 		(sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) {
2305 
2306 		int peer_mode = 0;
2307 
2308 		if (mode&RCV_SHUTDOWN)
2309 			peer_mode |= SEND_SHUTDOWN;
2310 		if (mode&SEND_SHUTDOWN)
2311 			peer_mode |= RCV_SHUTDOWN;
2312 		unix_state_lock(other);
2313 		other->sk_shutdown |= peer_mode;
2314 		unix_state_unlock(other);
2315 		other->sk_state_change(other);
2316 		if (peer_mode == SHUTDOWN_MASK)
2317 			sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP);
2318 		else if (peer_mode & RCV_SHUTDOWN)
2319 			sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN);
2320 	}
2321 	if (other)
2322 		sock_put(other);
2323 
2324 	return 0;
2325 }
2326 
2327 long unix_inq_len(struct sock *sk)
2328 {
2329 	struct sk_buff *skb;
2330 	long amount = 0;
2331 
2332 	if (sk->sk_state == TCP_LISTEN)
2333 		return -EINVAL;
2334 
2335 	spin_lock(&sk->sk_receive_queue.lock);
2336 	if (sk->sk_type == SOCK_STREAM ||
2337 	    sk->sk_type == SOCK_SEQPACKET) {
2338 		skb_queue_walk(&sk->sk_receive_queue, skb)
2339 			amount += unix_skb_len(skb);
2340 	} else {
2341 		skb = skb_peek(&sk->sk_receive_queue);
2342 		if (skb)
2343 			amount = skb->len;
2344 	}
2345 	spin_unlock(&sk->sk_receive_queue.lock);
2346 
2347 	return amount;
2348 }
2349 EXPORT_SYMBOL_GPL(unix_inq_len);
2350 
2351 long unix_outq_len(struct sock *sk)
2352 {
2353 	return sk_wmem_alloc_get(sk);
2354 }
2355 EXPORT_SYMBOL_GPL(unix_outq_len);
2356 
2357 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
2358 {
2359 	struct sock *sk = sock->sk;
2360 	long amount = 0;
2361 	int err;
2362 
2363 	switch (cmd) {
2364 	case SIOCOUTQ:
2365 		amount = unix_outq_len(sk);
2366 		err = put_user(amount, (int __user *)arg);
2367 		break;
2368 	case SIOCINQ:
2369 		amount = unix_inq_len(sk);
2370 		if (amount < 0)
2371 			err = amount;
2372 		else
2373 			err = put_user(amount, (int __user *)arg);
2374 		break;
2375 	default:
2376 		err = -ENOIOCTLCMD;
2377 		break;
2378 	}
2379 	return err;
2380 }
2381 
2382 static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table *wait)
2383 {
2384 	struct sock *sk = sock->sk;
2385 	unsigned int mask;
2386 
2387 	sock_poll_wait(file, sk_sleep(sk), wait);
2388 	mask = 0;
2389 
2390 	/* exceptional events? */
2391 	if (sk->sk_err)
2392 		mask |= POLLERR;
2393 	if (sk->sk_shutdown == SHUTDOWN_MASK)
2394 		mask |= POLLHUP;
2395 	if (sk->sk_shutdown & RCV_SHUTDOWN)
2396 		mask |= POLLRDHUP | POLLIN | POLLRDNORM;
2397 
2398 	/* readable? */
2399 	if (!skb_queue_empty(&sk->sk_receive_queue))
2400 		mask |= POLLIN | POLLRDNORM;
2401 
2402 	/* Connection-based need to check for termination and startup */
2403 	if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) &&
2404 	    sk->sk_state == TCP_CLOSE)
2405 		mask |= POLLHUP;
2406 
2407 	/*
2408 	 * we set writable also when the other side has shut down the
2409 	 * connection. This prevents stuck sockets.
2410 	 */
2411 	if (unix_writable(sk))
2412 		mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
2413 
2414 	return mask;
2415 }
2416 
2417 static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
2418 				    poll_table *wait)
2419 {
2420 	struct sock *sk = sock->sk, *other;
2421 	unsigned int mask, writable;
2422 
2423 	sock_poll_wait(file, sk_sleep(sk), wait);
2424 	mask = 0;
2425 
2426 	/* exceptional events? */
2427 	if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
2428 		mask |= POLLERR |
2429 			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
2430 
2431 	if (sk->sk_shutdown & RCV_SHUTDOWN)
2432 		mask |= POLLRDHUP | POLLIN | POLLRDNORM;
2433 	if (sk->sk_shutdown == SHUTDOWN_MASK)
2434 		mask |= POLLHUP;
2435 
2436 	/* readable? */
2437 	if (!skb_queue_empty(&sk->sk_receive_queue))
2438 		mask |= POLLIN | POLLRDNORM;
2439 
2440 	/* Connection-based need to check for termination and startup */
2441 	if (sk->sk_type == SOCK_SEQPACKET) {
2442 		if (sk->sk_state == TCP_CLOSE)
2443 			mask |= POLLHUP;
2444 		/* connection hasn't started yet? */
2445 		if (sk->sk_state == TCP_SYN_SENT)
2446 			return mask;
2447 	}
2448 
2449 	/* No write status requested, avoid expensive OUT tests. */
2450 	if (!(poll_requested_events(wait) & (POLLWRBAND|POLLWRNORM|POLLOUT)))
2451 		return mask;
2452 
2453 	writable = unix_writable(sk);
2454 	other = unix_peer_get(sk);
2455 	if (other) {
2456 		if (unix_peer(other) != sk) {
2457 			sock_poll_wait(file, &unix_sk(other)->peer_wait, wait);
2458 			if (unix_recvq_full(other))
2459 				writable = 0;
2460 		}
2461 		sock_put(other);
2462 	}
2463 
2464 	if (writable)
2465 		mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
2466 	else
2467 		set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
2468 
2469 	return mask;
2470 }
2471 
2472 #ifdef CONFIG_PROC_FS
2473 
2474 #define BUCKET_SPACE (BITS_PER_LONG - (UNIX_HASH_BITS + 1) - 1)
2475 
2476 #define get_bucket(x) ((x) >> BUCKET_SPACE)
2477 #define get_offset(x) ((x) & ((1L << BUCKET_SPACE) - 1))
2478 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
2479 
2480 static struct sock *unix_from_bucket(struct seq_file *seq, loff_t *pos)
2481 {
2482 	unsigned long offset = get_offset(*pos);
2483 	unsigned long bucket = get_bucket(*pos);
2484 	struct sock *sk;
2485 	unsigned long count = 0;
2486 
2487 	for (sk = sk_head(&unix_socket_table[bucket]); sk; sk = sk_next(sk)) {
2488 		if (sock_net(sk) != seq_file_net(seq))
2489 			continue;
2490 		if (++count == offset)
2491 			break;
2492 	}
2493 
2494 	return sk;
2495 }
2496 
2497 static struct sock *unix_next_socket(struct seq_file *seq,
2498 				     struct sock *sk,
2499 				     loff_t *pos)
2500 {
2501 	unsigned long bucket;
2502 
2503 	while (sk > (struct sock *)SEQ_START_TOKEN) {
2504 		sk = sk_next(sk);
2505 		if (!sk)
2506 			goto next_bucket;
2507 		if (sock_net(sk) == seq_file_net(seq))
2508 			return sk;
2509 	}
2510 
2511 	do {
2512 		sk = unix_from_bucket(seq, pos);
2513 		if (sk)
2514 			return sk;
2515 
2516 next_bucket:
2517 		bucket = get_bucket(*pos) + 1;
2518 		*pos = set_bucket_offset(bucket, 1);
2519 	} while (bucket < ARRAY_SIZE(unix_socket_table));
2520 
2521 	return NULL;
2522 }
2523 
2524 static void *unix_seq_start(struct seq_file *seq, loff_t *pos)
2525 	__acquires(unix_table_lock)
2526 {
2527 	spin_lock(&unix_table_lock);
2528 
2529 	if (!*pos)
2530 		return SEQ_START_TOKEN;
2531 
2532 	if (get_bucket(*pos) >= ARRAY_SIZE(unix_socket_table))
2533 		return NULL;
2534 
2535 	return unix_next_socket(seq, NULL, pos);
2536 }
2537 
2538 static void *unix_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2539 {
2540 	++*pos;
2541 	return unix_next_socket(seq, v, pos);
2542 }
2543 
2544 static void unix_seq_stop(struct seq_file *seq, void *v)
2545 	__releases(unix_table_lock)
2546 {
2547 	spin_unlock(&unix_table_lock);
2548 }
2549 
2550 static int unix_seq_show(struct seq_file *seq, void *v)
2551 {
2552 
2553 	if (v == SEQ_START_TOKEN)
2554 		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
2555 			 "Inode Path\n");
2556 	else {
2557 		struct sock *s = v;
2558 		struct unix_sock *u = unix_sk(s);
2559 		unix_state_lock(s);
2560 
2561 		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
2562 			s,
2563 			atomic_read(&s->sk_refcnt),
2564 			0,
2565 			s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
2566 			s->sk_type,
2567 			s->sk_socket ?
2568 			(s->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) :
2569 			(s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
2570 			sock_i_ino(s));
2571 
2572 		if (u->addr) {
2573 			int i, len;
2574 			seq_putc(seq, ' ');
2575 
2576 			i = 0;
2577 			len = u->addr->len - sizeof(short);
2578 			if (!UNIX_ABSTRACT(s))
2579 				len--;
2580 			else {
2581 				seq_putc(seq, '@');
2582 				i++;
2583 			}
2584 			for ( ; i < len; i++)
2585 				seq_putc(seq, u->addr->name->sun_path[i]);
2586 		}
2587 		unix_state_unlock(s);
2588 		seq_putc(seq, '\n');
2589 	}
2590 
2591 	return 0;
2592 }
2593 
2594 static const struct seq_operations unix_seq_ops = {
2595 	.start  = unix_seq_start,
2596 	.next   = unix_seq_next,
2597 	.stop   = unix_seq_stop,
2598 	.show   = unix_seq_show,
2599 };
2600 
2601 static int unix_seq_open(struct inode *inode, struct file *file)
2602 {
2603 	return seq_open_net(inode, file, &unix_seq_ops,
2604 			    sizeof(struct seq_net_private));
2605 }
2606 
2607 static const struct file_operations unix_seq_fops = {
2608 	.owner		= THIS_MODULE,
2609 	.open		= unix_seq_open,
2610 	.read		= seq_read,
2611 	.llseek		= seq_lseek,
2612 	.release	= seq_release_net,
2613 };
2614 
2615 #endif
2616 
2617 static const struct net_proto_family unix_family_ops = {
2618 	.family = PF_UNIX,
2619 	.create = unix_create,
2620 	.owner	= THIS_MODULE,
2621 };
2622 
2623 
2624 static int __net_init unix_net_init(struct net *net)
2625 {
2626 	int error = -ENOMEM;
2627 
2628 	net->unx.sysctl_max_dgram_qlen = 10;
2629 	if (unix_sysctl_register(net))
2630 		goto out;
2631 
2632 #ifdef CONFIG_PROC_FS
2633 	if (!proc_create("unix", 0, net->proc_net, &unix_seq_fops)) {
2634 		unix_sysctl_unregister(net);
2635 		goto out;
2636 	}
2637 #endif
2638 	error = 0;
2639 out:
2640 	return error;
2641 }
2642 
2643 static void __net_exit unix_net_exit(struct net *net)
2644 {
2645 	unix_sysctl_unregister(net);
2646 	remove_proc_entry("unix", net->proc_net);
2647 }
2648 
2649 static struct pernet_operations unix_net_ops = {
2650 	.init = unix_net_init,
2651 	.exit = unix_net_exit,
2652 };
2653 
2654 static int __init af_unix_init(void)
2655 {
2656 	int rc = -1;
2657 
2658 	BUILD_BUG_ON(sizeof(struct unix_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
2659 
2660 	rc = proto_register(&unix_proto, 1);
2661 	if (rc != 0) {
2662 		pr_crit("%s: Cannot create unix_sock SLAB cache!\n", __func__);
2663 		goto out;
2664 	}
2665 
2666 	sock_register(&unix_family_ops);
2667 	register_pernet_subsys(&unix_net_ops);
2668 out:
2669 	return rc;
2670 }
2671 
2672 static void __exit af_unix_exit(void)
2673 {
2674 	sock_unregister(PF_UNIX);
2675 	proto_unregister(&unix_proto);
2676 	unregister_pernet_subsys(&unix_net_ops);
2677 }
2678 
2679 /* Earlier than device_initcall() so that other drivers invoking
2680    request_module() don't end up in a loop when modprobe tries
2681    to use a UNIX socket. But later than subsys_initcall() because
2682    we depend on stuff initialised there */
2683 fs_initcall(af_unix_init);
2684 module_exit(af_unix_exit);
2685 
2686 MODULE_LICENSE("GPL");
2687 MODULE_ALIAS_NETPROTO(PF_UNIX);
2688