Merge tag 'v3.10.80' into update
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / unix / af_unix.c
1 /*
2 * NET4: Implementation of BSD Unix domain sockets.
3 *
4 * Authors: Alan Cox, <alan@lxorguk.ukuu.org.uk>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 * Fixes:
12 * Linus Torvalds : Assorted bug cures.
13 * Niibe Yutaka : async I/O support.
14 * Carsten Paeth : PF_UNIX check, address fixes.
15 * Alan Cox : Limit size of allocated blocks.
16 * Alan Cox : Fixed the stupid socketpair bug.
17 * Alan Cox : BSD compatibility fine tuning.
18 * Alan Cox : Fixed a bug in connect when interrupted.
19 * Alan Cox : Sorted out a proper draft version of
20 * file descriptor passing hacked up from
21 * Mike Shaver's work.
22 * Marty Leisner : Fixes to fd passing
23 * Nick Nevin : recvmsg bugfix.
24 * Alan Cox : Started proper garbage collector
25 * Heiko EiBfeldt : Missing verify_area check
26 * Alan Cox : Started POSIXisms
27 * Andreas Schwab : Replace inode by dentry for proper
28 * reference counting
29 * Kirk Petersen : Made this a module
30 * Christoph Rohland : Elegant non-blocking accept/connect algorithm.
31 * Lots of bug fixes.
32 * Alexey Kuznetosv : Repaired (I hope) bugs introduces
33 * by above two patches.
34 * Andrea Arcangeli : If possible we block in connect(2)
35 * if the max backlog of the listen socket
36 * is been reached. This won't break
37 * old apps and it will avoid huge amount
38 * of socks hashed (this for unix_gc()
39 * performances reasons).
40 * Security fix that limits the max
41 * number of socks to 2*max_files and
42 * the number of skb queueable in the
43 * dgram receiver.
44 * Artur Skawina : Hash function optimizations
45 * Alexey Kuznetsov : Full scale SMP. Lot of bugs are introduced 8)
46 * Malcolm Beattie : Set peercred for socketpair
47 * Michal Ostrowski : Module initialization cleanup.
48 * Arnaldo C. Melo : Remove MOD_{INC,DEC}_USE_COUNT,
49 * the core infrastructure is doing that
50 * for all net proto families now (2.5.69+)
51 *
52 *
53 * Known differences from reference BSD that was tested:
54 *
55 * [TO FIX]
56 * ECONNREFUSED is not returned from one end of a connected() socket to the
57 * other the moment one end closes.
58 * fstat() doesn't return st_dev=0, and give the blksize as high water mark
59 * and a fake inode identifier (nor the BSD first socket fstat twice bug).
60 * [NOT TO FIX]
61 * accept() returns a path name even if the connecting socket has closed
62 * in the meantime (BSD loses the path and gives up).
63 * accept() returns 0 length path for an unbound connector. BSD returns 16
64 * and a null first byte in the path (but not for gethost/peername - BSD bug ??)
65 * socketpair(...SOCK_RAW..) doesn't panic the kernel.
66 * BSD af_unix apparently has connect forgetting to block properly.
67 * (need to check this with the POSIX spec in detail)
68 *
69 * Differences from 2.0.0-11-... (ANK)
70 * Bug fixes and improvements.
71 * - client shutdown killed server socket.
72 * - removed all useless cli/sti pairs.
73 *
74 * Semantic changes/extensions.
75 * - generic control message passing.
76 * - SCM_CREDENTIALS control message.
77 * - "Abstract" (not FS based) socket bindings.
78 * Abstract names are sequences of bytes (not zero terminated)
79 * started by 0, so that this name space does not intersect
80 * with BSD names.
81 */
82
83 #include <linux/module.h>
84 #include <linux/kernel.h>
85 #include <linux/signal.h>
86 #include <linux/sched.h>
87 #include <linux/errno.h>
88 #include <linux/string.h>
89 #include <linux/stat.h>
90 #include <linux/dcache.h>
91 #include <linux/namei.h>
92 #include <linux/socket.h>
93 #include <linux/un.h>
94 #include <linux/fcntl.h>
95 #include <linux/termios.h>
96 #include <linux/sockios.h>
97 #include <linux/net.h>
98 #include <linux/in.h>
99 #include <linux/fs.h>
100 #include <linux/slab.h>
101 #include <asm/uaccess.h>
102 #include <linux/skbuff.h>
103 #include <linux/netdevice.h>
104 #include <net/net_namespace.h>
105 #include <net/sock.h>
106 #include <net/tcp_states.h>
107 #include <net/af_unix.h>
108 #include <linux/proc_fs.h>
109 #include <linux/seq_file.h>
110 #include <net/scm.h>
111 #include <linux/init.h>
112 #include <linux/poll.h>
113 #include <linux/rtnetlink.h>
114 #include <linux/mount.h>
115 #include <net/checksum.h>
116 #include <linux/security.h>
117 #include <linux/freezer.h>
118
119
120 #include <linux/uio.h>
121 #include <linux/blkdev.h>
122 #include <linux/compat.h>
123 #include <linux/rtc.h>
124 #include <asm/kmap_types.h>
125 #include <linux/device.h>
126
127
128 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
129 EXPORT_SYMBOL_GPL(unix_socket_table);
130 DEFINE_SPINLOCK(unix_table_lock);
131 EXPORT_SYMBOL_GPL(unix_table_lock);
132 static atomic_long_t unix_nr_socks;
133
134
135 static struct hlist_head *unix_sockets_unbound(void *addr)
136 {
137 unsigned long hash = (unsigned long)addr;
138
139 hash ^= hash >> 16;
140 hash ^= hash >> 8;
141 hash %= UNIX_HASH_SIZE;
142 return &unix_socket_table[UNIX_HASH_SIZE + hash];
143 }
144
145 #define UNIX_ABSTRACT(sk) (unix_sk(sk)->addr->hash < UNIX_HASH_SIZE)
146
147
148 //for aee interface start
149 #define __UNIX_SOCKET_OUTPUT_BUF_SIZE__ 3500
150 static struct proc_dir_entry *gunix_socket_track_aee_entry = NULL;
151 #define UNIX_SOCK_TRACK_AEE_PROCNAME "driver/usktrk_aee"
152 #define UNIX_SOCK_TRACK_PROC_AEE_SIZE 3072
153
154 static volatile unsigned int unix_sock_track_stop_flag = 0;
155 #define unix_peer(sk) (unix_sk(sk)->peer)
156
157
158 #ifdef CONFIG_SECURITY_NETWORK
159 static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
160 {
161 memcpy(UNIXSID(skb), &scm->secid, sizeof(u32));
162 }
163
164 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
165 {
166 scm->secid = *UNIXSID(skb);
167 }
168 #else
169 static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
170 { }
171
172 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
173 { }
174 #endif /* CONFIG_SECURITY_NETWORK */
175
176 /*
177 * SMP locking strategy:
178 * hash table is protected with spinlock unix_table_lock
179 * each socket state is protected by separate spin lock.
180 */
181
182 static inline unsigned int unix_hash_fold(__wsum n)
183 {
184 unsigned int hash = (__force unsigned int)csum_fold(n);
185
186 hash ^= hash>>8;
187 return hash&(UNIX_HASH_SIZE-1);
188 }
189
190
191
192 static inline int unix_our_peer(struct sock *sk, struct sock *osk)
193 {
194 return unix_peer(osk) == sk;
195 }
196
197 static inline int unix_may_send(struct sock *sk, struct sock *osk)
198 {
199 return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
200 }
201
202 static inline int unix_recvq_full(struct sock const *sk)
203 {
204 return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
205 }
206
207 struct sock *unix_peer_get(struct sock *s)
208 {
209 struct sock *peer;
210
211 unix_state_lock(s);
212 peer = unix_peer(s);
213 if (peer)
214 sock_hold(peer);
215 unix_state_unlock(s);
216 return peer;
217 }
218 EXPORT_SYMBOL_GPL(unix_peer_get);
219
220 static inline void unix_release_addr(struct unix_address *addr)
221 {
222 if (atomic_dec_and_test(&addr->refcnt))
223 kfree(addr);
224 }
225
226 /*
227 * Check unix socket name:
228 * - should be not zero length.
229 * - if started by not zero, should be NULL terminated (FS object)
230 * - if started by zero, it is abstract name.
231 */
232
233 static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
234 {
235 if (len <= sizeof(short) || len > sizeof(*sunaddr))
236 return -EINVAL;
237 if (!sunaddr || sunaddr->sun_family != AF_UNIX)
238 return -EINVAL;
239 if (sunaddr->sun_path[0]) {
240 /*
241 * This may look like an off by one error but it is a bit more
242 * subtle. 108 is the longest valid AF_UNIX path for a binding.
243 * sun_path[108] doesn't as such exist. However in kernel space
244 * we are guaranteed that it is a valid memory location in our
245 * kernel address buffer.
246 */
247 ((char *)sunaddr)[len] = 0;
248 len = strlen(sunaddr->sun_path)+1+sizeof(short);
249 return len;
250 }
251
252 *hashp = unix_hash_fold(csum_partial(sunaddr, len, 0));
253 return len;
254 }
255
256 static void __unix_remove_socket(struct sock *sk)
257 {
258 sk_del_node_init(sk);
259 }
260
261 static void __unix_insert_socket(struct hlist_head *list, struct sock *sk)
262 {
263 WARN_ON(!sk_unhashed(sk));
264 sk_add_node(sk, list);
265 }
266
267 static inline void unix_remove_socket(struct sock *sk)
268 {
269 spin_lock(&unix_table_lock);
270 __unix_remove_socket(sk);
271 spin_unlock(&unix_table_lock);
272 }
273
274 static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk)
275 {
276 spin_lock(&unix_table_lock);
277 __unix_insert_socket(list, sk);
278 spin_unlock(&unix_table_lock);
279 }
280
281 static struct sock *__unix_find_socket_byname(struct net *net,
282 struct sockaddr_un *sunname,
283 int len, int type, unsigned int hash)
284 {
285 struct sock *s;
286
287 sk_for_each(s, &unix_socket_table[hash ^ type]) {
288 struct unix_sock *u = unix_sk(s);
289
290 if (!net_eq(sock_net(s), net))
291 continue;
292
293 if (u->addr->len == len &&
294 !memcmp(u->addr->name, sunname, len))
295 goto found;
296 }
297 s = NULL;
298 found:
299 return s;
300 }
301
302 static inline struct sock *unix_find_socket_byname(struct net *net,
303 struct sockaddr_un *sunname,
304 int len, int type,
305 unsigned int hash)
306 {
307 struct sock *s;
308
309 spin_lock(&unix_table_lock);
310 s = __unix_find_socket_byname(net, sunname, len, type, hash);
311 if (s)
312 sock_hold(s);
313 spin_unlock(&unix_table_lock);
314 return s;
315 }
316
317 static struct sock *unix_find_socket_byinode(struct inode *i)
318 {
319 struct sock *s;
320
321 spin_lock(&unix_table_lock);
322 sk_for_each(s,
323 &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
324 struct dentry *dentry = unix_sk(s)->path.dentry;
325
326 if (dentry && dentry->d_inode == i) {
327 sock_hold(s);
328 goto found;
329 }
330 }
331 s = NULL;
332 found:
333 spin_unlock(&unix_table_lock);
334 return s;
335 }
336
337 /* Support code for asymmetrically connected dgram sockets
338 *
339 * If a datagram socket is connected to a socket not itself connected
340 * to the first socket (eg, /dev/log), clients may only enqueue more
341 * messages if the present receive queue of the server socket is not
342 * "too large". This means there's a second writeability condition
343 * poll and sendmsg need to test. The dgram recv code will do a wake
344 * up on the peer_wait wait queue of a socket upon reception of a
345 * datagram which needs to be propagated to sleeping would-be writers
346 * since these might not have sent anything so far. This can't be
347 * accomplished via poll_wait because the lifetime of the server
348 * socket might be less than that of its clients if these break their
349 * association with it or if the server socket is closed while clients
350 * are still connected to it and there's no way to inform "a polling
351 * implementation" that it should let go of a certain wait queue
352 *
353 * In order to propagate a wake up, a wait_queue_t of the client
354 * socket is enqueued on the peer_wait queue of the server socket
355 * whose wake function does a wake_up on the ordinary client socket
356 * wait queue. This connection is established whenever a write (or
357 * poll for write) hit the flow control condition and broken when the
358 * association to the server socket is dissolved or after a wake up
359 * was relayed.
360 */
361
362 static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags,
363 void *key)
364 {
365 struct unix_sock *u;
366 wait_queue_head_t *u_sleep;
367
368 u = container_of(q, struct unix_sock, peer_wake);
369
370 __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait,
371 q);
372 u->peer_wake.private = NULL;
373
374 /* relaying can only happen while the wq still exists */
375 u_sleep = sk_sleep(&u->sk);
376 if (u_sleep)
377 wake_up_interruptible_poll(u_sleep, key);
378
379 return 0;
380 }
381
382 static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other)
383 {
384 struct unix_sock *u, *u_other;
385 int rc;
386
387 u = unix_sk(sk);
388 u_other = unix_sk(other);
389 rc = 0;
390 spin_lock(&u_other->peer_wait.lock);
391
392 if (!u->peer_wake.private) {
393 u->peer_wake.private = other;
394 __add_wait_queue(&u_other->peer_wait, &u->peer_wake);
395
396 rc = 1;
397 }
398
399 spin_unlock(&u_other->peer_wait.lock);
400 return rc;
401 }
402
403 static void unix_dgram_peer_wake_disconnect(struct sock *sk,
404 struct sock *other)
405 {
406 struct unix_sock *u, *u_other;
407
408 u = unix_sk(sk);
409 u_other = unix_sk(other);
410 spin_lock(&u_other->peer_wait.lock);
411
412 if (u->peer_wake.private == other) {
413 __remove_wait_queue(&u_other->peer_wait, &u->peer_wake);
414 u->peer_wake.private = NULL;
415 }
416
417 spin_unlock(&u_other->peer_wait.lock);
418 }
419
420 static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk,
421 struct sock *other)
422 {
423 unix_dgram_peer_wake_disconnect(sk, other);
424 wake_up_interruptible_poll(sk_sleep(sk),
425 POLLOUT |
426 POLLWRNORM |
427 POLLWRBAND);
428 }
429
430 /* preconditions:
431 * - unix_peer(sk) == other
432 * - association is stable
433 */
434 static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
435 {
436 int connected;
437
438 connected = unix_dgram_peer_wake_connect(sk, other);
439
440 if (unix_recvq_full(other))
441 return 1;
442
443 if (connected)
444 unix_dgram_peer_wake_disconnect(sk, other);
445
446 return 0;
447 }
448
449 static inline int unix_writable(struct sock *sk)
450 {
451 return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
452 }
453
454 static void unix_write_space(struct sock *sk)
455 {
456 struct socket_wq *wq;
457
458 rcu_read_lock();
459 if (unix_writable(sk)) {
460 wq = rcu_dereference(sk->sk_wq);
461 if (wq_has_sleeper(wq))
462 wake_up_interruptible_sync_poll(&wq->wait,
463 POLLOUT | POLLWRNORM | POLLWRBAND);
464 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
465 }
466 rcu_read_unlock();
467 }
468
469 /* When dgram socket disconnects (or changes its peer), we clear its receive
470 * queue of packets arrived from previous peer. First, it allows to do
471 * flow control based only on wmem_alloc; second, sk connected to peer
472 * may receive messages only from that peer. */
473 static void unix_dgram_disconnected(struct sock *sk, struct sock *other)
474 {
475 if (!skb_queue_empty(&sk->sk_receive_queue)) {
476 skb_queue_purge(&sk->sk_receive_queue);
477 wake_up_interruptible_all(&unix_sk(sk)->peer_wait);
478
479 /* If one link of bidirectional dgram pipe is disconnected,
480 * we signal error. Messages are lost. Do not make this,
481 * when peer was not connected to us.
482 */
483 if (!sock_flag(other, SOCK_DEAD) && unix_peer(other) == sk) {
484 other->sk_err = ECONNRESET;
485 other->sk_error_report(other);
486 }
487 }
488 }
489
490 static void unix_sock_destructor(struct sock *sk)
491 {
492 struct unix_sock *u = unix_sk(sk);
493
494 skb_queue_purge(&sk->sk_receive_queue);
495
496 WARN_ON(atomic_read(&sk->sk_wmem_alloc));
497 WARN_ON(!sk_unhashed(sk));
498 WARN_ON(sk->sk_socket);
499 if (!sock_flag(sk, SOCK_DEAD)) {
500 #ifdef CONFIG_MTK_NET_LOGGING
501 printk(KERN_INFO "[mtk_net][unix]Attempt to release alive unix socket: %p\n", sk);
502 #endif
503 return;
504 }
505
506 if (u->addr)
507 unix_release_addr(u->addr);
508
509 atomic_long_dec(&unix_nr_socks);
510 local_bh_disable();
511 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
512 local_bh_enable();
513 #ifdef UNIX_REFCNT_DEBUG
514 printk(KERN_DEBUG "[mtk_net][unix]UNIX %p is destroyed, %ld are still alive.\n", sk,
515 atomic_long_read(&unix_nr_socks));
516 #endif
517 }
518
519 static void unix_release_sock(struct sock *sk, int embrion)
520 {
521 struct unix_sock *u = unix_sk(sk);
522 struct path path;
523 struct sock *skpair;
524 struct sk_buff *skb;
525 int state;
526
527 unix_remove_socket(sk);
528
529 /* Clear state */
530 unix_state_lock(sk);
531 sock_orphan(sk);
532 sk->sk_shutdown = SHUTDOWN_MASK;
533 path = u->path;
534 u->path.dentry = NULL;
535 u->path.mnt = NULL;
536 state = sk->sk_state;
537 sk->sk_state = TCP_CLOSE;
538 unix_state_unlock(sk);
539
540 wake_up_interruptible_all(&u->peer_wait);
541
542 skpair = unix_peer(sk);
543
544 if (skpair != NULL) {
545 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
546 unix_state_lock(skpair);
547 /* No more writes */
548 skpair->sk_shutdown = SHUTDOWN_MASK;
549 if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
550 skpair->sk_err = ECONNRESET;
551 unix_state_unlock(skpair);
552 skpair->sk_state_change(skpair);
553 sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
554 }
555
556 unix_dgram_peer_wake_disconnect(sk, skpair);
557 sock_put(skpair); /* It may now die */
558 unix_peer(sk) = NULL;
559 }
560
561 /* Try to flush out this socket. Throw out buffers at least */
562
563 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
564 if (state == TCP_LISTEN)
565 unix_release_sock(skb->sk, 1);
566 /* passed fds are erased in the kfree_skb hook */
567 kfree_skb(skb);
568 }
569
570 if (path.dentry)
571 path_put(&path);
572
573 sock_put(sk);
574
575 /* ---- Socket is dead now and most probably destroyed ---- */
576
577 /*
578 * Fixme: BSD difference: In BSD all sockets connected to us get
579 * ECONNRESET and we die on the spot. In Linux we behave
580 * like files and pipes do and wait for the last
581 * dereference.
582 *
583 * Can't we simply set sock->err?
584 *
585 * What the above comment does talk about? --ANK(980817)
586 */
587
588 if (unix_tot_inflight)
589 unix_gc(); /* Garbage collect fds */
590 }
591
592 static void init_peercred(struct sock *sk)
593 {
594 put_pid(sk->sk_peer_pid);
595 if (sk->sk_peer_cred)
596 put_cred(sk->sk_peer_cred);
597 sk->sk_peer_pid = get_pid(task_tgid(current));
598 sk->sk_peer_cred = get_current_cred();
599 }
600
601 static void copy_peercred(struct sock *sk, struct sock *peersk)
602 {
603 put_pid(sk->sk_peer_pid);
604 if (sk->sk_peer_cred)
605 put_cred(sk->sk_peer_cred);
606 sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);
607 sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
608 }
609
610 static int unix_listen(struct socket *sock, int backlog)
611 {
612 int err;
613 struct sock *sk = sock->sk;
614 struct unix_sock *u = unix_sk(sk);
615 struct pid *old_pid = NULL;
616
617 err = -EOPNOTSUPP;
618 if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
619 goto out; /* Only stream/seqpacket sockets accept */
620 err = -EINVAL;
621 if (!u->addr)
622 goto out; /* No listens on an unbound socket */
623 unix_state_lock(sk);
624 if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
625 goto out_unlock;
626 if (backlog > sk->sk_max_ack_backlog)
627 wake_up_interruptible_all(&u->peer_wait);
628 sk->sk_max_ack_backlog = backlog;
629 sk->sk_state = TCP_LISTEN;
630 /* set credentials so connect can copy them */
631 init_peercred(sk);
632 err = 0;
633
634 out_unlock:
635 unix_state_unlock(sk);
636 put_pid(old_pid);
637 out:
638
639 return err;
640 }
641
642 static int unix_release(struct socket *);
643 static int unix_bind(struct socket *, struct sockaddr *, int);
644 static int unix_stream_connect(struct socket *, struct sockaddr *,
645 int addr_len, int flags);
646 static int unix_socketpair(struct socket *, struct socket *);
647 static int unix_accept(struct socket *, struct socket *, int);
648 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
649 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
650 static unsigned int unix_dgram_poll(struct file *, struct socket *,
651 poll_table *);
652 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
653 static int unix_shutdown(struct socket *, int);
654 static int unix_stream_sendmsg(struct kiocb *, struct socket *,
655 struct msghdr *, size_t);
656 static int unix_stream_recvmsg(struct kiocb *, struct socket *,
657 struct msghdr *, size_t, int);
658 static int unix_dgram_sendmsg(struct kiocb *, struct socket *,
659 struct msghdr *, size_t);
660 static int unix_dgram_recvmsg(struct kiocb *, struct socket *,
661 struct msghdr *, size_t, int);
662 static int unix_dgram_connect(struct socket *, struct sockaddr *,
663 int, int);
664 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
665 struct msghdr *, size_t);
666 static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
667 struct msghdr *, size_t, int);
668
669 static int unix_set_peek_off(struct sock *sk, int val)
670 {
671 struct unix_sock *u = unix_sk(sk);
672
673 if (mutex_lock_interruptible(&u->readlock))
674 return -EINTR;
675
676 sk->sk_peek_off = val;
677 mutex_unlock(&u->readlock);
678
679 return 0;
680 }
681
682
683 static const struct proto_ops unix_stream_ops = {
684 .family = PF_UNIX,
685 .owner = THIS_MODULE,
686 .release = unix_release,
687 .bind = unix_bind,
688 .connect = unix_stream_connect,
689 .socketpair = unix_socketpair,
690 .accept = unix_accept,
691 .getname = unix_getname,
692 .poll = unix_poll,
693 .ioctl = unix_ioctl,
694 .listen = unix_listen,
695 .shutdown = unix_shutdown,
696 .setsockopt = sock_no_setsockopt,
697 .getsockopt = sock_no_getsockopt,
698 .sendmsg = unix_stream_sendmsg,
699 .recvmsg = unix_stream_recvmsg,
700 .mmap = sock_no_mmap,
701 .sendpage = sock_no_sendpage,
702 .set_peek_off = unix_set_peek_off,
703 };
704
705 static const struct proto_ops unix_dgram_ops = {
706 .family = PF_UNIX,
707 .owner = THIS_MODULE,
708 .release = unix_release,
709 .bind = unix_bind,
710 .connect = unix_dgram_connect,
711 .socketpair = unix_socketpair,
712 .accept = sock_no_accept,
713 .getname = unix_getname,
714 .poll = unix_dgram_poll,
715 .ioctl = unix_ioctl,
716 .listen = sock_no_listen,
717 .shutdown = unix_shutdown,
718 .setsockopt = sock_no_setsockopt,
719 .getsockopt = sock_no_getsockopt,
720 .sendmsg = unix_dgram_sendmsg,
721 .recvmsg = unix_dgram_recvmsg,
722 .mmap = sock_no_mmap,
723 .sendpage = sock_no_sendpage,
724 .set_peek_off = unix_set_peek_off,
725 };
726
727 static const struct proto_ops unix_seqpacket_ops = {
728 .family = PF_UNIX,
729 .owner = THIS_MODULE,
730 .release = unix_release,
731 .bind = unix_bind,
732 .connect = unix_stream_connect,
733 .socketpair = unix_socketpair,
734 .accept = unix_accept,
735 .getname = unix_getname,
736 .poll = unix_dgram_poll,
737 .ioctl = unix_ioctl,
738 .listen = unix_listen,
739 .shutdown = unix_shutdown,
740 .setsockopt = sock_no_setsockopt,
741 .getsockopt = sock_no_getsockopt,
742 .sendmsg = unix_seqpacket_sendmsg,
743 .recvmsg = unix_seqpacket_recvmsg,
744 .mmap = sock_no_mmap,
745 .sendpage = sock_no_sendpage,
746 .set_peek_off = unix_set_peek_off,
747 };
748
749 static struct proto unix_proto = {
750 .name = "UNIX",
751 .owner = THIS_MODULE,
752 .obj_size = sizeof(struct unix_sock),
753 };
754
755 /*
756 * AF_UNIX sockets do not interact with hardware, hence they
757 * dont trigger interrupts - so it's safe for them to have
758 * bh-unsafe locking for their sk_receive_queue.lock. Split off
759 * this special lock-class by reinitializing the spinlock key:
760 */
761 static struct lock_class_key af_unix_sk_receive_queue_lock_key;
762
763 static struct sock *unix_create1(struct net *net, struct socket *sock)
764 {
765 struct sock *sk = NULL;
766 struct unix_sock *u;
767
768 atomic_long_inc(&unix_nr_socks);
769 if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files())
770 goto out;
771
772 sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto);
773 if (!sk)
774 goto out;
775
776 sock_init_data(sock, sk);
777 lockdep_set_class(&sk->sk_receive_queue.lock,
778 &af_unix_sk_receive_queue_lock_key);
779
780 sk->sk_write_space = unix_write_space;
781 sk->sk_max_ack_backlog = net->unx.sysctl_max_dgram_qlen;
782 sk->sk_destruct = unix_sock_destructor;
783 u = unix_sk(sk);
784 u->path.dentry = NULL;
785 u->path.mnt = NULL;
786 spin_lock_init(&u->lock);
787 atomic_long_set(&u->inflight, 0);
788 INIT_LIST_HEAD(&u->link);
789 mutex_init(&u->readlock); /* single task reading lock */
790 init_waitqueue_head(&u->peer_wait);
791 init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
792 unix_insert_socket(unix_sockets_unbound(sk), sk);
793 out:
794 if (sk == NULL)
795 atomic_long_dec(&unix_nr_socks);
796 else {
797 local_bh_disable();
798 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
799 local_bh_enable();
800 }
801 return sk;
802 }
803
804 static int unix_create(struct net *net, struct socket *sock, int protocol,
805 int kern)
806 {
807 if (protocol && protocol != PF_UNIX)
808 return -EPROTONOSUPPORT;
809
810 sock->state = SS_UNCONNECTED;
811
812 switch (sock->type) {
813 case SOCK_STREAM:
814 sock->ops = &unix_stream_ops;
815 break;
816 /*
817 * Believe it or not BSD has AF_UNIX, SOCK_RAW though
818 * nothing uses it.
819 */
820 case SOCK_RAW:
821 sock->type = SOCK_DGRAM;
822 case SOCK_DGRAM:
823 sock->ops = &unix_dgram_ops;
824 break;
825 case SOCK_SEQPACKET:
826 sock->ops = &unix_seqpacket_ops;
827 break;
828 default:
829 return -ESOCKTNOSUPPORT;
830 }
831
832 return unix_create1(net, sock) ? 0 : -ENOMEM;
833 }
834
835 static int unix_release(struct socket *sock)
836 {
837 struct sock *sk = sock->sk;
838
839 if (!sk)
840 return 0;
841
842 unix_release_sock(sk, 0);
843 sock->sk = NULL;
844
845 return 0;
846 }
847
848 static int unix_autobind(struct socket *sock)
849 {
850 struct sock *sk = sock->sk;
851 struct net *net = sock_net(sk);
852 struct unix_sock *u = unix_sk(sk);
853 static u32 ordernum = 1;
854 struct unix_address *addr;
855 int err;
856 unsigned int retries = 0;
857
858 err = mutex_lock_interruptible(&u->readlock);
859 if (err)
860 return err;
861
862 err = 0;
863 if (u->addr)
864 goto out;
865
866 err = -ENOMEM;
867 addr = kzalloc(sizeof(*addr) + sizeof(short) + 16, GFP_KERNEL);
868 if (!addr)
869 goto out;
870
871 addr->name->sun_family = AF_UNIX;
872 atomic_set(&addr->refcnt, 1);
873
874 retry:
875 addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short);
876 addr->hash = unix_hash_fold(csum_partial(addr->name, addr->len, 0));
877
878 spin_lock(&unix_table_lock);
879 ordernum = (ordernum+1)&0xFFFFF;
880
881 if (__unix_find_socket_byname(net, addr->name, addr->len, sock->type,
882 addr->hash)) {
883 spin_unlock(&unix_table_lock);
884 /*
885 * __unix_find_socket_byname() may take long time if many names
886 * are already in use.
887 */
888 cond_resched();
889 /* Give up if all names seems to be in use. */
890 if (retries++ == 0xFFFFF) {
891 err = -ENOSPC;
892 kfree(addr);
893 goto out;
894 }
895 goto retry;
896 }
897 addr->hash ^= sk->sk_type;
898
899 __unix_remove_socket(sk);
900 u->addr = addr;
901 __unix_insert_socket(&unix_socket_table[addr->hash], sk);
902 spin_unlock(&unix_table_lock);
903 err = 0;
904
905 out: mutex_unlock(&u->readlock);
906 return err;
907 }
908
909 static struct sock *unix_find_other(struct net *net,
910 struct sockaddr_un *sunname, int len,
911 int type, unsigned int hash, int *error)
912 {
913 struct sock *u;
914 struct path path;
915 int err = 0;
916
917 if (sunname->sun_path[0]) {
918 struct inode *inode;
919 err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
920 if (err)
921 goto fail;
922 inode = path.dentry->d_inode;
923 err = inode_permission(inode, MAY_WRITE);
924 if (err)
925 goto put_fail;
926
927 err = -ECONNREFUSED;
928 if (!S_ISSOCK(inode->i_mode))
929 goto put_fail;
930 u = unix_find_socket_byinode(inode);
931 if (!u)
932 goto put_fail;
933
934 if (u->sk_type == type)
935 touch_atime(&path);
936
937 path_put(&path);
938
939 err = -EPROTOTYPE;
940 if (u->sk_type != type) {
941 sock_put(u);
942 goto fail;
943 }
944 } else {
945 err = -ECONNREFUSED;
946 u = unix_find_socket_byname(net, sunname, len, type, hash);
947 if (u) {
948 struct dentry *dentry;
949 dentry = unix_sk(u)->path.dentry;
950 if (dentry)
951 touch_atime(&unix_sk(u)->path);
952 } else
953 goto fail;
954 }
955 return u;
956
957 put_fail:
958 path_put(&path);
959 fail:
960 *error = err;
961 return NULL;
962 }
963
964 static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
965 {
966 struct dentry *dentry;
967 struct path path;
968 int err = 0;
969 /*
970 * Get the parent directory, calculate the hash for last
971 * component.
972 */
973 dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
974 err = PTR_ERR(dentry);
975 if (IS_ERR(dentry))
976 return err;
977
978 /*
979 * All right, let's create it.
980 */
981 err = security_path_mknod(&path, dentry, mode, 0);
982 if (!err) {
983 err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
984 if (!err) {
985 res->mnt = mntget(path.mnt);
986 res->dentry = dget(dentry);
987 }
988 }
989 done_path_create(&path, dentry);
990 return err;
991 }
992
993 static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
994 {
995 struct sock *sk = sock->sk;
996 struct net *net = sock_net(sk);
997 struct unix_sock *u = unix_sk(sk);
998 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
999 char *sun_path = sunaddr->sun_path;
1000 int err;
1001 unsigned int hash;
1002 struct unix_address *addr;
1003 struct hlist_head *list;
1004
1005 err = -EINVAL;
1006 if (sunaddr->sun_family != AF_UNIX)
1007 goto out;
1008
1009 if (addr_len == sizeof(short)) {
1010 err = unix_autobind(sock);
1011 goto out;
1012 }
1013
1014 err = unix_mkname(sunaddr, addr_len, &hash);
1015 if (err < 0)
1016 goto out;
1017 addr_len = err;
1018
1019 err = mutex_lock_interruptible(&u->readlock);
1020 if (err)
1021 goto out;
1022
1023 err = -EINVAL;
1024 if (u->addr)
1025 goto out_up;
1026
1027 err = -ENOMEM;
1028 addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
1029 if (!addr)
1030 goto out_up;
1031
1032 memcpy(addr->name, sunaddr, addr_len);
1033 addr->len = addr_len;
1034 addr->hash = hash ^ sk->sk_type;
1035 atomic_set(&addr->refcnt, 1);
1036
1037 if (sun_path[0]) {
1038 struct path path;
1039
1040 umode_t mode = S_IFSOCK |
1041 (SOCK_INODE(sock)->i_mode & ~current_umask());
1042 err = unix_mknod(sun_path, mode, &path);
1043 if (err) {
1044 if (err == -EEXIST)
1045 err = -EADDRINUSE;
1046 unix_release_addr(addr);
1047 goto out_up;
1048 }
1049 addr->hash = UNIX_HASH_SIZE;
1050 hash = path.dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1);
1051 spin_lock(&unix_table_lock);
1052 u->path = path;
1053 list = &unix_socket_table[hash];
1054 } else {
1055 spin_lock(&unix_table_lock);
1056 err = -EADDRINUSE;
1057 if (__unix_find_socket_byname(net, sunaddr, addr_len,
1058 sk->sk_type, hash)) {
1059 unix_release_addr(addr);
1060 goto out_unlock;
1061 }
1062
1063 list = &unix_socket_table[addr->hash];
1064 }
1065
1066 err = 0;
1067 __unix_remove_socket(sk);
1068 u->addr = addr;
1069 __unix_insert_socket(list, sk);
1070
1071 out_unlock:
1072 spin_unlock(&unix_table_lock);
1073 out_up:
1074 mutex_unlock(&u->readlock);
1075 out:
1076
1077 return err;
1078 }
1079
1080 static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
1081 {
1082 if (unlikely(sk1 == sk2) || !sk2) {
1083 unix_state_lock(sk1);
1084 return;
1085 }
1086 if (sk1 < sk2) {
1087 unix_state_lock(sk1);
1088 unix_state_lock_nested(sk2);
1089 } else {
1090 unix_state_lock(sk2);
1091 unix_state_lock_nested(sk1);
1092 }
1093 }
1094
1095 static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
1096 {
1097 if (unlikely(sk1 == sk2) || !sk2) {
1098 unix_state_unlock(sk1);
1099 return;
1100 }
1101 unix_state_unlock(sk1);
1102 unix_state_unlock(sk2);
1103 }
1104
1105 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
1106 int alen, int flags)
1107 {
1108 struct sock *sk = sock->sk;
1109 struct net *net = sock_net(sk);
1110 struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
1111 struct sock *other;
1112 unsigned int hash;
1113 int err;
1114
1115 if (addr->sa_family != AF_UNSPEC) {
1116
1117 err = unix_mkname(sunaddr, alen, &hash);
1118 if (err < 0)
1119 goto out;
1120 alen = err;
1121
1122 if (test_bit(SOCK_PASSCRED, &sock->flags) &&
1123 !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0)
1124 goto out;
1125
1126 restart:
1127 other = unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
1128 if (!other)
1129 goto out;
1130
1131 unix_state_double_lock(sk, other);
1132
1133 /* Apparently VFS overslept socket death. Retry. */
1134 if (sock_flag(other, SOCK_DEAD)) {
1135 unix_state_double_unlock(sk, other);
1136 sock_put(other);
1137 goto restart;
1138 }
1139
1140 err = -EPERM;
1141 if (!unix_may_send(sk, other))
1142 goto out_unlock;
1143
1144 err = security_unix_may_send(sk->sk_socket, other->sk_socket);
1145 if (err)
1146 goto out_unlock;
1147
1148 } else {
1149 /*
1150 * 1003.1g breaking connected state with AF_UNSPEC
1151 */
1152 other = NULL;
1153 unix_state_double_lock(sk, other);
1154 }
1155
1156 /*
1157 * If it was connected, reconnect.
1158 */
1159 if (unix_peer(sk)) {
1160 struct sock *old_peer = unix_peer(sk);
1161 unix_peer(sk) = other;
1162 unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
1163
1164 unix_state_double_unlock(sk, other);
1165
1166 if (other != old_peer)
1167 unix_dgram_disconnected(sk, old_peer);
1168 sock_put(old_peer);
1169 } else {
1170 unix_peer(sk) = other;
1171 unix_state_double_unlock(sk, other);
1172 }
1173
1174 #ifdef CONFIG_MTK_NET_LOGGING
1175 if((SOCK_INODE(sock)!= NULL) && (sunaddr != NULL) && (other->sk_socket != NULL) && (SOCK_INODE(other->sk_socket) != NULL))
1176 {
1177 printk(KERN_INFO "[mtk_net][socket]unix_dgram_connect[%lu]:connect [%s] other[%lu]\n",SOCK_INODE(sock)->i_ino,sunaddr->sun_path,SOCK_INODE(other->sk_socket)->i_ino);
1178 }
1179 #endif
1180
1181 return 0;
1182
1183 out_unlock:
1184 unix_state_double_unlock(sk, other);
1185 sock_put(other);
1186 out:
1187
1188 return err;
1189 }
1190
1191 static long unix_wait_for_peer(struct sock *other, long timeo)
1192 {
1193 struct unix_sock *u = unix_sk(other);
1194 int sched;
1195 DEFINE_WAIT(wait);
1196
1197 prepare_to_wait_exclusive(&u->peer_wait, &wait, TASK_INTERRUPTIBLE);
1198
1199 sched = !sock_flag(other, SOCK_DEAD) &&
1200 !(other->sk_shutdown & RCV_SHUTDOWN) &&
1201 unix_recvq_full(other);
1202
1203 unix_state_unlock(other);
1204
1205 if (sched)
1206 timeo = schedule_timeout(timeo);
1207
1208 finish_wait(&u->peer_wait, &wait);
1209 return timeo;
1210 }
1211
1212 static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
1213 int addr_len, int flags)
1214 {
1215 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
1216 struct sock *sk = sock->sk;
1217 struct net *net = sock_net(sk);
1218 struct unix_sock *u = unix_sk(sk), *newu, *otheru;
1219 struct sock *newsk = NULL;
1220 struct sock *other = NULL;
1221 struct sk_buff *skb = NULL;
1222 unsigned int hash;
1223 int st;
1224 int err;
1225 long timeo;
1226
1227 err = unix_mkname(sunaddr, addr_len, &hash);
1228 if (err < 0)
1229 goto out;
1230 addr_len = err;
1231
1232 if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr &&
1233 (err = unix_autobind(sock)) != 0)
1234 goto out;
1235
1236 timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
1237
1238 /* First of all allocate resources.
1239 If we will make it after state is locked,
1240 we will have to recheck all again in any case.
1241 */
1242
1243 err = -ENOMEM;
1244
1245 /* create new sock for complete connection */
1246 newsk = unix_create1(sock_net(sk), NULL);
1247 if (newsk == NULL)
1248 goto out;
1249
1250 /* Allocate skb for sending to listening sock */
1251 skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL);
1252 if (skb == NULL)
1253 goto out;
1254
1255 restart:
1256 /* Find listening sock. */
1257 other = unix_find_other(net, sunaddr, addr_len, sk->sk_type, hash, &err);
1258 if (!other)
1259 goto out;
1260
1261 /* Latch state of peer */
1262 unix_state_lock(other);
1263
1264 /* Apparently VFS overslept socket death. Retry. */
1265 if (sock_flag(other, SOCK_DEAD)) {
1266 unix_state_unlock(other);
1267 sock_put(other);
1268 goto restart;
1269 }
1270
1271 err = -ECONNREFUSED;
1272 if (other->sk_state != TCP_LISTEN)
1273 goto out_unlock;
1274 if (other->sk_shutdown & RCV_SHUTDOWN)
1275 goto out_unlock;
1276
1277 if (unix_recvq_full(other)) {
1278 err = -EAGAIN;
1279 if (!timeo)
1280 goto out_unlock;
1281
1282 timeo = unix_wait_for_peer(other, timeo);
1283
1284 err = sock_intr_errno(timeo);
1285 if (signal_pending(current))
1286 goto out;
1287 sock_put(other);
1288 goto restart;
1289 }
1290
1291 /* Latch our state.
1292
1293 It is tricky place. We need to grab our state lock and cannot
1294 drop lock on peer. It is dangerous because deadlock is
1295 possible. Connect to self case and simultaneous
1296 attempt to connect are eliminated by checking socket
1297 state. other is TCP_LISTEN, if sk is TCP_LISTEN we
1298 check this before attempt to grab lock.
1299
1300 Well, and we have to recheck the state after socket locked.
1301 */
1302 st = sk->sk_state;
1303
1304 switch (st) {
1305 case TCP_CLOSE:
1306 /* This is ok... continue with connect */
1307 break;
1308 case TCP_ESTABLISHED:
1309 /* Socket is already connected */
1310 err = -EISCONN;
1311 goto out_unlock;
1312 default:
1313 err = -EINVAL;
1314 goto out_unlock;
1315 }
1316
1317 unix_state_lock_nested(sk);
1318
1319 if (sk->sk_state != st) {
1320 unix_state_unlock(sk);
1321 unix_state_unlock(other);
1322 sock_put(other);
1323 goto restart;
1324 }
1325
1326 err = security_unix_stream_connect(sk, other, newsk);
1327 if (err) {
1328 unix_state_unlock(sk);
1329 goto out_unlock;
1330 }
1331
1332 /* The way is open! Fastly set all the necessary fields... */
1333
1334 sock_hold(sk);
1335 unix_peer(newsk) = sk;
1336 newsk->sk_state = TCP_ESTABLISHED;
1337 newsk->sk_type = sk->sk_type;
1338 init_peercred(newsk);
1339 newu = unix_sk(newsk);
1340 RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
1341 otheru = unix_sk(other);
1342
1343 /* copy address information from listening to new sock*/
1344 if (otheru->addr) {
1345 atomic_inc(&otheru->addr->refcnt);
1346 newu->addr = otheru->addr;
1347 }
1348 if (otheru->path.dentry) {
1349 path_get(&otheru->path);
1350 newu->path = otheru->path;
1351 }
1352
1353 /* Set credentials */
1354 copy_peercred(sk, other);
1355
1356 sock->state = SS_CONNECTED;
1357 sk->sk_state = TCP_ESTABLISHED;
1358 sock_hold(newsk);
1359
1360 smp_mb__after_atomic_inc(); /* sock_hold() does an atomic_inc() */
1361 unix_peer(sk) = newsk;
1362
1363 unix_state_unlock(sk);
1364
1365 /* take ten and and send info to listening sock */
1366 spin_lock(&other->sk_receive_queue.lock);
1367 __skb_queue_tail(&other->sk_receive_queue, skb);
1368 spin_unlock(&other->sk_receive_queue.lock);
1369 unix_state_unlock(other);
1370
1371 #ifdef CONFIG_MTK_NET_LOGGING
1372 if((SOCK_INODE(sock)!= NULL) && (sunaddr != NULL) && (other->sk_socket != NULL) && (SOCK_INODE(other->sk_socket) != NULL))
1373 {
1374 printk(KERN_INFO "[mtk_net][socket]unix_stream_connect[%lu ]: connect [%s] other[%lu] \n",SOCK_INODE(sock)->i_ino,sunaddr->sun_path,SOCK_INODE(other->sk_socket)->i_ino);
1375 }
1376 #endif
1377
1378 other->sk_data_ready(other, 0);
1379 sock_put(other);
1380
1381 return 0;
1382
1383 out_unlock:
1384 if (other)
1385 unix_state_unlock(other);
1386
1387 out:
1388 kfree_skb(skb);
1389 if (newsk)
1390 unix_release_sock(newsk, 0);
1391 if (other)
1392 sock_put(other);
1393
1394 return err;
1395 }
1396
1397 static int unix_socketpair(struct socket *socka, struct socket *sockb)
1398 {
1399 struct sock *ska = socka->sk, *skb = sockb->sk;
1400
1401 /* Join our sockets back to back */
1402 sock_hold(ska);
1403 sock_hold(skb);
1404 unix_peer(ska) = skb;
1405 unix_peer(skb) = ska;
1406 init_peercred(ska);
1407 init_peercred(skb);
1408
1409 if (ska->sk_type != SOCK_DGRAM) {
1410 ska->sk_state = TCP_ESTABLISHED;
1411 skb->sk_state = TCP_ESTABLISHED;
1412 socka->state = SS_CONNECTED;
1413 sockb->state = SS_CONNECTED;
1414 }
1415 return 0;
1416 }
1417
1418 static void unix_sock_inherit_flags(const struct socket *old,
1419 struct socket *new)
1420 {
1421 if (test_bit(SOCK_PASSCRED, &old->flags))
1422 set_bit(SOCK_PASSCRED, &new->flags);
1423 if (test_bit(SOCK_PASSSEC, &old->flags))
1424 set_bit(SOCK_PASSSEC, &new->flags);
1425 }
1426
1427 static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
1428 {
1429 struct sock *sk = sock->sk;
1430 struct sock *tsk;
1431 struct sk_buff *skb;
1432 int err;
1433
1434 err = -EOPNOTSUPP;
1435 if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
1436 goto out;
1437
1438 err = -EINVAL;
1439 if (sk->sk_state != TCP_LISTEN)
1440 goto out;
1441
1442 /* If socket state is TCP_LISTEN it cannot change (for now...),
1443 * so that no locks are necessary.
1444 */
1445
1446 skb = skb_recv_datagram(sk, 0, flags&O_NONBLOCK, &err);
1447 if (!skb) {
1448 /* This means receive shutdown. */
1449 if (err == 0)
1450 err = -EINVAL;
1451 goto out;
1452 }
1453
1454 tsk = skb->sk;
1455 skb_free_datagram(sk, skb);
1456 wake_up_interruptible(&unix_sk(sk)->peer_wait);
1457
1458 /* attach accepted sock to socket */
1459 unix_state_lock(tsk);
1460 newsock->state = SS_CONNECTED;
1461 unix_sock_inherit_flags(sock, newsock);
1462 sock_graft(tsk, newsock);
1463 unix_state_unlock(tsk);
1464
1465 return 0;
1466
1467 out:
1468
1469 return err;
1470 }
1471
1472
1473 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer)
1474 {
1475 struct sock *sk = sock->sk;
1476 struct unix_sock *u;
1477 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
1478 int err = 0;
1479
1480 if (peer) {
1481 sk = unix_peer_get(sk);
1482
1483 err = -ENOTCONN;
1484 if (!sk)
1485 goto out;
1486 err = 0;
1487 } else {
1488 sock_hold(sk);
1489 }
1490
1491 u = unix_sk(sk);
1492 unix_state_lock(sk);
1493 if (!u->addr) {
1494 sunaddr->sun_family = AF_UNIX;
1495 sunaddr->sun_path[0] = 0;
1496 *uaddr_len = sizeof(short);
1497 } else {
1498 struct unix_address *addr = u->addr;
1499
1500 *uaddr_len = addr->len;
1501 memcpy(sunaddr, addr->name, *uaddr_len);
1502 }
1503 unix_state_unlock(sk);
1504 sock_put(sk);
1505 out:
1506 return err;
1507 }
1508
1509 static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1510 {
1511 int i;
1512
1513 scm->fp = UNIXCB(skb).fp;
1514 UNIXCB(skb).fp = NULL;
1515
1516 for (i = scm->fp->count-1; i >= 0; i--)
1517 unix_notinflight(scm->fp->fp[i]);
1518 }
1519
1520 static void unix_destruct_scm(struct sk_buff *skb)
1521 {
1522 struct scm_cookie scm;
1523 memset(&scm, 0, sizeof(scm));
1524 scm.pid = UNIXCB(skb).pid;
1525 if (UNIXCB(skb).fp)
1526 unix_detach_fds(&scm, skb);
1527
1528 /* Alas, it calls VFS */
1529 /* So fscking what? fput() had been SMP-safe since the last Summer */
1530 scm_destroy(&scm);
1531 sock_wfree(skb);
1532 }
1533
1534 #define MAX_RECURSION_LEVEL 4
1535
1536 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1537 {
1538 int i;
1539 unsigned char max_level = 0;
1540 int unix_sock_count = 0;
1541
1542 for (i = scm->fp->count - 1; i >= 0; i--) {
1543 struct sock *sk = unix_get_socket(scm->fp->fp[i]);
1544
1545 if (sk) {
1546 unix_sock_count++;
1547 max_level = max(max_level,
1548 unix_sk(sk)->recursion_level);
1549 }
1550 }
1551 if (unlikely(max_level > MAX_RECURSION_LEVEL))
1552 return -ETOOMANYREFS;
1553
1554 /*
1555 * Need to duplicate file references for the sake of garbage
1556 * collection. Otherwise a socket in the fps might become a
1557 * candidate for GC while the skb is not yet queued.
1558 */
1559 UNIXCB(skb).fp = scm_fp_dup(scm->fp);
1560 if (!UNIXCB(skb).fp)
1561 return -ENOMEM;
1562
1563 if (unix_sock_count) {
1564 for (i = scm->fp->count - 1; i >= 0; i--)
1565 unix_inflight(scm->fp->fp[i]);
1566 }
1567 return max_level;
1568 }
1569
1570 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
1571 {
1572 int err = 0;
1573
1574 UNIXCB(skb).pid = get_pid(scm->pid);
1575 UNIXCB(skb).uid = scm->creds.uid;
1576 UNIXCB(skb).gid = scm->creds.gid;
1577 UNIXCB(skb).fp = NULL;
1578 if (scm->fp && send_fds)
1579 err = unix_attach_fds(scm, skb);
1580
1581 skb->destructor = unix_destruct_scm;
1582 return err;
1583 }
1584
1585 /*
1586 * Some apps rely on write() giving SCM_CREDENTIALS
1587 * We include credentials if source or destination socket
1588 * asserted SOCK_PASSCRED.
1589 */
1590 static void maybe_add_creds(struct sk_buff *skb, const struct socket *sock,
1591 const struct sock *other)
1592 {
1593 if (UNIXCB(skb).pid)
1594 return;
1595 if (test_bit(SOCK_PASSCRED, &sock->flags) ||
1596 !other->sk_socket ||
1597 test_bit(SOCK_PASSCRED, &other->sk_socket->flags)) {
1598 UNIXCB(skb).pid = get_pid(task_tgid(current));
1599 current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
1600 }
1601 }
1602
1603 /*
1604 * Send AF_UNIX data.
1605 */
1606
1607 static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
1608 struct msghdr *msg, size_t len)
1609 {
1610 struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
1611 struct sock *sk = sock->sk;
1612 struct net *net = sock_net(sk);
1613 struct unix_sock *u = unix_sk(sk);
1614 struct sockaddr_un *sunaddr = msg->msg_name;
1615 struct sock *other = NULL;
1616 int namelen = 0; /* fake GCC */
1617 int err;
1618 unsigned int hash;
1619 struct sk_buff *skb;
1620 long timeo;
1621 struct scm_cookie tmp_scm;
1622 int max_level;
1623 int data_len = 0;
1624 int sk_locked;
1625
1626 if (NULL == siocb->scm)
1627 siocb->scm = &tmp_scm;
1628 wait_for_unix_gc();
1629 err = scm_send(sock, msg, siocb->scm, false);
1630 if (err < 0)
1631 return err;
1632
1633 err = -EOPNOTSUPP;
1634 if (msg->msg_flags&MSG_OOB)
1635 goto out;
1636
1637 if (msg->msg_namelen) {
1638 err = unix_mkname(sunaddr, msg->msg_namelen, &hash);
1639 if (err < 0)
1640 goto out;
1641 namelen = err;
1642 } else {
1643 sunaddr = NULL;
1644 err = -ENOTCONN;
1645 other = unix_peer_get(sk);
1646 if (!other)
1647 goto out;
1648 }
1649
1650 if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr
1651 && (err = unix_autobind(sock)) != 0)
1652 goto out;
1653
1654 err = -EMSGSIZE;
1655 if (len > sk->sk_sndbuf - 32)
1656 goto out;
1657
1658 if (len > SKB_MAX_ALLOC)
1659 data_len = min_t(size_t,
1660 len - SKB_MAX_ALLOC,
1661 MAX_SKB_FRAGS * PAGE_SIZE);
1662
1663 skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
1664 msg->msg_flags & MSG_DONTWAIT, &err);
1665 if (skb == NULL)
1666 goto out;
1667
1668 err = unix_scm_to_skb(siocb->scm, skb, true);
1669 if (err < 0)
1670 goto out_free;
1671 max_level = err + 1;
1672 unix_get_secdata(siocb->scm, skb);
1673
1674 skb_put(skb, len - data_len);
1675 skb->data_len = data_len;
1676 skb->len = len;
1677 err = skb_copy_datagram_from_iovec(skb, 0, msg->msg_iov, 0, len);
1678 if (err)
1679 goto out_free;
1680
1681 timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1682
1683 restart:
1684 if (!other) {
1685 err = -ECONNRESET;
1686 if (sunaddr == NULL)
1687 goto out_free;
1688
1689 other = unix_find_other(net, sunaddr, namelen, sk->sk_type,
1690 hash, &err);
1691 if (other == NULL)
1692 goto out_free;
1693 }
1694
1695 if (sk_filter(other, skb) < 0) {
1696 /* Toss the packet but do not return any error to the sender */
1697 err = len;
1698 goto out_free;
1699 }
1700
1701 sk_locked = 0;
1702 unix_state_lock(other);
1703 restart_locked:
1704 err = -EPERM;
1705 if (!unix_may_send(sk, other))
1706 goto out_unlock;
1707
1708 if (unlikely(sock_flag(other, SOCK_DEAD))) {
1709 /*
1710 * Check with 1003.1g - what should
1711 * datagram error
1712 */
1713 unix_state_unlock(other);
1714 sock_put(other);
1715
1716 if (!sk_locked)
1717 unix_state_lock(sk);
1718 if (unix_peer(sk) == other) {
1719 unix_peer(sk) = NULL;
1720 unix_dgram_peer_wake_disconnect_wakeup(sk, other);
1721
1722 unix_state_unlock(sk);
1723
1724 unix_dgram_disconnected(sk, other);
1725 sock_put(other);
1726 err = -ECONNREFUSED;
1727 } else {
1728 unix_state_unlock(sk);
1729 }
1730
1731 other = NULL;
1732 if (err)
1733 goto out_free;
1734 goto restart;
1735 }
1736
1737 err = -EPIPE;
1738 if (other->sk_shutdown & RCV_SHUTDOWN)
1739 goto out_unlock;
1740
1741 if (sk->sk_type != SOCK_SEQPACKET) {
1742 err = security_unix_may_send(sk->sk_socket, other->sk_socket);
1743 if (err)
1744 goto out_unlock;
1745 }
1746
1747 /* other == sk && unix_peer(other) != sk if
1748 * - unix_peer(sk) == NULL, destination address bound to sk
1749 * - unix_peer(sk) == sk by time of get but disconnected before lock
1750 */
1751 if (other != sk &&
1752 unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
1753 if (timeo) {
1754 timeo = unix_wait_for_peer(other, timeo);
1755
1756 err = sock_intr_errno(timeo);
1757 if (signal_pending(current))
1758 goto out_free;
1759
1760 goto restart;
1761 }
1762
1763 if (!sk_locked) {
1764 unix_state_unlock(other);
1765 unix_state_double_lock(sk, other);
1766 }
1767
1768 if (unix_peer(sk) != other ||
1769 unix_dgram_peer_wake_me(sk, other)) {
1770 err = -EAGAIN;
1771 sk_locked = 1;
1772 goto out_unlock;
1773 }
1774
1775 if (!sk_locked) {
1776 sk_locked = 1;
1777 goto restart_locked;
1778 }
1779 }
1780
1781 if (unlikely(sk_locked))
1782 unix_state_unlock(sk);
1783
1784 if (sock_flag(other, SOCK_RCVTSTAMP))
1785 __net_timestamp(skb);
1786 maybe_add_creds(skb, sock, other);
1787 skb_queue_tail(&other->sk_receive_queue, skb);
1788 if (max_level > unix_sk(other)->recursion_level)
1789 unix_sk(other)->recursion_level = max_level;
1790 unix_state_unlock(other);
1791 other->sk_data_ready(other, len);
1792 sock_put(other);
1793 scm_destroy(siocb->scm);
1794
1795 return len;
1796
1797 out_unlock:
1798 if (sk_locked)
1799 unix_state_unlock(sk);
1800 unix_state_unlock(other);
1801 out_free:
1802 kfree_skb(skb);
1803 out:
1804 if (other)
1805 sock_put(other);
1806 scm_destroy(siocb->scm);
1807
1808 return err;
1809 }
1810
1811
1812 static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
1813 struct msghdr *msg, size_t len)
1814 {
1815 struct sock_iocb *siocb = kiocb_to_siocb(kiocb);
1816 struct sock *sk = sock->sk;
1817 struct sock *other = NULL;
1818 int err, size;
1819 struct sk_buff *skb;
1820 int sent = 0;
1821 struct scm_cookie tmp_scm;
1822 bool fds_sent = false;
1823 int max_level;
1824
1825 if (NULL == siocb->scm)
1826 siocb->scm = &tmp_scm;
1827
1828 wait_for_unix_gc();
1829 err = scm_send(sock, msg, siocb->scm, false);
1830 if (err < 0)
1831 return err;
1832
1833 err = -EOPNOTSUPP;
1834 if (msg->msg_flags&MSG_OOB)
1835 goto out_err;
1836
1837 if (msg->msg_namelen) {
1838 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
1839 goto out_err;
1840 } else {
1841 err = -ENOTCONN;
1842 other = unix_peer(sk);
1843 if (!other)
1844 goto out_err;
1845 }
1846
1847 if (sk->sk_shutdown & SEND_SHUTDOWN)
1848 goto pipe_err;
1849
1850 while (sent < len) {
1851 /*
1852 * Optimisation for the fact that under 0.01% of X
1853 * messages typically need breaking up.
1854 */
1855
1856 size = len-sent;
1857
1858 /* Keep two messages in the pipe so it schedules better */
1859 if (size > ((sk->sk_sndbuf >> 1) - 64))
1860 size = (sk->sk_sndbuf >> 1) - 64;
1861
1862 if (size > SKB_MAX_ALLOC)
1863 size = SKB_MAX_ALLOC;
1864
1865 /*
1866 * Grab a buffer
1867 */
1868
1869 skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT,
1870 &err);
1871
1872
1873 if (skb == NULL)
1874 goto out_err;
1875
1876 /*
1877 * If you pass two values to the sock_alloc_send_skb
1878 * it tries to grab the large buffer with GFP_NOFS
1879 * (which can fail easily), and if it fails grab the
1880 * fallback size buffer which is under a page and will
1881 * succeed. [Alan]
1882 */
1883 size = min_t(int, size, skb_tailroom(skb));
1884
1885
1886 /* Only send the fds in the first buffer */
1887 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
1888 if (err < 0) {
1889 kfree_skb(skb);
1890 goto out_err;
1891 }
1892 max_level = err + 1;
1893 fds_sent = true;
1894
1895 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
1896 if (err) {
1897 kfree_skb(skb);
1898 goto out_err;
1899 }
1900
1901 unix_state_lock(other);
1902
1903 if (sock_flag(other, SOCK_DEAD) ||
1904 (other->sk_shutdown & RCV_SHUTDOWN))
1905 {
1906 if( other->sk_socket )
1907 {
1908 if(sk->sk_socket)
1909 {
1910
1911 #ifdef CONFIG_MTK_NET_LOGGING
1912 printk(KERN_INFO " [mtk_net][unix]: sendmsg[%lu:%lu]:peer close\n" ,SOCK_INODE(sk->sk_socket)->i_ino,SOCK_INODE(other->sk_socket)->i_ino);
1913 #endif
1914 }
1915 else{
1916 #ifdef CONFIG_MTK_NET_LOGGING
1917 printk(KERN_INFO " [mtk_net][unix]: sendmsg[null:%lu]:peer close\n" ,SOCK_INODE(other->sk_socket)->i_ino);
1918 #endif
1919 }
1920
1921 }
1922 else
1923 {
1924 #ifdef CONFIG_MTK_NET_LOGGING
1925 printk(KERN_INFO " [mtk_net][unix]: sendmsg:peer close \n" );
1926 #endif
1927 }
1928
1929
1930 goto pipe_err_free;
1931 }
1932
1933 maybe_add_creds(skb, sock, other);
1934 skb_queue_tail(&other->sk_receive_queue, skb);
1935 if (max_level > unix_sk(other)->recursion_level)
1936 unix_sk(other)->recursion_level = max_level;
1937 unix_state_unlock(other);
1938 other->sk_data_ready(other, size);
1939 sent += size;
1940 }
1941
1942 scm_destroy(siocb->scm);
1943 siocb->scm = NULL;
1944
1945 return sent;
1946
1947 pipe_err_free:
1948 unix_state_unlock(other);
1949 kfree_skb(skb);
1950 pipe_err:
1951 if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
1952 send_sig(SIGPIPE, current, 0);
1953 err = -EPIPE;
1954 out_err:
1955 scm_destroy(siocb->scm);
1956 siocb->scm = NULL;
1957
1958 return sent ? : err;
1959 }
1960
1961 static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
1962 struct msghdr *msg, size_t len)
1963 {
1964 int err;
1965 struct sock *sk = sock->sk;
1966
1967 err = sock_error(sk);
1968 if (err)
1969 return err;
1970
1971 if (sk->sk_state != TCP_ESTABLISHED)
1972 return -ENOTCONN;
1973
1974 if (msg->msg_namelen)
1975 msg->msg_namelen = 0;
1976
1977 return unix_dgram_sendmsg(kiocb, sock, msg, len);
1978 }
1979
1980 static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
1981 struct msghdr *msg, size_t size,
1982 int flags)
1983 {
1984 struct sock *sk = sock->sk;
1985
1986 if (sk->sk_state != TCP_ESTABLISHED)
1987 return -ENOTCONN;
1988
1989 return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
1990 }
1991
1992 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
1993 {
1994 struct unix_sock *u = unix_sk(sk);
1995
1996 if (u->addr) {
1997 msg->msg_namelen = u->addr->len;
1998 memcpy(msg->msg_name, u->addr->name, u->addr->len);
1999 }
2000 }
2001
2002 static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
2003 struct msghdr *msg, size_t size,
2004 int flags)
2005 {
2006 struct sock_iocb *siocb = kiocb_to_siocb(iocb);
2007 struct scm_cookie tmp_scm;
2008 struct sock *sk = sock->sk;
2009 struct unix_sock *u = unix_sk(sk);
2010 int noblock = flags & MSG_DONTWAIT;
2011 struct sk_buff *skb;
2012 int err;
2013 int peeked, skip;
2014
2015 err = -EOPNOTSUPP;
2016 if (flags&MSG_OOB)
2017 goto out;
2018
2019 err = mutex_lock_interruptible(&u->readlock);
2020 if (unlikely(err)) {
2021 /* recvmsg() in non blocking mode is supposed to return -EAGAIN
2022 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
2023 */
2024 err = noblock ? -EAGAIN : -ERESTARTSYS;
2025 goto out;
2026 }
2027
2028 skip = sk_peek_offset(sk, flags);
2029
2030 skb = __skb_recv_datagram(sk, flags, &peeked, &skip, &err);
2031 if (!skb) {
2032 unix_state_lock(sk);
2033 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
2034 if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
2035 (sk->sk_shutdown & RCV_SHUTDOWN))
2036 err = 0;
2037 unix_state_unlock(sk);
2038 goto out_unlock;
2039 }
2040
2041 wake_up_interruptible_sync_poll(&u->peer_wait,
2042 POLLOUT | POLLWRNORM | POLLWRBAND);
2043
2044 if (msg->msg_name)
2045 unix_copy_addr(msg, skb->sk);
2046
2047 if (size > skb->len - skip)
2048 size = skb->len - skip;
2049 else if (size < skb->len - skip)
2050 msg->msg_flags |= MSG_TRUNC;
2051
2052 err = skb_copy_datagram_iovec(skb, skip, msg->msg_iov, size);
2053 if (err)
2054 goto out_free;
2055
2056 if (sock_flag(sk, SOCK_RCVTSTAMP))
2057 __sock_recv_timestamp(msg, sk, skb);
2058
2059 if (!siocb->scm) {
2060 siocb->scm = &tmp_scm;
2061 memset(&tmp_scm, 0, sizeof(tmp_scm));
2062 }
2063 scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
2064 unix_set_secdata(siocb->scm, skb);
2065
2066 if (!(flags & MSG_PEEK)) {
2067 if (UNIXCB(skb).fp)
2068 unix_detach_fds(siocb->scm, skb);
2069
2070 sk_peek_offset_bwd(sk, skb->len);
2071 } else {
2072 /* It is questionable: on PEEK we could:
2073 - do not return fds - good, but too simple 8)
2074 - return fds, and do not return them on read (old strategy,
2075 apparently wrong)
2076 - clone fds (I chose it for now, it is the most universal
2077 solution)
2078
2079 POSIX 1003.1g does not actually define this clearly
2080 at all. POSIX 1003.1g doesn't define a lot of things
2081 clearly however!
2082
2083 */
2084
2085 sk_peek_offset_fwd(sk, size);
2086
2087 if (UNIXCB(skb).fp)
2088 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
2089 }
2090 err = (flags & MSG_TRUNC) ? skb->len - skip : size;
2091
2092 scm_recv(sock, msg, siocb->scm, flags);
2093
2094 out_free:
2095 skb_free_datagram(sk, skb);
2096 out_unlock:
2097 mutex_unlock(&u->readlock);
2098 out:
2099
2100 return err;
2101 }
2102
2103 /*
2104 * Sleep until more data has arrived. But check for races..
2105 */
2106 static long unix_stream_data_wait(struct sock *sk, long timeo,
2107 struct sk_buff *last)
2108 {
2109 DEFINE_WAIT(wait);
2110
2111 unix_state_lock(sk);
2112
2113 for (;;) {
2114 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
2115
2116 if (skb_peek_tail(&sk->sk_receive_queue) != last ||
2117 sk->sk_err ||
2118 (sk->sk_shutdown & RCV_SHUTDOWN) ||
2119 signal_pending(current) ||
2120 !timeo)
2121 break;
2122
2123 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
2124 unix_state_unlock(sk);
2125 timeo = freezable_schedule_timeout(timeo);
2126 unix_state_lock(sk);
2127 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
2128 }
2129
2130 finish_wait(sk_sleep(sk), &wait);
2131 unix_state_unlock(sk);
2132 return timeo;
2133 }
2134
2135 static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
2136 struct msghdr *msg, size_t size,
2137 int flags)
2138 {
2139 struct sock_iocb *siocb = kiocb_to_siocb(iocb);
2140 struct scm_cookie tmp_scm;
2141 struct sock *sk = sock->sk;
2142 struct unix_sock *u = unix_sk(sk);
2143 struct sockaddr_un *sunaddr = msg->msg_name;
2144 int copied = 0;
2145 int noblock = flags & MSG_DONTWAIT;
2146 int check_creds = 0;
2147 int target;
2148 int err = 0;
2149 long timeo;
2150 int skip;
2151 struct sock * other = unix_peer(sk);
2152
2153 err = -EINVAL;
2154 if (sk->sk_state != TCP_ESTABLISHED)
2155 goto out;
2156
2157 err = -EOPNOTSUPP;
2158 if (flags&MSG_OOB)
2159 goto out;
2160
2161 target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
2162 timeo = sock_rcvtimeo(sk, noblock);
2163
2164 /* Lock the socket to prevent queue disordering
2165 * while sleeps in memcpy_tomsg
2166 */
2167
2168 if (!siocb->scm) {
2169 siocb->scm = &tmp_scm;
2170 memset(&tmp_scm, 0, sizeof(tmp_scm));
2171 }
2172
2173 err = mutex_lock_interruptible(&u->readlock);
2174 if (unlikely(err)) {
2175 /* recvmsg() in non blocking mode is supposed to return -EAGAIN
2176 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
2177 */
2178 err = noblock ? -EAGAIN : -ERESTARTSYS;
2179 goto out;
2180 }
2181
2182 do {
2183 int chunk;
2184 struct sk_buff *skb, *last;
2185
2186 unix_state_lock(sk);
2187 last = skb = skb_peek(&sk->sk_receive_queue);
2188 again:
2189 if (skb == NULL) {
2190 unix_sk(sk)->recursion_level = 0;
2191 if (copied >= target)
2192 goto unlock;
2193
2194 /*
2195 * POSIX 1003.1g mandates this order.
2196 */
2197
2198 err = sock_error(sk);
2199 if (err)
2200 goto unlock;
2201 if (sk->sk_shutdown & RCV_SHUTDOWN)
2202 {
2203 if(sk && sk->sk_socket )
2204 {
2205 if(other && other->sk_socket ){
2206 #ifdef CONFIG_MTK_NET_LOGGING
2207
2208 printk(KERN_INFO " [mtk_net][unix]: recvmsg[%lu:%lu]:exit read due to peer shutdown \n" ,SOCK_INODE(sk->sk_socket)->i_ino,SOCK_INODE(other->sk_socket)->i_ino);
2209 #endif
2210 }else{
2211 #ifdef CONFIG_MTK_NET_LOGGING
2212 printk(KERN_INFO "[mtk_net][unix]: recvmsg[%lu:null]:exit read due to peer shutdown \n" ,SOCK_INODE(sk->sk_socket)->i_ino);
2213 #endif
2214 }
2215 }
2216 else{
2217 #ifdef CONFIG_MTK_NET_LOGGING
2218 printk(KERN_INFO " [mtk_net][unix]: recvmsg: exit read due to peer shutdown \n" );
2219 #endif
2220 }
2221 goto unlock;
2222 }
2223 unix_state_unlock(sk);
2224 err = -EAGAIN;
2225 if (!timeo)
2226 break;
2227 mutex_unlock(&u->readlock);
2228
2229 timeo = unix_stream_data_wait(sk, timeo, last);
2230 if (!timeo)
2231 {
2232 if(sk && sk->sk_socket )
2233 {
2234 if(other && other->sk_socket ){
2235 #ifdef CONFIG_MTK_NET_LOGGING
2236 printk(KERN_INFO " [mtk_net][unix]: recvmsg[%lu:%lu]:exit read due to timeout \n" ,SOCK_INODE(sk->sk_socket)->i_ino,SOCK_INODE(other->sk_socket)->i_ino);
2237 #endif
2238 }else{
2239 #ifdef CONFIG_MTK_NET_LOGGING
2240 printk(KERN_INFO " [mtk_net][unix]: recvmsg[%lu:null]:exit read due to timeout \n" ,SOCK_INODE(sk->sk_socket)->i_ino);
2241 #endif
2242 }
2243 }
2244 else
2245 {
2246 #ifdef CONFIG_MTK_NET_LOGGING
2247 printk(KERN_INFO " [mtk_net][unix]: recvmsg:exit read due to timeout \n" );
2248 #endif
2249 }
2250
2251 }
2252
2253 if (signal_pending(current)
2254 || mutex_lock_interruptible(&u->readlock)) {
2255 err = sock_intr_errno(timeo);
2256 goto out;
2257 }
2258
2259 continue;
2260 unlock:
2261 unix_state_unlock(sk);
2262 break;
2263 }
2264
2265 skip = sk_peek_offset(sk, flags);
2266 while (skip >= skb->len) {
2267 skip -= skb->len;
2268 last = skb;
2269 skb = skb_peek_next(skb, &sk->sk_receive_queue);
2270 if (!skb)
2271 goto again;
2272 }
2273
2274 unix_state_unlock(sk);
2275
2276 if (check_creds) {
2277 /* Never glue messages from different writers */
2278 if ((UNIXCB(skb).pid != siocb->scm->pid) ||
2279 !uid_eq(UNIXCB(skb).uid, siocb->scm->creds.uid) ||
2280 !gid_eq(UNIXCB(skb).gid, siocb->scm->creds.gid))
2281 break;
2282 } else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
2283 /* Copy credentials */
2284 scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
2285 check_creds = 1;
2286 }
2287
2288 /* Copy address just once */
2289 if (sunaddr) {
2290 unix_copy_addr(msg, skb->sk);
2291 sunaddr = NULL;
2292 }
2293
2294 chunk = min_t(unsigned int, skb->len - skip, size);
2295 if (memcpy_toiovec(msg->msg_iov, skb->data + skip, chunk)) {
2296 if (copied == 0)
2297 copied = -EFAULT;
2298 break;
2299 }
2300 copied += chunk;
2301 size -= chunk;
2302
2303 /* Mark read part of skb as used */
2304 if (!(flags & MSG_PEEK)) {
2305 skb_pull(skb, chunk);
2306
2307 sk_peek_offset_bwd(sk, chunk);
2308
2309 if (UNIXCB(skb).fp)
2310 unix_detach_fds(siocb->scm, skb);
2311
2312 if (skb->len)
2313 break;
2314
2315 skb_unlink(skb, &sk->sk_receive_queue);
2316 consume_skb(skb);
2317
2318 if (siocb->scm->fp)
2319 break;
2320 } else {
2321 /* It is questionable, see note in unix_dgram_recvmsg.
2322 */
2323 if (UNIXCB(skb).fp)
2324 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
2325
2326 sk_peek_offset_fwd(sk, chunk);
2327
2328 break;
2329 }
2330 } while (size);
2331
2332 mutex_unlock(&u->readlock);
2333 scm_recv(sock, msg, siocb->scm, flags);
2334 out:
2335
2336 return copied ? : err;
2337 }
2338
2339 static int unix_shutdown(struct socket *sock, int mode)
2340 {
2341 struct sock *sk = sock->sk;
2342 struct sock *other;
2343
2344 if (mode < SHUT_RD || mode > SHUT_RDWR)
2345 return -EINVAL;
2346 /* This maps:
2347 * SHUT_RD (0) -> RCV_SHUTDOWN (1)
2348 * SHUT_WR (1) -> SEND_SHUTDOWN (2)
2349 * SHUT_RDWR (2) -> SHUTDOWN_MASK (3)
2350 */
2351 ++mode;
2352
2353 unix_state_lock(sk);
2354 sk->sk_shutdown |= mode;
2355 other = unix_peer(sk);
2356 if (other)
2357 sock_hold(other);
2358 unix_state_unlock(sk);
2359 sk->sk_state_change(sk);
2360
2361 if (other &&
2362 (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) {
2363
2364 int peer_mode = 0;
2365
2366 if (mode&RCV_SHUTDOWN)
2367 peer_mode |= SEND_SHUTDOWN;
2368 if (mode&SEND_SHUTDOWN)
2369 peer_mode |= RCV_SHUTDOWN;
2370 unix_state_lock(other);
2371 other->sk_shutdown |= peer_mode;
2372 unix_state_unlock(other);
2373 other->sk_state_change(other);
2374 if (peer_mode == SHUTDOWN_MASK)
2375 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP);
2376 else if (peer_mode & RCV_SHUTDOWN)
2377 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN);
2378 }
2379 if (other)
2380 sock_put(other);
2381
2382 return 0;
2383 }
2384
2385 long unix_inq_len(struct sock *sk)
2386 {
2387 struct sk_buff *skb;
2388 long amount = 0;
2389
2390 if (sk->sk_state == TCP_LISTEN)
2391 return -EINVAL;
2392
2393 spin_lock(&sk->sk_receive_queue.lock);
2394 if (sk->sk_type == SOCK_STREAM ||
2395 sk->sk_type == SOCK_SEQPACKET) {
2396 skb_queue_walk(&sk->sk_receive_queue, skb)
2397 amount += skb->len;
2398 } else {
2399 skb = skb_peek(&sk->sk_receive_queue);
2400 if (skb)
2401 amount = skb->len;
2402 }
2403 spin_unlock(&sk->sk_receive_queue.lock);
2404
2405 return amount;
2406 }
2407 EXPORT_SYMBOL_GPL(unix_inq_len);
2408
2409 long unix_outq_len(struct sock *sk)
2410 {
2411 return sk_wmem_alloc_get(sk);
2412 }
2413 EXPORT_SYMBOL_GPL(unix_outq_len);
2414
2415 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
2416 {
2417 struct sock *sk = sock->sk;
2418 long amount = 0;
2419 int err;
2420
2421 switch (cmd) {
2422 case SIOCOUTQ:
2423 amount = unix_outq_len(sk);
2424 err = put_user(amount, (int __user *)arg);
2425 break;
2426 case SIOCINQ:
2427 amount = unix_inq_len(sk);
2428 if (amount < 0)
2429 err = amount;
2430 else
2431 err = put_user(amount, (int __user *)arg);
2432 break;
2433 default:
2434 err = -ENOIOCTLCMD;
2435 break;
2436 }
2437 return err;
2438 }
2439
2440 static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table *wait)
2441 {
2442 struct sock *sk = sock->sk;
2443 unsigned int mask;
2444
2445 sock_poll_wait(file, sk_sleep(sk), wait);
2446 mask = 0;
2447
2448 /* exceptional events? */
2449 if (sk->sk_err)
2450 mask |= POLLERR;
2451 if (sk->sk_shutdown == SHUTDOWN_MASK)
2452 mask |= POLLHUP;
2453 if (sk->sk_shutdown & RCV_SHUTDOWN)
2454 mask |= POLLRDHUP | POLLIN | POLLRDNORM;
2455
2456 /* readable? */
2457 if (!skb_queue_empty(&sk->sk_receive_queue))
2458 mask |= POLLIN | POLLRDNORM;
2459
2460 /* Connection-based need to check for termination and startup */
2461 if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) &&
2462 sk->sk_state == TCP_CLOSE)
2463 mask |= POLLHUP;
2464
2465 /*
2466 * we set writable also when the other side has shut down the
2467 * connection. This prevents stuck sockets.
2468 */
2469 if (unix_writable(sk))
2470 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
2471
2472 return mask;
2473 }
2474
2475 static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
2476 poll_table *wait)
2477 {
2478 struct sock *sk = sock->sk, *other;
2479 unsigned int mask, writable;
2480
2481 sock_poll_wait(file, sk_sleep(sk), wait);
2482 mask = 0;
2483
2484 /* exceptional events? */
2485 if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
2486 mask |= POLLERR |
2487 (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
2488
2489 if (sk->sk_shutdown & RCV_SHUTDOWN)
2490 mask |= POLLRDHUP | POLLIN | POLLRDNORM;
2491 if (sk->sk_shutdown == SHUTDOWN_MASK)
2492 mask |= POLLHUP;
2493
2494 /* readable? */
2495 if (!skb_queue_empty(&sk->sk_receive_queue))
2496 mask |= POLLIN | POLLRDNORM;
2497
2498 /* Connection-based need to check for termination and startup */
2499 if (sk->sk_type == SOCK_SEQPACKET) {
2500 if (sk->sk_state == TCP_CLOSE)
2501 mask |= POLLHUP;
2502 /* connection hasn't started yet? */
2503 if (sk->sk_state == TCP_SYN_SENT)
2504 {
2505
2506 return mask;
2507 }
2508 }
2509
2510 /* No write status requested, avoid expensive OUT tests. */
2511 if (!(poll_requested_events(wait) & (POLLWRBAND|POLLWRNORM|POLLOUT)))
2512 {
2513 return mask;
2514 }
2515
2516 writable = unix_writable(sk);
2517 if (writable) {
2518 unix_state_lock(sk);
2519
2520 other = unix_peer(sk);
2521 if (other && unix_peer(other) != sk &&
2522 unix_recvq_full(other) &&
2523 unix_dgram_peer_wake_me(sk, other))
2524 writable = 0;
2525
2526 unix_state_unlock(sk);
2527 }
2528
2529 if (writable)
2530 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
2531 else
2532 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
2533
2534 return mask;
2535 }
2536
2537 #ifdef CONFIG_PROC_FS
2538
2539 #define BUCKET_SPACE (BITS_PER_LONG - (UNIX_HASH_BITS + 1) - 1)
2540
2541 #define get_bucket(x) ((x) >> BUCKET_SPACE)
2542 #define get_offset(x) ((x) & ((1L << BUCKET_SPACE) - 1))
2543 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
2544
2545 static struct sock *unix_from_bucket(struct seq_file *seq, loff_t *pos)
2546 {
2547 unsigned long offset = get_offset(*pos);
2548 unsigned long bucket = get_bucket(*pos);
2549 struct sock *sk;
2550 unsigned long count = 0;
2551
2552 for (sk = sk_head(&unix_socket_table[bucket]); sk; sk = sk_next(sk)) {
2553 if (sock_net(sk) != seq_file_net(seq))
2554 continue;
2555 if (++count == offset)
2556 break;
2557 }
2558
2559 return sk;
2560 }
2561
2562 static struct sock *unix_next_socket(struct seq_file *seq,
2563 struct sock *sk,
2564 loff_t *pos)
2565 {
2566 unsigned long bucket;
2567
2568 while (sk > (struct sock *)SEQ_START_TOKEN) {
2569 sk = sk_next(sk);
2570 if (!sk)
2571 goto next_bucket;
2572 if (sock_net(sk) == seq_file_net(seq))
2573 return sk;
2574 }
2575
2576 do {
2577 sk = unix_from_bucket(seq, pos);
2578 if (sk)
2579 return sk;
2580
2581 next_bucket:
2582 bucket = get_bucket(*pos) + 1;
2583 *pos = set_bucket_offset(bucket, 1);
2584 } while (bucket < ARRAY_SIZE(unix_socket_table));
2585
2586 return NULL;
2587 }
2588
2589 static void *unix_seq_start(struct seq_file *seq, loff_t *pos)
2590 __acquires(unix_table_lock)
2591 {
2592 spin_lock(&unix_table_lock);
2593
2594 if (!*pos)
2595 return SEQ_START_TOKEN;
2596
2597 if (get_bucket(*pos) >= ARRAY_SIZE(unix_socket_table))
2598 return NULL;
2599
2600 return unix_next_socket(seq, NULL, pos);
2601 }
2602
2603 static void *unix_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2604 {
2605 ++*pos;
2606 return unix_next_socket(seq, v, pos);
2607 }
2608
2609 static void unix_seq_stop(struct seq_file *seq, void *v)
2610 __releases(unix_table_lock)
2611 {
2612 spin_unlock(&unix_table_lock);
2613 }
2614
2615 static int unix_seq_show(struct seq_file *seq, void *v)
2616 {
2617
2618 if (v == SEQ_START_TOKEN)
2619 seq_puts(seq, "Num RefCount Protocol Flags Type St "
2620 "Inode Path\n");
2621 else {
2622 struct sock *s = v;
2623 struct unix_sock *u = unix_sk(s);
2624 unix_state_lock(s);
2625
2626 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
2627 s,
2628 atomic_read(&s->sk_refcnt),
2629 0,
2630 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
2631 s->sk_type,
2632 s->sk_socket ?
2633 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) :
2634 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
2635 sock_i_ino(s));
2636
2637 if (u->addr) {
2638 int i, len;
2639 seq_putc(seq, ' ');
2640
2641 i = 0;
2642 len = u->addr->len - sizeof(short);
2643 if (!UNIX_ABSTRACT(s))
2644 len--;
2645 else {
2646 seq_putc(seq, '@');
2647 i++;
2648 }
2649 for ( ; i < len; i++)
2650 seq_putc(seq, u->addr->name->sun_path[i]);
2651 }
2652 unix_state_unlock(s);
2653 seq_putc(seq, '\n');
2654 }
2655
2656 return 0;
2657 }
2658
2659 static const struct seq_operations unix_seq_ops = {
2660 .start = unix_seq_start,
2661 .next = unix_seq_next,
2662 .stop = unix_seq_stop,
2663 .show = unix_seq_show,
2664 };
2665
2666 static int unix_seq_open(struct inode *inode, struct file *file)
2667 {
2668 return seq_open_net(inode, file, &unix_seq_ops,
2669 sizeof(struct seq_net_private));
2670 }
2671
2672 static const struct file_operations unix_seq_fops = {
2673 .owner = THIS_MODULE,
2674 .open = unix_seq_open,
2675 .read = seq_read,
2676 .llseek = seq_lseek,
2677 .release = seq_release_net,
2678 };
2679
2680 #endif
2681
2682 static const struct net_proto_family unix_family_ops = {
2683 .family = PF_UNIX,
2684 .create = unix_create,
2685 .owner = THIS_MODULE,
2686 };
2687
2688
2689 static int __net_init unix_net_init(struct net *net)
2690 {
2691 int error = -ENOMEM;
2692
2693 net->unx.sysctl_max_dgram_qlen = 10;
2694 if (unix_sysctl_register(net))
2695 goto out;
2696
2697 #ifdef CONFIG_PROC_FS
2698 if (!proc_create("unix", 0, net->proc_net, &unix_seq_fops)) {
2699 unix_sysctl_unregister(net);
2700 goto out;
2701 }
2702 #endif
2703 error = 0;
2704 out:
2705 return error;
2706 }
2707
2708 static void __net_exit unix_net_exit(struct net *net)
2709 {
2710 unix_sysctl_unregister(net);
2711 remove_proc_entry("unix", net->proc_net);
2712 }
2713
2714 static struct pernet_operations unix_net_ops = {
2715 .init = unix_net_init,
2716 .exit = unix_net_exit,
2717 };
2718
2719 static int __init af_unix_init(void)
2720 {
2721 int rc = -1;
2722
2723 BUILD_BUG_ON(sizeof(struct unix_skb_parms) > FIELD_SIZEOF(struct sk_buff, cb));
2724
2725 rc = proto_register(&unix_proto, 1);
2726 if (rc != 0) {
2727 printk(KERN_CRIT "%s: Cannot create unix_sock SLAB cache!\n",
2728 __func__);
2729 goto out;
2730 }
2731
2732 sock_register(&unix_family_ops);
2733 register_pernet_subsys(&unix_net_ops);
2734 out:
2735 return rc;
2736 }
2737
2738 static void __exit af_unix_exit(void)
2739 {
2740 sock_unregister(PF_UNIX);
2741 proto_unregister(&unix_proto);
2742 unregister_pernet_subsys(&unix_net_ops);
2743 }
2744
2745 /* Earlier than device_initcall() so that other drivers invoking
2746 request_module() don't end up in a loop when modprobe tries
2747 to use a UNIX socket. But later than subsys_initcall() because
2748 we depend on stuff initialised there */
2749 fs_initcall(af_unix_init);
2750 module_exit(af_unix_exit);
2751
2752 MODULE_LICENSE("GPL");
2753 MODULE_ALIAS_NETPROTO(PF_UNIX);