1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * NET4: Implementation of BSD Unix domain sockets.
5 * Authors: Alan Cox, <alan@lxorguk.ukuu.org.uk>
8 * Linus Torvalds : Assorted bug cures.
9 * Niibe Yutaka : async I/O support.
10 * Carsten Paeth : PF_UNIX check, address fixes.
11 * Alan Cox : Limit size of allocated blocks.
12 * Alan Cox : Fixed the stupid socketpair bug.
13 * Alan Cox : BSD compatibility fine tuning.
14 * Alan Cox : Fixed a bug in connect when interrupted.
15 * Alan Cox : Sorted out a proper draft version of
16 * file descriptor passing hacked up from
18 * Marty Leisner : Fixes to fd passing
19 * Nick Nevin : recvmsg bugfix.
20 * Alan Cox : Started proper garbage collector
21 * Heiko EiBfeldt : Missing verify_area check
22 * Alan Cox : Started POSIXisms
23 * Andreas Schwab : Replace inode by dentry for proper
25 * Kirk Petersen : Made this a module
26 * Christoph Rohland : Elegant non-blocking accept/connect algorithm.
28 * Alexey Kuznetosv : Repaired (I hope) bugs introduces
29 * by above two patches.
30 * Andrea Arcangeli : If possible we block in connect(2)
31 * if the max backlog of the listen socket
32 * is been reached. This won't break
33 * old apps and it will avoid huge amount
34 * of socks hashed (this for unix_gc()
35 * performances reasons).
36 * Security fix that limits the max
37 * number of socks to 2*max_files and
38 * the number of skb queueable in the
40 * Artur Skawina : Hash function optimizations
41 * Alexey Kuznetsov : Full scale SMP. Lot of bugs are introduced 8)
42 * Malcolm Beattie : Set peercred for socketpair
43 * Michal Ostrowski : Module initialization cleanup.
44 * Arnaldo C. Melo : Remove MOD_{INC,DEC}_USE_COUNT,
45 * the core infrastructure is doing that
46 * for all net proto families now (2.5.69+)
48 * Known differences from reference BSD that was tested:
51 * ECONNREFUSED is not returned from one end of a connected() socket to the
52 * other the moment one end closes.
53 * fstat() doesn't return st_dev=0, and give the blksize as high water mark
54 * and a fake inode identifier (nor the BSD first socket fstat twice bug).
56 * accept() returns a path name even if the connecting socket has closed
57 * in the meantime (BSD loses the path and gives up).
58 * accept() returns 0 length path for an unbound connector. BSD returns 16
59 * and a null first byte in the path (but not for gethost/peername - BSD bug ??)
60 * socketpair(...SOCK_RAW..) doesn't panic the kernel.
61 * BSD af_unix apparently has connect forgetting to block properly.
62 * (need to check this with the POSIX spec in detail)
64 * Differences from 2.0.0-11-... (ANK)
65 * Bug fixes and improvements.
66 * - client shutdown killed server socket.
67 * - removed all useless cli/sti pairs.
69 * Semantic changes/extensions.
70 * - generic control message passing.
71 * - SCM_CREDENTIALS control message.
72 * - "Abstract" (not FS based) socket bindings.
73 * Abstract names are sequences of bytes (not zero terminated)
74 * started by 0, so that this name space does not intersect
78 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
80 #include <linux/module.h>
81 #include <linux/kernel.h>
82 #include <linux/signal.h>
83 #include <linux/sched/signal.h>
84 #include <linux/errno.h>
85 #include <linux/string.h>
86 #include <linux/stat.h>
87 #include <linux/dcache.h>
88 #include <linux/namei.h>
89 #include <linux/socket.h>
91 #include <linux/fcntl.h>
92 #include <linux/termios.h>
93 #include <linux/sockios.h>
94 #include <linux/net.h>
97 #include <linux/slab.h>
98 #include <linux/uaccess.h>
99 #include <linux/skbuff.h>
100 #include <linux/netdevice.h>
101 #include <net/net_namespace.h>
102 #include <net/sock.h>
103 #include <net/tcp_states.h>
104 #include <net/af_unix.h>
105 #include <linux/proc_fs.h>
106 #include <linux/seq_file.h>
108 #include <linux/init.h>
109 #include <linux/poll.h>
110 #include <linux/rtnetlink.h>
111 #include <linux/mount.h>
112 #include <net/checksum.h>
113 #include <linux/security.h>
114 #include <linux/freezer.h>
115 #include <linux/file.h>
116 #include <linux/btf_ids.h>
120 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
121 EXPORT_SYMBOL_GPL(unix_socket_table);
122 DEFINE_SPINLOCK(unix_table_lock);
123 EXPORT_SYMBOL_GPL(unix_table_lock);
124 static atomic_long_t unix_nr_socks;
127 static struct hlist_head *unix_sockets_unbound(void *addr)
129 unsigned long hash = (unsigned long)addr;
133 hash %= UNIX_HASH_SIZE;
134 return &unix_socket_table[UNIX_HASH_SIZE + hash];
137 #define UNIX_ABSTRACT(sk) (unix_sk(sk)->addr->hash < UNIX_HASH_SIZE)
139 #ifdef CONFIG_SECURITY_NETWORK
140 static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
142 UNIXCB(skb).secid = scm->secid;
145 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
147 scm->secid = UNIXCB(skb).secid;
150 static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb)
152 return (scm->secid == UNIXCB(skb).secid);
155 static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
158 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
161 static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb)
165 #endif /* CONFIG_SECURITY_NETWORK */
168 * SMP locking strategy:
169 * hash table is protected with spinlock unix_table_lock
170 * each socket state is protected by separate spin lock.
173 static inline unsigned int unix_hash_fold(__wsum n)
175 unsigned int hash = (__force unsigned int)csum_fold(n);
178 return hash&(UNIX_HASH_SIZE-1);
181 #define unix_peer(sk) (unix_sk(sk)->peer)
183 static inline int unix_our_peer(struct sock *sk, struct sock *osk)
185 return unix_peer(osk) == sk;
188 static inline int unix_may_send(struct sock *sk, struct sock *osk)
190 return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
193 static inline int unix_recvq_full(const struct sock *sk)
195 return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
198 static inline int unix_recvq_full_lockless(const struct sock *sk)
200 return skb_queue_len_lockless(&sk->sk_receive_queue) >
201 READ_ONCE(sk->sk_max_ack_backlog);
204 struct sock *unix_peer_get(struct sock *s)
212 unix_state_unlock(s);
215 EXPORT_SYMBOL_GPL(unix_peer_get);
217 static inline void unix_release_addr(struct unix_address *addr)
219 if (refcount_dec_and_test(&addr->refcnt))
224 * Check unix socket name:
225 * - should be not zero length.
226 * - if started by not zero, should be NULL terminated (FS object)
227 * - if started by zero, it is abstract name.
230 static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
234 if (len <= sizeof(short) || len > sizeof(*sunaddr))
236 if (!sunaddr || sunaddr->sun_family != AF_UNIX)
238 if (sunaddr->sun_path[0]) {
240 * This may look like an off by one error but it is a bit more
241 * subtle. 108 is the longest valid AF_UNIX path for a binding.
242 * sun_path[108] doesn't as such exist. However in kernel space
243 * we are guaranteed that it is a valid memory location in our
244 * kernel address buffer.
246 ((char *)sunaddr)[len] = 0;
247 len = strlen(sunaddr->sun_path)+1+sizeof(short);
251 *hashp = unix_hash_fold(csum_partial(sunaddr, len, 0));
255 static void __unix_remove_socket(struct sock *sk)
257 sk_del_node_init(sk);
260 static void __unix_insert_socket(struct hlist_head *list, struct sock *sk)
262 WARN_ON(!sk_unhashed(sk));
263 sk_add_node(sk, list);
266 static void __unix_set_addr(struct sock *sk, struct unix_address *addr,
269 __unix_remove_socket(sk);
270 smp_store_release(&unix_sk(sk)->addr, addr);
271 __unix_insert_socket(&unix_socket_table[hash], sk);
274 static inline void unix_remove_socket(struct sock *sk)
276 spin_lock(&unix_table_lock);
277 __unix_remove_socket(sk);
278 spin_unlock(&unix_table_lock);
281 static inline void unix_insert_socket(struct hlist_head *list, struct sock *sk)
283 spin_lock(&unix_table_lock);
284 __unix_insert_socket(list, sk);
285 spin_unlock(&unix_table_lock);
288 static struct sock *__unix_find_socket_byname(struct net *net,
289 struct sockaddr_un *sunname,
290 int len, unsigned int hash)
294 sk_for_each(s, &unix_socket_table[hash]) {
295 struct unix_sock *u = unix_sk(s);
297 if (!net_eq(sock_net(s), net))
300 if (u->addr->len == len &&
301 !memcmp(u->addr->name, sunname, len))
307 static inline struct sock *unix_find_socket_byname(struct net *net,
308 struct sockaddr_un *sunname,
309 int len, unsigned int hash)
313 spin_lock(&unix_table_lock);
314 s = __unix_find_socket_byname(net, sunname, len, hash);
317 spin_unlock(&unix_table_lock);
321 static struct sock *unix_find_socket_byinode(struct inode *i)
325 spin_lock(&unix_table_lock);
327 &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
328 struct dentry *dentry = unix_sk(s)->path.dentry;
330 if (dentry && d_backing_inode(dentry) == i) {
337 spin_unlock(&unix_table_lock);
341 /* Support code for asymmetrically connected dgram sockets
343 * If a datagram socket is connected to a socket not itself connected
344 * to the first socket (eg, /dev/log), clients may only enqueue more
345 * messages if the present receive queue of the server socket is not
346 * "too large". This means there's a second writeability condition
347 * poll and sendmsg need to test. The dgram recv code will do a wake
348 * up on the peer_wait wait queue of a socket upon reception of a
349 * datagram which needs to be propagated to sleeping would-be writers
350 * since these might not have sent anything so far. This can't be
351 * accomplished via poll_wait because the lifetime of the server
352 * socket might be less than that of its clients if these break their
353 * association with it or if the server socket is closed while clients
354 * are still connected to it and there's no way to inform "a polling
355 * implementation" that it should let go of a certain wait queue
357 * In order to propagate a wake up, a wait_queue_entry_t of the client
358 * socket is enqueued on the peer_wait queue of the server socket
359 * whose wake function does a wake_up on the ordinary client socket
360 * wait queue. This connection is established whenever a write (or
361 * poll for write) hit the flow control condition and broken when the
362 * association to the server socket is dissolved or after a wake up
366 static int unix_dgram_peer_wake_relay(wait_queue_entry_t *q, unsigned mode, int flags,
370 wait_queue_head_t *u_sleep;
372 u = container_of(q, struct unix_sock, peer_wake);
374 __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait,
376 u->peer_wake.private = NULL;
378 /* relaying can only happen while the wq still exists */
379 u_sleep = sk_sleep(&u->sk);
381 wake_up_interruptible_poll(u_sleep, key_to_poll(key));
386 static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other)
388 struct unix_sock *u, *u_other;
392 u_other = unix_sk(other);
394 spin_lock(&u_other->peer_wait.lock);
396 if (!u->peer_wake.private) {
397 u->peer_wake.private = other;
398 __add_wait_queue(&u_other->peer_wait, &u->peer_wake);
403 spin_unlock(&u_other->peer_wait.lock);
407 static void unix_dgram_peer_wake_disconnect(struct sock *sk,
410 struct unix_sock *u, *u_other;
413 u_other = unix_sk(other);
414 spin_lock(&u_other->peer_wait.lock);
416 if (u->peer_wake.private == other) {
417 __remove_wait_queue(&u_other->peer_wait, &u->peer_wake);
418 u->peer_wake.private = NULL;
421 spin_unlock(&u_other->peer_wait.lock);
424 static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk,
427 unix_dgram_peer_wake_disconnect(sk, other);
428 wake_up_interruptible_poll(sk_sleep(sk),
435 * - unix_peer(sk) == other
436 * - association is stable
438 static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
442 connected = unix_dgram_peer_wake_connect(sk, other);
444 /* If other is SOCK_DEAD, we want to make sure we signal
445 * POLLOUT, such that a subsequent write() can get a
446 * -ECONNREFUSED. Otherwise, if we haven't queued any skbs
447 * to other and its full, we will hang waiting for POLLOUT.
449 if (unix_recvq_full(other) && !sock_flag(other, SOCK_DEAD))
453 unix_dgram_peer_wake_disconnect(sk, other);
458 static int unix_writable(const struct sock *sk)
460 return sk->sk_state != TCP_LISTEN &&
461 (refcount_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
464 static void unix_write_space(struct sock *sk)
466 struct socket_wq *wq;
469 if (unix_writable(sk)) {
470 wq = rcu_dereference(sk->sk_wq);
471 if (skwq_has_sleeper(wq))
472 wake_up_interruptible_sync_poll(&wq->wait,
473 EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND);
474 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
479 /* When dgram socket disconnects (or changes its peer), we clear its receive
480 * queue of packets arrived from previous peer. First, it allows to do
481 * flow control based only on wmem_alloc; second, sk connected to peer
482 * may receive messages only from that peer. */
483 static void unix_dgram_disconnected(struct sock *sk, struct sock *other)
485 if (!skb_queue_empty(&sk->sk_receive_queue)) {
486 skb_queue_purge(&sk->sk_receive_queue);
487 wake_up_interruptible_all(&unix_sk(sk)->peer_wait);
489 /* If one link of bidirectional dgram pipe is disconnected,
490 * we signal error. Messages are lost. Do not make this,
491 * when peer was not connected to us.
493 if (!sock_flag(other, SOCK_DEAD) && unix_peer(other) == sk) {
494 other->sk_err = ECONNRESET;
495 sk_error_report(other);
498 sk->sk_state = other->sk_state = TCP_CLOSE;
501 static void unix_sock_destructor(struct sock *sk)
503 struct unix_sock *u = unix_sk(sk);
505 skb_queue_purge(&sk->sk_receive_queue);
507 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
509 kfree_skb(u->oob_skb);
513 WARN_ON(refcount_read(&sk->sk_wmem_alloc));
514 WARN_ON(!sk_unhashed(sk));
515 WARN_ON(sk->sk_socket);
516 if (!sock_flag(sk, SOCK_DEAD)) {
517 pr_info("Attempt to release alive unix socket: %p\n", sk);
522 unix_release_addr(u->addr);
524 atomic_long_dec(&unix_nr_socks);
526 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
528 #ifdef UNIX_REFCNT_DEBUG
529 pr_debug("UNIX %p is destroyed, %ld are still alive.\n", sk,
530 atomic_long_read(&unix_nr_socks));
534 static void unix_release_sock(struct sock *sk, int embrion)
536 struct unix_sock *u = unix_sk(sk);
542 unix_remove_socket(sk);
547 sk->sk_shutdown = SHUTDOWN_MASK;
549 u->path.dentry = NULL;
551 state = sk->sk_state;
552 sk->sk_state = TCP_CLOSE;
554 skpair = unix_peer(sk);
555 unix_peer(sk) = NULL;
557 unix_state_unlock(sk);
559 wake_up_interruptible_all(&u->peer_wait);
561 if (skpair != NULL) {
562 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
563 unix_state_lock(skpair);
565 skpair->sk_shutdown = SHUTDOWN_MASK;
566 if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
567 skpair->sk_err = ECONNRESET;
568 unix_state_unlock(skpair);
569 skpair->sk_state_change(skpair);
570 sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
573 unix_dgram_peer_wake_disconnect(sk, skpair);
574 sock_put(skpair); /* It may now die */
577 /* Try to flush out this socket. Throw out buffers at least */
579 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
580 if (state == TCP_LISTEN)
581 unix_release_sock(skb->sk, 1);
582 /* passed fds are erased in the kfree_skb hook */
583 UNIXCB(skb).consumed = skb->len;
592 /* ---- Socket is dead now and most probably destroyed ---- */
595 * Fixme: BSD difference: In BSD all sockets connected to us get
596 * ECONNRESET and we die on the spot. In Linux we behave
597 * like files and pipes do and wait for the last
600 * Can't we simply set sock->err?
602 * What the above comment does talk about? --ANK(980817)
605 if (unix_tot_inflight)
606 unix_gc(); /* Garbage collect fds */
609 static void init_peercred(struct sock *sk)
611 put_pid(sk->sk_peer_pid);
612 if (sk->sk_peer_cred)
613 put_cred(sk->sk_peer_cred);
614 sk->sk_peer_pid = get_pid(task_tgid(current));
615 sk->sk_peer_cred = get_current_cred();
618 static void copy_peercred(struct sock *sk, struct sock *peersk)
620 put_pid(sk->sk_peer_pid);
621 if (sk->sk_peer_cred)
622 put_cred(sk->sk_peer_cred);
623 sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);
624 sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
627 static int unix_listen(struct socket *sock, int backlog)
630 struct sock *sk = sock->sk;
631 struct unix_sock *u = unix_sk(sk);
634 if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
635 goto out; /* Only stream/seqpacket sockets accept */
638 goto out; /* No listens on an unbound socket */
640 if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
642 if (backlog > sk->sk_max_ack_backlog)
643 wake_up_interruptible_all(&u->peer_wait);
644 sk->sk_max_ack_backlog = backlog;
645 sk->sk_state = TCP_LISTEN;
646 /* set credentials so connect can copy them */
651 unix_state_unlock(sk);
656 static int unix_release(struct socket *);
657 static int unix_bind(struct socket *, struct sockaddr *, int);
658 static int unix_stream_connect(struct socket *, struct sockaddr *,
659 int addr_len, int flags);
660 static int unix_socketpair(struct socket *, struct socket *);
661 static int unix_accept(struct socket *, struct socket *, int, bool);
662 static int unix_getname(struct socket *, struct sockaddr *, int);
663 static __poll_t unix_poll(struct file *, struct socket *, poll_table *);
664 static __poll_t unix_dgram_poll(struct file *, struct socket *,
666 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
668 static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
670 static int unix_shutdown(struct socket *, int);
671 static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);
672 static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int);
673 static ssize_t unix_stream_sendpage(struct socket *, struct page *, int offset,
674 size_t size, int flags);
675 static ssize_t unix_stream_splice_read(struct socket *, loff_t *ppos,
676 struct pipe_inode_info *, size_t size,
678 static int unix_dgram_sendmsg(struct socket *, struct msghdr *, size_t);
679 static int unix_dgram_recvmsg(struct socket *, struct msghdr *, size_t, int);
680 static int unix_read_sock(struct sock *sk, read_descriptor_t *desc,
681 sk_read_actor_t recv_actor);
682 static int unix_stream_read_sock(struct sock *sk, read_descriptor_t *desc,
683 sk_read_actor_t recv_actor);
684 static int unix_dgram_connect(struct socket *, struct sockaddr *,
686 static int unix_seqpacket_sendmsg(struct socket *, struct msghdr *, size_t);
687 static int unix_seqpacket_recvmsg(struct socket *, struct msghdr *, size_t,
690 static int unix_set_peek_off(struct sock *sk, int val)
692 struct unix_sock *u = unix_sk(sk);
694 if (mutex_lock_interruptible(&u->iolock))
697 sk->sk_peek_off = val;
698 mutex_unlock(&u->iolock);
703 #ifdef CONFIG_PROC_FS
704 static void unix_show_fdinfo(struct seq_file *m, struct socket *sock)
706 struct sock *sk = sock->sk;
710 u = unix_sk(sock->sk);
711 seq_printf(m, "scm_fds: %u\n",
712 atomic_read(&u->scm_stat.nr_fds));
716 #define unix_show_fdinfo NULL
719 static const struct proto_ops unix_stream_ops = {
721 .owner = THIS_MODULE,
722 .release = unix_release,
724 .connect = unix_stream_connect,
725 .socketpair = unix_socketpair,
726 .accept = unix_accept,
727 .getname = unix_getname,
731 .compat_ioctl = unix_compat_ioctl,
733 .listen = unix_listen,
734 .shutdown = unix_shutdown,
735 .sendmsg = unix_stream_sendmsg,
736 .recvmsg = unix_stream_recvmsg,
737 .read_sock = unix_stream_read_sock,
738 .mmap = sock_no_mmap,
739 .sendpage = unix_stream_sendpage,
740 .splice_read = unix_stream_splice_read,
741 .set_peek_off = unix_set_peek_off,
742 .show_fdinfo = unix_show_fdinfo,
745 static const struct proto_ops unix_dgram_ops = {
747 .owner = THIS_MODULE,
748 .release = unix_release,
750 .connect = unix_dgram_connect,
751 .socketpair = unix_socketpair,
752 .accept = sock_no_accept,
753 .getname = unix_getname,
754 .poll = unix_dgram_poll,
757 .compat_ioctl = unix_compat_ioctl,
759 .listen = sock_no_listen,
760 .shutdown = unix_shutdown,
761 .sendmsg = unix_dgram_sendmsg,
762 .read_sock = unix_read_sock,
763 .recvmsg = unix_dgram_recvmsg,
764 .mmap = sock_no_mmap,
765 .sendpage = sock_no_sendpage,
766 .set_peek_off = unix_set_peek_off,
767 .show_fdinfo = unix_show_fdinfo,
770 static const struct proto_ops unix_seqpacket_ops = {
772 .owner = THIS_MODULE,
773 .release = unix_release,
775 .connect = unix_stream_connect,
776 .socketpair = unix_socketpair,
777 .accept = unix_accept,
778 .getname = unix_getname,
779 .poll = unix_dgram_poll,
782 .compat_ioctl = unix_compat_ioctl,
784 .listen = unix_listen,
785 .shutdown = unix_shutdown,
786 .sendmsg = unix_seqpacket_sendmsg,
787 .recvmsg = unix_seqpacket_recvmsg,
788 .mmap = sock_no_mmap,
789 .sendpage = sock_no_sendpage,
790 .set_peek_off = unix_set_peek_off,
791 .show_fdinfo = unix_show_fdinfo,
794 static void unix_close(struct sock *sk, long timeout)
796 /* Nothing to do here, unix socket does not need a ->close().
797 * This is merely for sockmap.
801 static void unix_unhash(struct sock *sk)
803 /* Nothing to do here, unix socket does not need a ->unhash().
804 * This is merely for sockmap.
808 struct proto unix_dgram_proto = {
809 .name = "UNIX-DGRAM",
810 .owner = THIS_MODULE,
811 .obj_size = sizeof(struct unix_sock),
813 #ifdef CONFIG_BPF_SYSCALL
814 .psock_update_sk_prot = unix_dgram_bpf_update_proto,
818 struct proto unix_stream_proto = {
819 .name = "UNIX-STREAM",
820 .owner = THIS_MODULE,
821 .obj_size = sizeof(struct unix_sock),
823 .unhash = unix_unhash,
824 #ifdef CONFIG_BPF_SYSCALL
825 .psock_update_sk_prot = unix_stream_bpf_update_proto,
829 static struct sock *unix_create1(struct net *net, struct socket *sock, int kern, int type)
831 struct sock *sk = NULL;
834 atomic_long_inc(&unix_nr_socks);
835 if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files())
838 if (type == SOCK_STREAM)
839 sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_stream_proto, kern);
840 else /*dgram and seqpacket */
841 sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_dgram_proto, kern);
846 sock_init_data(sock, sk);
848 sk->sk_allocation = GFP_KERNEL_ACCOUNT;
849 sk->sk_write_space = unix_write_space;
850 sk->sk_max_ack_backlog = net->unx.sysctl_max_dgram_qlen;
851 sk->sk_destruct = unix_sock_destructor;
853 u->path.dentry = NULL;
855 spin_lock_init(&u->lock);
856 atomic_long_set(&u->inflight, 0);
857 INIT_LIST_HEAD(&u->link);
858 mutex_init(&u->iolock); /* single task reading lock */
859 mutex_init(&u->bindlock); /* single task binding lock */
860 init_waitqueue_head(&u->peer_wait);
861 init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
862 memset(&u->scm_stat, 0, sizeof(struct scm_stat));
863 unix_insert_socket(unix_sockets_unbound(sk), sk);
866 atomic_long_dec(&unix_nr_socks);
869 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
875 static int unix_create(struct net *net, struct socket *sock, int protocol,
878 if (protocol && protocol != PF_UNIX)
879 return -EPROTONOSUPPORT;
881 sock->state = SS_UNCONNECTED;
883 switch (sock->type) {
885 sock->ops = &unix_stream_ops;
888 * Believe it or not BSD has AF_UNIX, SOCK_RAW though
892 sock->type = SOCK_DGRAM;
895 sock->ops = &unix_dgram_ops;
898 sock->ops = &unix_seqpacket_ops;
901 return -ESOCKTNOSUPPORT;
904 return unix_create1(net, sock, kern, sock->type) ? 0 : -ENOMEM;
907 static int unix_release(struct socket *sock)
909 struct sock *sk = sock->sk;
914 sk->sk_prot->close(sk, 0);
915 unix_release_sock(sk, 0);
921 static int unix_autobind(struct socket *sock)
923 struct sock *sk = sock->sk;
924 struct net *net = sock_net(sk);
925 struct unix_sock *u = unix_sk(sk);
926 static u32 ordernum = 1;
927 struct unix_address *addr;
929 unsigned int retries = 0;
931 err = mutex_lock_interruptible(&u->bindlock);
939 addr = kzalloc(sizeof(*addr) + sizeof(short) + 16, GFP_KERNEL);
943 addr->name->sun_family = AF_UNIX;
944 refcount_set(&addr->refcnt, 1);
947 addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short);
948 addr->hash = unix_hash_fold(csum_partial(addr->name, addr->len, 0));
949 addr->hash ^= sk->sk_type;
951 spin_lock(&unix_table_lock);
952 ordernum = (ordernum+1)&0xFFFFF;
954 if (__unix_find_socket_byname(net, addr->name, addr->len, addr->hash)) {
955 spin_unlock(&unix_table_lock);
957 * __unix_find_socket_byname() may take long time if many names
958 * are already in use.
961 /* Give up if all names seems to be in use. */
962 if (retries++ == 0xFFFFF) {
970 __unix_set_addr(sk, addr, addr->hash);
971 spin_unlock(&unix_table_lock);
974 out: mutex_unlock(&u->bindlock);
978 static struct sock *unix_find_other(struct net *net,
979 struct sockaddr_un *sunname, int len,
980 int type, unsigned int hash, int *error)
986 if (sunname->sun_path[0]) {
988 err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
991 inode = d_backing_inode(path.dentry);
992 err = path_permission(&path, MAY_WRITE);
997 if (!S_ISSOCK(inode->i_mode))
999 u = unix_find_socket_byinode(inode);
1003 if (u->sk_type == type)
1009 if (u->sk_type != type) {
1014 err = -ECONNREFUSED;
1015 u = unix_find_socket_byname(net, sunname, len, type ^ hash);
1017 struct dentry *dentry;
1018 dentry = unix_sk(u)->path.dentry;
1020 touch_atime(&unix_sk(u)->path);
1033 static int unix_bind_bsd(struct sock *sk, struct unix_address *addr)
1035 struct unix_sock *u = unix_sk(sk);
1036 umode_t mode = S_IFSOCK |
1037 (SOCK_INODE(sk->sk_socket)->i_mode & ~current_umask());
1038 struct user_namespace *ns; // barf...
1040 struct dentry *dentry;
1045 * Get the parent directory, calculate the hash for last
1048 dentry = kern_path_create(AT_FDCWD, addr->name->sun_path, &parent, 0);
1050 return PTR_ERR(dentry);
1051 ns = mnt_user_ns(parent.mnt);
1054 * All right, let's create it.
1056 err = security_path_mknod(&parent, dentry, mode, 0);
1058 err = vfs_mknod(ns, d_inode(parent.dentry), dentry, mode, 0);
1061 err = mutex_lock_interruptible(&u->bindlock);
1067 addr->hash = UNIX_HASH_SIZE;
1068 hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
1069 spin_lock(&unix_table_lock);
1070 u->path.mnt = mntget(parent.mnt);
1071 u->path.dentry = dget(dentry);
1072 __unix_set_addr(sk, addr, hash);
1073 spin_unlock(&unix_table_lock);
1074 mutex_unlock(&u->bindlock);
1075 done_path_create(&parent, dentry);
1079 mutex_unlock(&u->bindlock);
1082 /* failed after successful mknod? unlink what we'd created... */
1083 vfs_unlink(ns, d_inode(parent.dentry), dentry, NULL);
1085 done_path_create(&parent, dentry);
1089 static int unix_bind_abstract(struct sock *sk, struct unix_address *addr)
1091 struct unix_sock *u = unix_sk(sk);
1094 err = mutex_lock_interruptible(&u->bindlock);
1099 mutex_unlock(&u->bindlock);
1103 spin_lock(&unix_table_lock);
1104 if (__unix_find_socket_byname(sock_net(sk), addr->name, addr->len,
1106 spin_unlock(&unix_table_lock);
1107 mutex_unlock(&u->bindlock);
1110 __unix_set_addr(sk, addr, addr->hash);
1111 spin_unlock(&unix_table_lock);
1112 mutex_unlock(&u->bindlock);
1116 static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
1118 struct sock *sk = sock->sk;
1119 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
1120 char *sun_path = sunaddr->sun_path;
1123 struct unix_address *addr;
1125 if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
1126 sunaddr->sun_family != AF_UNIX)
1129 if (addr_len == sizeof(short))
1130 return unix_autobind(sock);
1132 err = unix_mkname(sunaddr, addr_len, &hash);
1136 addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
1140 memcpy(addr->name, sunaddr, addr_len);
1141 addr->len = addr_len;
1142 addr->hash = hash ^ sk->sk_type;
1143 refcount_set(&addr->refcnt, 1);
1146 err = unix_bind_bsd(sk, addr);
1148 err = unix_bind_abstract(sk, addr);
1150 unix_release_addr(addr);
1151 return err == -EEXIST ? -EADDRINUSE : err;
1154 static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
1156 if (unlikely(sk1 == sk2) || !sk2) {
1157 unix_state_lock(sk1);
1161 unix_state_lock(sk1);
1162 unix_state_lock_nested(sk2);
1164 unix_state_lock(sk2);
1165 unix_state_lock_nested(sk1);
1169 static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
1171 if (unlikely(sk1 == sk2) || !sk2) {
1172 unix_state_unlock(sk1);
1175 unix_state_unlock(sk1);
1176 unix_state_unlock(sk2);
1179 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
1180 int alen, int flags)
1182 struct sock *sk = sock->sk;
1183 struct net *net = sock_net(sk);
1184 struct sockaddr_un *sunaddr = (struct sockaddr_un *)addr;
1190 if (alen < offsetofend(struct sockaddr, sa_family))
1193 if (addr->sa_family != AF_UNSPEC) {
1194 err = unix_mkname(sunaddr, alen, &hash);
1199 if (test_bit(SOCK_PASSCRED, &sock->flags) &&
1200 !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0)
1204 other = unix_find_other(net, sunaddr, alen, sock->type, hash, &err);
1208 unix_state_double_lock(sk, other);
1210 /* Apparently VFS overslept socket death. Retry. */
1211 if (sock_flag(other, SOCK_DEAD)) {
1212 unix_state_double_unlock(sk, other);
1218 if (!unix_may_send(sk, other))
1221 err = security_unix_may_send(sk->sk_socket, other->sk_socket);
1227 * 1003.1g breaking connected state with AF_UNSPEC
1230 unix_state_double_lock(sk, other);
1234 * If it was connected, reconnect.
1236 if (unix_peer(sk)) {
1237 struct sock *old_peer = unix_peer(sk);
1238 unix_peer(sk) = other;
1239 unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
1241 unix_state_double_unlock(sk, other);
1243 if (other != old_peer)
1244 unix_dgram_disconnected(sk, old_peer);
1247 unix_peer(sk) = other;
1248 unix_state_double_unlock(sk, other);
1252 sk->sk_state = other->sk_state = TCP_ESTABLISHED;
1256 unix_state_double_unlock(sk, other);
1262 static long unix_wait_for_peer(struct sock *other, long timeo)
1263 __releases(&unix_sk(other)->lock)
1265 struct unix_sock *u = unix_sk(other);
1269 prepare_to_wait_exclusive(&u->peer_wait, &wait, TASK_INTERRUPTIBLE);
1271 sched = !sock_flag(other, SOCK_DEAD) &&
1272 !(other->sk_shutdown & RCV_SHUTDOWN) &&
1273 unix_recvq_full(other);
1275 unix_state_unlock(other);
1278 timeo = schedule_timeout(timeo);
1280 finish_wait(&u->peer_wait, &wait);
1284 static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
1285 int addr_len, int flags)
1287 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
1288 struct sock *sk = sock->sk;
1289 struct net *net = sock_net(sk);
1290 struct unix_sock *u = unix_sk(sk), *newu, *otheru;
1291 struct sock *newsk = NULL;
1292 struct sock *other = NULL;
1293 struct sk_buff *skb = NULL;
1299 err = unix_mkname(sunaddr, addr_len, &hash);
1304 if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr &&
1305 (err = unix_autobind(sock)) != 0)
1308 timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
1310 /* First of all allocate resources.
1311 If we will make it after state is locked,
1312 we will have to recheck all again in any case.
1317 /* create new sock for complete connection */
1318 newsk = unix_create1(sock_net(sk), NULL, 0, sock->type);
1322 /* Allocate skb for sending to listening sock */
1323 skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL);
1328 /* Find listening sock. */
1329 other = unix_find_other(net, sunaddr, addr_len, sk->sk_type, hash, &err);
1333 /* Latch state of peer */
1334 unix_state_lock(other);
1336 /* Apparently VFS overslept socket death. Retry. */
1337 if (sock_flag(other, SOCK_DEAD)) {
1338 unix_state_unlock(other);
1343 err = -ECONNREFUSED;
1344 if (other->sk_state != TCP_LISTEN)
1346 if (other->sk_shutdown & RCV_SHUTDOWN)
1349 if (unix_recvq_full(other)) {
1354 timeo = unix_wait_for_peer(other, timeo);
1356 err = sock_intr_errno(timeo);
1357 if (signal_pending(current))
1365 It is tricky place. We need to grab our state lock and cannot
1366 drop lock on peer. It is dangerous because deadlock is
1367 possible. Connect to self case and simultaneous
1368 attempt to connect are eliminated by checking socket
1369 state. other is TCP_LISTEN, if sk is TCP_LISTEN we
1370 check this before attempt to grab lock.
1372 Well, and we have to recheck the state after socket locked.
1378 /* This is ok... continue with connect */
1380 case TCP_ESTABLISHED:
1381 /* Socket is already connected */
1389 unix_state_lock_nested(sk);
1391 if (sk->sk_state != st) {
1392 unix_state_unlock(sk);
1393 unix_state_unlock(other);
1398 err = security_unix_stream_connect(sk, other, newsk);
1400 unix_state_unlock(sk);
1404 /* The way is open! Fastly set all the necessary fields... */
1407 unix_peer(newsk) = sk;
1408 newsk->sk_state = TCP_ESTABLISHED;
1409 newsk->sk_type = sk->sk_type;
1410 init_peercred(newsk);
1411 newu = unix_sk(newsk);
1412 RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
1413 otheru = unix_sk(other);
1415 /* copy address information from listening to new sock
1417 * The contents of *(otheru->addr) and otheru->path
1418 * are seen fully set up here, since we have found
1419 * otheru in hash under unix_table_lock. Insertion
1420 * into the hash chain we'd found it in had been done
1421 * in an earlier critical area protected by unix_table_lock,
1422 * the same one where we'd set *(otheru->addr) contents,
1423 * as well as otheru->path and otheru->addr itself.
1425 * Using smp_store_release() here to set newu->addr
1426 * is enough to make those stores, as well as stores
1427 * to newu->path visible to anyone who gets newu->addr
1428 * by smp_load_acquire(). IOW, the same warranties
1429 * as for unix_sock instances bound in unix_bind() or
1430 * in unix_autobind().
1432 if (otheru->path.dentry) {
1433 path_get(&otheru->path);
1434 newu->path = otheru->path;
1436 refcount_inc(&otheru->addr->refcnt);
1437 smp_store_release(&newu->addr, otheru->addr);
1439 /* Set credentials */
1440 copy_peercred(sk, other);
1442 sock->state = SS_CONNECTED;
1443 sk->sk_state = TCP_ESTABLISHED;
1446 smp_mb__after_atomic(); /* sock_hold() does an atomic_inc() */
1447 unix_peer(sk) = newsk;
1449 unix_state_unlock(sk);
1451 /* take ten and send info to listening sock */
1452 spin_lock(&other->sk_receive_queue.lock);
1453 __skb_queue_tail(&other->sk_receive_queue, skb);
1454 spin_unlock(&other->sk_receive_queue.lock);
1455 unix_state_unlock(other);
1456 other->sk_data_ready(other);
1462 unix_state_unlock(other);
1467 unix_release_sock(newsk, 0);
1473 static int unix_socketpair(struct socket *socka, struct socket *sockb)
1475 struct sock *ska = socka->sk, *skb = sockb->sk;
1477 /* Join our sockets back to back */
1480 unix_peer(ska) = skb;
1481 unix_peer(skb) = ska;
1485 ska->sk_state = TCP_ESTABLISHED;
1486 skb->sk_state = TCP_ESTABLISHED;
1487 socka->state = SS_CONNECTED;
1488 sockb->state = SS_CONNECTED;
1492 static void unix_sock_inherit_flags(const struct socket *old,
1495 if (test_bit(SOCK_PASSCRED, &old->flags))
1496 set_bit(SOCK_PASSCRED, &new->flags);
1497 if (test_bit(SOCK_PASSSEC, &old->flags))
1498 set_bit(SOCK_PASSSEC, &new->flags);
1501 static int unix_accept(struct socket *sock, struct socket *newsock, int flags,
1504 struct sock *sk = sock->sk;
1506 struct sk_buff *skb;
1510 if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)
1514 if (sk->sk_state != TCP_LISTEN)
1517 /* If socket state is TCP_LISTEN it cannot change (for now...),
1518 * so that no locks are necessary.
1521 skb = skb_recv_datagram(sk, 0, flags&O_NONBLOCK, &err);
1523 /* This means receive shutdown. */
1530 skb_free_datagram(sk, skb);
1531 wake_up_interruptible(&unix_sk(sk)->peer_wait);
1533 /* attach accepted sock to socket */
1534 unix_state_lock(tsk);
1535 newsock->state = SS_CONNECTED;
1536 unix_sock_inherit_flags(sock, newsock);
1537 sock_graft(tsk, newsock);
1538 unix_state_unlock(tsk);
1546 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
1548 struct sock *sk = sock->sk;
1549 struct unix_address *addr;
1550 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
1554 sk = unix_peer_get(sk);
1564 addr = smp_load_acquire(&unix_sk(sk)->addr);
1566 sunaddr->sun_family = AF_UNIX;
1567 sunaddr->sun_path[0] = 0;
1568 err = sizeof(short);
1571 memcpy(sunaddr, addr->name, addr->len);
1578 static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb)
1580 scm->fp = scm_fp_dup(UNIXCB(skb).fp);
1583 * Garbage collection of unix sockets starts by selecting a set of
1584 * candidate sockets which have reference only from being in flight
1585 * (total_refs == inflight_refs). This condition is checked once during
1586 * the candidate collection phase, and candidates are marked as such, so
1587 * that non-candidates can later be ignored. While inflight_refs is
1588 * protected by unix_gc_lock, total_refs (file count) is not, hence this
1589 * is an instantaneous decision.
1591 * Once a candidate, however, the socket must not be reinstalled into a
1592 * file descriptor while the garbage collection is in progress.
1594 * If the above conditions are met, then the directed graph of
1595 * candidates (*) does not change while unix_gc_lock is held.
1597 * Any operations that changes the file count through file descriptors
1598 * (dup, close, sendmsg) does not change the graph since candidates are
1599 * not installed in fds.
1601 * Dequeing a candidate via recvmsg would install it into an fd, but
1602 * that takes unix_gc_lock to decrement the inflight count, so it's
1603 * serialized with garbage collection.
1605 * MSG_PEEK is special in that it does not change the inflight count,
1606 * yet does install the socket into an fd. The following lock/unlock
1607 * pair is to ensure serialization with garbage collection. It must be
1608 * done between incrementing the file count and installing the file into
1611 * If garbage collection starts after the barrier provided by the
1612 * lock/unlock, then it will see the elevated refcount and not mark this
1613 * as a candidate. If a garbage collection is already in progress
1614 * before the file count was incremented, then the lock/unlock pair will
1615 * ensure that garbage collection is finished before progressing to
1616 * installing the fd.
1618 * (*) A -> B where B is on the queue of A or B is on the queue of C
1619 * which is on the queue of listening socket A.
1621 spin_lock(&unix_gc_lock);
1622 spin_unlock(&unix_gc_lock);
1625 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
1629 UNIXCB(skb).pid = get_pid(scm->pid);
1630 UNIXCB(skb).uid = scm->creds.uid;
1631 UNIXCB(skb).gid = scm->creds.gid;
1632 UNIXCB(skb).fp = NULL;
1633 unix_get_secdata(scm, skb);
1634 if (scm->fp && send_fds)
1635 err = unix_attach_fds(scm, skb);
1637 skb->destructor = unix_destruct_scm;
1641 static bool unix_passcred_enabled(const struct socket *sock,
1642 const struct sock *other)
1644 return test_bit(SOCK_PASSCRED, &sock->flags) ||
1645 !other->sk_socket ||
1646 test_bit(SOCK_PASSCRED, &other->sk_socket->flags);
1650 * Some apps rely on write() giving SCM_CREDENTIALS
1651 * We include credentials if source or destination socket
1652 * asserted SOCK_PASSCRED.
1654 static void maybe_add_creds(struct sk_buff *skb, const struct socket *sock,
1655 const struct sock *other)
1657 if (UNIXCB(skb).pid)
1659 if (unix_passcred_enabled(sock, other)) {
1660 UNIXCB(skb).pid = get_pid(task_tgid(current));
1661 current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
1665 static int maybe_init_creds(struct scm_cookie *scm,
1666 struct socket *socket,
1667 const struct sock *other)
1670 struct msghdr msg = { .msg_controllen = 0 };
1672 err = scm_send(socket, &msg, scm, false);
1676 if (unix_passcred_enabled(socket, other)) {
1677 scm->pid = get_pid(task_tgid(current));
1678 current_uid_gid(&scm->creds.uid, &scm->creds.gid);
1683 static bool unix_skb_scm_eq(struct sk_buff *skb,
1684 struct scm_cookie *scm)
1686 const struct unix_skb_parms *u = &UNIXCB(skb);
1688 return u->pid == scm->pid &&
1689 uid_eq(u->uid, scm->creds.uid) &&
1690 gid_eq(u->gid, scm->creds.gid) &&
1691 unix_secdata_eq(scm, skb);
1694 static void scm_stat_add(struct sock *sk, struct sk_buff *skb)
1696 struct scm_fp_list *fp = UNIXCB(skb).fp;
1697 struct unix_sock *u = unix_sk(sk);
1699 if (unlikely(fp && fp->count))
1700 atomic_add(fp->count, &u->scm_stat.nr_fds);
1703 static void scm_stat_del(struct sock *sk, struct sk_buff *skb)
1705 struct scm_fp_list *fp = UNIXCB(skb).fp;
1706 struct unix_sock *u = unix_sk(sk);
1708 if (unlikely(fp && fp->count))
1709 atomic_sub(fp->count, &u->scm_stat.nr_fds);
1713 * Send AF_UNIX data.
1716 static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
1719 struct sock *sk = sock->sk;
1720 struct net *net = sock_net(sk);
1721 struct unix_sock *u = unix_sk(sk);
1722 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, msg->msg_name);
1723 struct sock *other = NULL;
1724 int namelen = 0; /* fake GCC */
1727 struct sk_buff *skb;
1729 struct scm_cookie scm;
1734 err = scm_send(sock, msg, &scm, false);
1739 if (msg->msg_flags&MSG_OOB)
1742 if (msg->msg_namelen) {
1743 err = unix_mkname(sunaddr, msg->msg_namelen, &hash);
1750 other = unix_peer_get(sk);
1755 if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr
1756 && (err = unix_autobind(sock)) != 0)
1760 if (len > sk->sk_sndbuf - 32)
1763 if (len > SKB_MAX_ALLOC) {
1764 data_len = min_t(size_t,
1765 len - SKB_MAX_ALLOC,
1766 MAX_SKB_FRAGS * PAGE_SIZE);
1767 data_len = PAGE_ALIGN(data_len);
1769 BUILD_BUG_ON(SKB_MAX_ALLOC < PAGE_SIZE);
1772 skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
1773 msg->msg_flags & MSG_DONTWAIT, &err,
1774 PAGE_ALLOC_COSTLY_ORDER);
1778 err = unix_scm_to_skb(&scm, skb, true);
1782 skb_put(skb, len - data_len);
1783 skb->data_len = data_len;
1785 err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, len);
1789 timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
1794 if (sunaddr == NULL)
1797 other = unix_find_other(net, sunaddr, namelen, sk->sk_type,
1803 if (sk_filter(other, skb) < 0) {
1804 /* Toss the packet but do not return any error to the sender */
1810 unix_state_lock(other);
1813 if (!unix_may_send(sk, other))
1816 if (unlikely(sock_flag(other, SOCK_DEAD))) {
1818 * Check with 1003.1g - what should
1821 unix_state_unlock(other);
1825 unix_state_lock(sk);
1828 if (unix_peer(sk) == other) {
1829 unix_peer(sk) = NULL;
1830 unix_dgram_peer_wake_disconnect_wakeup(sk, other);
1832 unix_state_unlock(sk);
1834 unix_dgram_disconnected(sk, other);
1836 err = -ECONNREFUSED;
1838 unix_state_unlock(sk);
1848 if (other->sk_shutdown & RCV_SHUTDOWN)
1851 if (sk->sk_type != SOCK_SEQPACKET) {
1852 err = security_unix_may_send(sk->sk_socket, other->sk_socket);
1857 /* other == sk && unix_peer(other) != sk if
1858 * - unix_peer(sk) == NULL, destination address bound to sk
1859 * - unix_peer(sk) == sk by time of get but disconnected before lock
1862 unlikely(unix_peer(other) != sk &&
1863 unix_recvq_full_lockless(other))) {
1865 timeo = unix_wait_for_peer(other, timeo);
1867 err = sock_intr_errno(timeo);
1868 if (signal_pending(current))
1875 unix_state_unlock(other);
1876 unix_state_double_lock(sk, other);
1879 if (unix_peer(sk) != other ||
1880 unix_dgram_peer_wake_me(sk, other)) {
1888 goto restart_locked;
1892 if (unlikely(sk_locked))
1893 unix_state_unlock(sk);
1895 if (sock_flag(other, SOCK_RCVTSTAMP))
1896 __net_timestamp(skb);
1897 maybe_add_creds(skb, sock, other);
1898 scm_stat_add(other, skb);
1899 skb_queue_tail(&other->sk_receive_queue, skb);
1900 unix_state_unlock(other);
1901 other->sk_data_ready(other);
1908 unix_state_unlock(sk);
1909 unix_state_unlock(other);
1919 /* We use paged skbs for stream sockets, and limit occupancy to 32768
1920 * bytes, and a minimum of a full page.
1922 #define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768))
1924 #if (IS_ENABLED(CONFIG_AF_UNIX_OOB))
1925 static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other)
1927 struct unix_sock *ousk = unix_sk(other);
1928 struct sk_buff *skb;
1931 skb = sock_alloc_send_skb(sock->sk, 1, msg->msg_flags & MSG_DONTWAIT, &err);
1937 err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, 1);
1944 unix_state_lock(other);
1946 if (sock_flag(other, SOCK_DEAD) ||
1947 (other->sk_shutdown & RCV_SHUTDOWN)) {
1948 unix_state_unlock(other);
1953 maybe_add_creds(skb, sock, other);
1957 consume_skb(ousk->oob_skb);
1959 ousk->oob_skb = skb;
1961 scm_stat_add(other, skb);
1962 skb_queue_tail(&other->sk_receive_queue, skb);
1963 sk_send_sigurg(other);
1964 unix_state_unlock(other);
1965 other->sk_data_ready(other);
1971 static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
1974 struct sock *sk = sock->sk;
1975 struct sock *other = NULL;
1977 struct sk_buff *skb;
1979 struct scm_cookie scm;
1980 bool fds_sent = false;
1984 err = scm_send(sock, msg, &scm, false);
1989 if (msg->msg_flags & MSG_OOB) {
1990 #if (IS_ENABLED(CONFIG_AF_UNIX_OOB))
1998 if (msg->msg_namelen) {
1999 err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
2003 other = unix_peer(sk);
2008 if (sk->sk_shutdown & SEND_SHUTDOWN)
2011 while (sent < len) {
2014 /* Keep two messages in the pipe so it schedules better */
2015 size = min_t(int, size, (sk->sk_sndbuf >> 1) - 64);
2017 /* allow fallback to order-0 allocations */
2018 size = min_t(int, size, SKB_MAX_HEAD(0) + UNIX_SKB_FRAGS_SZ);
2020 data_len = max_t(int, 0, size - SKB_MAX_HEAD(0));
2022 data_len = min_t(size_t, size, PAGE_ALIGN(data_len));
2024 skb = sock_alloc_send_pskb(sk, size - data_len, data_len,
2025 msg->msg_flags & MSG_DONTWAIT, &err,
2026 get_order(UNIX_SKB_FRAGS_SZ));
2030 /* Only send the fds in the first buffer */
2031 err = unix_scm_to_skb(&scm, skb, !fds_sent);
2038 skb_put(skb, size - data_len);
2039 skb->data_len = data_len;
2041 err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, size);
2047 unix_state_lock(other);
2049 if (sock_flag(other, SOCK_DEAD) ||
2050 (other->sk_shutdown & RCV_SHUTDOWN))
2053 maybe_add_creds(skb, sock, other);
2054 scm_stat_add(other, skb);
2055 skb_queue_tail(&other->sk_receive_queue, skb);
2056 unix_state_unlock(other);
2057 other->sk_data_ready(other);
2061 #if (IS_ENABLED(CONFIG_AF_UNIX_OOB))
2062 if (msg->msg_flags & MSG_OOB) {
2063 err = queue_oob(sock, msg, other);
2075 unix_state_unlock(other);
2078 if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
2079 send_sig(SIGPIPE, current, 0);
2083 return sent ? : err;
2086 static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
2087 int offset, size_t size, int flags)
2090 bool send_sigpipe = false;
2091 bool init_scm = true;
2092 struct scm_cookie scm;
2093 struct sock *other, *sk = socket->sk;
2094 struct sk_buff *skb, *newskb = NULL, *tail = NULL;
2096 if (flags & MSG_OOB)
2099 other = unix_peer(sk);
2100 if (!other || sk->sk_state != TCP_ESTABLISHED)
2105 unix_state_unlock(other);
2106 mutex_unlock(&unix_sk(other)->iolock);
2107 newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
2113 /* we must acquire iolock as we modify already present
2114 * skbs in the sk_receive_queue and mess with skb->len
2116 err = mutex_lock_interruptible(&unix_sk(other)->iolock);
2118 err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS;
2122 if (sk->sk_shutdown & SEND_SHUTDOWN) {
2124 send_sigpipe = true;
2128 unix_state_lock(other);
2130 if (sock_flag(other, SOCK_DEAD) ||
2131 other->sk_shutdown & RCV_SHUTDOWN) {
2133 send_sigpipe = true;
2134 goto err_state_unlock;
2138 err = maybe_init_creds(&scm, socket, other);
2140 goto err_state_unlock;
2144 skb = skb_peek_tail(&other->sk_receive_queue);
2145 if (tail && tail == skb) {
2147 } else if (!skb || !unix_skb_scm_eq(skb, &scm)) {
2154 } else if (newskb) {
2155 /* this is fast path, we don't necessarily need to
2156 * call to kfree_skb even though with newskb == NULL
2157 * this - does no harm
2159 consume_skb(newskb);
2163 if (skb_append_pagefrags(skb, page, offset, size)) {
2169 skb->data_len += size;
2170 skb->truesize += size;
2171 refcount_add(size, &sk->sk_wmem_alloc);
2174 err = unix_scm_to_skb(&scm, skb, false);
2176 goto err_state_unlock;
2177 spin_lock(&other->sk_receive_queue.lock);
2178 __skb_queue_tail(&other->sk_receive_queue, newskb);
2179 spin_unlock(&other->sk_receive_queue.lock);
2182 unix_state_unlock(other);
2183 mutex_unlock(&unix_sk(other)->iolock);
2185 other->sk_data_ready(other);
2190 unix_state_unlock(other);
2192 mutex_unlock(&unix_sk(other)->iolock);
2195 if (send_sigpipe && !(flags & MSG_NOSIGNAL))
2196 send_sig(SIGPIPE, current, 0);
2202 static int unix_seqpacket_sendmsg(struct socket *sock, struct msghdr *msg,
2206 struct sock *sk = sock->sk;
2208 err = sock_error(sk);
2212 if (sk->sk_state != TCP_ESTABLISHED)
2215 if (msg->msg_namelen)
2216 msg->msg_namelen = 0;
2218 return unix_dgram_sendmsg(sock, msg, len);
2221 static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg,
2222 size_t size, int flags)
2224 struct sock *sk = sock->sk;
2226 if (sk->sk_state != TCP_ESTABLISHED)
2229 return unix_dgram_recvmsg(sock, msg, size, flags);
2232 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
2234 struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
2237 msg->msg_namelen = addr->len;
2238 memcpy(msg->msg_name, addr->name, addr->len);
2242 int __unix_dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t size,
2245 struct scm_cookie scm;
2246 struct socket *sock = sk->sk_socket;
2247 struct unix_sock *u = unix_sk(sk);
2248 struct sk_buff *skb, *last;
2257 timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
2260 mutex_lock(&u->iolock);
2262 skip = sk_peek_offset(sk, flags);
2263 skb = __skb_try_recv_datagram(sk, &sk->sk_receive_queue, flags,
2264 &skip, &err, &last);
2266 if (!(flags & MSG_PEEK))
2267 scm_stat_del(sk, skb);
2271 mutex_unlock(&u->iolock);
2276 !__skb_wait_for_more_packets(sk, &sk->sk_receive_queue,
2277 &err, &timeo, last));
2279 if (!skb) { /* implies iolock unlocked */
2280 unix_state_lock(sk);
2281 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
2282 if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
2283 (sk->sk_shutdown & RCV_SHUTDOWN))
2285 unix_state_unlock(sk);
2289 if (wq_has_sleeper(&u->peer_wait))
2290 wake_up_interruptible_sync_poll(&u->peer_wait,
2291 EPOLLOUT | EPOLLWRNORM |
2295 unix_copy_addr(msg, skb->sk);
2297 if (size > skb->len - skip)
2298 size = skb->len - skip;
2299 else if (size < skb->len - skip)
2300 msg->msg_flags |= MSG_TRUNC;
2302 err = skb_copy_datagram_msg(skb, skip, msg, size);
2306 if (sock_flag(sk, SOCK_RCVTSTAMP))
2307 __sock_recv_timestamp(msg, sk, skb);
2309 memset(&scm, 0, sizeof(scm));
2311 scm_set_cred(&scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
2312 unix_set_secdata(&scm, skb);
2314 if (!(flags & MSG_PEEK)) {
2316 unix_detach_fds(&scm, skb);
2318 sk_peek_offset_bwd(sk, skb->len);
2320 /* It is questionable: on PEEK we could:
2321 - do not return fds - good, but too simple 8)
2322 - return fds, and do not return them on read (old strategy,
2324 - clone fds (I chose it for now, it is the most universal
2327 POSIX 1003.1g does not actually define this clearly
2328 at all. POSIX 1003.1g doesn't define a lot of things
2333 sk_peek_offset_fwd(sk, size);
2336 unix_peek_fds(&scm, skb);
2338 err = (flags & MSG_TRUNC) ? skb->len - skip : size;
2340 scm_recv(sock, msg, &scm, flags);
2343 skb_free_datagram(sk, skb);
2344 mutex_unlock(&u->iolock);
2349 static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
2352 struct sock *sk = sock->sk;
2354 #ifdef CONFIG_BPF_SYSCALL
2355 const struct proto *prot = READ_ONCE(sk->sk_prot);
2357 if (prot != &unix_dgram_proto)
2358 return prot->recvmsg(sk, msg, size, flags & MSG_DONTWAIT,
2359 flags & ~MSG_DONTWAIT, NULL);
2361 return __unix_dgram_recvmsg(sk, msg, size, flags);
2364 static int unix_read_sock(struct sock *sk, read_descriptor_t *desc,
2365 sk_read_actor_t recv_actor)
2370 struct unix_sock *u = unix_sk(sk);
2371 struct sk_buff *skb;
2374 mutex_lock(&u->iolock);
2375 skb = skb_recv_datagram(sk, 0, 1, &err);
2376 mutex_unlock(&u->iolock);
2380 used = recv_actor(desc, skb, 0, skb->len);
2386 } else if (used <= skb->len) {
2399 * Sleep until more data has arrived. But check for races..
2401 static long unix_stream_data_wait(struct sock *sk, long timeo,
2402 struct sk_buff *last, unsigned int last_len,
2405 struct sk_buff *tail;
2408 unix_state_lock(sk);
2411 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
2413 tail = skb_peek_tail(&sk->sk_receive_queue);
2415 (tail && tail->len != last_len) ||
2417 (sk->sk_shutdown & RCV_SHUTDOWN) ||
2418 signal_pending(current) ||
2422 sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
2423 unix_state_unlock(sk);
2425 timeo = freezable_schedule_timeout(timeo);
2427 timeo = schedule_timeout(timeo);
2428 unix_state_lock(sk);
2430 if (sock_flag(sk, SOCK_DEAD))
2433 sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
2436 finish_wait(sk_sleep(sk), &wait);
2437 unix_state_unlock(sk);
2441 static unsigned int unix_skb_len(const struct sk_buff *skb)
2443 return skb->len - UNIXCB(skb).consumed;
2446 struct unix_stream_read_state {
2447 int (*recv_actor)(struct sk_buff *, int, int,
2448 struct unix_stream_read_state *);
2449 struct socket *socket;
2451 struct pipe_inode_info *pipe;
2454 unsigned int splice_flags;
2457 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
2458 static int unix_stream_recv_urg(struct unix_stream_read_state *state)
2460 struct socket *sock = state->socket;
2461 struct sock *sk = sock->sk;
2462 struct unix_sock *u = unix_sk(sk);
2464 struct sk_buff *oob_skb;
2466 mutex_lock(&u->iolock);
2467 unix_state_lock(sk);
2469 if (sock_flag(sk, SOCK_URGINLINE) || !u->oob_skb) {
2470 unix_state_unlock(sk);
2471 mutex_unlock(&u->iolock);
2475 oob_skb = u->oob_skb;
2477 if (!(state->flags & MSG_PEEK)) {
2481 unix_state_unlock(sk);
2483 chunk = state->recv_actor(oob_skb, 0, chunk, state);
2485 if (!(state->flags & MSG_PEEK)) {
2486 UNIXCB(oob_skb).consumed += 1;
2490 mutex_unlock(&u->iolock);
2495 state->msg->msg_flags |= MSG_OOB;
2499 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
2500 int flags, int copied)
2502 struct unix_sock *u = unix_sk(sk);
2504 if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
2505 skb_unlink(skb, &sk->sk_receive_queue);
2509 if (skb == u->oob_skb) {
2512 } else if (sock_flag(sk, SOCK_URGINLINE)) {
2513 if (!(flags & MSG_PEEK)) {
2517 } else if (!(flags & MSG_PEEK)) {
2518 skb_unlink(skb, &sk->sk_receive_queue);
2520 skb = skb_peek(&sk->sk_receive_queue);
2528 static int unix_stream_read_sock(struct sock *sk, read_descriptor_t *desc,
2529 sk_read_actor_t recv_actor)
2531 if (unlikely(sk->sk_state != TCP_ESTABLISHED))
2534 return unix_read_sock(sk, desc, recv_actor);
2537 static int unix_stream_read_generic(struct unix_stream_read_state *state,
2540 struct scm_cookie scm;
2541 struct socket *sock = state->socket;
2542 struct sock *sk = sock->sk;
2543 struct unix_sock *u = unix_sk(sk);
2545 int flags = state->flags;
2546 int noblock = flags & MSG_DONTWAIT;
2547 bool check_creds = false;
2552 size_t size = state->size;
2553 unsigned int last_len;
2555 if (unlikely(sk->sk_state != TCP_ESTABLISHED)) {
2560 if (unlikely(flags & MSG_OOB)) {
2562 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
2563 err = unix_stream_recv_urg(state);
2568 target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
2569 timeo = sock_rcvtimeo(sk, noblock);
2571 memset(&scm, 0, sizeof(scm));
2573 /* Lock the socket to prevent queue disordering
2574 * while sleeps in memcpy_tomsg
2576 mutex_lock(&u->iolock);
2578 skip = max(sk_peek_offset(sk, flags), 0);
2583 struct sk_buff *skb, *last;
2586 unix_state_lock(sk);
2587 if (sock_flag(sk, SOCK_DEAD)) {
2591 last = skb = skb_peek(&sk->sk_receive_queue);
2592 last_len = last ? last->len : 0;
2594 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
2596 skb = manage_oob(skb, sk, flags, copied);
2598 unix_state_unlock(sk);
2607 if (copied >= target)
2611 * POSIX 1003.1g mandates this order.
2614 err = sock_error(sk);
2617 if (sk->sk_shutdown & RCV_SHUTDOWN)
2620 unix_state_unlock(sk);
2626 mutex_unlock(&u->iolock);
2628 timeo = unix_stream_data_wait(sk, timeo, last,
2629 last_len, freezable);
2631 if (signal_pending(current)) {
2632 err = sock_intr_errno(timeo);
2637 mutex_lock(&u->iolock);
2640 unix_state_unlock(sk);
2644 while (skip >= unix_skb_len(skb)) {
2645 skip -= unix_skb_len(skb);
2647 last_len = skb->len;
2648 skb = skb_peek_next(skb, &sk->sk_receive_queue);
2653 unix_state_unlock(sk);
2656 /* Never glue messages from different writers */
2657 if (!unix_skb_scm_eq(skb, &scm))
2659 } else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
2660 /* Copy credentials */
2661 scm_set_cred(&scm, UNIXCB(skb).pid, UNIXCB(skb).uid, UNIXCB(skb).gid);
2662 unix_set_secdata(&scm, skb);
2666 /* Copy address just once */
2667 if (state->msg && state->msg->msg_name) {
2668 DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr,
2669 state->msg->msg_name);
2670 unix_copy_addr(state->msg, skb->sk);
2674 chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
2676 chunk = state->recv_actor(skb, skip, chunk, state);
2677 drop_skb = !unix_skb_len(skb);
2678 /* skb is only safe to use if !drop_skb */
2689 /* the skb was touched by a concurrent reader;
2690 * we should not expect anything from this skb
2691 * anymore and assume it invalid - we can be
2692 * sure it was dropped from the socket queue
2694 * let's report a short read
2700 /* Mark read part of skb as used */
2701 if (!(flags & MSG_PEEK)) {
2702 UNIXCB(skb).consumed += chunk;
2704 sk_peek_offset_bwd(sk, chunk);
2706 if (UNIXCB(skb).fp) {
2707 scm_stat_del(sk, skb);
2708 unix_detach_fds(&scm, skb);
2711 if (unix_skb_len(skb))
2714 skb_unlink(skb, &sk->sk_receive_queue);
2720 /* It is questionable, see note in unix_dgram_recvmsg.
2723 unix_peek_fds(&scm, skb);
2725 sk_peek_offset_fwd(sk, chunk);
2732 last_len = skb->len;
2733 unix_state_lock(sk);
2734 skb = skb_peek_next(skb, &sk->sk_receive_queue);
2737 unix_state_unlock(sk);
2742 mutex_unlock(&u->iolock);
2744 scm_recv(sock, state->msg, &scm, flags);
2748 return copied ? : err;
2751 static int unix_stream_read_actor(struct sk_buff *skb,
2752 int skip, int chunk,
2753 struct unix_stream_read_state *state)
2757 ret = skb_copy_datagram_msg(skb, UNIXCB(skb).consumed + skip,
2759 return ret ?: chunk;
2762 int __unix_stream_recvmsg(struct sock *sk, struct msghdr *msg,
2763 size_t size, int flags)
2765 struct unix_stream_read_state state = {
2766 .recv_actor = unix_stream_read_actor,
2767 .socket = sk->sk_socket,
2773 return unix_stream_read_generic(&state, true);
2776 static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg,
2777 size_t size, int flags)
2779 struct unix_stream_read_state state = {
2780 .recv_actor = unix_stream_read_actor,
2787 #ifdef CONFIG_BPF_SYSCALL
2788 struct sock *sk = sock->sk;
2789 const struct proto *prot = READ_ONCE(sk->sk_prot);
2791 if (prot != &unix_stream_proto)
2792 return prot->recvmsg(sk, msg, size, flags & MSG_DONTWAIT,
2793 flags & ~MSG_DONTWAIT, NULL);
2795 return unix_stream_read_generic(&state, true);
2798 static int unix_stream_splice_actor(struct sk_buff *skb,
2799 int skip, int chunk,
2800 struct unix_stream_read_state *state)
2802 return skb_splice_bits(skb, state->socket->sk,
2803 UNIXCB(skb).consumed + skip,
2804 state->pipe, chunk, state->splice_flags);
2807 static ssize_t unix_stream_splice_read(struct socket *sock, loff_t *ppos,
2808 struct pipe_inode_info *pipe,
2809 size_t size, unsigned int flags)
2811 struct unix_stream_read_state state = {
2812 .recv_actor = unix_stream_splice_actor,
2816 .splice_flags = flags,
2819 if (unlikely(*ppos))
2822 if (sock->file->f_flags & O_NONBLOCK ||
2823 flags & SPLICE_F_NONBLOCK)
2824 state.flags = MSG_DONTWAIT;
2826 return unix_stream_read_generic(&state, false);
2829 static int unix_shutdown(struct socket *sock, int mode)
2831 struct sock *sk = sock->sk;
2834 if (mode < SHUT_RD || mode > SHUT_RDWR)
2837 * SHUT_RD (0) -> RCV_SHUTDOWN (1)
2838 * SHUT_WR (1) -> SEND_SHUTDOWN (2)
2839 * SHUT_RDWR (2) -> SHUTDOWN_MASK (3)
2843 unix_state_lock(sk);
2844 sk->sk_shutdown |= mode;
2845 other = unix_peer(sk);
2848 unix_state_unlock(sk);
2849 sk->sk_state_change(sk);
2852 (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)) {
2855 const struct proto *prot = READ_ONCE(other->sk_prot);
2858 prot->unhash(other);
2859 if (mode&RCV_SHUTDOWN)
2860 peer_mode |= SEND_SHUTDOWN;
2861 if (mode&SEND_SHUTDOWN)
2862 peer_mode |= RCV_SHUTDOWN;
2863 unix_state_lock(other);
2864 other->sk_shutdown |= peer_mode;
2865 unix_state_unlock(other);
2866 other->sk_state_change(other);
2867 if (peer_mode == SHUTDOWN_MASK) {
2868 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP);
2869 other->sk_state = TCP_CLOSE;
2870 } else if (peer_mode & RCV_SHUTDOWN) {
2871 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN);
2880 long unix_inq_len(struct sock *sk)
2882 struct sk_buff *skb;
2885 if (sk->sk_state == TCP_LISTEN)
2888 spin_lock(&sk->sk_receive_queue.lock);
2889 if (sk->sk_type == SOCK_STREAM ||
2890 sk->sk_type == SOCK_SEQPACKET) {
2891 skb_queue_walk(&sk->sk_receive_queue, skb)
2892 amount += unix_skb_len(skb);
2894 skb = skb_peek(&sk->sk_receive_queue);
2898 spin_unlock(&sk->sk_receive_queue.lock);
2902 EXPORT_SYMBOL_GPL(unix_inq_len);
2904 long unix_outq_len(struct sock *sk)
2906 return sk_wmem_alloc_get(sk);
2908 EXPORT_SYMBOL_GPL(unix_outq_len);
2910 static int unix_open_file(struct sock *sk)
2916 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2919 if (!smp_load_acquire(&unix_sk(sk)->addr))
2922 path = unix_sk(sk)->path;
2928 fd = get_unused_fd_flags(O_CLOEXEC);
2932 f = dentry_open(&path, O_PATH, current_cred());
2946 static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
2948 struct sock *sk = sock->sk;
2954 amount = unix_outq_len(sk);
2955 err = put_user(amount, (int __user *)arg);
2958 amount = unix_inq_len(sk);
2962 err = put_user(amount, (int __user *)arg);
2965 err = unix_open_file(sk);
2967 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
2970 struct sk_buff *skb;
2971 struct unix_sock *u = unix_sk(sk);
2974 skb = skb_peek(&sk->sk_receive_queue);
2975 if (skb && skb == u->oob_skb)
2977 err = put_user(answ, (int __user *)arg);
2988 #ifdef CONFIG_COMPAT
2989 static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
2991 return unix_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
2995 static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait)
2997 struct sock *sk = sock->sk;
3000 sock_poll_wait(file, sock, wait);
3003 /* exceptional events? */
3006 if (sk->sk_shutdown == SHUTDOWN_MASK)
3008 if (sk->sk_shutdown & RCV_SHUTDOWN)
3009 mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
3012 if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
3013 mask |= EPOLLIN | EPOLLRDNORM;
3015 /* Connection-based need to check for termination and startup */
3016 if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) &&
3017 sk->sk_state == TCP_CLOSE)
3021 * we set writable also when the other side has shut down the
3022 * connection. This prevents stuck sockets.
3024 if (unix_writable(sk))
3025 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
3030 static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
3033 struct sock *sk = sock->sk, *other;
3034 unsigned int writable;
3037 sock_poll_wait(file, sock, wait);
3040 /* exceptional events? */
3041 if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
3043 (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
3045 if (sk->sk_shutdown & RCV_SHUTDOWN)
3046 mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
3047 if (sk->sk_shutdown == SHUTDOWN_MASK)
3051 if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
3052 mask |= EPOLLIN | EPOLLRDNORM;
3054 /* Connection-based need to check for termination and startup */
3055 if (sk->sk_type == SOCK_SEQPACKET) {
3056 if (sk->sk_state == TCP_CLOSE)
3058 /* connection hasn't started yet? */
3059 if (sk->sk_state == TCP_SYN_SENT)
3063 /* No write status requested, avoid expensive OUT tests. */
3064 if (!(poll_requested_events(wait) & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT)))
3067 writable = unix_writable(sk);
3069 unix_state_lock(sk);
3071 other = unix_peer(sk);
3072 if (other && unix_peer(other) != sk &&
3073 unix_recvq_full(other) &&
3074 unix_dgram_peer_wake_me(sk, other))
3077 unix_state_unlock(sk);
3081 mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
3083 sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
3088 #ifdef CONFIG_PROC_FS
3090 #define BUCKET_SPACE (BITS_PER_LONG - (UNIX_HASH_BITS + 1) - 1)
3092 #define get_bucket(x) ((x) >> BUCKET_SPACE)
3093 #define get_offset(x) ((x) & ((1L << BUCKET_SPACE) - 1))
3094 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
3096 static struct sock *unix_from_bucket(struct seq_file *seq, loff_t *pos)
3098 unsigned long offset = get_offset(*pos);
3099 unsigned long bucket = get_bucket(*pos);
3101 unsigned long count = 0;
3103 for (sk = sk_head(&unix_socket_table[bucket]); sk; sk = sk_next(sk)) {
3104 if (sock_net(sk) != seq_file_net(seq))
3106 if (++count == offset)
3113 static struct sock *unix_next_socket(struct seq_file *seq,
3117 unsigned long bucket;
3119 while (sk > (struct sock *)SEQ_START_TOKEN) {
3123 if (sock_net(sk) == seq_file_net(seq))
3128 sk = unix_from_bucket(seq, pos);
3133 bucket = get_bucket(*pos) + 1;
3134 *pos = set_bucket_offset(bucket, 1);
3135 } while (bucket < ARRAY_SIZE(unix_socket_table));
3140 static void *unix_seq_start(struct seq_file *seq, loff_t *pos)
3141 __acquires(unix_table_lock)
3143 spin_lock(&unix_table_lock);
3146 return SEQ_START_TOKEN;
3148 if (get_bucket(*pos) >= ARRAY_SIZE(unix_socket_table))
3151 return unix_next_socket(seq, NULL, pos);
3154 static void *unix_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3157 return unix_next_socket(seq, v, pos);
3160 static void unix_seq_stop(struct seq_file *seq, void *v)
3161 __releases(unix_table_lock)
3163 spin_unlock(&unix_table_lock);
3166 static int unix_seq_show(struct seq_file *seq, void *v)
3169 if (v == SEQ_START_TOKEN)
3170 seq_puts(seq, "Num RefCount Protocol Flags Type St "
3174 struct unix_sock *u = unix_sk(s);
3177 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
3179 refcount_read(&s->sk_refcnt),
3181 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
3184 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTED : SS_UNCONNECTED) :
3185 (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
3188 if (u->addr) { // under unix_table_lock here
3193 len = u->addr->len - sizeof(short);
3194 if (!UNIX_ABSTRACT(s))
3200 for ( ; i < len; i++)
3201 seq_putc(seq, u->addr->name->sun_path[i] ?:
3204 unix_state_unlock(s);
3205 seq_putc(seq, '\n');
3211 static const struct seq_operations unix_seq_ops = {
3212 .start = unix_seq_start,
3213 .next = unix_seq_next,
3214 .stop = unix_seq_stop,
3215 .show = unix_seq_show,
3218 #if IS_BUILTIN(CONFIG_UNIX) && defined(CONFIG_BPF_SYSCALL)
3219 struct bpf_iter__unix {
3220 __bpf_md_ptr(struct bpf_iter_meta *, meta);
3221 __bpf_md_ptr(struct unix_sock *, unix_sk);
3222 uid_t uid __aligned(8);
3225 static int unix_prog_seq_show(struct bpf_prog *prog, struct bpf_iter_meta *meta,
3226 struct unix_sock *unix_sk, uid_t uid)
3228 struct bpf_iter__unix ctx;
3230 meta->seq_num--; /* skip SEQ_START_TOKEN */
3232 ctx.unix_sk = unix_sk;
3234 return bpf_iter_run_prog(prog, &ctx);
3237 static int bpf_iter_unix_seq_show(struct seq_file *seq, void *v)
3239 struct bpf_iter_meta meta;
3240 struct bpf_prog *prog;
3241 struct sock *sk = v;
3244 if (v == SEQ_START_TOKEN)
3247 uid = from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk));
3249 prog = bpf_iter_get_info(&meta, false);
3250 return unix_prog_seq_show(prog, &meta, v, uid);
3253 static void bpf_iter_unix_seq_stop(struct seq_file *seq, void *v)
3255 struct bpf_iter_meta meta;
3256 struct bpf_prog *prog;
3260 prog = bpf_iter_get_info(&meta, true);
3262 (void)unix_prog_seq_show(prog, &meta, v, 0);
3265 unix_seq_stop(seq, v);
3268 static const struct seq_operations bpf_iter_unix_seq_ops = {
3269 .start = unix_seq_start,
3270 .next = unix_seq_next,
3271 .stop = bpf_iter_unix_seq_stop,
3272 .show = bpf_iter_unix_seq_show,
3277 static const struct net_proto_family unix_family_ops = {
3279 .create = unix_create,
3280 .owner = THIS_MODULE,
3284 static int __net_init unix_net_init(struct net *net)
3286 int error = -ENOMEM;
3288 net->unx.sysctl_max_dgram_qlen = 10;
3289 if (unix_sysctl_register(net))
3292 #ifdef CONFIG_PROC_FS
3293 if (!proc_create_net("unix", 0, net->proc_net, &unix_seq_ops,
3294 sizeof(struct seq_net_private))) {
3295 unix_sysctl_unregister(net);
3304 static void __net_exit unix_net_exit(struct net *net)
3306 unix_sysctl_unregister(net);
3307 remove_proc_entry("unix", net->proc_net);
3310 static struct pernet_operations unix_net_ops = {
3311 .init = unix_net_init,
3312 .exit = unix_net_exit,
3315 #if IS_BUILTIN(CONFIG_UNIX) && defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
3316 DEFINE_BPF_ITER_FUNC(unix, struct bpf_iter_meta *meta,
3317 struct unix_sock *unix_sk, uid_t uid)
3319 static const struct bpf_iter_seq_info unix_seq_info = {
3320 .seq_ops = &bpf_iter_unix_seq_ops,
3321 .init_seq_private = bpf_iter_init_seq_net,
3322 .fini_seq_private = bpf_iter_fini_seq_net,
3323 .seq_priv_size = sizeof(struct seq_net_private),
3326 static struct bpf_iter_reg unix_reg_info = {
3328 .ctx_arg_info_size = 1,
3330 { offsetof(struct bpf_iter__unix, unix_sk),
3331 PTR_TO_BTF_ID_OR_NULL },
3333 .seq_info = &unix_seq_info,
3336 static void __init bpf_iter_register(void)
3338 unix_reg_info.ctx_arg_info[0].btf_id = btf_sock_ids[BTF_SOCK_TYPE_UNIX];
3339 if (bpf_iter_reg_target(&unix_reg_info))
3340 pr_warn("Warning: could not register bpf iterator unix\n");
3344 static int __init af_unix_init(void)
3348 BUILD_BUG_ON(sizeof(struct unix_skb_parms) > sizeof_field(struct sk_buff, cb));
3350 rc = proto_register(&unix_dgram_proto, 1);
3352 pr_crit("%s: Cannot create unix_sock SLAB cache!\n", __func__);
3356 rc = proto_register(&unix_stream_proto, 1);
3358 pr_crit("%s: Cannot create unix_sock SLAB cache!\n", __func__);
3362 sock_register(&unix_family_ops);
3363 register_pernet_subsys(&unix_net_ops);
3364 unix_bpf_build_proto();
3366 #if IS_BUILTIN(CONFIG_UNIX) && defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
3367 bpf_iter_register();
3374 static void __exit af_unix_exit(void)
3376 sock_unregister(PF_UNIX);
3377 proto_unregister(&unix_dgram_proto);
3378 proto_unregister(&unix_stream_proto);
3379 unregister_pernet_subsys(&unix_net_ops);
3382 /* Earlier than device_initcall() so that other drivers invoking
3383 request_module() don't end up in a loop when modprobe tries
3384 to use a UNIX socket. But later than subsys_initcall() because
3385 we depend on stuff initialised there */
3386 fs_initcall(af_unix_init);
3387 module_exit(af_unix_exit);
3389 MODULE_LICENSE("GPL");
3390 MODULE_ALIAS_NETPROTO(PF_UNIX);