1 /*
2 * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1989, 1990, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * sendfile(2) and related extensions:
33 * Copyright (c) 1998, David Greenman. All rights reserved.
34 *
35 * Redistribution and use in source and binary forms, with or without
36 * modification, are permitted provided that the following conditions
37 * are met:
38 * 1. Redistributions of source code must retain the above copyright
39 * notice, this list of conditions and the following disclaimer.
40 * 2. Redistributions in binary form must reproduce the above copyright
41 * notice, this list of conditions and the following disclaimer in the
42 * documentation and/or other materials provided with the distribution.
43 * 3. All advertising materials mentioning features or use of this software
44 * must display the following acknowledgement:
45 * This product includes software developed by the University of
46 * California, Berkeley and its contributors.
47 * 4. Neither the name of the University nor the names of its contributors
48 * may be used to endorse or promote products derived from this software
49 * without specific prior written permission.
50 *
51 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
52 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
53 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
54 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
55 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
56 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
57 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
58 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
59 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
60 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
61 * SUCH DAMAGE.
62 *
63 * @(#)uipc_syscalls.c 8.4 (Berkeley) 2/21/94
64 */
65 /*
66 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
67 * support for mandatory and extensible security protections. This notice
68 * is included in support of clause 2.2 (b) of the Apple Public License,
69 * Version 2.0.
70 */
71
72 #include <sys/cdefs.h>
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/filedesc.h>
76 #include <sys/proc_internal.h>
77 #include <sys/file_internal.h>
78 #include <sys/vnode_internal.h>
79 #include <sys/malloc.h>
80 #include <sys/mcache.h>
81 #include <sys/mbuf.h>
82 #include <kern/locks.h>
83 #include <sys/domain.h>
84 #include <sys/protosw.h>
85 #include <sys/signalvar.h>
86 #include <sys/socket.h>
87 #include <sys/socketvar.h>
88 #include <sys/kernel.h>
89 #include <sys/uio_internal.h>
90 #include <sys/kauth.h>
91 #include <kern/task.h>
92 #include <sys/priv.h>
93 #include <sys/sysctl.h>
94 #include <sys/sys_domain.h>
95 #include <sys/types.h>
96
97 #include <security/audit/audit.h>
98
99 #include <sys/kdebug.h>
100 #include <sys/sysproto.h>
101 #include <netinet/in.h>
102 #include <net/route.h>
103 #include <netinet/in_pcb.h>
104
105 #include <os/log.h>
106 #include <os/ptrtools.h>
107
108 #include <os/log.h>
109
110 #if CONFIG_MACF_SOCKET_SUBSET
111 #include <security/mac_framework.h>
112 #endif /* MAC_SOCKET_SUBSET */
113
114 #define f_flag fp_glob->fg_flag
115 #define f_ops fp_glob->fg_ops
116
117 #define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETSOCK, 0)
118 #define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETSOCK, 2)
119 #define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETSOCK, 1)
120 #define DBG_LAYER_OUT_END NETDBG_CODE(DBG_NETSOCK, 3)
121 #define DBG_FNC_SENDMSG NETDBG_CODE(DBG_NETSOCK, (1 << 8) | 1)
122 #define DBG_FNC_SENDTO NETDBG_CODE(DBG_NETSOCK, (2 << 8) | 1)
123 #define DBG_FNC_SENDIT NETDBG_CODE(DBG_NETSOCK, (3 << 8) | 1)
124 #define DBG_FNC_RECVFROM NETDBG_CODE(DBG_NETSOCK, (5 << 8))
125 #define DBG_FNC_RECVMSG NETDBG_CODE(DBG_NETSOCK, (6 << 8))
126 #define DBG_FNC_RECVIT NETDBG_CODE(DBG_NETSOCK, (7 << 8))
127 #define DBG_FNC_SENDFILE NETDBG_CODE(DBG_NETSOCK, (10 << 8))
128 #define DBG_FNC_SENDFILE_WAIT NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 1))
129 #define DBG_FNC_SENDFILE_READ NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 2))
130 #define DBG_FNC_SENDFILE_SEND NETDBG_CODE(DBG_NETSOCK, ((10 << 8) | 3))
131 #define DBG_FNC_SENDMSG_X NETDBG_CODE(DBG_NETSOCK, (11 << 8))
132 #define DBG_FNC_RECVMSG_X NETDBG_CODE(DBG_NETSOCK, (12 << 8))
133
134 /* Forward declarations for referenced types */
135 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(void, void, __CCT_PTR);
136 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(uint8_t, uint8_t, __CCT_PTR);
137 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(int32_t, int32, __CCT_REF);
138 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(int, int, __CCT_REF);
139 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(user_ssize_t, user_ssize, __CCT_REF);
140 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(unsigned int, uint, __CCT_REF);
141 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(sae_connid_t, sae_connid, __CCT_REF);
142 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(socklen_t, socklen, __CCT_REF);
143 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct setsockopt_args, setsockopt_args, __CCT_REF);
144 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct connectx_args, connectx_args, __CCT_REF);
145 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct disconnectx_args, disconnectx_args, __CCT_REF);
146 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct cmsghdr, cmsghdr, __CCT_REF);
147 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct timeval, timeval, __CCT_REF);
148 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct user64_timeval, user64_timeval, __CCT_REF);
149 __CCT_DECLARE_CONSTRAINED_PTR_TYPE(struct user32_timeval, user32_timeval, __CCT_REF);
150
151 static int sendit(proc_ref_t, socket_ref_t, user_msghdr_ref_t, uio_t,
152 int, int32_ref_t );
153 static int recvit(proc_ref_t, int, user_msghdr_ref_t, uio_t, user_addr_t,
154 int32_ref_t);
155 static int connectit(socket_ref_t, sockaddr_ref_t);
156 static int getsockaddr(socket_ref_t, sockaddr_ref_ref_t, user_addr_t,
157 size_t, boolean_t);
158 static int getsockaddr_s(socket_ref_t, sockaddr_storage_ref_t,
159 user_addr_t, size_t, boolean_t);
160 #if SENDFILE
161 static void alloc_sendpkt(int, size_t, uint_ref_t, mbuf_ref_ref_t,
162 boolean_t);
163 #endif /* SENDFILE */
164 static int connectx_nocancel(proc_ref_t, connectx_args_ref_t, int_ref_t);
165 static int connectitx(socket_ref_t, sockaddr_ref_t,
166 sockaddr_ref_t, proc_ref_t, uint32_t, sae_associd_t,
167 sae_connid_ref_t, uio_t, unsigned int, user_ssize_ref_t);
168 static int disconnectx_nocancel(proc_ref_t, disconnectx_args_ref_t,
169 int_ref_t);
170 static int socket_common(proc_ref_t, int, int, int, pid_t, int32_ref_t, int);
171
172 #if DEBUG || DEVELOPMENT
173 static int internalize_user_msghdr_array(const void_ptr_t, int, int,
174 u_int count, user_msghdr_x_ptr_t, uio_ref_ptr_t);
175
176 static void externalize_user_msghdr_array(void_ptr_t, int, int, u_int count,
177 const user_msghdr_x_ptr_t, uio_ref_ptr_t);
178
179 static void free_uio_array(uio_ref_ptr_t, u_int count);
180 static boolean_t uio_array_is_valid(uio_ref_ptr_t, u_int count);
181 #endif /* DEBUG || DEVELOPMENT */
182 static int internalize_recv_msghdr_array(const void_ptr_t, int, int,
183 u_int count, user_msghdr_x_ptr_t, recv_msg_elem_ptr_t);
184 static u_int externalize_recv_msghdr_array(proc_ref_t, socket_ref_t, void_ptr_t,
185 u_int count, user_msghdr_x_ptr_t, recv_msg_elem_ptr_t, int_ref_t);
186
187 static recv_msg_elem_ptr_t alloc_recv_msg_array(u_int count);
188 static int recv_msg_array_is_valid(recv_msg_elem_ptr_t, u_int count);
189 static void free_recv_msg_array(recv_msg_elem_ptr_t, u_int count);
190 static int copyout_control(proc_ref_t, mbuf_ref_t, user_addr_t control,
191 socklen_ref_t, int_ref_t, socket_ref_t);
192
193 SYSCTL_DECL(_kern_ipc);
194
195 #define SO_MAX_MSG_X_DEFAULT 256
196
197 static u_int somaxsendmsgx = SO_MAX_MSG_X_DEFAULT;
198 SYSCTL_UINT(_kern_ipc, OID_AUTO, maxsendmsgx,
199 CTLFLAG_RW | CTLFLAG_LOCKED, &somaxsendmsgx, 0, "");
200
201 static u_int somaxrecvmsgx = SO_MAX_MSG_X_DEFAULT;
202 SYSCTL_UINT(_kern_ipc, OID_AUTO, maxrecvmsgx,
203 CTLFLAG_RW | CTLFLAG_LOCKED, &somaxrecvmsgx, 0, "");
204
205 static u_int missingpktinfo = 0;
206 SYSCTL_UINT(_kern_ipc, OID_AUTO, missingpktinfo,
207 CTLFLAG_RD | CTLFLAG_LOCKED, &missingpktinfo, 0, "");
208
209 static int do_recvmsg_x_donttrunc = 0;
210 SYSCTL_INT(_kern_ipc, OID_AUTO, do_recvmsg_x_donttrunc,
211 CTLFLAG_RW | CTLFLAG_LOCKED, &do_recvmsg_x_donttrunc, 0, "");
212
213 #if DEBUG || DEVELOPMENT
214 static int uipc_debug = 0;
215 SYSCTL_INT(_kern_ipc, OID_AUTO, debug,
216 CTLFLAG_RW | CTLFLAG_LOCKED, &uipc_debug, 0, "");
217
218 #define DEBUG_KERNEL_ADDRPERM(_v) (_v)
219 #define DBG_PRINTF(...) if (uipc_debug != 0) { \
220 os_log(OS_LOG_DEFAULT, __VA_ARGS__); \
221 }
222 #else
223 #define DEBUG_KERNEL_ADDRPERM(_v) VM_KERNEL_ADDRPERM(_v)
224 #define DBG_PRINTF(...) do { } while (0)
225 #endif
226
227
228 /*
229 * Values for sendmsg_x_mode
230 * 0: default
231 * 1: sendit loop one at a time
232 * 2: old implementation
233 */
234 static u_int sendmsg_x_mode = 0;
235 SYSCTL_UINT(_kern_ipc, OID_AUTO, sendmsg_x_mode,
236 CTLFLAG_RW | CTLFLAG_LOCKED, &sendmsg_x_mode, 0, "");
237
238 /*
239 * System call interface to the socket abstraction.
240 */
241
242 extern const struct fileops socketops;
243
244 /*
245 * Returns: 0 Success
246 * EACCES Mandatory Access Control failure
247 * falloc:ENFILE
248 * falloc:EMFILE
249 * falloc:ENOMEM
250 * socreate:EAFNOSUPPORT
251 * socreate:EPROTOTYPE
252 * socreate:EPROTONOSUPPORT
253 * socreate:ENOBUFS
254 * socreate:ENOMEM
255 * socreate:??? [other protocol families, IPSEC]
256 */
257 int
socket(proc_ref_t p,struct socket_args * uap,int32_ref_t retval)258 socket(proc_ref_t p,
259 struct socket_args *uap,
260 int32_ref_t retval)
261 {
262 return socket_common(p, uap->domain, uap->type, uap->protocol,
263 proc_selfpid(), retval, 0);
264 }
265
266 int
socket_delegate(proc_ref_t p,struct socket_delegate_args * uap,int32_ref_t retval)267 socket_delegate(proc_ref_t p,
268 struct socket_delegate_args *uap,
269 int32_ref_t retval)
270 {
271 return socket_common(p, uap->domain, uap->type, uap->protocol,
272 uap->epid, retval, 1);
273 }
274
275 static int
socket_common(proc_ref_t p,int domain,int type,int protocol,pid_t epid,int32_ref_t retval,int delegate)276 socket_common(proc_ref_t p,
277 int domain,
278 int type,
279 int protocol,
280 pid_t epid,
281 int32_ref_t retval,
282 int delegate)
283 {
284 socket_ref_t so;
285 fileproc_ref_t fp;
286 int fd, error;
287
288 AUDIT_ARG(socket, domain, type, protocol);
289 #if CONFIG_MACF_SOCKET_SUBSET
290 if ((error = mac_socket_check_create(kauth_cred_get(), domain,
291 type, protocol)) != 0) {
292 return error;
293 }
294 #endif /* MAC_SOCKET_SUBSET */
295
296 if (delegate) {
297 error = priv_check_cred(kauth_cred_get(),
298 PRIV_NET_PRIVILEGED_SOCKET_DELEGATE, 0);
299 if (error) {
300 return EACCES;
301 }
302 }
303
304 error = falloc(p, &fp, &fd, vfs_context_current());
305 if (error) {
306 return error;
307 }
308 fp->f_flag = FREAD | FWRITE;
309 fp->f_ops = &socketops;
310
311 if (delegate) {
312 error = socreate_delegate(domain, &so, type, protocol, epid);
313 } else {
314 error = socreate(domain, &so, type, protocol);
315 }
316
317 if (error) {
318 fp_free(p, fd, fp);
319 } else {
320 fp_set_data(fp, so);
321
322 proc_fdlock(p);
323 procfdtbl_releasefd(p, fd, NULL);
324
325 if (ENTR_SHOULDTRACE) {
326 KERNEL_ENERGYTRACE(kEnTrActKernSocket, DBG_FUNC_START,
327 fd, 0, (int64_t)VM_KERNEL_ADDRPERM(so));
328 }
329 fp_drop(p, fd, fp, 1);
330 proc_fdunlock(p);
331
332 *retval = fd;
333 }
334 return error;
335 }
336
337 /*
338 * Returns: 0 Success
339 * EDESTADDRREQ Destination address required
340 * EBADF Bad file descriptor
341 * EACCES Mandatory Access Control failure
342 * file_socket:ENOTSOCK
343 * file_socket:EBADF
344 * getsockaddr:ENAMETOOLONG Filename too long
345 * getsockaddr:EINVAL Invalid argument
346 * getsockaddr:ENOMEM Not enough space
347 * getsockaddr:EFAULT Bad address
348 * sobindlock:???
349 */
350 /* ARGSUSED */
351 int
bind(__unused proc_t p,struct bind_args * uap,__unused int32_ref_t retval)352 bind(__unused proc_t p, struct bind_args *uap, __unused int32_ref_t retval)
353 {
354 struct sockaddr_storage ss;
355 sockaddr_ref_t sa = NULL;
356 socket_ref_t so;
357 boolean_t want_free = TRUE;
358 int error;
359
360 AUDIT_ARG(fd, uap->s);
361 error = file_socket(uap->s, &so);
362 if (error != 0) {
363 return error;
364 }
365 if (so == NULL) {
366 error = EBADF;
367 goto out;
368 }
369 if (uap->name == USER_ADDR_NULL) {
370 error = EDESTADDRREQ;
371 goto out;
372 }
373 if (uap->namelen > sizeof(ss)) {
374 error = getsockaddr(so, &sa, uap->name, uap->namelen, TRUE);
375 } else {
376 error = getsockaddr_s(so, &ss, uap->name, uap->namelen, TRUE);
377 if (error == 0) {
378 sa = (sockaddr_ref_t)&ss;
379 want_free = FALSE;
380 }
381 }
382 if (error != 0) {
383 goto out;
384 }
385 AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), sa);
386 #if CONFIG_MACF_SOCKET_SUBSET
387 if ((sa != NULL && sa->sa_family == AF_SYSTEM) ||
388 (error = mac_socket_check_bind(kauth_cred_get(), so, sa)) == 0) {
389 error = sobindlock(so, sa, 1); /* will lock socket */
390 }
391 #else
392 error = sobindlock(so, sa, 1); /* will lock socket */
393 #endif /* MAC_SOCKET_SUBSET */
394 if (want_free) {
395 free_sockaddr(sa);
396 }
397 out:
398 file_drop(uap->s);
399 return error;
400 }
401
402 /*
403 * Returns: 0 Success
404 * EBADF
405 * EACCES Mandatory Access Control failure
406 * file_socket:ENOTSOCK
407 * file_socket:EBADF
408 * solisten:EINVAL
409 * solisten:EOPNOTSUPP
410 * solisten:???
411 */
412 int
listen(__unused proc_ref_t p,struct listen_args * uap,__unused int32_ref_t retval)413 listen(__unused proc_ref_t p, struct listen_args *uap,
414 __unused int32_ref_t retval)
415 {
416 int error;
417 socket_ref_t so;
418
419 AUDIT_ARG(fd, uap->s);
420 error = file_socket(uap->s, &so);
421 if (error) {
422 return error;
423 }
424 if (so != NULL)
425 #if CONFIG_MACF_SOCKET_SUBSET
426 {
427 error = mac_socket_check_listen(kauth_cred_get(), so);
428 if (error == 0) {
429 error = solisten(so, uap->backlog);
430 }
431 }
432 #else
433 { error = solisten(so, uap->backlog);}
434 #endif /* MAC_SOCKET_SUBSET */
435 else {
436 error = EBADF;
437 }
438
439 file_drop(uap->s);
440 return error;
441 }
442
443 /*
444 * Returns: fp_get_ftype:EBADF Bad file descriptor
445 * fp_get_ftype:ENOTSOCK Socket operation on non-socket
446 * :EFAULT Bad address on copyin/copyout
447 * :EBADF Bad file descriptor
448 * :EOPNOTSUPP Operation not supported on socket
449 * :EINVAL Invalid argument
450 * :EWOULDBLOCK Operation would block
451 * :ECONNABORTED Connection aborted
452 * :EINTR Interrupted function
453 * :EACCES Mandatory Access Control failure
454 * falloc:ENFILE Too many files open in system
455 * falloc:EMFILE Too many open files
456 * falloc:ENOMEM Not enough space
457 * 0 Success
458 */
459 int
accept_nocancel(proc_ref_t p,struct accept_nocancel_args * uap,int32_ref_t retval)460 accept_nocancel(proc_ref_t p, struct accept_nocancel_args *uap,
461 int32_ref_t retval)
462 {
463 fileproc_ref_t fp;
464 sockaddr_ref_t sa = NULL;
465 socklen_t namelen;
466 int error;
467 socket_ref_t head;
468 socket_ref_t so = NULL;
469 lck_mtx_t *mutex_held;
470 int fd = uap->s;
471 int newfd;
472 unsigned int fflag;
473 int dosocklock = 0;
474
475 *retval = -1;
476
477 AUDIT_ARG(fd, uap->s);
478
479 if (uap->name) {
480 error = copyin(uap->anamelen, (caddr_t)&namelen,
481 sizeof(socklen_t));
482 if (error) {
483 return error;
484 }
485 }
486 error = fp_get_ftype(p, fd, DTYPE_SOCKET, ENOTSOCK, &fp);
487 if (error) {
488 return error;
489 }
490 head = (struct socket *)fp_get_data(fp);
491
492 #if CONFIG_MACF_SOCKET_SUBSET
493 if ((error = mac_socket_check_accept(kauth_cred_get(), head)) != 0) {
494 goto out;
495 }
496 #endif /* MAC_SOCKET_SUBSET */
497
498 socket_lock(head, 1);
499
500 if (head->so_proto->pr_getlock != NULL) {
501 mutex_held = (*head->so_proto->pr_getlock)(head, PR_F_WILLUNLOCK);
502 dosocklock = 1;
503 } else {
504 mutex_held = head->so_proto->pr_domain->dom_mtx;
505 dosocklock = 0;
506 }
507
508 if ((head->so_options & SO_ACCEPTCONN) == 0) {
509 if ((head->so_proto->pr_flags & PR_CONNREQUIRED) == 0) {
510 error = EOPNOTSUPP;
511 } else {
512 /* POSIX: The socket is not accepting connections */
513 error = EINVAL;
514 }
515 socket_unlock(head, 1);
516 goto out;
517 }
518 check_again:
519 if ((head->so_state & SS_NBIO) && head->so_comp.tqh_first == NULL) {
520 socket_unlock(head, 1);
521 error = EWOULDBLOCK;
522 goto out;
523 }
524 while (TAILQ_EMPTY(&head->so_comp) && head->so_error == 0) {
525 if (head->so_state & SS_CANTRCVMORE) {
526 head->so_error = ECONNABORTED;
527 break;
528 }
529 if (head->so_usecount < 1) {
530 panic("accept: head=%p refcount=%d", head,
531 head->so_usecount);
532 }
533 error = msleep((caddr_t)&head->so_timeo, mutex_held,
534 PSOCK | PCATCH, "accept", 0);
535 if (head->so_usecount < 1) {
536 panic("accept: 2 head=%p refcount=%d", head,
537 head->so_usecount);
538 }
539 if ((head->so_state & SS_DRAINING)) {
540 error = ECONNABORTED;
541 }
542 if (error) {
543 socket_unlock(head, 1);
544 goto out;
545 }
546 }
547 if (head->so_error) {
548 error = head->so_error;
549 head->so_error = 0;
550 socket_unlock(head, 1);
551 goto out;
552 }
553
554 /*
555 * At this point we know that there is at least one connection
556 * ready to be accepted. Remove it from the queue prior to
557 * allocating the file descriptor for it since falloc() may
558 * block allowing another process to accept the connection
559 * instead.
560 */
561 lck_mtx_assert(mutex_held, LCK_MTX_ASSERT_OWNED);
562
563 so_acquire_accept_list(head, NULL);
564 if (TAILQ_EMPTY(&head->so_comp)) {
565 so_release_accept_list(head);
566 goto check_again;
567 }
568
569 so = TAILQ_FIRST(&head->so_comp);
570 TAILQ_REMOVE(&head->so_comp, so, so_list);
571 /*
572 * Acquire the lock of the new connection
573 * as we may be in the process of receiving
574 * a packet that may change its so_state
575 * (e.g.: a TCP FIN).
576 */
577 if (dosocklock) {
578 socket_lock(so, 0);
579 }
580 so->so_head = NULL;
581 so->so_state &= ~SS_COMP;
582 if (dosocklock) {
583 socket_unlock(so, 0);
584 }
585 head->so_qlen--;
586 so_release_accept_list(head);
587
588 /* unlock head to avoid deadlock with select, keep a ref on head */
589 socket_unlock(head, 0);
590
591 #if CONFIG_MACF_SOCKET_SUBSET
592 /*
593 * Pass the pre-accepted socket to the MAC framework. This is
594 * cheaper than allocating a file descriptor for the socket,
595 * calling the protocol accept callback, and possibly freeing
596 * the file descriptor should the MAC check fails.
597 */
598 if ((error = mac_socket_check_accepted(kauth_cred_get(), so)) != 0) {
599 socket_lock(so, 1);
600 so->so_state &= ~SS_NOFDREF;
601 socket_unlock(so, 1);
602 soclose(so);
603 /* Drop reference on listening socket */
604 sodereference(head);
605 goto out;
606 }
607 #endif /* MAC_SOCKET_SUBSET */
608
609 /*
610 * Pass the pre-accepted socket to any interested socket filter(s).
611 * Upon failure, the socket would have been closed by the callee.
612 */
613 if (so->so_filt != NULL && (error = soacceptfilter(so, head)) != 0) {
614 /* Drop reference on listening socket */
615 sodereference(head);
616 /* Propagate socket filter's error code to the caller */
617 goto out;
618 }
619
620 fflag = fp->f_flag;
621 error = falloc(p, &fp, &newfd, vfs_context_current());
622 if (error) {
623 /*
624 * Probably ran out of file descriptors.
625 *
626 * <rdar://problem/8554930>
627 * Don't put this back on the socket like we used to, that
628 * just causes the client to spin. Drop the socket.
629 */
630 socket_lock(so, 1);
631 so->so_state &= ~SS_NOFDREF;
632 socket_unlock(so, 1);
633 soclose(so);
634 sodereference(head);
635 goto out;
636 }
637 *retval = newfd;
638 fp->f_flag = fflag;
639 fp->f_ops = &socketops;
640 fp_set_data(fp, so);
641
642 socket_lock(head, 0);
643 if (dosocklock) {
644 socket_lock(so, 1);
645 }
646
647 /* Sync socket non-blocking/async state with file flags */
648 if (fp->f_flag & FNONBLOCK) {
649 so->so_state |= SS_NBIO;
650 } else {
651 so->so_state &= ~SS_NBIO;
652 }
653
654 if (fp->f_flag & FASYNC) {
655 so->so_state |= SS_ASYNC;
656 so->so_rcv.sb_flags |= SB_ASYNC;
657 so->so_snd.sb_flags |= SB_ASYNC;
658 } else {
659 so->so_state &= ~SS_ASYNC;
660 so->so_rcv.sb_flags &= ~SB_ASYNC;
661 so->so_snd.sb_flags &= ~SB_ASYNC;
662 }
663
664 (void) soacceptlock(so, &sa, 0);
665 socket_unlock(head, 1);
666 if (sa == NULL) {
667 namelen = 0;
668 if (uap->name) {
669 goto gotnoname;
670 }
671 error = 0;
672 goto releasefd;
673 }
674 AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), sa);
675
676 if (uap->name) {
677 socklen_t sa_len;
678
679 /* save sa_len before it is destroyed */
680 sa_len = sa->sa_len;
681 namelen = MIN(namelen, sa_len);
682 error = copyout(sa, uap->name, namelen);
683 if (!error) {
684 /* return the actual, untruncated address length */
685 namelen = sa_len;
686 }
687 gotnoname:
688 error = copyout((caddr_t)&namelen, uap->anamelen,
689 sizeof(socklen_t));
690 }
691 free_sockaddr(sa);
692
693 releasefd:
694 /*
695 * If the socket has been marked as inactive by sosetdefunct(),
696 * disallow further operations on it.
697 */
698 if (so->so_flags & SOF_DEFUNCT) {
699 sodefunct(current_proc(), so,
700 SHUTDOWN_SOCKET_LEVEL_DISCONNECT_INTERNAL);
701 }
702
703 if (dosocklock) {
704 socket_unlock(so, 1);
705 }
706
707 proc_fdlock(p);
708 procfdtbl_releasefd(p, newfd, NULL);
709 fp_drop(p, newfd, fp, 1);
710 proc_fdunlock(p);
711
712 out:
713 if (error == 0 && ENTR_SHOULDTRACE) {
714 KERNEL_ENERGYTRACE(kEnTrActKernSocket, DBG_FUNC_START,
715 newfd, 0, (int64_t)VM_KERNEL_ADDRPERM(so));
716 }
717
718 file_drop(fd);
719 return error;
720 }
721
722 int
accept(proc_ref_t p,struct accept_args * uap,int32_ref_t retval)723 accept(proc_ref_t p, struct accept_args *uap, int32_ref_t retval)
724 {
725 __pthread_testcancel(1);
726 return accept_nocancel(p, (struct accept_nocancel_args *)uap,
727 retval);
728 }
729
730 /*
731 * Returns: 0 Success
732 * EBADF Bad file descriptor
733 * EALREADY Connection already in progress
734 * EINPROGRESS Operation in progress
735 * ECONNABORTED Connection aborted
736 * EINTR Interrupted function
737 * EACCES Mandatory Access Control failure
738 * file_socket:ENOTSOCK
739 * file_socket:EBADF
740 * getsockaddr:ENAMETOOLONG Filename too long
741 * getsockaddr:EINVAL Invalid argument
742 * getsockaddr:ENOMEM Not enough space
743 * getsockaddr:EFAULT Bad address
744 * soconnectlock:EOPNOTSUPP
745 * soconnectlock:EISCONN
746 * soconnectlock:??? [depends on protocol, filters]
747 * msleep:EINTR
748 *
749 * Imputed: so_error error may be set from so_error, which
750 * may have been set by soconnectlock.
751 */
752 /* ARGSUSED */
753 int
connect(proc_ref_t p,struct connect_args * uap,int32_ref_t retval)754 connect(proc_ref_t p, struct connect_args *uap, int32_ref_t retval)
755 {
756 __pthread_testcancel(1);
757 return connect_nocancel(p, (struct connect_nocancel_args *)uap,
758 retval);
759 }
760
761 int
connect_nocancel(proc_t p,struct connect_nocancel_args * uap,int32_ref_t retval)762 connect_nocancel(proc_t p, struct connect_nocancel_args *uap, int32_ref_t retval)
763 {
764 #pragma unused(p, retval)
765 socket_ref_t so;
766 struct sockaddr_storage ss;
767 sockaddr_ref_t sa = NULL;
768 int error;
769 int fd = uap->s;
770 boolean_t dgram;
771
772 AUDIT_ARG(fd, uap->s);
773 error = file_socket(fd, &so);
774 if (error != 0) {
775 return error;
776 }
777 if (so == NULL) {
778 error = EBADF;
779 goto out;
780 }
781
782 /*
783 * Ask getsockaddr{_s} to not translate AF_UNSPEC to AF_INET
784 * if this is a datagram socket; translate for other types.
785 */
786 dgram = (so->so_type == SOCK_DGRAM);
787
788 /* Get socket address now before we obtain socket lock */
789 if (uap->namelen > sizeof(ss)) {
790 error = getsockaddr(so, &sa, uap->name, uap->namelen, !dgram);
791 } else {
792 error = getsockaddr_s(so, &ss, uap->name, uap->namelen, !dgram);
793 if (error == 0) {
794 sa = (sockaddr_ref_t)&ss;
795 }
796 }
797 if (error != 0) {
798 goto out;
799 }
800
801 error = connectit(so, sa);
802
803 if (sa != NULL && sa != SA(&ss)) {
804 free_sockaddr(sa);
805 }
806 if (error == ERESTART) {
807 error = EINTR;
808 }
809 out:
810 file_drop(fd);
811 return error;
812 }
813
814 static int
connectx_nocancel(proc_ref_t p,connectx_args_ref_t uap,int_ref_t retval)815 connectx_nocancel(proc_ref_t p, connectx_args_ref_t uap, int_ref_t retval)
816 {
817 #pragma unused(p, retval)
818 struct sockaddr_storage ss, sd;
819 sockaddr_ref_t src = NULL, dst = NULL;
820 socket_ref_t so;
821 int error, error1, fd = uap->socket;
822 boolean_t dgram;
823 sae_connid_t cid = SAE_CONNID_ANY;
824 struct user32_sa_endpoints ep32;
825 struct user64_sa_endpoints ep64;
826 struct user_sa_endpoints ep;
827 user_ssize_t bytes_written = 0;
828 struct user_iovec *iovp;
829 uio_t auio = NULL;
830
831 AUDIT_ARG(fd, uap->socket);
832 error = file_socket(fd, &so);
833 if (error != 0) {
834 return error;
835 }
836 if (so == NULL) {
837 error = EBADF;
838 goto out;
839 }
840
841 if (uap->endpoints == USER_ADDR_NULL) {
842 error = EINVAL;
843 goto out;
844 }
845
846 if (IS_64BIT_PROCESS(p)) {
847 error = copyin(uap->endpoints, (caddr_t)&ep64, sizeof(ep64));
848 if (error != 0) {
849 goto out;
850 }
851
852 ep.sae_srcif = ep64.sae_srcif;
853 ep.sae_srcaddr = (user_addr_t)ep64.sae_srcaddr;
854 ep.sae_srcaddrlen = ep64.sae_srcaddrlen;
855 ep.sae_dstaddr = (user_addr_t)ep64.sae_dstaddr;
856 ep.sae_dstaddrlen = ep64.sae_dstaddrlen;
857 } else {
858 error = copyin(uap->endpoints, (caddr_t)&ep32, sizeof(ep32));
859 if (error != 0) {
860 goto out;
861 }
862
863 ep.sae_srcif = ep32.sae_srcif;
864 ep.sae_srcaddr = ep32.sae_srcaddr;
865 ep.sae_srcaddrlen = ep32.sae_srcaddrlen;
866 ep.sae_dstaddr = ep32.sae_dstaddr;
867 ep.sae_dstaddrlen = ep32.sae_dstaddrlen;
868 }
869
870 /*
871 * Ask getsockaddr{_s} to not translate AF_UNSPEC to AF_INET
872 * if this is a datagram socket; translate for other types.
873 */
874 dgram = (so->so_type == SOCK_DGRAM);
875
876 /* Get socket address now before we obtain socket lock */
877 if (ep.sae_srcaddr != USER_ADDR_NULL) {
878 if (ep.sae_srcaddrlen > sizeof(ss)) {
879 error = getsockaddr(so, &src, ep.sae_srcaddr, ep.sae_srcaddrlen, dgram);
880 } else {
881 error = getsockaddr_s(so, &ss, ep.sae_srcaddr, ep.sae_srcaddrlen, dgram);
882 if (error == 0) {
883 src = (sockaddr_ref_t)&ss;
884 }
885 }
886
887 if (error) {
888 goto out;
889 }
890 }
891
892 if (ep.sae_dstaddr == USER_ADDR_NULL) {
893 error = EINVAL;
894 goto out;
895 }
896
897 /* Get socket address now before we obtain socket lock */
898 if (ep.sae_dstaddrlen > sizeof(sd)) {
899 error = getsockaddr(so, &dst, ep.sae_dstaddr, ep.sae_dstaddrlen, dgram);
900 } else {
901 error = getsockaddr_s(so, &sd, ep.sae_dstaddr, ep.sae_dstaddrlen, dgram);
902 if (error == 0) {
903 dst = (sockaddr_ref_t)&sd;
904 }
905 }
906
907 if (error) {
908 goto out;
909 }
910
911 VERIFY(dst != NULL);
912
913 if (uap->iov != USER_ADDR_NULL) {
914 /* Verify range before calling uio_create() */
915 if (uap->iovcnt <= 0 || uap->iovcnt > UIO_MAXIOV) {
916 error = EINVAL;
917 goto out;
918 }
919
920 if (uap->len == USER_ADDR_NULL) {
921 error = EINVAL;
922 goto out;
923 }
924
925 /* allocate a uio to hold the number of iovecs passed */
926 auio = uio_create(uap->iovcnt, 0,
927 (IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
928 UIO_WRITE);
929
930 if (auio == NULL) {
931 error = ENOMEM;
932 goto out;
933 }
934
935 /*
936 * get location of iovecs within the uio.
937 * then copyin the iovecs from user space.
938 */
939 iovp = uio_iovsaddr(auio);
940 if (iovp == NULL) {
941 error = ENOMEM;
942 goto out;
943 }
944 error = copyin_user_iovec_array(uap->iov,
945 IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
946 uap->iovcnt, iovp);
947 if (error != 0) {
948 goto out;
949 }
950
951 /* finish setup of uio_t */
952 error = uio_calculateresid(auio);
953 if (error != 0) {
954 goto out;
955 }
956 }
957
958 error = connectitx(so, src, dst, p, ep.sae_srcif, uap->associd,
959 &cid, auio, uap->flags, &bytes_written);
960 if (error == ERESTART) {
961 error = EINTR;
962 }
963
964 if (uap->len != USER_ADDR_NULL) {
965 if (IS_64BIT_PROCESS(p)) {
966 error1 = copyout(&bytes_written, uap->len, sizeof(user64_size_t));
967 } else {
968 error1 = copyout(&bytes_written, uap->len, sizeof(user32_size_t));
969 }
970 /* give precedence to connectitx errors */
971 if ((error1 != 0) && (error == 0)) {
972 error = error1;
973 }
974 }
975
976 if (uap->connid != USER_ADDR_NULL) {
977 error1 = copyout(&cid, uap->connid, sizeof(cid));
978 /* give precedence to connectitx errors */
979 if ((error1 != 0) && (error == 0)) {
980 error = error1;
981 }
982 }
983 out:
984 file_drop(fd);
985 if (auio != NULL) {
986 uio_free(auio);
987 }
988 if (src != NULL && src != SA(&ss)) {
989 free_sockaddr(src);
990 }
991 if (dst != NULL && dst != SA(&sd)) {
992 free_sockaddr(dst);
993 }
994 return error;
995 }
996
997 int
connectx(proc_ref_t p,struct connectx_args * uap,int * retval)998 connectx(proc_ref_t p, struct connectx_args *uap, int *retval)
999 {
1000 /*
1001 * Due to similiarity with a POSIX interface, define as
1002 * an unofficial cancellation point.
1003 */
1004 __pthread_testcancel(1);
1005 return connectx_nocancel(p, uap, retval);
1006 }
1007
1008 static int
connectit(struct socket * so,sockaddr_ref_t sa)1009 connectit(struct socket *so, sockaddr_ref_t sa)
1010 {
1011 int error;
1012
1013 AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), sa);
1014 #if CONFIG_MACF_SOCKET_SUBSET
1015 if ((error = mac_socket_check_connect(kauth_cred_get(), so, sa)) != 0) {
1016 return error;
1017 }
1018 #endif /* MAC_SOCKET_SUBSET */
1019
1020 socket_lock(so, 1);
1021 if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) {
1022 error = EALREADY;
1023 goto out;
1024 }
1025 error = soconnectlock(so, sa, 0);
1026 if (error != 0) {
1027 goto out;
1028 }
1029 if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) {
1030 error = EINPROGRESS;
1031 goto out;
1032 }
1033 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
1034 lck_mtx_t *mutex_held;
1035
1036 if (so->so_proto->pr_getlock != NULL) {
1037 mutex_held = (*so->so_proto->pr_getlock)(so, PR_F_WILLUNLOCK);
1038 } else {
1039 mutex_held = so->so_proto->pr_domain->dom_mtx;
1040 }
1041 error = msleep((caddr_t)&so->so_timeo, mutex_held,
1042 PSOCK | PCATCH, __func__, 0);
1043 if (so->so_state & SS_DRAINING) {
1044 error = ECONNABORTED;
1045 }
1046 if (error != 0) {
1047 break;
1048 }
1049 }
1050 if (error == 0) {
1051 error = so->so_error;
1052 so->so_error = 0;
1053 }
1054 out:
1055 socket_unlock(so, 1);
1056 return error;
1057 }
1058
1059 static int
connectitx(struct socket * so,sockaddr_ref_t src,sockaddr_ref_t dst,proc_ref_t p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uio_t auio,unsigned int flags,user_ssize_t * bytes_written)1060 connectitx(struct socket *so, sockaddr_ref_t src,
1061 sockaddr_ref_t dst, proc_ref_t p, uint32_t ifscope,
1062 sae_associd_t aid, sae_connid_t *pcid, uio_t auio, unsigned int flags,
1063 user_ssize_t *bytes_written)
1064 {
1065 int error;
1066
1067 VERIFY(dst != NULL);
1068
1069 AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), dst);
1070 #if CONFIG_MACF_SOCKET_SUBSET
1071 if ((error = mac_socket_check_connect(kauth_cred_get(), so, dst)) != 0) {
1072 return error;
1073 }
1074
1075 if (auio != NULL) {
1076 if ((error = mac_socket_check_send(kauth_cred_get(), so, dst)) != 0) {
1077 return error;
1078 }
1079 }
1080 #endif /* MAC_SOCKET_SUBSET */
1081
1082 socket_lock(so, 1);
1083 if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) {
1084 error = EALREADY;
1085 goto out;
1086 }
1087
1088 error = soconnectxlocked(so, src, dst, p, ifscope,
1089 aid, pcid, flags, NULL, 0, auio, bytes_written);
1090 if (error != 0) {
1091 goto out;
1092 }
1093 /*
1094 * If, after the call to soconnectxlocked the flag is still set (in case
1095 * data has been queued and the connect() has actually been triggered,
1096 * it will have been unset by the transport), we exit immediately. There
1097 * is no reason to wait on any event.
1098 */
1099 if (so->so_flags1 & SOF1_PRECONNECT_DATA) {
1100 error = 0;
1101 goto out;
1102 }
1103 if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) {
1104 error = EINPROGRESS;
1105 goto out;
1106 }
1107 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
1108 lck_mtx_t *mutex_held;
1109
1110 if (so->so_proto->pr_getlock != NULL) {
1111 mutex_held = (*so->so_proto->pr_getlock)(so, PR_F_WILLUNLOCK);
1112 } else {
1113 mutex_held = so->so_proto->pr_domain->dom_mtx;
1114 }
1115 error = msleep((caddr_t)&so->so_timeo, mutex_held,
1116 PSOCK | PCATCH, __func__, 0);
1117 if (so->so_state & SS_DRAINING) {
1118 error = ECONNABORTED;
1119 }
1120 if (error != 0) {
1121 break;
1122 }
1123 }
1124 if (error == 0) {
1125 error = so->so_error;
1126 so->so_error = 0;
1127 }
1128 out:
1129 socket_unlock(so, 1);
1130 return error;
1131 }
1132
1133 int
peeloff(proc_ref_t p,struct peeloff_args * uap,int * retval)1134 peeloff(proc_ref_t p, struct peeloff_args *uap, int *retval)
1135 {
1136 #pragma unused(p, uap, retval)
1137 /*
1138 * Due to similiarity with a POSIX interface, define as
1139 * an unofficial cancellation point.
1140 */
1141 __pthread_testcancel(1);
1142 return 0;
1143 }
1144
1145 int
disconnectx(proc_ref_t p,struct disconnectx_args * uap,int * retval)1146 disconnectx(proc_ref_t p, struct disconnectx_args *uap, int *retval)
1147 {
1148 /*
1149 * Due to similiarity with a POSIX interface, define as
1150 * an unofficial cancellation point.
1151 */
1152 __pthread_testcancel(1);
1153 return disconnectx_nocancel(p, uap, retval);
1154 }
1155
1156 static int
disconnectx_nocancel(proc_ref_t p,struct disconnectx_args * uap,int * retval)1157 disconnectx_nocancel(proc_ref_t p, struct disconnectx_args *uap, int *retval)
1158 {
1159 #pragma unused(p, retval)
1160 socket_ref_t so;
1161 int fd = uap->s;
1162 int error;
1163
1164 error = file_socket(fd, &so);
1165 if (error != 0) {
1166 return error;
1167 }
1168 if (so == NULL) {
1169 error = EBADF;
1170 goto out;
1171 }
1172
1173 error = sodisconnectx(so, uap->aid, uap->cid);
1174 out:
1175 file_drop(fd);
1176 return error;
1177 }
1178
1179 /*
1180 * Returns: 0 Success
1181 * socreate:EAFNOSUPPORT
1182 * socreate:EPROTOTYPE
1183 * socreate:EPROTONOSUPPORT
1184 * socreate:ENOBUFS
1185 * socreate:ENOMEM
1186 * socreate:EISCONN
1187 * socreate:??? [other protocol families, IPSEC]
1188 * falloc:ENFILE
1189 * falloc:EMFILE
1190 * falloc:ENOMEM
1191 * copyout:EFAULT
1192 * soconnect2:EINVAL
1193 * soconnect2:EPROTOTYPE
1194 * soconnect2:??? [other protocol families[
1195 */
1196 int
socketpair(proc_ref_t p,struct socketpair_args * uap,__unused int32_ref_t retval)1197 socketpair(proc_ref_t p, struct socketpair_args *uap,
1198 __unused int32_ref_t retval)
1199 {
1200 fileproc_ref_t fp1, fp2;
1201 socket_ref_t so1, so2;
1202 int fd, error, sv[2];
1203
1204 AUDIT_ARG(socket, uap->domain, uap->type, uap->protocol);
1205 error = socreate(uap->domain, &so1, uap->type, uap->protocol);
1206 if (error) {
1207 return error;
1208 }
1209 error = socreate(uap->domain, &so2, uap->type, uap->protocol);
1210 if (error) {
1211 goto free1;
1212 }
1213
1214 error = falloc(p, &fp1, &fd, vfs_context_current());
1215 if (error) {
1216 goto free2;
1217 }
1218 fp1->f_flag = FREAD | FWRITE;
1219 fp1->f_ops = &socketops;
1220 fp_set_data(fp1, so1);
1221 sv[0] = fd;
1222
1223 error = falloc(p, &fp2, &fd, vfs_context_current());
1224 if (error) {
1225 goto free3;
1226 }
1227 fp2->f_flag = FREAD | FWRITE;
1228 fp2->f_ops = &socketops;
1229 fp_set_data(fp2, so2);
1230 sv[1] = fd;
1231
1232 error = soconnect2(so1, so2);
1233 if (error) {
1234 goto free4;
1235 }
1236 if (uap->type == SOCK_DGRAM) {
1237 /*
1238 * Datagram socket connection is asymmetric.
1239 */
1240 error = soconnect2(so2, so1);
1241 if (error) {
1242 goto free4;
1243 }
1244 }
1245
1246 if ((error = copyout(sv, uap->rsv, 2 * sizeof(int))) != 0) {
1247 goto free4;
1248 }
1249
1250 proc_fdlock(p);
1251 procfdtbl_releasefd(p, sv[0], NULL);
1252 procfdtbl_releasefd(p, sv[1], NULL);
1253 fp_drop(p, sv[0], fp1, 1);
1254 fp_drop(p, sv[1], fp2, 1);
1255 proc_fdunlock(p);
1256
1257 return 0;
1258 free4:
1259 fp_free(p, sv[1], fp2);
1260 free3:
1261 fp_free(p, sv[0], fp1);
1262 free2:
1263 (void) soclose(so2);
1264 free1:
1265 (void) soclose(so1);
1266 return error;
1267 }
1268
1269 /*
1270 * Returns: 0 Success
1271 * EINVAL
1272 * ENOBUFS
1273 * EBADF
1274 * EPIPE
1275 * EACCES Mandatory Access Control failure
1276 * file_socket:ENOTSOCK
1277 * file_socket:EBADF
1278 * getsockaddr:ENAMETOOLONG Filename too long
1279 * getsockaddr:EINVAL Invalid argument
1280 * getsockaddr:ENOMEM Not enough space
1281 * getsockaddr:EFAULT Bad address
1282 * <pru_sosend>:EACCES[TCP]
1283 * <pru_sosend>:EADDRINUSE[TCP]
1284 * <pru_sosend>:EADDRNOTAVAIL[TCP]
1285 * <pru_sosend>:EAFNOSUPPORT[TCP]
1286 * <pru_sosend>:EAGAIN[TCP]
1287 * <pru_sosend>:EBADF
1288 * <pru_sosend>:ECONNRESET[TCP]
1289 * <pru_sosend>:EFAULT
1290 * <pru_sosend>:EHOSTUNREACH[TCP]
1291 * <pru_sosend>:EINTR
1292 * <pru_sosend>:EINVAL
1293 * <pru_sosend>:EISCONN[AF_INET]
1294 * <pru_sosend>:EMSGSIZE[TCP]
1295 * <pru_sosend>:ENETDOWN[TCP]
1296 * <pru_sosend>:ENETUNREACH[TCP]
1297 * <pru_sosend>:ENOBUFS
1298 * <pru_sosend>:ENOMEM[TCP]
1299 * <pru_sosend>:ENOTCONN[AF_INET]
1300 * <pru_sosend>:EOPNOTSUPP
1301 * <pru_sosend>:EPERM[TCP]
1302 * <pru_sosend>:EPIPE
1303 * <pru_sosend>:EWOULDBLOCK
1304 * <pru_sosend>:???[TCP] [ignorable: mostly IPSEC/firewall/DLIL]
1305 * <pru_sosend>:???[AF_INET] [whatever a filter author chooses]
1306 * <pru_sosend>:??? [value from so_error]
1307 * sockargs:???
1308 */
1309 static int
sendit(proc_ref_t p,struct socket * so,user_msghdr_ref_t mp,uio_t uiop,int flags,int32_ref_t retval)1310 sendit(proc_ref_t p, struct socket *so, user_msghdr_ref_t mp, uio_t uiop,
1311 int flags, int32_ref_t retval)
1312 {
1313 mbuf_ref_t control = NULL;
1314 struct sockaddr_storage ss;
1315 sockaddr_ref_t to = NULL;
1316 boolean_t want_free = TRUE;
1317 int error;
1318 user_ssize_t len;
1319
1320 KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1321
1322 if (mp->msg_name != USER_ADDR_NULL) {
1323 if (mp->msg_namelen > sizeof(ss)) {
1324 error = getsockaddr(so, &to, mp->msg_name,
1325 mp->msg_namelen, TRUE);
1326 } else {
1327 error = getsockaddr_s(so, &ss, mp->msg_name,
1328 mp->msg_namelen, TRUE);
1329 if (error == 0) {
1330 to = (sockaddr_ref_t)&ss;
1331 want_free = FALSE;
1332 }
1333 }
1334 if (error != 0) {
1335 goto out;
1336 }
1337 AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()), to);
1338 }
1339 if (mp->msg_control != USER_ADDR_NULL) {
1340 if (mp->msg_controllen < sizeof(struct cmsghdr)) {
1341 error = EINVAL;
1342 goto bad;
1343 }
1344 error = sockargs(&control, mp->msg_control,
1345 mp->msg_controllen, MT_CONTROL);
1346 if (error != 0) {
1347 goto bad;
1348 }
1349 }
1350
1351 #if CONFIG_MACF_SOCKET_SUBSET
1352 /*
1353 * We check the state without holding the socket lock;
1354 * if a race condition occurs, it would simply result
1355 * in an extra call to the MAC check function.
1356 */
1357 if (to != NULL &&
1358 !(so->so_state & SS_DEFUNCT) &&
1359 (error = mac_socket_check_send(kauth_cred_get(), so, to)) != 0) {
1360 if (control != NULL) {
1361 m_freem(control);
1362 }
1363
1364 goto bad;
1365 }
1366 #endif /* MAC_SOCKET_SUBSET */
1367
1368 len = uio_resid(uiop);
1369 error = so->so_proto->pr_usrreqs->pru_sosend(so, to, uiop, 0,
1370 control, flags);
1371 if (error != 0) {
1372 if (uio_resid(uiop) != len && (error == ERESTART ||
1373 error == EINTR || error == EWOULDBLOCK)) {
1374 error = 0;
1375 }
1376 /* Generation of SIGPIPE can be controlled per socket */
1377 if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE) &&
1378 !(flags & MSG_NOSIGNAL)) {
1379 psignal(p, SIGPIPE);
1380 }
1381 }
1382 if (error == 0) {
1383 *retval = (int)(len - uio_resid(uiop));
1384 }
1385 bad:
1386 if (want_free) {
1387 free_sockaddr(to);
1388 }
1389 out:
1390 KERNEL_DEBUG(DBG_FNC_SENDIT | DBG_FUNC_END, error, 0, 0, 0, 0);
1391
1392 return error;
1393 }
1394
1395 /*
1396 * Returns: 0 Success
1397 * ENOMEM
1398 * sendit:??? [see sendit definition in this file]
1399 * write:??? [4056224: applicable for pipes]
1400 */
1401 int
sendto(proc_ref_t p,struct sendto_args * uap,int32_ref_t retval)1402 sendto(proc_ref_t p, struct sendto_args *uap, int32_ref_t retval)
1403 {
1404 __pthread_testcancel(1);
1405 return sendto_nocancel(p, (struct sendto_nocancel_args *)uap, retval);
1406 }
1407
1408 int
sendto_nocancel(proc_ref_t p,struct sendto_nocancel_args * uap,int32_ref_t retval)1409 sendto_nocancel(proc_ref_t p,
1410 struct sendto_nocancel_args *uap,
1411 int32_ref_t retval)
1412 {
1413 struct user_msghdr msg;
1414 int error;
1415 uio_t auio = NULL;
1416 socket_ref_t so;
1417
1418 KERNEL_DEBUG(DBG_FNC_SENDTO | DBG_FUNC_START, 0, 0, 0, 0, 0);
1419 AUDIT_ARG(fd, uap->s);
1420
1421 if (uap->flags & MSG_SKIPCFIL) {
1422 error = EPERM;
1423 goto done;
1424 }
1425
1426 if (uap->len > LONG_MAX) {
1427 error = EINVAL;
1428 goto done;
1429 }
1430
1431 auio = uio_create(1, 0,
1432 (IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
1433 UIO_WRITE);
1434 if (auio == NULL) {
1435 error = ENOMEM;
1436 goto done;
1437 }
1438 uio_addiov(auio, uap->buf, uap->len);
1439
1440 msg.msg_name = uap->to;
1441 msg.msg_namelen = uap->tolen;
1442 /* no need to set up msg_iov. sendit uses uio_t we send it */
1443 msg.msg_iov = 0;
1444 msg.msg_iovlen = 0;
1445 msg.msg_control = 0;
1446 msg.msg_flags = 0;
1447
1448 error = file_socket(uap->s, &so);
1449 if (error) {
1450 goto done;
1451 }
1452
1453 if (so == NULL) {
1454 error = EBADF;
1455 } else {
1456 error = sendit(p, so, &msg, auio, uap->flags, retval);
1457 }
1458
1459 file_drop(uap->s);
1460 done:
1461 if (auio != NULL) {
1462 uio_free(auio);
1463 }
1464
1465 KERNEL_DEBUG(DBG_FNC_SENDTO | DBG_FUNC_END, error, *retval, 0, 0, 0);
1466
1467 return error;
1468 }
1469
1470 /*
1471 * Returns: 0 Success
1472 * ENOBUFS
1473 * copyin:EFAULT
1474 * sendit:??? [see sendit definition in this file]
1475 */
1476 int
sendmsg(proc_ref_t p,struct sendmsg_args * uap,int32_ref_t retval)1477 sendmsg(proc_ref_t p, struct sendmsg_args *uap, int32_ref_t retval)
1478 {
1479 __pthread_testcancel(1);
1480 return sendmsg_nocancel(p, (struct sendmsg_nocancel_args *)uap,
1481 retval);
1482 }
1483
1484 int
sendmsg_nocancel(proc_ref_t p,struct sendmsg_nocancel_args * uap,int32_ref_t retval)1485 sendmsg_nocancel(proc_ref_t p, struct sendmsg_nocancel_args *uap,
1486 int32_ref_t retval)
1487 {
1488 struct user32_msghdr msg32;
1489 struct user64_msghdr msg64;
1490 struct user_msghdr user_msg;
1491 caddr_t msghdrp;
1492 int size_of_msghdr;
1493 int error;
1494 uio_t auio = NULL;
1495 struct user_iovec *iovp;
1496 socket_ref_t so;
1497
1498 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
1499
1500 KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_START, 0, 0, 0, 0, 0);
1501 AUDIT_ARG(fd, uap->s);
1502
1503 if (uap->flags & MSG_SKIPCFIL) {
1504 error = EPERM;
1505 goto done;
1506 }
1507
1508 if (is_p_64bit_process) {
1509 msghdrp = (caddr_t)&msg64;
1510 size_of_msghdr = sizeof(msg64);
1511 } else {
1512 msghdrp = (caddr_t)&msg32;
1513 size_of_msghdr = sizeof(msg32);
1514 }
1515 error = copyin(uap->msg, msghdrp, size_of_msghdr);
1516 if (error) {
1517 KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
1518 return error;
1519 }
1520
1521 if (is_p_64bit_process) {
1522 user_msg.msg_flags = msg64.msg_flags;
1523 user_msg.msg_controllen = msg64.msg_controllen;
1524 user_msg.msg_control = (user_addr_t)msg64.msg_control;
1525 user_msg.msg_iovlen = msg64.msg_iovlen;
1526 user_msg.msg_iov = (user_addr_t)msg64.msg_iov;
1527 user_msg.msg_namelen = msg64.msg_namelen;
1528 user_msg.msg_name = (user_addr_t)msg64.msg_name;
1529 } else {
1530 user_msg.msg_flags = msg32.msg_flags;
1531 user_msg.msg_controllen = msg32.msg_controllen;
1532 user_msg.msg_control = msg32.msg_control;
1533 user_msg.msg_iovlen = msg32.msg_iovlen;
1534 user_msg.msg_iov = msg32.msg_iov;
1535 user_msg.msg_namelen = msg32.msg_namelen;
1536 user_msg.msg_name = msg32.msg_name;
1537 }
1538
1539 if (user_msg.msg_iovlen <= 0 || user_msg.msg_iovlen > UIO_MAXIOV) {
1540 KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_END, EMSGSIZE,
1541 0, 0, 0, 0);
1542 return EMSGSIZE;
1543 }
1544
1545 /* allocate a uio large enough to hold the number of iovecs passed */
1546 auio = uio_create(user_msg.msg_iovlen, 0,
1547 (is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32),
1548 UIO_WRITE);
1549 if (auio == NULL) {
1550 error = ENOBUFS;
1551 goto done;
1552 }
1553
1554 if (user_msg.msg_iovlen) {
1555 /*
1556 * get location of iovecs within the uio.
1557 * then copyin the iovecs from user space.
1558 */
1559 iovp = uio_iovsaddr(auio);
1560 if (iovp == NULL) {
1561 error = ENOBUFS;
1562 goto done;
1563 }
1564 error = copyin_user_iovec_array(user_msg.msg_iov,
1565 is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32,
1566 user_msg.msg_iovlen, iovp);
1567 if (error) {
1568 goto done;
1569 }
1570 user_msg.msg_iov = CAST_USER_ADDR_T(iovp);
1571
1572 /* finish setup of uio_t */
1573 error = uio_calculateresid(auio);
1574 if (error) {
1575 goto done;
1576 }
1577 } else {
1578 user_msg.msg_iov = 0;
1579 }
1580
1581 /* msg_flags is ignored for send */
1582 user_msg.msg_flags = 0;
1583
1584 error = file_socket(uap->s, &so);
1585 if (error) {
1586 goto done;
1587 }
1588 if (so == NULL) {
1589 error = EBADF;
1590 } else {
1591 error = sendit(p, so, &user_msg, auio, uap->flags, retval);
1592 }
1593 file_drop(uap->s);
1594 done:
1595 if (auio != NULL) {
1596 uio_free(auio);
1597 }
1598 KERNEL_DEBUG(DBG_FNC_SENDMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
1599
1600 return error;
1601 }
1602
1603 #if DEBUG || DEVELOPMENT
1604 static int
sendmsg_x_old(proc_ref_t p,struct sendmsg_x_args * uap,user_ssize_t * retval)1605 sendmsg_x_old(proc_ref_t p, struct sendmsg_x_args *uap, user_ssize_t *retval)
1606 {
1607 int error = 0;
1608 user_msghdr_x_ptr_t user_msg_x = NULL;
1609 uio_ref_ptr_t uiop = NULL;
1610 socket_ref_t so;
1611 u_int i;
1612 sockaddr_ref_t to = NULL;
1613 user_ssize_t len_before = 0, len_after;
1614 int need_drop = 0;
1615 size_t size_of_msghdr;
1616 void_ptr_t umsgp = NULL;
1617 u_int uiocnt = 0;
1618 int has_addr_or_ctl = 0;
1619
1620 KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
1621
1622 size_of_msghdr = IS_64BIT_PROCESS(p) ?
1623 sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
1624
1625 if (uap->flags & MSG_SKIPCFIL) {
1626 error = EPERM;
1627 goto out;
1628 }
1629
1630 error = file_socket(uap->s, &so);
1631 if (error) {
1632 goto out;
1633 }
1634 need_drop = 1;
1635 if (so == NULL) {
1636 error = EBADF;
1637 goto out;
1638 }
1639
1640 /*
1641 * Input parameter range check
1642 */
1643 if (uap->cnt == 0 || uap->cnt > UIO_MAXIOV) {
1644 error = EINVAL;
1645 goto out;
1646 }
1647 /*
1648 * Clip to max currently allowed
1649 */
1650 if (uap->cnt > somaxsendmsgx) {
1651 uap->cnt = somaxsendmsgx > 0 ? somaxsendmsgx : 1;
1652 }
1653
1654 user_msg_x = kalloc_type(struct user_msghdr_x, uap->cnt,
1655 Z_WAITOK | Z_ZERO);
1656 if (user_msg_x == NULL) {
1657 DBG_PRINTF("%s user_msg_x alloc failed", __func__);
1658 error = ENOMEM;
1659 goto out;
1660 }
1661 uiop = kalloc_type(uio_ref_t, uap->cnt, Z_WAITOK | Z_ZERO);
1662 if (uiop == NULL) {
1663 DBG_PRINTF("%s uiop alloc failed", __func__);
1664 error = ENOMEM;
1665 goto out;
1666 }
1667
1668 umsgp = kalloc_data(uap->cnt * size_of_msghdr, Z_WAITOK | Z_ZERO);
1669 if (umsgp == NULL) {
1670 DBG_PRINTF("%s user_msg_x alloc failed", __func__);
1671 error = ENOMEM;
1672 goto out;
1673 }
1674 error = copyin(uap->msgp, umsgp, uap->cnt * size_of_msghdr);
1675 if (error) {
1676 DBG_PRINTF("%s copyin() failed", __func__);
1677 goto out;
1678 }
1679 error = internalize_user_msghdr_array(umsgp,
1680 IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
1681 UIO_WRITE, uap->cnt, user_msg_x, uiop);
1682 if (error) {
1683 DBG_PRINTF("%s copyin_user_msghdr_array() failed", __func__);
1684 goto out;
1685 }
1686 /*
1687 * Make sure the size of each message iovec and
1688 * the aggregate size of all the iovec is valid
1689 */
1690 if (uio_array_is_valid(uiop, uap->cnt) == false) {
1691 error = EINVAL;
1692 goto out;
1693 }
1694
1695 /*
1696 * Sanity check on passed arguments
1697 */
1698 for (i = 0; i < uap->cnt; i++) {
1699 struct user_msghdr_x *mp = user_msg_x + i;
1700
1701 /*
1702 * No flags on send message
1703 */
1704 if (mp->msg_flags != 0) {
1705 error = EINVAL;
1706 goto out;
1707 }
1708 /*
1709 * No support for address or ancillary data (yet)
1710 */
1711 if (mp->msg_name != USER_ADDR_NULL || mp->msg_namelen != 0) {
1712 has_addr_or_ctl = 1;
1713 }
1714
1715 if (mp->msg_control != USER_ADDR_NULL ||
1716 mp->msg_controllen != 0) {
1717 has_addr_or_ctl = 1;
1718 }
1719
1720 #if CONFIG_MACF_SOCKET_SUBSET
1721 /*
1722 * We check the state without holding the socket lock;
1723 * if a race condition occurs, it would simply result
1724 * in an extra call to the MAC check function.
1725 *
1726 * Note: The following check is never true taken with the
1727 * current limitation that we do not accept to pass an address,
1728 * this is effectively placeholder code. If we add support for
1729 * addresses, we will have to check every address.
1730 */
1731 if (to != NULL &&
1732 !(so->so_state & SS_DEFUNCT) &&
1733 (error = mac_socket_check_send(kauth_cred_get(), so, to))
1734 != 0) {
1735 goto out;
1736 }
1737 #endif /* MAC_SOCKET_SUBSET */
1738 }
1739
1740 len_before = uio_array_resid(uiop, uap->cnt);
1741
1742 for (i = 0; i < uap->cnt; i++) {
1743 struct user_msghdr_x *mp = user_msg_x + i;
1744 struct user_msghdr user_msg;
1745 uio_t auio = uiop[i];
1746 int32_t tmpval;
1747
1748 user_msg.msg_flags = mp->msg_flags;
1749 user_msg.msg_controllen = mp->msg_controllen;
1750 user_msg.msg_control = mp->msg_control;
1751 user_msg.msg_iovlen = mp->msg_iovlen;
1752 user_msg.msg_iov = mp->msg_iov;
1753 user_msg.msg_namelen = mp->msg_namelen;
1754 user_msg.msg_name = mp->msg_name;
1755
1756 error = sendit(p, so, &user_msg, auio, uap->flags,
1757 &tmpval);
1758 if (error != 0) {
1759 break;
1760 }
1761 uiocnt += 1;
1762 }
1763
1764 len_after = uio_array_resid(uiop, uap->cnt);
1765
1766 VERIFY(len_after <= len_before);
1767
1768 if (error != 0) {
1769 if (len_after != len_before && (error == ERESTART ||
1770 error == EINTR || error == EWOULDBLOCK ||
1771 error == ENOBUFS)) {
1772 error = 0;
1773 }
1774 /* Generation of SIGPIPE can be controlled per socket */
1775 if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE) &&
1776 !(uap->flags & MSG_NOSIGNAL)) {
1777 psignal(p, SIGPIPE);
1778 }
1779 }
1780 if (error == 0) {
1781 externalize_user_msghdr_array(umsgp,
1782 IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32,
1783 UIO_WRITE, uiocnt, user_msg_x, uiop);
1784
1785 *retval = (int)(uiocnt);
1786 }
1787 out:
1788 if (need_drop) {
1789 file_drop(uap->s);
1790 }
1791 kfree_data(umsgp, uap->cnt * size_of_msghdr);
1792 if (uiop != NULL) {
1793 free_uio_array(uiop, uap->cnt);
1794 kfree_type(uio_ref_t, uap->cnt, uiop);
1795 }
1796 kfree_type(struct user_msghdr_x, uap->cnt, user_msg_x);
1797
1798 KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
1799
1800 return error;
1801 }
1802 #endif /* DEBUG || DEVELOPMENT */
1803
1804 static int
internalize_user_msg_x(struct user_msghdr * user_msg,uio_t * auiop,proc_ref_t p,void_ptr_t user_msghdr_x_src)1805 internalize_user_msg_x(struct user_msghdr *user_msg, uio_t *auiop, proc_ref_t p, void_ptr_t user_msghdr_x_src)
1806 {
1807 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
1808 uio_t auio = *auiop;
1809 int error;
1810
1811 if (is_p_64bit_process) {
1812 struct user64_msghdr_x msghdrx64;
1813
1814 error = copyin((user_addr_t)user_msghdr_x_src,
1815 &msghdrx64, sizeof(msghdrx64));
1816 if (error != 0) {
1817 DBG_PRINTF("%s copyin() msghdrx64 failed %d",
1818 __func__, error);
1819 goto done;
1820 }
1821 user_msg->msg_name = msghdrx64.msg_name;
1822 user_msg->msg_namelen = msghdrx64.msg_namelen;
1823 user_msg->msg_iov = msghdrx64.msg_iov;
1824 user_msg->msg_iovlen = msghdrx64.msg_iovlen;
1825 user_msg->msg_control = msghdrx64.msg_control;
1826 user_msg->msg_controllen = msghdrx64.msg_controllen;
1827 } else {
1828 struct user32_msghdr_x msghdrx32;
1829
1830 error = copyin((user_addr_t)user_msghdr_x_src,
1831 &msghdrx32, sizeof(msghdrx32));
1832 if (error != 0) {
1833 DBG_PRINTF("%s copyin() msghdrx32 failed %d",
1834 __func__, error);
1835 goto done;
1836 }
1837 user_msg->msg_name = msghdrx32.msg_name;
1838 user_msg->msg_namelen = msghdrx32.msg_namelen;
1839 user_msg->msg_iov = msghdrx32.msg_iov;
1840 user_msg->msg_iovlen = msghdrx32.msg_iovlen;
1841 user_msg->msg_control = msghdrx32.msg_control;
1842 user_msg->msg_controllen = msghdrx32.msg_controllen;
1843 }
1844 /* msg_flags is ignored for send */
1845 user_msg->msg_flags = 0;
1846
1847 if (user_msg->msg_iovlen <= 0 || user_msg->msg_iovlen > UIO_MAXIOV) {
1848 error = EMSGSIZE;
1849 DBG_PRINTF("%s bad msg_iovlen, error %d",
1850 __func__, error);
1851 goto done;
1852 }
1853 /*
1854 * Attempt to reuse the uio if large enough, otherwise we need
1855 * a new one
1856 */
1857 if (auio != NULL) {
1858 if (auio->uio_max_iovs >= user_msg->msg_iovlen) {
1859 uio_reset(auio, 0,
1860 is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32,
1861 UIO_WRITE);
1862 } else {
1863 uio_free(auio);
1864 auio = NULL;
1865 }
1866 }
1867 if (auio == NULL) {
1868 auio = uio_create(user_msg->msg_iovlen, 0,
1869 is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32,
1870 UIO_WRITE);
1871 if (auio == NULL) {
1872 error = ENOBUFS;
1873 DBG_PRINTF("%s uio_create() failed %d",
1874 __func__, error);
1875 goto done;
1876 }
1877 }
1878
1879 if (user_msg->msg_iovlen) {
1880 /*
1881 * get location of iovecs within the uio.
1882 * then copyin the iovecs from user space.
1883 */
1884 struct user_iovec *iovp = uio_iovsaddr(auio);
1885 if (iovp == NULL) {
1886 error = ENOBUFS;
1887 goto done;
1888 }
1889 error = copyin_user_iovec_array(user_msg->msg_iov,
1890 is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32,
1891 user_msg->msg_iovlen, iovp);
1892 if (error != 0) {
1893 goto done;
1894 }
1895 user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
1896
1897 /* finish setup of uio_t */
1898 error = uio_calculateresid(auio);
1899 if (error) {
1900 goto done;
1901 }
1902 } else {
1903 user_msg->msg_iov = 0;
1904 }
1905
1906 done:
1907 *auiop = auio;
1908 return error;
1909 }
1910
1911 static int
mbuf_packet_from_uio(socket_ref_t so,mbuf_ref_ref_t mp,uio_t auio)1912 mbuf_packet_from_uio(socket_ref_t so, mbuf_ref_ref_t mp, uio_t auio)
1913 {
1914 int error = 0;
1915 uint16_t headroom = 0;
1916 size_t bytes_to_alloc;
1917 mbuf_ref_t top = NULL, m;
1918
1919 if (soreserveheadroom != 0) {
1920 headroom = so->so_pktheadroom;
1921 }
1922 bytes_to_alloc = headroom + uio_resid(auio);
1923
1924 error = mbuf_allocpacket(MBUF_WAITOK, bytes_to_alloc, NULL, &top);
1925 if (error != 0) {
1926 os_log(OS_LOG_DEFAULT, "mbuf_packet_from_uio: mbuf_allocpacket %zu error %d",
1927 bytes_to_alloc, error);
1928 goto done;
1929 }
1930
1931 if (headroom > 0 && headroom < mbuf_maxlen(top)) {
1932 top->m_data += headroom;
1933 }
1934
1935 for (m = top; m != NULL; m = m->m_next) {
1936 int bytes_to_copy = (int)uio_resid(auio);
1937 ssize_t mlen;
1938
1939 if ((m->m_flags & M_EXT)) {
1940 mlen = m->m_ext.ext_size -
1941 M_LEADINGSPACE(m);
1942 } else if ((m->m_flags & M_PKTHDR)) {
1943 mlen = MHLEN - M_LEADINGSPACE(m);
1944 m_add_crumb(m, PKT_CRUMB_SOSEND);
1945 } else {
1946 mlen = MLEN - M_LEADINGSPACE(m);
1947 }
1948 int len = imin((int)mlen, bytes_to_copy);
1949
1950 error = uiomove(mtod(m, caddr_t), (int)len, auio);
1951 if (error != 0) {
1952 os_log(OS_LOG_DEFAULT, "mbuf_packet_from_uio: len %d error %d",
1953 len, error);
1954 goto done;
1955 }
1956 m->m_len = len;
1957 top->m_pkthdr.len += len;
1958 }
1959
1960 done:
1961 if (error != 0) {
1962 m_freem(top);
1963 } else {
1964 *mp = top;
1965 }
1966 return error;
1967 }
1968
1969 static int
sendit_x(proc_ref_t p,socket_ref_t so,struct sendmsg_x_args * uap,u_int * retval)1970 sendit_x(proc_ref_t p, socket_ref_t so, struct sendmsg_x_args *uap, u_int *retval)
1971 {
1972 int error = 0;
1973 uio_t auio = NULL;
1974 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
1975 void_ptr_t src;
1976 MBUFQ_HEAD() pktlist = {};
1977 size_t total_pkt_len = 0;
1978 u_int pkt_cnt = 0;
1979 int flags = uap->flags;
1980 mbuf_ref_t top;
1981
1982 MBUFQ_INIT(&pktlist);
1983
1984 *retval = 0;
1985
1986 /* We re-use the uio when possible */
1987 auio = uio_create(1, 0,
1988 (is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32),
1989 UIO_WRITE);
1990 if (auio == NULL) {
1991 error = ENOBUFS;
1992 DBG_PRINTF("%s uio_create() failed %d",
1993 __func__, error);
1994 goto done;
1995 }
1996
1997 src = (void_ptr_t)uap->msgp;
1998
1999 /*
2000 * Create a list of packets
2001 */
2002 for (u_int i = 0; i < uap->cnt; i++) {
2003 struct user_msghdr user_msg = {};
2004 mbuf_ref_t m = NULL;
2005
2006 if (is_p_64bit_process) {
2007 error = internalize_user_msg_x(&user_msg, &auio, p, ((struct user64_msghdr_x *)src) + i);
2008 if (error != 0) {
2009 os_log(OS_LOG_DEFAULT, "sendit_x: internalize_user_msg_x error %d\n", error);
2010 goto done;
2011 }
2012 } else {
2013 error = internalize_user_msg_x(&user_msg, &auio, p, ((struct user32_msghdr_x *)src) + i);
2014 if (error != 0) {
2015 os_log(OS_LOG_DEFAULT, "sendit_x: internalize_user_msg_x error %d\n", error);
2016 goto done;
2017 }
2018 }
2019 /*
2020 * Stop on the first datagram that is too large
2021 */
2022 if (uio_resid(auio) > so->so_snd.sb_hiwat) {
2023 if (i == 0) {
2024 error = EMSGSIZE;
2025 goto done;
2026 }
2027 break;
2028 }
2029 /*
2030 * An mbuf packet has the control mbuf(s) followed by data
2031 * We allocate the mbufs in reverse order
2032 */
2033 error = mbuf_packet_from_uio(so, &m, auio);
2034 if (error != 0) {
2035 os_log(OS_LOG_DEFAULT, "sendit_x: mbuf_packet_from_uio error %d\n", error);
2036 goto done;
2037 }
2038 total_pkt_len += m->m_pkthdr.len;
2039
2040 if (user_msg.msg_control != USER_ADDR_NULL && user_msg.msg_controllen != 0) {
2041 mbuf_ref_t control = NULL;
2042
2043 error = sockargs(&control, user_msg.msg_control, user_msg.msg_controllen, MT_CONTROL);
2044 if (error != 0) {
2045 os_log(OS_LOG_DEFAULT, "sendit_x: sockargs error %d\n", error);
2046 goto done;
2047 }
2048 control->m_next = m;
2049 m = control;
2050 }
2051 MBUFQ_ENQUEUE(&pktlist, m);
2052 }
2053
2054 top = MBUFQ_FIRST(&pktlist);
2055 MBUFQ_INIT(&pktlist);
2056 pkt_cnt = uap->cnt;
2057 error = sosend_list(so, top, total_pkt_len, &pkt_cnt, flags);
2058 if (error != 0) {
2059 os_log(OS_LOG_DEFAULT, "sendit_x: sosend_list error %d\n", error);
2060 goto done;
2061 }
2062 done:
2063 *retval = pkt_cnt;
2064
2065 if (auio != NULL) {
2066 uio_free(auio);
2067 }
2068 MBUFQ_DRAIN(&pktlist);
2069 return error;
2070 }
2071
2072 int
sendmsg_x(proc_ref_t p,struct sendmsg_x_args * uap,user_ssize_t * retval)2073 sendmsg_x(proc_ref_t p, struct sendmsg_x_args *uap, user_ssize_t *retval)
2074 {
2075 void_ptr_t src;
2076 int error;
2077 uio_t auio = NULL;
2078 socket_ref_t so;
2079 u_int uiocnt = 0;
2080 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
2081
2082 #if DEBUG || DEVELOPMENT
2083 if (sendmsg_x_mode == 2) {
2084 return sendmsg_x_old(p, uap, retval);
2085 }
2086 #endif /* DEBUG || DEVELOPMENT */
2087
2088 KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
2089 AUDIT_ARG(fd, uap->s);
2090
2091 if (uap->flags & MSG_SKIPCFIL) {
2092 error = EPERM;
2093 goto done_no_filedrop;
2094 }
2095
2096 error = file_socket(uap->s, &so);
2097 if (error) {
2098 goto done_no_filedrop;
2099 }
2100 if (so == NULL) {
2101 error = EBADF;
2102 goto done;
2103 }
2104
2105 /*
2106 * For an atomic datagram connected socket we can build the list of
2107 * mbuf packets with sosend_list()
2108 */
2109 if (so->so_type == SOCK_DGRAM && sosendallatonce(so) &&
2110 (so->so_state & SS_ISCONNECTED) && sendmsg_x_mode != 1) {
2111 error = sendit_x(p, so, uap, &uiocnt);
2112 if (error != 0) {
2113 DBG_PRINTF("%s sendit_x() failed %d",
2114 __func__, error);
2115 }
2116 goto done;
2117 }
2118
2119 src = (void_ptr_t)uap->msgp;
2120
2121 /* We re-use the uio when possible */
2122 auio = uio_create(1, 0,
2123 (is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32),
2124 UIO_WRITE);
2125 if (auio == NULL) {
2126 error = ENOBUFS;
2127 DBG_PRINTF("%s uio_create() failed %d",
2128 __func__, error);
2129 goto done;
2130 }
2131
2132 for (u_int i = 0; i < uap->cnt; i++) {
2133 struct user_msghdr user_msg = {};
2134
2135 if (is_p_64bit_process) {
2136 error = internalize_user_msg_x(&user_msg, &auio, p, ((struct user64_msghdr_x *)src) + i);
2137 if (error != 0) {
2138 goto done;
2139 }
2140 } else {
2141 error = internalize_user_msg_x(&user_msg, &auio, p, ((struct user32_msghdr_x *)src) + i);
2142 if (error != 0) {
2143 goto done;
2144 }
2145 }
2146
2147 int32_t len = 0;
2148 error = sendit(p, so, &user_msg, auio, uap->flags, &len);
2149 if (error != 0) {
2150 break;
2151 }
2152 uiocnt += 1;
2153 }
2154 done:
2155 if (error != 0) {
2156 if (uiocnt != 0 && (error == ERESTART ||
2157 error == EINTR || error == EWOULDBLOCK ||
2158 error == ENOBUFS || error == EMSGSIZE)) {
2159 error = 0;
2160 }
2161 /* Generation of SIGPIPE can be controlled per socket */
2162 if (error == EPIPE && !(so->so_flags & SOF_NOSIGPIPE) &&
2163 !(uap->flags & MSG_NOSIGNAL)) {
2164 psignal(p, SIGPIPE);
2165 }
2166 }
2167 if (error == 0) {
2168 *retval = (int)(uiocnt);
2169 }
2170 file_drop(uap->s);
2171
2172 done_no_filedrop:
2173 if (auio != NULL) {
2174 uio_free(auio);
2175 }
2176 KERNEL_DEBUG(DBG_FNC_SENDMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
2177
2178 return error;
2179 }
2180
2181
2182 static int
copyout_sa(sockaddr_ref_t fromsa,user_addr_t name,socklen_t * namelen)2183 copyout_sa(sockaddr_ref_t fromsa, user_addr_t name, socklen_t *namelen)
2184 {
2185 int error = 0;
2186 socklen_t sa_len = 0;
2187 ssize_t len;
2188
2189 len = *namelen;
2190 if (len <= 0 || fromsa == 0) {
2191 len = 0;
2192 } else {
2193 #ifndef MIN
2194 #define MIN(a, b) ((a) > (b) ? (b) : (a))
2195 #endif
2196 sa_len = fromsa->sa_len;
2197 len = MIN((unsigned int)len, sa_len);
2198 error = copyout(fromsa, name, (unsigned)len);
2199 if (error) {
2200 goto out;
2201 }
2202 }
2203 *namelen = sa_len;
2204 out:
2205 return 0;
2206 }
2207
2208 static int
copyout_maddr(struct mbuf * m,user_addr_t name,socklen_t * namelen)2209 copyout_maddr(struct mbuf *m, user_addr_t name, socklen_t *namelen)
2210 {
2211 int error = 0;
2212 socklen_t sa_len = 0;
2213 ssize_t len;
2214
2215 len = *namelen;
2216 if (len <= 0 || m == NULL) {
2217 len = 0;
2218 } else {
2219 #ifndef MIN
2220 #define MIN(a, b) ((a) > (b) ? (b) : (a))
2221 #endif
2222 struct sockaddr *fromsa = mtod(m, struct sockaddr *);
2223
2224 sa_len = fromsa->sa_len;
2225 len = MIN((unsigned int)len, sa_len);
2226 error = copyout(fromsa, name, (unsigned)len);
2227 if (error != 0) {
2228 goto out;
2229 }
2230 }
2231 *namelen = sa_len;
2232 out:
2233 return 0;
2234 }
2235
2236 static int
copyout_control(proc_ref_t p,mbuf_ref_t m,user_addr_t control,socklen_ref_t controllen,int_ref_t flags,socket_ref_t so)2237 copyout_control(proc_ref_t p, mbuf_ref_t m, user_addr_t control,
2238 socklen_ref_t controllen, int_ref_t flags, socket_ref_t so)
2239 {
2240 int error = 0;
2241 socklen_t len;
2242 user_addr_t ctlbuf;
2243 struct inpcb *inp = NULL;
2244 bool want_pktinfo = false;
2245 bool seen_pktinfo = false;
2246
2247 if (so != NULL && (SOCK_DOM(so) == PF_INET6 || SOCK_DOM(so) == PF_INET)) {
2248 inp = sotoinpcb(so);
2249 want_pktinfo = (inp->inp_flags & IN6P_PKTINFO) != 0;
2250 }
2251
2252 len = *controllen;
2253 *controllen = 0;
2254 ctlbuf = control;
2255
2256 while (m && len > 0) {
2257 socklen_t tocopy;
2258 struct cmsghdr *cp = mtod(m, struct cmsghdr *);
2259 socklen_t cp_size = CMSG_ALIGN(cp->cmsg_len);
2260 socklen_t buflen = m->m_len;
2261
2262 while (buflen > 0 && len > 0) {
2263 /*
2264 * SCM_TIMESTAMP hack because struct timeval has a
2265 * different size for 32 bits and 64 bits processes
2266 */
2267 if (cp->cmsg_level == SOL_SOCKET && cp->cmsg_type == SCM_TIMESTAMP) {
2268 unsigned char tmp_buffer[CMSG_SPACE(sizeof(struct user64_timeval))] = {};
2269 struct cmsghdr *tmp_cp = (struct cmsghdr *)(void *)tmp_buffer;
2270 socklen_t tmp_space;
2271 struct timeval *tv = (struct timeval *)(void *)CMSG_DATA(cp);
2272
2273 tmp_cp->cmsg_level = SOL_SOCKET;
2274 tmp_cp->cmsg_type = SCM_TIMESTAMP;
2275
2276 if (proc_is64bit(p)) {
2277 struct user64_timeval *tv64 = (struct user64_timeval *)(void *)CMSG_DATA(tmp_cp);
2278
2279 os_unaligned_deref(&tv64->tv_sec) = tv->tv_sec;
2280 os_unaligned_deref(&tv64->tv_usec) = tv->tv_usec;
2281
2282 tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user64_timeval));
2283 tmp_space = CMSG_SPACE(sizeof(struct user64_timeval));
2284 } else {
2285 struct user32_timeval *tv32 = (struct user32_timeval *)(void *)CMSG_DATA(tmp_cp);
2286
2287 tv32->tv_sec = (user32_time_t)tv->tv_sec;
2288 tv32->tv_usec = tv->tv_usec;
2289
2290 tmp_cp->cmsg_len = CMSG_LEN(sizeof(struct user32_timeval));
2291 tmp_space = CMSG_SPACE(sizeof(struct user32_timeval));
2292 }
2293 if (len >= tmp_space) {
2294 tocopy = tmp_space;
2295 } else {
2296 *flags |= MSG_CTRUNC;
2297 tocopy = len;
2298 }
2299 error = copyout(tmp_buffer, ctlbuf, tocopy);
2300 if (error) {
2301 goto out;
2302 }
2303 } else {
2304 /* If socket has flow tracking and socket did not request address, ignore it */
2305 if (SOFLOW_ENABLED(so) &&
2306 ((cp->cmsg_level == IPPROTO_IP && cp->cmsg_type == IP_RECVDSTADDR && inp != NULL &&
2307 !(inp->inp_flags & INP_RECVDSTADDR)) ||
2308 (cp->cmsg_level == IPPROTO_IPV6 && (cp->cmsg_type == IPV6_PKTINFO || cp->cmsg_type == IPV6_2292PKTINFO) && inp &&
2309 !(inp->inp_flags & IN6P_PKTINFO)))) {
2310 tocopy = 0;
2311 } else {
2312 if (cp_size > buflen) {
2313 panic("cp_size > buflen, something wrong with alignment!");
2314 }
2315 if (len >= cp_size) {
2316 tocopy = cp_size;
2317 } else {
2318 *flags |= MSG_CTRUNC;
2319 tocopy = len;
2320 }
2321 error = copyout((caddr_t) cp, ctlbuf, tocopy);
2322 if (error) {
2323 goto out;
2324 }
2325 if (want_pktinfo && cp->cmsg_level == IPPROTO_IPV6 &&
2326 (cp->cmsg_type == IPV6_PKTINFO || cp->cmsg_type == IPV6_2292PKTINFO)) {
2327 seen_pktinfo = true;
2328 }
2329 }
2330 }
2331
2332
2333 ctlbuf += tocopy;
2334 len -= tocopy;
2335
2336 buflen -= cp_size;
2337 cp = (struct cmsghdr *)(void *)
2338 ((unsigned char *) cp + cp_size);
2339 cp_size = CMSG_ALIGN(cp->cmsg_len);
2340 }
2341
2342 m = m->m_next;
2343 }
2344 *controllen = (socklen_t)(ctlbuf - control);
2345 out:
2346 if (want_pktinfo && !seen_pktinfo) {
2347 missingpktinfo += 1;
2348 #if (DEBUG || DEVELOPMENT)
2349 char pname[MAXCOMLEN];
2350 char local[MAX_IPv6_STR_LEN + 6];
2351 char remote[MAX_IPv6_STR_LEN + 6];
2352
2353 proc_name(so->last_pid, pname, sizeof(MAXCOMLEN));
2354 if (inp->inp_vflag & INP_IPV6) {
2355 inet_ntop(AF_INET6, &inp->in6p_laddr.s6_addr, local, sizeof(local));
2356 inet_ntop(AF_INET6, &inp->in6p_faddr.s6_addr, remote, sizeof(local));
2357 } else {
2358 inet_ntop(AF_INET, &inp->inp_laddr.s_addr, local, sizeof(local));
2359 inet_ntop(AF_INET, &inp->inp_faddr.s_addr, remote, sizeof(local));
2360 }
2361
2362 os_log(OS_LOG_DEFAULT,
2363 "cmsg IPV6_PKTINFO missing for %s:%u > %s:%u proc %s.%u error %d\n",
2364 local, ntohs(inp->inp_lport), remote, ntohs(inp->inp_fport),
2365 pname, so->last_pid, error);
2366 #endif /* (DEBUG || DEVELOPMENT) */
2367 }
2368 return error;
2369 }
2370
2371 /*
2372 * Returns: 0 Success
2373 * ENOTSOCK
2374 * EINVAL
2375 * EBADF
2376 * EACCES Mandatory Access Control failure
2377 * copyout:EFAULT
2378 * fp_lookup:EBADF
2379 * <pru_soreceive>:ENOBUFS
2380 * <pru_soreceive>:ENOTCONN
2381 * <pru_soreceive>:EWOULDBLOCK
2382 * <pru_soreceive>:EFAULT
2383 * <pru_soreceive>:EINTR
2384 * <pru_soreceive>:EBADF
2385 * <pru_soreceive>:EINVAL
2386 * <pru_soreceive>:EMSGSIZE
2387 * <pru_soreceive>:???
2388 *
2389 * Notes: Additional return values from calls through <pru_soreceive>
2390 * depend on protocols other than TCP or AF_UNIX, which are
2391 * documented above.
2392 */
2393 static int
recvit(proc_ref_t p,int s,user_msghdr_ref_t mp,uio_t uiop,user_addr_t namelenp,int32_ref_t retval)2394 recvit(proc_ref_t p, int s, user_msghdr_ref_t mp, uio_t uiop,
2395 user_addr_t namelenp, int32_ref_t retval)
2396 {
2397 ssize_t len;
2398 int error;
2399 mbuf_ref_t control = 0;
2400 socket_ref_t so;
2401 sockaddr_ref_t fromsa = 0;
2402 fileproc_ref_t fp;
2403
2404 KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_START, 0, 0, 0, 0, 0);
2405 if ((error = fp_get_ftype(p, s, DTYPE_SOCKET, ENOTSOCK, &fp))) {
2406 KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, error, 0, 0, 0, 0);
2407 return error;
2408 }
2409 so = (struct socket *)fp_get_data(fp);
2410
2411 #if CONFIG_MACF_SOCKET_SUBSET
2412 /*
2413 * We check the state without holding the socket lock;
2414 * if a race condition occurs, it would simply result
2415 * in an extra call to the MAC check function.
2416 */
2417 if (!(so->so_state & SS_DEFUNCT) &&
2418 !(so->so_state & SS_ISCONNECTED) &&
2419 !(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
2420 (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0) {
2421 goto out1;
2422 }
2423 #endif /* MAC_SOCKET_SUBSET */
2424 if (uio_resid(uiop) < 0 || uio_resid(uiop) > INT_MAX) {
2425 KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, EINVAL, 0, 0, 0, 0);
2426 error = EINVAL;
2427 goto out1;
2428 }
2429
2430 len = uio_resid(uiop);
2431 error = so->so_proto->pr_usrreqs->pru_soreceive(so, &fromsa, uiop,
2432 NULL, mp->msg_control ? &control : NULL,
2433 &mp->msg_flags);
2434 if (fromsa) {
2435 AUDIT_ARG(sockaddr, vfs_context_cwd(vfs_context_current()),
2436 fromsa);
2437 }
2438 if (error) {
2439 if (uio_resid(uiop) != len && (error == ERESTART ||
2440 error == EINTR || error == EWOULDBLOCK)) {
2441 error = 0;
2442 }
2443 }
2444 if (error) {
2445 goto out;
2446 }
2447
2448 *retval = (int32_t)(len - uio_resid(uiop));
2449
2450 if (mp->msg_name) {
2451 error = copyout_sa(fromsa, mp->msg_name, &mp->msg_namelen);
2452 if (error) {
2453 goto out;
2454 }
2455 /* return the actual, untruncated address length */
2456 if (namelenp &&
2457 (error = copyout((caddr_t)&mp->msg_namelen, namelenp,
2458 sizeof(int)))) {
2459 goto out;
2460 }
2461 }
2462
2463 if (mp->msg_control) {
2464 error = copyout_control(p, control, mp->msg_control,
2465 &mp->msg_controllen, &mp->msg_flags, so);
2466 }
2467 out:
2468 free_sockaddr(fromsa);
2469 if (control) {
2470 m_freem(control);
2471 }
2472 KERNEL_DEBUG(DBG_FNC_RECVIT | DBG_FUNC_END, error, 0, 0, 0, 0);
2473 out1:
2474 fp_drop(p, s, fp, 0);
2475 return error;
2476 }
2477
2478 /*
2479 * Returns: 0 Success
2480 * ENOMEM
2481 * copyin:EFAULT
2482 * recvit:???
2483 * read:??? [4056224: applicable for pipes]
2484 *
2485 * Notes: The read entry point is only called as part of support for
2486 * binary backward compatability; new code should use read
2487 * instead of recv or recvfrom when attempting to read data
2488 * from pipes.
2489 *
2490 * For full documentation of the return codes from recvit, see
2491 * the block header for the recvit function.
2492 */
2493 int
recvfrom(proc_ref_t p,struct recvfrom_args * uap,int32_ref_t retval)2494 recvfrom(proc_ref_t p, struct recvfrom_args *uap, int32_ref_t retval)
2495 {
2496 __pthread_testcancel(1);
2497 return recvfrom_nocancel(p, (struct recvfrom_nocancel_args *)uap,
2498 retval);
2499 }
2500
2501 int
recvfrom_nocancel(proc_ref_t p,struct recvfrom_nocancel_args * uap,int32_ref_t retval)2502 recvfrom_nocancel(proc_ref_t p, struct recvfrom_nocancel_args *uap,
2503 int32_ref_t retval)
2504 {
2505 struct user_msghdr msg;
2506 int error;
2507 uio_t auio = NULL;
2508
2509 KERNEL_DEBUG(DBG_FNC_RECVFROM | DBG_FUNC_START, 0, 0, 0, 0, 0);
2510 AUDIT_ARG(fd, uap->s);
2511
2512 if (uap->fromlenaddr) {
2513 error = copyin(uap->fromlenaddr,
2514 (caddr_t)&msg.msg_namelen, sizeof(msg.msg_namelen));
2515 if (error) {
2516 return error;
2517 }
2518 } else {
2519 msg.msg_namelen = 0;
2520 }
2521 msg.msg_name = uap->from;
2522 auio = uio_create(1, 0,
2523 (IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32),
2524 UIO_READ);
2525 if (auio == NULL) {
2526 return ENOMEM;
2527 }
2528
2529 uio_addiov(auio, uap->buf, uap->len);
2530 /* no need to set up msg_iov. recvit uses uio_t we send it */
2531 msg.msg_iov = 0;
2532 msg.msg_iovlen = 0;
2533 msg.msg_control = 0;
2534 msg.msg_controllen = 0;
2535 msg.msg_flags = uap->flags;
2536 error = recvit(p, uap->s, &msg, auio, uap->fromlenaddr, retval);
2537 if (auio != NULL) {
2538 uio_free(auio);
2539 }
2540
2541 KERNEL_DEBUG(DBG_FNC_RECVFROM | DBG_FUNC_END, error, 0, 0, 0, 0);
2542
2543 return error;
2544 }
2545
2546 /*
2547 * Returns: 0 Success
2548 * EMSGSIZE
2549 * ENOMEM
2550 * copyin:EFAULT
2551 * copyout:EFAULT
2552 * recvit:???
2553 *
2554 * Notes: For full documentation of the return codes from recvit, see
2555 * the block header for the recvit function.
2556 */
2557 int
recvmsg(proc_ref_t p,struct recvmsg_args * uap,int32_ref_t retval)2558 recvmsg(proc_ref_t p, struct recvmsg_args *uap, int32_ref_t retval)
2559 {
2560 __pthread_testcancel(1);
2561 return recvmsg_nocancel(p, (struct recvmsg_nocancel_args *)uap,
2562 retval);
2563 }
2564
2565 int
recvmsg_nocancel(proc_ref_t p,struct recvmsg_nocancel_args * uap,int32_ref_t retval)2566 recvmsg_nocancel(proc_ref_t p, struct recvmsg_nocancel_args *uap,
2567 int32_ref_t retval)
2568 {
2569 struct user32_msghdr msg32;
2570 struct user64_msghdr msg64;
2571 struct user_msghdr user_msg;
2572 caddr_t msghdrp;
2573 int size_of_msghdr;
2574 user_addr_t uiov;
2575 int error;
2576 uio_t auio = NULL;
2577 struct user_iovec *iovp;
2578
2579 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
2580
2581 KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_START, 0, 0, 0, 0, 0);
2582 AUDIT_ARG(fd, uap->s);
2583 if (is_p_64bit_process) {
2584 msghdrp = (caddr_t)&msg64;
2585 size_of_msghdr = sizeof(msg64);
2586 } else {
2587 msghdrp = (caddr_t)&msg32;
2588 size_of_msghdr = sizeof(msg32);
2589 }
2590 error = copyin(uap->msg, msghdrp, size_of_msghdr);
2591 if (error) {
2592 KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
2593 return error;
2594 }
2595
2596 /* only need to copy if user process is not 64-bit */
2597 if (is_p_64bit_process) {
2598 user_msg.msg_flags = msg64.msg_flags;
2599 user_msg.msg_controllen = msg64.msg_controllen;
2600 user_msg.msg_control = (user_addr_t)msg64.msg_control;
2601 user_msg.msg_iovlen = msg64.msg_iovlen;
2602 user_msg.msg_iov = (user_addr_t)msg64.msg_iov;
2603 user_msg.msg_namelen = msg64.msg_namelen;
2604 user_msg.msg_name = (user_addr_t)msg64.msg_name;
2605 } else {
2606 user_msg.msg_flags = msg32.msg_flags;
2607 user_msg.msg_controllen = msg32.msg_controllen;
2608 user_msg.msg_control = msg32.msg_control;
2609 user_msg.msg_iovlen = msg32.msg_iovlen;
2610 user_msg.msg_iov = msg32.msg_iov;
2611 user_msg.msg_namelen = msg32.msg_namelen;
2612 user_msg.msg_name = msg32.msg_name;
2613 }
2614
2615 if (user_msg.msg_iovlen <= 0 || user_msg.msg_iovlen > UIO_MAXIOV) {
2616 KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_END, EMSGSIZE,
2617 0, 0, 0, 0);
2618 return EMSGSIZE;
2619 }
2620
2621 user_msg.msg_flags = uap->flags;
2622
2623 /* allocate a uio large enough to hold the number of iovecs passed */
2624 auio = uio_create(user_msg.msg_iovlen, 0,
2625 (is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32),
2626 UIO_READ);
2627 if (auio == NULL) {
2628 error = ENOMEM;
2629 goto done;
2630 }
2631
2632 /*
2633 * get location of iovecs within the uio. then copyin the iovecs from
2634 * user space.
2635 */
2636 iovp = uio_iovsaddr(auio);
2637 if (iovp == NULL) {
2638 error = ENOMEM;
2639 goto done;
2640 }
2641 uiov = user_msg.msg_iov;
2642 user_msg.msg_iov = CAST_USER_ADDR_T(iovp);
2643 error = copyin_user_iovec_array(uiov,
2644 is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32,
2645 user_msg.msg_iovlen, iovp);
2646 if (error) {
2647 goto done;
2648 }
2649
2650 /* finish setup of uio_t */
2651 error = uio_calculateresid(auio);
2652 if (error) {
2653 goto done;
2654 }
2655
2656 error = recvit(p, uap->s, &user_msg, auio, 0, retval);
2657 if (!error) {
2658 user_msg.msg_iov = uiov;
2659 if (is_p_64bit_process) {
2660 msg64.msg_flags = user_msg.msg_flags;
2661 msg64.msg_controllen = user_msg.msg_controllen;
2662 msg64.msg_control = user_msg.msg_control;
2663 msg64.msg_iovlen = user_msg.msg_iovlen;
2664 msg64.msg_iov = user_msg.msg_iov;
2665 msg64.msg_namelen = user_msg.msg_namelen;
2666 msg64.msg_name = user_msg.msg_name;
2667 } else {
2668 msg32.msg_flags = user_msg.msg_flags;
2669 msg32.msg_controllen = user_msg.msg_controllen;
2670 msg32.msg_control = (user32_addr_t)user_msg.msg_control;
2671 msg32.msg_iovlen = user_msg.msg_iovlen;
2672 msg32.msg_iov = (user32_addr_t)user_msg.msg_iov;
2673 msg32.msg_namelen = user_msg.msg_namelen;
2674 msg32.msg_name = (user32_addr_t)user_msg.msg_name;
2675 }
2676 error = copyout(msghdrp, uap->msg, size_of_msghdr);
2677 }
2678 done:
2679 if (auio != NULL) {
2680 uio_free(auio);
2681 }
2682 KERNEL_DEBUG(DBG_FNC_RECVMSG | DBG_FUNC_END, error, 0, 0, 0, 0);
2683 return error;
2684 }
2685
2686 __attribute__((noinline))
2687 static int
recvmsg_x_array(proc_ref_t p,socket_ref_t so,struct recvmsg_x_args * uap,user_ssize_t * retval)2688 recvmsg_x_array(proc_ref_t p, socket_ref_t so, struct recvmsg_x_args *uap, user_ssize_t *retval)
2689 {
2690 int error = EOPNOTSUPP;
2691 user_msghdr_x_ptr_t user_msg_x = NULL;
2692 recv_msg_elem_ptr_t recv_msg_array = NULL;
2693 user_ssize_t len_before = 0, len_after;
2694 size_t size_of_msghdr;
2695 void_ptr_t umsgp = NULL;
2696 u_int i;
2697 u_int uiocnt;
2698 int flags = uap->flags;
2699
2700 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
2701
2702 size_of_msghdr = is_p_64bit_process ?
2703 sizeof(struct user64_msghdr_x) : sizeof(struct user32_msghdr_x);
2704
2705 /*
2706 * Support only a subset of message flags
2707 */
2708 if (uap->flags & ~(MSG_PEEK | MSG_WAITALL | MSG_DONTWAIT | MSG_NEEDSA | MSG_NBIO)) {
2709 return EOPNOTSUPP;
2710 }
2711 /*
2712 * Input parameter range check
2713 */
2714 if (uap->cnt == 0 || uap->cnt > UIO_MAXIOV) {
2715 error = EINVAL;
2716 goto out;
2717 }
2718 if (uap->cnt > somaxrecvmsgx) {
2719 uap->cnt = somaxrecvmsgx > 0 ? somaxrecvmsgx : 1;
2720 }
2721
2722 user_msg_x = kalloc_type(struct user_msghdr_x, uap->cnt,
2723 Z_WAITOK | Z_ZERO);
2724 if (user_msg_x == NULL) {
2725 DBG_PRINTF("%s user_msg_x alloc failed", __func__);
2726 error = ENOMEM;
2727 goto out;
2728 }
2729 recv_msg_array = alloc_recv_msg_array(uap->cnt);
2730 if (recv_msg_array == NULL) {
2731 DBG_PRINTF("%s alloc_recv_msg_array() failed", __func__);
2732 error = ENOMEM;
2733 goto out;
2734 }
2735
2736 umsgp = kalloc_data(uap->cnt * size_of_msghdr, Z_WAITOK | Z_ZERO);
2737 if (umsgp == NULL) {
2738 DBG_PRINTF("%s umsgp alloc failed", __func__);
2739 error = ENOMEM;
2740 goto out;
2741 }
2742 error = copyin(uap->msgp, umsgp, uap->cnt * size_of_msghdr);
2743 if (error) {
2744 DBG_PRINTF("%s copyin() failed", __func__);
2745 goto out;
2746 }
2747 error = internalize_recv_msghdr_array(umsgp,
2748 is_p_64bit_process ? UIO_USERSPACE64 : UIO_USERSPACE32,
2749 UIO_READ, uap->cnt, user_msg_x, recv_msg_array);
2750 if (error) {
2751 DBG_PRINTF("%s copyin_user_msghdr_array() failed", __func__);
2752 goto out;
2753 }
2754 /*
2755 * Make sure the size of each message iovec and
2756 * the aggregate size of all the iovec is valid
2757 */
2758 if (recv_msg_array_is_valid(recv_msg_array, uap->cnt) == 0) {
2759 error = EINVAL;
2760 goto out;
2761 }
2762 /*
2763 * Sanity check on passed arguments
2764 */
2765 for (i = 0; i < uap->cnt; i++) {
2766 struct user_msghdr_x *mp = user_msg_x + i;
2767
2768 if (mp->msg_flags != 0) {
2769 error = EINVAL;
2770 goto out;
2771 }
2772 }
2773 #if CONFIG_MACF_SOCKET_SUBSET
2774 /*
2775 * We check the state without holding the socket lock;
2776 * if a race condition occurs, it would simply result
2777 * in an extra call to the MAC check function.
2778 */
2779 if (!(so->so_state & SS_DEFUNCT) &&
2780 !(so->so_state & SS_ISCONNECTED) &&
2781 !(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
2782 (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0) {
2783 goto out;
2784 }
2785 #endif /* MAC_SOCKET_SUBSET */
2786
2787 len_before = recv_msg_array_resid(recv_msg_array, uap->cnt);
2788
2789 for (i = 0; i < uap->cnt; i++) {
2790 struct recv_msg_elem *recv_msg_elem;
2791 uio_t auio;
2792 sockaddr_ref_ref_t psa;
2793 struct mbuf **controlp;
2794
2795 recv_msg_elem = recv_msg_array + i;
2796 auio = recv_msg_elem->uio;
2797
2798 /*
2799 * Do not block if we got at least one packet
2800 */
2801 if (i > 0) {
2802 flags |= MSG_DONTWAIT;
2803 }
2804
2805 psa = (recv_msg_elem->which & SOCK_MSG_SA) ?
2806 &recv_msg_elem->psa : NULL;
2807 controlp = (recv_msg_elem->which & SOCK_MSG_CONTROL) ?
2808 &recv_msg_elem->controlp : NULL;
2809
2810 error = so->so_proto->pr_usrreqs->pru_soreceive(so, psa,
2811 auio, NULL, controlp, &flags);
2812 if (error) {
2813 break;
2814 }
2815 /*
2816 * We have some data
2817 */
2818 recv_msg_elem->which |= SOCK_MSG_DATA;
2819 /*
2820 * Set the messages flags for this packet
2821 */
2822 flags &= ~MSG_DONTWAIT;
2823 recv_msg_elem->flags = flags;
2824 /*
2825 * Stop on partial copy
2826 */
2827 if (recv_msg_elem->flags & (MSG_RCVMORE | MSG_TRUNC)) {
2828 break;
2829 }
2830 }
2831
2832 len_after = recv_msg_array_resid(recv_msg_array, uap->cnt);
2833
2834 if (error) {
2835 if (len_after != len_before && (error == ERESTART ||
2836 error == EINTR || error == EWOULDBLOCK)) {
2837 error = 0;
2838 } else {
2839 goto out;
2840 }
2841 }
2842
2843 uiocnt = externalize_recv_msghdr_array(p, so, umsgp,
2844 uap->cnt, user_msg_x, recv_msg_array, &error);
2845 if (error != 0) {
2846 goto out;
2847 }
2848
2849 error = copyout(umsgp, uap->msgp, uap->cnt * size_of_msghdr);
2850 if (error) {
2851 DBG_PRINTF("%s copyout() failed", __func__);
2852 goto out;
2853 }
2854 *retval = (int)(uiocnt);
2855
2856 out:
2857 kfree_data(umsgp, uap->cnt * size_of_msghdr);
2858 free_recv_msg_array(recv_msg_array, uap->cnt);
2859 kfree_type(struct user_msghdr_x, uap->cnt, user_msg_x);
2860
2861 return error;
2862 }
2863
2864 int
recvmsg_x(struct proc * p,struct recvmsg_x_args * uap,user_ssize_t * retval)2865 recvmsg_x(struct proc *p, struct recvmsg_x_args *uap, user_ssize_t *retval)
2866 {
2867 int error = EOPNOTSUPP;
2868 socket_ref_t so;
2869 size_t size_of_msghdrx;
2870 caddr_t msghdrxp;
2871 struct user32_msghdr_x msghdrx32 = {};
2872 struct user64_msghdr_x msghdrx64 = {};
2873 int spacetype;
2874 u_int i;
2875 uio_t auio = NULL;
2876 caddr_t src;
2877 int flags;
2878 struct mbuf *pkt_list = NULL, *m;
2879 struct mbuf *addr_list = NULL, *m_addr;
2880 struct mbuf *ctl_list = NULL, *control;
2881 u_int pktcnt;
2882
2883 KERNEL_DEBUG(DBG_FNC_RECVMSG_X | DBG_FUNC_START, 0, 0, 0, 0, 0);
2884
2885 error = file_socket(uap->s, &so);
2886 if (error) {
2887 goto done_no_filedrop;
2888 }
2889 if (so == NULL) {
2890 error = EBADF;
2891 goto done;
2892 }
2893
2894 #if CONFIG_MACF_SOCKET_SUBSET
2895 /*
2896 * We check the state without holding the socket lock;
2897 * if a race condition occurs, it would simply result
2898 * in an extra call to the MAC check function.
2899 */
2900 if (!(so->so_state & SS_DEFUNCT) &&
2901 !(so->so_state & SS_ISCONNECTED) &&
2902 !(so->so_proto->pr_flags & PR_CONNREQUIRED) &&
2903 (error = mac_socket_check_receive(kauth_cred_get(), so)) != 0) {
2904 goto done;
2905 }
2906 #endif /* MAC_SOCKET_SUBSET */
2907
2908 /*
2909 * With soreceive_m_list, all packets must be uniform, with address and
2910 * control as they are returned in parallel lists and it's only guaranteed
2911 * when pru_send_list is supported
2912 */
2913 if (do_recvmsg_x_donttrunc != 0 || (so->so_options & SO_DONTTRUNC)) {
2914 error = recvmsg_x_array(p, so, uap, retval);
2915 goto done;
2916 }
2917
2918 /*
2919 * Input parameter range check
2920 */
2921 if (uap->cnt == 0 || uap->cnt > UIO_MAXIOV) {
2922 error = EINVAL;
2923 goto done;
2924 }
2925 if (uap->cnt > somaxrecvmsgx) {
2926 uap->cnt = somaxrecvmsgx > 0 ? somaxrecvmsgx : 1;
2927 }
2928
2929 if (IS_64BIT_PROCESS(p)) {
2930 msghdrxp = (caddr_t)&msghdrx64;
2931 size_of_msghdrx = sizeof(struct user64_msghdr_x);
2932 spacetype = UIO_USERSPACE64;
2933 } else {
2934 msghdrxp = (caddr_t)&msghdrx32;
2935 size_of_msghdrx = sizeof(struct user32_msghdr_x);
2936 spacetype = UIO_USERSPACE32;
2937 }
2938 src = (caddr_t)uap->msgp;
2939
2940 flags = uap->flags;
2941
2942 /*
2943 * Only allow MSG_DONTWAIT
2944 */
2945 if ((flags & ~(MSG_DONTWAIT | MSG_NBIO)) != 0) {
2946 error = EINVAL;
2947 goto done;
2948 }
2949
2950 /*
2951 * Receive list of packet in a single call
2952 */
2953 pktcnt = uap->cnt;
2954 error = soreceive_m_list(so, &pktcnt, &addr_list, &pkt_list, &ctl_list,
2955 &flags);
2956 if (error != 0) {
2957 if (pktcnt != 0 && (error == ERESTART ||
2958 error == EINTR || error == EWOULDBLOCK)) {
2959 error = 0;
2960 } else {
2961 goto done;
2962 }
2963 }
2964
2965 m_addr = addr_list;
2966 m = pkt_list;
2967 control = ctl_list;
2968
2969 for (i = 0; i < pktcnt; i++) {
2970 struct user_msghdr user_msg;
2971 ssize_t len;
2972 struct user_iovec *iovp;
2973 struct mbuf *n;
2974
2975 if (m->m_type != MT_OOBDATA && m->m_type != MT_DATA &&
2976 m->m_type != MT_HEADER) {
2977 panic("%s: m %p m_type %d != MT_DATA", __func__, m, m->m_type);
2978 }
2979
2980 error = copyin((user_addr_t)(src + i * size_of_msghdrx),
2981 msghdrxp, size_of_msghdrx);
2982 if (error) {
2983 DBG_PRINTF("%s copyin() msghdrx failed %d\n",
2984 __func__, error);
2985 goto done;
2986 }
2987 if (spacetype == UIO_USERSPACE64) {
2988 user_msg.msg_name = msghdrx64.msg_name;
2989 user_msg.msg_namelen = msghdrx64.msg_namelen;
2990 user_msg.msg_iov = msghdrx64.msg_iov;
2991 user_msg.msg_iovlen = msghdrx64.msg_iovlen;
2992 user_msg.msg_control = msghdrx64.msg_control;
2993 user_msg.msg_controllen = msghdrx64.msg_controllen;
2994 } else {
2995 user_msg.msg_name = msghdrx32.msg_name;
2996 user_msg.msg_namelen = msghdrx32.msg_namelen;
2997 user_msg.msg_iov = msghdrx32.msg_iov;
2998 user_msg.msg_iovlen = msghdrx32.msg_iovlen;
2999 user_msg.msg_control = msghdrx32.msg_control;
3000 user_msg.msg_controllen = msghdrx32.msg_controllen;
3001 }
3002 user_msg.msg_flags = 0;
3003 if (user_msg.msg_iovlen <= 0 ||
3004 user_msg.msg_iovlen > UIO_MAXIOV) {
3005 error = EMSGSIZE;
3006 DBG_PRINTF("%s bad msg_iovlen, error %d\n",
3007 __func__, error);
3008 goto done;
3009 }
3010 /*
3011 * Attempt to reuse the uio if large enough, otherwise we need
3012 * a new one
3013 */
3014 if (auio != NULL) {
3015 if (auio->uio_max_iovs <= user_msg.msg_iovlen) {
3016 uio_reset(auio, 0, spacetype, UIO_READ);
3017 } else {
3018 uio_free(auio);
3019 auio = NULL;
3020 }
3021 }
3022 if (auio == NULL) {
3023 auio = uio_create(user_msg.msg_iovlen, 0, spacetype,
3024 UIO_READ);
3025 if (auio == NULL) {
3026 error = ENOBUFS;
3027 DBG_PRINTF("%s uio_create() failed %d\n",
3028 __func__, error);
3029 goto done;
3030 }
3031 }
3032 /*
3033 * get location of iovecs within the uio then copy the iovecs
3034 * from user space.
3035 */
3036 iovp = uio_iovsaddr(auio);
3037 if (iovp == NULL) {
3038 error = ENOMEM;
3039 DBG_PRINTF("%s uio_iovsaddr() failed %d\n",
3040 __func__, error);
3041 goto done;
3042 }
3043 error = copyin_user_iovec_array(user_msg.msg_iov,
3044 spacetype, user_msg.msg_iovlen, iovp);
3045 if (error != 0) {
3046 DBG_PRINTF("%s copyin_user_iovec_array() failed %d\n",
3047 __func__, error);
3048 goto done;
3049 }
3050 error = uio_calculateresid(auio);
3051 if (error != 0) {
3052 DBG_PRINTF("%s uio_calculateresid() failed %d\n",
3053 __func__, error);
3054 goto done;
3055 }
3056 user_msg.msg_iov = CAST_USER_ADDR_T(iovp);
3057
3058 len = uio_resid(auio);
3059 for (n = m; n != NULL; n = n->m_next) {
3060 user_ssize_t resid = uio_resid(auio);
3061 if (resid < n->m_len) {
3062 error = uiomove(mtod(n, caddr_t), (int)n->m_len, auio);
3063 if (error != 0) {
3064 DBG_PRINTF("%s uiomove() failed\n",
3065 __func__);
3066 goto done;
3067 }
3068 flags |= MSG_TRUNC;
3069 break;
3070 }
3071
3072 error = uiomove(mtod(n, caddr_t), (int)n->m_len, auio);
3073 if (error != 0) {
3074 DBG_PRINTF("%s uiomove() failed\n",
3075 __func__);
3076 goto done;
3077 }
3078 }
3079 len -= uio_resid(auio);
3080
3081 if (user_msg.msg_name != 0 && user_msg.msg_namelen != 0) {
3082 error = copyout_maddr(m_addr, user_msg.msg_name,
3083 &user_msg.msg_namelen);
3084 if (error) {
3085 DBG_PRINTF("%s copyout_maddr() failed\n",
3086 __func__);
3087 goto done;
3088 }
3089 }
3090 if (user_msg.msg_control != 0 && user_msg.msg_controllen != 0) {
3091 error = copyout_control(p, control,
3092 user_msg.msg_control, &user_msg.msg_controllen,
3093 &user_msg.msg_flags, so);
3094 if (error) {
3095 DBG_PRINTF("%s copyout_control() failed\n",
3096 __func__);
3097 goto done;
3098 }
3099 }
3100 /*
3101 * Note: the original msg_iovlen and msg_iov do not change
3102 */
3103 if (spacetype == UIO_USERSPACE64) {
3104 msghdrx64.msg_flags = user_msg.msg_flags;
3105 msghdrx64.msg_controllen = user_msg.msg_controllen;
3106 msghdrx64.msg_control = user_msg.msg_control;
3107 msghdrx64.msg_namelen = user_msg.msg_namelen;
3108 msghdrx64.msg_name = user_msg.msg_name;
3109 msghdrx64.msg_datalen = len;
3110 } else {
3111 msghdrx32.msg_flags = user_msg.msg_flags;
3112 msghdrx32.msg_controllen = user_msg.msg_controllen;
3113 msghdrx32.msg_control = (user32_addr_t) user_msg.msg_control;
3114 msghdrx32.msg_name = user_msg.msg_namelen;
3115 msghdrx32.msg_name = (user32_addr_t) user_msg.msg_name;
3116 msghdrx32.msg_datalen = (user32_size_t) len;
3117 }
3118 error = copyout(msghdrxp,
3119 (user_addr_t)(src + i * size_of_msghdrx),
3120 size_of_msghdrx);
3121 if (error) {
3122 DBG_PRINTF("%s copyout() msghdrx failed\n", __func__);
3123 goto done;
3124 }
3125
3126 m = m->m_nextpkt;
3127 if (control != NULL) {
3128 control = control->m_nextpkt;
3129 }
3130 if (m_addr != NULL) {
3131 m_addr = m_addr->m_nextpkt;
3132 }
3133 }
3134
3135 uap->flags = flags;
3136
3137 *retval = (int)i;
3138 done:
3139 file_drop(uap->s);
3140
3141 done_no_filedrop:
3142 if (pkt_list != NULL) {
3143 m_freem_list(pkt_list);
3144 }
3145 if (addr_list != NULL) {
3146 m_freem_list(addr_list);
3147 }
3148 if (ctl_list != NULL) {
3149 m_freem_list(ctl_list);
3150 }
3151 if (auio != NULL) {
3152 uio_free(auio);
3153 }
3154
3155 KERNEL_DEBUG(DBG_FNC_RECVMSG_X | DBG_FUNC_END, error, 0, 0, 0, 0);
3156
3157 return error;
3158 }
3159
3160 /*
3161 * Returns: 0 Success
3162 * EBADF
3163 * file_socket:ENOTSOCK
3164 * file_socket:EBADF
3165 * soshutdown:EINVAL
3166 * soshutdown:ENOTCONN
3167 * soshutdown:EADDRNOTAVAIL[TCP]
3168 * soshutdown:ENOBUFS[TCP]
3169 * soshutdown:EMSGSIZE[TCP]
3170 * soshutdown:EHOSTUNREACH[TCP]
3171 * soshutdown:ENETUNREACH[TCP]
3172 * soshutdown:ENETDOWN[TCP]
3173 * soshutdown:ENOMEM[TCP]
3174 * soshutdown:EACCES[TCP]
3175 * soshutdown:EMSGSIZE[TCP]
3176 * soshutdown:ENOBUFS[TCP]
3177 * soshutdown:???[TCP] [ignorable: mostly IPSEC/firewall/DLIL]
3178 * soshutdown:??? [other protocol families]
3179 */
3180 /* ARGSUSED */
3181 int
shutdown(__unused proc_ref_t p,struct shutdown_args * uap,__unused int32_ref_t retval)3182 shutdown(__unused proc_ref_t p, struct shutdown_args *uap,
3183 __unused int32_ref_t retval)
3184 {
3185 socket_ref_t so;
3186 int error;
3187
3188 AUDIT_ARG(fd, uap->s);
3189 error = file_socket(uap->s, &so);
3190 if (error) {
3191 return error;
3192 }
3193 if (so == NULL) {
3194 error = EBADF;
3195 goto out;
3196 }
3197 error = soshutdown((struct socket *)so, uap->how);
3198 out:
3199 file_drop(uap->s);
3200 return error;
3201 }
3202
3203 /*
3204 * Returns: 0 Success
3205 * EFAULT
3206 * EINVAL
3207 * EACCES Mandatory Access Control failure
3208 * file_socket:ENOTSOCK
3209 * file_socket:EBADF
3210 * sosetopt:EINVAL
3211 * sosetopt:ENOPROTOOPT
3212 * sosetopt:ENOBUFS
3213 * sosetopt:EDOM
3214 * sosetopt:EFAULT
3215 * sosetopt:EOPNOTSUPP[AF_UNIX]
3216 * sosetopt:???
3217 */
3218 /* ARGSUSED */
3219 int
setsockopt(proc_ref_t p,setsockopt_args_ref_t uap,__unused int32_ref_t retval)3220 setsockopt(proc_ref_t p, setsockopt_args_ref_t uap,
3221 __unused int32_ref_t retval)
3222 {
3223 socket_ref_t so;
3224 struct sockopt sopt;
3225 int error;
3226
3227 AUDIT_ARG(fd, uap->s);
3228 if (uap->val == 0 && uap->valsize != 0) {
3229 return EFAULT;
3230 }
3231 /* No bounds checking on size (it's unsigned) */
3232
3233 error = file_socket(uap->s, &so);
3234 if (error) {
3235 return error;
3236 }
3237
3238 sopt.sopt_dir = SOPT_SET;
3239 sopt.sopt_level = uap->level;
3240 sopt.sopt_name = uap->name;
3241 sopt.sopt_val = uap->val;
3242 sopt.sopt_valsize = uap->valsize;
3243 sopt.sopt_p = p;
3244
3245 if (so == NULL) {
3246 error = EINVAL;
3247 goto out;
3248 }
3249 #if CONFIG_MACF_SOCKET_SUBSET
3250 if ((error = mac_socket_check_setsockopt(kauth_cred_get(), so,
3251 &sopt)) != 0) {
3252 goto out;
3253 }
3254 #endif /* MAC_SOCKET_SUBSET */
3255 error = sosetoptlock(so, &sopt, 1); /* will lock socket */
3256 out:
3257 file_drop(uap->s);
3258 return error;
3259 }
3260
3261
3262
3263 /*
3264 * Returns: 0 Success
3265 * EINVAL
3266 * EBADF
3267 * EACCES Mandatory Access Control failure
3268 * copyin:EFAULT
3269 * copyout:EFAULT
3270 * file_socket:ENOTSOCK
3271 * file_socket:EBADF
3272 * sogetopt:???
3273 */
3274 int
getsockopt(proc_ref_t p,struct getsockopt_args * uap,__unused int32_ref_t retval)3275 getsockopt(proc_ref_t p, struct getsockopt_args *uap,
3276 __unused int32_ref_t retval)
3277 {
3278 int error;
3279 socklen_t valsize;
3280 struct sockopt sopt;
3281 socket_ref_t so;
3282
3283 error = file_socket(uap->s, &so);
3284 if (error) {
3285 return error;
3286 }
3287 if (uap->val) {
3288 error = copyin(uap->avalsize, (caddr_t)&valsize,
3289 sizeof(valsize));
3290 if (error) {
3291 goto out;
3292 }
3293 /* No bounds checking on size (it's unsigned) */
3294 } else {
3295 valsize = 0;
3296 }
3297 sopt.sopt_dir = SOPT_GET;
3298 sopt.sopt_level = uap->level;
3299 sopt.sopt_name = uap->name;
3300 sopt.sopt_val = uap->val;
3301 sopt.sopt_valsize = (size_t)valsize; /* checked non-negative above */
3302 sopt.sopt_p = p;
3303
3304 if (so == NULL) {
3305 error = EBADF;
3306 goto out;
3307 }
3308 #if CONFIG_MACF_SOCKET_SUBSET
3309 if ((error = mac_socket_check_getsockopt(kauth_cred_get(), so,
3310 &sopt)) != 0) {
3311 goto out;
3312 }
3313 #endif /* MAC_SOCKET_SUBSET */
3314 error = sogetoptlock((struct socket *)so, &sopt, 1); /* will lock */
3315 if (error == 0) {
3316 valsize = (socklen_t)sopt.sopt_valsize;
3317 error = copyout((caddr_t)&valsize, uap->avalsize,
3318 sizeof(valsize));
3319 }
3320 out:
3321 file_drop(uap->s);
3322 return error;
3323 }
3324
3325
3326 /*
3327 * Get socket name.
3328 *
3329 * Returns: 0 Success
3330 * EBADF
3331 * file_socket:ENOTSOCK
3332 * file_socket:EBADF
3333 * copyin:EFAULT
3334 * copyout:EFAULT
3335 * <pru_sockaddr>:ENOBUFS[TCP]
3336 * <pru_sockaddr>:ECONNRESET[TCP]
3337 * <pru_sockaddr>:EINVAL[AF_UNIX]
3338 * <sf_getsockname>:???
3339 */
3340 /* ARGSUSED */
3341 int
getsockname(__unused proc_ref_t p,struct getsockname_args * uap,__unused int32_ref_t retval)3342 getsockname(__unused proc_ref_t p, struct getsockname_args *uap,
3343 __unused int32_ref_t retval)
3344 {
3345 socket_ref_t so;
3346 sockaddr_ref_t sa;
3347 socklen_t len;
3348 socklen_t sa_len;
3349 int error;
3350
3351 error = file_socket(uap->fdes, &so);
3352 if (error) {
3353 return error;
3354 }
3355 error = copyin(uap->alen, (caddr_t)&len, sizeof(socklen_t));
3356 if (error) {
3357 goto out;
3358 }
3359 if (so == NULL) {
3360 error = EBADF;
3361 goto out;
3362 }
3363 sa = 0;
3364 socket_lock(so, 1);
3365 error = (*so->so_proto->pr_usrreqs->pru_sockaddr)(so, &sa);
3366 if (error == 0) {
3367 error = sflt_getsockname(so, &sa);
3368 if (error == EJUSTRETURN) {
3369 error = 0;
3370 }
3371 }
3372 socket_unlock(so, 1);
3373 if (error) {
3374 goto bad;
3375 }
3376 if (sa == 0) {
3377 len = 0;
3378 goto gotnothing;
3379 }
3380
3381 sa_len = sa->sa_len;
3382 len = MIN(len, sa_len);
3383 error = copyout((caddr_t)sa, uap->asa, len);
3384 if (error) {
3385 goto bad;
3386 }
3387 /* return the actual, untruncated address length */
3388 len = sa_len;
3389 gotnothing:
3390 error = copyout((caddr_t)&len, uap->alen, sizeof(socklen_t));
3391 bad:
3392 free_sockaddr(sa);
3393 out:
3394 file_drop(uap->fdes);
3395 return error;
3396 }
3397
3398 /*
3399 * Get name of peer for connected socket.
3400 *
3401 * Returns: 0 Success
3402 * EBADF
3403 * EINVAL
3404 * ENOTCONN
3405 * file_socket:ENOTSOCK
3406 * file_socket:EBADF
3407 * copyin:EFAULT
3408 * copyout:EFAULT
3409 * <pru_peeraddr>:???
3410 * <sf_getpeername>:???
3411 */
3412 /* ARGSUSED */
3413 int
getpeername(__unused proc_ref_t p,struct getpeername_args * uap,__unused int32_ref_t retval)3414 getpeername(__unused proc_ref_t p, struct getpeername_args *uap,
3415 __unused int32_ref_t retval)
3416 {
3417 socket_ref_t so;
3418 sockaddr_ref_t sa;
3419 socklen_t len;
3420 socklen_t sa_len;
3421 int error;
3422
3423 error = file_socket(uap->fdes, &so);
3424 if (error) {
3425 return error;
3426 }
3427 if (so == NULL) {
3428 error = EBADF;
3429 goto out;
3430 }
3431
3432 socket_lock(so, 1);
3433
3434 if ((so->so_state & (SS_CANTRCVMORE | SS_CANTSENDMORE)) ==
3435 (SS_CANTRCVMORE | SS_CANTSENDMORE)) {
3436 /* the socket has been shutdown, no more getpeername's */
3437 socket_unlock(so, 1);
3438 error = EINVAL;
3439 goto out;
3440 }
3441
3442 if ((so->so_state & (SS_ISCONNECTED | SS_ISCONFIRMING)) == 0) {
3443 socket_unlock(so, 1);
3444 error = ENOTCONN;
3445 goto out;
3446 }
3447 error = copyin(uap->alen, (caddr_t)&len, sizeof(socklen_t));
3448 if (error) {
3449 socket_unlock(so, 1);
3450 goto out;
3451 }
3452 sa = 0;
3453 error = (*so->so_proto->pr_usrreqs->pru_peeraddr)(so, &sa);
3454 if (error == 0) {
3455 error = sflt_getpeername(so, &sa);
3456 if (error == EJUSTRETURN) {
3457 error = 0;
3458 }
3459 }
3460 socket_unlock(so, 1);
3461 if (error) {
3462 goto bad;
3463 }
3464 if (sa == 0) {
3465 len = 0;
3466 goto gotnothing;
3467 }
3468 sa_len = sa->sa_len;
3469 len = MIN(len, sa_len);
3470 error = copyout(sa, uap->asa, len);
3471 if (error) {
3472 goto bad;
3473 }
3474 /* return the actual, untruncated address length */
3475 len = sa_len;
3476 gotnothing:
3477 error = copyout((caddr_t)&len, uap->alen, sizeof(socklen_t));
3478 bad:
3479 free_sockaddr(sa);
3480 out:
3481 file_drop(uap->fdes);
3482 return error;
3483 }
3484
3485 int
sockargs(struct mbuf ** mp,user_addr_t data,socklen_t buflen,int type)3486 sockargs(struct mbuf **mp, user_addr_t data, socklen_t buflen, int type)
3487 {
3488 sockaddr_ref_t sa;
3489 struct mbuf *m;
3490 int error;
3491 socklen_t alloc_buflen = buflen;
3492
3493 if (buflen > INT_MAX / 2) {
3494 return EINVAL;
3495 }
3496 if (type == MT_SONAME && (buflen > SOCK_MAXADDRLEN ||
3497 buflen < offsetof(struct sockaddr, sa_data[0]))) {
3498 return EINVAL;
3499 }
3500 if (type == MT_CONTROL && buflen < sizeof(struct cmsghdr)) {
3501 return EINVAL;
3502 }
3503
3504 #ifdef __LP64__
3505 /*
3506 * The fd's in the buffer must expand to be pointers, thus we need twice
3507 * as much space
3508 */
3509 if (type == MT_CONTROL) {
3510 alloc_buflen = ((buflen - sizeof(struct cmsghdr)) * 2) +
3511 sizeof(struct cmsghdr);
3512 }
3513 #endif
3514 if (alloc_buflen > MLEN) {
3515 if (type == MT_SONAME && alloc_buflen <= 112) {
3516 alloc_buflen = MLEN; /* unix domain compat. hack */
3517 } else if (alloc_buflen > MCLBYTES) {
3518 return EINVAL;
3519 }
3520 }
3521 m = m_get(M_WAIT, type);
3522 if (m == NULL) {
3523 return ENOBUFS;
3524 }
3525 if (alloc_buflen > MLEN) {
3526 MCLGET(m, M_WAIT);
3527 if ((m->m_flags & M_EXT) == 0) {
3528 m_free(m);
3529 return ENOBUFS;
3530 }
3531 }
3532 /*
3533 * K64: We still copyin the original buflen because it gets expanded
3534 * later and we lie about the size of the mbuf because it only affects
3535 * unp_* functions
3536 */
3537 m->m_len = buflen;
3538 error = copyin(data, mtod(m, caddr_t), (u_int)buflen);
3539 if (error) {
3540 (void) m_free(m);
3541 } else {
3542 *mp = m;
3543 if (type == MT_SONAME) {
3544 VERIFY(buflen <= SOCK_MAXADDRLEN);
3545 sa = mtod(m, sockaddr_ref_t);
3546 sa->sa_len = (__uint8_t)buflen;
3547 }
3548 }
3549 return error;
3550 }
3551
3552 /*
3553 * Given a user_addr_t of length len, allocate and fill out a *sa.
3554 *
3555 * Returns: 0 Success
3556 * ENAMETOOLONG Filename too long
3557 * EINVAL Invalid argument
3558 * ENOMEM Not enough space
3559 * copyin:EFAULT Bad address
3560 */
3561 static int
getsockaddr(struct socket * so,sockaddr_ref_ref_t namp,user_addr_t uaddr,size_t len,boolean_t translate_unspec)3562 getsockaddr(struct socket *so, sockaddr_ref_ref_t namp, user_addr_t uaddr,
3563 size_t len, boolean_t translate_unspec)
3564 {
3565 sockaddr_ref_t sa;
3566 int error;
3567
3568 if (len > SOCK_MAXADDRLEN) {
3569 return ENAMETOOLONG;
3570 }
3571
3572 if (len < offsetof(struct sockaddr, sa_data[0])) {
3573 return EINVAL;
3574 }
3575
3576 sa = (sockaddr_ref_t)alloc_sockaddr(len, Z_WAITOK | Z_NOFAIL);
3577
3578 error = copyin(uaddr, (caddr_t)sa, len);
3579 if (error) {
3580 free_sockaddr(sa);
3581 } else {
3582 /*
3583 * Force sa_family to AF_INET on AF_INET sockets to handle
3584 * legacy applications that use AF_UNSPEC (0). On all other
3585 * sockets we leave it unchanged and let the lower layer
3586 * handle it.
3587 */
3588 if (translate_unspec && sa->sa_family == AF_UNSPEC &&
3589 SOCK_CHECK_DOM(so, PF_INET) &&
3590 len == sizeof(struct sockaddr_in)) {
3591 sa->sa_family = AF_INET;
3592 }
3593 VERIFY(len <= SOCK_MAXADDRLEN);
3594 sa = *&sa;
3595 sa->sa_len = (__uint8_t)len;
3596 *namp = sa;
3597 }
3598 return error;
3599 }
3600
3601 static int
getsockaddr_s(struct socket * so,sockaddr_storage_ref_t ss,user_addr_t uaddr,size_t len,boolean_t translate_unspec)3602 getsockaddr_s(struct socket *so, sockaddr_storage_ref_t ss,
3603 user_addr_t uaddr, size_t len, boolean_t translate_unspec)
3604 {
3605 int error;
3606
3607 if (ss == NULL || uaddr == USER_ADDR_NULL ||
3608 len < offsetof(struct sockaddr, sa_data[0])) {
3609 return EINVAL;
3610 }
3611
3612 /*
3613 * sockaddr_storage size is less than SOCK_MAXADDRLEN,
3614 * so the check here is inclusive.
3615 */
3616 if (len > sizeof(*ss)) {
3617 return ENAMETOOLONG;
3618 }
3619
3620 bzero(ss, sizeof(*ss));
3621 error = copyin(uaddr, (caddr_t)ss, len);
3622 if (error == 0) {
3623 /*
3624 * Force sa_family to AF_INET on AF_INET sockets to handle
3625 * legacy applications that use AF_UNSPEC (0). On all other
3626 * sockets we leave it unchanged and let the lower layer
3627 * handle it.
3628 */
3629 if (translate_unspec && ss->ss_family == AF_UNSPEC &&
3630 SOCK_CHECK_DOM(so, PF_INET) &&
3631 len == sizeof(struct sockaddr_in)) {
3632 ss->ss_family = AF_INET;
3633 }
3634
3635 ss->ss_len = (__uint8_t)len;
3636 }
3637 return error;
3638 }
3639
3640 #if DEBUG || DEVELOPMENT
3641 int
internalize_user_msghdr_array(const void_ptr_t src,int spacetype,int direction,u_int count,user_msghdr_x_ptr_t dst,uio_ref_ptr_t uiop)3642 internalize_user_msghdr_array(const void_ptr_t src, int spacetype, int direction,
3643 u_int count, user_msghdr_x_ptr_t dst, uio_ref_ptr_t uiop)
3644 {
3645 int error = 0;
3646 u_int i;
3647 u_int namecnt = 0;
3648 u_int ctlcnt = 0;
3649
3650 for (i = 0; i < count; i++) {
3651 uio_t auio;
3652 struct user_iovec *iovp;
3653 struct user_msghdr_x *user_msg = dst + i;
3654
3655 if (spacetype == UIO_USERSPACE64) {
3656 const struct user64_msghdr_x *msghdr64;
3657
3658 msghdr64 = ((const struct user64_msghdr_x *)src) + i;
3659
3660 user_msg->msg_name = (user_addr_t)msghdr64->msg_name;
3661 user_msg->msg_namelen = msghdr64->msg_namelen;
3662 user_msg->msg_iov = (user_addr_t)msghdr64->msg_iov;
3663 user_msg->msg_iovlen = msghdr64->msg_iovlen;
3664 user_msg->msg_control = (user_addr_t)msghdr64->msg_control;
3665 user_msg->msg_controllen = msghdr64->msg_controllen;
3666 user_msg->msg_flags = msghdr64->msg_flags;
3667 user_msg->msg_datalen = (size_t)msghdr64->msg_datalen;
3668 } else {
3669 const struct user32_msghdr_x *msghdr32;
3670
3671 msghdr32 = ((const struct user32_msghdr_x *)src) + i;
3672
3673 user_msg->msg_name = msghdr32->msg_name;
3674 user_msg->msg_namelen = msghdr32->msg_namelen;
3675 user_msg->msg_iov = msghdr32->msg_iov;
3676 user_msg->msg_iovlen = msghdr32->msg_iovlen;
3677 user_msg->msg_control = msghdr32->msg_control;
3678 user_msg->msg_controllen = msghdr32->msg_controllen;
3679 user_msg->msg_flags = msghdr32->msg_flags;
3680 user_msg->msg_datalen = msghdr32->msg_datalen;
3681 }
3682
3683 if (user_msg->msg_iovlen <= 0 ||
3684 user_msg->msg_iovlen > UIO_MAXIOV) {
3685 error = EMSGSIZE;
3686 goto done;
3687 }
3688 auio = uio_create(user_msg->msg_iovlen, 0, spacetype,
3689 direction);
3690 if (auio == NULL) {
3691 error = ENOMEM;
3692 goto done;
3693 }
3694 uiop[i] = auio;
3695
3696 iovp = uio_iovsaddr(auio);
3697 if (iovp == NULL) {
3698 error = ENOMEM;
3699 goto done;
3700 }
3701 error = copyin_user_iovec_array(user_msg->msg_iov,
3702 spacetype, user_msg->msg_iovlen, iovp);
3703 if (error) {
3704 goto done;
3705 }
3706 user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
3707
3708 error = uio_calculateresid(auio);
3709 if (error) {
3710 goto done;
3711 }
3712 user_msg->msg_datalen = uio_resid(auio);
3713
3714 if (user_msg->msg_name && user_msg->msg_namelen) {
3715 namecnt++;
3716 }
3717 if (user_msg->msg_control && user_msg->msg_controllen) {
3718 ctlcnt++;
3719 }
3720 }
3721 done:
3722
3723 return error;
3724 }
3725 #endif /* DEBUG || DEVELOPMENT */
3726
3727 int
internalize_recv_msghdr_array(const void_ptr_t src,int spacetype,int direction,u_int count,user_msghdr_x_ptr_t dst,recv_msg_elem_ptr_t recv_msg_array)3728 internalize_recv_msghdr_array(const void_ptr_t src, int spacetype, int direction,
3729 u_int count, user_msghdr_x_ptr_t dst,
3730 recv_msg_elem_ptr_t recv_msg_array)
3731 {
3732 int error = 0;
3733 u_int i;
3734
3735 for (i = 0; i < count; i++) {
3736 struct user_iovec *iovp;
3737 struct user_msghdr_x *user_msg = dst + i;
3738 struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
3739
3740 if (spacetype == UIO_USERSPACE64) {
3741 const struct user64_msghdr_x *msghdr64;
3742
3743 msghdr64 = ((const struct user64_msghdr_x *)src) + i;
3744
3745 user_msg->msg_name = (user_addr_t)msghdr64->msg_name;
3746 user_msg->msg_namelen = msghdr64->msg_namelen;
3747 user_msg->msg_iov = (user_addr_t)msghdr64->msg_iov;
3748 user_msg->msg_iovlen = msghdr64->msg_iovlen;
3749 user_msg->msg_control = (user_addr_t)msghdr64->msg_control;
3750 user_msg->msg_controllen = msghdr64->msg_controllen;
3751 user_msg->msg_flags = msghdr64->msg_flags;
3752 user_msg->msg_datalen = (size_t)msghdr64->msg_datalen;
3753 } else {
3754 const struct user32_msghdr_x *msghdr32;
3755
3756 msghdr32 = ((const struct user32_msghdr_x *)src) + i;
3757
3758 user_msg->msg_name = msghdr32->msg_name;
3759 user_msg->msg_namelen = msghdr32->msg_namelen;
3760 user_msg->msg_iov = msghdr32->msg_iov;
3761 user_msg->msg_iovlen = msghdr32->msg_iovlen;
3762 user_msg->msg_control = msghdr32->msg_control;
3763 user_msg->msg_controllen = msghdr32->msg_controllen;
3764 user_msg->msg_flags = msghdr32->msg_flags;
3765 user_msg->msg_datalen = msghdr32->msg_datalen;
3766 }
3767
3768 if (user_msg->msg_iovlen <= 0 ||
3769 user_msg->msg_iovlen > UIO_MAXIOV) {
3770 error = EMSGSIZE;
3771 goto done;
3772 }
3773 recv_msg_elem->uio = uio_create(user_msg->msg_iovlen, 0,
3774 spacetype, direction);
3775 if (recv_msg_elem->uio == NULL) {
3776 error = ENOMEM;
3777 goto done;
3778 }
3779
3780 iovp = uio_iovsaddr(recv_msg_elem->uio);
3781 if (iovp == NULL) {
3782 error = ENOMEM;
3783 goto done;
3784 }
3785 error = copyin_user_iovec_array(user_msg->msg_iov,
3786 spacetype, user_msg->msg_iovlen, iovp);
3787 if (error) {
3788 goto done;
3789 }
3790 user_msg->msg_iov = CAST_USER_ADDR_T(iovp);
3791
3792 error = uio_calculateresid(recv_msg_elem->uio);
3793 if (error) {
3794 goto done;
3795 }
3796 user_msg->msg_datalen = uio_resid(recv_msg_elem->uio);
3797
3798 if (user_msg->msg_name && user_msg->msg_namelen) {
3799 recv_msg_elem->which |= SOCK_MSG_SA;
3800 }
3801 if (user_msg->msg_control && user_msg->msg_controllen) {
3802 recv_msg_elem->which |= SOCK_MSG_CONTROL;
3803 }
3804 }
3805 done:
3806
3807 return error;
3808 }
3809
3810 #if DEBUG || DEVELOPMENT
3811 void
externalize_user_msghdr_array(void_ptr_t dst,int spacetype,int direction,u_int count,const user_msghdr_x_ptr_t src,uio_ref_ptr_t uiop)3812 externalize_user_msghdr_array(void_ptr_t dst, int spacetype, int direction,
3813 u_int count, const user_msghdr_x_ptr_t src, uio_ref_ptr_t uiop)
3814 {
3815 #pragma unused(direction)
3816 u_int i;
3817
3818 for (i = 0; i < count; i++) {
3819 const struct user_msghdr_x *user_msg = src + i;
3820 uio_t auio = uiop[i];
3821 user_ssize_t len = user_msg->msg_datalen - uio_resid(auio);
3822
3823 if (spacetype == UIO_USERSPACE64) {
3824 struct user64_msghdr_x *msghdr64;
3825
3826 msghdr64 = ((struct user64_msghdr_x *)dst) + i;
3827
3828 msghdr64->msg_flags = user_msg->msg_flags;
3829 msghdr64->msg_datalen = len;
3830 } else {
3831 struct user32_msghdr_x *msghdr32;
3832
3833 msghdr32 = ((struct user32_msghdr_x *)dst) + i;
3834
3835 msghdr32->msg_flags = user_msg->msg_flags;
3836 msghdr32->msg_datalen = (user32_size_t)len;
3837 }
3838 }
3839 }
3840 #endif /* DEBUG || DEVELOPMENT */
3841
3842 u_int
externalize_recv_msghdr_array(proc_ref_t p,socket_ref_t so,void_ptr_t dst,u_int count,user_msghdr_x_ptr_t src,recv_msg_elem_ptr_t recv_msg_array,int_ref_t ret_error)3843 externalize_recv_msghdr_array(proc_ref_t p, socket_ref_t so, void_ptr_t dst,
3844 u_int count, user_msghdr_x_ptr_t src,
3845 recv_msg_elem_ptr_t recv_msg_array, int_ref_t ret_error)
3846 {
3847 u_int i;
3848 u_int retcnt = 0;
3849 int spacetype = IS_64BIT_PROCESS(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
3850
3851 *ret_error = 0;
3852
3853 for (i = 0; i < count; i++) {
3854 struct user_msghdr_x *user_msg = src + i;
3855 struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
3856 user_ssize_t len = 0;
3857 int error;
3858
3859 len = user_msg->msg_datalen - uio_resid(recv_msg_elem->uio);
3860
3861 if ((recv_msg_elem->which & SOCK_MSG_DATA)) {
3862 retcnt++;
3863
3864 if (recv_msg_elem->which & SOCK_MSG_SA) {
3865 error = copyout_sa(recv_msg_elem->psa, user_msg->msg_name,
3866 &user_msg->msg_namelen);
3867 if (error != 0) {
3868 *ret_error = error;
3869 return 0;
3870 }
3871 }
3872 if (recv_msg_elem->which & SOCK_MSG_CONTROL) {
3873 error = copyout_control(p, recv_msg_elem->controlp,
3874 user_msg->msg_control, &user_msg->msg_controllen,
3875 &recv_msg_elem->flags, so);
3876 if (error != 0) {
3877 *ret_error = error;
3878 return 0;
3879 }
3880 }
3881 }
3882
3883 if (spacetype == UIO_USERSPACE64) {
3884 struct user64_msghdr_x *msghdr64 = ((struct user64_msghdr_x *)dst) + i;
3885
3886 msghdr64->msg_namelen = user_msg->msg_namelen;
3887 msghdr64->msg_controllen = user_msg->msg_controllen;
3888 msghdr64->msg_flags = recv_msg_elem->flags;
3889 msghdr64->msg_datalen = len;
3890 } else {
3891 struct user32_msghdr_x *msghdr32 = ((struct user32_msghdr_x *)dst) + i;
3892
3893 msghdr32->msg_namelen = user_msg->msg_namelen;
3894 msghdr32->msg_controllen = user_msg->msg_controllen;
3895 msghdr32->msg_flags = recv_msg_elem->flags;
3896 msghdr32->msg_datalen = (user32_size_t)len;
3897 }
3898 }
3899 return retcnt;
3900 }
3901
3902 #if DEBUG || DEVELOPMENT
3903 void
free_uio_array(uio_ref_ptr_t uiop,u_int count)3904 free_uio_array(uio_ref_ptr_t uiop, u_int count)
3905 {
3906 u_int i;
3907
3908 for (i = 0; i < count; i++) {
3909 if (uiop[i] != NULL) {
3910 uio_free(uiop[i]);
3911 }
3912 }
3913 }
3914 #endif /* DEBUG || DEVELOPMENT */
3915
3916 /* Extern linkage requires using __counted_by instead of bptr */
3917 __private_extern__ user_ssize_t
uio_array_resid(uio_ref_t * __counted_by (count)uiop,u_int count)3918 uio_array_resid(uio_ref_t * __counted_by(count)uiop, u_int count)
3919 {
3920 user_ssize_t len = 0;
3921 u_int i;
3922
3923 for (i = 0; i < count; i++) {
3924 struct uio *auio = uiop[i];
3925
3926 if (auio != NULL) {
3927 len += uio_resid(auio);
3928 }
3929 }
3930 return len;
3931 }
3932
3933 #if DEBUG || DEVELOPMENT
3934 static boolean_t
uio_array_is_valid(uio_ref_ptr_t uiop,u_int count)3935 uio_array_is_valid(uio_ref_ptr_t uiop, u_int count)
3936 {
3937 user_ssize_t len = 0;
3938 u_int i;
3939
3940 for (i = 0; i < count; i++) {
3941 struct uio *auio = uiop[i];
3942
3943 if (auio != NULL) {
3944 user_ssize_t resid = uio_resid(auio);
3945
3946 /*
3947 * Sanity check on the validity of the iovec:
3948 * no point of going over sb_max
3949 */
3950 if (resid < 0 || resid > (user_ssize_t)sb_max) {
3951 return false;
3952 }
3953
3954 len += resid;
3955 if (len < 0 || len > (user_ssize_t)sb_max) {
3956 return false;
3957 }
3958 }
3959 }
3960 return true;
3961 }
3962 #endif /* DEBUG || DEVELOPMENT */
3963
3964 recv_msg_elem_ptr_t
alloc_recv_msg_array(u_int count)3965 alloc_recv_msg_array(u_int count)
3966 {
3967 return kalloc_type(struct recv_msg_elem, count, Z_WAITOK | Z_ZERO);
3968 }
3969
3970 void
free_recv_msg_array(recv_msg_elem_ptr_t recv_msg_array,u_int count)3971 free_recv_msg_array(recv_msg_elem_ptr_t recv_msg_array, u_int count)
3972 {
3973 if (recv_msg_array == NULL) {
3974 return;
3975 }
3976 for (uint32_t i = 0; i < count; i++) {
3977 struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
3978
3979 if (recv_msg_elem->uio != NULL) {
3980 uio_free(recv_msg_elem->uio);
3981 }
3982 free_sockaddr(recv_msg_elem->psa);
3983 if (recv_msg_elem->controlp != NULL) {
3984 m_freem(recv_msg_elem->controlp);
3985 }
3986 }
3987 kfree_type(struct recv_msg_elem, count, recv_msg_array);
3988 }
3989
3990
3991 /* Extern linkage requires using __counted_by instead of bptr */
3992 __private_extern__ user_ssize_t
recv_msg_array_resid(struct recv_msg_elem * __counted_by (count)recv_msg_array,u_int count)3993 recv_msg_array_resid(struct recv_msg_elem * __counted_by(count)recv_msg_array, u_int count)
3994 {
3995 user_ssize_t len = 0;
3996 u_int i;
3997
3998 for (i = 0; i < count; i++) {
3999 struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
4000
4001 if (recv_msg_elem->uio != NULL) {
4002 len += uio_resid(recv_msg_elem->uio);
4003 }
4004 }
4005 return len;
4006 }
4007
4008 int
recv_msg_array_is_valid(recv_msg_elem_ptr_t recv_msg_array,u_int count)4009 recv_msg_array_is_valid(recv_msg_elem_ptr_t recv_msg_array, u_int count)
4010 {
4011 user_ssize_t len = 0;
4012 u_int i;
4013
4014 for (i = 0; i < count; i++) {
4015 struct recv_msg_elem *recv_msg_elem = recv_msg_array + i;
4016
4017 if (recv_msg_elem->uio != NULL) {
4018 user_ssize_t resid = uio_resid(recv_msg_elem->uio);
4019
4020 /*
4021 * Sanity check on the validity of the iovec:
4022 * no point of going over sb_max
4023 */
4024 if (resid < 0 || (u_int32_t)resid > sb_max) {
4025 return 0;
4026 }
4027
4028 len += resid;
4029 if (len < 0 || (u_int32_t)len > sb_max) {
4030 return 0;
4031 }
4032 }
4033 }
4034 return 1;
4035 }
4036
4037 #if SENDFILE
4038
4039 #define SFUIOBUFS 64
4040
4041 /* Macros to compute the number of mbufs needed depending on cluster size */
4042 #define HOWMANY_16K(n) ((((unsigned int)(n) - 1) >> M16KCLSHIFT) + 1)
4043 #define HOWMANY_4K(n) ((((unsigned int)(n) - 1) >> MBIGCLSHIFT) + 1)
4044
4045 /* Upper send limit in bytes (SFUIOBUFS * PAGESIZE) */
4046 #define SENDFILE_MAX_BYTES (SFUIOBUFS << PGSHIFT)
4047
4048 /* Upper send limit in the number of mbuf clusters */
4049 #define SENDFILE_MAX_16K HOWMANY_16K(SENDFILE_MAX_BYTES)
4050 #define SENDFILE_MAX_4K HOWMANY_4K(SENDFILE_MAX_BYTES)
4051
4052 static void
alloc_sendpkt(int how,size_t pktlen,unsigned int * maxchunks,mbuf_ref_ref_t m,boolean_t jumbocl)4053 alloc_sendpkt(int how, size_t pktlen, unsigned int *maxchunks,
4054 mbuf_ref_ref_t m, boolean_t jumbocl)
4055 {
4056 unsigned int needed;
4057
4058 if (pktlen == 0) {
4059 panic("%s: pktlen (%ld) must be non-zero", __func__, pktlen);
4060 }
4061
4062 /*
4063 * Try to allocate for the whole thing. Since we want full control
4064 * over the buffer size and be able to accept partial result, we can't
4065 * use mbuf_allocpacket(). The logic below is similar to sosend().
4066 */
4067 *m = NULL;
4068 if (pktlen > MBIGCLBYTES && jumbocl) {
4069 needed = MIN(SENDFILE_MAX_16K, HOWMANY_16K(pktlen));
4070 *m = m_getpackets_internal(&needed, 1, how, 0, M16KCLBYTES);
4071 }
4072 if (*m == NULL) {
4073 needed = MIN(SENDFILE_MAX_4K, HOWMANY_4K(pktlen));
4074 *m = m_getpackets_internal(&needed, 1, how, 0, MBIGCLBYTES);
4075 }
4076
4077 /*
4078 * Our previous attempt(s) at allocation had failed; the system
4079 * may be short on mbufs, and we want to block until they are
4080 * available. This time, ask just for 1 mbuf and don't return
4081 * until we get it.
4082 */
4083 if (*m == NULL) {
4084 needed = 1;
4085 *m = m_getpackets_internal(&needed, 1, M_WAIT, 1, MBIGCLBYTES);
4086 }
4087 if (*m == NULL) {
4088 panic("%s: blocking allocation returned NULL", __func__);
4089 }
4090
4091 *maxchunks = needed;
4092 }
4093
4094 /*
4095 * sendfile(2).
4096 * int sendfile(int fd, int s, off_t offset, off_t *nbytes,
4097 * struct sf_hdtr *hdtr, int flags)
4098 *
4099 * Send a file specified by 'fd' and starting at 'offset' to a socket
4100 * specified by 's'. Send only '*nbytes' of the file or until EOF if
4101 * *nbytes == 0. Optionally add a header and/or trailer to the socket
4102 * output. If specified, write the total number of bytes sent into *nbytes.
4103 */
4104 int
sendfile(proc_ref_t p,struct sendfile_args * uap,__unused int * retval)4105 sendfile(proc_ref_t p, struct sendfile_args *uap, __unused int *retval)
4106 {
4107 fileproc_ref_t fp;
4108 vnode_ref_t vp;
4109 socket_ref_t so;
4110 struct writev_nocancel_args nuap;
4111 user_ssize_t writev_retval;
4112 struct user_sf_hdtr user_hdtr;
4113 struct user32_sf_hdtr user32_hdtr;
4114 struct user64_sf_hdtr user64_hdtr;
4115 off_t off, xfsize;
4116 off_t nbytes = 0, sbytes = 0;
4117 int error = 0;
4118 size_t sizeof_hdtr;
4119 off_t file_size;
4120 struct vfs_context context = *vfs_context_current();
4121
4122 const bool is_p_64bit_process = IS_64BIT_PROCESS(p);
4123
4124 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE | DBG_FUNC_START), uap->s,
4125 0, 0, 0, 0);
4126
4127 AUDIT_ARG(fd, uap->fd);
4128 AUDIT_ARG(value32, uap->s);
4129
4130 /*
4131 * Do argument checking. Must be a regular file in, stream
4132 * type and connected socket out, positive offset.
4133 */
4134 if ((error = fp_getfvp(p, uap->fd, &fp, &vp))) {
4135 goto done;
4136 }
4137 if ((fp->f_flag & FREAD) == 0) {
4138 error = EBADF;
4139 goto done1;
4140 }
4141 if (vnode_isreg(vp) == 0) {
4142 error = ENOTSUP;
4143 goto done1;
4144 }
4145 error = file_socket(uap->s, &so);
4146 if (error) {
4147 goto done1;
4148 }
4149 if (so == NULL) {
4150 error = EBADF;
4151 goto done2;
4152 }
4153 if (so->so_type != SOCK_STREAM) {
4154 error = EINVAL;
4155 goto done2;
4156 }
4157 if ((so->so_state & SS_ISCONNECTED) == 0) {
4158 error = ENOTCONN;
4159 goto done2;
4160 }
4161 if (uap->offset < 0) {
4162 error = EINVAL;
4163 goto done2;
4164 }
4165 if (uap->nbytes == USER_ADDR_NULL) {
4166 error = EINVAL;
4167 goto done2;
4168 }
4169 if (uap->flags != 0) {
4170 error = EINVAL;
4171 goto done2;
4172 }
4173
4174 context.vc_ucred = fp->fp_glob->fg_cred;
4175
4176 #if CONFIG_MACF_SOCKET_SUBSET
4177 /* JMM - fetch connected sockaddr? */
4178 error = mac_socket_check_send(context.vc_ucred, so, NULL);
4179 if (error) {
4180 goto done2;
4181 }
4182 #endif
4183
4184 /*
4185 * Get number of bytes to send
4186 * Should it applies to size of header and trailer?
4187 */
4188 error = copyin(uap->nbytes, &nbytes, sizeof(off_t));
4189 if (error) {
4190 goto done2;
4191 }
4192
4193 /*
4194 * If specified, get the pointer to the sf_hdtr struct for
4195 * any headers/trailers.
4196 */
4197 if (uap->hdtr != USER_ADDR_NULL) {
4198 caddr_t hdtrp;
4199
4200 bzero(&user_hdtr, sizeof(user_hdtr));
4201 if (is_p_64bit_process) {
4202 hdtrp = (caddr_t)&user64_hdtr;
4203 sizeof_hdtr = sizeof(user64_hdtr);
4204 } else {
4205 hdtrp = (caddr_t)&user32_hdtr;
4206 sizeof_hdtr = sizeof(user32_hdtr);
4207 }
4208 error = copyin(uap->hdtr, hdtrp, sizeof_hdtr);
4209 if (error) {
4210 goto done2;
4211 }
4212 if (is_p_64bit_process) {
4213 user_hdtr.headers = user64_hdtr.headers;
4214 user_hdtr.hdr_cnt = user64_hdtr.hdr_cnt;
4215 user_hdtr.trailers = user64_hdtr.trailers;
4216 user_hdtr.trl_cnt = user64_hdtr.trl_cnt;
4217 } else {
4218 user_hdtr.headers = user32_hdtr.headers;
4219 user_hdtr.hdr_cnt = user32_hdtr.hdr_cnt;
4220 user_hdtr.trailers = user32_hdtr.trailers;
4221 user_hdtr.trl_cnt = user32_hdtr.trl_cnt;
4222 }
4223
4224 /*
4225 * Send any headers. Wimp out and use writev(2).
4226 */
4227 if (user_hdtr.headers != USER_ADDR_NULL) {
4228 bzero(&nuap, sizeof(struct writev_args));
4229 nuap.fd = uap->s;
4230 nuap.iovp = user_hdtr.headers;
4231 nuap.iovcnt = user_hdtr.hdr_cnt;
4232 error = writev_nocancel(p, &nuap, &writev_retval);
4233 if (error) {
4234 goto done2;
4235 }
4236 sbytes += writev_retval;
4237 }
4238 }
4239
4240 /*
4241 * Get the file size for 2 reasons:
4242 * 1. We don't want to allocate more mbufs than necessary
4243 * 2. We don't want to read past the end of file
4244 */
4245 if ((error = vnode_size(vp, &file_size, vfs_context_current())) != 0) {
4246 goto done2;
4247 }
4248
4249 /*
4250 * Simply read file data into a chain of mbufs that used with scatter
4251 * gather reads. We're not (yet?) setup to use zero copy external
4252 * mbufs that point to the file pages.
4253 */
4254 socket_lock(so, 1);
4255 error = sblock(&so->so_snd, SBL_WAIT);
4256 if (error) {
4257 socket_unlock(so, 1);
4258 goto done2;
4259 }
4260 for (off = uap->offset;; off += xfsize, sbytes += xfsize) {
4261 mbuf_ref_t m0 = NULL;
4262 mbuf_t m;
4263 unsigned int nbufs = SFUIOBUFS, i;
4264 uio_t auio;
4265 UIO_STACKBUF(uio_buf, SFUIOBUFS); /* 1KB !!! */
4266 size_t uiolen;
4267 user_ssize_t rlen;
4268 off_t pgoff;
4269 size_t pktlen;
4270 boolean_t jumbocl;
4271
4272 /*
4273 * Calculate the amount to transfer.
4274 * Align to round number of pages.
4275 * Not to exceed send socket buffer,
4276 * the EOF, or the passed in nbytes.
4277 */
4278 xfsize = sbspace(&so->so_snd);
4279
4280 if (xfsize <= 0) {
4281 if (so->so_state & SS_CANTSENDMORE) {
4282 error = EPIPE;
4283 goto done3;
4284 } else if ((so->so_state & SS_NBIO)) {
4285 error = EAGAIN;
4286 goto done3;
4287 } else {
4288 xfsize = PAGE_SIZE;
4289 }
4290 }
4291
4292 if (xfsize > SENDFILE_MAX_BYTES) {
4293 xfsize = SENDFILE_MAX_BYTES;
4294 } else if (xfsize > PAGE_SIZE) {
4295 xfsize = trunc_page(xfsize);
4296 }
4297 pgoff = off & PAGE_MASK_64;
4298 if (pgoff > 0 && PAGE_SIZE - pgoff < xfsize) {
4299 xfsize = PAGE_SIZE_64 - pgoff;
4300 }
4301 if (nbytes && xfsize > (nbytes - sbytes)) {
4302 xfsize = nbytes - sbytes;
4303 }
4304 if (xfsize <= 0) {
4305 break;
4306 }
4307 if (off + xfsize > file_size) {
4308 xfsize = file_size - off;
4309 }
4310 if (xfsize <= 0) {
4311 break;
4312 }
4313
4314 /*
4315 * Attempt to use larger than system page-size clusters for
4316 * large writes only if there is a jumbo cluster pool and
4317 * if the socket is marked accordingly.
4318 */
4319 jumbocl = sosendjcl && njcl > 0 &&
4320 ((so->so_flags & SOF_MULTIPAGES) || sosendjcl_ignore_capab);
4321
4322 socket_unlock(so, 0);
4323 alloc_sendpkt(M_WAIT, xfsize, &nbufs, &m0, jumbocl);
4324 pktlen = mbuf_pkthdr_maxlen(m0);
4325 if (pktlen < (size_t)xfsize) {
4326 xfsize = pktlen;
4327 }
4328
4329 auio = uio_createwithbuffer(nbufs, off, UIO_SYSSPACE,
4330 UIO_READ, &uio_buf[0], sizeof(uio_buf));
4331 if (auio == NULL) {
4332 DBG_PRINTF("sendfile failed. nbufs = %d. %s", nbufs,
4333 "File a radar related to rdar://10146739.\n");
4334 mbuf_freem(m0);
4335 error = ENXIO;
4336 socket_lock(so, 0);
4337 goto done3;
4338 }
4339
4340 for (i = 0, m = m0, uiolen = 0;
4341 i < nbufs && m != NULL && uiolen < (size_t)xfsize;
4342 i++, m = mbuf_next(m)) {
4343 size_t mlen = mbuf_maxlen(m);
4344
4345 if (mlen + uiolen > (size_t)xfsize) {
4346 mlen = xfsize - uiolen;
4347 }
4348 mbuf_setlen(m, mlen);
4349 uio_addiov(auio, CAST_USER_ADDR_T(mbuf_datastart(m)),
4350 mlen);
4351 uiolen += mlen;
4352 }
4353
4354 if (xfsize != uio_resid(auio)) {
4355 DBG_PRINTF("sendfile: xfsize: %lld != uio_resid(auio): "
4356 "%lld\n", xfsize, (long long)uio_resid(auio));
4357 }
4358
4359 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_READ | DBG_FUNC_START),
4360 uap->s, (unsigned int)((xfsize >> 32) & 0x0ffffffff),
4361 (unsigned int)(xfsize & 0x0ffffffff), 0, 0);
4362 error = fo_read(fp, auio, FOF_OFFSET, &context);
4363 socket_lock(so, 0);
4364 if (error != 0) {
4365 if (uio_resid(auio) != xfsize && (error == ERESTART ||
4366 error == EINTR || error == EWOULDBLOCK)) {
4367 error = 0;
4368 } else {
4369 mbuf_freem(m0);
4370 goto done3;
4371 }
4372 }
4373 xfsize -= uio_resid(auio);
4374 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_READ | DBG_FUNC_END),
4375 uap->s, (unsigned int)((xfsize >> 32) & 0x0ffffffff),
4376 (unsigned int)(xfsize & 0x0ffffffff), 0, 0);
4377
4378 if (xfsize == 0) {
4379 break;
4380 }
4381 if (xfsize + off > file_size) {
4382 DBG_PRINTF("sendfile: xfsize: %lld + off: %lld > file_size:"
4383 "%lld\n", xfsize, off, file_size);
4384 }
4385 for (i = 0, m = m0, rlen = 0;
4386 i < nbufs && m != NULL && rlen < xfsize;
4387 i++, m = mbuf_next(m)) {
4388 size_t mlen = mbuf_maxlen(m);
4389
4390 if (rlen + mlen > (size_t)xfsize) {
4391 mlen = xfsize - rlen;
4392 }
4393 mbuf_setlen(m, mlen);
4394
4395 rlen += mlen;
4396 }
4397 mbuf_pkthdr_setlen(m0, xfsize);
4398
4399 retry_space:
4400 /*
4401 * Make sure that the socket is still able to take more data.
4402 * CANTSENDMORE being true usually means that the connection
4403 * was closed. so_error is true when an error was sensed after
4404 * a previous send.
4405 * The state is checked after the page mapping and buffer
4406 * allocation above since those operations may block and make
4407 * any socket checks stale. From this point forward, nothing
4408 * blocks before the pru_send (or more accurately, any blocking
4409 * results in a loop back to here to re-check).
4410 */
4411 if ((so->so_state & SS_CANTSENDMORE) || so->so_error) {
4412 if (so->so_state & SS_CANTSENDMORE) {
4413 error = EPIPE;
4414 } else {
4415 error = so->so_error;
4416 so->so_error = 0;
4417 }
4418 m_freem(m0);
4419 goto done3;
4420 }
4421 /*
4422 * Wait for socket space to become available. We do this just
4423 * after checking the connection state above in order to avoid
4424 * a race condition with sbwait().
4425 */
4426 if (sbspace(&so->so_snd) < (long)so->so_snd.sb_lowat) {
4427 if (so->so_state & SS_NBIO) {
4428 m_freem(m0);
4429 error = EAGAIN;
4430 goto done3;
4431 }
4432 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_WAIT |
4433 DBG_FUNC_START), uap->s, 0, 0, 0, 0);
4434 error = sbwait(&so->so_snd);
4435 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_WAIT |
4436 DBG_FUNC_END), uap->s, 0, 0, 0, 0);
4437 /*
4438 * An error from sbwait usually indicates that we've
4439 * been interrupted by a signal. If we've sent anything
4440 * then return bytes sent, otherwise return the error.
4441 */
4442 if (error) {
4443 m_freem(m0);
4444 goto done3;
4445 }
4446 goto retry_space;
4447 }
4448
4449 mbuf_ref_t control = NULL;
4450 {
4451 /*
4452 * Socket filter processing
4453 */
4454
4455 error = sflt_data_out(so, NULL, &m0, &control, 0);
4456 if (error) {
4457 if (error == EJUSTRETURN) {
4458 error = 0;
4459 continue;
4460 }
4461 goto done3;
4462 }
4463 /*
4464 * End Socket filter processing
4465 */
4466 }
4467 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_SEND | DBG_FUNC_START),
4468 uap->s, 0, 0, 0, 0);
4469 error = (*so->so_proto->pr_usrreqs->pru_send)(so, 0, m0,
4470 NULL, control, p);
4471 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE_SEND | DBG_FUNC_START),
4472 uap->s, 0, 0, 0, 0);
4473 if (error) {
4474 goto done3;
4475 }
4476 }
4477 sbunlock(&so->so_snd, FALSE); /* will unlock socket */
4478 /*
4479 * Send trailers. Wimp out and use writev(2).
4480 */
4481 if (uap->hdtr != USER_ADDR_NULL &&
4482 user_hdtr.trailers != USER_ADDR_NULL) {
4483 bzero(&nuap, sizeof(struct writev_args));
4484 nuap.fd = uap->s;
4485 nuap.iovp = user_hdtr.trailers;
4486 nuap.iovcnt = user_hdtr.trl_cnt;
4487 error = writev_nocancel(p, &nuap, &writev_retval);
4488 if (error) {
4489 goto done2;
4490 }
4491 sbytes += writev_retval;
4492 }
4493 done2:
4494 file_drop(uap->s);
4495 done1:
4496 file_drop(uap->fd);
4497 done:
4498 if (uap->nbytes != USER_ADDR_NULL) {
4499 /* XXX this appears bogus for some early failure conditions */
4500 copyout(&sbytes, uap->nbytes, sizeof(off_t));
4501 }
4502 KERNEL_DEBUG_CONSTANT((DBG_FNC_SENDFILE | DBG_FUNC_END), uap->s,
4503 (unsigned int)((sbytes >> 32) & 0x0ffffffff),
4504 (unsigned int)(sbytes & 0x0ffffffff), error, 0);
4505 return error;
4506 done3:
4507 sbunlock(&so->so_snd, FALSE); /* will unlock socket */
4508 goto done2;
4509 }
4510
4511
4512 #endif /* SENDFILE */
4513