sys/kern/uipc_usrreq.c

   1 /*-
   2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
   3  *      The Regents of the University of California.
   4  * Copyright (c) 2004-2009 Robert N. M. Watson
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 4. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  *
  31  *      From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
  32  */
  33
  34 /*
  35  * UNIX Domain (Local) Sockets
  36  *
  37  * This is an implementation of UNIX (local) domain sockets.  Each socket has
  38  * an associated struct unpcb (UNIX protocol control block).  Stream sockets
  39  * may be connected to 0 or 1 other socket.  Datagram sockets may be
  40  * connected to 0, 1, or many other sockets.  Sockets may be created and
  41  * connected in pairs (socketpair(2)), or bound/connected to using the file
  42  * system name space.  For most purposes, only the receive socket buffer is
  43  * used, as sending on one socket delivers directly to the receive socket
  44  * buffer of a second socket.
  45  *
  46  * The implementation is substantially complicated by the fact that
  47  * "ancillary data", such as file descriptors or credentials, may be passed
  48  * across UNIX domain sockets.  The potential for passing UNIX domain sockets
  49  * over other UNIX domain sockets requires the implementation of a simple
  50  * garbage collector to find and tear down cycles of disconnected sockets.
  51  *
  52  * TODO:
  53  *      RDM
  54  *      distinguish datagram size limits from flow control limits in SEQPACKET
  55  *      rethink name space problems
  56  *      need a proper out-of-band
  57  */
  58
  59 #include <sys/cdefs.h>
  60 __FBSDID("$FreeBSD$");
  61
  62 #include "opt_ddb.h"
  63
  64 #include <sys/param.h>
  65 #include <sys/domain.h>
  66 #include <sys/fcntl.h>
  67 #include <sys/malloc.h>         /* XXX must be before <sys/file.h> */
  68 #include <sys/eventhandler.h>
  69 #include <sys/file.h>
  70 #include <sys/filedesc.h>
  71 #include <sys/kernel.h>
  72 #include <sys/lock.h>
  73 #include <sys/mbuf.h>
  74 #include <sys/mount.h>
  75 #include <sys/mutex.h>
  76 #include <sys/namei.h>
  77 #include <sys/proc.h>
  78 #include <sys/protosw.h>
  79 #include <sys/queue.h>
  80 #include <sys/resourcevar.h>
  81 #include <sys/rwlock.h>
  82 #include <sys/socket.h>
  83 #include <sys/socketvar.h>
  84 #include <sys/signalvar.h>
  85 #include <sys/stat.h>
  86 #include <sys/sx.h>
  87 #include <sys/sysctl.h>
  88 #include <sys/systm.h>
  89 #include <sys/taskqueue.h>
  90 #include <sys/un.h>
  91 #include <sys/unpcb.h>
  92 #include <sys/vnode.h>
  93
  94 #include <net/vnet.h>
  95
  96 #ifdef DDB
  97 #include <ddb/ddb.h>
  98 #endif
  99
 100 #include <security/mac/mac_framework.h>
 101
 102 #include <vm/uma.h>
 103
 104 /*
 105  * Locking key:
 106  * (l)  Locked using list lock
 107  * (g)  Locked using linkage lock
 108  */
 109
 110 static uma_zone_t       unp_zone;
 111 static unp_gen_t        unp_gencnt;     /* (l) */
 112 static u_int            unp_count;      /* (l) Count of local sockets. */
 113 static ino_t            unp_ino;        /* Prototype for fake inode numbers. */
 114 static int              unp_rights;     /* (g) File descriptors in flight. */
 115 static struct unp_head  unp_shead;      /* (l) List of stream sockets. */
 116 static struct unp_head  unp_dhead;      /* (l) List of datagram sockets. */
 117 static struct unp_head  unp_sphead;     /* (l) List of seqpacket sockets. */
 118
 119 struct unp_defer {
 120         SLIST_ENTRY(unp_defer) ud_link;
 121         struct file *ud_fp;
 122 };
 123 static SLIST_HEAD(, unp_defer) unp_defers;
 124 static int unp_defers_count;
 125
 126 static const struct sockaddr    sun_noname = { sizeof(sun_noname), AF_LOCAL };
 127
 128 /*
 129  * Garbage collection of cyclic file descriptor/socket references occurs
 130  * asynchronously in a taskqueue context in order to avoid recursion and
 131  * reentrance in the UNIX domain socket, file descriptor, and socket layer
 132  * code.  See unp_gc() for a full description.
 133  */
 134 static struct timeout_task unp_gc_task;
 135
 136 /*
 137  * The close of unix domain sockets attached as SCM_RIGHTS is
 138  * postponed to the taskqueue, to avoid arbitrary recursion depth.
 139  * The attached sockets might have another sockets attached.
 140  */
 141 static struct task      unp_defer_task;
 142
 143 /*
 144  * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
 145  * stream sockets, although the total for sender and receiver is actually
 146  * only PIPSIZ.
 147  *
 148  * Datagram sockets really use the sendspace as the maximum datagram size,
 149  * and don't really want to reserve the sendspace.  Their recvspace should be
 150  * large enough for at least one max-size datagram plus address.
 151  */
 152 #ifndef PIPSIZ
 153 #define PIPSIZ  8192
 154 #endif
 155 static u_long   unpst_sendspace = PIPSIZ;
 156 static u_long   unpst_recvspace = PIPSIZ;
 157 static u_long   unpdg_sendspace = 2*1024;       /* really max datagram size */
 158 static u_long   unpdg_recvspace = 4*1024;
 159 static u_long   unpsp_sendspace = PIPSIZ;       /* really max datagram size */
 160 static u_long   unpsp_recvspace = PIPSIZ;
 161
 162 static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW, 0, "Local domain");
 163 static SYSCTL_NODE(_net_local, SOCK_STREAM, stream, CTLFLAG_RW, 0,
 164     "SOCK_STREAM");
 165 static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, CTLFLAG_RW, 0, "SOCK_DGRAM");
 166 static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket, CTLFLAG_RW, 0,
 167     "SOCK_SEQPACKET");
 168
 169 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
 170            &unpst_sendspace, 0, "Default stream send space.");
 171 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
 172            &unpst_recvspace, 0, "Default stream receive space.");
 173 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
 174            &unpdg_sendspace, 0, "Default datagram send space.");
 175 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
 176            &unpdg_recvspace, 0, "Default datagram receive space.");
 177 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
 178            &unpsp_sendspace, 0, "Default seqpacket send space.");
 179 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
 180            &unpsp_recvspace, 0, "Default seqpacket receive space.");
 181 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
 182     "File descriptors in flight.");
 183 SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
 184     &unp_defers_count, 0,
 185     "File descriptors deferred to taskqueue for close.");
 186
 187 /*
 188  * Locking and synchronization:
 189  *
 190  * Three types of locks exit in the local domain socket implementation: a
 191  * global list mutex, a global linkage rwlock, and per-unpcb mutexes.  Of the
 192  * global locks, the list lock protects the socket count, global generation
 193  * number, and stream/datagram global lists.  The linkage lock protects the
 194  * interconnection of unpcbs, the v_socket and unp_vnode pointers, and can be
 195  * held exclusively over the acquisition of multiple unpcb locks to prevent
 196  * deadlock.
 197  *
 198  * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
 199  * allocated in pru_attach() and freed in pru_detach().  The validity of that
 200  * pointer is an invariant, so no lock is required to dereference the so_pcb
 201  * pointer if a valid socket reference is held by the caller.  In practice,
 202  * this is always true during operations performed on a socket.  Each unpcb
 203  * has a back-pointer to its socket, unp_socket, which will be stable under
 204  * the same circumstances.
 205  *
 206  * This pointer may only be safely dereferenced as long as a valid reference
 207  * to the unpcb is held.  Typically, this reference will be from the socket,
 208  * or from another unpcb when the referring unpcb's lock is held (in order
 209  * that the reference not be invalidated during use).  For example, to follow
 210  * unp->unp_conn->unp_socket, you need unlock the lock on unp, not unp_conn,
 211  * as unp_socket remains valid as long as the reference to unp_conn is valid.
 212  *
 213  * Fields of unpcbss are locked using a per-unpcb lock, unp_mtx.  Individual
 214  * atomic reads without the lock may be performed "lockless", but more
 215  * complex reads and read-modify-writes require the mutex to be held.  No
 216  * lock order is defined between unpcb locks -- multiple unpcb locks may be
 217  * acquired at the same time only when holding the linkage rwlock
 218  * exclusively, which prevents deadlocks.
 219  *
 220  * Blocking with UNIX domain sockets is a tricky issue: unlike most network
 221  * protocols, bind() is a non-atomic operation, and connect() requires
 222  * potential sleeping in the protocol, due to potentially waiting on local or
 223  * distributed file systems.  We try to separate "lookup" operations, which
 224  * may sleep, and the IPC operations themselves, which typically can occur
 225  * with relative atomicity as locks can be held over the entire operation.
 226  *
 227  * Another tricky issue is simultaneous multi-threaded or multi-process
 228  * access to a single UNIX domain socket.  These are handled by the flags
 229  * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
 230  * binding, both of which involve dropping UNIX domain socket locks in order
 231  * to perform namei() and other file system operations.
 232  */
 233 static struct rwlock    unp_link_rwlock;
 234 static struct mtx       unp_list_lock;
 235 static struct mtx       unp_defers_lock;
 236
 237 #define UNP_LINK_LOCK_INIT()            rw_init(&unp_link_rwlock,       \
 238                                             "unp_link_rwlock")
 239
 240 #define UNP_LINK_LOCK_ASSERT()  rw_assert(&unp_link_rwlock,     \
 241                                             RA_LOCKED)
 242 #define UNP_LINK_UNLOCK_ASSERT()        rw_assert(&unp_link_rwlock,     \
 243                                             RA_UNLOCKED)
 244
 245 #define UNP_LINK_RLOCK()                rw_rlock(&unp_link_rwlock)
 246 #define UNP_LINK_RUNLOCK()              rw_runlock(&unp_link_rwlock)
 247 #define UNP_LINK_WLOCK()                rw_wlock(&unp_link_rwlock)
 248 #define UNP_LINK_WUNLOCK()              rw_wunlock(&unp_link_rwlock)
 249 #define UNP_LINK_WLOCK_ASSERT()         rw_assert(&unp_link_rwlock,     \
 250                                             RA_WLOCKED)
 251
 252 #define UNP_LIST_LOCK_INIT()            mtx_init(&unp_list_lock,        \
 253                                             "unp_list_lock", NULL, MTX_DEF)
 254 #define UNP_LIST_LOCK()                 mtx_lock(&unp_list_lock)
 255 #define UNP_LIST_UNLOCK()               mtx_unlock(&unp_list_lock)
 256
 257 #define UNP_DEFERRED_LOCK_INIT()        mtx_init(&unp_defers_lock, \
 258                                             "unp_defer", NULL, MTX_DEF)
 259 #define UNP_DEFERRED_LOCK()             mtx_lock(&unp_defers_lock)
 260 #define UNP_DEFERRED_UNLOCK()           mtx_unlock(&unp_defers_lock)
 261
 262 #define UNP_PCB_LOCK_INIT(unp)          mtx_init(&(unp)->unp_mtx,       \
 263                                             "unp_mtx", "unp_mtx",       \
 264                                             MTX_DUPOK|MTX_DEF|MTX_RECURSE)
 265 #define UNP_PCB_LOCK_DESTROY(unp)       mtx_destroy(&(unp)->unp_mtx)
 266 #define UNP_PCB_LOCK(unp)               mtx_lock(&(unp)->unp_mtx)
 267 #define UNP_PCB_UNLOCK(unp)             mtx_unlock(&(unp)->unp_mtx)
 268 #define UNP_PCB_LOCK_ASSERT(unp)        mtx_assert(&(unp)->unp_mtx, MA_OWNED)
 269
 270 static int      uipc_connect2(struct socket *, struct socket *);
 271 static int      uipc_ctloutput(struct socket *, struct sockopt *);
 272 static int      unp_connect(struct socket *, struct sockaddr *,
 273                     struct thread *);
 274 static int      unp_connect2(struct socket *so, struct socket *so2, int);
 275 static void     unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
 276 static void     unp_dispose(struct mbuf *);
 277 static void     unp_shutdown(struct unpcb *);
 278 static void     unp_drop(struct unpcb *, int);
 279 static void     unp_gc(__unused void *, int);
 280 static void     unp_scan(struct mbuf *, void (*)(struct file *));
 281 static void     unp_discard(struct file *);
 282 static void     unp_freerights(struct file **, int);
 283 static void     unp_init(void);
 284 static int      unp_internalize(struct mbuf **, struct thread *);
 285 static void     unp_internalize_fp(struct file *);
 286 static int      unp_externalize(struct mbuf *, struct mbuf **);
 287 static int      unp_externalize_fp(struct file *);
 288 static struct mbuf      *unp_addsockcred(struct thread *, struct mbuf *);
 289 static void     unp_process_defers(void * __unused, int);
 290
 291 /*
 292  * Definitions of protocols supported in the LOCAL domain.
 293  */
 294 static struct domain localdomain;
 295 static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream;
 296 static struct pr_usrreqs uipc_usrreqs_seqpacket;
 297 static struct protosw localsw[] = {
 298 {
 299         .pr_type =              SOCK_STREAM,
 300         .pr_domain =            &localdomain,
 301         .pr_flags =             PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS,
 302         .pr_ctloutput =         &uipc_ctloutput,
 303         .pr_usrreqs =           &uipc_usrreqs_stream
 304 },
 305 {
 306         .pr_type =              SOCK_DGRAM,
 307         .pr_domain =            &localdomain,
 308         .pr_flags =             PR_ATOMIC|PR_ADDR|PR_RIGHTS,
 309         .pr_ctloutput =         &uipc_ctloutput,
 310         .pr_usrreqs =           &uipc_usrreqs_dgram
 311 },
 312 {
 313         .pr_type =              SOCK_SEQPACKET,
 314         .pr_domain =            &localdomain,
 315
 316         /*
 317          * XXXRW: For now, PR_ADDR because soreceive will bump into them
 318          * due to our use of sbappendaddr.  A new sbappend variants is needed
 319          * that supports both atomic record writes and control data.
 320          */
 321         .pr_flags =             PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|PR_WANTRCVD|
 322                                     PR_RIGHTS,
 323         .pr_usrreqs =           &uipc_usrreqs_seqpacket,
 324 },
 325 };
 326
 327 static struct domain localdomain = {
 328         .dom_family =           AF_LOCAL,
 329         .dom_name =             "local",
 330         .dom_init =             unp_init,
 331         .dom_externalize =      unp_externalize,
 332         .dom_dispose =          unp_dispose,
 333         .dom_protosw =          localsw,
 334         .dom_protoswNPROTOSW =  &localsw[sizeof(localsw)/sizeof(localsw[0])]
 335 };
 336 DOMAIN_SET(local);
 337
 338 static void
 339 uipc_abort(struct socket *so)
 340 {
 341         struct unpcb *unp, *unp2;
 342
 343         unp = sotounpcb(so);
 344         KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
 345
 346         UNP_LINK_WLOCK();
 347         UNP_PCB_LOCK(unp);
 348         unp2 = unp->unp_conn;
 349         if (unp2 != NULL) {
 350                 UNP_PCB_LOCK(unp2);
 351                 unp_drop(unp2, ECONNABORTED);
 352                 UNP_PCB_UNLOCK(unp2);
 353         }
 354         UNP_PCB_UNLOCK(unp);
 355         UNP_LINK_WUNLOCK();
 356 }
 357
 358 static int
 359 uipc_accept(struct socket *so, struct sockaddr **nam)
 360 {
 361         struct unpcb *unp, *unp2;
 362         const struct sockaddr *sa;
 363
 364         /*
 365          * Pass back name of connected socket, if it was bound and we are
 366          * still connected (our peer may have closed already!).
 367          */
 368         unp = sotounpcb(so);
 369         KASSERT(unp != NULL, ("uipc_accept: unp == NULL"));
 370
 371         *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
 372         UNP_LINK_RLOCK();
 373         unp2 = unp->unp_conn;
 374         if (unp2 != NULL && unp2->unp_addr != NULL) {
 375                 UNP_PCB_LOCK(unp2);
 376                 sa = (struct sockaddr *) unp2->unp_addr;
 377                 bcopy(sa, *nam, sa->sa_len);
 378                 UNP_PCB_UNLOCK(unp2);
 379         } else {
 380                 sa = &sun_noname;
 381                 bcopy(sa, *nam, sa->sa_len);
 382         }
 383         UNP_LINK_RUNLOCK();
 384         return (0);
 385 }
 386
 387 static int
 388 uipc_attach(struct socket *so, int proto, struct thread *td)
 389 {
 390         u_long sendspace, recvspace;
 391         struct unpcb *unp;
 392         int error;
 393
 394         KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
 395         if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
 396                 switch (so->so_type) {
 397                 case SOCK_STREAM:
 398                         sendspace = unpst_sendspace;
 399                         recvspace = unpst_recvspace;
 400                         break;
 401
 402                 case SOCK_DGRAM:
 403                         sendspace = unpdg_sendspace;
 404                         recvspace = unpdg_recvspace;
 405                         break;
 406
 407                 case SOCK_SEQPACKET:
 408                         sendspace = unpsp_sendspace;
 409                         recvspace = unpsp_recvspace;
 410                         break;
 411
 412                 default:
 413                         panic("uipc_attach");
 414                 }
 415                 error = soreserve(so, sendspace, recvspace);
 416                 if (error)
 417                         return (error);
 418         }
 419         unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
 420         if (unp == NULL)
 421                 return (ENOBUFS);
 422         LIST_INIT(&unp->unp_refs);
 423         UNP_PCB_LOCK_INIT(unp);
 424         unp->unp_socket = so;
 425         so->so_pcb = unp;
 426         unp->unp_refcount = 1;
 427
 428         UNP_LIST_LOCK();
 429         unp->unp_gencnt = ++unp_gencnt;
 430         unp_count++;
 431         switch (so->so_type) {
 432         case SOCK_STREAM:
 433                 LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
 434                 break;
 435
 436         case SOCK_DGRAM:
 437                 LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
 438                 break;
 439
 440         case SOCK_SEQPACKET:
 441                 LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
 442                 break;
 443
 444         default:
 445                 panic("uipc_attach");
 446         }
 447         UNP_LIST_UNLOCK();
 448
 449         return (0);
 450 }
 451
 452 static int
 453 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 454 {
 455         struct sockaddr_un *soun = (struct sockaddr_un *)nam;
 456         struct vattr vattr;
 457         int error, namelen;
 458         struct nameidata nd;
 459         struct unpcb *unp;
 460         struct vnode *vp;
 461         struct mount *mp;
 462         char *buf;
 463
 464         unp = sotounpcb(so);
 465         KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
 466
 467         if (soun->sun_len > sizeof(struct sockaddr_un))
 468                 return (EINVAL);
 469         namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
 470         if (namelen <= 0)
 471                 return (EINVAL);
 472
 473         /*
 474          * We don't allow simultaneous bind() calls on a single UNIX domain
 475          * socket, so flag in-progress operations, and return an error if an
 476          * operation is already in progress.
 477          *
 478          * Historically, we have not allowed a socket to be rebound, so this
 479          * also returns an error.  Not allowing re-binding simplifies the
 480          * implementation and avoids a great many possible failure modes.
 481          */
 482         UNP_PCB_LOCK(unp);
 483         if (unp->unp_vnode != NULL) {
 484                 UNP_PCB_UNLOCK(unp);
 485                 return (EINVAL);
 486         }
 487         if (unp->unp_flags & UNP_BINDING) {
 488                 UNP_PCB_UNLOCK(unp);
 489                 return (EALREADY);
 490         }
 491         unp->unp_flags |= UNP_BINDING;
 492         UNP_PCB_UNLOCK(unp);
 493
 494         buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
 495         bcopy(soun->sun_path, buf, namelen);
 496         buf[namelen] = 0;
 497
 498 restart:
 499         NDINIT(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME,
 500             UIO_SYSSPACE, buf, td);
 501 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
 502         error = namei(&nd);
 503         if (error)
 504                 goto error;
 505         vp = nd.ni_vp;
 506         if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
 507                 NDFREE(&nd, NDF_ONLY_PNBUF);
 508                 if (nd.ni_dvp == vp)
 509                         vrele(nd.ni_dvp);
 510                 else
 511                         vput(nd.ni_dvp);
 512                 if (vp != NULL) {
 513                         vrele(vp);
 514                         error = EADDRINUSE;
 515                         goto error;
 516                 }
 517                 error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH);
 518                 if (error)
 519                         goto error;
 520                 goto restart;
 521         }
 522         VATTR_NULL(&vattr);
 523         vattr.va_type = VSOCK;
 524         vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask);
 525 #ifdef MAC
 526         error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
 527             &vattr);
 528 #endif
 529         if (error == 0)
 530                 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
 531         NDFREE(&nd, NDF_ONLY_PNBUF);
 532         vput(nd.ni_dvp);
 533         if (error) {
 534                 vn_finished_write(mp);
 535                 goto error;
 536         }
 537         vp = nd.ni_vp;
 538         ASSERT_VOP_ELOCKED(vp, "uipc_bind");
 539         soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
 540
 541         UNP_LINK_WLOCK();
 542         UNP_PCB_LOCK(unp);
 543         VOP_UNP_BIND(vp, unp->unp_socket);
 544         unp->unp_vnode = vp;
 545         unp->unp_addr = soun;
 546         unp->unp_flags &= ~UNP_BINDING;
 547         UNP_PCB_UNLOCK(unp);
 548         UNP_LINK_WUNLOCK();
 549         VOP_UNLOCK(vp, 0);
 550         vn_finished_write(mp);
 551         free(buf, M_TEMP);
 552         return (0);
 553
 554 error:
 555         UNP_PCB_LOCK(unp);
 556         unp->unp_flags &= ~UNP_BINDING;
 557         UNP_PCB_UNLOCK(unp);
 558         free(buf, M_TEMP);
 559         return (error);
 560 }
 561
 562 static int
 563 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 564 {
 565         int error;
 566
 567         KASSERT(td == curthread, ("uipc_connect: td != curthread"));
 568         UNP_LINK_WLOCK();
 569         error = unp_connect(so, nam, td);
 570         UNP_LINK_WUNLOCK();
 571         return (error);
 572 }
 573
 574 static void
 575 uipc_close(struct socket *so)
 576 {
 577         struct unpcb *unp, *unp2;
 578
 579         unp = sotounpcb(so);
 580         KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
 581
 582         UNP_LINK_WLOCK();
 583         UNP_PCB_LOCK(unp);
 584         unp2 = unp->unp_conn;
 585         if (unp2 != NULL) {
 586                 UNP_PCB_LOCK(unp2);
 587                 unp_disconnect(unp, unp2);
 588                 UNP_PCB_UNLOCK(unp2);
 589         }
 590         UNP_PCB_UNLOCK(unp);
 591         UNP_LINK_WUNLOCK();
 592 }
 593
 594 static int
 595 uipc_connect2(struct socket *so1, struct socket *so2)
 596 {
 597         struct unpcb *unp, *unp2;
 598         int error;
 599
 600         UNP_LINK_WLOCK();
 601         unp = so1->so_pcb;
 602         KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
 603         UNP_PCB_LOCK(unp);
 604         unp2 = so2->so_pcb;
 605         KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
 606         UNP_PCB_LOCK(unp2);
 607         error = unp_connect2(so1, so2, PRU_CONNECT2);
 608         UNP_PCB_UNLOCK(unp2);
 609         UNP_PCB_UNLOCK(unp);
 610         UNP_LINK_WUNLOCK();
 611         return (error);
 612 }
 613
 614 static void
 615 uipc_detach(struct socket *so)
 616 {
 617         struct unpcb *unp, *unp2;
 618         struct sockaddr_un *saved_unp_addr;
 619         struct vnode *vp;
 620         int freeunp, local_unp_rights;
 621
 622         unp = sotounpcb(so);
 623         KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
 624
 625         UNP_LINK_WLOCK();
 626         UNP_LIST_LOCK();
 627         UNP_PCB_LOCK(unp);
 628         LIST_REMOVE(unp, unp_link);
 629         unp->unp_gencnt = ++unp_gencnt;
 630         --unp_count;
 631         UNP_LIST_UNLOCK();
 632
 633         /*
 634          * XXXRW: Should assert vp->v_socket == so.
 635          */
 636         if ((vp = unp->unp_vnode) != NULL) {
 637                 VOP_UNP_DETACH(vp);
 638                 unp->unp_vnode = NULL;
 639         }
 640         unp2 = unp->unp_conn;
 641         if (unp2 != NULL) {
 642                 UNP_PCB_LOCK(unp2);
 643                 unp_disconnect(unp, unp2);
 644                 UNP_PCB_UNLOCK(unp2);
 645         }
 646
 647         /*
 648          * We hold the linkage lock exclusively, so it's OK to acquire
 649          * multiple pcb locks at a time.
 650          */
 651         while (!LIST_EMPTY(&unp->unp_refs)) {
 652                 struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
 653
 654                 UNP_PCB_LOCK(ref);
 655                 unp_drop(ref, ECONNRESET);
 656                 UNP_PCB_UNLOCK(ref);
 657         }
 658         local_unp_rights = unp_rights;
 659         UNP_LINK_WUNLOCK();
 660         unp->unp_socket->so_pcb = NULL;
 661         saved_unp_addr = unp->unp_addr;
 662         unp->unp_addr = NULL;
 663         unp->unp_refcount--;
 664         freeunp = (unp->unp_refcount == 0);
 665         if (saved_unp_addr != NULL)
 666                 free(saved_unp_addr, M_SONAME);
 667         if (freeunp) {
 668                 UNP_PCB_LOCK_DESTROY(unp);
 669                 uma_zfree(unp_zone, unp);
 670         } else
 671                 UNP_PCB_UNLOCK(unp);
 672         if (vp)
 673                 vrele(vp);
 674         if (local_unp_rights)
 675                 taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
 676 }
 677
 678 static int
 679 uipc_disconnect(struct socket *so)
 680 {
 681         struct unpcb *unp, *unp2;
 682
 683         unp = sotounpcb(so);
 684         KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
 685
 686         UNP_LINK_WLOCK();
 687         UNP_PCB_LOCK(unp);
 688         unp2 = unp->unp_conn;
 689         if (unp2 != NULL) {
 690                 UNP_PCB_LOCK(unp2);
 691                 unp_disconnect(unp, unp2);
 692                 UNP_PCB_UNLOCK(unp2);
 693         }
 694         UNP_PCB_UNLOCK(unp);
 695         UNP_LINK_WUNLOCK();
 696         return (0);
 697 }
 698
 699 static int
 700 uipc_listen(struct socket *so, int backlog, struct thread *td)
 701 {
 702         struct unpcb *unp;
 703         int error;
 704
 705         unp = sotounpcb(so);
 706         KASSERT(unp != NULL, ("uipc_listen: unp == NULL"));
 707
 708         UNP_PCB_LOCK(unp);
 709         if (unp->unp_vnode == NULL) {
 710                 UNP_PCB_UNLOCK(unp);
 711                 return (EINVAL);
 712         }
 713
 714         SOCK_LOCK(so);
 715         error = solisten_proto_check(so);
 716         if (error == 0) {
 717                 cru2x(td->td_ucred, &unp->unp_peercred);
 718                 unp->unp_flags |= UNP_HAVEPCCACHED;
 719                 solisten_proto(so, backlog);
 720         }
 721         SOCK_UNLOCK(so);
 722         UNP_PCB_UNLOCK(unp);
 723         return (error);
 724 }
 725
 726 static int
 727 uipc_peeraddr(struct socket *so, struct sockaddr **nam)
 728 {
 729         struct unpcb *unp, *unp2;
 730         const struct sockaddr *sa;
 731
 732         unp = sotounpcb(so);
 733         KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
 734
 735         *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
 736         UNP_LINK_RLOCK();
 737         /*
 738          * XXX: It seems that this test always fails even when connection is
 739          * established.  So, this else clause is added as workaround to
 740          * return PF_LOCAL sockaddr.
 741          */
 742         unp2 = unp->unp_conn;
 743         if (unp2 != NULL) {
 744                 UNP_PCB_LOCK(unp2);
 745                 if (unp2->unp_addr != NULL)
 746                         sa = (struct sockaddr *) unp2->unp_addr;
 747                 else
 748                         sa = &sun_noname;
 749                 bcopy(sa, *nam, sa->sa_len);
 750                 UNP_PCB_UNLOCK(unp2);
 751         } else {
 752                 sa = &sun_noname;
 753                 bcopy(sa, *nam, sa->sa_len);
 754         }
 755         UNP_LINK_RUNLOCK();
 756         return (0);
 757 }
 758
 759 static int
 760 uipc_rcvd(struct socket *so, int flags)
 761 {
 762         struct unpcb *unp, *unp2;
 763         struct socket *so2;
 764         u_int mbcnt, sbcc;
 765         u_long newhiwat;
 766
 767         unp = sotounpcb(so);
 768         KASSERT(unp != NULL, ("uipc_rcvd: unp == NULL"));
 769
 770         if (so->so_type != SOCK_STREAM && so->so_type != SOCK_SEQPACKET)
 771                 panic("uipc_rcvd socktype %d", so->so_type);
 772
 773         /*
 774          * Adjust backpressure on sender and wakeup any waiting to write.
 775          *
 776          * The unp lock is acquired to maintain the validity of the unp_conn
 777          * pointer; no lock on unp2 is required as unp2->unp_socket will be
 778          * static as long as we don't permit unp2 to disconnect from unp,
 779          * which is prevented by the lock on unp.  We cache values from
 780          * so_rcv to avoid holding the so_rcv lock over the entire
 781          * transaction on the remote so_snd.
 782          */
 783         SOCKBUF_LOCK(&so->so_rcv);
 784         mbcnt = so->so_rcv.sb_mbcnt;
 785         sbcc = so->so_rcv.sb_cc;
 786         SOCKBUF_UNLOCK(&so->so_rcv);
 787         UNP_PCB_LOCK(unp);
 788         unp2 = unp->unp_conn;
 789         if (unp2 == NULL) {
 790                 UNP_PCB_UNLOCK(unp);
 791                 return (0);
 792         }
 793         so2 = unp2->unp_socket;
 794         SOCKBUF_LOCK(&so2->so_snd);
 795         so2->so_snd.sb_mbmax += unp->unp_mbcnt - mbcnt;
 796         newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc - sbcc;
 797         (void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat,
 798             newhiwat, RLIM_INFINITY);
 799         sowwakeup_locked(so2);
 800         unp->unp_mbcnt = mbcnt;
 801         unp->unp_cc = sbcc;
 802         UNP_PCB_UNLOCK(unp);
 803         return (0);
 804 }
 805
 806 static int
 807 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
 808     struct mbuf *control, struct thread *td)
 809 {
 810         struct unpcb *unp, *unp2;
 811         struct socket *so2;
 812         u_int mbcnt_delta, sbcc;
 813         u_int newhiwat;
 814         int error = 0;
 815
 816         unp = sotounpcb(so);
 817         KASSERT(unp != NULL, ("uipc_send: unp == NULL"));
 818
 819         if (flags & PRUS_OOB) {
 820                 error = EOPNOTSUPP;
 821                 goto release;
 822         }
 823         if (control != NULL && (error = unp_internalize(&control, td)))
 824                 goto release;
 825         if ((nam != NULL) || (flags & PRUS_EOF))
 826                 UNP_LINK_WLOCK();
 827         else
 828                 UNP_LINK_RLOCK();
 829         switch (so->so_type) {
 830         case SOCK_DGRAM:
 831         {
 832                 const struct sockaddr *from;
 833
 834                 unp2 = unp->unp_conn;
 835                 if (nam != NULL) {
 836                         UNP_LINK_WLOCK_ASSERT();
 837                         if (unp2 != NULL) {
 838                                 error = EISCONN;
 839                                 break;
 840                         }
 841                         error = unp_connect(so, nam, td);
 842                         if (error)
 843                                 break;
 844                         unp2 = unp->unp_conn;
 845                 }
 846
 847                 /*
 848                  * Because connect() and send() are non-atomic in a sendto()
 849                  * with a target address, it's possible that the socket will
 850                  * have disconnected before the send() can run.  In that case
 851                  * return the slightly counter-intuitive but otherwise
 852                  * correct error that the socket is not connected.
 853                  */
 854                 if (unp2 == NULL) {
 855                         error = ENOTCONN;
 856                         break;
 857                 }
 858                 /* Lockless read. */
 859                 if (unp2->unp_flags & UNP_WANTCRED)
 860                         control = unp_addsockcred(td, control);
 861                 UNP_PCB_LOCK(unp);
 862                 if (unp->unp_addr != NULL)
 863                         from = (struct sockaddr *)unp->unp_addr;
 864                 else
 865                         from = &sun_noname;
 866                 so2 = unp2->unp_socket;
 867                 SOCKBUF_LOCK(&so2->so_rcv);
 868                 if (sbappendaddr_locked(&so2->so_rcv, from, m, control)) {
 869                         sorwakeup_locked(so2);
 870                         m = NULL;
 871                         control = NULL;
 872                 } else {
 873                         SOCKBUF_UNLOCK(&so2->so_rcv);
 874                         error = ENOBUFS;
 875                 }
 876                 if (nam != NULL) {
 877                         UNP_LINK_WLOCK_ASSERT();
 878                         UNP_PCB_LOCK(unp2);
 879                         unp_disconnect(unp, unp2);
 880                         UNP_PCB_UNLOCK(unp2);
 881                 }
 882                 UNP_PCB_UNLOCK(unp);
 883                 break;
 884         }
 885
 886         case SOCK_SEQPACKET:
 887         case SOCK_STREAM:
 888                 if ((so->so_state & SS_ISCONNECTED) == 0) {
 889                         if (nam != NULL) {
 890                                 UNP_LINK_WLOCK_ASSERT();
 891                                 error = unp_connect(so, nam, td);
 892                                 if (error)
 893                                         break;  /* XXX */
 894                         } else {
 895                                 error = ENOTCONN;
 896                                 break;
 897                         }
 898                 }
 899
 900                 /* Lockless read. */
 901                 if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
 902                         error = EPIPE;
 903                         break;
 904                 }
 905
 906                 /*
 907                  * Because connect() and send() are non-atomic in a sendto()
 908                  * with a target address, it's possible that the socket will
 909                  * have disconnected before the send() can run.  In that case
 910                  * return the slightly counter-intuitive but otherwise
 911                  * correct error that the socket is not connected.
 912                  *
 913                  * Locking here must be done carefully: the linkage lock
 914                  * prevents interconnections between unpcbs from changing, so
 915                  * we can traverse from unp to unp2 without acquiring unp's
 916                  * lock.  Socket buffer locks follow unpcb locks, so we can
 917                  * acquire both remote and lock socket buffer locks.
 918                  */
 919                 unp2 = unp->unp_conn;
 920                 if (unp2 == NULL) {
 921                         error = ENOTCONN;
 922                         break;
 923                 }
 924                 so2 = unp2->unp_socket;
 925                 UNP_PCB_LOCK(unp2);
 926                 SOCKBUF_LOCK(&so2->so_rcv);
 927                 if (unp2->unp_flags & UNP_WANTCRED) {
 928                         /*
 929                          * Credentials are passed only once on SOCK_STREAM
 930                          * and SOCK_SEQPACKET.
 931                          */
 932                         unp2->unp_flags &= ~UNP_WANTCRED;
 933                         control = unp_addsockcred(td, control);
 934                 }
 935                 /*
 936                  * Send to paired receive port, and then reduce send buffer
 937                  * hiwater marks to maintain backpressure.  Wake up readers.
 938                  */
 939                 switch (so->so_type) {
 940                 case SOCK_STREAM:
 941                         if (control != NULL) {
 942                                 if (sbappendcontrol_locked(&so2->so_rcv, m,
 943                                     control))
 944                                         control = NULL;
 945                         } else
 946                                 sbappend_locked(&so2->so_rcv, m);
 947                         break;
 948
 949                 case SOCK_SEQPACKET: {
 950                         const struct sockaddr *from;
 951
 952                         from = &sun_noname;
 953                         if (sbappendaddr_locked(&so2->so_rcv, from, m,
 954                             control))
 955                                 control = NULL;
 956                         break;
 957                         }
 958                 }
 959
 960                 /*
 961                  * XXXRW: While fine for SOCK_STREAM, this conflates maximum
 962                  * datagram size and back-pressure for SOCK_SEQPACKET, which
 963                  * can lead to undesired return of EMSGSIZE on send instead
 964                  * of more desirable blocking.
 965                  */
 966                 mbcnt_delta = so2->so_rcv.sb_mbcnt - unp2->unp_mbcnt;
 967                 unp2->unp_mbcnt = so2->so_rcv.sb_mbcnt;
 968                 sbcc = so2->so_rcv.sb_cc;
 969                 sorwakeup_locked(so2);
 970
 971                 SOCKBUF_LOCK(&so->so_snd);
 972                 if ((int)so->so_snd.sb_hiwat >= (int)(sbcc - unp2->unp_cc))
 973                         newhiwat = so->so_snd.sb_hiwat - (sbcc - unp2->unp_cc);
 974                 else
 975                         newhiwat = 0;
 976                 (void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat,
 977                     newhiwat, RLIM_INFINITY);
 978                 so->so_snd.sb_mbmax -= mbcnt_delta;
 979                 SOCKBUF_UNLOCK(&so->so_snd);
 980                 unp2->unp_cc = sbcc;
 981                 UNP_PCB_UNLOCK(unp2);
 982                 m = NULL;
 983                 break;
 984
 985         default:
 986                 panic("uipc_send unknown socktype");
 987         }
 988
 989         /*
 990          * PRUS_EOF is equivalent to pru_send followed by pru_shutdown.
 991          */
 992         if (flags & PRUS_EOF) {
 993                 UNP_PCB_LOCK(unp);
 994                 socantsendmore(so);
 995                 unp_shutdown(unp);
 996                 UNP_PCB_UNLOCK(unp);
 997         }
 998
 999         if ((nam != NULL) || (flags & PRUS_EOF))
1000                 UNP_LINK_WUNLOCK();
1001         else
1002                 UNP_LINK_RUNLOCK();
1003
1004         if (control != NULL && error != 0)
1005                 unp_dispose(control);
1006
1007 release:
1008         if (control != NULL)
1009                 m_freem(control);
1010         if (m != NULL)
1011                 m_freem(m);
1012         return (error);
1013 }
1014
1015 static int
1016 uipc_sense(struct socket *so, struct stat *sb)
1017 {
1018         struct unpcb *unp, *unp2;
1019         struct socket *so2;
1020
1021         unp = sotounpcb(so);
1022         KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1023
1024         sb->st_blksize = so->so_snd.sb_hiwat;
1025         UNP_LINK_RLOCK();
1026         UNP_PCB_LOCK(unp);
1027         unp2 = unp->unp_conn;
1028         if ((so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET) &&
1029             unp2 != NULL) {
1030                 so2 = unp2->unp_socket;
1031                 sb->st_blksize += so2->so_rcv.sb_cc;
1032         }
1033         sb->st_dev = NODEV;
1034         if (unp->unp_ino == 0)
1035                 unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino;
1036         sb->st_ino = unp->unp_ino;
1037         UNP_PCB_UNLOCK(unp);
1038         UNP_LINK_RUNLOCK();
1039         return (0);
1040 }
1041
1042 static int
1043 uipc_shutdown(struct socket *so)
1044 {
1045         struct unpcb *unp;
1046
1047         unp = sotounpcb(so);
1048         KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
1049
1050         UNP_LINK_WLOCK();
1051         UNP_PCB_LOCK(unp);
1052         socantsendmore(so);
1053         unp_shutdown(unp);
1054         UNP_PCB_UNLOCK(unp);
1055         UNP_LINK_WUNLOCK();
1056         return (0);
1057 }
1058
1059 static int
1060 uipc_sockaddr(struct socket *so, struct sockaddr **nam)
1061 {
1062         struct unpcb *unp;
1063         const struct sockaddr *sa;
1064
1065         unp = sotounpcb(so);
1066         KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1067
1068         *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1069         UNP_PCB_LOCK(unp);
1070         if (unp->unp_addr != NULL)
1071                 sa = (struct sockaddr *) unp->unp_addr;
1072         else
1073                 sa = &sun_noname;
1074         bcopy(sa, *nam, sa->sa_len);
1075         UNP_PCB_UNLOCK(unp);
1076         return (0);
1077 }
1078
1079 static struct pr_usrreqs uipc_usrreqs_dgram = {
1080         .pru_abort =            uipc_abort,
1081         .pru_accept =           uipc_accept,
1082         .pru_attach =           uipc_attach,
1083         .pru_bind =             uipc_bind,
1084         .pru_connect =          uipc_connect,
1085         .pru_connect2 =         uipc_connect2,
1086         .pru_detach =           uipc_detach,
1087         .pru_disconnect =       uipc_disconnect,
1088         .pru_listen =           uipc_listen,
1089         .pru_peeraddr =         uipc_peeraddr,
1090         .pru_rcvd =             uipc_rcvd,
1091         .pru_send =             uipc_send,
1092         .pru_sense =            uipc_sense,
1093         .pru_shutdown =         uipc_shutdown,
1094         .pru_sockaddr =         uipc_sockaddr,
1095         .pru_soreceive =        soreceive_dgram,
1096         .pru_close =            uipc_close,
1097 };
1098
1099 static struct pr_usrreqs uipc_usrreqs_seqpacket = {
1100         .pru_abort =            uipc_abort,
1101         .pru_accept =           uipc_accept,
1102         .pru_attach =           uipc_attach,
1103         .pru_bind =             uipc_bind,
1104         .pru_connect =          uipc_connect,
1105         .pru_connect2 =         uipc_connect2,
1106         .pru_detach =           uipc_detach,
1107         .pru_disconnect =       uipc_disconnect,
1108         .pru_listen =           uipc_listen,
1109         .pru_peeraddr =         uipc_peeraddr,
1110         .pru_rcvd =             uipc_rcvd,
1111         .pru_send =             uipc_send,
1112         .pru_sense =            uipc_sense,
1113         .pru_shutdown =         uipc_shutdown,
1114         .pru_sockaddr =         uipc_sockaddr,
1115         .pru_soreceive =        soreceive_generic,      /* XXX: or...? */
1116         .pru_close =            uipc_close,
1117 };
1118
1119 static struct pr_usrreqs uipc_usrreqs_stream = {
1120         .pru_abort =            uipc_abort,
1121         .pru_accept =           uipc_accept,
1122         .pru_attach =           uipc_attach,
1123         .pru_bind =             uipc_bind,
1124         .pru_connect =          uipc_connect,
1125         .pru_connect2 =         uipc_connect2,
1126         .pru_detach =           uipc_detach,
1127         .pru_disconnect =       uipc_disconnect,
1128         .pru_listen =           uipc_listen,
1129         .pru_peeraddr =         uipc_peeraddr,
1130         .pru_rcvd =             uipc_rcvd,
1131         .pru_send =             uipc_send,
1132         .pru_sense =            uipc_sense,
1133         .pru_shutdown =         uipc_shutdown,
1134         .pru_sockaddr =         uipc_sockaddr,
1135         .pru_soreceive =        soreceive_generic,
1136         .pru_close =            uipc_close,
1137 };
1138
1139 static int
1140 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
1141 {
1142         struct unpcb *unp;
1143         struct xucred xu;
1144         int error, optval;
1145
1146         if (sopt->sopt_level != 0)
1147                 return (EINVAL);
1148
1149         unp = sotounpcb(so);
1150         KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
1151         error = 0;
1152         switch (sopt->sopt_dir) {
1153         case SOPT_GET:
1154                 switch (sopt->sopt_name) {
1155                 case LOCAL_PEERCRED:
1156                         UNP_PCB_LOCK(unp);
1157                         if (unp->unp_flags & UNP_HAVEPC)
1158                                 xu = unp->unp_peercred;
1159                         else {
1160                                 if (so->so_type == SOCK_STREAM)
1161                                         error = ENOTCONN;
1162                                 else
1163                                         error = EINVAL;
1164                         }
1165                         UNP_PCB_UNLOCK(unp);
1166                         if (error == 0)
1167                                 error = sooptcopyout(sopt, &xu, sizeof(xu));
1168                         break;
1169
1170                 case LOCAL_CREDS:
1171                         /* Unlocked read. */
1172                         optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0;
1173                         error = sooptcopyout(sopt, &optval, sizeof(optval));
1174                         break;
1175
1176                 case LOCAL_CONNWAIT:
1177                         /* Unlocked read. */
1178                         optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0;
1179                         error = sooptcopyout(sopt, &optval, sizeof(optval));
1180                         break;
1181
1182                 default:
1183                         error = EOPNOTSUPP;
1184                         break;
1185                 }
1186                 break;
1187
1188         case SOPT_SET:
1189                 switch (sopt->sopt_name) {
1190                 case LOCAL_CREDS:
1191                 case LOCAL_CONNWAIT:
1192                         error = sooptcopyin(sopt, &optval, sizeof(optval),
1193                                             sizeof(optval));
1194                         if (error)
1195                                 break;
1196
1197 #define OPTSET(bit) do {                                                \
1198         UNP_PCB_LOCK(unp);                                              \
1199         if (optval)                                                     \
1200                 unp->unp_flags |= bit;                                  \
1201         else                                                            \
1202                 unp->unp_flags &= ~bit;                                 \
1203         UNP_PCB_UNLOCK(unp);                                            \
1204 } while (0)
1205
1206                         switch (sopt->sopt_name) {
1207                         case LOCAL_CREDS:
1208                                 OPTSET(UNP_WANTCRED);
1209                                 break;
1210
1211                         case LOCAL_CONNWAIT:
1212                                 OPTSET(UNP_CONNWAIT);
1213                                 break;
1214
1215                         default:
1216                                 break;
1217                         }
1218                         break;
1219 #undef  OPTSET
1220                 default:
1221                         error = ENOPROTOOPT;
1222                         break;
1223                 }
1224                 break;
1225
1226         default:
1227                 error = EOPNOTSUPP;
1228                 break;
1229         }
1230         return (error);
1231 }
1232
1233 static int
1234 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1235 {
1236         struct sockaddr_un *soun = (struct sockaddr_un *)nam;
1237         struct vnode *vp;
1238         struct socket *so2, *so3;
1239         struct unpcb *unp, *unp2, *unp3;
1240         int error, len;
1241         struct nameidata nd;
1242         char buf[SOCK_MAXADDRLEN];
1243         struct sockaddr *sa;
1244
1245         UNP_LINK_WLOCK_ASSERT();
1246
1247         unp = sotounpcb(so);
1248         KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1249
1250         if (nam->sa_len > sizeof(struct sockaddr_un))
1251                 return (EINVAL);
1252         len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
1253         if (len <= 0)
1254                 return (EINVAL);
1255         bcopy(soun->sun_path, buf, len);
1256         buf[len] = 0;
1257
1258         UNP_PCB_LOCK(unp);
1259         if (unp->unp_flags & UNP_CONNECTING) {
1260                 UNP_PCB_UNLOCK(unp);
1261                 return (EALREADY);
1262         }
1263         UNP_LINK_WUNLOCK();
1264         unp->unp_flags |= UNP_CONNECTING;
1265         UNP_PCB_UNLOCK(unp);
1266
1267         sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1268         NDINIT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF,
1269             UIO_SYSSPACE, buf, td);
1270         error = namei(&nd);
1271         if (error)
1272                 vp = NULL;
1273         else
1274                 vp = nd.ni_vp;
1275         ASSERT_VOP_LOCKED(vp, "unp_connect");
1276         NDFREE(&nd, NDF_ONLY_PNBUF);
1277         if (error)
1278                 goto bad;
1279
1280         if (vp->v_type != VSOCK) {
1281                 error = ENOTSOCK;
1282                 goto bad;
1283         }
1284 #ifdef MAC
1285         error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
1286         if (error)
1287                 goto bad;
1288 #endif
1289         error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1290         if (error)
1291                 goto bad;
1292
1293         unp = sotounpcb(so);
1294         KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1295
1296         /*
1297          * Lock linkage lock for two reasons: make sure v_socket is stable,
1298          * and to protect simultaneous locking of multiple pcbs.
1299          */
1300         UNP_LINK_WLOCK();
1301         VOP_UNP_CONNECT(vp, &so2);
1302         if (so2 == NULL) {
1303                 error = ECONNREFUSED;
1304                 goto bad2;
1305         }
1306         if (so->so_type != so2->so_type) {
1307                 error = EPROTOTYPE;
1308                 goto bad2;
1309         }
1310         if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1311                 if (so2->so_options & SO_ACCEPTCONN) {
1312                         CURVNET_SET(so2->so_vnet);
1313                         so3 = sonewconn(so2, 0);
1314                         CURVNET_RESTORE();
1315                 } else
1316                         so3 = NULL;
1317                 if (so3 == NULL) {
1318                         error = ECONNREFUSED;
1319                         goto bad2;
1320                 }
1321                 unp = sotounpcb(so);
1322                 unp2 = sotounpcb(so2);
1323                 unp3 = sotounpcb(so3);
1324                 UNP_PCB_LOCK(unp);
1325                 UNP_PCB_LOCK(unp2);
1326                 UNP_PCB_LOCK(unp3);
1327                 if (unp2->unp_addr != NULL) {
1328                         bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
1329                         unp3->unp_addr = (struct sockaddr_un *) sa;
1330                         sa = NULL;
1331                 }
1332
1333                 /*
1334                  * The connecter's (client's) credentials are copied from its
1335                  * process structure at the time of connect() (which is now).
1336                  */
1337                 cru2x(td->td_ucred, &unp3->unp_peercred);
1338                 unp3->unp_flags |= UNP_HAVEPC;
1339
1340                 /*
1341                  * The receiver's (server's) credentials are copied from the
1342                  * unp_peercred member of socket on which the former called
1343                  * listen(); uipc_listen() cached that process's credentials
1344                  * at that time so we can use them now.
1345                  */
1346                 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1347                     ("unp_connect: listener without cached peercred"));
1348                 memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1349                     sizeof(unp->unp_peercred));
1350                 unp->unp_flags |= UNP_HAVEPC;
1351                 if (unp2->unp_flags & UNP_WANTCRED)
1352                         unp3->unp_flags |= UNP_WANTCRED;
1353                 UNP_PCB_UNLOCK(unp3);
1354                 UNP_PCB_UNLOCK(unp2);
1355                 UNP_PCB_UNLOCK(unp);
1356 #ifdef MAC
1357                 mac_socketpeer_set_from_socket(so, so3);
1358                 mac_socketpeer_set_from_socket(so3, so);
1359 #endif
1360
1361                 so2 = so3;
1362         }
1363         unp = sotounpcb(so);
1364         KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1365         unp2 = sotounpcb(so2);
1366         KASSERT(unp2 != NULL, ("unp_connect: unp2 == NULL"));
1367         UNP_PCB_LOCK(unp);
1368         UNP_PCB_LOCK(unp2);
1369         error = unp_connect2(so, so2, PRU_CONNECT);
1370         UNP_PCB_UNLOCK(unp2);
1371         UNP_PCB_UNLOCK(unp);
1372 bad2:
1373         UNP_LINK_WUNLOCK();
1374 bad:
1375         if (vp != NULL)
1376                 vput(vp);
1377         free(sa, M_SONAME);
1378         UNP_LINK_WLOCK();
1379         UNP_PCB_LOCK(unp);
1380         unp->unp_flags &= ~UNP_CONNECTING;
1381         UNP_PCB_UNLOCK(unp);
1382         return (error);
1383 }
1384
1385 static int
1386 unp_connect2(struct socket *so, struct socket *so2, int req)
1387 {
1388         struct unpcb *unp;
1389         struct unpcb *unp2;
1390
1391         unp = sotounpcb(so);
1392         KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
1393         unp2 = sotounpcb(so2);
1394         KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
1395
1396         UNP_LINK_WLOCK_ASSERT();
1397         UNP_PCB_LOCK_ASSERT(unp);
1398         UNP_PCB_LOCK_ASSERT(unp2);
1399
1400         if (so2->so_type != so->so_type)
1401                 return (EPROTOTYPE);
1402         unp->unp_conn = unp2;
1403
1404         switch (so->so_type) {
1405         case SOCK_DGRAM:
1406                 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1407                 soisconnected(so);
1408                 break;
1409
1410         case SOCK_STREAM:
1411         case SOCK_SEQPACKET:
1412                 unp2->unp_conn = unp;
1413                 if (req == PRU_CONNECT &&
1414                     ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
1415                         soisconnecting(so);
1416                 else
1417                         soisconnected(so);
1418                 soisconnected(so2);
1419                 break;
1420
1421         default:
1422                 panic("unp_connect2");
1423         }
1424         return (0);
1425 }
1426
1427 static void
1428 unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
1429 {
1430         struct socket *so;
1431
1432         KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL"));
1433
1434         UNP_LINK_WLOCK_ASSERT();
1435         UNP_PCB_LOCK_ASSERT(unp);
1436         UNP_PCB_LOCK_ASSERT(unp2);
1437
1438         unp->unp_conn = NULL;
1439         switch (unp->unp_socket->so_type) {
1440         case SOCK_DGRAM:
1441                 LIST_REMOVE(unp, unp_reflink);
1442                 so = unp->unp_socket;
1443                 SOCK_LOCK(so);
1444                 so->so_state &= ~SS_ISCONNECTED;
1445                 SOCK_UNLOCK(so);
1446                 break;
1447
1448         case SOCK_STREAM:
1449         case SOCK_SEQPACKET:
1450                 soisdisconnected(unp->unp_socket);
1451                 unp2->unp_conn = NULL;
1452                 soisdisconnected(unp2->unp_socket);
1453                 break;
1454         }
1455 }
1456
1457 /*
1458  * unp_pcblist() walks the global list of struct unpcb's to generate a
1459  * pointer list, bumping the refcount on each unpcb.  It then copies them out
1460  * sequentially, validating the generation number on each to see if it has
1461  * been detached.  All of this is necessary because copyout() may sleep on
1462  * disk I/O.
1463  */
1464 static int
1465 unp_pcblist(SYSCTL_HANDLER_ARGS)
1466 {
1467         int error, i, n;
1468         int freeunp;
1469         struct unpcb *unp, **unp_list;
1470         unp_gen_t gencnt;
1471         struct xunpgen *xug;
1472         struct unp_head *head;
1473         struct xunpcb *xu;
1474
1475         switch ((intptr_t)arg1) {
1476         case SOCK_STREAM:
1477                 head = &unp_shead;
1478                 break;
1479
1480         case SOCK_DGRAM:
1481                 head = &unp_dhead;
1482                 break;
1483
1484         case SOCK_SEQPACKET:
1485                 head = &unp_sphead;
1486                 break;
1487
1488         default:
1489                 panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
1490         }
1491
1492         /*
1493          * The process of preparing the PCB list is too time-consuming and
1494          * resource-intensive to repeat twice on every request.
1495          */
1496         if (req->oldptr == NULL) {
1497                 n = unp_count;
1498                 req->oldidx = 2 * (sizeof *xug)
1499                         + (n + n/8) * sizeof(struct xunpcb);
1500                 return (0);
1501         }
1502
1503         if (req->newptr != NULL)
1504                 return (EPERM);
1505
1506         /*
1507          * OK, now we're committed to doing something.
1508          */
1509         xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK);
1510         UNP_LIST_LOCK();
1511         gencnt = unp_gencnt;
1512         n = unp_count;
1513         UNP_LIST_UNLOCK();
1514
1515         xug->xug_len = sizeof *xug;
1516         xug->xug_count = n;
1517         xug->xug_gen = gencnt;
1518         xug->xug_sogen = so_gencnt;
1519         error = SYSCTL_OUT(req, xug, sizeof *xug);
1520         if (error) {
1521                 free(xug, M_TEMP);
1522                 return (error);
1523         }
1524
1525         unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
1526
1527         UNP_LIST_LOCK();
1528         for (unp = LIST_FIRST(head), i = 0; unp && i < n;
1529              unp = LIST_NEXT(unp, unp_link)) {
1530                 UNP_PCB_LOCK(unp);
1531                 if (unp->unp_gencnt <= gencnt) {
1532                         if (cr_cansee(req->td->td_ucred,
1533                             unp->unp_socket->so_cred)) {
1534                                 UNP_PCB_UNLOCK(unp);
1535                                 continue;
1536                         }
1537                         unp_list[i++] = unp;
1538                         unp->unp_refcount++;
1539                 }
1540                 UNP_PCB_UNLOCK(unp);
1541         }
1542         UNP_LIST_UNLOCK();
1543         n = i;                  /* In case we lost some during malloc. */
1544
1545         error = 0;
1546         xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
1547         for (i = 0; i < n; i++) {
1548                 unp = unp_list[i];
1549                 UNP_PCB_LOCK(unp);
1550                 unp->unp_refcount--;
1551                 if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) {
1552                         xu->xu_len = sizeof *xu;
1553                         xu->xu_unpp = unp;
1554                         /*
1555                          * XXX - need more locking here to protect against
1556                          * connect/disconnect races for SMP.
1557                          */
1558                         if (unp->unp_addr != NULL)
1559                                 bcopy(unp->unp_addr, &xu->xu_addr,
1560                                       unp->unp_addr->sun_len);
1561                         if (unp->unp_conn != NULL &&
1562                             unp->unp_conn->unp_addr != NULL)
1563                                 bcopy(unp->unp_conn->unp_addr,
1564                                       &xu->xu_caddr,
1565                                       unp->unp_conn->unp_addr->sun_len);
1566                         bcopy(unp, &xu->xu_unp, sizeof *unp);
1567                         sotoxsocket(unp->unp_socket, &xu->xu_socket);
1568                         UNP_PCB_UNLOCK(unp);
1569                         error = SYSCTL_OUT(req, xu, sizeof *xu);
1570                 } else {
1571                         freeunp = (unp->unp_refcount == 0);
1572                         UNP_PCB_UNLOCK(unp);
1573                         if (freeunp) {
1574                                 UNP_PCB_LOCK_DESTROY(unp);
1575                                 uma_zfree(unp_zone, unp);
1576                         }
1577                 }
1578         }
1579         free(xu, M_TEMP);
1580         if (!error) {
1581                 /*
1582                  * Give the user an updated idea of our state.  If the
1583                  * generation differs from what we told her before, she knows
1584                  * that something happened while we were processing this
1585                  * request, and it might be necessary to retry.
1586                  */
1587                 xug->xug_gen = unp_gencnt;
1588                 xug->xug_sogen = so_gencnt;
1589                 xug->xug_count = unp_count;
1590                 error = SYSCTL_OUT(req, xug, sizeof *xug);
1591         }
1592         free(unp_list, M_TEMP);
1593         free(xug, M_TEMP);
1594         return (error);
1595 }
1596
1597 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
1598     (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
1599     "List of active local datagram sockets");
1600 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
1601     (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
1602     "List of active local stream sockets");
1603 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
1604     CTLTYPE_OPAQUE | CTLFLAG_RD,
1605     (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
1606     "List of active local seqpacket sockets");
1607
1608 static void
1609 unp_shutdown(struct unpcb *unp)
1610 {
1611         struct unpcb *unp2;
1612         struct socket *so;
1613
1614         UNP_LINK_WLOCK_ASSERT();
1615         UNP_PCB_LOCK_ASSERT(unp);
1616
1617         unp2 = unp->unp_conn;
1618         if ((unp->unp_socket->so_type == SOCK_STREAM ||
1619             (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
1620                 so = unp2->unp_socket;
1621                 if (so != NULL)
1622                         socantrcvmore(so);
1623         }
1624 }
1625
1626 static void
1627 unp_drop(struct unpcb *unp, int errno)
1628 {
1629         struct socket *so = unp->unp_socket;
1630         struct unpcb *unp2;
1631
1632         UNP_LINK_WLOCK_ASSERT();
1633         UNP_PCB_LOCK_ASSERT(unp);
1634
1635         so->so_error = errno;
1636         unp2 = unp->unp_conn;
1637         if (unp2 == NULL)
1638                 return;
1639         UNP_PCB_LOCK(unp2);
1640         unp_disconnect(unp, unp2);
1641         UNP_PCB_UNLOCK(unp2);
1642 }
1643
1644 static void
1645 unp_freerights(struct file **rp, int fdcount)
1646 {
1647         int i;
1648         struct file *fp;
1649
1650         for (i = 0; i < fdcount; i++) {
1651                 fp = *rp;
1652                 *rp++ = NULL;
1653                 unp_discard(fp);
1654         }
1655 }
1656
1657 static int
1658 unp_externalize(struct mbuf *control, struct mbuf **controlp)
1659 {
1660         struct thread *td = curthread;          /* XXX */
1661         struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1662         int i;
1663         int *fdp;
1664         struct file **rp;
1665         struct file *fp;
1666         void *data;
1667         socklen_t clen = control->m_len, datalen;
1668         int error, newfds;
1669         int f;
1670         u_int newlen;
1671
1672         UNP_LINK_UNLOCK_ASSERT();
1673
1674         error = 0;
1675         if (controlp != NULL) /* controlp == NULL => free control messages */
1676                 *controlp = NULL;
1677         while (cm != NULL) {
1678                 if (sizeof(*cm) > clen || cm->cmsg_len > clen) {
1679                         error = EINVAL;
1680                         break;
1681                 }
1682                 data = CMSG_DATA(cm);
1683                 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
1684                 if (cm->cmsg_level == SOL_SOCKET
1685                     && cm->cmsg_type == SCM_RIGHTS) {
1686                         newfds = datalen / sizeof(struct file *);
1687                         rp = data;
1688
1689                         /* If we're not outputting the descriptors free them. */
1690                         if (error || controlp == NULL) {
1691                                 unp_freerights(rp, newfds);
1692                                 goto next;
1693                         }
1694                         FILEDESC_XLOCK(td->td_proc->p_fd);
1695                         /* if the new FD's will not fit free them.  */
1696                         if (!fdavail(td, newfds)) {
1697                                 FILEDESC_XUNLOCK(td->td_proc->p_fd);
1698                                 error = EMSGSIZE;
1699                                 unp_freerights(rp, newfds);
1700                                 goto next;
1701                         }
1702
1703                         /*
1704                          * Now change each pointer to an fd in the global
1705                          * table to an integer that is the index to the local
1706                          * fd table entry that we set up to point to the
1707                          * global one we are transferring.
1708                          */
1709                         newlen = newfds * sizeof(int);
1710                         *controlp = sbcreatecontrol(NULL, newlen,
1711                             SCM_RIGHTS, SOL_SOCKET);
1712                         if (*controlp == NULL) {
1713                                 FILEDESC_XUNLOCK(td->td_proc->p_fd);
1714                                 error = E2BIG;
1715                                 unp_freerights(rp, newfds);
1716                                 goto next;
1717                         }
1718
1719                         fdp = (int *)
1720                             CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1721                         for (i = 0; i < newfds; i++) {
1722                                 if (fdalloc(td, 0, &f))
1723                                         panic("unp_externalize fdalloc failed");
1724                                 fp = *rp++;
1725                                 td->td_proc->p_fd->fd_ofiles[f] = fp;
1726                                 unp_externalize_fp(fp);
1727                                 *fdp++ = f;
1728                         }
1729                         FILEDESC_XUNLOCK(td->td_proc->p_fd);
1730                 } else {
1731                         /* We can just copy anything else across. */
1732                         if (error || controlp == NULL)
1733                                 goto next;
1734                         *controlp = sbcreatecontrol(NULL, datalen,
1735                             cm->cmsg_type, cm->cmsg_level);
1736                         if (*controlp == NULL) {
1737                                 error = ENOBUFS;
1738                                 goto next;
1739                         }
1740                         bcopy(data,
1741                             CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
1742                             datalen);
1743                 }
1744                 controlp = &(*controlp)->m_next;
1745
1746 next:
1747                 if (CMSG_SPACE(datalen) < clen) {
1748                         clen -= CMSG_SPACE(datalen);
1749                         cm = (struct cmsghdr *)
1750                             ((caddr_t)cm + CMSG_SPACE(datalen));
1751                 } else {
1752                         clen = 0;
1753                         cm = NULL;
1754                 }
1755         }
1756
1757         m_freem(control);
1758         return (error);
1759 }
1760
1761 static void
1762 unp_zone_change(void *tag)
1763 {
1764
1765         uma_zone_set_max(unp_zone, maxsockets);
1766 }
1767
1768 static void
1769 unp_init(void)
1770 {
1771
1772 #ifdef VIMAGE
1773         if (!IS_DEFAULT_VNET(curvnet))
1774                 return;
1775 #endif
1776         unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, NULL,
1777             NULL, NULL, UMA_ALIGN_PTR, 0);
1778         if (unp_zone == NULL)
1779                 panic("unp_init");
1780         uma_zone_set_max(unp_zone, maxsockets);
1781         EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
1782             NULL, EVENTHANDLER_PRI_ANY);
1783         LIST_INIT(&unp_dhead);
1784         LIST_INIT(&unp_shead);
1785         LIST_INIT(&unp_sphead);
1786         SLIST_INIT(&unp_defers);
1787         TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
1788         TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
1789         UNP_LINK_LOCK_INIT();
1790         UNP_LIST_LOCK_INIT();
1791         UNP_DEFERRED_LOCK_INIT();
1792 }
1793
1794 static int
1795 unp_internalize(struct mbuf **controlp, struct thread *td)
1796 {
1797         struct mbuf *control = *controlp;
1798         struct proc *p = td->td_proc;
1799         struct filedesc *fdescp = p->p_fd;
1800         struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1801         struct cmsgcred *cmcred;
1802         struct file **rp;
1803         struct file *fp;
1804         struct timeval *tv;
1805         int i, fd, *fdp;
1806         void *data;
1807         socklen_t clen = control->m_len, datalen;
1808         int error, oldfds;
1809         u_int newlen;
1810
1811         UNP_LINK_UNLOCK_ASSERT();
1812
1813         error = 0;
1814         *controlp = NULL;
1815         while (cm != NULL) {
1816                 if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
1817                     || cm->cmsg_len > clen) {
1818                         error = EINVAL;
1819                         goto out;
1820                 }
1821                 data = CMSG_DATA(cm);
1822                 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
1823
1824                 switch (cm->cmsg_type) {
1825                 /*
1826                  * Fill in credential information.
1827                  */
1828                 case SCM_CREDS:
1829                         *controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
1830                             SCM_CREDS, SOL_SOCKET);
1831                         if (*controlp == NULL) {
1832                                 error = ENOBUFS;
1833                                 goto out;
1834                         }
1835                         cmcred = (struct cmsgcred *)
1836                             CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1837                         cmcred->cmcred_pid = p->p_pid;
1838                         cmcred->cmcred_uid = td->td_ucred->cr_ruid;
1839                         cmcred->cmcred_gid = td->td_ucred->cr_rgid;
1840                         cmcred->cmcred_euid = td->td_ucred->cr_uid;
1841                         cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
1842                             CMGROUP_MAX);
1843                         for (i = 0; i < cmcred->cmcred_ngroups; i++)
1844                                 cmcred->cmcred_groups[i] =
1845                                     td->td_ucred->cr_groups[i];
1846                         break;
1847
1848                 case SCM_RIGHTS:
1849                         oldfds = datalen / sizeof (int);
1850                         /*
1851                          * Check that all the FDs passed in refer to legal
1852                          * files.  If not, reject the entire operation.
1853                          */
1854                         fdp = data;
1855                         FILEDESC_SLOCK(fdescp);
1856                         for (i = 0; i < oldfds; i++) {
1857                                 fd = *fdp++;
1858                                 if (fd < 0 || fd >= fdescp->fd_nfiles ||
1859                                     fdescp->fd_ofiles[fd] == NULL) {
1860                                         FILEDESC_SUNLOCK(fdescp);
1861                                         error = EBADF;
1862                                         goto out;
1863                                 }
1864                                 fp = fdescp->fd_ofiles[fd];
1865                                 if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
1866                                         FILEDESC_SUNLOCK(fdescp);
1867                                         error = EOPNOTSUPP;
1868                                         goto out;
1869                                 }
1870
1871                         }
1872
1873                         /*
1874                          * Now replace the integer FDs with pointers to the
1875                          * associated global file table entry..
1876                          */
1877                         newlen = oldfds * sizeof(struct file *);
1878                         *controlp = sbcreatecontrol(NULL, newlen,
1879                             SCM_RIGHTS, SOL_SOCKET);
1880                         if (*controlp == NULL) {
1881                                 FILEDESC_SUNLOCK(fdescp);
1882                                 error = E2BIG;
1883                                 goto out;
1884                         }
1885                         fdp = data;
1886                         rp = (struct file **)
1887                             CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1888                         for (i = 0; i < oldfds; i++) {
1889                                 fp = fdescp->fd_ofiles[*fdp++];
1890                                 *rp++ = fp;
1891                                 unp_internalize_fp(fp);
1892                         }
1893                         FILEDESC_SUNLOCK(fdescp);
1894                         break;
1895
1896                 case SCM_TIMESTAMP:
1897                         *controlp = sbcreatecontrol(NULL, sizeof(*tv),
1898                             SCM_TIMESTAMP, SOL_SOCKET);
1899                         if (*controlp == NULL) {
1900                                 error = ENOBUFS;
1901                                 goto out;
1902                         }
1903                         tv = (struct timeval *)
1904                             CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1905                         microtime(tv);
1906                         break;
1907
1908                 default:
1909                         error = EINVAL;
1910                         goto out;
1911                 }
1912
1913                 controlp = &(*controlp)->m_next;
1914                 if (CMSG_SPACE(datalen) < clen) {
1915                         clen -= CMSG_SPACE(datalen);
1916                         cm = (struct cmsghdr *)
1917                             ((caddr_t)cm + CMSG_SPACE(datalen));
1918                 } else {
1919                         clen = 0;
1920                         cm = NULL;
1921                 }
1922         }
1923
1924 out:
1925         m_freem(control);
1926         return (error);
1927 }
1928
1929 static struct mbuf *
1930 unp_addsockcred(struct thread *td, struct mbuf *control)
1931 {
1932         struct mbuf *m, *n, *n_prev;
1933         struct sockcred *sc;
1934         const struct cmsghdr *cm;
1935         int ngroups;
1936         int i;
1937
1938         ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
1939         m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET);
1940         if (m == NULL)
1941                 return (control);
1942
1943         sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *));
1944         sc->sc_uid = td->td_ucred->cr_ruid;
1945         sc->sc_euid = td->td_ucred->cr_uid;
1946         sc->sc_gid = td->td_ucred->cr_rgid;
1947         sc->sc_egid = td->td_ucred->cr_gid;
1948         sc->sc_ngroups = ngroups;
1949         for (i = 0; i < sc->sc_ngroups; i++)
1950                 sc->sc_groups[i] = td->td_ucred->cr_groups[i];
1951
1952         /*
1953          * Unlink SCM_CREDS control messages (struct cmsgcred), since just
1954          * created SCM_CREDS control message (struct sockcred) has another
1955          * format.
1956          */
1957         if (control != NULL)
1958                 for (n = control, n_prev = NULL; n != NULL;) {
1959                         cm = mtod(n, struct cmsghdr *);
1960                         if (cm->cmsg_level == SOL_SOCKET &&
1961                             cm->cmsg_type == SCM_CREDS) {
1962                                 if (n_prev == NULL)
1963                                         control = n->m_next;
1964                                 else
1965                                         n_prev->m_next = n->m_next;
1966                                 n = m_free(n);
1967                         } else {
1968                                 n_prev = n;
1969                                 n = n->m_next;
1970                         }
1971                 }
1972
1973         /* Prepend it to the head. */
1974         m->m_next = control;
1975         return (m);
1976 }
1977
1978 static struct unpcb *
1979 fptounp(struct file *fp)
1980 {
1981         struct socket *so;
1982
1983         if (fp->f_type != DTYPE_SOCKET)
1984                 return (NULL);
1985         if ((so = fp->f_data) == NULL)
1986                 return (NULL);
1987         if (so->so_proto->pr_domain != &localdomain)
1988                 return (NULL);
1989         return sotounpcb(so);
1990 }
1991
1992 static void
1993 unp_discard(struct file *fp)
1994 {
1995         struct unp_defer *dr;
1996
1997         if (unp_externalize_fp(fp)) {
1998                 dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
1999                 dr->ud_fp = fp;
2000                 UNP_DEFERRED_LOCK();
2001                 SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
2002                 UNP_DEFERRED_UNLOCK();
2003                 atomic_add_int(&unp_defers_count, 1);
2004                 taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
2005         } else
2006                 (void) closef(fp, (struct thread *)NULL);
2007 }
2008
2009 static void
2010 unp_process_defers(void *arg __unused, int pending)
2011 {
2012         struct unp_defer *dr;
2013         SLIST_HEAD(, unp_defer) drl;
2014         int count;
2015
2016         SLIST_INIT(&drl);
2017         for (;;) {
2018                 UNP_DEFERRED_LOCK();
2019                 if (SLIST_FIRST(&unp_defers) == NULL) {
2020                         UNP_DEFERRED_UNLOCK();
2021                         break;
2022                 }
2023                 SLIST_SWAP(&unp_defers, &drl, unp_defer);
2024                 UNP_DEFERRED_UNLOCK();
2025                 count = 0;
2026                 while ((dr = SLIST_FIRST(&drl)) != NULL) {
2027                         SLIST_REMOVE_HEAD(&drl, ud_link);
2028                         closef(dr->ud_fp, NULL);
2029                         free(dr, M_TEMP);
2030                         count++;
2031                 }
2032                 atomic_add_int(&unp_defers_count, -count);
2033         }
2034 }
2035
2036 static void
2037 unp_internalize_fp(struct file *fp)
2038 {
2039         struct unpcb *unp;
2040
2041         UNP_LINK_WLOCK();
2042         if ((unp = fptounp(fp)) != NULL) {
2043                 unp->unp_file = fp;
2044                 unp->unp_msgcount++;
2045         }
2046         fhold(fp);
2047         unp_rights++;
2048         UNP_LINK_WUNLOCK();
2049 }
2050
2051 static int
2052 unp_externalize_fp(struct file *fp)
2053 {
2054         struct unpcb *unp;
2055         int ret;
2056
2057         UNP_LINK_WLOCK();
2058         if ((unp = fptounp(fp)) != NULL) {
2059                 unp->unp_msgcount--;
2060                 ret = 1;
2061         } else
2062                 ret = 0;
2063         unp_rights--;
2064         UNP_LINK_WUNLOCK();
2065         return (ret);
2066 }
2067
2068 /*
2069  * unp_defer indicates whether additional work has been defered for a future
2070  * pass through unp_gc().  It is thread local and does not require explicit
2071  * synchronization.
2072  */
2073 static int      unp_marked;
2074 static int      unp_unreachable;
2075
2076 static void
2077 unp_accessable(struct file *fp)
2078 {
2079         struct unpcb *unp;
2080
2081         if ((unp = fptounp(fp)) == NULL)
2082                 return;
2083         if (unp->unp_gcflag & UNPGC_REF)
2084                 return;
2085         unp->unp_gcflag &= ~UNPGC_DEAD;
2086         unp->unp_gcflag |= UNPGC_REF;
2087         unp_marked++;
2088 }
2089
2090 static void
2091 unp_gc_process(struct unpcb *unp)
2092 {
2093         struct socket *soa;
2094         struct socket *so;
2095         struct file *fp;
2096
2097         /* Already processed. */
2098         if (unp->unp_gcflag & UNPGC_SCANNED)
2099                 return;
2100         fp = unp->unp_file;
2101
2102         /*
2103          * Check for a socket potentially in a cycle.  It must be in a
2104          * queue as indicated by msgcount, and this must equal the file
2105          * reference count.  Note that when msgcount is 0 the file is NULL.
2106          */
2107         if ((unp->unp_gcflag & UNPGC_REF) == 0 && fp &&
2108             unp->unp_msgcount != 0 && fp->f_count == unp->unp_msgcount) {
2109                 unp->unp_gcflag |= UNPGC_DEAD;
2110                 unp_unreachable++;
2111                 return;
2112         }
2113
2114         /*
2115          * Mark all sockets we reference with RIGHTS.
2116          */
2117         so = unp->unp_socket;
2118         SOCKBUF_LOCK(&so->so_rcv);
2119         unp_scan(so->so_rcv.sb_mb, unp_accessable);
2120         SOCKBUF_UNLOCK(&so->so_rcv);
2121
2122         /*
2123          * Mark all sockets in our accept queue.
2124          */
2125         ACCEPT_LOCK();
2126         TAILQ_FOREACH(soa, &so->so_comp, so_list) {
2127                 SOCKBUF_LOCK(&soa->so_rcv);
2128                 unp_scan(soa->so_rcv.sb_mb, unp_accessable);
2129                 SOCKBUF_UNLOCK(&soa->so_rcv);
2130         }
2131         ACCEPT_UNLOCK();
2132         unp->unp_gcflag |= UNPGC_SCANNED;
2133 }
2134
2135 static int unp_recycled;
2136 SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
2137     "Number of unreachable sockets claimed by the garbage collector.");
2138
2139 static int unp_taskcount;
2140 SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
2141     "Number of times the garbage collector has run.");
2142
2143 static void
2144 unp_gc(__unused void *arg, int pending)
2145 {
2146         struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
2147                                     NULL };
2148         struct unp_head **head;
2149         struct file *f, **unref;
2150         struct unpcb *unp;
2151         int i, total;
2152
2153         unp_taskcount++;
2154         UNP_LIST_LOCK();
2155         /*
2156          * First clear all gc flags from previous runs.
2157          */
2158         for (head = heads; *head != NULL; head++)
2159                 LIST_FOREACH(unp, *head, unp_link)
2160                         unp->unp_gcflag = 0;
2161
2162         /*
2163          * Scan marking all reachable sockets with UNPGC_REF.  Once a socket
2164          * is reachable all of the sockets it references are reachable.
2165          * Stop the scan once we do a complete loop without discovering
2166          * a new reachable socket.
2167          */
2168         do {
2169                 unp_unreachable = 0;
2170                 unp_marked = 0;
2171                 for (head = heads; *head != NULL; head++)
2172                         LIST_FOREACH(unp, *head, unp_link)
2173                                 unp_gc_process(unp);
2174         } while (unp_marked);
2175         UNP_LIST_UNLOCK();
2176         if (unp_unreachable == 0)
2177                 return;
2178
2179         /*
2180          * Allocate space for a local list of dead unpcbs.
2181          */
2182         unref = malloc(unp_unreachable * sizeof(struct file *),
2183             M_TEMP, M_WAITOK);
2184
2185         /*
2186          * Iterate looking for sockets which have been specifically marked
2187          * as as unreachable and store them locally.
2188          */
2189         UNP_LINK_RLOCK();
2190         UNP_LIST_LOCK();
2191         for (total = 0, head = heads; *head != NULL; head++)
2192                 LIST_FOREACH(unp, *head, unp_link)
2193                         if ((unp->unp_gcflag & UNPGC_DEAD) != 0) {
2194                                 f = unp->unp_file;
2195                                 if (unp->unp_msgcount == 0 || f == NULL ||
2196                                     f->f_count != unp->unp_msgcount)
2197                                         continue;
2198                                 unref[total++] = f;
2199                                 fhold(f);
2200                                 KASSERT(total <= unp_unreachable,
2201                                     ("unp_gc: incorrect unreachable count."));
2202                         }
2203         UNP_LIST_UNLOCK();
2204         UNP_LINK_RUNLOCK();
2205
2206         /*
2207          * Now flush all sockets, free'ing rights.  This will free the
2208          * struct files associated with these sockets but leave each socket
2209          * with one remaining ref.
2210          */
2211         for (i = 0; i < total; i++) {
2212                 struct socket *so;
2213
2214                 so = unref[i]->f_data;
2215                 CURVNET_SET(so->so_vnet);
2216                 sorflush(so);
2217                 CURVNET_RESTORE();
2218         }
2219
2220         /*
2221          * And finally release the sockets so they can be reclaimed.
2222          */
2223         for (i = 0; i < total; i++)
2224                 fdrop(unref[i], NULL);
2225         unp_recycled += total;
2226         free(unref, M_TEMP);
2227 }
2228
2229 static void
2230 unp_dispose(struct mbuf *m)
2231 {
2232
2233         if (m)
2234                 unp_scan(m, unp_discard);
2235 }
2236
2237 static void
2238 unp_scan(struct mbuf *m0, void (*op)(struct file *))
2239 {
2240         struct mbuf *m;
2241         struct file **rp;
2242         struct cmsghdr *cm;
2243         void *data;
2244         int i;
2245         socklen_t clen, datalen;
2246         int qfds;
2247
2248         while (m0 != NULL) {
2249                 for (m = m0; m; m = m->m_next) {
2250                         if (m->m_type != MT_CONTROL)
2251                                 continue;
2252
2253                         cm = mtod(m, struct cmsghdr *);
2254                         clen = m->m_len;
2255
2256                         while (cm != NULL) {
2257                                 if (sizeof(*cm) > clen || cm->cmsg_len > clen)
2258                                         break;
2259
2260                                 data = CMSG_DATA(cm);
2261                                 datalen = (caddr_t)cm + cm->cmsg_len
2262                                     - (caddr_t)data;
2263
2264                                 if (cm->cmsg_level == SOL_SOCKET &&
2265                                     cm->cmsg_type == SCM_RIGHTS) {
2266                                         qfds = datalen / sizeof (struct file *);
2267                                         rp = data;
2268                                         for (i = 0; i < qfds; i++)
2269                                                 (*op)(*rp++);
2270                                 }
2271
2272                                 if (CMSG_SPACE(datalen) < clen) {
2273                                         clen -= CMSG_SPACE(datalen);
2274                                         cm = (struct cmsghdr *)
2275                                             ((caddr_t)cm + CMSG_SPACE(datalen));
2276                                 } else {
2277                                         clen = 0;
2278                                         cm = NULL;
2279                                 }
2280                         }
2281                 }
2282                 m0 = m0->m_act;
2283         }
2284 }
2285
2286 /*
2287  * A helper function called by VFS before socket-type vnode reclamation.
2288  * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
2289  * use count.
2290  */
2291 void
2292 vfs_unp_reclaim(struct vnode *vp)
2293 {
2294         struct socket *so;
2295         struct unpcb *unp;
2296         int active;
2297
2298         ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
2299         KASSERT(vp->v_type == VSOCK,
2300             ("vfs_unp_reclaim: vp->v_type != VSOCK"));
2301
2302         active = 0;
2303         UNP_LINK_WLOCK();
2304         VOP_UNP_CONNECT(vp, &so);
2305         if (so == NULL)
2306                 goto done;
2307         unp = sotounpcb(so);
2308         if (unp == NULL)
2309                 goto done;
2310         UNP_PCB_LOCK(unp);
2311         if (unp->unp_vnode == vp) {
2312                 VOP_UNP_DETACH(vp);
2313                 unp->unp_vnode = NULL;
2314                 active = 1;
2315         }
2316         UNP_PCB_UNLOCK(unp);
2317 done:
2318         UNP_LINK_WUNLOCK();
2319         if (active)
2320                 vunref(vp);
2321 }
2322
2323 #ifdef DDB
2324 static void
2325 db_print_indent(int indent)
2326 {
2327         int i;
2328
2329         for (i = 0; i < indent; i++)
2330                 db_printf(" ");
2331 }
2332
2333 static void
2334 db_print_unpflags(int unp_flags)
2335 {
2336         int comma;
2337
2338         comma = 0;
2339         if (unp_flags & UNP_HAVEPC) {
2340                 db_printf("%sUNP_HAVEPC", comma ? ", " : "");
2341                 comma = 1;
2342         }
2343         if (unp_flags & UNP_HAVEPCCACHED) {
2344                 db_printf("%sUNP_HAVEPCCACHED", comma ? ", " : "");
2345                 comma = 1;
2346         }
2347         if (unp_flags & UNP_WANTCRED) {
2348                 db_printf("%sUNP_WANTCRED", comma ? ", " : "");
2349                 comma = 1;
2350         }
2351         if (unp_flags & UNP_CONNWAIT) {
2352                 db_printf("%sUNP_CONNWAIT", comma ? ", " : "");
2353                 comma = 1;
2354         }
2355         if (unp_flags & UNP_CONNECTING) {
2356                 db_printf("%sUNP_CONNECTING", comma ? ", " : "");
2357                 comma = 1;
2358         }
2359         if (unp_flags & UNP_BINDING) {
2360                 db_printf("%sUNP_BINDING", comma ? ", " : "");
2361                 comma = 1;
2362         }
2363 }
2364
2365 static void
2366 db_print_xucred(int indent, struct xucred *xu)
2367 {
2368         int comma, i;
2369
2370         db_print_indent(indent);
2371         db_printf("cr_version: %u   cr_uid: %u   cr_ngroups: %d\n",
2372             xu->cr_version, xu->cr_uid, xu->cr_ngroups);
2373         db_print_indent(indent);
2374         db_printf("cr_groups: ");
2375         comma = 0;
2376         for (i = 0; i < xu->cr_ngroups; i++) {
2377                 db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
2378                 comma = 1;
2379         }
2380         db_printf("\n");
2381 }
2382
2383 static void
2384 db_print_unprefs(int indent, struct unp_head *uh)
2385 {
2386         struct unpcb *unp;
2387         int counter;
2388
2389         counter = 0;
2390         LIST_FOREACH(unp, uh, unp_reflink) {
2391                 if (counter % 4 == 0)
2392                         db_print_indent(indent);
2393                 db_printf("%p  ", unp);
2394                 if (counter % 4 == 3)
2395                         db_printf("\n");
2396                 counter++;
2397         }
2398         if (counter != 0 && counter % 4 != 0)
2399                 db_printf("\n");
2400 }
2401
2402 DB_SHOW_COMMAND(unpcb, db_show_unpcb)
2403 {
2404         struct unpcb *unp;
2405
2406         if (!have_addr) {
2407                 db_printf("usage: show unpcb <addr>\n");
2408                 return;
2409         }
2410         unp = (struct unpcb *)addr;
2411
2412         db_printf("unp_socket: %p   unp_vnode: %p\n", unp->unp_socket,
2413             unp->unp_vnode);
2414
2415         db_printf("unp_ino: %ju   unp_conn: %p\n", (uintmax_t)unp->unp_ino,
2416             unp->unp_conn);
2417
2418         db_printf("unp_refs:\n");
2419         db_print_unprefs(2, &unp->unp_refs);
2420
2421         /* XXXRW: Would be nice to print the full address, if any. */
2422         db_printf("unp_addr: %p\n", unp->unp_addr);
2423
2424         db_printf("unp_cc: %d   unp_mbcnt: %d   unp_gencnt: %llu\n",
2425             unp->unp_cc, unp->unp_mbcnt,
2426             (unsigned long long)unp->unp_gencnt);
2427
2428         db_printf("unp_flags: %x (", unp->unp_flags);
2429         db_print_unpflags(unp->unp_flags);
2430         db_printf(")\n");
2431
2432         db_printf("unp_peercred:\n");
2433         db_print_xucred(2, &unp->unp_peercred);
2434
2435         db_printf("unp_refcount: %u\n", unp->unp_refcount);
2436 }
2437 #endif