// SPDX-License-Identifier: GPL-2.0-or-later

/*

* NET4: Implementation of BSD Unix domain sockets.

*

* Authors: Alan Cox, <alan@lxorguk.ukuu.org.uk>

*

* Fixes:

* Linus Torvalds : Assorted bug cures.

* Niibe Yutaka : async I/O support.

* Carsten Paeth : PF_UNIX check, address fixes.

* Alan Cox : Limit size of allocated blocks.

* Alan Cox : Fixed the stupid socketpair bug.

* Alan Cox : BSD compatibility fine tuning.

* Alan Cox : Fixed a bug in connect when interrupted.

* Alan Cox : Sorted out a proper draft version of

* file descriptor passing hacked up from

* Mike Shaver's work.

* Marty Leisner : Fixes to fd passing

* Nick Nevin : recvmsg bugfix.

* Alan Cox : Started proper garbage collector

* Heiko EiBfeldt : Missing verify_area check

* Alan Cox : Started POSIXisms

* Andreas Schwab : Replace inode by dentry for proper

* reference counting

* Kirk Petersen : Made this a module

* Christoph Rohland : Elegant non-blocking accept/connect algorithm.

* Lots of bug fixes.

* Alexey Kuznetosv : Repaired (I hope) bugs introduces

* by above two patches.

* Andrea Arcangeli : If possible we block in connect(2)

* if the max backlog of the listen socket

* is been reached. This won't break

* old apps and it will avoid huge amount

* of socks hashed (this for unix_gc()

* performances reasons).

* Security fix that limits the max

* number of socks to 2*max_files and

* the number of skb queueable in the

* dgram receiver.

* Artur Skawina : Hash function optimizations

* Alexey Kuznetsov : Full scale SMP. Lot of bugs are introduced 8)

* Malcolm Beattie : Set peercred for socketpair

* Michal Ostrowski : Module initialization cleanup.

* Arnaldo C. Melo : Remove MOD_{INC,DEC}_USE_COUNT,

* the core infrastructure is doing that

* for all net proto families now (2.5.69+)

*

* Known differences from reference BSD that was tested:

*

* [TO FIX]

* ECONNREFUSED is not returned from one end of a connected() socket to the

* other the moment one end closes.

* fstat() doesn't return st_dev=0, and give the blksize as high water mark

* and a fake inode identifier (nor the BSD first socket fstat twice bug).

* [NOT TO FIX]

* accept() returns a path name even if the connecting socket has closed

* in the meantime (BSD loses the path and gives up).

* accept() returns 0 length path for an unbound connector. BSD returns 16

* and a null first byte in the path (but not for gethost/peername - BSD bug ??)

* socketpair(...SOCK_RAW..) doesn't panic the kernel.

* BSD af_unix apparently has connect forgetting to block properly.

* (need to check this with the POSIX spec in detail)

*

* Differences from 2.0.0-11-... (ANK)

* Bug fixes and improvements.

* - client shutdown killed server socket.

* - removed all useless cli/sti pairs.

*

* Semantic changes/extensions.

* - generic control message passing.

* - SCM_CREDENTIALS control message.

* - "Abstract" (not FS based) socket bindings.

* Abstract names are sequences of bytes (not zero terminated)

* started by 0, so that this name space does not intersect

* with BSD names.

*/

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/bpf-cgroup.h>

#include <linux/btf_ids.h>

#include <linux/dcache.h>

#include <linux/errno.h>

#include <linux/fcntl.h>

#include <linux/file.h>

#include <linux/filter.h>

#include <linux/fs.h>

#include <linux/fs_struct.h>

#include <linux/init.h>

#include <linux/kernel.h>

#include <linux/mount.h>

#include <linux/namei.h>

#include <linux/net.h>

#include <linux/pidfs.h>

#include <linux/poll.h>

#include <linux/proc_fs.h>

#include <linux/sched/signal.h>

#include <linux/security.h>

#include <linux/seq_file.h>

#include <linux/skbuff.h>

#include <linux/slab.h>

#include <linux/socket.h>

#include <linux/splice.h>

#include <linux/string.h>

#include <linux/uaccess.h>

#include <net/af_unix.h>

#include <net/net_namespace.h>

#include <net/scm.h>

#include <net/tcp_states.h>

#include <uapi/linux/sockios.h>

#include <uapi/linux/termios.h>

#include "af_unix.h"

static atomic_long_t unix_nr_socks;

static struct hlist_head bsd_socket_buckets[UNIX_HASH_SIZE / 2];

static spinlock_t bsd_socket_locks[UNIX_HASH_SIZE / 2];

/* SMP locking strategy:

* hash table is protected with spinlock.

* each socket state is protected by separate spinlock.

*/

#ifdef CONFIG_PROVE_LOCKING

#define cmp_ptr(l, r) (((l) > (r)) - ((l) < (r)))

static int unix_table_lock_cmp_fn(const struct lockdep_map *a,

const struct lockdep_map *b)

{

return cmp_ptr(a, b);

}

static int unix_state_lock_cmp_fn(const struct lockdep_map *_a,

const struct lockdep_map *_b)

{

const struct unix_sock *a, *b;

a = container_of(_a, struct unix_sock, lock.dep_map);

b = container_of(_b, struct unix_sock, lock.dep_map);

if (a->sk.sk_state == TCP_LISTEN) {

/* unix_stream_connect(): Before the 2nd unix_state_lock(),

*

* 1. a is TCP_LISTEN.

* 2. b is not a.

* 3. concurrent connect(b -> a) must fail.

*

* Except for 2. & 3., the b's state can be any possible

* value due to concurrent connect() or listen().

*

* 2. is detected in debug_spin_lock_before(), and 3. cannot

* be expressed as lock_cmp_fn.

*/

switch (b->sk.sk_state) {

case TCP_CLOSE:

case TCP_ESTABLISHED:

case TCP_LISTEN:

return -1;

default:

/* Invalid case. */

return 0;

}

}

/* Should never happen. Just to be symmetric. */

if (b->sk.sk_state == TCP_LISTEN) {

switch (b->sk.sk_state) {

case TCP_CLOSE:

case TCP_ESTABLISHED:

return 1;

default:

return 0;

}

}

/* unix_state_double_lock(): ascending address order. */

return cmp_ptr(a, b);

}

static int unix_recvq_lock_cmp_fn(const struct lockdep_map *_a,

const struct lockdep_map *_b)

{

const struct sock *a, *b;

a = container_of(_a, struct sock, sk_receive_queue.lock.dep_map);

b = container_of(_b, struct sock, sk_receive_queue.lock.dep_map);

/* unix_collect_skb(): listener -> embryo order. */

if (a->sk_state == TCP_LISTEN && unix_sk(b)->listener == a)

return -1;

/* Should never happen. Just to be symmetric. */

if (b->sk_state == TCP_LISTEN && unix_sk(a)->listener == b)

return 1;

return 0;

}

#endif

static unsigned int unix_unbound_hash(struct sock *sk)

{

unsigned long hash = (unsigned long)sk;

hash ^= hash >> 16;

hash ^= hash >> 8;

hash ^= sk->sk_type;

return hash & UNIX_HASH_MOD;

}

static unsigned int unix_bsd_hash(struct inode *i)

{

return i->i_ino & UNIX_HASH_MOD;

}

static unsigned int unix_abstract_hash(struct sockaddr_un *sunaddr,

int addr_len, int type)

{

__wsum csum = csum_partial(sunaddr, addr_len, 0);

unsigned int hash;

hash = (__force unsigned int)csum_fold(csum);

hash ^= hash >> 8;

hash ^= type;

return UNIX_HASH_MOD + 1 + (hash & UNIX_HASH_MOD);

}

static void unix_table_double_lock(struct net *net,

unsigned int hash1, unsigned int hash2)

{

if (hash1 == hash2) {

spin_lock(&net->unx.table.locks[hash1]);

return;

}

if (hash1 > hash2)

swap(hash1, hash2);

spin_lock(&net->unx.table.locks[hash1]);

spin_lock(&net->unx.table.locks[hash2]);

}

static void unix_table_double_unlock(struct net *net,

unsigned int hash1, unsigned int hash2)

{

if (hash1 == hash2) {

spin_unlock(&net->unx.table.locks[hash1]);

return;

}

spin_unlock(&net->unx.table.locks[hash1]);

spin_unlock(&net->unx.table.locks[hash2]);

}

#ifdef CONFIG_SECURITY_NETWORK

static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)

{

UNIXCB(skb).secid = scm->secid;

}

static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)

{

scm->secid = UNIXCB(skb).secid;

}

static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb)

{

return (scm->secid == UNIXCB(skb).secid);

}

#else

static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)

{ }

static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)

{ }

static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb)

{

return true;

}

#endif /* CONFIG_SECURITY_NETWORK */

static inline int unix_may_send(struct sock *sk, struct sock *osk)

{

return !unix_peer(osk) || unix_peer(osk) == sk;

}

static inline int unix_recvq_full_lockless(const struct sock *sk)

{

return skb_queue_len_lockless(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;

}

struct sock *unix_peer_get(struct sock *s)

{

struct sock *peer;

unix_state_lock(s);

peer = unix_peer(s);

if (peer)

sock_hold(peer);

unix_state_unlock(s);

return peer;

}

EXPORT_SYMBOL_GPL(unix_peer_get);

static struct unix_address *unix_create_addr(struct sockaddr_un *sunaddr,

int addr_len)

{

struct unix_address *addr;

addr = kmalloc(sizeof(*addr) + addr_len, GFP_KERNEL);

if (!addr)

return NULL;

refcount_set(&addr->refcnt, 1);

addr->len = addr_len;

memcpy(addr->name, sunaddr, addr_len);

return addr;

}

static inline void unix_release_addr(struct unix_address *addr)

{

if (refcount_dec_and_test(&addr->refcnt))

kfree(addr);

}

/*

* Check unix socket name:

* - should be not zero length.

* - if started by not zero, should be NULL terminated (FS object)

* - if started by zero, it is abstract name.

*/

static int unix_validate_addr(struct sockaddr_un *sunaddr, int addr_len)

{

if (addr_len <= offsetof(struct sockaddr_un, sun_path) ||

addr_len > sizeof(*sunaddr))

return -EINVAL;

if (sunaddr->sun_family != AF_UNIX)

return -EINVAL;

return 0;

}

static int unix_mkname_bsd(struct sockaddr_un *sunaddr, int addr_len)

{

struct sockaddr_storage *addr = (struct sockaddr_storage *)sunaddr;

short offset = offsetof(struct sockaddr_storage, __data);

BUILD_BUG_ON(offset != offsetof(struct sockaddr_un, sun_path));

/* This may look like an off by one error but it is a bit more

* subtle. 108 is the longest valid AF_UNIX path for a binding.

* sun_path[108] doesn't as such exist. However in kernel space

* we are guaranteed that it is a valid memory location in our

* kernel address buffer because syscall functions always pass

* a pointer of struct sockaddr_storage which has a bigger buffer

* than 108. Also, we must terminate sun_path for strlen() in

* getname_kernel().

*/

addr->__data[addr_len - offset] = 0;

/* Don't pass sunaddr->sun_path to strlen(). Otherwise, 108 will

* cause panic if CONFIG_FORTIFY_SOURCE=y. Let __fortify_strlen()

* know the actual buffer.

*/

return strlen(addr->__data) + offset + 1;

}

static void __unix_remove_socket(struct sock *sk)

{

sk_del_node_init(sk);

}

static void __unix_insert_socket(struct net *net, struct sock *sk)

{

DEBUG_NET_WARN_ON_ONCE(!sk_unhashed(sk));

sk_add_node(sk, &net->unx.table.buckets[sk->sk_hash]);

}

static void __unix_set_addr_hash(struct net *net, struct sock *sk,

struct unix_address *addr, unsigned int hash)

{

__unix_remove_socket(sk);

smp_store_release(&unix_sk(sk)->addr, addr);

sk->sk_hash = hash;

__unix_insert_socket(net, sk);

}

static void unix_remove_socket(struct net *net, struct sock *sk)

{

spin_lock(&net->unx.table.locks[sk->sk_hash]);

__unix_remove_socket(sk);

spin_unlock(&net->unx.table.locks[sk->sk_hash]);

}

static void unix_insert_unbound_socket(struct net *net, struct sock *sk)

{

spin_lock(&net->unx.table.locks[sk->sk_hash]);

__unix_insert_socket(net, sk);

spin_unlock(&net->unx.table.locks[sk->sk_hash]);

}

static void unix_insert_bsd_socket(struct sock *sk)

{

spin_lock(&bsd_socket_locks[sk->sk_hash]);

sk_add_bind_node(sk, &bsd_socket_buckets[sk->sk_hash]);

spin_unlock(&bsd_socket_locks[sk->sk_hash]);

}

static void unix_remove_bsd_socket(struct sock *sk)

{

if (!hlist_unhashed(&sk->sk_bind_node)) {

spin_lock(&bsd_socket_locks[sk->sk_hash]);

__sk_del_bind_node(sk);

spin_unlock(&bsd_socket_locks[sk->sk_hash]);

sk_node_init(&sk->sk_bind_node);

}

}

static struct sock *__unix_find_socket_byname(struct net *net,

struct sockaddr_un *sunname,

int len, unsigned int hash)

{

struct sock *s;

sk_for_each(s, &net->unx.table.buckets[hash]) {

struct unix_sock *u = unix_sk(s);

if (u->addr->len == len &&

!memcmp(u->addr->name, sunname, len))

return s;

}

return NULL;

}

static inline struct sock *unix_find_socket_byname(struct net *net,

struct sockaddr_un *sunname,

int len, unsigned int hash)

{

struct sock *s;

spin_lock(&net->unx.table.locks[hash]);

s = __unix_find_socket_byname(net, sunname, len, hash);

if (s)

sock_hold(s);

spin_unlock(&net->unx.table.locks[hash]);

return s;

}

static struct sock *unix_find_socket_byinode(struct inode *i)

{

unsigned int hash = unix_bsd_hash(i);

struct sock *s;

spin_lock(&bsd_socket_locks[hash]);

sk_for_each_bound(s, &bsd_socket_buckets[hash]) {

struct dentry *dentry = unix_sk(s)->path.dentry;

if (dentry && d_backing_inode(dentry) == i) {

sock_hold(s);

spin_unlock(&bsd_socket_locks[hash]);

return s;

}

}

spin_unlock(&bsd_socket_locks[hash]);

return NULL;

}

/* Support code for asymmetrically connected dgram sockets

*

* If a datagram socket is connected to a socket not itself connected

* to the first socket (eg, /dev/log), clients may only enqueue more

* messages if the present receive queue of the server socket is not

* "too large". This means there's a second writeability condition

* poll and sendmsg need to test. The dgram recv code will do a wake

* up on the peer_wait wait queue of a socket upon reception of a

* datagram which needs to be propagated to sleeping would-be writers

* since these might not have sent anything so far. This can't be

* accomplished via poll_wait because the lifetime of the server

* socket might be less than that of its clients if these break their

* association with it or if the server socket is closed while clients

* are still connected to it and there's no way to inform "a polling

* implementation" that it should let go of a certain wait queue

*

* In order to propagate a wake up, a wait_queue_entry_t of the client

* socket is enqueued on the peer_wait queue of the server socket

* whose wake function does a wake_up on the ordinary client socket

* wait queue. This connection is established whenever a write (or

* poll for write) hit the flow control condition and broken when the

* association to the server socket is dissolved or after a wake up

* was relayed.

*/

static int unix_dgram_peer_wake_relay(wait_queue_entry_t *q, unsigned mode, int flags,

void *key)

{

struct unix_sock *u;

wait_queue_head_t *u_sleep;

u = container_of(q, struct unix_sock, peer_wake);

__remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait,

q);

u->peer_wake.private = NULL;

/* relaying can only happen while the wq still exists */

u_sleep = sk_sleep(&u->sk);

if (u_sleep)

wake_up_interruptible_poll(u_sleep, key_to_poll(key));

return 0;

}

static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other)

{

struct unix_sock *u, *u_other;

int rc;

u = unix_sk(sk);

u_other = unix_sk(other);

rc = 0;

spin_lock(&u_other->peer_wait.lock);

if (!u->peer_wake.private) {

u->peer_wake.private = other;

__add_wait_queue(&u_other->peer_wait, &u->peer_wake);

rc = 1;

}

spin_unlock(&u_other->peer_wait.lock);

return rc;

}

static void unix_dgram_peer_wake_disconnect(struct sock *sk,

struct sock *other)

{

struct unix_sock *u, *u_other;

u = unix_sk(sk);

u_other = unix_sk(other);

spin_lock(&u_other->peer_wait.lock);

if (u->peer_wake.private == other) {

__remove_wait_queue(&u_other->peer_wait, &u->peer_wake);

u->peer_wake.private = NULL;

}

spin_unlock(&u_other->peer_wait.lock);

}

static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk,

struct sock *other)

{

unix_dgram_peer_wake_disconnect(sk, other);

wake_up_interruptible_poll(sk_sleep(sk),

EPOLLOUT |

EPOLLWRNORM |

EPOLLWRBAND);

}

/* preconditions:

* - unix_peer(sk) == other

* - association is stable

*/

static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)

{

int connected;

connected = unix_dgram_peer_wake_connect(sk, other);

/* If other is SOCK_DEAD, we want to make sure we signal

* POLLOUT, such that a subsequent write() can get a

* -ECONNREFUSED. Otherwise, if we haven't queued any skbs

* to other and its full, we will hang waiting for POLLOUT.

*/

if (unix_recvq_full_lockless(other) && !sock_flag(other, SOCK_DEAD))

return 1;

if (connected)

unix_dgram_peer_wake_disconnect(sk, other);

return 0;

}

static int unix_writable(const struct sock *sk, unsigned char state)

{

return state != TCP_LISTEN &&

(refcount_read(&sk->sk_wmem_alloc) << 2) <= READ_ONCE(sk->sk_sndbuf);

}

static void unix_write_space(struct sock *sk)

{

struct socket_wq *wq;

rcu_read_lock();

if (unix_writable(sk, READ_ONCE(sk->sk_state))) {

wq = rcu_dereference(sk->sk_wq);

if (skwq_has_sleeper(wq))

wake_up_interruptible_sync_poll(&wq->wait,

EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND);

sk_wake_async_rcu(sk, SOCK_WAKE_SPACE, POLL_OUT);

}

rcu_read_unlock();

}

/* When dgram socket disconnects (or changes its peer), we clear its receive

* queue of packets arrived from previous peer. First, it allows to do

* flow control based only on wmem_alloc; second, sk connected to peer

* may receive messages only from that peer. */

static void unix_dgram_disconnected(struct sock *sk, struct sock *other)

{

if (!skb_queue_empty(&sk->sk_receive_queue)) {

skb_queue_purge_reason(&sk->sk_receive_queue,

SKB_DROP_REASON_UNIX_DISCONNECT);

wake_up_interruptible_all(&unix_sk(sk)->peer_wait);

/* If one link of bidirectional dgram pipe is disconnected,

* we signal error. Messages are lost. Do not make this,

* when peer was not connected to us.

*/

if (!sock_flag(other, SOCK_DEAD) && unix_peer(other) == sk) {

WRITE_ONCE(other->sk_err, ECONNRESET);

sk_error_report(other);

}

}

}

static void unix_sock_destructor(struct sock *sk)

{

struct unix_sock *u = unix_sk(sk);

skb_queue_purge_reason(&sk->sk_receive_queue, SKB_DROP_REASON_SOCKET_CLOSE);

DEBUG_NET_WARN_ON_ONCE(refcount_read(&sk->sk_wmem_alloc));

DEBUG_NET_WARN_ON_ONCE(!sk_unhashed(sk));

DEBUG_NET_WARN_ON_ONCE(sk->sk_socket);

if (!sock_flag(sk, SOCK_DEAD)) {

pr_info("Attempt to release alive unix socket: %p\n", sk);

return;

}

if (u->addr)

unix_release_addr(u->addr);

atomic_long_dec(&unix_nr_socks);

sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);

#ifdef UNIX_REFCNT_DEBUG

pr_debug("UNIX %p is destroyed, %ld are still alive.\n", sk,

atomic_long_read(&unix_nr_socks));

#endif

}

static unsigned int unix_skb_len(const struct sk_buff *skb)

{

return skb->len - UNIXCB(skb).consumed;

}

static void unix_release_sock(struct sock *sk, int embrion)

{

struct unix_sock *u = unix_sk(sk);

struct sock *skpair;

struct sk_buff *skb;

struct path path;

int state;

unix_remove_socket(sock_net(sk), sk);

unix_remove_bsd_socket(sk);

/* Clear state */

unix_state_lock(sk);

sock_orphan(sk);

WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);

path = u->path;

u->path.dentry = NULL;

u->path.mnt = NULL;

state = sk->sk_state;

WRITE_ONCE(sk->sk_state, TCP_CLOSE);

skpair = unix_peer(sk);

unix_peer(sk) = NULL;

unix_state_unlock(sk);

#if IS_ENABLED(CONFIG_AF_UNIX_OOB)

u->oob_skb = NULL;

#endif

wake_up_interruptible_all(&u->peer_wait);

if (skpair != NULL) {

if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {

struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);

#if IS_ENABLED(CONFIG_AF_UNIX_OOB)

if (skb && !unix_skb_len(skb))

skb = skb_peek_next(skb, &sk->sk_receive_queue);

#endif

unix_state_lock(skpair);

/* No more writes */

WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK);

if (skb || embrion)

WRITE_ONCE(skpair->sk_err, ECONNRESET);

unix_state_unlock(skpair);

skpair->sk_state_change(skpair);

sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);

}

unix_dgram_peer_wake_disconnect(sk, skpair);

sock_put(skpair); /* It may now die */

}

/* Try to flush out this socket. Throw out buffers at least */

while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {

if (state == TCP_LISTEN)

unix_release_sock(skb->sk, 1);

/* passed fds are erased in the kfree_skb hook */

kfree_skb_reason(skb, SKB_DROP_REASON_SOCKET_CLOSE);

}

if (path.dentry)

path_put(&path);

sock_put(sk);

/* ---- Socket is dead now and most probably destroyed ---- */

unix_schedule_gc(NULL);

}

struct unix_peercred {

struct pid *peer_pid;

const struct cred *peer_cred;

};

static inline int prepare_peercred(struct unix_peercred *peercred)

{

struct pid *pid;

int err;

pid = task_tgid(current);

err = pidfs_register_pid(pid);

if (likely(!err)) {

peercred->peer_pid = get_pid(pid);

peercred->peer_cred = get_current_cred();

}

return err;

}

static void drop_peercred(struct unix_peercred *peercred)

{

const struct cred *cred = NULL;

struct pid *pid = NULL;

might_sleep();

swap(peercred->peer_pid, pid);

swap(peercred->peer_cred, cred);

put_pid(pid);

put_cred(cred);

}

static inline void init_peercred(struct sock *sk,

const struct unix_peercred *peercred)

{

sk->sk_peer_pid = peercred->peer_pid;

sk->sk_peer_cred = peercred->peer_cred;

}

static void update_peercred(struct sock *sk, struct unix_peercred *peercred)

{

const struct cred *old_cred;

struct pid *old_pid;

spin_lock(&sk->sk_peer_lock);

old_pid = sk->sk_peer_pid;

old_cred = sk->sk_peer_cred;

init_peercred(sk, peercred);

spin_unlock(&sk->sk_peer_lock);

peercred->peer_pid = old_pid;

peercred->peer_cred = old_cred;

}

static void copy_peercred(struct sock *sk, struct sock *peersk)

{

lockdep_assert_held(&unix_sk(peersk)->lock);

spin_lock(&sk->sk_peer_lock);

sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);

sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);

spin_unlock(&sk->sk_peer_lock);

}

static bool unix_may_passcred(const struct sock *sk)

{

return sk->sk_scm_credentials || sk->sk_scm_pidfd;

}

static int unix_listen(struct socket *sock, int backlog)

{

int err;

struct sock *sk = sock->sk;

struct unix_sock *u = unix_sk(sk);

struct unix_peercred peercred = {};

err = -EOPNOTSUPP;

if (sock->type != SOCK_STREAM && sock->type != SOCK_SEQPACKET)

goto out; /* Only stream/seqpacket sockets accept */

err = -EINVAL;

if (!READ_ONCE(u->addr))

goto out; /* No listens on an unbound socket */

err = prepare_peercred(&peercred);

if (err)

goto out;

unix_state_lock(sk);

if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)

goto out_unlock;

if (backlog > sk->sk_max_ack_backlog)

wake_up_interruptible_all(&u->peer_wait);

sk->sk_max_ack_backlog = backlog;

WRITE_ONCE(sk->sk_state, TCP_LISTEN);

/* set credentials so connect can copy them */

update_peercred(sk, &peercred);

err = 0;

out_unlock:

unix_state_unlock(sk);

drop_peercred(&peercred);

out:

return err;

}

static int unix_release(struct socket *);

static int unix_bind(struct socket *, struct sockaddr_unsized *, int);

static int unix_stream_connect(struct socket *, struct sockaddr_unsized *,

int addr_len, int flags);

static int unix_socketpair(struct socket *, struct socket *);

static int unix_accept(struct socket *, struct socket *, struct proto_accept_arg *arg);

static int unix_getname(struct socket *, struct sockaddr *, int);

static __poll_t unix_poll(struct file *, struct socket *, poll_table *);

static __poll_t unix_dgram_poll(struct file *, struct socket *,

poll_table *);

static int unix_ioctl(struct socket *, unsigned int, unsigned long);

#ifdef CONFIG_COMPAT

static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);

#endif

static int unix_shutdown(struct socket *, int);

static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);

static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int);

static ssize_t unix_stream_splice_read(struct socket *, loff_t *ppos,

struct pipe_inode_info *, size_t size,

unsigned int flags);

static int unix_dgram_sendmsg(struct socket *, struct msghdr *, size_t);

static int unix_dgram_recvmsg(struct socket *, struct msghdr *, size_t, int);

static int unix_read_skb(struct sock *sk, skb_read_actor_t recv_actor);

static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor);

static int unix_dgram_connect(struct socket *, struct sockaddr_unsized *,

int, int);

static int unix_seqpacket_sendmsg(struct socket *, struct msghdr *, size_t);

static int unix_seqpacket_recvmsg(struct socket *, struct msghdr *, size_t,

int);

#ifdef CONFIG_PROC_FS

static int unix_count_nr_fds(struct sock *sk)

{

struct sk_buff *skb;

struct unix_sock *u;

int nr_fds = 0;

spin_lock(&sk->sk_receive_queue.lock);

skb = skb_peek(&sk->sk_receive_queue);

while (skb) {

u = unix_sk(skb->sk);

nr_fds += atomic_read(&u->scm_stat.nr_fds);

skb = skb_peek_next(skb, &sk->sk_receive_queue);

}

spin_unlock(&sk->sk_receive_queue.lock);

return nr_fds;

}

static void unix_show_fdinfo(struct seq_file *m, struct socket *sock)

{

struct sock *sk = sock->sk;

unsigned char s_state;

struct unix_sock *u;

int nr_fds = 0;

if (sk) {

s_state = READ_ONCE(sk->sk_state);

u = unix_sk(sk);

/* SOCK_STREAM and SOCK_SEQPACKET sockets never change their

* sk_state after switching to TCP_ESTABLISHED or TCP_LISTEN.

* SOCK_DGRAM is ordinary. So, no lock is needed.

*/

if (sock->type == SOCK_DGRAM || s_state == TCP_ESTABLISHED)

nr_fds = atomic_read(&u->scm_stat.nr_fds);

else if (s_state == TCP_LISTEN)

nr_fds = unix_count_nr_fds(sk);

seq_printf(m, "scm_fds: %u\n", nr_fds);

}

}

#else

#define unix_show_fdinfo NULL

#endif

static bool unix_custom_sockopt(int optname)

{

switch (optname) {

case SO_INQ:

return true;

default:

return false;

}

}

static int unix_setsockopt(struct socket *sock, int level, int optname,

sockptr_t optval, unsigned int optlen)

{

struct unix_sock *u = unix_sk(sock->sk);

struct sock *sk = sock->sk;

int val;

if (level != SOL_SOCKET)

return -EOPNOTSUPP;

if (!unix_custom_sockopt(optname))

return sock_setsockopt(sock, level, optname, optval, optlen);

if (optlen != sizeof(int))

return -EINVAL;

if (copy_from_sockptr(&val, optval, sizeof(val)))

return -EFAULT;

switch (optname) {

case SO_INQ:

if (sk->sk_type != SOCK_STREAM)

return -EINVAL;

if (val > 1 || val < 0)

return -EINVAL;

WRITE_ONCE(u->recvmsg_inq, val);

break;

default:

return -ENOPROTOOPT;

}

return 0;

}

static const struct proto_ops unix_stream_ops = {

.family = PF_UNIX,

.owner = THIS_MODULE,

.release = unix_release,

.bind = unix_bind,

.connect = unix_stream_connect,

.socketpair = unix_socketpair,

.accept = unix_accept,

.getname = unix_getname,

.poll = unix_poll,

.ioctl = unix_ioctl,

#ifdef CONFIG_COMPAT

.compat_ioctl = unix_compat_ioctl,

#endif

.listen = unix_listen,

.shutdown = unix_shutdown,

.setsockopt = unix_setsockopt,

.sendmsg = unix_stream_sendmsg,

.recvmsg = unix_stream_recvmsg,

.read_skb = unix_stream_read_skb,

.mmap = sock_no_mmap,

.splice_read = unix_stream_splice_read,

.set_peek_off = sk_set_peek_off,

.show_fdinfo = unix_show_fdinfo,

};

static const struct proto_ops unix_dgram_ops = {

.family = PF_UNIX,

.owner = THIS_MODULE,

.release = unix_release,

.bind = unix_bind,

.connect = unix_dgram_connect,

.socketpair = unix_socketpair,

.accept = sock_no_accept,

.getname = unix_getname,