Florent Parent writes:
> 'struct proc' member in the struct sockopt can be NULL. As per the comment 
> in that structure, NULL means that the calling entity is the kernel, not a 
> user process (my interpretation):
> 
> struct sockopt {
>       enum    sopt_dir sopt_dir; /* is this a get or a set? */
>       int     sopt_level;     /* second arg of [gs]etsockopt */
>       int     sopt_name;      /* third arg of [gs]etsockopt */
>       void   *sopt_val;       /* fourth arg of [gs]etsockopt */
>       size_t  sopt_valsize;   /* (almost) fifth arg of [gs]etsockopt */
>       struct  proc *sopt_p;   /* calling process or null if kernel */
> };
> 
> This doesn't apply to socreate() since it isn't passed a 'struct sockopt' 
> as argument. From a quick glance, the socket functions that are concerned 
> are sosetopt() and sogetopt().

But socreate() does take a struct proc directly... perhaps
it can be NULL too..?

[ looks at code ... ]

Nope, it doesn't appear that it can... 

> int
> socreate(dom, aso, type, proto, p)
>       int dom;
>       struct socket **aso;
>       register int type;
>       int proto;
>       struct proc *p;
> {
>       register struct protosw *prp;
>       register struct socket *so;
>       register int error;
> 
>       if (proto)
>               prp = pffindproto(dom, proto, type);
>       else
>               prp = pffindtype(dom, type);
> 
>       if (prp == 0 || prp->pr_usrreqs->pru_attach == 0)
>               return (EPROTONOSUPPORT);
> 
>       if (p->p_prison && jail_socket_unixiproute_only &&
>           prp->pr_domain->dom_family != PF_LOCAL &&
>           prp->pr_domain->dom_family != PF_INET &&
>           prp->pr_domain->dom_family != PF_ROUTE) {
>               return (EPROTONOSUPPORT);
>       }
> 
>       if (prp->pr_type != type)
>               return (EPROTOTYPE);
>       so = soalloc(p != 0);
>       if (so == 0)
>               return (ENOBUFS);
> 
>       TAILQ_INIT(&so->so_incomp);
>       TAILQ_INIT(&so->so_comp);
>       so->so_type = type;
>       so->so_cred = p->p_ucred;
>       crhold(so->so_cred);
>       so->so_proto = prp;
>       error = (*prp->pr_usrreqs->pru_attach)(so, proto, p);
>       if (error) {
>               so->so_state |= SS_NOFDREF;
>               sofree(so);
>               return (error);
>       }
>       *aso = so;
>       return (0);
> }

But it's interesting the soalloc() is called with 'p != 0'
as an argument. p is never 0 or else you would have already
panic'd... you'd panic later on, too, referencing 'p->p_ucred'.

-Archie

__________________________________________________________________________
Archie Cobbs     *     Packet Design     *     http://www.packetdesign.com

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message

Reply via email to