The unreliability of AF_UNIX datagram sockets

[Ken Brown]

On 5/3/2021 11:45 AM, Corinna Vinschen wrote:
> On May  3 12:30, Corinna Vinschen wrote:
>> 1. As you noticed, the socket descriptors are inherited by exec'ed
>>     children, but the mqueue isn't.  So we need at least some kind of
>>     fixup_after_exec for mqueues used as part of AF_UNIX sockets.
>>
>> 2. While none of the mqueue structures are propagated to child
>>     processes, the handles to the synchronization objects accidentally
>>     are.
>>
>> 3. Note 1 and 2 can only be implemented, if we introduce a new
>>     superstructure keeping track of all mdq_t/mq_info structure
>>     pointers in an application.  Oh well.  Bummer, I was SOO happy
>>     that the posix_ipc stuff didn't need it yet...
>>
>> 4. As stated in the code comment leading the mqueue implementation,
>>     I used Stevens code as the basis.  What I didn't realize so far is
>>     that Stevens simplified the implementation in some ways.  The code
>>     works for real POSIX mqueues, but needs some more fixing before it
>>     can be used for AF_UNIX at all.
>>
>> 5. I hacked a bit on an mq-only mmap call, which is supposed to allow
>>     creating/opening of named shared memeory areas, but that's a tricky
>>     extension to the mmap scenario.  I have a gut feeling that it's
>>     better to avoid using mmap at all and use Windows section mapping
>>     directly in mq_open/mq_close, especially if we have to implement
>>     fixup_after_exec semantics anyway.
>>
>> 6. Ultimately, AF_UNIX sockets should not run file-backed at all,
>>     anyway.  Given that sockets can't be bound multiple times, there's
>>     no persistency requirement for the mqueue.
> 
> Got it:
> 
> 7. The idea of _mq_recv partial reads is entirely broken.  Given that
>     the information in the queue consists of header info plus payload,
>     the entire block has to be read, and then a new block with fixed
>     header and shortened payload has to be rewritten with bumped priority.
>     This in turn can only be performed by the AF_UNIX code, unless we
>     expect knowledge of the AF_UNIX packet layout in the mqueue code.

The partial read is actually OK as is, since it's comparable to what happens on 
a partial read from a pipe.  I already have AF_UNIX code (on the topic/af_unix 
branch) that deals with that.  A boolean variable _unread keeps track of whether 
there's unread data from a previous partial read.  If so, the next read just 
reads data without expecting a header.

Ken