| Age | Commit message (Collapse) | Author |
|
It used to be used by COMPAT_IRIX for the purpose of overriding
uvm_fault (only implemented in MIPS), now removed.
Ride 8.99.12 version bump.
|
|
XXX: pullup-8
|
|
sys_pipe2() returns two integers (values), the 2nd one is a copy of the 2nd
file descriptor that lands in fildes[2]. This is a side effect of reusing
the code for sys_pipe() (SYS_pipe) and not cleaning it up.
The first returned value is (on success) 0.
Introduced a small refactoring in pipe1() that it does not operate over
retval[], but on an array int[2]. A user sets retval[] for pipe() when
desired and needed.
This refactoring touches compat code: netbsd32, linux, linux32.
Before the changes on NetBSD/amd64:
$ ktruss -i ./a.out
[...]
15131 1 a.out pipe2(0x7f7fff2e62b8, 0) = 0, 4
[...]
After the changes:
$ ktruss -i ./a.out
[...]
782 1 a.out pipe2(0x7f7fff97e850, 0) = 0
[...]
There should not be a visible change for current users.
Sponsored by <The NetBSD Foundation>
|
|
enabled by default.
While here make it possible to enable this if already enabled, or disable
if already disabled, without error. Some minor KNF.
|
|
compat modules back to enabled, stop forcing it to switch back to
disabled any time the module is init'd (which is truly barbaric behaviour.)
|
|
is somewhat sensible, breaking functionality of GENERIC is not and has
been objected to on a regular base.
|
|
|
|
|
|
extend the uint64_t's when building it, so we're leaking 48 bits of kernel
stack to userland.
Having said that, it appears that I unintentionally fixed most of this
issue in locore.S::rev1.127 - by building the frame with interrupts
disabled, we are implicitly guaranteeing that the structure doesn't get
overwritten by the kernel. Which means, we are leaking to userland data
that comes from userland anyway.
(still other places with this issue, but I'll fix them differently)
|
|
way segment registers work on amd64 will diverge between 32bit and 64bit
LWPs.
|
|
right now, but will be in the future.
|
|
sysctl, like compat_linux.
|
|
mitigation against similar bugs.
The operations on segment registers can generate a page fault if there is
an issue when touching the in-memory gdt. Theoretically, it is never
supposed to happen, since the gdt is mapped correctly. However, in the
kernel we allow the gdt to be resized, and to do that, we allocate the
maximum amount of va needed by it, but only kenter a few pages until we
need more. Moreover, to avoid reloading the gdt each time we grow it, the
'size' field of gdtr is set to the maximum value. All of this means that
if a mov or iretq is done with a segment register whose index hits a page
that has not been kentered, a page fault is sent.
Such a page fault, if received in kernel mode, does not trigger a swapgs
on amd64; in other words, the kernel would be re-entered with the userland
tls.
And there just happens to be a place in compat_linux32 where the index of
%cs is controlled by userland, making it easy to trigger the page fault
and get kernel privileges.
The mitigation simply consists in abandoning the gdt_grow mechanism and
allocating/kentering the maximum size right away, in such a way that no
page fault can be triggered because of segment registers.
|
|
Controllable via puffs from userland.
From Ilja Van Sprundel.
|
|
|
|
|
|
|
|
- Provide if_release for consistency to if_acquire
- Use if_acquire and if_release for ifp iterations
- Make ifnet_psref_class static
|
|
|
|
|
|
|
|
|
|
|
|
|
|
reclen test prevents overflow.
|
|
|
|
|
|
|
|
zero is hugely flawed. It is easy to demonstrate that one can trick UVM
into chosing a NULL hint after the user_va0_disable check from uvm_map.
Such a bypass allows kernel NULL pointer dereferences to be exploitable on
architectures with a shared userland<->kernel VA, like amd64.
Fix this by increasing the limit of the vm space made available for
userland processes. This way, UVM will never chose a NULL hint, since it
would be outside of the vm space.
The user_va0_disable sysctl still controls this feature.
|
|
This change makes struct ifaddr and its variants (in_ifaddr and in6_ifaddr)
MP-safe by using pserialize and psref. At this moment, pserialize_perform
and psref_target_destroy are disabled because (1) we don't need them
because of softnet_lock (2) they cause a deadlock because of softnet_lock.
So we'll enable them when we remove softnet_lock in the future.
|
|
As usual, we leave the old list to avoid breaking kvm(3) users.
|
|
|
|
|
|
|
|
The change ensures that ifnet objects in the ifnet list aren't freed during
list iterations by using pserialize(9) and psref(9).
Note that the change adds a pslist(9) for ifnet but doesn't remove the
original ifnet list (ifnet_list) to avoid breaking kvm(3) users. We
shouldn't use the original list in the kernel anymore.
|
|
|
|
Found by Brainy.
|
|
padding between a_v and a_type contains kernel garbage, therefore
exposed to userland.
Original report by uebayasi@
|
|
|
|
|
|
|
|
|
|
|
|
The tweaks make the code intention clear and make further changes easy.
No functional change.
|
|
|
|
|
|
|
|
|
|
exec_elf32 works on 32bit systems only, and will crash 32bit binaries on
64bit systems.
2) Now that exec_elf32 is dormant, we can give the native ELF loaders the
highest priority.
Binaries will load faster now (system boot, compilation, etc.).
With the help of njloy@. Discussed a bit on tech-kern@, no disagreement.
|
|
a good idea; but not proven harmful.
With the help of njoly@
|