summaryrefslogtreecommitdiff
path: root/sys/miscfs
AgeCommit message (Collapse)Author
2022-06-17Pull up following revision(s) (requested by shm in ticket #1475):martin
sys/miscfs/procfs/procfs_vnops.c: revision 1.229 Add missing permission check
2021-10-04Pull up following revision(s) (requested by thorpej in ticket #1353):martin
sys/miscfs/fifofs/fifo_vnops.c: revision 1.90 tests/kernel/kqueue/write/t_fifo.c: revision 1.5 - Add a new EVFILT_WRITE test case for FIFOs that correctly validates the writability thresholds. - Fix a bug in fifo_kqfilter() exposed by the new test case; in the EVFILT_WRITE case, we were attaching the wrong end of the socket pair to the knote! - In filt_fiforead(), use ">= so->so_rcv.sb_lowat" rather than "> 0" for consistency with fifo_poll(). NFC.
2021-10-04Pull up following revision(s) (requested by thorpej in ticket #1351):martin
sys/miscfs/fifofs/fifo_vnops.c: revision 1.88 sys/kern/uipc_syscalls.c: revision 1.201 tests/lib/libc/sys/t_poll.c: revision 1.6 tests/lib/libc/sys/t_poll.c: revision 1.7 tests/lib/libc/sys/t_poll.c: revision 1.8 - Strenghen the poll(2) fifo_inout test to ensure that once the reader has read enough that exactly PIPE_BUF space is available that the FIFO becomes writable again. - When creating a FIFO, ensure that the receive low water mark is 1 (a FIFO must be readable when at least 1 byte is available); this was already the case implicitly, but this makes it explicit. - Similarly, set the send low water mark to PIPE_BUF to ensure that the pipe is writable when at least PIPE_BUF bytes of space are available in the send buffer. Without this change, the strengthened test case above does not pass (the default send low water mark is larger than PIPE_BUF; see soreserve()). - Make the same low water mark changes to the PIPE_SOCKETPAIR case. In the fifo_hup1 test, also ensure that POLLHUP is de-asserted when a new writer appears. Add a fifo_inout test case that validates the expected POLLIN / POLLOUT behavior for FIFOs: - A FIFO is readable so long as at least 1 byte is available. - A FIFO is writable so long as at least PIPE_BUF (obtained with _PC_PIPE_BUF) space is avaiable. This will be cloned for a forthcoming kevent test case.
2021-10-02Pull up following revision(s) (requested by thorpej in ticket #1350):martin
sys/kern/uipc_socket2.c: revision 1.140 tests/lib/libc/sys/t_poll.c: revision 1.5 sys/miscfs/fifofs/fifo_vnops.c: revision 1.87 - fifo_poll(): If the last writer has disappeared, detect this and return POLLHUP, per POSIX. - fifo_close(): Use the new fifo_socantrcvmore(), which is like the garden-variety socantrcvmore(), except it specifies POLL_HUP rather than POLL_IN (so the correct code for SIGIO is sent). - sowakeup(): Allow POLL_HUP as a code (notifies poll'ers with POLLHUP). - Add test cases for correct POLLHUP behavior with FIFOs. Fixes PR kern/56429.
2021-07-06Pull up following revision(s) (requested by dholland in ticket #1318):martin
sys/miscfs/kernfs/kernfs_vnops.c: revision 1.169 sys/miscfs/kernfs/kernfs_vnops.c: revision 1.170 Add missing VOP_KQFILTER to kernfs. Not sure if lack of it can be used for local DoS or not, but best to fix. - Fix perms on /kern/{r,}rootdev.
2021-05-03Pull up following revision(s) (requested by hannken in ticket #1267):martin
sys/miscfs/fdesc/fdesc_vnops.c: revision 1.135 Make sure fdesc_lookup() never returns VNON vnodes. Should fix PR kern/56130 (fdescfs create nodes with wrong major number)
2021-02-04Pull up following revision(s) (requested by riastradh in ticket #1195):martin
sys/miscfs/procfs/procfs_vfsops.c: revision 1.110 Fix procfs environ node.
2020-09-13Pull up following revision(s) (requested by riastradh in ticket #1083):martin
sys/miscfs/genfs/genfs_rename.c: revision 1.5 tests/fs/vfs/t_renamerace.c: revision 1.37 tests/fs/vfs/t_renamerace.c: revision 1.38 tests/fs/vfs/t_renamerace: Test a screw case hannken@ found. genfs_rename: Fix deadlocks in cross-directory cyclic rename. Reproducer: A: for (;;) { mkdir("c", 0600); mkdir("c/d", 0600); mkdir("c/d/e", 0600); rmdir("c/d/e"); rmdir("c/d"); } B: for (;;) { mkdir("c", 0600); mkdir("c/d", 0600); mkdir("c/d/e", 0600); rename("c", "c/d/e"); } C: for (;;) { mkdir("c", 0600); mkdir("c/d", 0600); mkdir("c/d/e", 0600); rename("c/d/e", "c"); } Deadlock: - A holds c and wants to lock d; and either - B holds . and d and wants to lock c, or - C holds . and d and wants to lock c. The problem with these is that genfs_rename_enter_separate in B or C tried lock order .->d->c->e (in A/B, fdvp->tdvp->fvp->tvp; in A/C, tdvp->fdvp->tvp->fvp) which violates the ancestor->descendant order .->c->d->e. The resolution is to change B to do fdvp->fvp->tdvp->tvp and C to do tdvp->tvp->fdvp->fvp. But there's an edge case: tvp and fvp might be the same (hard links), and we can't detect that until after we've looked them both up -- and in some file systems (I'm looking at you, ufs), there is no mere lookup operation, only lookup-and-lock, so we can't even hold the lock on one of tvp or fvp when we look up the other one if there's a chance they might be the same. Fortunately the cases (a) tvp = fvp (b) tvp or fvp is a directory are mutually exclusive as long as directories cannot be hard-linked. In case (a) we can just defer locking {tvp, fvp} until the end, because it can't possibly have {fdvp or fvp, tdvp or tvp} as descendants. In case (b) we can just lock them in the order fdvp->fvp->tdvp->tvp or tdvp->tvp->fdvp->fvp if the first one of {fvp, tvp} is a directory, because it can't possibly coincide with the second one of {fvp, tvp}. With this change, we can now prove that the locking order is consistent with the ancestor->descendant partial ordering. Where two nodes are incommensurate under that partial ordering, they are only ever locked by rename and there is only ever one rename at a time. Proof: - For same-directory renames, genfs_rename_enter_common locks the directory first and then the children. The order directory->child[i] is consistent with ancestor->descendant and child[0]/child[1] are incommensurate. - For cross-directory renames: . While a rename is in progress and the fs-wide rename lock is held, directories can be created or removed but not changed, so the outcome of gro_genealogy -- which, given fdvp and tdvp, returns the node N relating fdvp/N/.../tdvp or null if there is none -- can only transition from finding N to not finding N, if one of the directories is removed while any of the vnodes are unlocked. Merely creating directories cannot change the ancestry of tdvp, and concurrent renames are not possible. Thus, if a gro_genealogy determined the operation to have the form fdvp/N/.../tdvp, then it might cease to have that form, but only because tdvp was removed which will harmlessly cause the rename to fail later on. Similarly, if gro_genealogy determined the operation _not_ to have the form fdvp/N/.../tdvp then it can't begin to have that form until after the rename has completed. The lock order is, => for fdvp/.../tdvp: 1. lock fdvp 2. lookup(/lock/unlock) fvp (consistent with fdvp->fvp) 3. lock fvp if a directory (consistent with fdvp->fvp) 4. lock tdvp (consistent with fdvp->tdvp and possibly fvp->tdvp) 5. lookup(/lock/unlock) tvp (consistent with tdvp->tvp) 6. lock fvp if a nondirectory (fvp->t* or fvp->fdvp is impossible) 7. lock tvp if not fvp (tvp->f* is impossible unless tvp=fvp) => for incommensurate fdvp & tdvp, or for tdvp/.../fdvp: 1. lock tdvp 2. lookup(/lock/unlock) tvp (consistent with tdvp->tvp) 3. lock tvp if a directory (consistent with tdvp->tvp) 4. lock fdvp (either incommensurate with tdvp and/or tvp, or consistent with tdvp(->tvp)->fdvp) 5. lookup(/lock/unlock) fvp (consistent with fdvp->fvp) 6. lock tvp if a nondirectory (tvp->f* or tvp->tdvp is impossible) 7. lock fvp if not tvp (fvp->t* is impossible unless fvp=tvp) Deadlocks found by hannken@; resolution worked out with dholland@. XXX I think we could improve concurrency somewhat -- with a likely big win for applications like tar and rsync that create many files with temporary names and then rename them to the permanent one in the same directory -- by making vfs_renamelock a reader/writer lock: any number of same-directory renames, or exactly one cross-directory rename, at any one time.
2020-03-21Pull up following revision(s) (requested by riastradh in ticket #789):martin
sys/miscfs/deadfs/dead_vnops.c: revision 1.62 Use vn_bwrite, not genfs_nullop, for VOP_BWRITE. VOP_BWRITE is responsible for calling biodone; can't just leave it hanging. XXX pullup
2020-02-12Pull up following revision(s) (requested by riastradh in ticket #702):martin
sys/miscfs/kernfs/kernfs_vfsops.c: revision 1.98 sys/miscfs/kernfs/kernfs_vnops.c: revision 1.163 sys/miscfs/kernfs/kernfs.h: revision 1.43 Use specfs vnops for specnodes in kernfs. While here, don't filter out rootdev and rrootdev merely because they're not cached. Fixes the elusive /kern/rootdev and /kern/rrootdev nodes, which only appeared sometimes when they felt like it, and fixes operations on /kern/rootdev and /kern/rrootdev always returning EOPNOTSUPP. We didn't seem to have a single PR for these issues but the following PRs are all relevant: PR bin/13564 PR kern/38265 PR kern/38778 PR kern/45974 XXX pullup-9, pullup-8, pullup-7, pullup-6, pullup-5, pullup-4, pullup-3, p= ullup-2, pullup-1.4T...
2019-12-24Pull up following revision(s) (requested by hannken in ticket #581):martin
sys/miscfs/nullfs/null_vfsops.c: revision 1.96 Set IMNT_MPSAFE before creating the vnode for the root of the filesystem. Otherwise, it won't be created with VV_MPSAFE and require the kernel_lock.
2019-09-13Pull up following revision(s) (requested by maxv in ticket #194):martin
sys/compat/linux/common/linux_socket.c: revision 1.146 sys/compat/linux/common/linux_socket.c: revision 1.147 sys/compat/linux/common/linux_socket.c: revision 1.148 sys/compat/linux/common/linux_socket.c: revision 1.149 sys/compat/linux/arch/amd64/linux_machdep.c: revision 1.59 sys/compat/linux32/common/linux32_sysinfo.c: revision 1.8 sys/kern/sysv_shm.c: revision 1.138 sys/compat/linux/common/linux_file64.c: revision 1.61 sys/compat/linux/common/linux_file64.c: revision 1.62 sys/compat/netbsd32/netbsd32_compat_43.c: revision 1.58 sys/compat/linux32/common/linux32_dirent.c: revision 1.20 sys/compat/linux32/common/linux32_utsname.c: revision 1.10 sys/compat/linux/common/linux_termios.h: revision 1.22 sys/compat/linux32/common/linux32_termios.c: revision 1.15 sys/compat/linux32/common/linux32_misc.c: revision 1.27 sys/compat/linux32/common/linux32_ioctl.c: revision 1.14 sys/compat/linux/common/linux_statfs.h: revision 1.7 sys/compat/linux/common/linux_ipc.c: revision 1.57 sys/compat/linux/common/linux_fcntl.h: revision 1.18 sys/compat/linux/common/linux_socket.h: revision 1.24 sys/sys/shm.h: revision 1.54 sys/compat/ossaudio/ossaudio.c: revision 1.75 sys/compat/linux32/common/linux32_signal.c: revision 1.20 sys/miscfs/procfs/procfs_linux.c: revision 1.75 sys/compat/linux/common/linux_signal.c: revision 1.81 sys/compat/linux/common/linux_termios.c: revision 1.38 sys/compat/linux/common/linux_misc.c: revision 1.241 sys/compat/linux/common/linux_misc.c: revision 1.242 sys/compat/linux/common/linux_misc.c: revision 1.243 sys/compat/linux/common/linux_misc.c: revision 1.244 Fix info leaks. Fix stupid bugs in linux_sys_shmctl(): the index could be out of bound (page fault) and there was no proper locking. Maybe we should just remove LINUX_SHM_STAT, like compat_linux32. Remove printf. When dealing with an unknown value, set -1, to prevent (harmless) uninitialized accesses later. Add a default case, don't call sys_ioctl() with an uninitialized 'com' argument. Fix error handling, returns an errno, not -1. Put the printf under DEBUG_LINUX. Hum, don't forget the 'pid' argument, otherwise we're not gonna go very far. Don't read data from userland directly. This simply does not work on any recent x86 CPU (thanks to SMAP) and all architectures that forbid direct access to userland from the kernel. But I guess no one noticed because no one ever uses compat_linux, right? Hum, don't pass an mbuf to realloc(). Inspired from copyin32_msg_control(). Fix memory leak. I don't see the point in having this useless printf, but add a '\n' to it, so that it at least displays useless stuff correctly. Hum, remove incorrect assignment. Userland could have passed a smaller namelen, and the uninitialized bytes from sb_data were being used later in the network stack.
2019-09-10Pull up following revision(s) (requested by chs in ticket #190):martin
sys/miscfs/procfs/procfs_linux.c: revision 1.76 have procfs_do_pid_stat() pass the proc's map to get_proc_size_info(), rather than having the latter look up the map again and not check for an error.
2019-09-01Pull up following revision(s) (requested by hannken in ticket #132):martin
sys/miscfs/kernfs/kernfs_vnops.c: revision 1.161 sys/miscfs/procfs/procfs_vnops.c: revision 1.207 Add missing operation VOP_GETPAGES() returning EFAULT. Without this operation posix_fadvise(..., POSIX_FADV_WILLNEED) would leave the v_interlock held. Observed by maxv@
2019-07-11Fix (harmless) uninitialized variable: 'pg' could be 'endm', in which casemaxv
'pg->uobject' would not be initialized. Just invert the two last conditions of the KASSERT. ok hannken@
2019-04-25Restore mapping of file id to pid/type/fd.mlelstv
Use 64bit file id to allow for 32bit fd and 25-26bit pid.
2019-03-30add a node for the process resource limits.christos
2019-02-20Attach "mnt_transinfo" to "dead_rootmount" so every mount has ahannken
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS. Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED. Should become the default for DIAGNOSTIC in the future.
2019-02-20Set "mnt_lower" before the first file system operation on the new file system.hannken
2019-01-01Add "void *extra" argument to vcache_new() so a file system mayhannken
pass more information about the file to create. Welcome to 8.99.30
2018-12-10assert that WAPBL journal write lock is actually held when called withjdolecek
PGO_JOURNALLOCKED or IO_JOURNALLOCKED suggested by mrg@, thanks
2018-12-09support flag PGO_JOURNALLOCKED also for genfs_getpages()jdolecek
2018-12-05As discussed in tech-kern:christos
- make sysctl kern.expose_address tri-state: 0: no access 1: access to processes with open /dev/kmem 2: access to everyone defaults: 0: KASLR kernels 1: non-KASLR kernels - improve efficiency by calling get_expose_address() per sysctl, not per process. - don't expose addresses for linux procfs - welcome to 8.99.27, changes to fill_*proc ABI
2018-10-14remove M_CANFAIL flag for malloc(9) - it was completely ignored, so hadjdolecek
actually no effect
2018-10-05Bring back three state file system suspension:hannken
NORMAL -> SUSPENDING -> SUSPENDED and add operation fstrans_start_lazy() that only blocks while SUSPENDED. Change vndthread() support operation handle_with_rdwr() to bracket its file system operations by fstrans_start_lazy() and fstrans_done(). PR kern/53624 (dom0 freeze on domU exit)
2018-09-03Rename min/max -> uimin/uimax for better honesty.riastradh
These functions are defined on unsigned int. The generic name min/max should not silently truncate to 32 bits on 64-bit systems. This is purely a name change -- no functional change intended. HOWEVER! Some subsystems have #define min(a, b) ((a) < (b) ? (a) : (b)) #define max(a, b) ((a) > (b) ? (a) : (b)) even though our standard name for that is MIN/MAX. Although these may invite multiple evaluation bugs, these do _not_ cause integer truncation. To avoid `fixing' these cases, I first changed the name in libkern, and then compile-tested every file where min/max occurred in order to confirm that it failed -- and thus confirm that nothing shadowed min/max -- before changing it. I have left a handful of bootloaders that are too annoying to compile-test, and some dead code: cobalt ews4800mips hp300 hppa ia64 luna68k vax acorn32/if_ie.c (not included in any kernels) macppc/if_gm.c (superseded by gem(4)) It should be easy to fix the fallout once identified -- this way of doing things fails safe, and the goal here, after all, is to _avoid_ silent integer truncations, not introduce them. Maybe one day we can reintroduce min/max as type-generic things that never silently truncate. But we should avoid doing that for a while, so that existing code has a chance to be detected by the compiler for conversion to uimin/uimax without changing the semantics until we can properly audit it all. (Who knows, maybe in some cases integer truncation is actually intended!)
2018-05-28add a genfs method to allow a file system to limit the range of pageschs
that are given to a single GOP_WRITE() call. needed by ZFS.
2018-04-16Change procfs_revoke_vnodes() to use vrecycle()/vgone() insteadhannken
of VOP_REVOKE(). Gets rid of a bunch of suspensions on /proc as vrecycle() will succeed most time and we suspend at most once per call.
2018-04-07Lock the target cwdi and take an additional reference to thehannken
vnode we are interested in to prevent it from disappearing before getcwd_common(). Should fix PR kern/53096 (netbsd-8 crash on heavy disk I/O)
2018-03-31factor out some repeated code and simplify the logputchar function.christos
2017-12-31rename some "cmdline" stuff now that it is used to print environment toochristos
2017-12-31Add an environ nodechristos
2017-12-01Allow procfs_kqfilter, since we allow poll. "go" does it.christos
2017-11-08fix locking, remove error(1) comments.christos
2017-11-08use p->p_path, remove unused code.christos
2017-10-28Update the kernhist(9) kernel history code to address issues identifiedpgoyette
in PR kern/52639, as well as some general cleaning-up... (As proposed on tech-kern@ with additional changes and enhancements.) Details of changes: * All history arguments are now stored as uintmax_t values[1], both in the kernel and in the structures used for exporting the history data to userland via sysctl(9). This avoids problems on some architectures where passing a 64-bit (or larger) value to printf(3) can cause it to process the value as multiple arguments. (This can be particularly problematic when printf()'s format string is not a literal, since in that case the compiler cannot know how large each argument should be.) * Update the data structures used for exporting kernel history data to include a version number as well as the length of history arguments. * All [2] existing users of kernhist(9) have had their format strings updated. Each format specifier now includes an explicit length modifier 'j' to refer to numeric values of the size of uintmax_t. * All [2] existing users of kernhist(9) have had their format strings updated to replace uses of "%p" with "%#jx", and the pointer arguments are now cast to (uintptr_t) before being subsequently cast to (uintmax_t). This is needed to avoid compiler warnings about casting "pointer to integer of a different size." * All [2] existing users of kernhist(9) have had instances of "%s" or "%c" format strings replaced with numeric formats; several instances of mis-match between format string and argument list have been fixed. * vmstat(1) has been modified to handle the new size of arguments in the history data as exported by sysctl(9). * vmstat(1) now provides a warning message if the history requested with the -u option does not exist (previously, this condition was silently ignored, with only a single blank line being printed). * vmstat(1) now checks the version and argument length included in the data exported via sysctl(9) and exits if they do not match the values with which vmstat was built. * The kernhist(9) man-page has been updated to note the additional requirements imposed on the format strings, along with several other minor changes and enhancements. [1] It would have been possible to use an explicit length (for example, uint64_t) for the history arguments. But that would require another "rototill" of all the users in the future when we add support for an architecture that supports a larger size. Also, the printf(3) format specifiers for explicitly-sized values, such as "%"PRIu64, are much more verbose (and less aesthetically appealing, IMHO) than simply using "%ju". [2] I've tried very hard to find "all [the] existing users of kernhist(9)" but it is possible that I've missed some of them. I would be glad to update any stragglers that anyone identifies.
2017-10-25Use C99 initializer for filteropsmaya
Mostly done with spatch with touchups for indentation @@ expression a; identifier b,c,d; identifier p; @@ const struct filterops p = - { a, b, c, d + { + .f_isfd = a, + .f_attach = b, + .f_detach = c, + .f_event = d, };
2017-09-29Use %ju and (intmax_t) to unbreak i386 build.kre
2017-09-29Split the status printing routines (one for NetBSD and one for Linux) forchristos
simplicity (Robert Swindelis)
2017-08-28Remove the filesystem tracing featurekamil
This is a legacy interface from 4.4BSD, and it was introduced to overcome shortcomings of ptrace(2) at that time, which are no longer relevant (performance). Today /proc/#/ctl offers a narrow subset of ptrace(2) commands and is not applicable for modern applications use beyond simplistic tracing scenarios. This removal will simplify kernel internals. Users will still be able to use all the other /proc files. This change won't affect other procfs files neither Linux compat features within mount_procfs(8). /proc/#/ctl isn't available on Linux. Remove: - /proc/#/ctl from mount_procfs(8) - P_FSTRACE note from the documentation of ps(1) - /proc/#/ctl and filesystem tracing documentation from mount_procfs(8) - KAUTH_REQ_PROCESS_PROCFS_CTL documentation from kauth(9) - source code file miscfs/procfs/procfs_ctl.c - PFSctl and procfs_doctl() from sys/miscfs/procfs/procfs.h - KAUTH_REQ_PROCESS_PROCFS_CTL from sys/sys/kauth.h - PSL_FSTRACE (0x00010000) from sys/sys/proc.h - P_FSTRACE (0x00010000) from sys/sys/sysctl.h Reduce code complexity after removal of this functionality. Update TODO.ptrace accordingly: remove two entries about /proc tracing. Do not keep legacy notes as comments in the headers about removed PSL_FSTRACE / P_FSTRACE, as this interface had little number of users (close or equal to zero). Proposed on tech-kern@. All filesystem tracing utility users are encouraged to switch to ptrace(2). Sponsored by <The NetBSD Foundation>
2017-08-21No need to cache anonymous device vnodes, they will never be looked up.hannken
Set key to (dead_rootmount, 0, NULL) and add assertions.
2017-07-01Provide EVFILT_WRITE; this is what FreeBSD does and go wants it.christos
Makes go unit tests pass.
2017-06-27Add missing check for dead or dying vnode to the entry of genfs_getpages().hannken
2017-06-24Refuse to open a block device with zero open count when it hashannken
a mountpoint set. This may happen after forced detach or unplug of a mounted block device.
2017-06-04Operations fstrans_start() and fstrans_start_nowait() now alwayshannken
use FSTRANS_SHARED as lock type so remove the lock type argument. File system state FSTRANS_SUSPENDING is now unused so remove it. Regen vnode_if files. Ride 8.99.1 less than a hour ago.
2017-06-04Locking a layer vnode using the regular bypass routine is no longerhannken
racy. Undo the change from 2017-03-30 11:16:52, commitid eurqbzuGxGRlryLz and make vi_lock a krwlock_t again.
2017-06-04Now that FSTRANS is part of VOP_*LOCK() remove FSTRANS and vdead_check()hannken
from genfs_.*lock() and assert the vnode state once the vnode is locked.
2017-06-01remove checks for failure after memory allocation calls that cannot fail:chs
kmem_alloc() with KM_SLEEP kmem_zalloc() with KM_SLEEP percpu_alloc() pserialize_create() psref_class_create() all of these paths include an assertion that the allocation has not failed, so callers should not assert that again.
2017-05-26Make VOP_RECLAIM do the last unlock of the vnode.riastradh
VOP_RECLAIM naturally has exclusive access to the vnode, so having it locked on entry is not strictly necessary -- but it means if there are any final operations that must be done on the vnode, such as ffs_update, requiring exclusive access to it, we can now kassert that the vnode is locked in those operations. We can't just have the caller release the last lock because some file systems don't use genfs_lock, and require the vnode to remain valid for VOP_UNLOCK to work, notably unionfs.
2017-05-24Protect layer_getpages against vnodes disappearing during ahannken
forced unmount.