| Age | Commit message (Collapse) | Author |
|
sys/miscfs/procfs/procfs_vnops.c: revision 1.229
Add missing permission check
|
|
sys/miscfs/fifofs/fifo_vnops.c: revision 1.90
tests/kernel/kqueue/write/t_fifo.c: revision 1.5
- Add a new EVFILT_WRITE test case for FIFOs that correctly validates
the writability thresholds.
- Fix a bug in fifo_kqfilter() exposed by the new test case; in the
EVFILT_WRITE case, we were attaching the wrong end of the socket
pair to the knote!
- In filt_fiforead(), use ">= so->so_rcv.sb_lowat" rather than "> 0"
for consistency with fifo_poll(). NFC.
|
|
sys/miscfs/fifofs/fifo_vnops.c: revision 1.88
sys/kern/uipc_syscalls.c: revision 1.201
tests/lib/libc/sys/t_poll.c: revision 1.6
tests/lib/libc/sys/t_poll.c: revision 1.7
tests/lib/libc/sys/t_poll.c: revision 1.8
- Strenghen the poll(2) fifo_inout test to ensure that once the reader
has read enough that exactly PIPE_BUF space is available that the FIFO
becomes writable again.
- When creating a FIFO, ensure that the receive low water mark is 1
(a FIFO must be readable when at least 1 byte is available); this
was already the case implicitly, but this makes it explicit.
- Similarly, set the send low water mark to PIPE_BUF to ensure that
the pipe is writable when at least PIPE_BUF bytes of space are available
in the send buffer. Without this change, the strengthened test case
above does not pass (the default send low water mark is larger than
PIPE_BUF; see soreserve()).
- Make the same low water mark changes to the PIPE_SOCKETPAIR case.
In the fifo_hup1 test, also ensure that POLLHUP is de-asserted when a
new writer appears.
Add a fifo_inout test case that validates the expected POLLIN / POLLOUT
behavior for FIFOs:
- A FIFO is readable so long as at least 1 byte is available.
- A FIFO is writable so long as at least PIPE_BUF (obtained with _PC_PIPE_BUF)
space is avaiable.
This will be cloned for a forthcoming kevent test case.
|
|
sys/kern/uipc_socket2.c: revision 1.140
tests/lib/libc/sys/t_poll.c: revision 1.5
sys/miscfs/fifofs/fifo_vnops.c: revision 1.87
- fifo_poll(): If the last writer has disappeared, detect this and return
POLLHUP, per POSIX.
- fifo_close(): Use the new fifo_socantrcvmore(), which is like the
garden-variety socantrcvmore(), except it specifies POLL_HUP rather
than POLL_IN (so the correct code for SIGIO is sent).
- sowakeup(): Allow POLL_HUP as a code (notifies poll'ers with POLLHUP).
- Add test cases for correct POLLHUP behavior with FIFOs.
Fixes PR kern/56429.
|
|
sys/miscfs/kernfs/kernfs_vnops.c: revision 1.169
sys/miscfs/kernfs/kernfs_vnops.c: revision 1.170
Add missing VOP_KQFILTER to kernfs.
Not sure if lack of it can be used for local DoS or not, but best to
fix.
-
Fix perms on /kern/{r,}rootdev.
|
|
sys/miscfs/fdesc/fdesc_vnops.c: revision 1.135
Make sure fdesc_lookup() never returns VNON vnodes.
Should fix PR kern/56130 (fdescfs create nodes with wrong major number)
|
|
sys/miscfs/procfs/procfs_vfsops.c: revision 1.110
Fix procfs environ node.
|
|
sys/miscfs/genfs/genfs_rename.c: revision 1.5
tests/fs/vfs/t_renamerace.c: revision 1.37
tests/fs/vfs/t_renamerace.c: revision 1.38
tests/fs/vfs/t_renamerace: Test a screw case hannken@ found.
genfs_rename: Fix deadlocks in cross-directory cyclic rename.
Reproducer:
A: for (;;) { mkdir("c", 0600); mkdir("c/d", 0600); mkdir("c/d/e", 0600);
rmdir("c/d/e"); rmdir("c/d"); }
B: for (;;) { mkdir("c", 0600); mkdir("c/d", 0600); mkdir("c/d/e", 0600);
rename("c", "c/d/e"); }
C: for (;;) { mkdir("c", 0600); mkdir("c/d", 0600); mkdir("c/d/e", 0600);
rename("c/d/e", "c"); }
Deadlock:
- A holds c and wants to lock d; and either
- B holds . and d and wants to lock c, or
- C holds . and d and wants to lock c.
The problem with these is that genfs_rename_enter_separate in B or C
tried lock order .->d->c->e (in A/B, fdvp->tdvp->fvp->tvp; in A/C,
tdvp->fdvp->tvp->fvp) which violates the ancestor->descendant order
.->c->d->e.
The resolution is to change B to do fdvp->fvp->tdvp->tvp and C to do
tdvp->tvp->fdvp->fvp. But there's an edge case: tvp and fvp might be
the same (hard links), and we can't detect that until after we've
looked them both up -- and in some file systems (I'm looking at you,
ufs), there is no mere lookup operation, only lookup-and-lock, so we
can't even hold the lock on one of tvp or fvp when we look up the
other one if there's a chance they might be the same.
Fortunately the cases
(a) tvp = fvp
(b) tvp or fvp is a directory
are mutually exclusive as long as directories cannot be hard-linked.
In case (a) we can just defer locking {tvp, fvp} until the end, because
it can't possibly have {fdvp or fvp, tdvp or tvp} as descendants. In
case (b) we can just lock them in the order fdvp->fvp->tdvp->tvp or
tdvp->tvp->fdvp->fvp if the first one of {fvp, tvp} is a directory,
because it can't possibly coincide with the second one of {fvp, tvp}.
With this change, we can now prove that the locking order is consistent
with the ancestor->descendant partial ordering. Where two nodes are
incommensurate under that partial ordering, they are only ever locked
by rename and there is only ever one rename at a time.
Proof:
- For same-directory renames, genfs_rename_enter_common locks the
directory first and then the children. The order
directory->child[i] is consistent with ancestor->descendant and
child[0]/child[1] are incommensurate.
- For cross-directory renames:
. While a rename is in progress and the fs-wide rename lock is held,
directories can be created or removed but not changed, so the
outcome of gro_genealogy -- which, given fdvp and tdvp, returns
the node N relating fdvp/N/.../tdvp or null if there is none --
can only transition from finding N to not finding N, if one of
the directories is removed while any of the vnodes are unlocked.
Merely creating directories cannot change the ancestry of tdvp,
and concurrent renames are not possible.
Thus, if a gro_genealogy determined the operation to have the
form fdvp/N/.../tdvp, then it might cease to have that form, but
only because tdvp was removed which will harmlessly cause the
rename to fail later on. Similarly, if gro_genealogy determined
the operation _not_ to have the form fdvp/N/.../tdvp then it
can't begin to have that form until after the rename has
completed.
The lock order is,
=> for fdvp/.../tdvp:
1. lock fdvp
2. lookup(/lock/unlock) fvp (consistent with fdvp->fvp)
3. lock fvp if a directory (consistent with fdvp->fvp)
4. lock tdvp (consistent with fdvp->tdvp and possibly fvp->tdvp)
5. lookup(/lock/unlock) tvp (consistent with tdvp->tvp)
6. lock fvp if a nondirectory (fvp->t* or fvp->fdvp is impossible)
7. lock tvp if not fvp (tvp->f* is impossible unless tvp=fvp)
=> for incommensurate fdvp & tdvp, or for tdvp/.../fdvp:
1. lock tdvp
2. lookup(/lock/unlock) tvp (consistent with tdvp->tvp)
3. lock tvp if a directory (consistent with tdvp->tvp)
4. lock fdvp (either incommensurate with tdvp and/or tvp, or
consistent with tdvp(->tvp)->fdvp)
5. lookup(/lock/unlock) fvp (consistent with fdvp->fvp)
6. lock tvp if a nondirectory (tvp->f* or tvp->tdvp is impossible)
7. lock fvp if not tvp (fvp->t* is impossible unless fvp=tvp)
Deadlocks found by hannken@; resolution worked out with dholland@.
XXX I think we could improve concurrency somewhat -- with a likely
big win for applications like tar and rsync that create many files
with temporary names and then rename them to the permanent one in the
same directory -- by making vfs_renamelock a reader/writer lock: any
number of same-directory renames, or exactly one cross-directory
rename, at any one time.
|
|
sys/miscfs/deadfs/dead_vnops.c: revision 1.62
Use vn_bwrite, not genfs_nullop, for VOP_BWRITE.
VOP_BWRITE is responsible for calling biodone; can't just leave it
hanging.
XXX pullup
|
|
sys/miscfs/kernfs/kernfs_vfsops.c: revision 1.98
sys/miscfs/kernfs/kernfs_vnops.c: revision 1.163
sys/miscfs/kernfs/kernfs.h: revision 1.43
Use specfs vnops for specnodes in kernfs.
While here, don't filter out rootdev and rrootdev merely because
they're not cached.
Fixes the elusive /kern/rootdev and /kern/rrootdev nodes, which only
appeared sometimes when they felt like it, and fixes operations on
/kern/rootdev and /kern/rrootdev always returning EOPNOTSUPP.
We didn't seem to have a single PR for these issues but the following
PRs are all relevant:
PR bin/13564
PR kern/38265
PR kern/38778
PR kern/45974
XXX pullup-9, pullup-8, pullup-7, pullup-6, pullup-5, pullup-4, pullup-3, p=
ullup-2, pullup-1.4T...
|
|
sys/miscfs/nullfs/null_vfsops.c: revision 1.96
Set IMNT_MPSAFE before creating the vnode for the root of the
filesystem. Otherwise, it won't be created with VV_MPSAFE and require
the kernel_lock.
|
|
sys/compat/linux/common/linux_socket.c: revision 1.146
sys/compat/linux/common/linux_socket.c: revision 1.147
sys/compat/linux/common/linux_socket.c: revision 1.148
sys/compat/linux/common/linux_socket.c: revision 1.149
sys/compat/linux/arch/amd64/linux_machdep.c: revision 1.59
sys/compat/linux32/common/linux32_sysinfo.c: revision 1.8
sys/kern/sysv_shm.c: revision 1.138
sys/compat/linux/common/linux_file64.c: revision 1.61
sys/compat/linux/common/linux_file64.c: revision 1.62
sys/compat/netbsd32/netbsd32_compat_43.c: revision 1.58
sys/compat/linux32/common/linux32_dirent.c: revision 1.20
sys/compat/linux32/common/linux32_utsname.c: revision 1.10
sys/compat/linux/common/linux_termios.h: revision 1.22
sys/compat/linux32/common/linux32_termios.c: revision 1.15
sys/compat/linux32/common/linux32_misc.c: revision 1.27
sys/compat/linux32/common/linux32_ioctl.c: revision 1.14
sys/compat/linux/common/linux_statfs.h: revision 1.7
sys/compat/linux/common/linux_ipc.c: revision 1.57
sys/compat/linux/common/linux_fcntl.h: revision 1.18
sys/compat/linux/common/linux_socket.h: revision 1.24
sys/sys/shm.h: revision 1.54
sys/compat/ossaudio/ossaudio.c: revision 1.75
sys/compat/linux32/common/linux32_signal.c: revision 1.20
sys/miscfs/procfs/procfs_linux.c: revision 1.75
sys/compat/linux/common/linux_signal.c: revision 1.81
sys/compat/linux/common/linux_termios.c: revision 1.38
sys/compat/linux/common/linux_misc.c: revision 1.241
sys/compat/linux/common/linux_misc.c: revision 1.242
sys/compat/linux/common/linux_misc.c: revision 1.243
sys/compat/linux/common/linux_misc.c: revision 1.244
Fix info leaks.
Fix stupid bugs in linux_sys_shmctl(): the index could be out of bound
(page fault) and there was no proper locking.
Maybe we should just remove LINUX_SHM_STAT, like compat_linux32.
Remove printf.
When dealing with an unknown value, set -1, to prevent (harmless)
uninitialized accesses later.
Add a default case, don't call sys_ioctl() with an uninitialized 'com'
argument.
Fix error handling, returns an errno, not -1.
Put the printf under DEBUG_LINUX.
Hum, don't forget the 'pid' argument, otherwise we're not gonna go very
far.
Don't read data from userland directly. This simply does not work on any
recent x86 CPU (thanks to SMAP) and all architectures that forbid direct
access to userland from the kernel. But I guess no one noticed because no
one ever uses compat_linux, right?
Hum, don't pass an mbuf to realloc(). Inspired from copyin32_msg_control().
Fix memory leak.
I don't see the point in having this useless printf, but add a '\n' to it,
so that it at least displays useless stuff correctly.
Hum, remove incorrect assignment. Userland could have passed a smaller
namelen, and the uninitialized bytes from sb_data were being used later in
the network stack.
|
|
sys/miscfs/procfs/procfs_linux.c: revision 1.76
have procfs_do_pid_stat() pass the proc's map to get_proc_size_info(),
rather than having the latter look up the map again and not check
for an error.
|
|
sys/miscfs/kernfs/kernfs_vnops.c: revision 1.161
sys/miscfs/procfs/procfs_vnops.c: revision 1.207
Add missing operation VOP_GETPAGES() returning EFAULT.
Without this operation posix_fadvise(..., POSIX_FADV_WILLNEED)
would leave the v_interlock held.
Observed by maxv@
|
|
'pg->uobject' would not be initialized. Just invert the two last conditions
of the KASSERT.
ok hannken@
|
|
Use 64bit file id to allow for 32bit fd and 25-26bit pid.
|
|
|
|
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.
Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.
|
|
|
|
pass more information about the file to create.
Welcome to 8.99.30
|
|
PGO_JOURNALLOCKED or IO_JOURNALLOCKED
suggested by mrg@, thanks
|
|
|
|
- make sysctl kern.expose_address tri-state:
0: no access
1: access to processes with open /dev/kmem
2: access to everyone
defaults:
0: KASLR kernels
1: non-KASLR kernels
- improve efficiency by calling get_expose_address() per sysctl, not per
process.
- don't expose addresses for linux procfs
- welcome to 8.99.27, changes to fill_*proc ABI
|
|
actually no effect
|
|
NORMAL -> SUSPENDING -> SUSPENDED
and add operation fstrans_start_lazy() that only blocks while SUSPENDED.
Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().
PR kern/53624 (dom0 freeze on domU exit)
|
|
These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.
HOWEVER! Some subsystems have
#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))
even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.
To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.
I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:
cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))
It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.
Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)
|
|
that are given to a single GOP_WRITE() call. needed by ZFS.
|
|
of VOP_REVOKE().
Gets rid of a bunch of suspensions on /proc as vrecycle() will
succeed most time and we suspend at most once per call.
|
|
vnode we are interested in to prevent it from disappearing
before getcwd_common().
Should fix PR kern/53096 (netbsd-8 crash on heavy disk I/O)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
in PR kern/52639, as well as some general cleaning-up...
(As proposed on tech-kern@ with additional changes and enhancements.)
Details of changes:
* All history arguments are now stored as uintmax_t values[1], both in
the kernel and in the structures used for exporting the history data
to userland via sysctl(9). This avoids problems on some architectures
where passing a 64-bit (or larger) value to printf(3) can cause it to
process the value as multiple arguments. (This can be particularly
problematic when printf()'s format string is not a literal, since in
that case the compiler cannot know how large each argument should be.)
* Update the data structures used for exporting kernel history data to
include a version number as well as the length of history arguments.
* All [2] existing users of kernhist(9) have had their format strings
updated. Each format specifier now includes an explicit length
modifier 'j' to refer to numeric values of the size of uintmax_t.
* All [2] existing users of kernhist(9) have had their format strings
updated to replace uses of "%p" with "%#jx", and the pointer
arguments are now cast to (uintptr_t) before being subsequently cast
to (uintmax_t). This is needed to avoid compiler warnings about
casting "pointer to integer of a different size."
* All [2] existing users of kernhist(9) have had instances of "%s" or
"%c" format strings replaced with numeric formats; several instances
of mis-match between format string and argument list have been fixed.
* vmstat(1) has been modified to handle the new size of arguments in the
history data as exported by sysctl(9).
* vmstat(1) now provides a warning message if the history requested with
the -u option does not exist (previously, this condition was silently
ignored, with only a single blank line being printed).
* vmstat(1) now checks the version and argument length included in the
data exported via sysctl(9) and exits if they do not match the values
with which vmstat was built.
* The kernhist(9) man-page has been updated to note the additional
requirements imposed on the format strings, along with several other
minor changes and enhancements.
[1] It would have been possible to use an explicit length (for example,
uint64_t) for the history arguments. But that would require another
"rototill" of all the users in the future when we add support for an
architecture that supports a larger size. Also, the printf(3) format
specifiers for explicitly-sized values, such as "%"PRIu64, are much
more verbose (and less aesthetically appealing, IMHO) than simply
using "%ju".
[2] I've tried very hard to find "all [the] existing users of kernhist(9)"
but it is possible that I've missed some of them. I would be glad to
update any stragglers that anyone identifies.
|
|
Mostly done with spatch with touchups for indentation
@@
expression a;
identifier b,c,d;
identifier p;
@@
const struct filterops p =
- { a, b, c, d
+ {
+ .f_isfd = a,
+ .f_attach = b,
+ .f_detach = c,
+ .f_event = d,
};
|
|
|
|
simplicity (Robert Swindelis)
|
|
This is a legacy interface from 4.4BSD, and it was
introduced to overcome shortcomings of ptrace(2) at that time, which are
no longer relevant (performance). Today /proc/#/ctl offers a narrow
subset of ptrace(2) commands and is not applicable for modern
applications use beyond simplistic tracing scenarios.
This removal will simplify kernel internals. Users will still be able to
use all the other /proc files.
This change won't affect other procfs files neither Linux compat
features within mount_procfs(8). /proc/#/ctl isn't available on Linux.
Remove:
- /proc/#/ctl from mount_procfs(8)
- P_FSTRACE note from the documentation of ps(1)
- /proc/#/ctl and filesystem tracing documentation from mount_procfs(8)
- KAUTH_REQ_PROCESS_PROCFS_CTL documentation from kauth(9)
- source code file miscfs/procfs/procfs_ctl.c
- PFSctl and procfs_doctl() from sys/miscfs/procfs/procfs.h
- KAUTH_REQ_PROCESS_PROCFS_CTL from sys/sys/kauth.h
- PSL_FSTRACE (0x00010000) from sys/sys/proc.h
- P_FSTRACE (0x00010000) from sys/sys/sysctl.h
Reduce code complexity after removal of this functionality.
Update TODO.ptrace accordingly: remove two entries about /proc tracing.
Do not keep legacy notes as comments in the headers about removed
PSL_FSTRACE / P_FSTRACE, as this interface had little number of users
(close or equal to zero).
Proposed on tech-kern@.
All filesystem tracing utility users are encouraged to switch to ptrace(2).
Sponsored by <The NetBSD Foundation>
|
|
Set key to (dead_rootmount, 0, NULL) and add assertions.
|
|
Makes go unit tests pass.
|
|
|
|
a mountpoint set. This may happen after forced detach or unplug
of a mounted block device.
|
|
use FSTRANS_SHARED as lock type so remove the lock type argument.
File system state FSTRANS_SUSPENDING is now unused so remove it.
Regen vnode_if files.
Ride 8.99.1 less than a hour ago.
|
|
racy. Undo the change from 2017-03-30 11:16:52, commitid eurqbzuGxGRlryLz
and make vi_lock a krwlock_t again.
|
|
from genfs_.*lock() and assert the vnode state once the vnode is locked.
|
|
kmem_alloc() with KM_SLEEP
kmem_zalloc() with KM_SLEEP
percpu_alloc()
pserialize_create()
psref_class_create()
all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.
|
|
VOP_RECLAIM naturally has exclusive access to the vnode, so having it
locked on entry is not strictly necessary -- but it means if there
are any final operations that must be done on the vnode, such as
ffs_update, requiring exclusive access to it, we can now kassert that
the vnode is locked in those operations.
We can't just have the caller release the last lock because some file
systems don't use genfs_lock, and require the vnode to remain valid
for VOP_UNLOCK to work, notably unionfs.
|
|
forced unmount.
|