The code to handle copyin and copyout of the structured parameters is
moved into the helpers.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
If the flag is not specified, the process descriptor returned by either
pdfork(2) or pdopenpid(2) has the CAP_PTRACE capability disabled.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
The capability will allow the ptrace(2) on the procdesc.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
When connecting a unix domain stream socket, we
1. look up the peer (listening) socket,
2. allocate a new socket
3. add the new socket to the listening socket's queue
Prior to commit 26147c5154, this sequence of operations was
synchronized by a pool mutex, also acquired in uipc_close().
After commit 26147c5154, we drop the vnode pool lock immediately after
finding the peer socket via a filesystem lookup. This creates a window
where it's possible for a connection to add a new socket to the
listening queue after the listening queue has been aborted.
Fix the race by restoring the old behaviour of holding the pool lock
across the solisten_enqueue() call. This is a bit ugly since we need to
pass a mutex lock and a vnode through a couple of layers, but it seems
like a low-risk solution. Alternately we could add some flag to the
listening socket which indicates that no new connections are to be
accepted, but I think this will require some changes to the generic
socket code.
Reported by: pho
Fixes: 26147c5154 ("unix: pin the pathname peer by reference across the connect")
Reviewed by: olce, kib, John Ericson <[email protected]>
Differential Revision: https://reviews.freebsd.org/D59201
In the world of containers, mounting a unix(4) socket is a common
practice to allow communication between processes within containers.
For example, both Podman and Docker can expose a unix(4) socket,
and that same unix(4) socket can be mounted as a file accessible
to a process inside a container, allowing that application to control
Podman or Docker. Another example is PHP-FPM with NGINX, where,
instead of using TCP/IP for communication between containers, a
unix(4) socket is sufficient.
However, nullfs(4) and all related components do not allow mounting
a VSOCK on top of another. The current workaround involves creating
the socket in a directory and mounting that directory. This is an
option, though it does not provide a good user experience compared
to directly mounting a VSOCK on top of another, since the application
that creates the socket may create other sockets in that directory,
and the user may not wish to share them, or, worse yet, applications
that create unix(4) sockets may not provide any authentication at
all, as they may assume that security at the file system level is
sufficient.
Reviewed by: dfr@
Approved by: dfr@
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D59158
With no file argument, fortune looks for a database named fortunes
in FORTDIR. The base system has not shipped that file since
0538d7bbe6 (FreeBSD 12), only freebsd-tips, so the default
invocation failed even though a valid database remained. Callers
such as xlockmore's marquee and nose modes (fortune -s) then
displayed the error as the epigram.
If the named fortunes file is absent, scan every database in the
existing search path. /usr/local/share/games/fortune stays on that
path so fortune-mod-* packages keep working; when
fortune-mod-freebsd-classic restores the fortunes file, it is still
preferred. fortune -f with no arguments lists the same files that
would be searched.
MFC after: 1 week
Reviewed by: ziaee, fuz
Differential Revision: https://reviews.freebsd.org/D59057
After rangelocks were reimplemented, _rangelock_cookie_assert() became a
stub. Re-provide an implementation.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59222
A PCI function with its own _PXM still inherits a DMA tag carrying
the upstream bridge's proximity domain. Resolving an SR-IOV VF's
locality through its PF therefore does not affect the domain used for
DMA allocations.
Create and cache a private child tag when the function, or a VF's
owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU
tag so its constraints remain intact, then apply the function's domain
without mutating a shared tag.
pci_get_dma_tag() already performs the IOMMU lookup, so remove the
duplicated lookup in the ACPI subclass while here.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59063
A PCI function's _PXM is stable for the lifetime of its device
instance, but CPU and DMA locality queries may evaluate it repeatedly.
SR-IOV amplifies this because every VF resolves locality through the
same PF.
Cache successful mappings and the stable absence of _PXM on the
locality source device, and share that result between CPU and domain
queries. Continue to retry generic evaluation or mapping errors rather
than making a potentially transient failure permanent.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59207
bus_generic_get_cpus() preserves the original leaf device while
forwarding a request through the bus hierarchy. Consequently,
acpi_pci_get_cpus() may receive a descendant below a PCI function
rather than one of the PCI bus's direct children.
Only apply the SR-IOV PF-locality mapping to direct PCI children.
Preserve the previous ACPI CPU-locality lookup for descendants so their
unrelated bus ivars are not interpreted as PCI device information.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59206
Adds missing structs symbols for V4L2.
video(4) capture devices do not crop, expose menu controls or support
overlay, and return ENOTTY for the new ioctls.
Applications enumerate these unconditionally and degrade gracefully
at run time, but fail to build when the declarations are missing.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59203
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
Seven ATF cases covering process-attachment teardown orderings: a
target that exits before it is detached, the owner that exits before
its target (hwpmc's other unlink path), releasing a still-running
attached PMC, row exhaustion with out-of-order release, and
PMC_F_DESCENDANTS inheritance including a fork storm.
All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
A pmc_id_t is a packed integer that the driver hands to userland and
accepts back on eleven operations, and nothing tested what happens when
one comes back forged, stale, or belonging to another process. Neither
was there a test that an unprivileged caller is refused the operations
that need a privilege.
The cases use a SOFT-class PMC wherever the counter itself does not
matter, so they run on a machine with no PMU.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
This tests what FreeBSD-SA-26:56.hwpmc fixed.
exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away
when its target execs a set-gid program its owner is not entitled to
trace.
exec_setuid_no_double_unlink lets the target exec a set-uid program;
the teardown must unlink the process descriptor exactly once, and
completing at all is the assertion.
Both need an unprivileged owner and must not drop privileges themselves,
since p_candebug() would then refuse the target to its own owner; they
ask for require.user instead.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
This addresses a bug in the addition overflow check added in commit
319414a926 ("netmap: Handle overflow when computing ring sizes"): that
overflow wasn't actually caught by the check because "len" is promoted
to size_t.
PR: 297300
Fixes: 319414a926 ("netmap: Handle overflow when computing ring sizes")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58896
Commit 8572367b68 ("pf: remove STATE_LOOKUP") introduced two seemingly
unintentional changes with respect to divert(4)-injected packets (i.e.,
the PACKET_LOOPED case): we no longer return the matching state, and
direct callers of pf_find_state() now treat matches of diverted packets
the same as having no matching state at all.
This seems inadvertent, and breaks certain rulesets which use divert-to.
Fix them, and add a regression test case.
Fixes: 8572367b68 ("pf: remove STATE_LOOKUP")
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D59015
Netlink IFLA_GROUP works with a single group id, in our
implementation an interface can be joined to multiple groups
and it works with group name.
Store interface groups in IFLAF_GROUP attribute.
Reviewed by: glebius, melifaro
Discussed with: markj
Differential Revision: https://reviews.freebsd.org/D58643
Fix a typo, grammar, and generally rephrase for better clarity.
Fixes: 3463f02706 ("UPDATING: add an entry for [gs]etgroups")
MFC after: 1 day
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.
Reviewed by: tuexen
MFC after: 1 month
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D57299
This generalizes the divapp logic and makes it usable for other test
scenarios such as diverted TCP connections.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59067
Finish reviewing all callers for lkpi_80211_mo_link_info_changed() and
lkpi_80211_mo_bss_info_changed(), which are called from
lkpi_bss_info_change() only. Add the lockdep_assert_wiphy() to
lkpi_bss_info_change() and make sure all callers are holding the
wiphy lock.
PR: 297228
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
A failed controller accepted new requests, but nothing ever
completed them, so the caller waited forever. The admin retry
path could also resubmit a request to a dead queue.
Reject new submits and admin retries on a failed controller.
The submit check runs under the queue lock, so it cannot race
with the queue walk in the fail path.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58948
When the first start attempt fails early, the recovery reset
runs the start sequence again without a SIM. That pass still
looked up the WLUN, so it dereferenced a NULL SIM and panicked.
Attach the SIM whenever it does not exist yet. Also make the
WLUN lookup return NULL when there is no SIM.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58947
Konstantin Belousov