The capability will allow the ptrace(2) on the procdesc.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
When connecting a unix domain stream socket, we
1. look up the peer (listening) socket,
2. allocate a new socket
3. add the new socket to the listening socket's queue
Prior to commit 26147c5154, this sequence of operations was
synchronized by a pool mutex, also acquired in uipc_close().
After commit 26147c5154, we drop the vnode pool lock immediately after
finding the peer socket via a filesystem lookup. This creates a window
where it's possible for a connection to add a new socket to the
listening queue after the listening queue has been aborted.
Fix the race by restoring the old behaviour of holding the pool lock
across the solisten_enqueue() call. This is a bit ugly since we need to
pass a mutex lock and a vnode through a couple of layers, but it seems
like a low-risk solution. Alternately we could add some flag to the
listening socket which indicates that no new connections are to be
accepted, but I think this will require some changes to the generic
socket code.
Reported by: pho
Fixes: 26147c5154 ("unix: pin the pathname peer by reference across the connect")
Reviewed by: olce, kib, John Ericson <[email protected]>
Differential Revision: https://reviews.freebsd.org/D59201
In the world of containers, mounting a unix(4) socket is a common
practice to allow communication between processes within containers.
For example, both Podman and Docker can expose a unix(4) socket,
and that same unix(4) socket can be mounted as a file accessible
to a process inside a container, allowing that application to control
Podman or Docker. Another example is PHP-FPM with NGINX, where,
instead of using TCP/IP for communication between containers, a
unix(4) socket is sufficient.
However, nullfs(4) and all related components do not allow mounting
a VSOCK on top of another. The current workaround involves creating
the socket in a directory and mounting that directory. This is an
option, though it does not provide a good user experience compared
to directly mounting a VSOCK on top of another, since the application
that creates the socket may create other sockets in that directory,
and the user may not wish to share them, or, worse yet, applications
that create unix(4) sockets may not provide any authentication at
all, as they may assume that security at the file system level is
sufficient.
Reviewed by: dfr@
Approved by: dfr@
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D59158
With no file argument, fortune looks for a database named fortunes
in FORTDIR. The base system has not shipped that file since
0538d7bbe6 (FreeBSD 12), only freebsd-tips, so the default
invocation failed even though a valid database remained. Callers
such as xlockmore's marquee and nose modes (fortune -s) then
displayed the error as the epigram.
If the named fortunes file is absent, scan every database in the
existing search path. /usr/local/share/games/fortune stays on that
path so fortune-mod-* packages keep working; when
fortune-mod-freebsd-classic restores the fortunes file, it is still
preferred. fortune -f with no arguments lists the same files that
would be searched.
MFC after: 1 week
Reviewed by: ziaee, fuz
Differential Revision: https://reviews.freebsd.org/D59057
After rangelocks were reimplemented, _rangelock_cookie_assert() became a
stub. Re-provide an implementation.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59222
A PCI function with its own _PXM still inherits a DMA tag carrying
the upstream bridge's proximity domain. Resolving an SR-IOV VF's
locality through its PF therefore does not affect the domain used for
DMA allocations.
Create and cache a private child tag when the function, or a VF's
owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU
tag so its constraints remain intact, then apply the function's domain
without mutating a shared tag.
pci_get_dma_tag() already performs the IOMMU lookup, so remove the
duplicated lookup in the ACPI subclass while here.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59063
A PCI function's _PXM is stable for the lifetime of its device
instance, but CPU and DMA locality queries may evaluate it repeatedly.
SR-IOV amplifies this because every VF resolves locality through the
same PF.
Cache successful mappings and the stable absence of _PXM on the
locality source device, and share that result between CPU and domain
queries. Continue to retry generic evaluation or mapping errors rather
than making a potentially transient failure permanent.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59207
bus_generic_get_cpus() preserves the original leaf device while
forwarding a request through the bus hierarchy. Consequently,
acpi_pci_get_cpus() may receive a descendant below a PCI function
rather than one of the PCI bus's direct children.
Only apply the SR-IOV PF-locality mapping to direct PCI children.
Preserve the previous ACPI CPU-locality lookup for descendants so their
unrelated bus ivars are not interpreted as PCI device information.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59206
Adds missing structs symbols for V4L2.
video(4) capture devices do not crop, expose menu controls or support
overlay, and return ENOTTY for the new ioctls.
Applications enumerate these unconditionally and degrade gracefully
at run time, but fail to build when the declarations are missing.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59203
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
Seven ATF cases covering process-attachment teardown orderings: a
target that exits before it is detached, the owner that exits before
its target (hwpmc's other unlink path), releasing a still-running
attached PMC, row exhaustion with out-of-order release, and
PMC_F_DESCENDANTS inheritance including a fork storm.
All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
A pmc_id_t is a packed integer that the driver hands to userland and
accepts back on eleven operations, and nothing tested what happens when
one comes back forged, stale, or belonging to another process. Neither
was there a test that an unprivileged caller is refused the operations
that need a privilege.
The cases use a SOFT-class PMC wherever the counter itself does not
matter, so they run on a machine with no PMU.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
This tests what FreeBSD-SA-26:56.hwpmc fixed.
exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away
when its target execs a set-gid program its owner is not entitled to
trace.
exec_setuid_no_double_unlink lets the target exec a set-uid program;
the teardown must unlink the process descriptor exactly once, and
completing at all is the assertion.
Both need an unprivileged owner and must not drop privileges themselves,
since p_candebug() would then refuse the target to its own owner; they
ask for require.user instead.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
This addresses a bug in the addition overflow check added in commit
319414a926 ("netmap: Handle overflow when computing ring sizes"): that
overflow wasn't actually caught by the check because "len" is promoted
to size_t.
PR: 297300
Fixes: 319414a926 ("netmap: Handle overflow when computing ring sizes")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58896
Commit 8572367b68 ("pf: remove STATE_LOOKUP") introduced two seemingly
unintentional changes with respect to divert(4)-injected packets (i.e.,
the PACKET_LOOPED case): we no longer return the matching state, and
direct callers of pf_find_state() now treat matches of diverted packets
the same as having no matching state at all.
This seems inadvertent, and breaks certain rulesets which use divert-to.
Fix them, and add a regression test case.
Fixes: 8572367b68 ("pf: remove STATE_LOOKUP")
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: OPNsense
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D59015
Netlink IFLA_GROUP works with a single group id, in our
implementation an interface can be joined to multiple groups
and it works with group name.
Store interface groups in IFLAF_GROUP attribute.
Reviewed by: glebius, melifaro
Discussed with: markj
Differential Revision: https://reviews.freebsd.org/D58643
Fix a typo, grammar, and generally rephrase for better clarity.
Fixes: 3463f02706 ("UPDATING: add an entry for [gs]etgroups")
MFC after: 1 day
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Move the functions vtnet_rxq_csum() and vtnet_txq_offload() and the
subfunctions they call from if_vtnet.c to virtio_net.h. This allows
us to call these functions from if_tuntap.c and if_ptnet.c.
virtio_net.h already contained a copy of these functions, but a copy
of an outdated version. The functions evolved in if_vtnet.c.
In if_vtnet.c, the copy has never been used because it increments
counters in their own functions.
This patch removes the outdated copy from virtio_net.h and moves the
new version of the functions from if_vtnet.c to virtio_net.h.
if_tuntap.c, if_ptnet.c, and if_vtnet.c just call these functions,
and if_vtnet.c increments its counters depending on the return value.
Reviewed by: tuexen
MFC after: 1 month
MFC to: stable/15
Differential Revision: https://reviews.freebsd.org/D57299
This generalizes the divapp logic and makes it usable for other test
scenarios such as diverted TCP connections.
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59067
Finish reviewing all callers for lkpi_80211_mo_link_info_changed() and
lkpi_80211_mo_bss_info_changed(), which are called from
lkpi_bss_info_change() only. Add the lockdep_assert_wiphy() to
lkpi_bss_info_change() and make sure all callers are holding the
wiphy lock.
PR: 297228
Sponsored by: The FreeBSD Foundation
MFC after: 3 days
A failed controller accepted new requests, but nothing ever
completed them, so the caller waited forever. The admin retry
path could also resubmit a request to a dead queue.
Reject new submits and admin retries on a failed controller.
The submit check runs under the queue lock, so it cannot race
with the queue walk in the fail path.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58948
When the first start attempt fails early, the recovery reset
runs the start sequence again without a SIM. That pass still
looked up the WLUN, so it dereferenced a NULL SIM and panicked.
Attach the SIM whenever it does not exist yet. Also make the
WLUN lookup return NULL when there is no SIM.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58947
The manual completion wrote the fake response to the wrong
descriptor for task management slots. It also left the task tag
at zero, which tripped the task tag check under INVARIANTS.
Write the fake response where the completion path reads it.
Copy the task tag from the request.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58946
ufshci_req_queue_fail() drops the queue lock to complete each
tracker. In that window the completion path could complete the
same tracker again.
Claim the slot before dropping the lock, so the completion scan
skips it. Reserved slots are left to their submit thread, which
completes them itself. The manual request completion helper
lost its only caller, so drop it.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58945
Two threads could run ufshci_ctrlr_fail() at the same time.
Each one walked the queues and completed the same trackers
again, which caused a double free and a panic.
Turn is_failed into an atomic gate, so only the first caller
walks the queues. The reset task now returns early on a failed
controller instead of re-enabling it.
Reviewed by: imp (mentor)
Sponsored by: Samsung Electronics
Differential Revision: https://reviews.freebsd.org/D58944
SR-IOV VFs are instantiated from their PF and intentionally do not
receive an ACPI handle by matching their runtime BDF. Consequently,
ACPI locality queries for a VF fall back to the upstream bus. This is
usually sufficient, but loses a _PXM supplied specifically for the PF.
Use the PCI core's owning-PF accessor for BUS_GET_DOMAIN and
BUS_GET_CPUS requests made for a VF. This preserves the VF's lack of
an ACPI handle while allowing its CPU and NUMA placement to follow the
PF.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59062
SR-IOV VFs are instantiated dynamically from their PF rather than
enumerated from ACPI. A VF's runtime slot and function can match an
unrelated _ADR below the bridge. acpi_pci_save_handle() stores that
handle in the VF's devinfo before acpi_pci_update_device() runs.
If the handle is already bound to another device_t whose parent is not
acpi0, acpi_pci_update_device() panics under INVARIANTS. Without
INVARIANTS, the VF retains the unrelated handle, so subsequent ACPI
lookups, including NUMA and power-management operations, can act on the
wrong namespace node.
Skip ACPI namespace matching for VFs.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59061
Commit 290e563166 changed the flag's name from dontcache
to nocache. This patch fixes the man page.
This is a content change.
Reviewed by: kib (earlier version)
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58181
Fixes: 4830670a3f ("chflags.1: Document the new UF_DONTCACHE flag")
This internet draft (which is close to being an RFC)
specifies a new NFSv4.2 attribute which tells the NFSv4.2
client to not cache file data. (Similar to O_DIRECT, but
triggered by this attribute set on the file on the NFSv4.2
server and not by the application's open(2).)
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-uncacheable-files/
This patch adds a new chflags(1) flag called UF_NOCACHE to
implement this.
Patches for NFS and ZFS will be done separately.
This is a redo of the patch, with a requested name change
and a #ifdef in strtofflags.c so that it doesn't break some
Linux cross build. The name change was requested by fuz@.
Reviewed by: kib (earlier version)
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D58181
The previous patch assumes that we don't want to reset toggle bit in
STOPPED_STEP. However, a device can explicitly call
usbd_clear_data_toggle if necessary. As a result, instead of not
dropping the bit unconditionally, we added a field in xhci to specify
that we want to drop it, so that usbd_clear_data_toggle can handle it
correctly.
Reported by: oh
Reviewed by: kevans
Tested by: oh
Fixes: 28d85db46b ("xhci: Do not drop and add bits in xhci")
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D59186
- The lobits field in the "physical" BAR settings is never used, so
don't bother setting it.
- Expand the comment explaining why the existing lobits are preserved
(namely, to preserve the prefetch flag on memory BARs).
Reviewed by: bnovkov
Differential Revision: https://reviews.freebsd.org/D58894
Konstantin Belousov