For objects without a TLS segment, tlsindex is zero. tls_get_addr_slow()
then reads dtv_slots[-1], which is dtv_size, and returns it as the TLS
address. Set dlpi_tls_data to NULL for such objects instead.
Fixes: d36d681615 ("rtld dl_iterate_phdr(): dlpi_tls_data is wrong")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Add a missing word in the comment.
Make each assignment a separate statement.
Fix formatting.
Fixes: 1e370f0387 ("rtld: stop using unbound alloca()")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
We unlock the bind lock around .init calls anyway. Also, the main
object cannot be unloaded.
Reported and reviewed by: dim
PR: 298943
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60588
The flag only use is for special handling of core dump vnodes.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60283
The obj->path is assigned directly from the path argument, and
load_object() frees the path on do_load_object() failure. Do not free
it in obj_free() on the error path.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60402
This fixes long-standing issue where ufssuspend file descriptor could
leak over fork or be passed over unix domain socket, and then closing it
in the opener would not unsuspend the file system.
It should not affect the well-behaving growfs(8) utility, but makes the
userspace API safer on principle.
Reviewed by: markj
Tested by: pho (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60285
to make the opened device files non-passable.
Reviewed by: markj
Tested by: pho (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60285
in particular, if the old environment is NULL.
Among making it less surprising for userspace to observe NULL environ,
the change also prevents NULL deref in __rebuild_environ() when
terminating the empty as NULL environment with the NULL pointer.
Reported by: Leo Bicknell <[email protected]>
PR: 298747
Reviewed by: emaste, markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59996
Provide a tunable env variable to request immediate GC on destroy
to allow to return to the previous behavior.
Based on the report and patch by Atle Solbakken <[email protected]>.
PR: 268532
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Wrap long lines, related to the nullfs mounts over regular files and
sockets type checks. Also fix indent.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
As result, we lock the devvp vnode around calls to VOP_FSYNC() on
unmount. For instance, the vn_fsync_buf() implementation of fsync()
needs exclusive lock on the vnode to guarantee that all dirty buffers
are indeed synced.
Reviewed by: markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59932
that locks both bo vnode and topology.
Reviewed by: markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59932
Thread can control it with sysarch(I386_SET_SPLITLOCK). The global
default is set with hw.splitlock_force.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
If hw supports it, on atomic operation that requires exclusive ownership
of more than one cache line, #AC is generated.
The state is maintained as the arch-private TDF_MD_SPLITLOCK_AC flag.
The state is inherited on thread creation from the thread spawning the
new one. It is cleared on exec.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
Recover from it if PCB_ONFAULT handler is provided.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
Use a hole in struct mdthread.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
Also explicitly specify .cfi_sections to emit the cfi bytecode into the
loadable .eh_frame section.
Reviewed by: mchoo
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59838
The new ptrace(2) features allow to change truss(1) to systematically
operate on the process descriptors instead of pids.
Allocate the global kqueue that tracks all noted children
by pdopenpid()-ing them and adding to the kqueue with
EVFILT_PROCDESC/NOTE_PDSIGCHLD. The activated knote triggers the
pdwait() call to return the child tracing info. This replaces the
waitid(P_ALL) call in the non-capsicumized truss(1) eventloop.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58094
Incorrect ELF might have PT_NOTE slightly larger than the needed to
contain all notes, and the PT_NOTE size could be larger than one page.
Then rtld mmaps just the notes bytes to parse. After the last note,
we iterate past the mapped region trying to read the Elf_Note header.
This was found in wild.
Require full elf note to fit into the [start_note, end_note) region to
continue the parsing. Check it in stages, first verifying the Elf_Note
header structure fits, to be able to read the name and data length.
After that, check the whole note against limit.
Reported and tested by: makc
Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59635
Utilize the ARCHLEVEL framework from libc/amd64/string to provide the
way for runtime selection of the implementation, if wanted.
Reviewed by: fuz, kfv
Discussed with: kargl
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59462
which makes the variable available for machine/Makefile.inc usage.
Reviewed by: fuz, kfv
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59462
Since the vp_crossmp vnode can leak into vn_vptocnp() calls due to
nullfs file mounting, not all lock requests are non-sleeping. The
requirement for the crossmp locking is that all lock requests should be
shared. Then, it does not matter if the requests allow sleeping, since
all locks are shared.
Also, check the lock type by correctly masking it with LK_TYPE_MASK.
Reported and tested by: pho
Reviewed by: jah, markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59468
The variable is written in the child process which shares the address
space with the parent. The data flow must not be optimized by a compiler.
Reviewed by: markj
Fixes: ddf62c83fc ("sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59282
to not leak information about unused pids or system processes' pids.
Reviewed by: markj
Fixes: 73c92a978c ("pdopenpid(2): allow in capability mode with restrictions")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59252
Instead of relocking tty to get the proctree_lock and experiencing the
race due to the relock, take the proctree_lock in advance for ioctl
commands that need it. The affected commands, TIOCNOTTY, TIOCSCTTY,
and TIOCSPGRP, must not be overridden by the specific tty drivers,
so the common handling is cleaner.
Reviewed by: kevans (previous version), markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59132
Adjust test to check for ECAPMODE using grandchild instead of child.
Childrens can be opened even in cap mode. Add test for the later.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.
The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The pdopenpid(2) syscall is allowed in capability mode. Add the chicken
switch security.bsd.ptrace_in_cap_mode, which disables it without
reboot, if needed.
The descriptor passed to pdptrace(2) must have the CAP_PTRACE
capability enabled. This capability is not enabled by default by
pdfork()/pdopenpid(), and the calls do not return a procdesc suitable
for debugging. The opening code must prepare for debugging in advance by
passing the PD_PTRACE_CAP flag to pdfork()/pdopenpid().
For ptrace(2), allow PT_CLEARSTEP and PT_GET_CHILDREN for the current
thread and process in cap mode as well.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The function defines the policy for allowing to open a pid.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The code to handle copyin and copyout of the structured parameters is
moved into the helpers.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
If the flag is not specified, the process descriptor returned by either
pdfork(2) or pdopenpid(2) has the CAP_PTRACE capability disabled.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
The capability will allow the ptrace(2) on the procdesc.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
st_blksize is defined by POSIX as the 'preferred I/O block size for this
object.' It is wrong to use st_blksize as the unit for st_blocks and
expect it to be equal to the object size regardless of the change of
st_blksize.
Fixes: 3a1bf59d19 ("shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59014
This is ABI-breaking change that could be considered as the bug fix.
Requested by: David Timber <[email protected]>
Reviewed by: emaste, markj
Sponsored by: The FreeBSD Foundation
Relnotes: yes
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58942
In particular, if there were any bytes moved, and then vm_fault()
faulted, do not return an error, but report the short io instead.
PR: 297512
Reviewed by: markj
Tested by: Stéphane D'Alu <[email protected]>
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58838
Since vmspace_iop()/proc_readmem() might return -1 on error from
vmspace_rwmem(), account for this and stop reading but return already
accumulated data if any, instead of returning an error.
PR: 297512
Reported and tested by: Stéphane D'Alu <[email protected]>
Reviewed by: markj
Fixes: e1b0d051bb ("proc: Allow to make proc_rwmem() operate on a consistent address space")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58838
for SADB_UPDATE op SADB_X_EXT_NEW_ADDRESS_SRC/DST extensions, by
checking the sa_len matching the address family requirements before
doing the copy.
Also convert KEY_SETSECASIDX() and KEY_SETSECSPIDX() to functions and
apply the sa_len clamping there.
See https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow
PR: 297264
Tested by: Wafa Hamzah <[email protected]> (previous version)
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58646
This should provide much higher resistence against struct thread layout
changes for out-of-tree modules depending on linuxkpi.
Reviewed by: bz
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58733
When the terminal cdev is closed due to revoke, ttydev_close() destroys
t_inpoll and t_outpoll selinfos. Since corresponding knotes reference
files pointing to the same tty cdev, it fdrop()s them. But then the
VOP_CLOSE() call would recurse into the ttydev_close() for the same tty.
More, because the devfs vnode is already doomed, each close call gets
the FREVOKE flag set.
As result, the kernel is recursing as deep into the ttydev_close() as
there are opened files referencing the same tty, which have the knotes
installed. Basically, the recursion level is controlled by userspace.
Prevent it by marking the tty that is handled by ttydev_close(), with
the TF_INDEVCLOSE flag. Do nothing in ttydev_close() when the flag is
already set, avoiding recursion.
Fixes: acd5638e26 ("tty: delete knotes when TTY is revoked")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58706
Konstantin Belousov