We unlock the bind lock around .init calls anyway. Also, the main
object cannot be unloaded.
Reported and reviewed by: dim
PR: 298943
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60588
The flag only use is for special handling of core dump vnodes.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60283
The obj->path is assigned directly from the path argument, and
load_object() frees the path on do_load_object() failure. Do not free
it in obj_free() on the error path.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60402
This fixes long-standing issue where ufssuspend file descriptor could
leak over fork or be passed over unix domain socket, and then closing it
in the opener would not unsuspend the file system.
It should not affect the well-behaving growfs(8) utility, but makes the
userspace API safer on principle.
Reviewed by: markj
Tested by: pho (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60285
to make the opened device files non-passable.
Reviewed by: markj
Tested by: pho (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60285
in particular, if the old environment is NULL.
Among making it less surprising for userspace to observe NULL environ,
the change also prevents NULL deref in __rebuild_environ() when
terminating the empty as NULL environment with the NULL pointer.
Reported by: Leo Bicknell <[email protected]>
PR: 298747
Reviewed by: emaste, markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59996
Provide a tunable env variable to request immediate GC on destroy
to allow to return to the previous behavior.
Based on the report and patch by Atle Solbakken <[email protected]>.
PR: 268532
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Wrap long lines, related to the nullfs mounts over regular files and
sockets type checks. Also fix indent.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
As result, we lock the devvp vnode around calls to VOP_FSYNC() on
unmount. For instance, the vn_fsync_buf() implementation of fsync()
needs exclusive lock on the vnode to guarantee that all dirty buffers
are indeed synced.
Reviewed by: markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59932
that locks both bo vnode and topology.
Reviewed by: markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59932
Thread can control it with sysarch(I386_SET_SPLITLOCK). The global
default is set with hw.splitlock_force.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
If hw supports it, on atomic operation that requires exclusive ownership
of more than one cache line, #AC is generated.
The state is maintained as the arch-private TDF_MD_SPLITLOCK_AC flag.
The state is inherited on thread creation from the thread spawning the
new one. It is cleared on exec.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
Recover from it if PCB_ONFAULT handler is provided.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
Use a hole in struct mdthread.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59815
Also explicitly specify .cfi_sections to emit the cfi bytecode into the
loadable .eh_frame section.
Reviewed by: mchoo
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59838
The new ptrace(2) features allow to change truss(1) to systematically
operate on the process descriptors instead of pids.
Allocate the global kqueue that tracks all noted children
by pdopenpid()-ing them and adding to the kqueue with
EVFILT_PROCDESC/NOTE_PDSIGCHLD. The activated knote triggers the
pdwait() call to return the child tracing info. This replaces the
waitid(P_ALL) call in the non-capsicumized truss(1) eventloop.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58094
Incorrect ELF might have PT_NOTE slightly larger than the needed to
contain all notes, and the PT_NOTE size could be larger than one page.
Then rtld mmaps just the notes bytes to parse. After the last note,
we iterate past the mapped region trying to read the Elf_Note header.
This was found in wild.
Require full elf note to fit into the [start_note, end_note) region to
continue the parsing. Check it in stages, first verifying the Elf_Note
header structure fits, to be able to read the name and data length.
After that, check the whole note against limit.
Reported and tested by: makc
Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59635
Utilize the ARCHLEVEL framework from libc/amd64/string to provide the
way for runtime selection of the implementation, if wanted.
Reviewed by: fuz, kfv
Discussed with: kargl
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59462
which makes the variable available for machine/Makefile.inc usage.
Reviewed by: fuz, kfv
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59462
Since the vp_crossmp vnode can leak into vn_vptocnp() calls due to
nullfs file mounting, not all lock requests are non-sleeping. The
requirement for the crossmp locking is that all lock requests should be
shared. Then, it does not matter if the requests allow sleeping, since
all locks are shared.
Also, check the lock type by correctly masking it with LK_TYPE_MASK.
Reported and tested by: pho
Reviewed by: jah, markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59468
The variable is written in the child process which shares the address
space with the parent. The data flow must not be optimized by a compiler.
Reviewed by: markj
Fixes: ddf62c83fc ("sys/tests/kern/pdopenpid: pdopenpid(2) is allowed in cap mode")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59282
to not leak information about unused pids or system processes' pids.
Reviewed by: markj
Fixes: 73c92a978c ("pdopenpid(2): allow in capability mode with restrictions")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59252
Instead of relocking tty to get the proctree_lock and experiencing the
race due to the relock, take the proctree_lock in advance for ioctl
commands that need it. The affected commands, TIOCNOTTY, TIOCSCTTY,
and TIOCSPGRP, must not be overridden by the specific tty drivers,
so the common handling is cleaner.
Reviewed by: kevans (previous version), markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59132
Adjust test to check for ECAPMODE using grandchild instead of child.
Childrens can be opened even in cap mode. Add test for the later.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The pdopenpid() syscall is allowed to open processes which are either
direct children of the caller, or are debuggees already attached to the
calling process. This is reasonable because we could have controlled the
child on fork anyway.
The procdesc-less debuggee can legitimately appear due to ptrace
FOLLOW-FORK mode.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The pdopenpid(2) syscall is allowed in capability mode. Add the chicken
switch security.bsd.ptrace_in_cap_mode, which disables it without
reboot, if needed.
The descriptor passed to pdptrace(2) must have the CAP_PTRACE
capability enabled. This capability is not enabled by default by
pdfork()/pdopenpid(), and the calls do not return a procdesc suitable
for debugging. The opening code must prepare for debugging in advance by
passing the PD_PTRACE_CAP flag to pdfork()/pdopenpid().
For ptrace(2), allow PT_CLEARSTEP and PT_GET_CHILDREN for the current
thread and process in cap mode as well.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The function defines the policy for allowing to open a pid.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58989
The code to handle copyin and copyout of the structured parameters is
moved into the helpers.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
If the flag is not specified, the process descriptor returned by either
pdfork(2) or pdopenpid(2) has the CAP_PTRACE capability disabled.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
The capability will allow the ptrace(2) on the procdesc.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58586
st_blksize is defined by POSIX as the 'preferred I/O block size for this
object.' It is wrong to use st_blksize as the unit for st_blocks and
expect it to be equal to the object size regardless of the change of
st_blksize.
Fixes: 3a1bf59d19 ("shmfd: consistently return size in 512 byte blocks for fstat(2) st_blocks")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D59014
This is ABI-breaking change that could be considered as the bug fix.
Requested by: David Timber <[email protected]>
Reviewed by: emaste, markj
Sponsored by: The FreeBSD Foundation
Relnotes: yes
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58942
In particular, if there were any bytes moved, and then vm_fault()
faulted, do not return an error, but report the short io instead.
PR: 297512
Reviewed by: markj
Tested by: Stéphane D'Alu <[email protected]>
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58838
Since vmspace_iop()/proc_readmem() might return -1 on error from
vmspace_rwmem(), account for this and stop reading but return already
accumulated data if any, instead of returning an error.
PR: 297512
Reported and tested by: Stéphane D'Alu <[email protected]>
Reviewed by: markj
Fixes: e1b0d051bb ("proc: Allow to make proc_rwmem() operate on a consistent address space")
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58838
for SADB_UPDATE op SADB_X_EXT_NEW_ADDRESS_SRC/DST extensions, by
checking the sa_len matching the address family requirements before
doing the copy.
Also convert KEY_SETSECASIDX() and KEY_SETSECSPIDX() to functions and
apply the sa_len clamping there.
See https://github.com/0xdeadbeefnetwork/pfkey-sadb-overflow
PR: 297264
Tested by: Wafa Hamzah <[email protected]> (previous version)
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58646
This should provide much higher resistence against struct thread layout
changes for out-of-tree modules depending on linuxkpi.
Reviewed by: bz
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58733
When the terminal cdev is closed due to revoke, ttydev_close() destroys
t_inpoll and t_outpoll selinfos. Since corresponding knotes reference
files pointing to the same tty cdev, it fdrop()s them. But then the
VOP_CLOSE() call would recurse into the ttydev_close() for the same tty.
More, because the devfs vnode is already doomed, each close call gets
the FREVOKE flag set.
As result, the kernel is recursing as deep into the ttydev_close() as
there are opened files referencing the same tty, which have the knotes
installed. Basically, the recursion level is controlled by userspace.
Prevent it by marking the tty that is handled by ttydev_close(), with
the TF_INDEVCLOSE flag. Do nothing in ttydev_close() when the flag is
already set, avoiding recursion.
Fixes: acd5638e26 ("tty: delete knotes when TTY is revoked")
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58706
For some complex nullfs mount configurations, it is possible to get the
covered vnode lock for the mount shared with some inside-mount vnode
lock. Then at unmount time, vflush() would recurse on the covered vnode
lock when reclaiming the vnode.
Work around it, by temprorarily allowing recursion on the covered vnode
lock. Disable recursion after the unmount if it was not enabled before.
PR: 297174
Reviewed by: jah
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58567
Also add vnode locking wrappers for lockcanrecurse(9) and
lockdisablerecurse(9).
Reviewed by: jah
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58567
Do the advisory aborts of the in-flight requests before flushing the
vnodes. It should mostly eliminate the waits due to requests busying
the mp.
Reported and reviewed by: rew
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58637
For pdwait(2) and pddupfd(2), the returned error is kept EINVAL.
PR: 297293
Reviewed by: lwhsu, markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58666
Since autofs_lookup() calls into autofs_trigger_vn() to perform
automounting, and autofs_trigger_vn() unlocks the vnode, it is possible
for the unmount to start meantime. Then autofs_trigger() accesses freed
memory.
At this point, busy can be only done unblocking, and the transient
failure must abort the trigger operation. This would cause spurious
automounter errors, but at least should prevent accesses to the freed
memory.
PR: 294361
Reviewed by: markj, rew
Tested by: rew
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58626
Add the p_zombieref bitmask into struct proc, which enumerates all
legitimate waiters on the process exit status. Among them are parent
for PZOMBIEREF_PARENT, and the holder of the process descriptor for
PZOMBIEREF_PROCDESC, if the process was created by pdfork().
Require all zombie refs to be cleared to reap zombie. This prevents
stealing the exit status from the parent by pdwait()ing on a procdesc
obtained by pdopenpid(), or by waitpid() by debugger from the real
parent.
Reviewed by: markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58264
Instead of accessing the struct proc and gathering data from it,
memoize the data needed for pdwait() on exited process in struct
procdesc, at the time of process termination.
This allows unlimited number of calls to pdwait(2) on procdesc for
terminated process.
Change the locking requirements for pd_flags to proctree_lock. This does
not modify the pre-patch locking regime, but the change requires it.
Reviewed by: markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D58407
Konstantin Belousov