Make timespecadd(3) and friends publicThe timespecadd(3) family of macros were imported from NetBSD back inr35029. However, they were initially guarded by #ifdef _KERNEL. In themeantime, we have
Make timespecadd(3) and friends publicThe timespecadd(3) family of macros were imported from NetBSD back inr35029. However, they were initially guarded by #ifdef _KERNEL. In themeantime, we have grown at least 28 syscalls that use timespecs in someway, leading many programs both inside and outside of the base system toredefine those macros. It's better just to make the definitions public.Our kernel currently defines two-argument versions of timespecadd andtimespecsub. NetBSD, OpenBSD, and FreeDesktop.org's libbsd, however, definethree-argument versions. Solaris also defines a three-argument version, butonly in its kernel. This revision changes our definition to match thecommon three-argument version.Bump _FreeBSD_version due to the breaking KPI change.Discussed with: cem, jilles, ian, bdeDifferential Revision: https://reviews.freebsd.org/D14725
show more ...
Eliminate the overhead of gratuitous repeated reinitialization of cap_rights- Add macros to allow preinitialization of cap_rights_t.- Convert most commonly used code paths to use preinitialized c
Eliminate the overhead of gratuitous repeated reinitialization of cap_rights- Add macros to allow preinitialization of cap_rights_t.- Convert most commonly used code paths to use preinitialized cap_rights_t. A 3.6% speedup in fstat was measured with this change.Reported by: mjgReviewed by: oshogboApproved by: sbrunoMFC after: 1 month
Unsign some values related to allocation.When allocating memory through malloc(9), we always expect the amount ofmemory requested to be unsigned as a negative value would either stand foran error
Unsign some values related to allocation.When allocating memory through malloc(9), we always expect the amount ofmemory requested to be unsigned as a negative value would either stand foran error or an overflow.Unsign some values, found when considering the use of mallocarray(9), toavoid unnecessary casting. Also consider that indexes should be ofat least the same size/type as the upper limit they pretend to index.MFC after: 3 weeks
sys: general adoption of SPDX licensing ID tags.Mainly focus on files that use BSD 2-Clause license, however the tool Iwas using misidentified many licenses so this was mostly a manual - errorpro
sys: general adoption of SPDX licensing ID tags.Mainly focus on files that use BSD 2-Clause license, however the tool Iwas using misidentified many licenses so this was mostly a manual - errorprone - task.The Software Package Data Exchange (SPDX) group provides a specificationto make it easier for automated tools to detect and summarize well knownopensource licenses. We are gradually adopting the specification, notingthat the tags are considered only advisory and do not, in any way,superceed or replace the license texts.No functional change intended.
spdx: initial adoption of licensing ID tags.The Software Package Data Exchange (SPDX) group provides a specificationto make it easier for automated tools to detect and summarize well knownopensou
spdx: initial adoption of licensing ID tags.The Software Package Data Exchange (SPDX) group provides a specificationto make it easier for automated tools to detect and summarize well knownopensource licenses. We are gradually adopting the specification, notingthat the tags are considered only advisory and do not, in any way,superceed or replace the license texts.Special thanks to Wind River for providing access to "The Duke ofHighlander" tool: an older (2014) run over FreeBSD tree was useful as astarting point.Initially, only tag files that use BSD 4-Clause "Original" license.RelNotes: yesDifferential Revision: https://reviews.freebsd.org/D13133
netsmb: Fix buggy/racy smb_strdupin()smb_strdupin() tried to roll a copyin() based strlen to allocate a bufferand then blindly copyin that size. Of course, a malicious user programcould simultan
netsmb: Fix buggy/racy smb_strdupin()smb_strdupin() tried to roll a copyin() based strlen to allocate a bufferand then blindly copyin that size. Of course, a malicious user programcould simultaneously manipulate the buffer, resulting in a non-terminatedstring being copied.Later assumptions in the code rely upon the string being nul-terminated.Just use copyinstr() and drop the racy sizing.PR: 222687Reported by: Meng Xu <meng.xu AT gatech.edu>Security: possible local DoSSponsored by: Dell EMC Isilon
sys/net*: minor spelling fixes.No functional change.
Remove unused SMB_DIALECT_MAX macro.Found by: jhb
kernel: use our nitems() macro when it is available through param.h.No functional change, only trivial cases are done in this sweep,Discussed in: freebsd-current
Cleanup unnecessary semicolons from the kernel.Found with devel/coccinelle.
The problem report was for a crash that happened when smbfs wastrying to do a mount. Given the backtrace,it appears that the crash occurred when smb_vc_create() failed and thencalled smb_vc_put()
The problem report was for a crash that happened when smbfs wastrying to do a mount. Given the backtrace,it appears that the crash occurred when smb_vc_create() failed and thencalled smb_vc_put() with vcp->vc_iod == NULL. smb_vc_put() subsequentlycalled smb_vc_disconnect() with vcp->vc_iod == NULL, causing the crash.This patch adds a check for vcp->vc_iod != NULL in smb_vc_disconnect() toavoid the crash. It also fixes the case in smb_vc_create() wherekproc_create() fails so that it destroys the mutexes and setsvcp->vc_iod == NULL before free()'ing the iod structure.The person who reported the PR tested the patch, but was not ableto reproduce the crash with or without the patch.PR: 201912Reviewed by: jhbMFC after: 2 weeks
When the smbfs iod thread (smb_iod_thread()) is shutting down, smb_iod_destroy()would call smb_iod_request(). This call could return as soon as thewakeup(evp) in smb_iod_main() call is done and the
When the smbfs iod thread (smb_iod_thread()) is shutting down, smb_iod_destroy()would call smb_iod_request(). This call could return as soon as thewakeup(evp) in smb_iod_main() call is done and then could destroythe mutexes. This caused a race with the rest of smb_iod_main()suse of these mutexes.A crash reported on freebsd-stable@ by Christian Kratzer wasdiagnosed as a use of one of these mutexes after it was destroyed.This patch moves destruction of the mutexes from smb_iod_destroy()to the end of smb_iod_thread(), so that they aren't destroyed beforethe thread is done with them. Christian comfirmed that the patchstopped the crashes from happening.Reported by: [email protected] (Christian Kratzer)Tested by: [email protected] (Christian Kratzer)Diagnosed by: jhbReviewed by: jhbMFC after: 2 weeks
Remove redundant unlock.This code was removed from the opensolaris and darwin'snetsmb implementations, in DfBSD it also has been disabled.PR: 36566, 87859, 139407, 161579, 175557, 178412, 18665
Remove redundant unlock.This code was removed from the opensolaris and darwin'snetsmb implementations, in DfBSD it also has been disabled.PR: 36566, 87859, 139407, 161579, 175557, 178412, 186652MFC after: 2 weeksSponsored by: Yandex LLC
Update kernel inclusions of capability.h to use capsicum.h instead; somefurther refinement is required as some device drivers intended to beportable over FreeBSD versions rely on __FreeBSD_version
Update kernel inclusions of capability.h to use capsicum.h instead; somefurther refinement is required as some device drivers intended to beportable over FreeBSD versions rely on __FreeBSD_version to decide whetherto include capability.h.MFC after: 3 weeks
Remove IPX support.IPX was a network transport protocol in Novell's NetWare network operatingsystem from late 80s and then 90s. The NetWare itself switched to TCP/IPas default transport in 1998.
Remove IPX support.IPX was a network transport protocol in Novell's NetWare network operatingsystem from late 80s and then 90s. The NetWare itself switched to TCP/IPas default transport in 1998. Later, in this century the Novell OpenEnterprise Server became successor of Novell NetWare. The last releasethat claimed to still support IPX was OES 2 in 2007. Routing equipmentvendors (e.g. Cisco) discontinued support for IPX in 2011.Thus, IPX won't be supported in FreeBSD 11.0-RELEASE.
Catch up with sb_timeo type change in r255138. This fixessmbfs operation.PR: kern/182963Submitted by: Tomoaki AOKI <junchoon dec.sakura.ne.jp>
Change the cap_rights_t type from uint64_t to a structure that we can extendin the future in a backward compatible (API and ABI) way.The cap_rights_t represents capability rights. We used to use o
Change the cap_rights_t type from uint64_t to a structure that we can extendin the future in a backward compatible (API and ABI) way.The cap_rights_t represents capability rights. We used to use one bit torepresent one right, but we are running out of spare bits. Currently the newstructure provides place for 114 rights (so 50 more than the previouscap_rights_t), but it is possible to grow the structure to hold at least 285rights, although we can make it even larger if 285 rights won't be enough.The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; };The initial CAP_RIGHTS_VERSION is 0.The top two bits in the first element of the cr_rights[] array contain totalnumber of elements in the array - 2. This means if those two bits are equal to0, we have 2 array elements.The top two bits in all remaining array elements should be 0.The next five bits in all array elements contain array index. Only one bit isused and bit position in this five-bits range defines array index. This meansthere can be at most five array elements in the future.To define new right the CAPRIGHT() macro must be used. The macro takes twoarguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL)We still support aliases that combine few rights, but the rights have to belongto the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP)There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);Capability rights to the cap_rights_init(), cap_rights_set(),cap_rights_clear() and cap_rights_is_set() functions are provided byseparating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);There is no need to terminate the list of rights, as those functions areactually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...);Thanks to using one bit as an array index we can assert in those functions thatthere are no two rights belonging to different array elements providedtogether. For example this is illegal and will be detected, because CAP_LOOKUPbelongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL);Providing several rights that belongs to the same array's element this way iscorrect, but is not advised. It should only be used for aliases definition.This commit also breaks compatibility with some existing Capsicum system calls,but I see no other way to do that. This should be fine as Capsicum is stillexperimental and this change is not going to 9.x.Sponsored by: The FreeBSD Foundation
Remove a reference to LK_DRAIN now that lockmgr(9) is gone from thispiece of code.Reported by: attilio
If the kernel is compiled with VMIMAGE support, the first attempt ofmounting smbfs share will cause a panic. Fix setting setting/restoringvnet context when needed.PR: kern/168077Submitted by: d
If the kernel is compiled with VMIMAGE support, the first attempt ofmounting smbfs share will cause a panic. Fix setting setting/restoringvnet context when needed.PR: kern/168077Submitted by: dteske
Overhaul locking in netsmb, getting rid of the obsolete lockmgr() primitive.This solves a long standing LOR between smb_conn and smb_vc.Tested by: martymac, pho (previous version)
Completely rewrite the interface to smbdev switching from dev_cloneto cdevpriv(9). This commit changes the semantic of mount_smbfsin userland as well, which now passes file descriptor in order tot
Completely rewrite the interface to smbdev switching from dev_cloneto cdevpriv(9). This commit changes the semantic of mount_smbfsin userland as well, which now passes file descriptor in order toto mount a specific filesystem istance.Reviewed by: attilio, edTested by: martymac
Call make_dev_credf() rather than using the couple make_dev()/dev_ref().This closes a race with clone_cleanup().
Merge Capsicum overhaul:- Capability is no longer separate descriptor type. Now every descriptor has set of its own capability rights.- The cap_new(2) system call is left, but it is no longer d
Merge Capsicum overhaul:- Capability is no longer separate descriptor type. Now every descriptor has set of its own capability rights.- The cap_new(2) system call is left, but it is no longer documented and should not be used in new code.- The new syscall cap_rights_limit(2) should be used instead of cap_new(2), which limits capability rights of the given descriptor without creating a new one.- The cap_getrights(2) syscall is renamed to cap_rights_get(2).- If CAP_IOCTL capability right is present we can further reduce allowed ioctls list with the new cap_ioctls_limit(2) syscall. List of allowed ioctls can be retrived with cap_ioctls_get(2) syscall.- If CAP_FCNTL capability right is present we can further reduce fcntls that can be used with the new cap_fcntls_limit(2) syscall and retrive them with cap_fcntls_get(2).- To support ioctl and fcntl white-listing the filedesc structure was heavly modified.- The audit subsystem, kdump and procstat tools were updated to recognize new syscalls.- Capability rights were revised and eventhough I tried hard to provide backward API and ABI compatibility there are some incompatible changes that are described in detail below: CAP_CREATE old behaviour: - Allow for openat(2)+O_CREAT. - Allow for linkat(2). - Allow for symlinkat(2). CAP_CREATE new behaviour: - Allow for openat(2)+O_CREAT. Added CAP_LINKAT: - Allow for linkat(2). ABI: Reuses CAP_RMDIR bit. - Allow to be target for renameat(2). Added CAP_SYMLINKAT: - Allow for symlinkat(2). Removed CAP_DELETE. Old behaviour: - Allow for unlinkat(2) when removing non-directory object. - Allow to be source for renameat(2). Removed CAP_RMDIR. Old behaviour: - Allow for unlinkat(2) when removing directory. Added CAP_RENAMEAT: - Required for source directory for the renameat(2) syscall. Added CAP_UNLINKAT (effectively it replaces CAP_DELETE and CAP_RMDIR): - Allow for unlinkat(2) on any object. - Required if target of renameat(2) exists and will be removed by this call. Removed CAP_MAPEXEC. CAP_MMAP old behaviour: - Allow for mmap(2) with any combination of PROT_NONE, PROT_READ and PROT_WRITE. CAP_MMAP new behaviour: - Allow for mmap(2)+PROT_NONE. Added CAP_MMAP_R: - Allow for mmap(PROT_READ). Added CAP_MMAP_W: - Allow for mmap(PROT_WRITE). Added CAP_MMAP_X: - Allow for mmap(PROT_EXEC). Added CAP_MMAP_RW: - Allow for mmap(PROT_READ | PROT_WRITE). Added CAP_MMAP_RX: - Allow for mmap(PROT_READ | PROT_EXEC). Added CAP_MMAP_WX: - Allow for mmap(PROT_WRITE | PROT_EXEC). Added CAP_MMAP_RWX: - Allow for mmap(PROT_READ | PROT_WRITE | PROT_EXEC). Renamed CAP_MKDIR to CAP_MKDIRAT. Renamed CAP_MKFIFO to CAP_MKFIFOAT. Renamed CAP_MKNODE to CAP_MKNODEAT. CAP_READ old behaviour: - Allow pread(2). - Disallow read(2), readv(2) (if there is no CAP_SEEK). CAP_READ new behaviour: - Allow read(2), readv(2). - Disallow pread(2) (CAP_SEEK was also required). CAP_WRITE old behaviour: - Allow pwrite(2). - Disallow write(2), writev(2) (if there is no CAP_SEEK). CAP_WRITE new behaviour: - Allow write(2), writev(2). - Disallow pwrite(2) (CAP_SEEK was also required). Added convinient defines: #define CAP_PREAD (CAP_SEEK | CAP_READ) #define CAP_PWRITE (CAP_SEEK | CAP_WRITE) #define CAP_MMAP_R (CAP_MMAP | CAP_SEEK | CAP_READ) #define CAP_MMAP_W (CAP_MMAP | CAP_SEEK | CAP_WRITE) #define CAP_MMAP_X (CAP_MMAP | CAP_SEEK | 0x0000000000000008ULL) #define CAP_MMAP_RW (CAP_MMAP_R | CAP_MMAP_W) #define CAP_MMAP_RX (CAP_MMAP_R | CAP_MMAP_X) #define CAP_MMAP_WX (CAP_MMAP_W | CAP_MMAP_X) #define CAP_MMAP_RWX (CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X) #define CAP_RECV CAP_READ #define CAP_SEND CAP_WRITE #define CAP_SOCK_CLIENT \ (CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \ CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN) #define CAP_SOCK_SERVER \ (CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \ CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \ CAP_SETSOCKOPT | CAP_SHUTDOWN) Added defines for backward API compatibility: #define CAP_MAPEXEC CAP_MMAP_X #define CAP_DELETE CAP_UNLINKAT #define CAP_MKDIR CAP_MKDIRAT #define CAP_RMDIR CAP_UNLINKAT #define CAP_MKFIFO CAP_MKFIFOAT #define CAP_MKNOD CAP_MKNODAT #define CAP_SOCK_ALL (CAP_SOCK_CLIENT | CAP_SOCK_SERVER)Sponsored by: The FreeBSD FoundationReviewed by: Christoph Mallon <[email protected]>Many aspects discussed with: rwatson, benl, jonathanABI compatibility discussed with: kib
Mechanically substitute flags from historic mbuf allocator withmalloc(9) flags within sys.Exceptions:- sys/contrib not touched- sys/mbuf.h edited manually
Fix panic due to page faults while in kernel mode, under conditions ofVM pressure. The reason is that in some codepaths pointers to stackvariables were passed from one thread to another.In collab
Fix panic due to page faults while in kernel mode, under conditions ofVM pressure. The reason is that in some codepaths pointers to stackvariables were passed from one thread to another.In collaboration with: phoReported by: pho's stress2 suiteSponsored by: iXsystems inc.
1234567