summaryrefslogtreecommitdiff
path: root/sys/nfs
AgeCommit message (Collapse)Author
2019-05-13When killing a process, the signal is handled by any thread thatAlexander Bluhm
does not block the signal. If all threads block the signal, we delivered it to the main thread. This does not conform to POSIX. If any thread unblocks the signal, it should be delivered immediately to this thread. Mark such signals pending at the process instead of a single thread. Then any thread can handle it later. OK kettenis@ guenther@
2019-01-22The kernel interpreted bogus lengths in RPC calls during NFS boot.Alexander Bluhm
A malicious rpc.bootparamd could corrupt memory, but the kernel has to trust the local network anyway in a diskless environment. Now in case of an RPC error, the kernel will stop booting with a specific panic. OK claudio@ beck@
2019-01-21Introduce a dedicated entry point data structure for file locks. This new dataanton
structure allows for better tracking of pending lock operations which is essential in order to prevent a use-after-free once the underlying vnode is gone. Inspired by the lockf implementation in FreeBSD. ok visa@ Reported-by: syzbot+d5540a236382f50f1dac@syzkaller.appspotmail.com
2019-01-19Move boottime into the timehands.cheloha
To protect the timehands we first need to protect the basis for all UTC time in the kernel: the boottime. Because the boottime can be changed at any time it needs to be versioned along with the other members of the timehands to enable safe lockless reads when using it for anything. So the global boottime timespec goes away and the static boottimebin becomes a member of the timehands. Instead of reading the global boottime you use one of two interfaces: binboottime(9) or microboottime(9). nanoboottime(9) can trivially be added later, though there are no consumers for it at the moment. This introduces one small change in behavior. We used to advance the reported boottime just before launching kernel threads from main(). This makes it look to userland like we "booted" moments before those threads were launched. Because there is no longer a boottime global we can no longer trivially do this from main(), so the boottime we report to userspace via e.g. kern.boottime will now reflect whatever the time was when we bootstrapped the timehands via inittodr(9). This is usually no more than a minute before the kernel threads are launched from main(). The prior behavior can be restored by adding a new interface to the timecounter layer in a future commit. Based on FreeBSD r303387. Discussed with mpi@ and visa@. ok visa@
2019-01-18Check for negative length in NFS strings. This affects both, theAlexander Bluhm
client and server. OK beck@
2019-01-18Check for negative length integers in NFS server. A maliciousAlexander Bluhm
client could crash the server. OK tedu@
2019-01-18Check for negative length integers in NFS client. A maliciousAlexander Bluhm
server could confuse the client file system code. OK beck@
2018-11-30Switch MH_ALIGN to m_align which is the same.Claudio Jeker
OK bluhm@
2018-11-09M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forClaudio Jeker
m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
2018-09-10Instead of calculating the mbuf packet header length here and there,Alexander Bluhm
put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
2018-07-30Use FNONBLOCK instead of SS_NBIO to check/indicate that the I/O modeMartin Pieuchot
for sockets is non-blocking. This allows us to G/C SS_NBIO. Having to keep the two flags in sync in a mp-safe way is complicated. This change introduce a behavior change in sosplice(), it can now always block. However this should not matter much due to the socket lock being taken beforhand. ok bluhm@, benno@, visa@
2018-07-09Nuke unused define 'nfsm_writereply()'.Kenneth R Westerback
ok beck@ deraadt@ guenther@ mpi@
2018-07-02Use more list macros for v_dirtyblkhd.Alexander Bluhm
OK mpi@
2018-06-21Drop redundant "node == parent node" checks from VOP_RMDIR()Visa Hankala
implementations. Rely on the VFS layer to do the checking. OK mpi@, helg@
2018-06-13Make the VFS layer responsible for preventing the deletionVisa Hankala
of mounted on directories. OK guenther@, mpi@
2018-06-07Make callers of VOP_CREATE(9) and VOP_MKNOD(9) responsible forVisa Hankala
unlocking the directory vnode. OK mpi@, helg@
2018-06-06Pass the socket to sounlock(), this prepare the terrain for per-socketMartin Pieuchot
locking. ok visa@, bluhm@
2018-05-27Drop unnecessary `p' parameter from vget(9).Visa Hankala
OK mpi@
2018-05-05Implement proper locking for NFS nodes.Martin Pieuchot
Tested in bulks by many. ok visa@, beck@
2018-05-04After unmount nfs_timer() could access the freed memory of structAlexander Bluhm
nfsmount. Delay the free(9) of the nfs mount point data until pending or sleeping timeouts have finished by running it on the softclock thread. OK visa@
2018-05-02Remove proc from the parameters of vn_lock(). The parameter isVisa Hankala
unnecessary because curproc always does the locking. OK mpi@
2018-04-28Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is alwaysVisa Hankala
curproc that does the locking or unlocking, so the proc parameter is pointless and can be dropped. OK mpi@, deraadt@
2018-04-25Fix use of unreferenced vnode by decrementing the vnode's referenceVisa Hankala
count after unlocking. To improve consistency, use vput() instead of VOP_UNLOCK() + vrele(). OK guenther@, mpi@, tedu@
2018-04-17Prepare vnops to be locked.Martin Pieuchot
- Use vput(9) instead of vrele(9) when a "locked" node is returned by nfs_nget(). - Make sure VN_KNOTE() is always called with a valid reference. - Add a missing PDIRUNLOCK in nfs_lookup() These changes are mostly noops as long as nfs_lock()/unlock() do nothing. Tested by bluhm@, visa@ and myself. ok visa@
2018-04-09Change the representation of an NFS mount point by caching the rootMartin Pieuchot
nodes. nfs_root() now returns a "locked" vnode, so vput(9) must be called to release it. Note that this has currently no effect as nfs_lock/unlock are still stubs. This will prevent some lock odering problems with upcoming NFSnode locking. Tested by landry@, sthen@, visa@, naddy@ and myself. From NetBSD with some tweaks, ok visa@
2018-03-28Check for possible race after sleeping instead of using a rwlock toMartin Pieuchot
protect insertions in `nm_ntree'. This will prevent a future lock ordering problem with NFSnode's lock. ok tedu@, visa@
2018-02-19Remove almost unused `flags' argument of suser().Martin Pieuchot
The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
2018-02-10Syncronize filesystems to disk when suspending. Each mountpoint's vnodesTheo de Raadt
are pushed to disk. Dangling vnodes (unlinked files still in use) and vnodes undergoing change by long-running syscalls are identified -- and such filesystems are marked dirty on-disk while we are suspended (in case power is lost, a fsck will be required). Filesystems without dangling or busy vnodes are marked clean, resulting in faster boots following "battery died" circumstances. Tested by numerous developers, thanks for the feedback.
2018-01-31Use FREF() instead of rolling our own.Martin Pieuchot
ok deraadt@, bluhm@
2017-12-30Delete unnecessary <sys/file.h> includesPhilip Guenther
ok millert@ krw@
2017-12-11In uvm Chuck decided backing store would not be allocated proactivelyTheo de Raadt
for blocks re-fetchable from the filesystem. However at reboot time, filesystems are unmounted, and since processes lack backing store they are killed. Since the scheduler is still running, in some cases init is killed... which drops us to ddb [noted by bluhm]. Solution is to convert filesystems to read-only [proposed by kettenis]. The tale follows: sys_reboot() should pass proc * to MD boot() to vfs_shutdown() which completes current IO with vfs_busy VB_WRITE|VB_WAIT, then calls VFS_MOUNT() with MNT_UPDATE | MNT_RDONLY, soon teaching us that *fs_mount() calls a copyin() late... so store the sizes in vfsconflist[] and move the copyin() to sys_mount()... and notice nfs_mount copyin() is size-variant, so kill legacy struct nfs_args3. Next we learn ffs_mount()'s MNT_UPDATE code is sharp and rusty especially wrt softdep, so fix some bugs adn add ~MNT_SOFTDEP to the downgrade. Some vnodes need a little more help, so tie them to &dead_vnops. ffs_mount calling DIOCCACHESYNC is causing a bit of grief still but this issue is seperate and will be dealt with in time. couple hundred reboots by bluhm and myself, advice from guenther and others at the hut
2017-11-14Push the NET_LOCK into ifioctl() and use the NET_RLOCK in ifioctl_get().Theo Buehler
In particular, this allows SIOCGIF* requests to run in parallel. lots of help & ok mpi, ok visa, sashan
2017-09-07nfs_connect() returns EINVAL at the beginning if nm_sotype isAlexander Bluhm
invalid. But the compiler cannot know whether it has changed in the meantime, so in the else case a bunch of variables would not be initialized. Add a panic() there to change the compiler's assumptions, the code should not be reached anyway. found by clang -Wuninitialized; OK deraadt@
2017-09-05Preallocate option mbufs in order to reduce solock()/sounlock() dances.Martin Pieuchot
Finally protect the last `so_rcv' and `so_snd' accesses with the socket lock. ok visa@, bluhm@
2017-09-01Change sosetopt() to no longer free the mbuf it receives and changeMartin Pieuchot
all the callers to call m_freem(9). Support from deraadt@ and tedu@, ok visa@, bluhm@
2017-08-29Remove old deactivated pledge path code. A replacement mechanism isTheo de Raadt
being brewed. ok beck
2017-08-14knf to fix tab/space mismatches that make it hard to tell what's insideTed Unangst
an if vs the condition itself. weird contortions because of course the lines want to be like 900 columns wide, but i think it's better now.
2017-08-14drop seriously lacking support for SEQPACKET.Ted Unangst
also move checks up sooner to prevent a (root) panic. ok bluhm
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-08-10Move the solock()/sounlock() dance outside of sobind().Martin Pieuchot
ok phessler@, visa@, bluhm@
2017-08-09Move the socket lock "above" sosetopt(), sogetopt() and sosplice().Martin Pieuchot
Protect the fields modifieds by sosetopt() and simplify the dance with the stars. ok bluhm@
2017-07-24Extend the scope of the socket lock to protect `so_state' in connect(2).Martin Pieuchot
As a side effect, soconnect() and soconnect2() now expect a locked socket, so update all the callers. ok bluhm@
2017-07-19If second xdr_string_encode() fails in bp_getfile() m_freem() m sinceClaudio Jeker
this mbuf was allocated by the first call. Fixes possible memory leak. Found by Ilja Van Sprundel OK bluhm@ deraadt@
2017-06-27Add missing solock()/sounlock() dances around sbreserve().Martin Pieuchot
While here document an abuse of parent socket's lock. Problem reported by krw@, analysis and ok bluhm@
2017-06-26Assert that the corresponding socket is locked when manipulating socketMartin Pieuchot
buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
2017-06-19When dealing with mbuf pointers passed down as function parameters,Alexander Bluhm
bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
2017-05-17Remove useless splsoftnet().Martin Pieuchot
Outside of USB, no code is executed in a softnet interrupt context. So what's protecting NFS data structures is the KERNEL_LOCK(). But more importantly, since r1.114 of nfs_socket.c, the 'softnet' thread is no longer executing NFS code. ok visa@
2017-05-08Sync nfs_connect() w/ sys_connect().Martin Pieuchot
ok bluhm@
2017-03-03Prevent a recursion in the socket layer.Martin Pieuchot
Always defere soreceive() to an nfsd(8) process instead of doing it in the 'softnet' thread. Avoiding this recursion ensure that we do not introduce a new sleeping point by releasing and grabbing the netlock. Tested by many, committing now in order to find possible performance regression.
2017-02-22Keep local definitions local.Martin Pieuchot
"good work" deraadt@, ok visa@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 16:48:44 +0000