Commit Graph

1710 Commits

Author SHA1 Message Date
Kris Kennaway
e29c976a58 devfs is not yet fully MPSAFE - for example, multiple concurrent devfs(8)
processes can cause a panic when operating on rulesets.

Approved by:	phk
2005-07-29 23:00:56 +00:00
Simon L. B. Nielsen
02a4be3f74 Correct devfs ruleset bypass.
Submitted by:	csjp
Reviewed by:	phk
Security:	FreeBSD-SA-05:17.devfs
Approved by:	cperciva
2005-07-20 13:34:16 +00:00
R. Imura
697ab829fc [1] unix2doschr()
If a character cannot be converted to DOS code page,
 unix2doschr() returned `0'. As a result, unix2dosfn()
 was forced to return `0', so we saw a file which was
 composed of these characters as `Invalid argument'.
 To correct this, if a character can be converted to
 Unicode, unix2doschr() now returns `1' which is a magic
 number to make unix2dosfn() know that the character
 must be converted to `_'.

[2] unix2dosfn()
 The above-mentioned solution only works if a file
 has both of Unicode name and DOS code page name.
 Unicode name would not be recorded if file name
 can be settled within 11 bytes (DOS short name)
 and if no conversion from Unix charset to DOS code
 page has occurred. Thus, FreeBSD can create a file
 which has only short name, but there is no guarantee
 that the short name contains allways valid characters
 because we leave it to people by using mount_msdosfs(8)
 to select which conversion is used between DOS code
 page and unix charset.
 To avoid this, Unicode file name should be recorded
 unless a character is an ascii character. This is
 the way Windows XP do.

PR:		77074 [1]
MFC after:	1 week
2005-07-17 07:10:05 +00:00
Robert Watson
d26dd2d99e When devfs cloning takes place, provide access to the credential of the
process that caused the clone event to take place for the device driver
creating the device.  This allows cloned device drivers to adapt the
device node based on security aspects of the process, such as the uid,
gid, and MAC label.

- Add a cred reference to struct cdev, so that when a device node is
  instantiated as a vnode, the cloning credential can be exposed to
  MAC.

- Add make_dev_cred(), a version of make_dev() that additionally
  accepts the credential to stick in the struct cdev.  Implement it and
  make_dev() in terms of a back-end make_dev_credv().

- Add a new event handler, dev_clone_cred, which can be registered to
  receive the credential instead of dev_clone, if desired.

- Modify the MAC entry point mac_create_devfs_device() to accept an
  optional credential pointer (may be NULL), so that MAC policies can
  inspect and act on the label or other elements of the credential
  when initializing the skeleton device protections.

- Modify tty_pty.c to register clone_dev_cred and invoke make_dev_cred(),
  so that the pty clone credential is exposed to the MAC Framework.

While currently primarily focussed on MAC policies, this change is also
a prerequisite for changes to allow ptys to be instantiated with the UID
of the process looking up the pty.  This requires further changes to the
pty driver -- in particular, to immediately recycle pty nodes on last
close so that the credential-related state can be recreated on next
lookup.

Submitted by:	Andrew Reisse <andrew.reisse@sparta.com>
Obtained from:	TrustedBSD Project
Sponsored by:	SPAWAR, SPARTA
MFC after:	1 week
MFC note:	Merge to 6.x, but not 5.x for ABI reasons
2005-07-14 10:22:09 +00:00
Seigo Tanimura
045f25a28d Regrab dvp only when ISDOTDOT.
Approved by:	re (scottl)
2005-07-09 13:52:49 +00:00
Jeff Roberson
8b3676f1a1 - Since we don't hold a usecount in pfs_exit we have to get a holdcnt
prior to calling vgone() to prevent any races.

Sponsored by:	Isilon Systems, Inc.
Approved by:	re (vfs blanket)
2005-07-07 07:33:10 +00:00
Peter Wemm
62919d788b Jumbo-commit to enhance 32 bit application support on 64 bit kernels.
This is good enough to be able to run a RELENG_4 gdb binary against
a RELENG_4 application, along with various other tools (eg: 4.x gcore).
We use this at work.

ia32_reg.[ch]: handle the 32 bit register file format, used by ptrace,
	procfs and core dumps.
procfs_*regs.c: vary the format of proc/XXX/*regs depending on the client
	and target application.
procfs_map.c: Don't print a 64 bit value to 32 bit consumers, or their
	sscanf fails.  They expect an unsigned long.
imgact_elf.c: produce a valid 32 bit coredump for 32 bit apps.
sys_process.c: handle 32 bit consumers debugging 32 bit targets.  Note
	that 64 bit consumers can still debug 32 bit targets.

IA64 has got stubs for ia32_reg.c.

Known limitations: a 5.x/6.x gdb uses get/setcontext(), which isn't
implemented in the 32/64 wrapper yet.  We also make a tiny patch to
gdb pacify it over conflicting formats of ld-elf.so.1.

Approved by:	re
2005-06-30 07:49:22 +00:00
Peter Wemm
2de92a386e Conditionally weaken sys_generic.c rev 1.136 to allow certain dubious
ioctl numbers in backwards compatability mode.  eg: an IOC_IN ioctl with
a size of zero.  Traditionally this was what you did before IOC_VOID
existed, and we had some established users of this in the tree, namely
procfs.  Certain 3rd party drivers with binary userland components also
have this too.

This is necessary to have 4.x and 5.x binaries use these ioctl's.  We
found this at work when trying to run 4.x binaries.

Approved by:	re
2005-06-30 00:19:08 +00:00
R. Imura
181fc3c6ea Avoid casting from (int *) to (size_t *) in order to fix udf_iconv on amd64.
Reviewed by:	scottl
MFC after:	2 weeks
2005-06-05 02:09:48 +00:00
Craig Rodrigues
fd225fe4a3 Do not declare a struct as extern, and then implement
it as static in the same file.  This is not legal C,
and GCC 4.0 will issue an error.

Reviewed by:	phk
Approved by:	das (mentor)
2005-05-31 14:50:49 +00:00
Christian Brueffer
befb7f333f Fix three typos in comments. Two of them obtained from OpenBSD.
MFC after:	3 days
2005-05-11 21:10:35 +00:00
Alexander Kabaev
42e1d99cc8 Do not dereference dvp pointer before doing a NULL check.
Noticed by: Coverity Prevent analysis tool.
2005-05-11 19:08:38 +00:00
Eric Anholt
1493ed4108 Staticize a symbol used only in this file.
PR:		kern/43613
Submitted by:	Matt Emmerton, matt at gsicomp dot on dot ca
2005-05-06 20:47:09 +00:00
Robert Drehmel
9c0c1ab87d The printf(9) `%p' conversion specifier puts an "0x" in
front of the pointer value.  Therefore, remove the "0x"
from the format string.
2005-05-06 00:15:57 +00:00
Robert Drehmel
e7aabf96a4 Fix our NTFS readdir function.
To check a directory's in-use bitmap bit by bit, we use
a pointer to an 8 bit wide unsigned value.

The index used to dereference this pointer is calculated
by shifting the bit index right 3 bits.  Then we do a
logical AND with the bit# represented by the lower 3
bits of the bit index.

This is an idiomatic way of iterating through a bit map
with simple bitwise operations.

This commit fixes the bug that we only checked bits
3:0 of each 8 bit chunk, because we only used bits 1:0
of the bit index for the bit# in the current 8 bit value.
This resulted in files not being returned by getdirentries(2).

Change the type of the bit map pointer from `char *' to
`u_int8_t *'.
2005-05-06 00:06:06 +00:00
Takanori Watanabe
1e8a69609e Fix breakage on alpha.
Pointed out by: hrs via IRC
2005-05-05 07:02:51 +00:00
Takanori Watanabe
4ebd3ea1f6 Make smbfs capable to use 16bit char set in filenames.
PR:78110
2005-05-04 15:05:46 +00:00
Jeff Roberson
d65736a1c0 - Set the v_object pointer after a successful VOP_OPEN(). This isn't a
perfect solution as the lower vm object can change at unpredictable times
   if our lower vp happens to be on another unionfs, etc.

Submitted by:	Oleg Sharoiko <os@rsu.ru>
2005-05-03 11:05:33 +00:00
Jeff Roberson
7b6b7657d2 - In devfs_open() and devfs_close() grab Giant if the driver sets NEEDGIANT.
We still have to DROP_GIANT and PICKUP_GIANT when NEEDGIANT is not set
   because vfs is still sometime entered with Giant held.
2005-05-01 00:56:34 +00:00
Dag-Erling Smørgrav
4cd27a97bc Fix an old pasto. 2005-04-30 16:27:20 +00:00
Jeff Roberson
cd360e947b - Mark devfs as MNTK_MPSAFE as I belive it does not require Giant.
Sponsored by:	Isilon Systems, Inc.
Agreed in principle by:		phk
2005-04-30 11:24:17 +00:00
Jeff Roberson
568556d720 - Fix several locking problems in unionfs_mount so that it will come
closer to passing DEBUG_VFS_LOCKS.
2005-04-27 09:07:13 +00:00
Jeff Roberson
189dd72df3 - Pass the ISOPEN flag down to our lower filesystems.
- Remove an erroneous VOP lock assert.
2005-04-27 09:06:06 +00:00
Jeff Roberson
7fd2deacb4 - As this is presently the one and only place where duplicate acquires of
the vnode interlock are allowed mark it by passing MTX_DUPOK to this
   lock operation only.

Sponsored by:	Isilon Systems, Inc.
2005-04-22 22:42:44 +00:00
David Schultz
23e8fcaf66 Disable negative name caching for msdosfs to work around a bug.
Since the name cache is case-sensitive and msdosfs isn't,
creating a file 'foo' won't invalidate a negative entry for 'FOO'.
There are similar problems related to 8.3 filenames.

A better solution is to override VOP_LOOKUP with a method that
canonicalizes the name, then calls vfs_cache_lookup().  Unfortunately,
it's not quite that simple because vfs_cache_lookup() will call
msdosfs_lookup() on a cache miss, and msdosfs_lookup() needs a way to
get at the original component name.
2005-04-16 23:47:19 +00:00
Nate Lawson
58ad326be6 Fix mbnambuf support for multi-byte characters. If a substring is larger
than WIN_CHARS bytes, we shift the suffix (previous substrings) upwards
by the amount this substring exceeds its WIN_CHARS slot.  Profiling shows
this change is indistinguishable from the previous code at 95% confidence.
This bug would result in attempts to access or create files or directories
with multi-byte characters returning an error but no data loss.

Reported and tested by:	avatar
MFC after:	3 days
2005-04-16 01:49:50 +00:00
Christian Brueffer
9f07f44971 Correct typo.
Obtained from:	OpenBSD
2005-04-14 14:40:09 +00:00
Jeff Roberson
4585e3ac5a - Change all filesystems and vfs_cache to relock the dvp once the child is
locked in the ISDOTDOT case.  Se vfs_lookup.c r1.79 for details.

Sponsored by:	Isilon Systems, Inc.
2005-04-13 10:59:09 +00:00
Jeff Roberson
8e82c4cd5f - Clear VI_OWEINACT before calling vget() with no lock type. We know
the node is actually already locked, and VOP_INACTIVE is not desirable
   in this case.
2005-04-11 11:17:20 +00:00
Jeff Roberson
316ec7bb7f - Honor the flags argument passed to null_root(). The filesystem below
us will decide whether or not to grab a real shared lock.
2005-04-11 11:16:29 +00:00
Xin LI
e8943128a9 Initialize vp before using it. Failing to do this can cause instant
panic when trying to access a file on mounted smbfs.

Submitted by:	takawata at jp freebsd org
2005-04-10 03:17:42 +00:00
Poul-Henning Kamp
f4b423ae60 Give msdosfs a unique inode number which is really the byteoffset of
the directory entry.

This solves the corruption problem I belive.

Regression test script by:	silby
2005-04-07 07:55:37 +00:00
Jeff Roberson
9370c333ce - Fix union's assumptions about when the dvp is unlocked. It is only
unlocked in the ISDOTDOT case now, not for all !ISLASTCN lookups.
2005-04-04 09:36:26 +00:00
Poul-Henning Kamp
f4f6abcb4e Explicitly hold a reference to the cdev we have just cloned. This
closes the race where the cdev was reclaimed before it ever made it
back to devfs lookup.
2005-03-31 12:19:44 +00:00
Poul-Henning Kamp
9477d73e32 cdev (still) needs per instance uid/gid/mode
Add unlocked version of dev_ref()

Clean up various stuff in sys/conf.h
2005-03-31 10:29:57 +00:00
Poul-Henning Kamp
eb151cb989 Rename dev_ref() to dev_refl() 2005-03-31 06:51:54 +00:00
Jeff Roberson
ea124bf597 - LK_NOPAUSE is a nop now.
Sponsored by:	Isilon Systems, Inc.
2005-03-31 04:27:49 +00:00
Jeff Roberson
da1c9cb2b5 - Remove wantparent, it is no longer necessary. An assert in vfs_lookup.c
prevents any callers from doing a modifying op without
   LOCKPARENT or WANTPARENT.
2005-03-29 13:09:42 +00:00
Jeff Roberson
fcc9c112cf - Remove wantparent, it is no longer necessary. An assert in vfs_lookup.c
prevents any callers from doing a DELETE or RENAME without locking
   the parent.
2005-03-29 13:04:00 +00:00
Jeff Roberson
5c5e51fd9a - cache_lookup() now locks the new vnode for us to prevent some races.
Remove redundant code.

Sponsored by:	Isilon Systems, Inc.
2005-03-29 13:00:37 +00:00
Jeff Roberson
654f669c9a - Correct the dprintf format int the _lookup routine.
Spotted by:	pjd
2005-03-28 14:26:01 +00:00
Jeff Roberson
e4fefa9bd5 - Garbage collect an unused variable. 2005-03-28 13:45:09 +00:00
Jeff Roberson
b2255473fb - Don't panic if we can't lock a child in lookup, return an error instead.
- Only unlock the directory if this is a DOTDOT lookup.  Previously this
   code could have deadlocked if there was a DOTDOT lookup with LOCKPARENT
   set and another thread was locking the other way up the tree.

Sponsored by:	Isilon Systems, Inc.
2005-03-28 13:39:16 +00:00
Jeff Roberson
e32addd40d - Remove unnecessary LOCKPARENT manipulation.
Sponsored by:	Isilon Systems, Inc.
2005-03-28 13:29:15 +00:00
Jeff Roberson
ce5846dc19 - nwfs_lookup() is no longer responsible for unlocking the dvp, this is
handled in vfs_lookup.c.  This code was missing PDIRUNLOCK use prior
   to the removal of PDIRUNLOCK in rev 1.73 of vfs_lookup.c.

Sponsored by:	Isilon Systems, Inc.
2005-03-28 09:46:33 +00:00
Jeff Roberson
7539637508 - hpfs_lookup() is no longer responsible for unlocking the dvp, this is
handled in vfs_lookup.c.  This code was missing PDIRUNLOCK use prior
   to the removal of PDIRUNLOCK in rev 1.73 of vfs_lookup.c.

Sponsored by:   Isilon Systems, Inc.
2005-03-28 09:40:59 +00:00
Jeff Roberson
eddcb03d02 - We no longer have to bother with PDIRUNLOCK, lookup() handles it for us.
Sponsored by:   Isilon Systems, Inc.
2005-03-28 09:34:36 +00:00
Jeff Roberson
27ad03cb5d - We no longer have to bother with PDIRUNLOCK, lookup() handles it for us.
- In the ISDOTDOT case we have to unlock the dvp before locking the child,
   if this fails we must relock dvp before returning an error.  This was
   missing before.

Sponsored by:	Isilon Systems, Inc.
2005-03-28 09:31:57 +00:00
Jeff Roberson
f6576f194e - We no longer have to bother with PDIRUNLOCK, lookup() handles it for us.
- Network filesystems are written with a special idiom that checks the
   cache first, and may even unlock dvp before discovering that a network
   round-trip is required to resolve the name.  I believe dvp is prevented
   from being recycled even in the forced unmount case by the shared lock
   on the mount point.  If not, this code should grow checks for VI_DOOMED
   after it relocks dvp or it will access NULL v_data fields.

Sponsored by:	Isilon Systems, Inc.
2005-03-28 09:29:58 +00:00
Jeff Roberson
7d2832e654 - Pass LK_EXCLUSIVE as the lock type to vget in vfs_hash_insert(). 2005-03-25 10:51:55 +00:00