d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fcntl: fix overflow when setting F_READAHEAD

Browse Source 
VOP_READ and VOP_WRITE take the seqcount in blocks in a 16-bit field.
However, fcntl allows you to set the seqcount in bytes to any nonnegative
31-bit value. The result can be a 16-bit overflow, which will be
sign-extended in functions like ffs_read. Fix this by sanitizing the
argument in kern_fcntl. As a matter of policy, limit to IO_SEQMAX rather
than INT16_MAX.

Also, fifos have overloaded the f_seqcount field for a completely different
purpose ever since r238936.  Formalize that by using a union type.

Reviewed by:	cem
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D20710
This commit is contained in:
Alan Somers 2019-06-20 23:07:20 +00:00
parent 68035f6381
commit 38b06f8ac4
5 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/fs/fifofs/fifo_vnops.c
View File

@ -174,7 +174,7 @@ fifo_open(ap)
if (fip->fi_writers > 0)
wakeup(&fip->fi_writers);
}
fp->f_seqcount = fpipe->pipe_wgen - fip->fi_writers;
fp->f_pipegen = fpipe->pipe_wgen - fip->fi_writers;
}
if (ap->a_mode & FWRITE) {
if ((ap->a_mode & O_NONBLOCK) && fip->fi_readers == 0) {

4
sys/kern/kern_descrip.c
View File

@ -780,7 +780,9 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_t arg)
}
if (arg >= 0) {
bsize = fp->f_vnode->v_mount->mnt_stat.f_iosize;
fp->f_seqcount = (arg + bsize - 1) / bsize;
arg = MIN(arg, INT_MAX - bsize + 1);
fp->f_seqcount = MIN(IO_SEQMAX,
(arg + bsize - 1) / bsize);
atomic_set_int(&fp->f_flag, FRDAHEAD);
} else {
atomic_clear_int(&fp->f_flag, FRDAHEAD);

2
sys/kern/sys_pipe.c
View File

@ -1414,7 +1414,7 @@ pipe_poll(struct file *fp, int events, struct ucred *active_cred,
levents = events &
(POLLIN | POLLINIGNEOF | POLLPRI | POLLRDNORM | POLLRDBAND);
if (rpipe->pipe_state & PIPE_NAMED && fp->f_flag & FREAD && levents &&
fp->f_seqcount == rpipe->pipe_wgen)
fp->f_pipegen == rpipe->pipe_wgen)
events |= POLLINIGNEOF;
if ((events & POLLINIGNEOF) == 0) {

3
sys/kern/vfs_vnops.c
View File

@ -499,7 +499,8 @@ sequential_heuristic(struct uio *uio, struct file *fp)
* closely related to the best I/O size for real disks than
* to any block size used by software.
*/
fp->f_seqcount += howmany(uio->uio_resid, 16384);
fp->f_seqcount += MIN(IO_SEQMAX,
howmany(uio->uio_resid, 16384));
if (fp->f_seqcount > IO_SEQMAX)
fp->f_seqcount = IO_SEQMAX;
return (fp->f_seqcount << IO_SEQSHIFT);

5
sys/sys/file.h
View File

@ -179,7 +179,10 @@ struct file {
/*
* DTYPE_VNODE specific fields.
*/
int f_seqcount; /* (a) Count of sequential accesses. */
union {
int16_t f_seqcount; /* (a) Count of sequential accesses. */
int f_pipegen;
};
off_t f_nextoff; /* next expected read/write offset. */
union {
struct cdev_privdata *fvn_cdevpriv;