Currently, pipe2 both closes the fds and releases references to the pipe
vnode on failure. However, closing the fds already causes the vnode
references to be dropped.
Make pipe2 only release the vnode references when the respective file_t
were not closed.
Found by syzkaller fuzzing.
The current mknodat code creates symlinks when requested. Not only does
this break POSIX, it also causes a kernel crash (NULL-deref on
tmpfs_readlink).
Refuse to create symlinks with mknodat.
Found by syzkaller fuzzing.
In preparation for printing file+function names in backtraces, add
support for generating and linking three tables into the kernel:
- dbg_sym_table: a table consisting of <uint32_t addr_offset, uint32_t
function_name_offset, uint32_t file_name_offset>, being ordered by
offset.
- dbg_fn_name_table: a table consisting of packed NULL terminated
strings, which the dbg_sym_table points into.
- dbg_file_name_table: a table consisting of packed NULL terminated
strings, which the dbg_sym_table points into.
Current tcp senders can wait forever for buffer space as POLLOUT is not
signaled when transmitting data. Signal POLLOUT when transmitting out of
a full tx buffer.
The current kcov code attaches a kcov object to the thread which opened
it. This is not desirable, as syzkaller opens /dev/kcov in a parent
process and passes it down to the child.
Move the thread attachment from open() time to start time.
An oversight on vnode inactivation when the last reference was a dirty
page causes a NULL-deref due to VOP_RELEASE set-NULL behavior.
Use a temporary variable in this case as the backing can still be
accesed by a truncation on vnode inactive.
mm: added last_pagefault handling when mm_space_t is unmapped
mm: fixed styling inconsistencies, fixed last pagefault range removal
mm: fix unitialized last_pagefault member in slab data
Implement a device (/dev/kcov) that exposes coverage info for the
kernel. This will be especially useful for coverage-based fuzzing (e.g.
syzkaller).
Exclude a lot of functions which would crash/otherwise interfere in the
coverage, including only processing coverage callbacks when not handling
an irq.
Currently, with IPL_IGNORE, tlb shootdown is not being treated as an
irq and thus does not contribute to the irq depth. Move it to the
highest possible IPL.
Add a way of checking if a cpu is in the middle of handling an irq and
how deep it is into it. This will allow for future code to conditionally
run only in/outside interrupts.
mm_fork_context() currently maps shared chdev mappings 1:1 when forking
a range. The issue with this approach is that chdev mappings are not
guaranteed to be backed by physical memory, and thus cannot safely be
refcounted. This can lead to issues on devices with more complex buffer
lifetimes.
To allow for internal book-keeping, do not map shared chdev memory on
fork and instead allow it to go through the entire fault-in process
again.
The SMP code exposes that a cpu woke up before it is properly
initialized in sched_ap_entry(). Fix this by initializing it first,
exposing it and then stopping the bootstrap thread.
Prevent the load balancer from balancing when running uniprocessor
machines and when not all CPUs are online yet.
This prevents a race between ap initialization and load balancing.
For some usecases, silencing syscall_print()s is ideal. A good example
of that is syzkaller, which uses logs to detect crashes and a badly
timed syscall_print() could interfere.
Add a nouserprint argument which skips printing on syscall_print().
The current devfs code requires registered devices to have a name on
creation. This makes temporary/hidden devices like pty master ends
appear for a split second on the devfs tree.
Add a way of registering/removing devfs nodes which do not have a name
on the tree.
The tty_unregister code removes the tty's vnode from the devfs mappings.
This causes a reference to be dropped, which can then cause the tty to
be freed and the remaining code in tty_unregister does a UAF.
Fix this by holding a reference across the unregister operation.
Matheus