Current tcp senders can wait forever for buffer space as POLLOUT is not
signaled when transmitting data. Signal POLLOUT when transmitting out of
a full tx buffer.
The current kcov code attaches a kcov object to the thread which opened
it. This is not desirable, as syzkaller opens /dev/kcov in a parent
process and passes it down to the child.
Move the thread attachment from open() time to start time.
An oversight on vnode inactivation when the last reference was a dirty
page causes a NULL-deref due to VOP_RELEASE set-NULL behavior.
Use a temporary variable in this case as the backing can still be
accesed by a truncation on vnode inactive.
mm: added last_pagefault handling when mm_space_t is unmapped
mm: fixed styling inconsistencies, fixed last pagefault range removal
mm: fix unitialized last_pagefault member in slab data
Implement a device (/dev/kcov) that exposes coverage info for the
kernel. This will be especially useful for coverage-based fuzzing (e.g.
syzkaller).
Exclude a lot of functions which would crash/otherwise interfere in the
coverage, including only processing coverage callbacks when not handling
an irq.
Currently, with IPL_IGNORE, tlb shootdown is not being treated as an
irq and thus does not contribute to the irq depth. Move it to the
highest possible IPL.
Add a way of checking if a cpu is in the middle of handling an irq and
how deep it is into it. This will allow for future code to conditionally
run only in/outside interrupts.
mm_fork_context() currently maps shared chdev mappings 1:1 when forking
a range. The issue with this approach is that chdev mappings are not
guaranteed to be backed by physical memory, and thus cannot safely be
refcounted. This can lead to issues on devices with more complex buffer
lifetimes.
To allow for internal book-keeping, do not map shared chdev memory on
fork and instead allow it to go through the entire fault-in process
again.
The SMP code exposes that a cpu woke up before it is properly
initialized in sched_ap_entry(). Fix this by initializing it first,
exposing it and then stopping the bootstrap thread.
Prevent the load balancer from balancing when running uniprocessor
machines and when not all CPUs are online yet.
This prevents a race between ap initialization and load balancing.
For some usecases, silencing syscall_print()s is ideal. A good example
of that is syzkaller, which uses logs to detect crashes and a badly
timed syscall_print() could interfere.
Add a nouserprint argument which skips printing on syscall_print().
The current devfs code requires registered devices to have a name on
creation. This makes temporary/hidden devices like pty master ends
appear for a split second on the devfs tree.
Add a way of registering/removing devfs nodes which do not have a name
on the tree.
The tty_unregister code removes the tty's vnode from the devfs mappings.
This causes a reference to be dropped, which can then cause the tty to
be freed and the remaining code in tty_unregister does a UAF.
Fix this by holding a reference across the unregister operation.
Matheus