From owner-svn-src-head@FreeBSD.ORG Mon Jan 11 20:44:05 2010 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D641E106566C; Mon, 11 Jan 2010 20:44:05 +0000 (UTC) (envelope-from mckusick@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id C38328FC08; Mon, 11 Jan 2010 20:44:05 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o0BKi5iY071241; Mon, 11 Jan 2010 20:44:05 GMT (envelope-from mckusick@svn.freebsd.org) Received: (from mckusick@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o0BKi5s3071234; Mon, 11 Jan 2010 20:44:05 GMT (envelope-from mckusick@svn.freebsd.org) Message-Id: <201001112044.o0BKi5s3071234@svn.freebsd.org> From: Kirk McKusick Date: Mon, 11 Jan 2010 20:44:05 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r202113 - in head/sys: compat/linux kern sys ufs/ffs ufs/ufs X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jan 2010 20:44:05 -0000 Author: mckusick Date: Mon Jan 11 20:44:05 2010 New Revision: 202113 URL: http://svn.freebsd.org/changeset/base/202113 Log: Background: When renaming a directory it passes through several intermediate states. First its new name will be created causing it to have two names (from possibly different parents). Next, if it has different parents, its value of ".." will be changed from pointing to the old parent to pointing to the new parent. Concurrently, its old name will be removed bringing it back into a consistent state. When fsck encounters an extra name for a directory, it offers to remove the "extraneous hard link"; when it finds that the names have been changed but the update to ".." has not happened, it offers to rewrite ".." to point at the correct parent. Both of these changes were considered unexpected so would cause fsck in preen mode or fsck in background mode to fail with the need to run fsck manually to fix these problems. Fsck running in preen mode or background mode now corrects these expected inconsistencies that arise during directory rename. The functionality added with this update is used by fsck running in background mode to make these fixes. Solution: This update adds three new fsck sysctl commands to support background fsck in correcting expected inconsistencies that arise from incomplete directory rename operations. They are: setcwd(dirinode) - set the current directory to dirinode in the filesystem associated with the snapshot. setdotdot(oldvalue, newvalue) - Verify that the inode number for ".." in the current directory is oldvalue then change it to newvalue. unlink(nameptr, oldvalue) - Verify that the inode number associated with nameptr in the current directory is oldvalue then unlink it. As with all other fsck sysctls, these new ones may only be used by processes with appropriate priviledge. Reported by: jeff Security issues: rwatson Modified: head/sys/compat/linux/linux_file.c head/sys/kern/vfs_syscalls.c head/sys/sys/syscallsubr.h head/sys/ufs/ffs/ffs_alloc.c head/sys/ufs/ffs/fs.h head/sys/ufs/ufs/ufs_lookup.c Modified: head/sys/compat/linux/linux_file.c ============================================================================== --- head/sys/compat/linux/linux_file.c Mon Jan 11 20:32:51 2010 (r202112) +++ head/sys/compat/linux/linux_file.c Mon Jan 11 20:44:05 2010 (r202113) @@ -652,7 +652,7 @@ linux_unlinkat(struct thread *td, struct if (args->flag & LINUX_AT_REMOVEDIR) error = kern_rmdirat(td, dfd, path, UIO_SYSSPACE); else - error = kern_unlinkat(td, dfd, path, UIO_SYSSPACE); + error = kern_unlinkat(td, dfd, path, UIO_SYSSPACE, 0); if (error == EPERM && !(args->flag & LINUX_AT_REMOVEDIR)) { /* Introduce POSIX noncompliant behaviour of Linux */ if (kern_statat(td, AT_SYMLINK_NOFOLLOW, dfd, path, Modified: head/sys/kern/vfs_syscalls.c ============================================================================== --- head/sys/kern/vfs_syscalls.c Mon Jan 11 20:32:51 2010 (r202112) +++ head/sys/kern/vfs_syscalls.c Mon Jan 11 20:44:05 2010 (r202113) @@ -1815,23 +1815,25 @@ unlinkat(struct thread *td, struct unlin if (flag & AT_REMOVEDIR) return (kern_rmdirat(td, fd, path, UIO_USERSPACE)); else - return (kern_unlinkat(td, fd, path, UIO_USERSPACE)); + return (kern_unlinkat(td, fd, path, UIO_USERSPACE, 0)); } int kern_unlink(struct thread *td, char *path, enum uio_seg pathseg) { - return (kern_unlinkat(td, AT_FDCWD, path, pathseg)); + return (kern_unlinkat(td, AT_FDCWD, path, pathseg, 0)); } int -kern_unlinkat(struct thread *td, int fd, char *path, enum uio_seg pathseg) +kern_unlinkat(struct thread *td, int fd, char *path, enum uio_seg pathseg, + ino_t oldinum) { struct mount *mp; struct vnode *vp; int error; struct nameidata nd; + struct stat sb; int vfslocked; restart: @@ -1842,9 +1844,13 @@ restart: return (error == EINVAL ? EPERM : error); vfslocked = NDHASGIANT(&nd); vp = nd.ni_vp; - if (vp->v_type == VDIR) + if (vp->v_type == VDIR && oldinum == 0) { error = EPERM; /* POSIX */ - else { + } else if (oldinum != 0 && + ((error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td)) == 0) && + sb.st_ino != oldinum) { + error = EIDRM; /* Identifier removed */ + } else { /* * The root of a mounted filesystem cannot be deleted. * Modified: head/sys/sys/syscallsubr.h ============================================================================== --- head/sys/sys/syscallsubr.h Mon Jan 11 20:32:51 2010 (r202112) +++ head/sys/sys/syscallsubr.h Mon Jan 11 20:44:05 2010 (r202113) @@ -212,7 +212,7 @@ int kern_truncate(struct thread *td, cha off_t length); int kern_unlink(struct thread *td, char *path, enum uio_seg pathseg); int kern_unlinkat(struct thread *td, int fd, char *path, - enum uio_seg pathseg); + enum uio_seg pathseg, ino_t oldinum); int kern_utimes(struct thread *td, char *path, enum uio_seg pathseg, struct timeval *tptr, enum uio_seg tptrseg); int kern_utimesat(struct thread *td, int fd, char *path, Modified: head/sys/ufs/ffs/ffs_alloc.c ============================================================================== --- head/sys/ufs/ffs/ffs_alloc.c Mon Jan 11 20:32:51 2010 (r202112) +++ head/sys/ufs/ffs/ffs_alloc.c Mon Jan 11 20:44:05 2010 (r202113) @@ -69,6 +69,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include #include @@ -76,9 +77,13 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include +#include + +#include #include #include #include @@ -2328,7 +2333,7 @@ ffs_fserr(fs, inum, cp) /* * This function provides the capability for the fsck program to - * update an active filesystem. Eleven operations are provided: + * update an active filesystem. Fourteen operations are provided: * * adjrefcnt(inode, amt) - adjusts the reference count on the * specified inode by the specified amount. Under normal @@ -2349,6 +2354,12 @@ ffs_fserr(fs, inum, cp) * as in use. * setflags(flags, set/clear) - the fs_flags field has the specified * flags set (second parameter +1) or cleared (second parameter -1). + * setcwd(dirinode) - set the current directory to dirinode in the + * filesystem associated with the snapshot. + * setdotdot(oldvalue, newvalue) - Verify that the inode number for ".." + * in the current directory is oldvalue then change it to newvalue. + * unlink(nameptr, oldvalue) - Verify that the inode number associated + * with nameptr in the current directory is oldvalue then unlink it. */ static int sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS); @@ -2386,6 +2397,15 @@ static SYSCTL_NODE(_vfs_ffs, FFS_BLK_FRE static SYSCTL_NODE(_vfs_ffs, FFS_SET_FLAGS, setflags, CTLFLAG_WR, sysctl_ffs_fsck, "Change Filesystem Flags"); +static SYSCTL_NODE(_vfs_ffs, FFS_SET_CWD, setcwd, CTLFLAG_WR, + sysctl_ffs_fsck, "Set Current Working Directory"); + +static SYSCTL_NODE(_vfs_ffs, FFS_SET_DOTDOT, setdotdot, CTLFLAG_WR, + sysctl_ffs_fsck, "Change Value of .. Entry"); + +static SYSCTL_NODE(_vfs_ffs, FFS_UNLINK, unlink, CTLFLAG_WR, + sysctl_ffs_fsck, "Unlink a Duplicate Name"); + #ifdef DEBUG static int fsckcmds = 0; SYSCTL_INT(_debug, OID_AUTO, fsckcmds, CTLFLAG_RW, &fsckcmds, 0, ""); @@ -2394,16 +2414,18 @@ SYSCTL_INT(_debug, OID_AUTO, fsckcmds, C static int sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) { + struct thread *td = curthread; struct fsck_cmd cmd; struct ufsmount *ump; - struct vnode *vp; - struct inode *ip; + struct vnode *vp, *vpold, *dvp, *fdvp; + struct inode *ip, *dp; struct mount *mp; struct fs *fs; ufs2_daddr_t blkno; long blkcnt, blksize; + struct filedesc *fdp; struct file *fp; - int filetype, error; + int vfslocked, filetype, error; if (req->newlen > sizeof cmd) return (EBADRPC); @@ -2413,15 +2435,20 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) return (ERPCMISMATCH); if ((error = getvnode(curproc->p_fd, cmd.handle, &fp)) != 0) return (error); - vn_start_write(fp->f_data, &mp, V_WAIT); + vp = fp->f_data; + if (vp->v_type != VREG && vp->v_type != VDIR) { + fdrop(fp, td); + return (EINVAL); + } + vn_start_write(vp, &mp, V_WAIT); if (mp == 0 || strncmp(mp->mnt_stat.f_fstypename, "ufs", MFSNAMELEN)) { vn_finished_write(mp); - fdrop(fp, curthread); + fdrop(fp, td); return (EINVAL); } if (mp->mnt_flag & MNT_RDONLY) { vn_finished_write(mp); - fdrop(fp, curthread); + fdrop(fp, td); return (EROFS); } ump = VFSTOUFS(mp); @@ -2553,6 +2580,7 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) #endif /* DEBUG */ fs->fs_cstotal.cs_ndir += cmd.value; break; + case FFS_ADJ_NBFREE: #ifdef DEBUG if (fsckcmds) { @@ -2562,6 +2590,7 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) #endif /* DEBUG */ fs->fs_cstotal.cs_nbfree += cmd.value; break; + case FFS_ADJ_NIFREE: #ifdef DEBUG if (fsckcmds) { @@ -2571,6 +2600,7 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) #endif /* DEBUG */ fs->fs_cstotal.cs_nifree += cmd.value; break; + case FFS_ADJ_NFFREE: #ifdef DEBUG if (fsckcmds) { @@ -2580,6 +2610,7 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) #endif /* DEBUG */ fs->fs_cstotal.cs_nffree += cmd.value; break; + case FFS_ADJ_NUMCLUSTERS: #ifdef DEBUG if (fsckcmds) { @@ -2590,6 +2621,91 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) fs->fs_cstotal.cs_numclusters += cmd.value; break; + case FFS_SET_CWD: +#ifdef DEBUG + if (fsckcmds) { + printf("%s: set current directory to inode %jd\n", + mp->mnt_stat.f_mntonname, (intmax_t)cmd.value); + } +#endif /* DEBUG */ + if ((error = ffs_vget(mp, (ino_t)cmd.value, LK_SHARED, &vp))) + break; + vfslocked = VFS_LOCK_GIANT(vp->v_mount); + AUDIT_ARG_VNODE1(vp); + if ((error = change_dir(vp, td)) != 0) { + vput(vp); + VFS_UNLOCK_GIANT(vfslocked); + break; + } + VOP_UNLOCK(vp, 0); + VFS_UNLOCK_GIANT(vfslocked); + fdp = td->td_proc->p_fd; + FILEDESC_XLOCK(fdp); + vpold = fdp->fd_cdir; + fdp->fd_cdir = vp; + FILEDESC_XUNLOCK(fdp); + vfslocked = VFS_LOCK_GIANT(vpold->v_mount); + vrele(vpold); + VFS_UNLOCK_GIANT(vfslocked); + break; + + case FFS_SET_DOTDOT: +#ifdef DEBUG + if (fsckcmds) { + printf("%s: change .. in cwd from %jd to %jd\n", + mp->mnt_stat.f_mntonname, (intmax_t)cmd.value, + (intmax_t)cmd.size); + } +#endif /* DEBUG */ + /* + * First we have to get and lock the parent directory + * to which ".." points. + */ + error = ffs_vget(mp, (ino_t)cmd.value, LK_EXCLUSIVE, &fdvp); + if (error) + break; + /* + * Now we get and lock the child directory containing "..". + */ + FILEDESC_SLOCK(td->td_proc->p_fd); + dvp = td->td_proc->p_fd->fd_cdir; + FILEDESC_SUNLOCK(td->td_proc->p_fd); + if ((error = vget(dvp, LK_EXCLUSIVE, td)) != 0) { + vput(fdvp); + break; + } + dp = VTOI(dvp); + dp->i_offset = 12; /* XXX mastertemplate.dot_reclen */ + error = ufs_dirrewrite(dp, VTOI(fdvp), (ino_t)cmd.size, + DT_DIR, 0); + cache_purge(fdvp); + cache_purge(dvp); + vput(dvp); + vput(fdvp); + break; + + case FFS_UNLINK: +#ifdef DEBUG + if (fsckcmds) { + char buf[32]; + + if (copyinstr((char *)(int)cmd.value, buf, 32, NULL)) + strncpy(buf, "Name_too_long", 32); + printf("%s: unlink %s (inode %jd)\n", + mp->mnt_stat.f_mntonname, buf, (intmax_t)cmd.size); + } +#endif /* DEBUG */ + /* + * kern_unlinkat will do its own start/finish writes and + * they do not nest, so drop ours here. Setting mp == NULL + * indicates that vn_finished_write is not needed down below. + */ + vn_finished_write(mp); + mp = NULL; + error = kern_unlinkat(td, AT_FDCWD, (char *)(int)cmd.value, + UIO_USERSPACE, (ino_t)cmd.size); + break; + default: #ifdef DEBUG if (fsckcmds) { @@ -2601,7 +2717,7 @@ sysctl_ffs_fsck(SYSCTL_HANDLER_ARGS) break; } - fdrop(fp, curthread); + fdrop(fp, td); vn_finished_write(mp); return (error); } Modified: head/sys/ufs/ffs/fs.h ============================================================================== --- head/sys/ufs/ffs/fs.h Mon Jan 11 20:32:51 2010 (r202112) +++ head/sys/ufs/ffs/fs.h Mon Jan 11 20:44:05 2010 (r202113) @@ -211,7 +211,10 @@ #define FFS_ADJ_NIFREE 9 /* adjust number of free inodes */ #define FFS_ADJ_NFFREE 10 /* adjust number of free frags */ #define FFS_ADJ_NUMCLUSTERS 11 /* adjust number of free clusters */ -#define FFS_MAXID 12 /* number of valid ffs ids */ +#define FFS_SET_CWD 12 /* set current directory */ +#define FFS_SET_DOTDOT 13 /* set inode number for ".." */ +#define FFS_UNLINK 14 /* remove a name in the filesystem */ +#define FFS_MAXID 15 /* number of valid ffs ids */ /* * Command structure passed in to the filesystem to adjust filesystem values. Modified: head/sys/ufs/ufs/ufs_lookup.c ============================================================================== --- head/sys/ufs/ufs/ufs_lookup.c Mon Jan 11 20:32:51 2010 (r202112) +++ head/sys/ufs/ufs/ufs_lookup.c Mon Jan 11 20:44:05 2010 (r202113) @@ -1224,6 +1224,11 @@ ufs_dirrewrite(dp, oip, newinum, newtype error = UFS_BLKATOFF(vdp, (off_t)dp->i_offset, (char **)&ep, &bp); if (error) return (error); + if (ep->d_namlen == 2 && ep->d_name[1] == '.' && ep->d_name[0] == '.' && + ep->d_ino != oip->i_number) { + brelse(bp); + return (EIDRM); + } ep->d_ino = newinum; if (!OFSFMT(vdp)) ep->d_type = newtype;