From owner-svn-src-head@freebsd.org Thu Mar 19 15:39:46 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 46DBA262A9F; Thu, 19 Mar 2020 15:39:46 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 48jrgk00svz4THf; Thu, 19 Mar 2020 15:39:46 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A7C46D21C; Thu, 19 Mar 2020 15:39:45 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 02JFdjD4082093; Thu, 19 Mar 2020 15:39:45 GMT (envelope-from markj@FreeBSD.org) Received: (from markj@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 02JFdjlH082092; Thu, 19 Mar 2020 15:39:45 GMT (envelope-from markj@FreeBSD.org) Message-Id: <202003191539.02JFdjlH082092@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: markj set sender to markj@FreeBSD.org using -f From: Mark Johnston Date: Thu, 19 Mar 2020 15:39:45 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r359132 - head/sys/kern X-SVN-Group: head X-SVN-Commit-Author: markj X-SVN-Commit-Paths: head/sys/kern X-SVN-Commit-Revision: 359132 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Mar 2020 15:39:46 -0000 Author: markj Date: Thu Mar 19 15:39:45 2020 New Revision: 359132 URL: https://svnweb.freebsd.org/changeset/base/359132 Log: Enter a write sequence when updating rights. The Capsicum system calls modify file descriptor table entries. To ensure that readers observe a consistent snapshot of descriptor writes, the system calls need to signal to unlocked readers that an update is pending. Note that ioctl rights are always checked with the descriptor table lock held, so it is not strictly necessary to signal unlocked readers. However, we probably want to enable lockless ioctl checks eventually, so use seqc_write_begin() in kern_cap_ioctls_limit() too. Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D24119 Modified: head/sys/kern/sys_capability.c Modified: head/sys/kern/sys_capability.c ============================================================================== --- head/sys/kern/sys_capability.c Thu Mar 19 14:37:28 2020 (r359131) +++ head/sys/kern/sys_capability.c Thu Mar 19 15:39:45 2020 (r359132) @@ -234,6 +234,7 @@ kern_cap_rights_limit(struct thread *td, int fd, cap_r { struct filedesc *fdp; struct filedescent *fdep; + u_long *ioctls; int error; fdp = td->td_proc->p_fd; @@ -243,18 +244,22 @@ kern_cap_rights_limit(struct thread *td, int fd, cap_r FILEDESC_XUNLOCK(fdp); return (EBADF); } + ioctls = NULL; error = _cap_check(cap_rights(fdp, fd), rights, CAPFAIL_INCREASE); if (error == 0) { + seqc_write_begin(&fdep->fde_seqc); fdep->fde_rights = *rights; if (!cap_rights_is_set(rights, CAP_IOCTL)) { - free(fdep->fde_ioctls, M_FILECAPS); + ioctls = fdep->fde_ioctls; fdep->fde_ioctls = NULL; fdep->fde_nioctls = 0; } if (!cap_rights_is_set(rights, CAP_FCNTL)) fdep->fde_fcntls = 0; + seqc_write_end(&fdep->fde_seqc); } FILEDESC_XUNLOCK(fdp); + free(ioctls, M_FILECAPS); return (error); } @@ -439,8 +444,10 @@ kern_cap_ioctls_limit(struct thread *td, int fd, u_lon goto out; ocmds = fdep->fde_ioctls; + seqc_write_begin(&fdep->fde_seqc); fdep->fde_ioctls = cmds; fdep->fde_nioctls = ncmds; + seqc_write_end(&fdep->fde_seqc); cmds = ocmds; error = 0; @@ -597,7 +604,9 @@ sys_cap_fcntls_limit(struct thread *td, struct cap_fcn return (ENOTCAPABLE); } + seqc_write_begin(&fdep->fde_seqc); fdep->fde_fcntls = fcntlrights; + seqc_write_end(&fdep->fde_seqc); FILEDESC_XUNLOCK(fdp); return (0);