unix: Fix a socket leak
When connecting a unix domain stream socket, we
1. look up the peer (listening) socket,
2. allocate a new socket
3. add the new socket to the listening socket's queue
Prior to commit 26147c51546e, this sequence of operations was
synchronized by a pool mutex, also acquired in uipc_close().
After commit 26147c51546e, we drop the vnode pool lock immediately after
finding the peer socket via a filesystem lookup. This creates a window
where it's possible for a connection to add a new socket to the
listening queue after the listening queue has been aborted.
Fix the race by restoring the old behaviour of holding the pool lock
across the solisten_enqueue() call. This is a bit ugly since we need to
pass a mutex lock and a vnode through a couple of layers, but it seems
like a low-risk solution. Alternately we could add some flag to the
[8 lines not shown]
nullfs: Allow VSOCK to be mounted on top of another VSOCK
In the world of containers, mounting a unix(4) socket is a common
practice to allow communication between processes within containers.
For example, both Podman and Docker can expose a unix(4) socket,
and that same unix(4) socket can be mounted as a file accessible
to a process inside a container, allowing that application to control
Podman or Docker. Another example is PHP-FPM with NGINX, where,
instead of using TCP/IP for communication between containers, a
unix(4) socket is sufficient.
However, nullfs(4) and all related components do not allow mounting
a VSOCK on top of another. The current workaround involves creating
the socket in a directory and mounting that directory. This is an
option, though it does not provide a good user experience compared
to directly mounting a VSOCK on top of another, since the application
that creates the socket may create other sockets in that directory,
and the user may not wish to share them, or, worse yet, applications
that create unix(4) sockets may not provide any authentication at
[7 lines not shown]
iflib: Initialize the VFLR task unconditionally
The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths. ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task. Even with MSI-X, the admin
interrupt was established before the task was initialized.
Initialize it alongside the other private tasks. The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.
Sponsored by: BBOX.io
(cherry picked from commit b4208a67edc2eb7898a9ff2a6f3990c6852910e4)
iflib: Add an admin task detach fail point
Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.
Use a bounded delay to keep the task active while detach enters the
taskqueue drain. Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().
Reviewed by: gallatin, kgalazka
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58720
(cherry picked from commit ac56d36007a5a1a01fe69df370f272060e852e0b)
iflib: Drain configuration tasks before interface detach
iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change. This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.
Drain the entire private taskqueue before ether_ifdetach(). Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.
Differential Revision: https://reviews.freebsd.org/D58452
Co-authored-by: Andrew Gallatin <gallatin at FreeBSD.org>
Co-authored-by: Kevin Bowling <kbowling at FreeBSD.org>
(cherry picked from commit ba353c8950d575f9d15b82c92658e660935fba25)
iflib: Add registration failure injection points
Add six device-scoped fail(9) points at the registration milestones
needed to exercise each unwind path. An exact, runtime-only device
selector prevents unrelated iflib devices from consuming an armed point.
Mark the points non-sleepable because registration holds the ifnet and
context locks. Document one-shot operation and bus-address reprobe so a
failed attach can be recovered without another kernel build.
Reviewed by: gallatin
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58722
(cherry picked from commit 90e7dbe5e2ca47baff4e4c6d9e892a0554eec4db)
iflib: Complete registration failure cleanup
Pre-attach sysctls contain pointers into the iflib context. Any later
registration failure that frees the context must first remove that
sysctl tree.
Failures after a successful IFDI_ATTACH_PRE also did not consistently
call IFDI_DETACH or free the private taskqueue. In particular, routing
a taskqueue creation failure through the context cleanup could free the
driver softc while resources allocated by attach_pre remained live.
Track successful interrupt and queue setup and use one common unwind
path. Invoke IFDI_DETACH with IFNET_WLOCK dropped and release only
resources whose setup completed. Leave a failed IFDI_ATTACH_PRE to
unwind its own partial state, as required by the existing driver
contract.
A failed post-attach can follow driver registration of an SR-IOV
schema. Remove that registration before detaching the interface and
[30 lines not shown]
iflib: drain admin task and fix teardown order on register failure
When IFDI_ATTACH_POST() fails (or netmap attach fails), iflib tears down with
ether_ifdetach(), taskqueue_free(ifc_tq), and IFDI_DETACH(). CTX_LOCK is still
held after ether_ifattach. ether_ifdetach() and taskqueue_drain(admin) must not
run under CTX_LOCK.
Teardown ordering (match iflib_device_deregister):
- Free the per-interface admin taskqueue after IFDI_DETACH / IFDI_QUEUES_FREE, not before.
- Drop IFNET_WLOCK() across IFDI_DETACH / IFDI_QUEUES_FREE so driver detach can sleep in
LinuxKPI workqueue drain, then retake IFNET_WLOCK() before iflib_free_intr_mem and fail_unlock.
Reviewed by: gallatin, kgalazka, #iflib
Differential Revision: https://reviews.freebsd.org/D56316
(cherry picked from commit 439132310ae1f623f6c0a3dc241d0a34e98e040b)
iflib: Fix panic observed while doing sysctl -a with if_bnxt unload
Observed below kernel panic calltrace while performing sysctl -a
operation while unloading the if_bnxt driver,
Fatal trap 9: general protection fault while in kernel mode
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe02a7569940
vpanic() at vpanic+0x136/frame 0xfffffe02a7569a70
panic() at panic+0x43/frame 0xfffffe02a7569ad0
trap_fatal() at trap_fatal+0x68/frame 0xfffffe02a7569af0
calltrap() at calltrap+0x8/frame 0xfffffe02a7569af0
trap 0x9, rip = 0xffffffff80c0b411, rsp = 0xfffffe02a7569bc0, rbp = 0xfffffe02a7569be0 ---
sysctl_handle_counter_u64() at sysctl_handle_counter_u64+0x61/frame 0xfffffe02a7569be0
sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe02a7569c30
sysctl_root() at sysctl_root+0x22f/frame 0xfffffe02a7569cb0
userland_sysctl() at userland_sysctl+0x196/frame 0xfffffe02a7569d50
[23 lines not shown]
iflib: Initialize the VFLR task unconditionally
The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths. ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task. Even with MSI-X, the admin
interrupt was established before the task was initialized.
Initialize it alongside the other private tasks. The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.
Sponsored by: BBOX.io
(cherry picked from commit b4208a67edc2eb7898a9ff2a6f3990c6852910e4)
iflib: Add an admin task detach fail point
Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.
Use a bounded delay to keep the task active while detach enters the
taskqueue drain. Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().
Reviewed by: gallatin, kgalazka
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58720
(cherry picked from commit ac56d36007a5a1a01fe69df370f272060e852e0b)
iflib: Drain configuration tasks before interface detach
iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change. This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.
Drain the entire private taskqueue before ether_ifdetach(). Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.
Differential Revision: https://reviews.freebsd.org/D58452
Co-authored-by: Andrew Gallatin <gallatin at FreeBSD.org>
Co-authored-by: Kevin Bowling <kbowling at FreeBSD.org>
(cherry picked from commit ba353c8950d575f9d15b82c92658e660935fba25)
iflib: Add registration failure injection points
Add six device-scoped fail(9) points at the registration milestones
needed to exercise each unwind path. An exact, runtime-only device
selector prevents unrelated iflib devices from consuming an armed point.
Mark the points non-sleepable because registration holds the ifnet and
context locks. Document one-shot operation and bus-address reprobe so a
failed attach can be recovered without another kernel build.
Reviewed by: gallatin
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58722
(cherry picked from commit 90e7dbe5e2ca47baff4e4c6d9e892a0554eec4db)
iflib: Complete registration failure cleanup
Pre-attach sysctls contain pointers into the iflib context. Any later
registration failure that frees the context must first remove that
sysctl tree.
Failures after a successful IFDI_ATTACH_PRE also did not consistently
call IFDI_DETACH or free the private taskqueue. In particular, routing
a taskqueue creation failure through the context cleanup could free the
driver softc while resources allocated by attach_pre remained live.
Track successful interrupt and queue setup and use one common unwind
path. Invoke IFDI_DETACH with IFNET_WLOCK dropped and release only
resources whose setup completed. Leave a failed IFDI_ATTACH_PRE to
unwind its own partial state, as required by the existing driver
contract.
A failed post-attach can follow driver registration of an SR-IOV
schema. Remove that registration before detaching the interface and
[30 lines not shown]
iflib: drain admin task and fix teardown order on register failure
When IFDI_ATTACH_POST() fails (or netmap attach fails), iflib tears down with
ether_ifdetach(), taskqueue_free(ifc_tq), and IFDI_DETACH(). CTX_LOCK is still
held after ether_ifattach. ether_ifdetach() and taskqueue_drain(admin) must not
run under CTX_LOCK.
Teardown ordering (match iflib_device_deregister):
- Free the per-interface admin taskqueue after IFDI_DETACH / IFDI_QUEUES_FREE, not before.
- Drop IFNET_WLOCK() across IFDI_DETACH / IFDI_QUEUES_FREE so driver detach can sleep in
LinuxKPI workqueue drain, then retake IFNET_WLOCK() before iflib_free_intr_mem and fail_unlock.
Reviewed by: gallatin, kgalazka, #iflib
Differential Revision: https://reviews.freebsd.org/D56316
(cherry picked from commit 439132310ae1f623f6c0a3dc241d0a34e98e040b)
iflib: Fix panic observed while doing sysctl -a with if_bnxt unload
Observed below kernel panic calltrace while performing sysctl -a
operation while unloading the if_bnxt driver,
Fatal trap 9: general protection fault while in kernel mode
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe02a7569940
vpanic() at vpanic+0x136/frame 0xfffffe02a7569a70
panic() at panic+0x43/frame 0xfffffe02a7569ad0
trap_fatal() at trap_fatal+0x68/frame 0xfffffe02a7569af0
calltrap() at calltrap+0x8/frame 0xfffffe02a7569af0
trap 0x9, rip = 0xffffffff80c0b411, rsp = 0xfffffe02a7569bc0, rbp = 0xfffffe02a7569be0 ---
sysctl_handle_counter_u64() at sysctl_handle_counter_u64+0x61/frame 0xfffffe02a7569be0
sysctl_root_handler_locked() at sysctl_root_handler_locked+0x9c/frame 0xfffffe02a7569c30
sysctl_root() at sysctl_root+0x22f/frame 0xfffffe02a7569cb0
userland_sysctl() at userland_sysctl+0x196/frame 0xfffffe02a7569d50
[23 lines not shown]
fortune: fall back to all databases if fortunes is missing
With no file argument, fortune looks for a database named fortunes
in FORTDIR. The base system has not shipped that file since
0538d7bbe620 (FreeBSD 12), only freebsd-tips, so the default
invocation failed even though a valid database remained. Callers
such as xlockmore's marquee and nose modes (fortune -s) then
displayed the error as the epigram.
If the named fortunes file is absent, scan every database in the
existing search path. /usr/local/share/games/fortune stays on that
path so fortune-mod-* packages keep working; when
fortune-mod-freebsd-classic restores the fortunes file, it is still
preferred. fortune -f with no arguments lists the same files that
would be searched.
MFC after: 1 week
Reviewed by: ziaee, fuz
Differential Revision: https://reviews.freebsd.org/D59057
rangelock: Reimplement _rangelock_cookie_assert()
After rangelocks were reimplemented, _rangelock_cookie_assert() became a
stub. Re-provide an implementation.
Reviewed by: kib
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59222
Revert "Remove minor version from kmods repo"
We now have kmod repositories built on releng/14.5 for amd64, arm64,
and i386.
This reverts commit 19a1025e1c0cbd6b1cd57d78826d42eeafbdaed0.
Approved by: re (cperciva)
install: Fix two bugs in stdin code
* Fix case where the source is - and the target exists.
* Only call chflags() (to remove flags that might prevent us from
replacing an existing target) in the exists case; otherwise,
to_sb.st_flags is uninitialized.
* Rename the source file in the stdin test case.
* Extend null and stdin test cases to cover the case where the
target already exists.
Approved by: re (cperciva)
PR: 297681
MFC after: 1 week
Fixes: d34870708db9 ("install: Allow installing stdin")
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59144
[3 lines not shown]
acpi_pci: Honor device proximity for DMA tags
A PCI function with its own _PXM still inherits a DMA tag carrying
the upstream bridge's proximity domain. Resolving an SR-IOV VF's
locality through its PF therefore does not affect the domain used for
DMA allocations.
Create and cache a private child tag when the function, or a VF's
owning PF, has an explicit _PXM. Parent it to the existing PCI or IOMMU
tag so its constraints remain intact, then apply the function's domain
without mutating a shared tag.
pci_get_dma_tag() already performs the IOMMU lookup, so remove the
duplicated lookup in the ACPI subclass while here.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59063
acpi_pci: Cache PCI proximity domains
A PCI function's _PXM is stable for the lifetime of its device
instance, but CPU and DMA locality queries may evaluate it repeatedly.
SR-IOV amplifies this because every VF resolves locality through the
same PF.
Cache successful mappings and the stable absence of _PXM on the
locality source device, and share that result between CPU and domain
queries. Continue to retry generic evaluation or mapping errors rather
than making a potentially transient failure permanent.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59207
acpi_pci: Preserve CPU locality queries for descendants
bus_generic_get_cpus() preserves the original leaf device while
forwarding a request through the bus hierarchy. Consequently,
acpi_pci_get_cpus() may receive a descendant below a PCI function
rather than one of the PCI bus's direct children.
Only apply the SR-IOV PF-locality mapping to direct PCI children.
Preserve the previous ACPI CPU-locality lookup for descendants so their
unrelated bus ivars are not interpreted as PCI device information.
Reviewed by: jhb
MFC after: 2 weeks
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D59206
video: add V4L2 cropping, control menu and overlay symbols
Adds missing structs symbols for V4L2.
video(4) capture devices do not crop, expose menu controls or support
overlay, and return ENOTTY for the new ioctls.
Applications enumerate these unconditionally and degrade gracefully
at run time, but fail to build when the declarations are missing.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D59203
