CVS log for src/sys/kern/sys_mqueue.c

Up to [NetBSD] / src / sys / kern

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Sync with HEAD.

sync with head

Add missing <sys/atomic.h> include.

- Move some checks into mqueue_get() and avoid some duplication.
- Simplify message queue descriptor unlinking and closure operations.
- Update proc_t::p_mqueue_cnt atomically.  Inherit it on fork().
- Use separate allocation for the name of message queue.

sync with head

mq_poll_fop: return only those events which are polled.

Sync with HEAD.

sync with head.

Get rid of SYSCTL_SETUP.

We want the sysctl variables also when mqueue(3) is loaded as a module.

sync to netbsd-5

sync with head

If a multithreaded app closes an fd while another thread is blocked in
read/write/accept, then the expectation is that the blocked thread will
exit and the close complete.
Since only one fd is affected, but many fd can refer to the same file,
the close code can only request the fs code unblock with ERESTART.
Fixed for pipes and sockets, ERESTART will only be generated after such
a close - so there should be no change for other programs.
Also rename fo_abort() to fo_restart() (this used to be fo_drain()).
Fixes PR/26567

Pull up following revision(s) (requested by tron in ticket #1188):
	sys/kern/sys_mqueue.c: revision 1.28 via patch
fix some security critical bugs:
-an invalid signal number passed to mq_notify(2) could crash the kernel
on delivery -- add a boundary check
-a user could set mq_maxmsg (the maximal number of messages in a queue)
to a huge value on mq_open(O_CREAT) and later use up all kernel
memory by mq_send(2) -- add a sysctl'able limit which defaults
to 16*mq_def_maxmsg
(mq_notify(2) should get some more checks, and SIGEV_* values other
than SIGEV_SIGNAL should be handled somehow, but this doesn't look
security critical)

Pull up following revision(s) (requested by drochner in ticket #1188):
	sys/kern/sys_mqueue.c: revision 1.28 via patch
fix some security critical bugs:
-an invalid signal number passed to mq_notify(2) could crash the kernel
on delivery -- add a boundary check
-mq_receive(2) from an empty queue crashed the kernel by NULL dereference
in timeout calculation -- handle the NULL case
-likewise for mq_send(2) to a full queue
-a user could set mq_maxmsg (the maximal number of messages in a queue)
to a huge value on mq_open(O_CREAT) and later use up all kernel
memory by mq_send(2) -- add a sysctl'able limit which defaults
to 16*mq_def_maxmsg
(mq_notify(2) should get some more checks, and SIGEV_* values other
than SIGEV_SIGNAL should be handled somehow, but this doesn't look
security critical)

fix some security critical bugs:
-an invalid signal number passed to mq_notify(2) could crash the kernel
 on delivery -- add a boundary check
-mq_receive(2) from an empty queue crashed the kernel by NULL dereference
 in timeout calculation -- handle the NULL case
-likewise for mq_send(2) to a full queue
-a user could set mq_maxmsg (the maximal number of messages in a queue)
 to a huge value on mq_open(O_CREAT) and later use up all kernel
 memory by mq_send(2) -- add a sysctl'able limit which defaults
 to 16*mq_def_maxmsg

(mq_notify(2) should get some more checks, and SIGEV_* values other
than SIGEV_SIGNAL should be handled somehow, but this doesn't look
security critical)

Rename fo_drain() to fo_abort(), 'drain' is used to mean 'wait for output
do drain' in many places, whereas fo_drain() was called in order to force
blocking read()/write() etc calls to return to userspace so that a close()
call from a different thread can complete.
In the sockets code comment out the broken code in the inner function,
it was being called from compat code.

- Move inittimeleft() and gettimeleft() to subr_time.c, where they belong.
- Move abstimeout2timo() there too and export.  Use it in lwp_park().

Pull up following revision(s) (requested by rmind in ticket #1071):
	sys/kern/sys_mqueue.c: revision 1.25 via patch
	sys/sys/mqueue.h: revision 1.11 via patch
mq_timedsend/mq_timedreceive: timeout value is absolute, not relative.
While here, drop unecessary (since fdesc API changes) lwp_t arguments.
Bug reported by Stathis Kamperis, thanks!

mq_timedsend/mq_timedreceive: timeout value is absolute, not relative.
While here, drop unecessary (since fdesc API changes) lwp_t arguments.

Bug reported by Stathis Kamperis, thanks!

sync with head.

Sync with HEAD.

Pull up following revision(s) (requested by rmind in ticket #857):
	sys/kern/sys_mqueue.c: revision 1.21 via patch
mq_send/mq_receive: while permission may allow that, return EBADF if sending
to read-only queue, or receiving from write-only queue.
From Stathis Kamperis, thanks!

Pull up following revision(s) (requested by rmind in ticket #857):
	sys/kern/sys_mqueue.c: revision 1.21 via patch
mq_send/mq_receive: while permission may allow that, return EBADF if sending
to read-only queue, or receiving from write-only queue.
From Stathis Kamperis, thanks!

Make POSIX message queues a kernel module.

Fix previous, so that it actually works, correctly.

sync with head.

- Make insertion to message queue O(1) by using bitmap and array.  However,
  mq_prio_max is dynamic, and sorted list is used for custom setup, when
  user manually sets higher priority range.
- Cache mq->mq_attrib in some places.  Change msg_ptr type to uint8_t.
- Update copyright, misc.

mq_send/mq_receive: while permission may allow that, return EBADF if sending
to read-only queue, or receiving from write-only queue.

From Stathis Kamperis, thanks!

Message queues also use genfs_can_access() to control access. Since the
latter might lose its KAUTH_GENERIC_ISSUSER check soon, add an internal
function, mqueue_access(), and call genfs_can_access() from it instead
so we don't pollute the main code path once we need to add a special
kauth(9) check for message queues.

No functional change, error codes preserved.

Related mailing list thread:

	http://mail-index.netbsd.org/tech-kern/2009/06/21/msg005311.html

Move the implementation of vaccess() to genfs_can_access(), in line with
the other routines of the same spirit.

Adjust file-system code to use it.

Keep vaccess() for KPI compatibility and to keep element of least
surprise. A "diagnostic" message warning that vaccess() is deprecated will
be printed when it's used (obviously, only in DIAGNOSTIC kernels).

No objections on tech-kern@:

	http://mail-index.netbsd.org/tech-kern/2009/06/21/msg005310.html

sync with head

Pull up following revision(s) (requested by rmind in ticket #779):
	sys/kern/sys_mqueue.c: revision 1.18
- Slightly rework the way permissions are checked. Neither mq_receive() not
  mq_send() should fail due to permissions.  Noted by Stathis Kamperis!
- Check for empty message queue name (POSIX does not allow this for regular
  files, and it's weird), check for DTYPE_MQUEUE, fix permission check in
  mq_unlink(), clean up.

Pull up following revision(s) (requested by rmind in ticket #779):
	sys/kern/sys_mqueue.c: revision 1.18
- Slightly rework the way permissions are checked. Neither mq_receive() not
  mq_send() should fail due to permissions.  Noted by Stathis Kamperis!
- Check for empty message queue name (POSIX does not allow this for regular
  files, and it's weird), check for DTYPE_MQUEUE, fix permission check in
  mq_unlink(), clean up.

- Slightly rework the way permissions are checked. Neither mq_receive() not
  mq_send() should fail due to permissions.  Noted by Stathis Kamperis!
- Check for empty message queue name (POSIX does not allow this for regular
  files, and it's weird), check for DTYPE_MQUEUE, fix permission check in
  mq_unlink(), clean up.

Pull up following revision(s) (requested by rmind in ticket #762):
	sys/kern/sys_mqueue.c: revision 1.17
sys_mq_open: remove broken access flag check.
Noted by Stathis Kamperis.

Pull up following revision(s) (requested by rmind in ticket #762):
	sys/kern/sys_mqueue.c: revision 1.17
sys_mq_open: remove broken access flag check.
Noted by Stathis Kamperis.

sys_mq_open: remove broken access flag check.
Noted by Stathis Kamperis.

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

sync with head.

Sync with HEAD.

Fix locking as Andy explained. Also fill in uid and gid like sys_pipe did.

Fix PR/37878 and PR/37550: Provide stat(2) for all devices and don't use
fbadop_stat.

Pull up following revision(s) (requested by ad in ticket #661):
	sys/arch/xen/xen/xenevt.c: revision 1.32
	sys/compat/svr4/svr4_net.c: revision 1.56
	sys/compat/svr4_32/svr4_32_net.c: revision 1.19
	sys/dev/dmover/dmover_io.c: revision 1.32
	sys/dev/putter/putter.c: revision 1.21
	sys/kern/kern_descrip.c: revision 1.190
	sys/kern/kern_drvctl.c: revision 1.23
	sys/kern/kern_event.c: revision 1.64
	sys/kern/sys_mqueue.c: revision 1.14
	sys/kern/sys_pipe.c: revision 1.109
	sys/kern/sys_socket.c: revision 1.59
	sys/kern/uipc_syscalls.c: revision 1.136
	sys/kern/vfs_vnops.c: revision 1.164
	sys/kern/uipc_socket.c: revision 1.188
	sys/net/bpf.c: revision 1.144
	sys/net/if_tap.c: revision 1.55
	sys/opencrypto/cryptodev.c: revision 1.47
	sys/sys/file.h: revision 1.67
	sys/sys/param.h: patch
	sys/sys/socketvar.h: revision 1.119
Add fileops::fo_drain(), to be called from fd_close() when there is more
than one active reference to a file descriptor. It should dislodge threads
sleeping while holding a reference to the descriptor. Implemented only for
sockets but should be extended to pipes, fifos, etc.
Fixes the case of a multithreaded process doing something like the
following, which would have hung until the process got a signal.
thr0	accept(fd, ...)
thr1	close(fd)

Add fileops::fo_drain(), to be called from fd_close() when there is more
than one active reference to a file descriptor. It should dislodge threads
sleeping while holding a reference to the descriptor. Implemented only for
sockets but should be extended to pipes, fifos, etc.

Fixes the case of a multithreaded process doing something like the
following, which would have hung until the process got a signal.

thr0	accept(fd, ...)
thr1	close(fd)

Sync with HEAD.

Sync with HEAD.

merge christos-time_t

Sync with head.

Sync with HEAD.

Sync with HEAD.

Sync with HEAD.

- Fix message queue permissions problems.
- Rake into account umask when creating mqueue.
- Restore DDB command, which was accidentally lost (hi martin).
- Misc.

Sync with HEAD.

Sync with wrstuden-revivesa-base-2.

Sync with head.

mq_open: fix confusion of FREAD/FWRITE and VREAD/VWRITE.

Sync with HEAD.

sync with head.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
  be sent from a hardware interrupt handler. Signal activity must be
  deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
  and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

Sync with HEAD.

Welcome to the time_t=long long dev_t=uint64_t branch.

Replace use of CACHE_LINE_SIZE in some obvious places.

sync with head.

- Support for select/poll.
- Convert pool to pool-cache.
- Wrap long lines, adjust the license.

Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

sync with head

sync with HEAD

Sync with HEAD

Sync with HEAD.

Sync with head.

Convert all the system call entry points from:
    int foo(struct lwp *l, void *v, register_t *retval)
to:
    int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

Sync with HEAD.

sync with head

Sync with HEAD.

Unify the license: All rights reserved.
No functional change.

Sync with HEAD.

sync with head.

Sync with HEAD.

Sync with HEAD

Change some initialization of static queues to compile time.
(xxx_INIT to xxx_HEAD_INITIALIZER).  Drop code which inits
non-auto (global or static) variables to 0 since that's
already implied by being non-auto.  Init some static/global
cpu_simple_locks at compile time.

sync with HEAD

sync with head.

Sync with HEAD.

Follow the merge of pmap.c on i386 and amd64 and move
pmap_init_tmp_pgtbl into arch/x86/x86/pmap.c. Modify the ACPI wakeup
code to restore CR4 before jumping back into kernel space as the large
page option might cover that.

sync with head.

Sync with head.

file sys_mqueue.c was added on branch matt-armv6 on 2007-11-06 23:32:30 +0000

file sys_mqueue.c was added on branch yamt-lazymbuf on 2007-10-27 11:35:35 +0000

mq_receive1: Handle the possible dereference, when cv_timedwait_sig() awakes
normally (without the error) and MQ_UNLINK is set.
From CID: 4565.

Sync with head.

Sync with HEAD.

file sys_mqueue.c was added on branch vmlocking on 2007-10-09 13:44:30 +0000

file sys_mqueue.c was added on branch jmcneill-pm on 2007-10-02 18:29:04 +0000

- mq_receive1, mq_send1: deal with spurious wakeup. XXX should adjust the
  timeout but this is a wider problem.
- MQ_SEND is unused, remove it.

Sync with HEAD.

file sys_mqueue.c was added on branch nick-csl-alignment on 2007-09-10 10:56:02 +0000

Implementation of POSIX message queues.

Reviewed by: <ad>, <tech-kern>