CVS log for src/common/lib/libprop/prop_kern.c

Up to [cvs.NetBSD.org] / src / common / lib / libprop

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

fix a/an grammar in obvious cases

proplib: Nix trailing whitespace.

Ooops, restore accidently removed files from merge mishap

Sync with HEAD

Sync with HEAD

Pull up following revision(s) (requested by sborrill in ticket #1645):

	common/include/prop/prop_dictionary.h: revision 1.16
	common/include/prop/prop_array.h: revision 1.15
	common/lib/libprop/prop_kern.c: revision 1.21
	common/lib/libprop/prop_copyin_ioctl.9: revision 1.12
	common/include/prop/prop_array.h: revision 1.16
	common/lib/libprop/prop_kern.c: revision 1.22 (patch)
	common/lib/libprop/prop_kern.c: revision 1.23 (patch)

add sized versions of the copyin ioctls.

 -

add sized versions of the copyin ioctls

 -

Update for the new *_size() functions recently added.  Mention the
implicit size limit (128KB) for the functions which do not take an
explicit limit argument.

 -

fix args

 -

missing brace

 -

call the proper size functions

Sync with head

remove M_CANFAIL flag for malloc(9) - it was completely ignored, so had
actually no effect

Sync with HEAD

Sync with HEAD

call the proper size functions

missing brace

add sized versions of the copyin ioctls

bump to 128K (because of npf large rules) and return E2BIG.

Pull up following revision(s) (requested by christos in ticket #782):
	common/lib/libprop/prop_kern.c: revision 1.19
	common/lib/libprop/prop_object.c: revision 1.30
	common/lib/libprop/prop_object_impl.h: revision 1.32
Limit size of xml buffer for userland requests (From Mateusz Kocielski)
--
Don't treat NUL (EOF) as SPACE. All the code that uses _PROP_ISSPACE() checks
explicitly for _PROP_EOF() anyway, and this can be abused to cause run beyond
the end of buffer DoS (Mateusz Kocielski)
--
Now that _PROP_ISSPACE does not include the EOF check, put the check for
EOF inside the loop. Also fix another unbounded loop that did not check for
EOF. From Mateusz Kocielski

Limit size of xml buffer for userland requests (From Mateusz Kocielski)
XXX: pullup-7

Pull up following revision(s) (requested by chs in ticket #363):
	common/lib/libprop/prop_kern.c: revision 1.18
	sys/arch/mac68k/dev/grf_compat.c: revision 1.27
	sys/arch/x68k/dev/grf.c: revision 1.45
	sys/external/bsd/drm/dist/bsd-core/drm_bufs.c: revision 1.12
	sys/external/bsd/drm2/drm/drm_drv.c: revision 1.12
	sys/external/bsd/drm2/drm/drm_vm.c: revision 1.6
	sys/external/bsd/drm2/include/linux/mm.h: revision 1.4
	sys/kern/vfs_vnops.c: revision 1.192 via patch
	sys/rump/librump/rumpkern/vm.c: revision 1.160
	sys/sys/file.h: revision 1.78 via patch
	sys/uvm/uvm_device.c: revision 1.64
	sys/uvm/uvm_device.h: revision 1.13
	sys/uvm/uvm_extern.h: revision 1.192
	sys/uvm/uvm_mmap.c: revision 1.150 via patch
add a new "fo_mmap" fileops method to allow use of arbitrary uvm_objects for
mappings of file objects.  move vnode-specific details of mmap()ing a vnode
from uvm_mmap() to the new vnode-specific vn_mmap().  add new uvm_mmap_dev()
and uvm_mmap_anon() convenience functions for mapping character devices
and anonymous memory, and replace all other calls to uvm_mmap() with those.
use the new fileop in drm2 so that libdrm can use mmap() to map things
like on other platforms (instead of the ioctl that we have used so far).

add a new "fo_mmap" fileops method to allow use of arbitrary uvm_objects for
mappings of file objects.  move vnode-specific details of mmap()ing a vnode
from uvm_mmap() to the new vnode-specific vn_mmap().  add new uvm_mmap_dev()
and uvm_mmap_anon() convenience functions for mapping character devices
and anonymous memory, and replace all other calls to uvm_mmap() with those.
use the new fileop in drm2 so that libdrm can use mmap() to map things
like on other platforms (instead of the ioctl that we have used so far).

Fix an implementation inconsistency with the prop_*_send_syscall() and
prop_*_recv_syscall() functions from proplib(3). They now share the
same logic as the one from prop_*_send_ioctl() functions:
- returns an int
- 0 indicates "no error", otherwise returns the error number (and
set errno)

Many consumers of the prop_*_{ioctl, syscall} expect errno to be set
on error and use err() to display the error message. As such, ensures that
errno gets set before returning from these functions.

prop_*_send_syscall() functions returned a boolean, and now return an int.
Fix all call sites to use the new paradigm (only quota2 is affected in src).

As the prop_*_{send,recv}_syscall() API appeared in -current and is only
used by the recent quota2 code, I am not bumping the lib. The API change
only affects the prop_*_send_syscall() function (recv_syscall()s were
already used correctly), so ensure you are not mixing "old" -current
quota binaries with a new proplib(3) (or the other way around). This
change will be announced via a HEADS-UP and UPDATING.

Does not affect the kernel part of proplib.

Document the correct API in prop_array(3) and prop_dictionary(3).

Thanks to Francois Tigeot for noticing the API inconsistency and
reporting it on tech-kern@.

ok bouyer@.

prop_*_copyout takes an object as second parameter, not a pointer to object.

- Implement prop_{array,dictionary}_copyout(), based on
  prop_{array,dictionary}_copyout_ioctl().
- Implement prop_{array,dictionary}_recv_syscall(), which
  takes as parameter the pref we got from kernel and internalize it,
  and unmaps the buffer prop_{array,dictionary}_copyout() mapped for us.
- add a prop_{array,dictionary}_send_syscall() for symetry, which is
  an alias to prop_{array,dictionary}_externalize_to_pref()

Discussed on tech-kern@ and tech-userlevel@

Use a consistent approach for rump kernel calls made by libs.
Should investigate a dynamic approach in the future.

Back out previous.  Builds for me and on autobuild cluster.

make this compile again.

Implement prop_array_externalize_to_pref(), prop_array_copyin(),
prop_dictionary_externalize_to_pref() and prop_dictionary_copyin()
as discussed in the thread:
http://mail-index.netbsd.org/tech-kern/2009/07/29/msg005594.html

Bump libprop shlib minor.

Wipe out the last vestiges of POOL_INIT with one swift stroke.  In
most cases, use a proper constructor.  For proplib, give a local
equivalent of POOL_INIT for the kernel object implementation.  This
way the code structure can be preserved, and a local link set is
not hazardous anyway (unless proplib is split to several modules,
but that'll be the day).

tested by booting a kernel in qemu and compile-testing i386/ALL

sync with head.

Remove clause 3 and 4 from TNF licenses

Catch up on netbsd-4 as of a few days ago.

Pull up following revision(s) (requested by joerg in ticket #904):
	sbin/veriexecctl/veriexecctl.c: revision 1.29 (via patch)
	common/lib/libprop/prop_string.c: revision 1.9 (via patch)
	distrib/sets/lists/comp/mi: revision 1.1063 (via patch)
	common/lib/libprop/prop_kern.c: revision 1.8 (via patch)
	common/include/prop/prop_string.h: revision 1.2 (via patch)
	common/include/prop/prop_ingest.h: revision 1.2 (via patch)
	usr.sbin/btdevctl/btdevctl.c: revision 1.5 (via patch)
	common/lib/libprop/prop_object_impl.h: revision 1.14 (via patch)
	common/lib/libprop/prop_rb.c: revision 1.7 (via patch)
	common/include/prop/prop_array.h: revision 1.5 (via patch)
	common/lib/libprop/prop_stack.h: revision 1.1 (via patch)
	common/lib/libprop/prop_object_impl.h: revision 1.16 (via patch)
	common/lib/libprop/prop_number.3: revision 1.7 (via patch)
	common/lib/libprop/prop_stack.h: revision 1.2 (via patch)
	common/lib/libprop/prop_stack.c: revision 1.1 (via patch)
	common/lib/libprop/prop_object_impl.h: revision 1.17 (via patch)
	common/lib/libprop/prop_dictionary_util.c: revision 1.2 (via patch)
	common/lib/libprop/prop_dictionary_util.3: revision 1.2 (via patch)
	common/lib/libprop/prop_dictionary.c: revision 1.18 (via patch)
	common/lib/libprop/prop_stack.c: revision 1.2 (via patch)
	common/lib/libprop/prop_object_impl.h: revision 1.18 (via patch)
	common/lib/libprop/prop_dictionary.c: revision 1.19 (via patch)
	common/include/prop/prop_bool.h: revision 1.3 (via patch)
	common/include/prop/prop_dictionary.h: revision 1.7 (via patch)
	common/include/prop/prop_data.h: revision 1.2 (via patch)
	sys/sys/dkio.h: revision 1.14 (via patch)
	usr.sbin/btdevctl/sdp.c: revision 1.4 (via patch)
	common/include/prop/Makefile: revision 1.3 (via patch)
	common/include/prop/prop_number.h: revision 1.5 (via patch)
	common/lib/libprop/prop_object.c: revision 1.14 (via patch)
	common/lib/libprop/prop_object.c: revision 1.15 (via patch)
	common/lib/libprop/prop_object.c: revision 1.16 (via patch)
	common/lib/libprop/prop_bool.3: revision 1.3 (via patch)
	common/lib/libprop/prop_data.3: revision 1.4 (via patch)
	common/lib/libprop/prop_object.3: revision 1.6 (via patch)
	common/lib/libprop/prop_data.c: revision 1.7 (via patch)
	common/lib/libprop/prop_data.c: revision 1.8 (via patch)
	common/lib/libprop/prop_data.c: revision 1.9 (via patch)
	common/lib/libprop/prop_dictionary.c: revision 1.20 (via patch)
	usr.sbin/btdevctl/print.c: revision 1.9 (via patch)
	sbin/veriexecctl/veriexecctl_parse.y: revision 1.22 (via patch)
	common/lib/libprop/prop_number.c: revision 1.12 (via patch)
	common/include/prop/proplib.h: revision 1.5 (via patch)
	common/lib/libprop/prop_number.c: revision 1.13 (via patch)
	common/lib/libprop/prop_number.c: revision 1.14 (via patch)
	common/include/prop/prop_object.h: revision 1.5 (via patch)
	common/lib/libprop/prop_array.3: revision 1.5 (via patch)
	common/include/prop/prop_object.h: revision 1.6 (via patch)
	common/lib/libprop/prop_string.3: revision 1.4 (via patch)
	common/lib/libprop/prop_bool.c: revision 1.10 (via patch)
	common/lib/libprop/Makefile.inc: revision 1.6 (via patch)
	common/lib/libprop/prop_ingest.c: revision 1.2 (via patch)
	common/lib/libprop/prop_bool.c: revision 1.11 (via patch)
	common/lib/libprop/prop_array.c: revision 1.10 (via patch)
	common/lib/libprop/prop_ingest.3: revision 1.3 (via patch)
	common/lib/libprop/prop_bool.c: revision 1.12 (via patch)
	common/lib/libprop/prop_array.c: revision 1.11 (via patch)
	common/lib/libprop/prop_string.c: revision 1.7 (via patch)
	common/lib/libprop/prop_dictionary.3: revision 1.8 (via patch)
	common/lib/libprop/prop_array.c: revision 1.9 (via patch)
	usr.sbin/btdevctl/db.c: revision 1.4 (via patch)
	common/lib/libprop/prop_string.c: revision 1.8 (via patch)
	common/include/prop/plistref.h: revision 1.1 (via patch)
Consider '\r' to be white space. Discussed with and also kept as local
change by freza. With this change, DOS style line endings work.

boolean_t -> bool
TRUE -> true
FALSE -> false

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.

Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.
struct plistref does not reference other proplib data types, so split it
in its own header file to be included by dkio.h. Fixes breakage due to
pollution from proplib.h in programs which include ioctl.h. Tested and OK
by dogcow@.

Attempt at fixing build failures after proplib was converted to bool:
FALSE -> false, TRUE -> true, boolean_t -> bool, int -> bool when
appropriate, include stdbool.h . proplib.h no longer provides boolean_t,
so it is necessary to change to bool.
From Tom Spindler (dogcow@).

Avoid using unbound amount of stack frames in prop_object_equal
by using a dynamic stack as well. Reorder arguments for the internalizer
as the iteration is always present and should go before possibly
NULL arguments.
Reviewed by mjf@ and adrianp@

libprop is currently using a recursive parser. While this is fine for
userland, deeply nested arrays and dictionaries can easily overflow
the kernel stack and thereby force a panic.

Fix the internalizer and prop_object_release to use a separate call
stack and alter the dictionary and array handling to not recurse on
the C stack. The default stack has an inline depth of 16 elements,
which should keep the overhead reasonable.

This issue was found by Pavel Cahyna and Jachym Holecek.

Additionally add a limit for prop_object_copyin_ioctl to prevent user
programs from temporary allocating unbound amount of kernel memory.
Allow malloc to fail so that tight loops of userland processes can't
force panics by exhausting the kernel map.

Tested with the sample exploit of Jachym, his test suite and reviewed
by himself (initial patch), Christos Zoulas and Jason Thorpe.

Add a comment to explain how the value for uaddr is chosen.  Maybe uvm_mmap
should do that instead of sys_mmap...

In _prop_object_copyout_ioctl, uaddr was not initialised, although it is
used by uvm_mmap() as a hint for the virtual address to map memory to.  As
a consequence, it tended to fail a lot on some architectures.

We cannot use 0, so instead use the value that would have been used if we
were calling mmap(2) with 0 as the first argument.

Fixes PR#34639 by xtraeme@.

Add prop_array_t support to prop_kern.

file prop_kern.c was added on branch newlock2 on 2006-10-26 18:51:22 +0000

Add prop_array_t support to prop_kern.

unbreak kernel builds from the last fix

protect include of sys/mman.h when building _KERNEL or _STANDALONE

Alter the protocol impemented by prop_kern to allow for bi-directional
plist-based messages and to eliminate looping previously required to
receive a plist from the kernel:

- prop_dictionary_copyin_ioctl() and prop_dictionary_copyout_ioctl()
  now take the cmd argument rather than the file open flag.  The
  read-ness or write-ness of an ioctl command is checked by these
  routines to ensure that information is being passed to/from the
  userland component properly.

- prop_dictionary_copyout_ioctl() now allocates the memory for the
  XML plist on behalf of the userland component by way of uvm_mmap().
  The XML plist is copied out to the newly-mapped anonymous region,
  and the pointer returned via the plistref.

- prop_dictionary_recv_ioctl() is responsible for munmap()'ing the
  region after parsing the XML plist into internal represenatation.

- A new prop_dictionary_sendrecv_ioctl() is added, allowing user space
  code to send a dictionary to the kernel and receive one back as a
  reply.


Update users of prop_kern for the API changes (Bluetooth).

This constitutes an ABI / protocol change -- but this will also be put
into NetBSD 4.0 so that the first proplib release will implement the new
scheme.

Add kernel and user space parts of a protocol for sending property lists
to / from the kernel using ioctls.