VOP_WRITE & read-only file system

[Jaakko Heinonen]

Hi,

I found a few ways to get VOP_WRITE called for a read-only system. Looks
like there is an assumption in (UFS) file system code that VOP_WRITE is
not called for read-only file-systems and indeed the assumption is true
in typical cases. Calling VOP_WRITE for a read-only file system leads to
erratic behavior at least with UFS.

Ways I found:

1) mmap(2)
  - mmap(2) a file
  - close(2) the file handle
  - remount file-system as read-only
  - modify mapped memory

2) ktrace(2)
  - start ktracing a process
  - remount file-system as read-only

3) alq(9)
  - I didn't really test this but it looks obvious

At which level this should be fixed? Is it caller's responsibility not
to call VOP_WRITE if the file system is read-only or should there be a
check in VOP_WRITE?

Another concern is races during remount. I don't see that UFS has
protection against read-only flag changing during VOPs.

-- 
Jaakko