svn commit: r350958 - in stable/12/sys: fs/fifofs kern sys

[Alan Somers]

Author: asomers
Date: Mon Aug 12 20:31:12 2019
New Revision: 350958
URL: https://svnweb.freebsd.org/changeset/base/350958

Log:
  MFC r349248, r349391, r350088
  
  r349248:
  fcntl: fix overflow when setting F_READAHEAD
  
  VOP_READ and VOP_WRITE take the seqcount in blocks in a 16-bit field.
  However, fcntl allows you to set the seqcount in bytes to any nonnegative
  31-bit value. The result can be a 16-bit overflow, which will be
  sign-extended in functions like ffs_read. Fix this by sanitizing the
  argument in kern_fcntl. As a matter of policy, limit to IO_SEQMAX rather
  than INT16_MAX.
  
  Also, fifos have overloaded the f_seqcount field for a completely different
  purpose ever since r238936.  Formalize that by using a union type.
  
  Reviewed by:	cem
  Sponsored by:	The FreeBSD Foundation
  Differential Revision:	https://reviews.freebsd.org/D20710
  
  r349391:
  fcntl: style changes to r349248
  
  Reported by:	bde
  MFC-With:	349248
  Sponsored by:	The FreeBSD Foundation
  
  r350088:
  F_READAHEAD: Fix r349248's overflow protection, broken by r349391
  
  I accidentally broke the main point of r349248 when making stylistic changes
  in r349391.  Restore the original behavior, and also fix an additional
  overflow that was possible when uio->uio_resid was nearly SSIZE_MAX.
  
  Reported by:	cem
  Reviewed by:	bde
  MFC-With:	349248
  Sponsored by:	The FreeBSD Foundation

Modified:
  stable/12/sys/fs/fifofs/fifo_vnops.c
  stable/12/sys/kern/kern_descrip.c
  stable/12/sys/kern/sys_pipe.c
  stable/12/sys/kern/vfs_vnops.c
  stable/12/sys/sys/file.h
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/fs/fifofs/fifo_vnops.c
==============================================================================
--- stable/12/sys/fs/fifofs/fifo_vnops.c	Mon Aug 12 20:27:33 2019	(r350957)
+++ stable/12/sys/fs/fifofs/fifo_vnops.c	Mon Aug 12 20:31:12 2019	(r350958)
@@ -174,7 +174,7 @@ fifo_open(ap)
 			if (fip->fi_writers > 0)
 				wakeup(&fip->fi_writers);
 		}
-		fp->f_seqcount = fpipe->pipe_wgen - fip->fi_writers;
+		fp->f_pipegen = fpipe->pipe_wgen - fip->fi_writers;
 	}
 	if (ap->a_mode & FWRITE) {
 		if ((ap->a_mode & O_NONBLOCK) && fip->fi_readers == 0) {

Modified: stable/12/sys/kern/kern_descrip.c
==============================================================================
--- stable/12/sys/kern/kern_descrip.c	Mon Aug 12 20:27:33 2019	(r350957)
+++ stable/12/sys/kern/kern_descrip.c	Mon Aug 12 20:31:12 2019	(r350958)
@@ -781,7 +781,9 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_
 		}
 		if (arg >= 0) {
 			bsize = fp->f_vnode->v_mount->mnt_stat.f_iosize;
-			fp->f_seqcount = (arg + bsize - 1) / bsize;
+			arg = MIN(arg, INT_MAX - bsize + 1);
+			fp->f_seqcount = MIN(IO_SEQMAX,
+			    (arg + bsize - 1) / bsize);
 			atomic_set_int(&fp->f_flag, FRDAHEAD);
 		} else {
 			atomic_clear_int(&fp->f_flag, FRDAHEAD);

Modified: stable/12/sys/kern/sys_pipe.c
==============================================================================
--- stable/12/sys/kern/sys_pipe.c	Mon Aug 12 20:27:33 2019	(r350957)
+++ stable/12/sys/kern/sys_pipe.c	Mon Aug 12 20:31:12 2019	(r350958)
@@ -1420,7 +1420,7 @@ pipe_poll(struct file *fp, int events, struct ucred *a
 	levents = events &
 	    (POLLIN | POLLINIGNEOF | POLLPRI | POLLRDNORM | POLLRDBAND);
 	if (rpipe->pipe_state & PIPE_NAMED && fp->f_flag & FREAD && levents &&
-	    fp->f_seqcount == rpipe->pipe_wgen)
+	    fp->f_pipegen == rpipe->pipe_wgen)
 		events |= POLLINIGNEOF;
 
 	if ((events & POLLINIGNEOF) == 0) {

Modified: stable/12/sys/kern/vfs_vnops.c
==============================================================================
--- stable/12/sys/kern/vfs_vnops.c	Mon Aug 12 20:27:33 2019	(r350957)
+++ stable/12/sys/kern/vfs_vnops.c	Mon Aug 12 20:31:12 2019	(r350958)
@@ -494,9 +494,13 @@ sequential_heuristic(struct uio *uio, struct file *fp)
 		 * closely related to the best I/O size for real disks than
 		 * to any block size used by software.
 		 */
-		fp->f_seqcount += howmany(uio->uio_resid, 16384);
-		if (fp->f_seqcount > IO_SEQMAX)
+		if (uio->uio_resid >= IO_SEQMAX * 16384)
 			fp->f_seqcount = IO_SEQMAX;
+		else {
+			fp->f_seqcount += howmany(uio->uio_resid, 16384);
+			if (fp->f_seqcount > IO_SEQMAX)
+				fp->f_seqcount = IO_SEQMAX;
+		}
 		return (fp->f_seqcount << IO_SEQSHIFT);
 	}
 

Modified: stable/12/sys/sys/file.h
==============================================================================
--- stable/12/sys/sys/file.h	Mon Aug 12 20:27:33 2019	(r350957)
+++ stable/12/sys/sys/file.h	Mon Aug 12 20:31:12 2019	(r350958)
@@ -179,7 +179,10 @@ struct file {
 	/*
 	 *  DTYPE_VNODE specific fields.
 	 */
-	int		f_seqcount;	/* (a) Count of sequential accesses. */
+	union {
+		int16_t	f_seqcount;	/* (a) Count of sequential accesses. */
+		int	f_pipegen;
+	};
 	off_t		f_nextoff;	/* next expected read/write offset. */
 	union {
 		struct cdev_privdata *fvn_cdevpriv;