WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sys/kern?h=master 2021-04-13T05:47:30Z 2021-04-13T05:47:30Z Matt Dunwoodie ncon@noconroy.net 2021-04-03T13:15:47Z urn:sha1:e447e5e6911f4dc85b71b8683614807a4bf342e1 This function (or of similar nature) is required to safely use a refcnt and smr_entry together. Such functions exist on other platforms as kref_get_unless_zero (on Linux) and refcount_acquire_if_gt (on FreeBSD). The following diagram details the following situation with and without refcnt_take_if_gt in 3 cases, with the first showing the "invalid" use of refcnt_take. Situation: Thread #1 is removing the global referenc (o). Thread #2 wants to reference an object (r), using a thread pointer (t). Case: 1) refcnt_take after Thread #1 has released "o" 2) refcnt_take_if_gt before Thread #1 has released "o" 3) refcnt_take_if_gt after Thread #1 has released "o" Data: struct obj { struct smr_entry smr; struct refcnt refcnt; } *o, *r, *t1, *t2; Thread #1 | Thread #2 ---------------------------------+------------------------------------ | r = NULL; rw_enter_write(&lock); | smr_read_enter(); | t1 = SMR_PTR_GET_LOCKED(&o); | t2 = SMR_PTR_GET(&o); SMR_PTR_SET_LOCKED(&o, NULL); | | if (refcnt_rele(&t1->refcnt) | smr_call(&t1->smr, free, t1); | | if (t2 != NULL) { | refcnt_take(&t2->refcnt); | r = t2; | } rw_exit_write(&lock); | smr_read_exit(); ..... // called by smr_thread | free(t1); | ..... | // use after free | *r ---------------------------------+------------------------------------ | r = NULL; rw_enter_write(&lock); | smr_read_enter(); | t1 = SMR_PTR_GET_LOCKED(&o); | t2 = SMR_PTR_GET(&o); SMR_PTR_SET_LOCKED(&o, NULL); | | if (refcnt_rele(&t1->refcnt) | smr_call(&t1->smr, free, t1); | | if (t2 != NULL && | refcnt_take_if_gt(&t2->refcnt, 0)) | r = t2; rw_exit_write(&lock); | smr_read_exit(); ..... // called by smr_thread | // we don't have a valid reference free(t1); | assert(r == NULL); ---------------------------------+------------------------------------ | r = NULL; rw_enter_write(&lock); | smr_read_enter(); | t1 = SMR_PTR_GET_LOCKED(&o); | t2 = SMR_PTR_GET(&o); SMR_PTR_SET_LOCKED(&o, NULL); | | if (t2 != NULL && | refcnt_take_if_gt(&t2->refcnt, 0)) | r = t2; if (refcnt_rele(&t1->refcnt) | smr_call(&t1->smr, free, t1); | rw_exit_write(&lock); | smr_read_exit(); ..... | // we need to put our reference | if (refcnt_rele(&t2->refcnt)) | smr_call(&t2->smr, free, t2); ..... // called by smr_thread | free(t1); | ---------------------------------+------------------------------------ Currently it uses atomic_add_int_nv to atomically read the refcnt, but I'm open to suggestions for better ways. The atomic_cas_uint is used to ensure that refcnt hasn't been modified since reading `old`. 2021-03-25T21:27:45Z abieber abieber@openbsd.org 2021-03-25T21:27:45Z urn:sha1:2e384c95b2c4c0c66e56742bbffb7e20579c2488 allowed when inet was used. This lets Go programs use 'unix' without also including 'inet'. from Josh Rickmar ok / tree review from deraadt@, commit message cluestick from tb@ 2021-03-23T10:30:40Z mpi mpi@openbsd.org 2021-03-23T10:30:40Z urn:sha1:af8964917e47849e103b45f84b226601281e0495 fork_return() does an additional check to send a SIGTRAP (for a debugger) but this signal might overwrite the SIGSTOP generated by the parent doing a PT_ATTACH before the child has a change to execute any instruction. Prevent a race visible only on SP system with regress/sys/kern/ptrace2. ok kettenis@ 2021-03-23T10:22:20Z mpi mpi@openbsd.org 2021-03-23T10:22:20Z urn:sha1:cb55d4750a53b14e91e62240a8a2cb53357ffd2f ok visa@ 2021-03-21T11:29:38Z semarie semarie@openbsd.org 2021-03-21T11:29:38Z urn:sha1:c49c61c6189f292e7cc497671b99c396a5890d71 - use C99-style initialization (grep works better with that) - use const as execsw is not modified during runtime ok mpi@ 2021-03-21T10:24:36Z mpi mpi@openbsd.org 2021-03-21T10:24:36Z urn:sha1:58ea3020aa556302036dbceae90c657300c06510 No functional change. ok semarie@ 2021-03-20T11:26:07Z semarie semarie@openbsd.org 2021-03-20T11:26:07Z urn:sha1:c2dd98f25b9d7181da4818325a7770905922ca39 - move 'fail' label to end of function (instead of using the first if-condition) - merge the most simples error code paths idioms from 'cleanup+return' to 'goto-fail' ok mpi@ 2021-03-18T08:44:59Z mvs mvs@openbsd.org 2021-03-18T08:44:59Z urn:sha1:1a45b5b6e341aafc249501a50d7a0f9ed64b7957 2021-03-18T08:43:38Z mvs mvs@openbsd.org 2021-03-18T08:43:38Z urn:sha1:87131069daeaefa13c7d980a429556ff59da3ba7 held but this path is only followed while `syslogf' socket is not set. New `syslogf_rwlock' used to protect `syslogf' access. ok bluhm@ 2021-03-16T16:32:22Z deraadt deraadt@openbsd.org 2021-03-16T16:32:22Z urn:sha1:d5ee67c8efc01e3ba4716c001a1db11220dbf9cc architecture. from miod