summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_sig.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Raise SPL when modifying ps_klist to prevent a race with interrupts.visa2020-06-151-1/+7
| | | | | | | The list can be accessed from interrupt context if a signal is sent from an interrupt handler. OK anton@ cheloha@ mpi@
* Remove misleading XXX about locking of ps_klist. All of the kqueuevisa2020-06-141-2/+1
| | | | subsystem and ps_klist handling still run under the kernel lock.
* Abstract the head of knote lists. This allows extending the lists,visa2020-04-071-3/+3
| | | | | | for example, with locking assertions. OK mpi@, anton@
* Use atomic operations to update ps_singlecount. This makesclaudio2020-03-201-18/+29
| | | | | | | single_thread_check() safe to be called without KERNEL_LOCK(). single_thread_wait() needs to use sleep_setup() and sleep_finish() instead of tsleep() to make sure no wakeup() is lost. Input kettenis@, with and OK visa@
* Restart child process scan in dowait4() if single_thread_wait() sleeps.visa2020-03-181-5/+13
| | | | | | | | | | | | This ensures that the conditions checked are still in force. The sleep breaks atomicity, allowing another thread to alter the state. single_thread_set() should return immediately after sleep when called from dowait4() because there is no guarantee that the process pr still exists. When called from single_thread_set(), the process is that of the calling thread, which prevents process pr from disappearing. OK anton@, mpi@, claudio@
* Rename "sigacts" flag field to avoid conflict with the "process" one.mpi2020-03-131-10/+10
| | | | | | | | | | This shows that atomic_* operations should not be necessery to write to this field unlike with the process one. The advantage of using a somewhat-unique prefix for struct member is moot when multiple definitions use the same prefix :o) From Amit Kulkarni, ok claudio@
* Move the sigprop definition and the other bits under SIGPROP intoclaudio2020-03-111-2/+41
| | | | | | kern_sig.c where they are currently added by the include. While doing that mark the sigprop array as const. OK mpi@ anton@ millert@
* Remove sigacts structure sharing. The only process that used sharing wasclaudio2020-02-211-35/+1
| | | | | | | proc0 which is used for kthreads and idle threads. proc0 and all those other kernel threads don't handle signals so there is no benefit in sharing. Simplifies the code a fair bit since the refcnt is gone. OK kettenis@
* Adjust a comment, no functional changeclaudio2020-02-211-2/+2
|
* Replace field f_isfd with field f_flags in struct filterops to allowvisa2020-02-201-2/+2
| | | | | | adding more filter properties without cluttering the struct. OK mpi@, anton@
* Remove the indirection via timeout for proc_stop_sweep(). Using a softclaudio2020-02-191-13/+13
| | | | | | | | interrupt is enough to defer the signal handling. This is a leftover from the times where not all archs had generic soft interrupts. It is possible that the defer signal handling to a soft interrupt will be removed at a later stage. Input anton@, mpi@ OK kettenis@
* Consistently perform atomic writes to the ps_flags field of structanton2020-02-151-3/+3
| | | | | | process. ok bluhm@ claudio@ visa@
* Push the KERNEL_LOCK() insidge pgsigio() and selwakeup().mpi2020-02-141-1/+3
| | | | | | | | | | | The 3 subsystems: signal, poll/select and kqueue can now be addressed separatly. Note that bpf(4) and audio(4) currently delay the wakeups to a separate context in order to respect the KERNEL_LOCK() requirement. Sockets (UDP, TCP) and pipes spin to grab the lock for the sames reasons. ok anton@, visa@
* Back out previous. Nothing wrong with the diff per se but I should haveanton2020-02-011-3/+1
| | | | asked for more oks; my bad!
* Grab the kernel lock in pgsigio() as it's strictly needed whileanton2020-02-011-1/+3
| | | | | | | | | | operating on the process structure and issuing signals. This is similar to what sigio_setown() already does. With this in place, the pipe subsystem is no longer required to grab the kernel lock before calling pgsigio(). ok visa@
* Split `p_priority' into `p_runpri' and `p_slppri'.mpi2020-01-301-4/+4
| | | | | | | | | | | Using different fields to remember in which runqueue or sleepqueue threads currently are will make it easier to split the SCHED_LOCK(). With this change, the (potentially boosted) sleeping priority is no longer overwriting the thread priority. This let us get rids of the logic required to synchronize `p_priority' with `p_usrpri'. Tested by many, ok visa@
* Introduce wakeup_proc() a function to un-SSTOP/SSLEEP a thread.mpi2020-01-161-2/+2
| | | | | | | This moves most of the SCHED_LOCK() related to protecting the sleepqueue and its states to kern/kern_sync.c Name suggestion from jsg@, ok kettenis@, visa@
* Introduce TIMESPEC_TO_NSEC() and use it to convert userland facingmpi2020-01-141-13/+7
| | | | | | tsleep(9) to tsleep_nsec(9). ok bluhm@
* Unify handling of ioctls FIOSETOWN/SIOCSPGRP/TIOCSPGRP andvisa2020-01-081-5/+16
| | | | | | | | | | | | FIOGETOWN/SIOCGPGRP/TIOCGPGRP. Do this by determining the meaning of the ID parameter inside the sigio code. Also add cases for FIOSETOWN and FIOGETOWN where there have been TIOCSPGRP and TIOCGPGRP before. These changes allow removing the ID translation from sys_fcntl() and sys_ioctl(). Idea from NetBSD OK mpi@, claudio@
* Retire csignal() the last users were converted to use pgsigio(9) instead.claudio2020-01-031-28/+1
| | | | OK visa@ anton@
* Use C99 designated initializers with struct filterops. In addition,visa2019-12-311-3/+7
| | | | | | make the structs const so that the data are put in .rodata. OK mpi@, deraadt@, anton@, bluhm@
* Convert infinite sleeps to {m,t}sleep_nsec(9).mpi2019-12-191-3/+3
| | | | ok visa@
* Replace p_xstat with ps_xexit and ps_xsigguenther2019-12-111-13/+12
| | | | | | | | | Convert those to a consolidated status when needed in wait4(), kevent(), and sysctl() Pass exit code and signal separately to exit1() (This also serves as prep for adding waitid(2)) ok mpi@
* Fix vn_open to require an op of 0, and 0 or KERNELPATH only as flags.beck2019-10-061-2/+3
| | | | | | | | sweep tree to correct NDIINT op and flags ahead of time. document the requirement. This allows KERNELPATH to be used to bypass unveil for crash dumps with nosuidcoredump=2 or 3 ok visa@ deraadt@ florian@
* sysctl global nosuidcoredump was being inspected twice inside coredump(),deraadt2019-10-031-23/+24
| | | | | with a sleep between. Reorganize the code for a single check. ok anton beck florian mpi
* avoid large MAXPATHLEN object on the stack in coredump(), by allocatingderaadt2019-08-071-6/+11
| | | | | it from the pool. ok bluhm visa
* Stop sleeping at PUSER.mpi2019-07-101-2/+2
| | | | | | | This allows to enforce that sleeping priorities will now always be < PUSER. ok visa@, ratchov@
* Make resource limit access MP-safe. So far, the copy-on-write sharingvisa2019-06-211-3/+2
| | | | | | | | | | of resource limit structs has been done between processes. By applying copy-on-write also between threads, threads can read rlimits in a nearly lock-free manner. Inspired by code in DragonFly BSD and FreeBSD. OK mpi@, agreement from jmatthew@ and anton@
* When killing a process, the signal is handled by any thread thatbluhm2019-05-131-22/+32
| | | | | | | | | | does not block the signal. If all threads block the signal, we delivered it to the main thread. This does not conform to POSIX. If any thread unblocks the signal, it should be delivered immediately to this thread. Mark such signals pending at the process instead of a single thread. Then any thread can handle it later. OK kettenis@ guenther@
* add a KERNEL_ASSERT_LOCKED() to ptsignaldlg2019-05-011-1/+3
| | | | | | | | | | | | it obviously needs to be called with the kernel lock held, so it makes sense to check that so we can unlock more code without introducing bugs that shoot us in the face in the indeterminate future. csignal is basically a wrapper around ptsignal, so calls to that without the kernel lock should be caught by this too. discussed with mpi@ on bugs@
* open the coredump file non-blocking. cheloha found it blocks with a fifo.tedu2019-02-191-2/+3
| | | | ok cheloha deraadt
* Sprinkle a pinch of timerisvalid/timespecisvalid over the rest of sys/kerncheloha2019-01-231-2/+2
|
* Remove unused function gsignal().visa2018-12-171-13/+1
| | | | OK deraadt@ anton@
* Add a mechanism for managing asynchronous IO signal registrations.visa2018-11-121-1/+271
| | | | | | | | | It centralizes IO signal privilege checking and makes possible to revoke a registration when the target process or process group is deleted. Adapted from FreeBSD. OK kettenis@ mpi@ guenther@
* wrap long linesderaadt2018-08-031-3/+6
|
* Revert the change that delivers process signals to any threads. Asbluhm2018-07-181-7/+4
| | | | | | | side effect pending signals specifically sent to the main thread were handled by other threads. This made gcj in textproc/pdftk port build stall. Noticed and tested by espie@.
* If no thread can immediately handle a signal, which has been sentbluhm2018-07-111-4/+7
| | | | | | | | | to the process, it is made pending at the main thread. There it could hang forever. So also check the main thread for signal delivery. This workaround fixes hung tests in posixtestsuite. The proper solution would be to split pending signals for process and threads. input visa@; OK guenther@
* Move from sendsig() to its callers the initsiginfo() calls andguenther2018-07-101-11/+7
| | | | | | | | instead of passing sendsig() the code+type+val, pass a siginfo_t* to copy from. Eliminate the indirection through struct emul for sendsig(); we no longer have a SunOS4-compat version of sendsig() ok deraadt@
* Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is alwaysvisa2018-04-281-4/+4
| | | | | | | curproc that does the locking or unlocking, so the proc parameter is pointless and can be dropped. OK mpi@, deraadt@
* Implement MAP_STACK option for mmap(). Synchronous faults (pagefault andderaadt2018-04-121-1/+6
| | | | | | | | | | | | | | syscall) confirm the stack register points at MAP_STACK memory, otherwise SIGSEGV is delivered. sigaltstack() and pthread_attr_setstack() are modified to create a MAP_STACK sub-region which satisfies alignment requirements. Observe that MAP_STACK can only be set/cleared by mmap(), which zeroes the contents of the region -- there is no mprotect() equivalent operation, so there is no MAP_STACK-adding gadget. This opportunistic software-emulation of a stack protection bit makes stack-pivot operations during ROPchain fragile (kind of like removing a tool from the toolbox). original discussion with tedu, uvm work by stefan, testing by mortimer ok kettenis
* Exclude SIGKILL from ptrace(2) interception.mpi2018-03-271-6/+8
| | | | | | | | | | This can lead to a deadlock where the parent waits infinitely for the traced process. Original problem reported by tb@ and worked around by visa@ for release by not calling CURSIG() twice in userret(). ok tb@, visa@
* Avoid calling issignal() twice on signal delivery in order notvisa2018-03-241-2/+2
| | | | | | | | | | | | to generate more than one ptrace(2) event. Do that by checking pending signals first without altering any state. If there is an unmasked signal ready for delivery, acquire the kernel lock and redo the checks in issignal(). This prevents gdb from blocking on exit when it attempts to kill an attached process, issue reported by tb@. OK mpi@, deraadt@
* Fix a TOCTOU race that causes signals to be delivered more than once.mpi2018-02-261-34/+41
| | | | | | | | | | | | | | | | | The race is only triggerable if one of the threads of a multi-threaded program is in the middle of a NOLOCK syscall when a signal is received. The problem is that `ps_sigact' is shared between threads so its access should be serialized. In the case of SA_RESETHAND, the handler is reset when a signal is delivered, so delivering the signal twice would put the process in an "impossible" state where some threads were stopped and some were waiting for the others to die. Serialize signal checking & processing with the KERNEL_LOCK() for now, and introduce postsig_done() gypped from FreeBSD, to make sure the lock is held when resetting the handler. Bug report from espie@, ok visa@
* Remove almost unused `flags' argument of suser().mpi2018-02-191-2/+2
| | | | | | | The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
* Don't pull in <sys/file.h> just to get fcntl.hguenther2017-12-301-2/+2
| | | | ok deraadt@ krw@
* Fix comment typoguenther2017-11-271-2/+2
|
* ASLR, W^X, and guard pages trigger processor traps that result inbluhm2017-06-081-1/+9
| | | | | | | | SIGILL, SIGBUS, SIGSEGV signals. Make such memory violations visible in lastcomm(1). This also works if a programm tries to hide them with a signal handler. Manual kill -SEGV does not generate false positives. OK deraadt@
* Add a port of witness(4) lock validation tool from FreeBSD.visa2017-04-201-1/+4
| | | | Go-ahead from kettenis@, guenther@, deraadt@
* Avoid some false positives with cppcheck. No binary change.bluhm2017-04-141-3/+3
| | | | OK jsg@
* Provide mips64 with kernel-facing TCB_{GET,SET} macros that store itguenther2017-04-131-5/+2
| | | | | | | in struct mdproc. With that, all archs have those and the __HAVE_MD_TCB macro can be unifdef'ed as always defined. ok kettenis@ visa@ jsing@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.