From nobody Thu Oct 22 17:32:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9YBG4NTcz6xPb7 for ; Thu, 22 Oct 2026 17:32:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9YBF6JyWz3HWX for ; Thu, 22 Oct 2026 17:32:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690341; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nPtl7oh/1t1StfO4DXKKKwq0Apov1EKIdE33O4hX6jg=; b=RILAvgnegync4gm465vl1+JHhE4C5rkSnF/Mzp5WzogI6LX4st8qHkqay1mX6NTbUe2DXa TK6x7P6bH/X90YqGPhepZJqoZrp/pHKCsWU8NKoR8c94RCzBfwnJ5HiBXSDW/fBbhYctps JiPx2nF++5wq3RJ1m803n8Xr52MvamOClKYsu/+FZRAtRhz+XTxRmA76iH20aIsu6XNUnk 4hCz+j0wFLu9KrIWQ6Qq5MkWo/U1gzXqYASRrKIUdk/B+3SOKTPsuiPk6AdU+IkS0+d8pE ThPnyfNAAZz0Jj+TLBF51THvwvjp9q2Y7U65CjNZ4jF4TmhfcMZo/MtR4q4TEA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792690341; b=UAqWXxkDr5w2lDMWlhGNdGk7+vwyuxbD6mJ3utuuRDhGCnAfIII7ozdAdjuQhV5Ut8aXhy ay1K6GJh7XrrYnBkIdw/jjw5o7nG07SHR/dTCViLL/3xfbgOTniJzbciJyR7jrauwmzLA1 P0ZlKlIhcKc/a4KYOb2Nu3IvQXSQ55WErFl8SEsOK9E25nztntaawTXtCcPoCAosbshqDd 5t1l1Z88uSjcDnE5CA1I+bsdE1EqDgmvPQVPmTR7ld7RUjtyqau56X4JEyVUQcrC3pUErV d2P07P5ctENo3Z+G+nQajeOL1ky6sLRnuXdkBYnJFC7s9wcYuLVn5f6Xag43QQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690341; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=nPtl7oh/1t1StfO4DXKKKwq0Apov1EKIdE33O4hX6jg=; b=iN62OKUCZoACKA7PfYiJMl7BO3CgRLWc7ym1Qagsq7SOjBFgLIzTPady8Z5+6EuaKb9rDu 1nkAnAt8FTHyufdEtkG2PVFP4pFSIg9nwF7spy44SmfUTcffAvaNQYuWCJMHLe30wi0a4g orx9JUg+l6PvlTfFvsmEtDGCmkW0BsDPxfQ0OF5GdkG9EV+1mSzSRQx39f4JLrqF6WnmW0 5YZ7lYrGKjSq3Kvx1ENtVpzO885uTo/BpAXfUT4YxxPC5sjjzfOlbJxmsJf8Vytw2GGN4A VkBf9WjaM31OMpg5g+EKF29bAkiQ57SmMGuvy803zcGBpEzIJKTcgnn0f/0BVw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9YBF5zzPzsSY for ; Thu, 22 Oct 2026 17:32:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3d0c9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 22 Oct 2026 17:32:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c781d6774df5 - stable/15 - devfs: Explicitly disable inotify List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c781d6774df53494e66b58408a62e04f6b95371f Auto-Submitted: auto-generated Date: Thu, 22 Oct 2026 17:32:21 +0000 Message-Id: <6ada48a5.3d0c9.2b978efd@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c781d6774df53494e66b58408a62e04f6b95371f commit c781d6774df53494e66b58408a62e04f6b95371f Author: Mark Johnston AuthorDate: 2026-10-07 14:36:26 +0000 Commit: Mark Johnston CommitDate: 2026-10-22 15:45:41 +0000 devfs: Explicitly disable inotify In principle, inotify can be used to leak timing information about I/O device accesses by privileged process, which might be sensitive, e.g., in the case of /dev/input. See https://inoti.fyi/#1-linux-inter-keystroke-timing In practice this does not work since I/O to devfs nodes does not go through vnodes, so the INOTIFY() calls in various VOP hooks do not fire. But, let's explicitly define a no-op VOP_INOTIFY to help ensure that no one tries to "fix" this bug. Alternately we could simply ignore VCHR/VBLK vnodes in vn_inotify(). However, maybe someday it'll be desirable to enable inotify for specific device files, in which case the filtering should live in devfs. Add a regression test. Reported by: Sudheendra Raghav Neela Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D60364 (cherry picked from commit c2ac0db7150c53d3902dbe1c507d96cbacfcadc6) --- sys/fs/devfs/devfs_vnops.c | 18 ++++++++++++++++++ tests/sys/kern/inotify_test.c | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/sys/fs/devfs/devfs_vnops.c b/sys/fs/devfs/devfs_vnops.c index 2a6f463701e1..bb708afad103 100644 --- a/sys/fs/devfs/devfs_vnops.c +++ b/sys/fs/devfs/devfs_vnops.c @@ -921,6 +921,22 @@ fiodgname_buf_get_ptr(void *fgnp, u_long com) } } +static int +devfs_inotify(struct vop_inotify_args *ap) +{ + /* + * Don't provide inotify for devfs nodes. Most of the inotify hooks + * don't fire anyway since devfs files do not use the vnode I/O path. + * If that were not the case, however, inotify could be abused to leak + * sensitive timing information, e.g., by watching for reads from + * /dev/input. Thus, we make inotify do nothing here as a safeguard. + * + * At some point it may be desirable to enable inotify for specific + * device files. + */ + return (0); +} + static int devfs_ioctl(struct vop_ioctl_args *ap) { @@ -2126,6 +2142,7 @@ static struct vop_vector devfs_vnodeops = { .vop_access = devfs_access, .vop_getattr = devfs_getattr, + .vop_inotify = devfs_inotify, .vop_ioctl = devfs_rioctl, .vop_lookup = devfs_lookup, .vop_mknod = devfs_mknod, @@ -2159,6 +2176,7 @@ static struct vop_vector devfs_specops = { .vop_create = VOP_PANIC, .vop_fsync = vop_stdfsync, .vop_getattr = devfs_getattr, + .vop_inotify = devfs_inotify, .vop_ioctl = devfs_ioctl, .vop_link = VOP_PANIC, .vop_mkdir = VOP_PANIC, diff --git a/tests/sys/kern/inotify_test.c b/tests/sys/kern/inotify_test.c index 0c2cc260f29e..8f16b9949932 100644 --- a/tests/sys/kern/inotify_test.c +++ b/tests/sys/kern/inotify_test.c @@ -318,6 +318,40 @@ ATF_TC_BODY(inotify_mask_create, tc) close_inotify(ifd); } +/* + * Verify that inotify events are not generated for devfs. In principle such + * events could leak timing information about I/O device accesses. + */ +ATF_TC_WITHOUT_HEAD(inotify_devfs); +ATF_TC_BODY(inotify_devfs, tc) +{ + char buf[1]; + int fd, ifd, n, wd1, wd2, wd3; + + ifd = inotify(IN_NONBLOCK); + + wd1 = inotify_add_watch(ifd, "/dev", IN_ALL_EVENTS); + ATF_REQUIRE(wd1 >= 0); + wd2 = inotify_add_watch(ifd, "/dev/null", IN_ALL_EVENTS); + ATF_REQUIRE(wd2 >= 0); + wd3 = inotify_add_watch(ifd, "/dev/zero", IN_ALL_EVENTS); + ATF_REQUIRE(wd3 >= 0); + + fd = open("/dev/null", O_WRONLY); + ATF_REQUIRE(fd != -1); + ATF_REQUIRE(write(fd, buf, sizeof(buf)) == (ssize_t)sizeof(buf)); + close_checked(fd); + + fd = open("/dev/zero", O_RDONLY); + ATF_REQUIRE(fd != -1); + ATF_REQUIRE(read(fd, buf, sizeof(buf)) == (ssize_t)sizeof(buf)); + close_checked(fd); + + ATF_REQUIRE(ioctl(ifd, FIONREAD, &n) == 0); + ATF_REQUIRE_MSG(n == 0, "unexpected %d bytes of inotify events", n); + close_checked(ifd); +} + /* * Make sure that inotify cooperates with nullfs: if a lower vnode is the * subject of an event, the upper vnode should be notified, and if the upper @@ -1011,6 +1045,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, inotify_capsicum); ATF_TP_ADD_TC(tp, inotify_coalesce); ATF_TP_ADD_TC(tp, inotify_mask_create); + ATF_TP_ADD_TC(tp, inotify_devfs); ATF_TP_ADD_TC(tp, inotify_nullfs); ATF_TP_ADD_TC(tp, inotify_nullfs_remove); ATF_TP_ADD_TC(tp, inotify_nullfs_rename);