From nobody Wed Oct 07 14:56:08 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j0GQx19WXz6w1yw for ; Wed, 07 Oct 2026 14:56:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j0GQx0f17z4HPy for ; Wed, 07 Oct 2026 14:56:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791384969; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VPSYuW7JfiTO4lfuQjXS22HeovJZHmgyfzopU0hOxCg=; b=vIPqDUryjlvomEBYOvCOB2mtle31uLQ6xAyeOu4syaMxKpvvlobhJqQKV9/xV70irX0Max 8EL7t3tng/qPlgPoadIs3oe9d3O941yyRiHxWjxaUnRB0dTBbZNOjuS+el0AaIWCOwJVGg iQUyS1NxXXJeY0tkL1SUnzOz/nWnj7YruuWw4+9Q86dOZFQy2IVkt9lEEmyEZI6W727Kj5 EDxfnwqbmSDEODBiLFwDydn7lpgzGCOEGtfJB89/hw6mjNy8DXQGT2hcszvVrJo0O57spN UJlwqVnX7gXRxE33DS1XiiiASuBGGB6dXhb5RWCnH0HSVMRL7PItXuOy+8O8cA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791384969; b=fMfGH0IO5EYSTMmvgTwZYWOX1PYJwC3iMGOI8ioleFIZ+WXG346tumH+Nl5UF5Fh7OOZFB zAp0/lKZpxAqNdJjBA+ylbTAWAFKkdcYh5nbG2I11Hmyj88f0jtYkhyjmuDU4yCZkDW7Ym iC1rcdEBHPof517B69OXjNp96B84l9QIz8jLQLUCrWIF1iYIcjBSX1THXVDEDvcvLM8Gog ZgLqljELXMx4nJD1QfQ8e5l0SORTZmZLZfJZwNt5OBPw0fxQbstbWzvE8p/qxurzv2kONL dIe2ER6axprPIChX1tD0p+h77paWFChqpPaGNx6pdVVinmqu3Xd/DSu0tkLluQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791384969; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VPSYuW7JfiTO4lfuQjXS22HeovJZHmgyfzopU0hOxCg=; b=utcJGoEev+TfM1yq9ZNwhIoA2bSHZ8hpEU3jL+LNy5ayPQ4dKHb1pHjE5sByqnQ/3Rrjx0 L2WuN7DmASLFs0KyJe8zFU0b6vz5Ds5P5qHZ7YvZTjH2IzbvgTKTcqDUYiI7lW54H0fVgU br36vowpu9UIOKSw6COcKhV1QMlCcZrsCOhw+YwGGQdwJ61n4dn8BLdDlaig8mjHT9i2bN yJ2lxNIraDGNNTsZdVW3fmuDksw9guv1qx8XIxIn30OUYliJPpVCme+9XzJJjg5zsZaihn 9aqbrnCy8ARUZl9q2fCsioXp96tpX7RypUIE63eT7IS4YKXMDHdRbo860Cfrjw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j0GQw6nJLzxgW for ; Wed, 07 Oct 2026 14:56:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22507 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 07 Oct 2026 14:56:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: c2ac0db7150c - main - devfs: Explicitly disable inotify List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c2ac0db7150c53d3902dbe1c507d96cbacfcadc6 Auto-Submitted: auto-generated Date: Wed, 07 Oct 2026 14:56:08 +0000 Message-Id: <6ac65d88.22507.a0bfe77@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c2ac0db7150c53d3902dbe1c507d96cbacfcadc6 commit c2ac0db7150c53d3902dbe1c507d96cbacfcadc6 Author: Mark Johnston AuthorDate: 2026-10-07 14:36:26 +0000 Commit: Mark Johnston CommitDate: 2026-10-07 14:55:57 +0000 devfs: Explicitly disable inotify In principle, inotify can be used to leak timing information about I/O device accesses by privileged process, which might be sensitive, e.g., in the case of /dev/input. See https://inoti.fyi/#1-linux-inter-keystroke-timing In practice this does not work since I/O to devfs nodes does not go through vnodes, so the INOTIFY() calls in various VOP hooks do not fire. But, let's explicitly define a no-op VOP_INOTIFY to help ensure that no one tries to "fix" this bug. Alternately we could simply ignore VCHR/VBLK vnodes in vn_inotify(). However, maybe someday it'll be desirable to enable inotify for specific device files, in which case the filtering should live in devfs. Add a regression test. Reported by: Sudheendra Raghav Neela Reviewed by: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D60364 --- sys/fs/devfs/devfs_vnops.c | 18 ++++++++++++++++++ tests/sys/kern/inotify_test.c | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/sys/fs/devfs/devfs_vnops.c b/sys/fs/devfs/devfs_vnops.c index 53fb08c6931b..9ed7ef9f0aed 100644 --- a/sys/fs/devfs/devfs_vnops.c +++ b/sys/fs/devfs/devfs_vnops.c @@ -921,6 +921,22 @@ fiodgname_buf_get_ptr(void *fgnp, u_long com) } } +static int +devfs_inotify(struct vop_inotify_args *ap) +{ + /* + * Don't provide inotify for devfs nodes. Most of the inotify hooks + * don't fire anyway since devfs files do not use the vnode I/O path. + * If that were not the case, however, inotify could be abused to leak + * sensitive timing information, e.g., by watching for reads from + * /dev/input. Thus, we make inotify do nothing here as a safeguard. + * + * At some point it may be desirable to enable inotify for specific + * device files. + */ + return (0); +} + static int devfs_ioctl(struct vop_ioctl_args *ap) { @@ -2126,6 +2142,7 @@ static struct vop_vector devfs_vnodeops = { .vop_access = devfs_access, .vop_getattr = devfs_getattr, + .vop_inotify = devfs_inotify, .vop_ioctl = devfs_rioctl, .vop_lookup = devfs_lookup, .vop_mknod = devfs_mknod, @@ -2159,6 +2176,7 @@ static struct vop_vector devfs_specops = { .vop_create = VOP_PANIC, .vop_fsync = vop_stdfsync, .vop_getattr = devfs_getattr, + .vop_inotify = devfs_inotify, .vop_ioctl = devfs_ioctl, .vop_link = VOP_PANIC, .vop_mkdir = VOP_PANIC, diff --git a/tests/sys/kern/inotify_test.c b/tests/sys/kern/inotify_test.c index 0c2cc260f29e..8f16b9949932 100644 --- a/tests/sys/kern/inotify_test.c +++ b/tests/sys/kern/inotify_test.c @@ -318,6 +318,40 @@ ATF_TC_BODY(inotify_mask_create, tc) close_inotify(ifd); } +/* + * Verify that inotify events are not generated for devfs. In principle such + * events could leak timing information about I/O device accesses. + */ +ATF_TC_WITHOUT_HEAD(inotify_devfs); +ATF_TC_BODY(inotify_devfs, tc) +{ + char buf[1]; + int fd, ifd, n, wd1, wd2, wd3; + + ifd = inotify(IN_NONBLOCK); + + wd1 = inotify_add_watch(ifd, "/dev", IN_ALL_EVENTS); + ATF_REQUIRE(wd1 >= 0); + wd2 = inotify_add_watch(ifd, "/dev/null", IN_ALL_EVENTS); + ATF_REQUIRE(wd2 >= 0); + wd3 = inotify_add_watch(ifd, "/dev/zero", IN_ALL_EVENTS); + ATF_REQUIRE(wd3 >= 0); + + fd = open("/dev/null", O_WRONLY); + ATF_REQUIRE(fd != -1); + ATF_REQUIRE(write(fd, buf, sizeof(buf)) == (ssize_t)sizeof(buf)); + close_checked(fd); + + fd = open("/dev/zero", O_RDONLY); + ATF_REQUIRE(fd != -1); + ATF_REQUIRE(read(fd, buf, sizeof(buf)) == (ssize_t)sizeof(buf)); + close_checked(fd); + + ATF_REQUIRE(ioctl(ifd, FIONREAD, &n) == 0); + ATF_REQUIRE_MSG(n == 0, "unexpected %d bytes of inotify events", n); + close_checked(ifd); +} + /* * Make sure that inotify cooperates with nullfs: if a lower vnode is the * subject of an event, the upper vnode should be notified, and if the upper @@ -1011,6 +1045,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, inotify_capsicum); ATF_TP_ADD_TC(tp, inotify_coalesce); ATF_TP_ADD_TC(tp, inotify_mask_create); + ATF_TP_ADD_TC(tp, inotify_devfs); ATF_TP_ADD_TC(tp, inotify_nullfs); ATF_TP_ADD_TC(tp, inotify_nullfs_remove); ATF_TP_ADD_TC(tp, inotify_nullfs_rename);