svn commit: r349248 - in head/sys: fs/fifofs kern sys

[Alan Somers]

Author: asomers
Date: Thu Jun 20 23:07:20 2019
New Revision: 349248
URL: https://svnweb.freebsd.org/changeset/base/349248

Log:
  fcntl: fix overflow when setting F_READAHEAD
  
  VOP_READ and VOP_WRITE take the seqcount in blocks in a 16-bit field.
  However, fcntl allows you to set the seqcount in bytes to any nonnegative
  31-bit value. The result can be a 16-bit overflow, which will be
  sign-extended in functions like ffs_read. Fix this by sanitizing the
  argument in kern_fcntl. As a matter of policy, limit to IO_SEQMAX rather
  than INT16_MAX.
  
  Also, fifos have overloaded the f_seqcount field for a completely different
  purpose ever since r238936.  Formalize that by using a union type.
  
  Reviewed by:	cem
  MFC after:	2 weeks
  Sponsored by:	The FreeBSD Foundation
  Differential Revision:	https://reviews.freebsd.org/D20710

Modified:
  head/sys/fs/fifofs/fifo_vnops.c
  head/sys/kern/kern_descrip.c
  head/sys/kern/sys_pipe.c
  head/sys/kern/vfs_vnops.c
  head/sys/sys/file.h

Modified: head/sys/fs/fifofs/fifo_vnops.c
==============================================================================
--- head/sys/fs/fifofs/fifo_vnops.c	Thu Jun 20 22:21:42 2019	(r349247)
+++ head/sys/fs/fifofs/fifo_vnops.c	Thu Jun 20 23:07:20 2019	(r349248)
@@ -174,7 +174,7 @@ fifo_open(ap)
 			if (fip->fi_writers > 0)
 				wakeup(&fip->fi_writers);
 		}
-		fp->f_seqcount = fpipe->pipe_wgen - fip->fi_writers;
+		fp->f_pipegen = fpipe->pipe_wgen - fip->fi_writers;
 	}
 	if (ap->a_mode & FWRITE) {
 		if ((ap->a_mode & O_NONBLOCK) && fip->fi_readers == 0) {

Modified: head/sys/kern/kern_descrip.c
==============================================================================
--- head/sys/kern/kern_descrip.c	Thu Jun 20 22:21:42 2019	(r349247)
+++ head/sys/kern/kern_descrip.c	Thu Jun 20 23:07:20 2019	(r349248)
@@ -780,7 +780,9 @@ kern_fcntl(struct thread *td, int fd, int cmd, intptr_
 		}
 		if (arg >= 0) {
 			bsize = fp->f_vnode->v_mount->mnt_stat.f_iosize;
-			fp->f_seqcount = (arg + bsize - 1) / bsize;
+			arg = MIN(arg, INT_MAX - bsize + 1);
+			fp->f_seqcount = MIN(IO_SEQMAX,
+			    (arg + bsize - 1) / bsize);
 			atomic_set_int(&fp->f_flag, FRDAHEAD);
 		} else {
 			atomic_clear_int(&fp->f_flag, FRDAHEAD);

Modified: head/sys/kern/sys_pipe.c
==============================================================================
--- head/sys/kern/sys_pipe.c	Thu Jun 20 22:21:42 2019	(r349247)
+++ head/sys/kern/sys_pipe.c	Thu Jun 20 23:07:20 2019	(r349248)
@@ -1414,7 +1414,7 @@ pipe_poll(struct file *fp, int events, struct ucred *a
 	levents = events &
 	    (POLLIN | POLLINIGNEOF | POLLPRI | POLLRDNORM | POLLRDBAND);
 	if (rpipe->pipe_state & PIPE_NAMED && fp->f_flag & FREAD && levents &&
-	    fp->f_seqcount == rpipe->pipe_wgen)
+	    fp->f_pipegen == rpipe->pipe_wgen)
 		events |= POLLINIGNEOF;
 
 	if ((events & POLLINIGNEOF) == 0) {

Modified: head/sys/kern/vfs_vnops.c
==============================================================================
--- head/sys/kern/vfs_vnops.c	Thu Jun 20 22:21:42 2019	(r349247)
+++ head/sys/kern/vfs_vnops.c	Thu Jun 20 23:07:20 2019	(r349248)
@@ -499,7 +499,8 @@ sequential_heuristic(struct uio *uio, struct file *fp)
 		 * closely related to the best I/O size for real disks than
 		 * to any block size used by software.
 		 */
-		fp->f_seqcount += howmany(uio->uio_resid, 16384);
+		fp->f_seqcount += MIN(IO_SEQMAX,
+		    howmany(uio->uio_resid, 16384));
 		if (fp->f_seqcount > IO_SEQMAX)
 			fp->f_seqcount = IO_SEQMAX;
 		return (fp->f_seqcount << IO_SEQSHIFT);

Modified: head/sys/sys/file.h
==============================================================================
--- head/sys/sys/file.h	Thu Jun 20 22:21:42 2019	(r349247)
+++ head/sys/sys/file.h	Thu Jun 20 23:07:20 2019	(r349248)
@@ -179,7 +179,10 @@ struct file {
 	/*
 	 *  DTYPE_VNODE specific fields.
 	 */
-	int		f_seqcount;	/* (a) Count of sequential accesses. */
+	union {
+		int16_t	f_seqcount;	/* (a) Count of sequential accesses. */
+		int	f_pipegen;
+	};
 	off_t		f_nextoff;	/* next expected read/write offset. */
 	union {
 		struct cdev_privdata *fvn_cdevpriv;