Make AIO a loadable module.

Remove the explicit call to aio_proc_rundown() from exit1(), instead AIO
will use at_exit(9).

Add functions at_exec(9), rm_at_exec(9) which function nearly the
same as at_exec(9) and rm_at_exec(9), these functions are called
on behalf of modules at the time of execve(2) after the image
activator has run.

Use a modified version of tegge's suggestion via at_exec(9) to close
an exploitable race in AIO.

Fix SYSCALL_MODULE_HELPER such that it's archetecuterally neutral,
the problem was that one had to pass it a paramater indicating the
number of arguments which were actually the number of "int".  Fix
it by using an inline version of the AS macro against the syscall
arguments.  (AS should be available globally but we'll get to that
later.)

Add a primative system for dynamically adding kqueue ops, it's really
not as sophisticated as it should be, but I'll discuss with jlemon when
he's around.

1 files changed, 41 insertions, 2 deletions

diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 5b4445c..6bec056 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -122,7 +122,16 @@ SYSCTL_INT(_kern, OID_AUTO, kq_calloutmax, CTLFLAG_RW,
 #define	KN_HASHSIZE		64		/* XXX should be tunable */
 #define KN_HASH(val, mask)	(((val) ^ (val >> 8)) & (mask))
 
-extern struct filterops aio_filtops;
+static int
+filt_nullattach(struct knote *kn)
+{
+
+	return (ENXIO);
+};
+
+struct filterops null_filtops =
+	{ 0, filt_nullattach, NULL, NULL };
+
 extern struct filterops sig_filtops;
 
 /*
@@ -131,7 +140,7 @@ extern struct filterops sig_filtops;
 static struct filterops *sysfilt_ops[] = {
 	&file_filtops,			/* EVFILT_READ */
 	&file_filtops,			/* EVFILT_WRITE */
-	&aio_filtops,			/* EVFILT_AIO */
+	&null_filtops,			/* EVFILT_AIO */
 	&file_filtops,			/* EVFILT_VNODE */
 	&proc_filtops,			/* EVFILT_PROC */
 	&sig_filtops,			/* EVFILT_SIGNAL */
@@ -460,6 +469,36 @@ done:
 }
 
 int
+kqueue_add_filteropts(int filt, struct filterops *filtops)
+{
+
+	if (filt > 0)
+		panic("filt(%d) > 0", filt);
+	if (filt + EVFILT_SYSCOUNT < 0)
+		panic("filt(%d) + EVFILT_SYSCOUNT(%d) == %d < 0",
+		    filt, EVFILT_SYSCOUNT, filt + EVFILT_SYSCOUNT);
+	if (sysfilt_ops[~filt] != &null_filtops)
+		panic("sysfilt_ops[~filt(%d)] != &null_filtops", filt);
+	sysfilt_ops[~filt] = filtops;
+	return (0);
+}
+
+int
+kqueue_del_filteropts(int filt)
+{
+
+	if (filt > 0)
+		panic("filt(%d) > 0", filt);
+	if (filt + EVFILT_SYSCOUNT < 0)
+		panic("filt(%d) + EVFILT_SYSCOUNT(%d) == %d < 0",
+		    filt, EVFILT_SYSCOUNT, filt + EVFILT_SYSCOUNT);
+	if (sysfilt_ops[~filt] == &null_filtops)
+		panic("sysfilt_ops[~filt(%d)] != &null_filtops", filt);
+	sysfilt_ops[~filt] = &null_filtops;
+	return (0);
+}
+
+int
 kqueue_register(struct kqueue *kq, struct kevent *kev, struct thread *td)
 {
 	struct filedesc *fdp = kq->kq_fdp;