Installed the second patch attached to kern/7899 with some changes suggested

by bde, a few other tweaks to get the patch to apply cleanly again and
some improvements to the comments.

This change closes some fairly minor security holes associated with
F_SETOWN, fixes a few bugs, and removes some limitations that F_SETOWN
had on tty devices.  For more details, see the description on the PR.

Because this patch increases the size of the proc and pgrp structures,
it is necessary to re-install the includes and recompile libkvm,
the vinum lkm, fstat, gcore, gdb, ipfilter, ps, top, and w.

PR:		kern/7899
Reviewed by:	bde, elvind

1 files changed, 17 insertions, 14 deletions

diff --git a/sys/net/bpf.c b/sys/net/bpf.c
index f9a217b..39d2d26 100644
--- a/sys/net/bpf.c
+++ b/sys/net/bpf.c
@@ -37,7 +37,7 @@
  *
  *      @(#)bpf.c	8.2 (Berkeley) 3/28/94
  *
- * $Id: bpf.c,v 1.43 1998/10/04 23:04:48 alex Exp $
+ * $Id: bpf.c,v 1.44 1998/10/08 00:32:08 alex Exp $
  */
 
 #include "bpfilter.h"
@@ -61,6 +61,7 @@
 #include <sys/filio.h>
 #include <sys/sockio.h>
 #include <sys/ttycom.h>
+#include <sys/filedesc.h>
 
 #if defined(sparc) && BSD < 199103
 #include <sys/stream.h>
@@ -379,6 +380,7 @@ bpfclose(dev, flags, fmt, p)
 	register struct bpf_d *d = &bpf_dtab[minor(dev)];
 	register int s;
 
+	funsetown(d->bd_sigio);
 	s = splimp();
 	if (d->bd_bif)
 		bpf_detachd(d);
@@ -537,11 +539,8 @@ bpf_wakeup(d)
 	struct proc *p;
 
 	wakeup((caddr_t)d);
-	if (d->bd_async && d->bd_sig)
-		if (d->bd_pgid > 0)
-			gsignal (d->bd_pgid, d->bd_sig);
-		else if (p = pfind (-d->bd_pgid))
-			psignal (p, d->bd_sig);
+	if (d->bd_async && d->bd_sig && d->bd_sigio)
+		pgsigio(d->bd_sigio, d->bd_sig, 0);
 
 #if BSD >= 199103
 	selwakeup(&d->bd_sel);
@@ -834,18 +833,22 @@ bpfioctl(dev, cmd, addr, flags, p)
 		d->bd_async = *(int *)addr;
 		break;
 
-/* N.B.  ioctl (FIOSETOWN) and fcntl (F_SETOWN) both end up doing the
-   equivalent of a TIOCSPGRP and hence end up here.  *However* TIOCSPGRP's arg
-   is a process group if it's positive and a process id if it's negative.  This
-   is exactly the opposite of what the other two functions want!  Therefore
-   there is code in ioctl and fcntl to negate the arg before calling here. */
+	case FIOSETOWN:
+		error = fsetown(*(int *)addr, &d->bd_sigio);
+		break;
+
+	case FIOGETOWN:
+		*(int *)addr = fgetown(d->bd_sigio);
+		break;
 
-	case TIOCSPGRP:		/* Process or group to send signals to */
-		d->bd_pgid = *(int *)addr;
+	/* This is deprecated, FIOSETOWN should be used instead. */
+	case TIOCSPGRP:
+		error = fsetown(-(*(int *)addr), &d->bd_sigio);
 		break;
 
+	/* This is deprecated, FIOGETOWN should be used instead. */
 	case TIOCGPGRP:
-		*(int *)addr = d->bd_pgid;
+		*(int *)addr = -fgetown(d->bd_sigio);
 		break;
 
 	case BIOCSRSIG:		/* Set receive signal */