From 560aa751e0f5cfef868bdf3fab01cdbc5169ef82 Mon Sep 17 00:00:00 2001 From: kib Date: Mon, 22 Oct 2012 17:50:54 +0000 Subject: Remove the support for using non-mpsafe filesystem modules. In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho --- sys/security/mac/mac_process.c | 8 ++------ sys/security/mac/mac_syscalls.c | 33 ++++++++++----------------------- 2 files changed, 12 insertions(+), 29 deletions(-) (limited to 'sys/security/mac') diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index 214e748..8e5e5bc 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -254,7 +254,7 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { vm_map_entry_t vme; - int vfslocked, result; + int result; vm_prot_t revokeperms; vm_object_t backing_object, object; vm_ooffset_t offset; @@ -300,7 +300,6 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); result = vme->max_protection; mac_vnode_check_mmap_downgrade(cred, vp, &result); @@ -310,10 +309,8 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, * but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; - if (!revokeperms) { - VFS_UNLOCK_GIANT(vfslocked); + if (!revokeperms) continue; - } printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, @@ -369,7 +366,6 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } - VFS_UNLOCK_GIANT(vfslocked); } vm_map_unlock(map); } diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index a20938c..ff55ec9 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -230,7 +230,7 @@ sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) struct pipe *pipe; struct socket *so; short label_type; - int vfslocked, error; + int error; error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) @@ -262,11 +262,9 @@ sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) } vp = fp->f_vnode; intlabel = mac_vnode_label_alloc(); - vfslocked = VFS_LOCK_GIANT(vp->v_mount); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); mac_vnode_copy_label(vp->v_label, intlabel); VOP_UNLOCK(vp, 0); - VFS_UNLOCK_GIANT(vfslocked); error = mac_vnode_externalize_label(intlabel, elements, buffer, mac.m_buflen); mac_vnode_label_free(intlabel); @@ -322,7 +320,7 @@ sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap) struct nameidata nd; struct label *intlabel; struct mac mac; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -343,20 +341,18 @@ sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap) } buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | FOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); if (error) goto out; intlabel = mac_vnode_label_alloc(); - vfslocked = NDHASGIANT(&nd); mac_vnode_copy_label(nd.ni_vp->v_label, intlabel); error = mac_vnode_externalize_label(intlabel, elements, buffer, mac.m_buflen); NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); if (error == 0) error = copyout(buffer, mac.m_string, strlen(buffer)+1); @@ -375,7 +371,7 @@ sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap) struct nameidata nd; struct label *intlabel; struct mac mac; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -396,19 +392,17 @@ sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap) } buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | NOFOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); if (error) goto out; intlabel = mac_vnode_label_alloc(); - vfslocked = NDHASGIANT(&nd); mac_vnode_copy_label(nd.ni_vp->v_label, intlabel); error = mac_vnode_externalize_label(intlabel, elements, buffer, mac.m_buflen); NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); if (error == 0) @@ -432,7 +426,7 @@ sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) struct vnode *vp; struct mac mac; char *buffer; - int error, vfslocked; + int error; error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) @@ -467,10 +461,8 @@ sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) break; } vp = fp->f_vnode; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) { - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); break; } @@ -478,7 +470,6 @@ sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) error = vn_setlabel(vp, intlabel, td->td_ucred); VOP_UNLOCK(vp, 0); vn_finished_write(mp); - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); break; @@ -532,7 +523,7 @@ sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) struct mount *mp; struct mac mac; char *buffer; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -558,10 +549,9 @@ sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) if (error) goto out; - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | FOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); - vfslocked = NDHASGIANT(&nd); if (error == 0) { error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error == 0) { @@ -572,7 +562,6 @@ sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) } NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); out: mac_vnode_label_free(intlabel); return (error); @@ -586,7 +575,7 @@ sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) struct mount *mp; struct mac mac; char *buffer; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -612,10 +601,9 @@ sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) if (error) goto out; - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | NOFOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); - vfslocked = NDHASGIANT(&nd); if (error == 0) { error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error == 0) { @@ -626,7 +614,6 @@ sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) } NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); out: mac_vnode_label_free(intlabel); return (error); -- cgit v1.1