Commit Graph

3528 Commits

Author SHA1 Message Date
Dean Deng 399c52888d Resolve remaining inotify TODOs.
Also refactor HandleDeletion().

Updates #1479.

PiperOrigin-RevId: 317989000
2020-06-23 20:05:28 -07:00
Dean Deng 2189e0a660 Clean up hostfs TODOs.
This CL does a handful of things:
- Support O_DSYNC, O_SYNC
- Support O_APPEND and document an unavoidable race condition
- Ignore O_DIRECT; we probably don't want to allow applications to set O_DIRECT
  on the host fd itself.
- Leave a TODO for supporting O_NONBLOCK, which is a simple fix once RWF_NOWAIT
  is supported.
- Get rid of caching TODO; force_page_cache is not configurable for host fs in
  vfs1 or vfs2 after whitelist fs was removed.
- For the remaining TODOs, link to more specific bugs.

Fixes #1672.

PiperOrigin-RevId: 317985269
2020-06-23 19:24:43 -07:00
Ian Gudger 2141013dce Add support for SO_REUSEADDR to TCP sockets/endpoints.
For TCP sockets, SO_REUSEADDR relaxes the rules for binding addresses.

gVisor/netstack already supported a behavior similar to SO_REUSEADDR, but did
not allow disabling it. This change brings the SO_REUSEADDR behavior closer to
the behavior implemented by Linux and adds a new SO_REUSEADDR disabled
behavior. Like Linux, SO_REUSEADDR is now disabled by default.

PiperOrigin-RevId: 317984380
2020-06-23 19:15:38 -07:00
Nicolas Lacasse 0f328beb0d Port /dev/tty device to VFS2.
Support is limited to the functionality that exists in VFS1.

Updates #2923 #1035

PiperOrigin-RevId: 317981417
2020-06-23 18:48:37 -07:00
Dean Deng 65a587dedf Complete inotify IN_EXCL_UNLINK implementation in VFS2.
Events were only skipped on parent directories after their children were
unlinked; events on the unlinked file itself need to be skipped as well.

As a result, all Watches.Notify() calls need to know whether the dentry where
the call came from was unlinked.

Updates #1479.

PiperOrigin-RevId: 317979476
2020-06-23 18:33:04 -07:00
Ting-Yu Wang acf519a77b Nit fix: Create and use a std::string object for `const char*`.
PiperOrigin-RevId: 317973144
2020-06-23 17:44:34 -07:00
Dean Deng 0c628c3152 Support inotify in vfs2 gofer fs.
Because there is no inode structure stored in the sandbox, inotify watches
must be held on the dentry. This would be an issue in the presence of hard
links, where multiple dentries would need to share the same set of watches,
but in VFS2, we do not support the internal creation of hard links on gofer
fs. As a result, we make the assumption that every dentry corresponds to a
unique inode.

Furthermore, dentries can be cached and then evicted, even if the underlying
file has not be deleted. We must prevent this from occurring if there are any
watches that would be lost. Note that if the dentry was deleted or invalidated
(d.vfsd.IsDead()), we should still destroy it along with its watches.

Additionally, when a dentry’s last watch is removed, we cache it if it also
has zero references. This way, the dentry can eventually be evicted from
memory if it is no longer needed. This is accomplished with a new dentry
method, OnZeroWatches(), which is called by Inotify.RmWatch and
Inotify.Release. Note that it must be called after all inotify locks are
released to avoid violating lock order. Stress tests are added to make sure
that inotify operations don't deadlock with gofer.OnZeroWatches.

Updates #1479.

PiperOrigin-RevId: 317958034
2020-06-23 16:14:56 -07:00
Ting-Yu Wang 793edf4cb4 Deflake proc test: Don't fail on DT_UNKNOWN.
Per manual page:
"All applications must properly handle a return of DT_UNKNOWN."

PiperOrigin-RevId: 317957013
2020-06-23 16:07:26 -07:00
Nicolas Lacasse edea9a8d02 Port readahead to VFS2.
It preserves the same functionality (almost none) as in VFS1.

Updates #2923 #1035

PiperOrigin-RevId: 317943522
2020-06-23 14:53:33 -07:00
gVisor bot ca1bc46f15 Internal change.
PiperOrigin-RevId: 317941748
2020-06-23 14:42:15 -07:00
gVisor bot 44dd65ce1e Merge pull request #2272 from lubinszARM:pr_serr_injection
PiperOrigin-RevId: 317933650
2020-06-23 13:53:56 -07:00
Dean Deng 38d7b2fe56 Only allow regular files, sockets, pipes, and char devices to be imported.
PiperOrigin-RevId: 317796028
2020-06-22 21:30:54 -07:00
Ayush Ranjan c9e6978062 Fix the way PR build clones gVisor.
Copybara force-pushes to the PR immediately before merging which triggers a PR
build. Since the PR is merged, the refspec +refs/pull/{pr_num}/merge is not
available and the build fails causing all master commit CI builds to show a
failure.

This change remove the clone step from travis and clone manually in a way
which always would succeed. We fetch +refs/pull/{pr_num}/head and cherry pick
that onto the target branch.

I have tested this in https://github.com/ayushr2/gvisor/pull/1 and
https://github.com/ayushr2/gvisor/pull/2.

PiperOrigin-RevId: 317759891
2020-06-22 16:36:52 -07:00
Dean Deng 4573e7d863 Check for invalid trailing / when traversing path in gofer OpenAt.
Updates #2923.

PiperOrigin-RevId: 317700049
2020-06-22 11:39:41 -07:00
Bruno Dal Bo 282a6aea1b Extract common nested LinkEndpoint pattern
... and unify logic for detached netsted endpoints.

sniffer.go caused crashes if a packet delivery is attempted when the dispatcher
is nil.

Extracted the endpoint nesting logic into a common composable type so it can be
used by the Fuchsia Netstack (the pattern is widespread there).

PiperOrigin-RevId: 317682842
2020-06-22 10:31:45 -07:00
Nicolas Lacasse a480b4faf4 Allow readdir(/proc/[tid]/net) to return EINVAL on a zombie task.
Despite what the man page says, linux will return EINVAL when calling
getdents() an a /proc/[tid]/net file corresponding to a zombie task. This
causes readdir() to return a null pointer AND errno=EINVAL.

See fs/proc/proc_net.c:proc_tgid_net_readdir() for where this occurs.

We have tests that recursively read /proc, and are likely to hit this when
running natively, so we must catch and handle this case.

PiperOrigin-RevId: 317674168
2020-06-22 09:54:22 -07:00
Dean Deng 00928d142d Fix vfs2 extended attributes.
Correct behavior when given zero size arguments and trying to set user.* xattrs
on files other than regular files or directories.

Updates #2923.

PiperOrigin-RevId: 317590409
2020-06-21 21:48:19 -07:00
Dean Deng f46f4a2af9 Enable passing vfs2 tests.
I forgot to update getdents earlier. Several thousand runs of the fsync and
proc_net_unix tests all passed as well.

Updates #2923.

PiperOrigin-RevId: 317415488
2020-06-19 18:27:29 -07:00
Dean Deng ad9f469174 Fix bugs in vfs2 to make symlink tests pass.
- Return ENOENT if target path is empty.
- Make sure open(2) with O_CREAT|O_EXCL returns EEXIST when necessary.
- Correctly update atime in tmpfs using touchATime().

Updates #2923.

PiperOrigin-RevId: 317382655
2020-06-19 14:41:14 -07:00
Nicolas Lacasse f0feada89c Use internal tmpfs in test runner, even when running with overlay.
PiperOrigin-RevId: 317377571
2020-06-19 14:14:21 -07:00
Dean Deng 8655fb7248 Fix vfs2 proc/self/fd dirent iteration.
Make proc/self/fd iteration work properly. Also, the comment on
kernfs.Inode.IterDirents did not accurately reflect how parameters should be
used/were used in kernfs.Inode impls other than fdDir.

Updates #2923.

PiperOrigin-RevId: 317370325
2020-06-19 13:36:18 -07:00
Dean Deng 7db196c4db Port fadvise64 to vfs2.
Like vfs1, we have a trivial implementation that ignores all valid advice.

Updates #2923.

PiperOrigin-RevId: 317349505
2020-06-19 11:50:09 -07:00
gVisor bot d962f9f384 Implement UDP cheksum verification.
Test:
 - TestIncrementChecksumErrors

Fixes #2943

PiperOrigin-RevId: 317348158
2020-06-19 11:43:20 -07:00
Dean Deng a609fff9d1 Fix vfs2 handling of preadv2/pwritev2 flags.
Check for unsupported flags, and silently support RWF_HIPRI by doing nothing.
From pkg/abi/linux/file.go: "gVisor does not implement the RWF_HIPRI feature,
but the flag is accepted as a valid flag argument for preadv2/pwritev2."

Updates #2923.

PiperOrigin-RevId: 317330631
2020-06-19 10:19:46 -07:00
Dean Deng f40d023ad6 Don't adjust parent link count if we replace a child dir with another.
Updates #2923.

PiperOrigin-RevId: 317314460
2020-06-19 08:45:40 -07:00
Dean Deng 6b69b955d7 Support all seek options in gofer specialFileFD.Seek.
Updates #2923.

PiperOrigin-RevId: 317298186
2020-06-19 06:39:09 -07:00
Dean Deng 46957ed24f Fix synthetic file bugs in gofer fs.
Always check if a synthetic file already exists at a location before creating a
file there, and do not try to delete synthetic gofer files from the remote fs.

This fixes runsc_ptrace socket tests that create/unlink synthetic, named socket
files.

Updates #2923.

PiperOrigin-RevId: 317293648
2020-06-19 05:57:15 -07:00
Dean Deng 408f3d2cd6 Fix vfs2 tmpfs link permission checks.
Updates #2923.

PiperOrigin-RevId: 317246916
2020-06-18 22:02:07 -07:00
Andrei Vagin 70c45e09cf socket/unix: (*connectionedEndpoint).State() has to take the endpoint lock
It accesses e.receiver which is protected by the endpoint lock.

WARNING: DATA RACE
Write at 0x00c0006aa2b8 by goroutine 189:
  pkg/sentry/socket/unix/transport.(*connectionedEndpoint).Connect.func1()
      pkg/sentry/socket/unix/transport/connectioned.go:359 +0x50
  pkg/sentry/socket/unix/transport.(*connectionedEndpoint).BidirectionalConnect()
      pkg/sentry/socket/unix/transport/connectioned.go:327 +0xa3c
  pkg/sentry/socket/unix/transport.(*connectionedEndpoint).Connect()
      pkg/sentry/socket/unix/transport/connectioned.go:363 +0xca
  pkg/sentry/socket/unix.(*socketOpsCommon).Connect()
      pkg/sentry/socket/unix/unix.go:420 +0x13a
  pkg/sentry/socket/unix.(*SocketOperations).Connect()
      <autogenerated>:1 +0x78
  pkg/sentry/syscalls/linux.Connect()
      pkg/sentry/syscalls/linux/sys_socket.go:286 +0x251

Previous read at 0x00c0006aa2b8 by goroutine 270:
  pkg/sentry/socket/unix/transport.(*baseEndpoint).Connected()
      pkg/sentry/socket/unix/transport/unix.go:789 +0x42
  pkg/sentry/socket/unix/transport.(*connectionedEndpoint).State()
      pkg/sentry/socket/unix/transport/connectioned.go:479 +0x2f
  pkg/sentry/socket/unix.(*socketOpsCommon).State()
      pkg/sentry/socket/unix/unix.go:714 +0xc3e
  pkg/sentry/socket/unix.(*socketOpsCommon).SendMsg()
      pkg/sentry/socket/unix/unix.go:466 +0xc44
  pkg/sentry/socket/unix.(*SocketOperations).SendMsg()
      <autogenerated>:1 +0x173
  pkg/sentry/syscalls/linux.sendTo()
      pkg/sentry/syscalls/linux/sys_socket.go:1121 +0x4c5
  pkg/sentry/syscalls/linux.SendTo()
      pkg/sentry/syscalls/linux/sys_socket.go:1134 +0x87

Reported-by: syzbot+c2be37eedc672ed59a86@syzkaller.appspotmail.com
PiperOrigin-RevId: 317236996
2020-06-18 20:28:10 -07:00
Kevin Krakauer 0c169b6ad5 iptables: skip iptables if no rules are set
Users that never set iptables rules shouldn't incur the iptables performance
cost. Suggested by Ian (@iangudger).

PiperOrigin-RevId: 317232921
2020-06-18 19:46:36 -07:00
Kevin Krakauer 28b8a5cc3a iptables: remove metadata struct
Metadata was useful for debugging and safety, but enough tests exist that we
should see failures when (de)serialization is broken. It made stack
initialization more cumbersome and it's also getting in the way of ip6tables.

PiperOrigin-RevId: 317210653
2020-06-18 17:02:16 -07:00
Fabricio Voznika 878050b5cf Enable more VFS2 syscall tests
Updates #2923

PiperOrigin-RevId: 317185798
2020-06-18 14:52:54 -07:00
Ting-Yu Wang f97122f44c Acquire lock when accessing MultiDevice's cache in String().
PiperOrigin-RevId: 317180925
2020-06-18 14:29:42 -07:00
Kevin Krakauer f1aa919181 Ensure ip6tables module installed
This module isn't always loaded automatically.

PiperOrigin-RevId: 317164471
2020-06-18 13:06:50 -07:00
Michael Pratt 3970c12743 Remove various uses of 'whitelist'
Updates #2972

PiperOrigin-RevId: 317113059
2020-06-18 09:03:39 -07:00
Bhasker Hariharan 07ff909e76 Support setsockopt SO_SNDBUF/SO_RCVBUF for raw/udp sockets.
Updates #173,#6
Fixes #2888

PiperOrigin-RevId: 317087652
2020-06-18 06:07:20 -07:00
Ghanan Gowripalan 09b2fca40c Cleanup tcp.timer and tcpip.Route
When a tcp.timer or tcpip.Route is no longer used, clean up its
resources so that unused memory may be released.

PiperOrigin-RevId: 317046582
2020-06-18 00:10:05 -07:00
Fabricio Voznika 6e0c170522 Implement Sync() to directories
Updates #1035, #1199

PiperOrigin-RevId: 317028108
2020-06-17 21:22:16 -07:00
Fabricio Voznika 22b0bb2138 Add TempTmpMount test
This currently doesn't work with VSF2. Add test to ensure
it's not missed.

Updates #1487

PiperOrigin-RevId: 317013792
2020-06-17 19:09:37 -07:00
Fabricio Voznika 97f6b20e89 Move mount configutation to RunOpts
Separate mount configuration from links and move it to
RunOpts, like the other options.

PiperOrigin-RevId: 317010158
2020-06-17 18:43:26 -07:00
Ghanan Gowripalan 57286eb642 Increase timeouts for NDP tests
... to help reduce flakes.

When waiting for an event to occur, use a timeout of 10s. When waiting
for an event to not occur, use a timeout of 1s.

Test: Ran test locally w/ run count of 1000 with and without gotsan.
PiperOrigin-RevId: 316998128
2020-06-17 17:22:43 -07:00
Ian Gudger 02072fd243 Add test for stat("/proc/net/snmp").
PiperOrigin-RevId: 316974863
2020-06-17 15:15:57 -07:00
gVisor bot a5f4deeca7 Internal change.
PiperOrigin-RevId: 316973783
2020-06-17 15:10:40 -07:00
Nicolas Lacasse 28a5c55bb6 Proc test: Allow root mount pathname to be non-root.
The test was expecting that the root mount pathname was "/", but it doesn't
need to be. Only the mount point actually should be "/" (otherwise it is not
the root).

PiperOrigin-RevId: 316968025
2020-06-17 14:42:41 -07:00
Bhasker Hariharan 505e8f4e3d Fix TtlDefault test on linux.
Different flavors of linux seem to use different defaults we accept 64
or 127 as the TtlDefault in the test.

PiperOrigin-RevId: 316961150
2020-06-17 14:08:48 -07:00
Michael Pratt 6d806ee719 Remove various uses of 'blacklist'
Updates #2972

PiperOrigin-RevId: 316942245
2020-06-17 12:34:33 -07:00
Dean Deng e5d97cbcc1 Refactor host.canMap.
Simplify the canMap check. We do not have plans to allow mmap for anything
beyond regular files, so we can just inline canMap() as a simple file mode
check.

Updates #1672.

PiperOrigin-RevId: 316929654
2020-06-17 11:34:06 -07:00
Mithun Iyer 50afec55c7 TCP stat fixes
Ensure that CurrentConnected stat is updated on any errors and cleanups
during connected state processing.

Fixes #2968

PiperOrigin-RevId: 316919426
2020-06-17 10:47:04 -07:00
Fabricio Voznika 96519e2c9d Implement POSIX locks
- Change FileDescriptionImpl Lock/UnlockPOSIX signature to
  take {start,length,whence}, so the correct offset can be
  calculated in the implementations.
- Create PosixLocker interface to make it possible to share
  the same locking code from different implementations.

Closes #1480

PiperOrigin-RevId: 316910286
2020-06-17 10:04:26 -07:00
Nicolas Lacasse 6d64028c94 Fix typos in test/README.md.
Closes #2996.

PiperOrigin-RevId: 316900535
2020-06-17 09:13:09 -07:00