115 Commits
Author SHA1 Message Date
gVisor bot 41c56d467b Merge pull request #10996 from cweld510:cweld/optionally-close-unix-sockets-on-save
PiperOrigin-RevId: 684217787
2024-10-09 16:54:50 -07:00
cweld510 db4ffada10 style feedback: remove newlines, fix import, remove stray comment 2024-10-07 22:39:13 +00:00
cweld510 727bc9c72a Add and implement option to close unsaveable gofer-backed unix sockets
on save
2024-10-04 20:13:38 +00:00
Ayush RanjanandgVisor bot 7e395bbbd4 Plumb restore context to load*() methods.
This allows for external information to be passed to restore code.
Similar to c087777e37 ("Plumb restore context to afterLoad()").

Updates #1956.

PiperOrigin-RevId: 614125262
2024-03-08 20:28:02 -08:00
Fabricio VoznikaandgVisor bot c087777e37 Plumb restore context to afterLoad()
This allows for external information to be passed to restore code, like
host FDs to be remapped.

Updates #1956

PiperOrigin-RevId: 612540749
2024-03-04 12:21:50 -08:00
Jamie LiuandgVisor bot a9bdef2352 More accurately replicate Linux's Unix domain socket event notification.
The documentation for EPOLLET (which repeatedly instructs users to read/write
until EAGAIN or short read) suggests that its intent is to only cause an epoll
notification when an FD registered with EPOLLET transitions from not-readable
to readable, or not-writable to writable. In practice, however, the actual
implementation for at least Unix domain sockets will trigger an epoll
notification on *every* send (cf. `net/unix/af_unix.c:unix_stream_sendmsg()` =>
"`other->sk_data_ready(other)`" => `net/core/sock.c:sock_def_readable()`), and
nginx (which registers Unix domain sockets with EPOLLET and - apparently
incorrectly - does *not* read from them until EAGAIN or short read) depends on
this property.

PiperOrigin-RevId: 601911295
2024-01-26 17:50:54 -08:00
Jing ChenandgVisor bot be48200c0e Re-order loads in BUILD files to make transformations reversible in Copybara.
PiperOrigin-RevId: 598898756
2024-01-16 11:21:40 -08:00
Ayush RanjanandgVisor bot 39afbf09cd Fix connectionedEndpoint.Readiness() to return EPOLL{RD}HUP appropriately.
Compare net/unix/af_unix.c:unix_poll().

Fixes #7331
Updates dart-lang/sdk#47899
Updates GoogleCloudPlatform/functions-framework-dart#302

PiperOrigin-RevId: 597625614
2024-01-11 12:34:33 -08:00
Nicolas LacasseandgVisor bot 9c0d595c8f Convert Recv and RecvMsg arguments/output into structs.
...they were getting out of control.

The two interface methods now take the same RecvArgs inputs, and return
RecvOutput.

I left `data [][]byte` as an explicit argument since it's technically an
argument (passed into Recv method), but acts like an output in that data is
written to it.

PiperOrigin-RevId: 578625002
2023-11-01 13:37:10 -07:00
Nicolas LacasseandgVisor bot e1e7edcc1b Don't release unused RightsControlMessage in Recv.
This Recv method is called with mm.activeRWMutex in mm.CopyOutFrom, which can
lead to lock order violatations because Release()ing a RightsControlMessage can
trigger filesystem operations (like inotify) which may need filesystem locks.

Instead, we plumb these "unusedRights" messages allll the way up to the
EndpointReader, where they can be safely released outside of mm.activeRWMutex.

PiperOrigin-RevId: 578584323
2023-11-01 11:35:09 -07:00
Nayana BidariandgVisor bot aa02c6fa15 Fix SO_ACCEPTCONN option for unix sockets.
SO_ACCEPTCONN returns true for TCP sockets which are in a listening state.
Added this socket option support for unix sockets.

PiperOrigin-RevId: 577008617
2023-10-26 15:48:38 -07:00
Andrei Vagin 5f4abad306 Fix a few typos
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.

Signed-off-by: Andrei Vagin <avagin@gmail.com>
2023-10-25 12:13:42 -07:00
Andrei VaginandgVisor bot 46115504ec Implement the setns syscall
This change introduces the nsfs file system. Each new namespace allocates
a new nsfs inode.

Here are reasons why we need these inodes:
* each namespace has to have an unique id.
* proc/pid/ns/ contains one entry for each namespace. Bind mounting one of
  the files in this directory to somewhere else in the filesystem keeps the
  corresponding namespace alive even if all processes currently in
  the namespace terminate.
* setns() allows the calling process to join an existing namespace specified
  by a file descriptor.

PiperOrigin-RevId: 550694515
2023-07-24 15:45:08 -07:00
Kevin KrakauerandgVisor bot 89d6bf18c8 have gVisor use renamed buffer package
PiperOrigin-RevId: 537209194
2023-06-01 21:27:49 -07:00
Nicolas LacasseandgVisor bot a7e1fe92f5 Don't hold baseEndpoint.mu when calling receiver.Recv.
We only need baseEndpoint.mu to read e.receiver, which we copy
before calling Recv() on in.

Reported-by: syzbot+f8566b86ff7c2613d8ce@syzkaller.appspotmail.com
Reported-by: syzbot+9f8368319cf3570ea45b@syzkaller.appspotmail.com
PiperOrigin-RevId: 530970638
2023-05-10 12:07:18 -07:00
Nicolas LacasseandgVisor bot 2044c34491 Don't hold streamQueueReceiver.mu while calling RightsControlMessage.Release().
This leads to lock order violations.

Reported-by: syzbot+c8a2ae926db29417b836@syzkaller.appspotmail.com
PiperOrigin-RevId: 530726950
2023-05-09 15:21:21 -07:00
Kevin KrakauerandgVisor bot 8478fe0a27 stop using tcpip.FullAddress with unix sockets
It's unnecessarily overloading the type, which makes it hard to change the type
in netstack.

PiperOrigin-RevId: 526168235
2023-04-21 16:48:37 -07:00
Ayush RanjanandgVisor bot 6669003321 Make HostBountEndpoint.SetBoundSocketFD take ownership of bound socket FD.
Earlier SetBoundSocketFD() was taking ownership of bound socket FD only on
success. Having it take ownership unconditionally is cleaner.

PiperOrigin-RevId: 516903597
2023-03-15 12:53:27 -07:00
Adin ScannellandgVisor bot 1ceb814544 Add default_applicable_licenses rules to packages.
PiperOrigin-RevId: 513581243
2023-03-02 10:50:04 -08:00
gVisor bot c15ea6da04 Inherit SO_PASSCRED from listening socket on server socket
PiperOrigin-RevId: 508137166
2023-02-08 11:35:35 -08:00
Ayush RanjanandgVisor bot 175db901ca Replace pkg/refs with pkg/refsvfs2.
All VFS1 only bits have been deleted.

Updates #1624

PiperOrigin-RevId: 492273183
2022-12-01 12:46:11 -08:00
Etienne PerotandgVisor bot 1ceee8c310 connectioned: Change nested lock name to only have a single nested lock.
Now there's the unnamed one, and "higherID" which is the lock for the
endpoint that has a higher ID.

The lock dependency should consistently be "lower ID" -> "higher ID".

PiperOrigin-RevId: 491716600
2022-11-29 13:06:57 -08:00
Etienne PerotandgVisor bot 445fa6f40c Lockdep: Print more info in the "unbalanced unlock" case.
This CL does the following:

- Add the ability for nested locks to have names.
- Give names to all current uses of nested locks in the codebase.
- Truncate `lockdep` debug stack traces to avoid the clutter from the
  `lockdep` code itself
- Simplify `lockdep` to not longer require `classMap`.

PiperOrigin-RevId: 491486620
2022-11-28 17:53:09 -08:00
Kevin KrakauerandgVisor bot d8aa09e04c convert uses of interface{} to any
Done via:
  find . -name "*.go" | xargs sed -i -E 's/interface\{\}/any/g'

PiperOrigin-RevId: 487033228
2022-11-08 13:14:06 -08:00
Ayush RanjanandgVisor bot b84129aace Add support for ErrAlreadyBound-like scenarios in transport.HostBountEndpoint.
Earlier we were panicking if connectionedEndpoint.boundSocketFD was already set.
Now we return the error associated with syserr.ErrAlreadyBound when we see that
the socket is already bound. This situation  can be easily triggered by double
bind(2) on the same socket. Fortunately, this feature is off by default.

Added better error handling for failures.
Added a regression test for this.

PiperOrigin-RevId: 476538438
2022-09-23 23:19:50 -07:00