xnu-2050.18.24

Imported from https://opensource.apple.com/tarballs/xnu/xnu-2050.18.24.tar.gz

bsd/hfs/hfs_vfsops.c

@@ -5113,12 +5113,14 @@ struct hfs_reclaim_extent_info {
  *                                        FABN = old FABN - E.blockCount
  *
  * Inputs: 
- *	extent_info - This is the structure that contains state about 
- *	              the current file, extent, and extent record that 
- *	              is being relocated.  This structure is shared 
- *	              among code that traverses through all the extents 
- *	              of the file, code that relocates extents, and 
- *	              code that splits the extent. 
+ *	extent_info -   This is the structure that contains state about 
+ *	                the current file, extent, and extent record that 
+ *	                is being relocated.  This structure is shared 
+ *	                among code that traverses through all the extents 
+ *	                of the file, code that relocates extents, and 
+ *	                code that splits the extent. 
+ *	newBlockCount - The blockCount of the extent to be split after 
+ *	                successfully split operation.
  * Output:
  * 	Zero on success, non-zero on failure.
  */
@@ -5148,6 +5150,13 @@ hfs_split_extent(struct hfs_reclaim_extent_info *extent_info, uint32_t newBlockC
 	extents = extent_info->extents;
 	cp = VTOC(extent_info->vp);
 
+	if (newBlockCount == 0) {
+		if (hfs_resize_debug) {
+			printf ("hfs_split_extent: No splitting required for newBlockCount=0\n");
+		}
+		return error;
+	}
+
 	if (hfs_resize_debug) {
 		printf ("hfs_split_extent: Split record:%u recStartBlock=%u %u:(%u,%u) for %u blocks\n", extent_info->overflow_count, extent_info->recStartBlock, index, extents[index].startBlock, extents[index].blockCount, newBlockCount);
 	}
@@ -5468,7 +5477,7 @@ hfs_split_extent(struct hfs_reclaim_extent_info *extent_info, uint32_t newBlockC
 				goto out;
 			}
 			if (hfs_resize_debug) {
-				printf ("hfs_split_extent: Deleted record with startBlock=%u\n", (is_xattr ? xattr_key->startBlock : extents_key->startBlock));
+				printf ("hfs_split_extent: Deleted extent record with startBlock=%u\n", (is_xattr ? xattr_key->startBlock : extents_key->startBlock));
 			}
 		}
 
@@ -5488,8 +5497,18 @@ hfs_split_extent(struct hfs_reclaim_extent_info *extent_info, uint32_t newBlockC
 			printf ("hfs_split_extent: Inserted extent record with startBlock=%u\n", write_recStartBlock);
 		}
 	}
-	BTFlushPath(extent_info->fcb);
+
 out:
+	/* 
+	 * Extents overflow btree or attributes btree headers might have 
+	 * been modified during the split/shift operation, so flush the 
+	 * changes to the disk while we are inside journal transaction.  
+	 * We should only be able to generate I/O that modifies the B-Tree 
+	 * header nodes while we're in the middle of a journal transaction.  
+	 * Otherwise it might result in panic during unmount.
+	 */
+	BTFlushPath(extent_info->fcb);
+
 	if (extents_rec) {
 		FREE (extents_rec, M_TEMP);
 	}
@@ -5578,7 +5597,12 @@ hfs_reclaim_extent(struct hfsmount *hfsmp, const u_long allocLimit, struct hfs_r
 	 */
 	if (oldStartBlock < allocLimit) {
 		newBlockCount = allocLimit - oldStartBlock;
-
+
+		if (hfs_resize_debug) {
+			int idx = extent_info->extent_index;
+			printf ("hfs_reclaim_extent: Split straddling extent %u:(%u,%u) for %u blocks\n", idx, extent_info->extents[idx].startBlock, extent_info->extents[idx].blockCount, newBlockCount);
+		}
+
 		/* If the extent belongs to a btree, check and trim 
 		 * it to be multiple of the node size. 
 		 */
@@ -5594,15 +5618,21 @@ hfs_reclaim_extent(struct hfsmount *hfsmp, const u_long allocLimit, struct hfs_r
 				if (remainder_blocks) {
 					newBlockCount -= remainder_blocks;
 					if (hfs_resize_debug) {
-						printf ("hfs_reclaim_extent: Fixing extent block count, node_blks=%u, old=%u, new=%u\n", node_size/hfsmp->blockSize, newBlockCount + remainder_blocks, newBlockCount);
+						printf ("hfs_reclaim_extent: Round-down newBlockCount to be multiple of nodeSize, node_allocblks=%u, old=%u, new=%u\n", node_size/hfsmp->blockSize, newBlockCount + remainder_blocks, newBlockCount);
 					}
 				}
 			}
-		}
-
-		if (hfs_resize_debug) {
-			int idx = extent_info->extent_index;
-			printf ("hfs_reclaim_extent: Split straddling extent %u:(%u,%u) for %u blocks\n", idx, extent_info->extents[idx].startBlock, extent_info->extents[idx].blockCount, newBlockCount);
+			/* The newBlockCount is zero because of rounding-down so that
+			 * btree nodes are not split across extents.  Therefore this
+			 * straddling extent across resize-boundary does not require 
+			 * splitting.  Skip over to relocating of complete extent.
+			 */
+			if (newBlockCount == 0) {
+				if (hfs_resize_debug) {
+					printf ("hfs_reclaim_extent: After round-down newBlockCount=0, skip split, relocate full extent\n");
+				}
+				goto relocate_full_extent;
+			}
 		}
 
 		/* Split the extents into two parts --- the first extent lies
@@ -5618,10 +5648,12 @@ hfs_reclaim_extent(struct hfsmount *hfsmp, const u_long allocLimit, struct hfs_r
 		}
 		/* Split failed, so try to relocate entire extent */
 		if (hfs_resize_debug) {
-			printf ("hfs_reclaim_extent: Split straddling extent failed, reclocate full extent\n");
+			int idx = extent_info->extent_index;
+			printf ("hfs_reclaim_extent: Split straddling extent %u:(%u,%u) for %u blocks failed, relocate full extent\n", idx, extent_info->extents[idx].startBlock, extent_info->extents[idx].blockCount, newBlockCount);
 		}
 	}
 
+relocate_full_extent:
 	/* At this point, the current extent requires relocation.  
 	 * We will try to allocate space equal to the size of the extent 
 	 * being relocated first to try to relocate it without splitting.  

bsd/hfs/hfs_vnops.c

@@ -4167,6 +4167,41 @@ hfs_vnop_rename(ap)
 
 	tdcp->c_flag |= C_FORCEUPDATE;  // XXXdbg - force it out!
 	(void) hfs_update(tdvp, 0);
+
+	/* Update the vnode's name now that the rename has completed. */
+	vnode_update_identity(fvp, tdvp, tcnp->cn_nameptr, tcnp->cn_namelen, 
+			tcnp->cn_hash, (VNODE_UPDATE_PARENT | VNODE_UPDATE_NAME));
+
+	/* 
+	 * At this point, we may have a resource fork vnode attached to the 
+	 * 'from' vnode.  If it exists, we will want to update its name, because
+	 * it contains the old name + _PATH_RSRCFORKSPEC. ("/..namedfork/rsrc").
+	 *
+	 * Note that the only thing we need to update here is the name attached to
+	 * the vnode, since a resource fork vnode does not have a separate resource
+	 * cnode -- it's still 'fcp'.
+	 */
+	if (fcp->c_rsrc_vp) {
+		char* rsrc_path = NULL;
+		int len;
+
+		/* Create a new temporary buffer that's going to hold the new name */
+		MALLOC_ZONE (rsrc_path, caddr_t, MAXPATHLEN, M_NAMEI, M_WAITOK);
+		len = snprintf (rsrc_path, MAXPATHLEN, "%s%s", tcnp->cn_nameptr, _PATH_RSRCFORKSPEC);
+		len = MIN(len, MAXPATHLEN);
+
+		/* 
+		 * vnode_update_identity will do the following for us:
+		 * 1) release reference on the existing rsrc vnode's name.
+		 * 2) copy/insert new name into the name cache
+		 * 3) attach the new name to the resource vnode
+		 * 4) update the vnode's vid
+		 */
+		vnode_update_identity (fcp->c_rsrc_vp, fvp, rsrc_path, len, 0, (VNODE_UPDATE_NAME | VNODE_UPDATE_CACHE));
+
+		/* Free the memory associated with the resource fork's name */
+		FREE_ZONE (rsrc_path, MAXPATHLEN, M_NAMEI);	
+	}
 out:
 	if (got_cookie) {
 		cat_postflight(hfsmp, &cookie, p);

bsd/kern/kern_event.c

@@ -471,7 +471,6 @@ static int
 filt_procattach(struct knote *kn)
 {
 	struct proc *p;
-	pid_t selfpid = (pid_t)0;
 
 	assert(PID_MAX < NOTE_PDATAMASK);
 
@@ -483,15 +482,22 @@ filt_procattach(struct knote *kn)
 		return (ESRCH);
 	}
 
-	if ((kn->kn_sfflags & NOTE_EXIT) != 0) {
-		selfpid = proc_selfpid();
-		/* check for validity of NOTE_EXISTATUS */
-		if (((kn->kn_sfflags & NOTE_EXITSTATUS) != 0) && 
-			((p->p_ppid != selfpid) && (((p->p_lflag & P_LTRACED) == 0) || (p->p_oppid != selfpid)))) {
+	const int NoteExitStatusBits = NOTE_EXIT | NOTE_EXITSTATUS;
+
+	if ((kn->kn_sfflags & NoteExitStatusBits) == NoteExitStatusBits)
+		do {
+			pid_t selfpid = proc_selfpid();
+
+			if (p->p_ppid == selfpid)
+				break;	/* parent => ok */
+
+			if ((p->p_lflag & P_LTRACED) != 0 &&
+			    (p->p_oppid == selfpid))
+				break;	/* parent-in-waiting => ok */
+
 			proc_rele(p);
-			return(EACCES);
-		}
-	}
+			return (EACCES);
+		} while (0);
 
 	proc_klist_lock();
 

bsd/kern/kern_exit.c

@@ -439,6 +439,7 @@ proc_exit(proc_t p)
 	struct uthread * uth;
 	pid_t pid;
 	int exitval;
+	int knote_hint;
 
 	uth = (struct uthread *)get_bsdthread_info(current_thread());
 
@@ -792,8 +793,12 @@ proc_exit(proc_t p)
 	p->task = TASK_NULL;
 	set_bsdtask_info(task, NULL);
 
-	/* exit status will be seen  by parent process */
-	proc_knote(p, NOTE_EXIT | (p->p_xstat & 0xffff));
+	knote_hint = NOTE_EXIT | (p->p_xstat & 0xffff);
+	if (p->p_oppid != 0) {
+		knote_hint |= NOTE_EXIT_REPARENTED;
+	}
+
+	proc_knote(p, knote_hint);
 
 	/* mark the thread as the one that is doing proc_exit
 	 * no need to hold proc lock in uthread_free

bsd/kern/kern_lockf.c

@@ -579,35 +579,44 @@ lf_setlock(struct lockf *lock)
 #endif /* LOCKF_DEBUGGING */
 		error = msleep(lock, &vp->v_lock, priority, lockstr, 0);
 
-		if (!TAILQ_EMPTY(&lock->lf_blkhd)) {
-		        if ((block = lf_getblock(lock, -1))) {
-				lf_move_blocked(block, lock);
-			}
-		}
-
 		if (error == 0 && (lock->lf_flags & F_ABORT) != 0)
 			error = EBADF;
 
-		if (error) {	/* XXX */
+		if (lock->lf_next) {
 			/*
-			 * We may have been awakened by a signal and/or by a
-			 * debugger continuing us (in which cases we must remove
-			 * ourselves from the blocked list) and/or by another
-			 * process releasing a lock (in which case we have
-			 * already been removed from the blocked list and our
-			 * lf_next field set to NOLOCKF).
+			 * lf_wakelock() always sets wakelock->lf_next to
+			 * NULL before a wakeup; so we've been woken early
+			 * - perhaps by a debugger, signal or other event.
+			 *
+			 * Remove 'lock' from the block list (avoids double-add
+			 * in the spurious case, which would create a cycle)
 			 */
-			if (lock->lf_next) {
-				TAILQ_REMOVE(&lock->lf_next->lf_blkhd, lock, lf_block);
-				lock->lf_next = NOLOCKF;
+			TAILQ_REMOVE(&lock->lf_next->lf_blkhd, lock, lf_block);
+			lock->lf_next = NULL;
+
+			if (error == 0) {
+				/*
+				 * If this was a spurious wakeup, retry
+				 */
+				printf("%s: spurious wakeup, retrying lock\n",
+				    __func__);
+				continue;
 			}
+		}
+
+		if (!TAILQ_EMPTY(&lock->lf_blkhd)) {
+		        if ((block = lf_getblock(lock, -1)) != NULL)
+				lf_move_blocked(block, lock);
+		}
+
+		if (error) {
 			if (!TAILQ_EMPTY(&lock->lf_blkhd))
 			        lf_wakelock(lock, TRUE);
-
 			FREE(lock, M_LOCKF);
 			return (error);
-		}	/* XXX */
+		}
 	}
+
 	/*
 	 * No blocks!!  Add the lock.  Note that we will
 	 * downgrade or upgrade any overlapping locks this
@@ -1189,6 +1198,10 @@ lf_wakelock(struct lockf *listhead, boolean_t force_all)
 			        struct lockf *tlock;
 
 			        TAILQ_FOREACH(tlock, &wakelock->lf_blkhd, lf_block) {
+					if (TAILQ_NEXT(tlock, lf_block) == tlock) {
+						/* See rdar://10887303 */
+						panic("cycle in wakelock list");
+					}
 				        tlock->lf_next = wakelock;
 				}
 			}

bsd/kern/uipc_mbuf.c

@@ -2708,16 +2708,18 @@ m_clalloc(const u_int32_t num, const int wait, const u_int32_t bufsize)
 
 	for (i = 0; i < numpages; i++, page += NBPG) {
 		ppnum_t offset = ((char *)page - (char *)mbutl) / NBPG;
-		ppnum_t new_page = pmap_find_phys(kernel_pmap,
-		    (vm_offset_t)page);
+		ppnum_t new_page = pmap_find_phys(kernel_pmap, page);
 
 		/*
 		 * In the case of no mapper being available the following
 		 * code noops and returns the input page; if there is a
 		 * mapper the appropriate I/O page is returned.
 		 */
 		VERIFY(offset < mcl_pages);
-		new_page = IOMapperInsertPage(mcl_paddr_base, offset, new_page);
+		if (mcl_paddr_base) {
+		    bzero((void *)(uintptr_t) page, page_size);
+		    new_page = IOMapperInsertPage(mcl_paddr_base, offset, new_page);
+		}
 		mcl_paddr[offset] = new_page << PGSHIFT;
 
 		/* Pattern-fill this fresh page */

bsd/netinet/tcp_lro.c

@@ -513,7 +513,7 @@ tcp_lro_process_pkt(struct mbuf *lro_mb, struct ip *ip_hdr,
 
 	case TCP_LRO_COALESCE:
 		if ((payload_len != 0) && (unknown_tcpopts == 0) && 
-			(tcpflags == 0) && (ecn == 0) && (to.to_flags & TOF_TS)) { 
+			(tcpflags == 0) && (ecn != IPTOS_ECN_CE) && (to.to_flags & TOF_TS)) { 
 			tcp_lro_coalesce(flow_id, lro_mb, tcp_hdr, payload_len,
 				drop_hdrlen, &to, 
 				(to.to_flags & TOF_TS) ? (u_int32_t *)(void *)(optp + 4) : NULL,