summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2020-10-19Remove legacy bazel configurations.Adin Scannell
Using the newer bazel rules necessitates a transition from proto1 to proto2. In order to resolve the incompatibility between proto2 and gogoproto, the cri runtimeoptions proto must be vendored. Further, some of the semantics of bazel caching changed during the transition. It is now necessary to: - Ensure that :gopath depends only on pure library targets, as the propagation of go_binary build attributes (pure, static) will affected the generated files (though content remains the same, there are conflicts with respect to the gopath). - Update bazel.mk to include the possibility of binaries in the bazel-out directory, as it will now put runsc and others there. This required some refinements to the mechanism of extracting paths, since some the existing regex resulted in false positives. - Change nogo rules to prevent escape generation on binary targets. For some reason, the newer version of bazel attempted to run the nogo analysis on the binary targets, which fails due to the fact that objdump does not work on the final binary. This must be due to a change in the semantics of aspects in bazel3. PiperOrigin-RevId: 337958324
2020-10-19Fixes to cgroupsFabricio Voznika
There were a few problems with cgroups: - cleanup loop what breaking too early - parse of /proc/[pid]/cgroups was skipping "name=systemd" because "name=" was not being removed from name. - When no limits are specified, fillFromAncestor was not being called, causing a failure to set cpuset.mems Updates #4536 PiperOrigin-RevId: 337947356
2020-10-19[vfs2] Fix fork reference leaks.Dean Deng
PiperOrigin-RevId: 337919424
2020-10-19splice: return EINVAL is len is negativeAndrei Vagin
Reported-by: syzbot+0268cc591c0f517a1de0@syzkaller.appspotmail.com PiperOrigin-RevId: 337901664
2020-10-19pgalloc: Do not hold MemoryFile.mu while calling mincore.Ayush Ranjan
This change makes the following changes: - Unlocks MemoryFile.mu while calling mincore (checkCommitted) because mincore can take a really long time. Accordingly looks up the segment in the tree tree again and handles changes to the segment. - MemoryFile.UpdateUsage() can now only be called at frequency at most 100Hz. 100 Hz = linux.CLOCKS_PER_SEC. Co-authored-by: Jamie Liu <jamieliu@google.com> PiperOrigin-RevId: 337865250
2020-10-16Refactor shared starlark files.Adin Scannell
PiperOrigin-RevId: 337581114
2020-10-16Use POSIX interval timers in flock test.Dean Deng
ualarm(2) is obsolete. Move IntervalTimer into a test util, where it can be used by flock tests. These tests were flaky with TSAN, probably because it slowed the tests down enough that the alarm was expiring before flock() was called. Use an interval timer so that even if we miss the first alarm (or more), flock() is still guaranteed to be interrupted. PiperOrigin-RevId: 337578751
2020-10-16Don't include link header when forwarding packetsGhanan Gowripalan
Before this change, if a link header was included in an incoming packet that is forwarded, the packet that gets sent out will take the original packet and add a link header to it while keeping the old link header. This would make the sent packet look like: OUTGOING LINK HDR | INCOMING LINK HDR | NETWORK HDR | ... Obviously this is incorrect as we should drop the incoming link header and only include the outgoing link header. This change fixes this bug. Test: integration_test.TestForwarding PiperOrigin-RevId: 337571447
2020-10-16Make IPv4 check the IP header checksumJulian Elischer
The IPv4 header checksum has not been checked, at least in recent times, so add code to do so. Fix all the tests that fail because they never needed to set the checksum. Fixes #4484 PiperOrigin-RevId: 337556243
2020-10-16Enable IPv4 fragmentation for every code path.Arthur Sfez
Currently, fragmentation can only occur during WritePacket(). This enables it for WritePackets() and WriteIncludedHeaderPacket() as well. IPv4 unit tests were refactored to be consistent with the IPv6 unit tests. This removes the extraHeaderReserveLength field and the related "prependable bytes" unit tests (for both IPv4 and IPv6) because it was only testing a panic condition when the value was too low. Fixes #3796 PiperOrigin-RevId: 337550061
2020-10-16Merge pull request #4387 from lubinszARM:pr_tls_host_sentry_1gVisor bot
PiperOrigin-RevId: 337544656
2020-10-16Refactor nogo to better support ARM.Adin Scannell
PiperOrigin-RevId: 337544107
2020-10-16Enable IPv6 WriteHeaderIncludedPacketGhanan Gowripalan
Allow writing an IPv6 packet where the IPv6 header is a provided by the user. * Introduce an error to let callers know a header is malformed. We previously useed tcpip.ErrInvalidOptionValue but that did not seem appropriate for generic malformed header errors. * Populate network header in WriteHeaderIncludedPacket IPv4's implementation of WriteHeaderIncludedPacket did not previously populate the packet buffer's network header. This change fixes that. Fixes #4527 Test: ip_test.TestWriteHeaderIncludedPacket PiperOrigin-RevId: 337534548
2020-10-16Cache errors when processing stdlib with nogo.Adin Scannell
PiperOrigin-RevId: 337515664
2020-10-15sockets: ignore io.EOF from view.ReadAtAndrei Vagin
Reported-by: syzbot+5466463b7604c2902875@syzkaller.appspotmail.com PiperOrigin-RevId: 337451896
2020-10-15`runsc do` fallback to internal network on failureFabricio Voznika
In case setting up network fails, log a warning and fallback to internal network. Closes #4498 PiperOrigin-RevId: 337442632
2020-10-15Add easier-to-use docker_image target.Adin Scannell
PiperOrigin-RevId: 337415009
2020-10-15Syncing packetimpact tests in different directoriesZeling Feng
By exposing an ALL_TESTS list in defs.bzl we can make sure all packetimpact users get to agree on the list of all tests. A defect in this approach is that we have to keep a list of packetimpact_testbench rules in the BUILD file. An helper validate_all_tests has been added to help keep BUILD and .bzl files in sync. PiperOrigin-RevId: 337411839
2020-10-15Process NAs without target link-layer addressesSam Balana
RFC 4861 section 4.4 comments the Target link-layer address option is sometimes optional in a Neighbor Advertisement packet: "When responding to a unicast Neighbor Solicitation this option SHOULD be included." Tests: pkg/tcpip/stack:stack_test - TestEntryStaleToReachableWhenSolicitedConfirmationWithoutAddress - TestEntryDelayToReachableWhenSolicitedConfirmationWithoutAddress - TestEntryProbeToReachableWhenSolicitedConfirmationWithoutAddress pkg/tcpip/network/ipv6:ipv6_test - TestCallsToNeighborCache PiperOrigin-RevId: 337396493
2020-10-15Change verity isEnable to be a member of dentryChong Cai
PiperOrigin-RevId: 337384146
2020-10-15Refactor compareFragments to follow Go styleArthur Sfez
Test helpers should be used for test setup/teardown, not actual testing. Use cmp.Diff instead of bytes.Equal to improve readability. PiperOrigin-RevId: 337323242
2020-10-14Find route before sending NA responseGhanan Gowripalan
This change also brings back the stack.Route.ResolveWith method so that we can immediately resolve a route when sending an NA in response to a a NS with a source link layer address option. Test: ipv6_test.TestNeighorSolicitationResponse PiperOrigin-RevId: 337185461
2020-10-14Fix SCM Rights reference leaks.Dean Deng
Control messages should be released on Read (which ignores the control message) or zero-byte Send. Otherwise, open fds sent through the control messages will be leaked. PiperOrigin-RevId: 337110774
2020-10-14Fix shm reference leak.Dean Deng
All shm segments in an IPC namespace should be released once that namespace is destroyed. Add reference counting to IPCNamespace so that once the last task with a reference on it exits, we can trigger a destructor that will clean up all shm segments that have not been explicitly freed by the application. PiperOrigin-RevId: 337032977
2020-10-13Various website fixesIan Lewis
- Formatting on the most recent blog post - Add a link to faq from containerd docs - Fix code in FAQ PiperOrigin-RevId: 337001738
2020-10-13Merge pull request #4482 from lemin9538:lemin_arm64gVisor bot
PiperOrigin-RevId: 336976081
2020-10-13Merge pull request #4486 from patr0nus:master_udp_ep_fixgVisor bot
PiperOrigin-RevId: 336974095
2020-10-13Merge pull request #4386 from lubinszARM:pr_testutil_tls_usrgVisor bot
PiperOrigin-RevId: 336970511
2020-10-13Merge pull request #4374 from lubinszARM:pr_ffmpeg_kvm_01gVisor bot
PiperOrigin-RevId: 336962937
2020-10-13Correct NA minimum sizeSam Balana
Remove the duplicate NA size variable while I'm here. See https://tools.ietf.org/html/rfc4861#section-4.4 for the packet format. PiperOrigin-RevId: 336943206
2020-10-13Don't read beyond EOF when inserting into sentry page cache.Jamie Liu
The sentry page cache stores file contents at page granularity; this is necessary for memory mappings. Thus file offset ranges passed to fsutil.FileRangeSet.Fill() must be page-aligned. If the read callback passed to Fill() returns (partial read, nil error) when reading up to EOF (which is the case for p9.ClientFile.ReadAt() since 9P's Rread cannot convey both a partial read and EOF), Fill() will re-invoke the read callback to try to read from EOF to the end of the containing page, which is harmless but needlessly expensive. Fix this by handling file size explicitly in fsutil.FileRangeSet.Fill(). PiperOrigin-RevId: 336934075
2020-10-13Use NDP option serializer instead of handcrafting the NSTamir Duberstein
Use the correct constant (Solicit, not Advert) while I'm here. PiperOrigin-RevId: 336924605
2020-10-13[vfs2] Don't take reference in Task.MountNamespaceVFS2 and MountNamespace.Root.Dean Deng
This fixes reference leaks related to accidentally forgetting to DecRef() after calling one or the other. PiperOrigin-RevId: 336918922
2020-10-13Avoid excessive Tgkill and wait operations.Adin Scannell
The required states may simply not be observed by the thread running bounce, so track guest and user generations to ensure that at least one of the desired state transitions happens. Fixes #3532 PiperOrigin-RevId: 336908216
2020-10-13[vfs2] Destroy all tmpfs files when the filesystem is released.Dean Deng
In addition to fixing reference leaks, this change also releases memory used by regular tmpfs files once the containing filesystem is released. PiperOrigin-RevId: 336833111
2020-10-13[vfs2] Add FilesystemType.Release to avoid reference leaks.Dean Deng
Singleton filesystem like devpts and devtmpfs have a single filesystem shared among all mounts, so they acquire a "self-reference" when initialized that must be released when the entire virtual filesystem is released at sandbox exit. PiperOrigin-RevId: 336828852
2020-10-13Don't leak VDSO mappings.Dean Deng
PiperOrigin-RevId: 336822021
2020-10-12gvisor/test: Set nogotsan for native testsAndrei Vagin
Tests are written in C++ and there is no reason to run them with gotsan without gVisor. PiperOrigin-RevId: 336783276
2020-10-12Change verity mu to be per file systemChong Cai
verity Mu should be per file system instead of global, so that enabling and verifying in different file systems won't block each other. Also Lock verity Mu in PRead. PiperOrigin-RevId: 336779356
2020-10-12Change Merkle tree library to use ReaderAtChong Cai
Merkle tree library was originally using Read/Seek to access data and tree, since the parameters are io.ReadSeeker. This could cause race conditions if multiple threads accesses the same fd to read. Here we change to use ReaderAt, and implement it with PRead to make it thread safe. PiperOrigin-RevId: 336779260
2020-10-12[vfs] kernfs: Fix inode memory leak issue.Ayush Ranjan
This change aims to fix the memory leak issue reported in #3933. Background: VFS2 kernfs kept accumulating invalid dentries if those dentries were not walked on. After substantial consideration of the problem by our team, we decided to have an LRU cache solution. This change is the first part to that solution, where we don't cache anything. The LRU cache can be added on top of this. What has changed: - Introduced the concept of an inode tree in kernfs.OrderedChildren. This is helpful is cases where the lifecycle of an inode is different from that of a dentry. - OrderedChildren now deals with initialized inodes instead of initialized dentries. It now implements Lookup() where it constructs a new dentry using the inode. - OrderedChildren holds a ref on all its children inodes. With this change, now an inode can "outlive" a dentry pointing to it. See comments in kernfs.OrderedChildren. - The kernfs dentry tree is solely maintained by kernfs only. Inode implementations can not modify the dentry tree. - Dentries that reach ref count 0 are removed from the dentry tree. - revalidateChildLocked now defer-DecRefs the newly created dentry from Inode.Lookup(), limiting its life to the current filesystem operation. If refs are picked on the dentry during the FS op (via an FD or something), then it will stick around and will be removed when the FD is closed. So there is essentially _no caching_ for Look()ed up dentries. - kernfs.DecRef does not have the precondition that fs.mu must be locked. Fixes #3933 PiperOrigin-RevId: 336768576
2020-10-12Merge pull request #4072 from adamliyi:droppt_fixgVisor bot
PiperOrigin-RevId: 336719900
2020-10-12[vfs2] Don't leak disconnected mounts.Dean Deng
PiperOrigin-RevId: 336694658
2020-10-11arm64 kvm: add tls-usr supportBin Lu
The tls of guest-el1-sentry and host-el0-sentry may be different on Arm64. I added a solution for it. Signed-off-by: Bin Lu <bin.lu@arm.com>
2020-10-11Assign ep.effectiveNetProtos in UDP forwarder's CreateEndpointpatr0nus
2020-10-10arm64: set DZE bit to make EL0 can use DC ZVAMin Le
Signed-off-by: Min Le <lemin.lm@antgroup.com>
2020-10-09TCP Receive window advertisement fixes.Bhasker Hariharan
The fix in commit 028e045da93b7c1c26417e80e4b4e388b86a713d was incorrect as it can cause the right edge of the window to shrink when we announce a zero window due to receive buffer being full as its done before the check for seeing if the window is being shrunk because of the selected window. Further the window was calculated purely on available space but in cases where we are getting full sized segments it makes more sense to use the actual bytes being held. This CL changes to use the lower of the total available space vs the available space in the maximal window we could advertise minus the actual payload bytes being held. This change also cleans up the code so that the window selection logic is not duplicated between getSendParams() and windowCrossedACKThresholdLocked. PiperOrigin-RevId: 336404827
2020-10-09RACK: Detect packet reordering.Nayana Bidari
RACK detects packet reordering by checking if the sender received ACK for the packet which has the sequence number less than the already acknowledged packets. PiperOrigin-RevId: 336397526
2020-10-09Include stat in Verity hashChong Cai
PiperOrigin-RevId: 336395445
2020-10-09Add gvisor webhook configurationKevin Krakauer
PiperOrigin-RevId: 336393190
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-02 16:25:28 +0000