It has been broken since we moved namespaces into userspace. Fixing it
can be done entirely inside userspace. Either by introducing a SYS_CALL
for the root capability or by treating closing the last fd as unmount.
This commit fixes the following panic when running nodejs:
```
KERNEL PANIC: panicked at src/context/memory.rs:267:18:
grant cannot magically disappear while we hold the lock!
FP ffff80002021f650: PC ffffffff8005e45b
FFFFFFFF8005E2E0+017B
kernel::panic::panic_handler_inner
FP ffff80002021f730: PC ffffffff80057559
FP ffff80002021f740: PC ffffffff8009a0ff
FP ffff80002021f770: PC ffffffff8009c214
FP ffff80002021f7d0: PC ffffffff80010997
FFFFFFFF8000FDD0+0BC7
kernel::context::memory::AddrSpaceWrapper::mprotect
FP ffff80002021fd40: PC ffffffff8008cb0b
FFFFFFFF8008CA40+00CB
kernel::syscall::process::mprotect
FP ffff80002021fd70: PC ffffffff8006ce6c
FFFFFFFF8006CBE0+028C
kernel::syscall::syscall
FP ffff80002021fe90: PC ffffffff8008d3cf
FFFFFFFF8008D320+00AF
__inner_syscall_instruction
FP ffff80002021ff50: PC ffffffff800830c3
FFFFFFFF80083080+0043
kernel::arch::x86_64::interrupt::syscall::syscall_instruction
00007ffffffffaf0: GUARD PAGE
CPU #1, CID 0xffffff7f8015b910
NAME: /usr/bin/node, DEBUG ID: 74
SYSCALL: mprotect(0x203C0000, 262144, Some(MapFlags(0x0)))
HALT
```
The grant did not magically disappear. When going through the
`grant_span_res` regions, the function adds (and removes) grants to the
`self.grants` tree. The insertion and deletion functions also merge
adjacent grants together when possible. This is an issue since we can no
longer use the keys we established before we started iterating. This
commit modifies the places where `remove` is used in this fashion to use
`remove_containing` instead. The `remove_containing` function will
remove the grant that *contains* the page.
Should it be done this way (requires unstable feature `btree_cursors`)?
Signed-off-by: Anhad Singh <andypython@protonmail.com>
`Grant::remap` should not directly mark entries as writeable because the
entry could be private and requires Copy-On-Write (COW) handling. This
bug fixes the random panics that occur when running programs that
incorrectly mark private memory regions as writeable. This also
inadvertently caused other systems to crash. This is because The Zeroed
Frame is mapped instead of allocating a new zeroed memory region every
time. Only after the first write is the frame actually allocated. This
means that with this bug one could remap a freshly mmap'ed ANONYMOUS
region with the write flag and rewrite the contents of The Zeroed Frame,
which is a big problem. This means that any program that allocated
memory with the ANONYMOUS flag after this would not receive zeroed
memory.
Example of `make` hitting this bug when the shared `ld.so` patches are
applied:
```
....
[page at 0x48bd000] is mapped to the zeroed frame with PageFlags { present: true, write: false, executable: false, user: true, bits: 0x8000000000000005 }
[page at 0x49b1000] is mapped to the zeroed frame with PageFlags { present: true, write: true, executable: false, user: true, bits: 0x8000000000000007 }
[page at 0x49b2000] is mapped to the zeroed frame with PageFlags { present: true, write: true, executable: false, user: true, bits: 0x8000000000000007 }
[page at 0x49b3000] is mapped to the zeroed frame with PageFlags { present: true, write: true, executable: false, user: true, bits: 0x8000000000000007 }
[page at 0x49b4000] is mapped to the zeroed frame with PageFlags { present: true, write: true, executable: false, user: true, bits: 0x8000000000000007 }
0x43ff000..0x49b5000 :: MapFlags(PROT_WRITE | PROT_READ)
[page at 0x49b5000] is mapped to the zeroed frame with PageFlags { present: true, write: false, executable: false, user: true, bits: 0x8000000000000005 }
[page at 0x49b6000] is mapped to the zeroed frame with PageFlags { present: true, write: false, executable: false, user: true, bits: 0x8000000000000005 }
....
```
and causing the following crash:
```
Page fault: 0000000000001718 P | WR | US
RFLAG: 0000000000010202
CS: 000000000000002b
RIP: 00000000004125fd
RSP: 00007fffffffdd80
SS: 0000000000000023
FSBASE 00000000003f6000
GSBASE 0000000000000000
KGSBASE ffff80007a800000
RAX: 0000000000001718
RCX: 0000000000000000
RDX: ffffffffffffffff
RDI: 000000000043b5a0
RSI: 00000000004537e0
R8: 0000000000000030
R9: 000000000043b5a0
R10: 0000000000000030
R11: 00000000000000ff
RBX: 0000000000000000
RBP: 00007fffffffddb0
R12: 000000000043b5a0
R13: 00000000004537e0
R14: 00000000004537e0
R15: 000000000043b5a0
FP 00007fffffffddb0: PC 000000000042614a
FP 00007fffffffde40: PC 0000000000411ae9
FP 00007fffffffde80: PC 0000000000417187
FP 00007fffffffdee0: PC 0000000000411d39
FP 00007fffffffdf90: PC 000000000041207d
FP 00007fffffffe020: PC 000000000040bc4c
FP 00007fffffffe0c0: PC 000000000040c7c9
FP 00007fffffffe0f0: PC 00000000004276ba
FP 00007fffffffe1a0: PC 0000000000428087
FP 00007fffffffe210: PC 000000000041eb6a
FP 00007fffffffe400: PC 00000000004205c3
FP 00007fffffffe490: PC 00000000004208dd
FP 00007fffffffe4d0: PC 000000000040747e
FP 00007ffffffffd60: PC 000000000092111c
<Invalid next frame pointer 0x0000000000438490; stack walk ended>
FP ffff80001b5bfe80: PC ffffffff80046dad
FFFFFFFF80046BD0+01DD
kernel::arch::x86_shared::interrupt::exception::page::inner
FP ffff80001b5bff50: PC ffffffff8003ffbb
FFFFFFFF8003FF84+0037
kernel::arch::x86_shared::interrupt::exception::page
00007fffffffddb0: GUARD PAGE
kernel::context::signal:INFO -- UNHANDLED EXCEPTION, CPU #1, PID 6548, NAME /usr/bin/make, CONTEXT 0xffffff7f8013fdc0
```
Also the crash info would vary every time you run the program since the
contents of The Zeroed Frame would have been mutated. Sneaky bug :^)
This also fixes the crashes that happen when running node.js (and maybe
other programs): https://gitlab.redox-os.org/redox-os/relibc/-/issues/229
Signed-off-by: Anhad Singh <andypython@protonmail.com>
Wildan M