kern: remove the need to allocate in prison_add_vfs()

[kevans]

Summary

The size of our format string is known at compile time, and vfc_name has
a similarly fixed size. asprintf() can theoretically fail and leave us
with no description, but there's really no need: the vfs type name is
small enough that the resulting stack requirement is fairly small in the
grand scheme of things (we won't even exceed 64-bytes) and it's unlikely
to increase dramatically (if at all).

This technically leaves us oversized because both sizeof() results will
include a NUL terminator, but it seems better to err on the side of
caution.

[jamie]

prison_add_vfs then goes on to call prison_add_allow, which has its own asprintf call. So unless you fix that as well, you've bought very little. And prison_add_allow really ought to be fixed. It's just a matter of not relying on asprintf with its M_NOWAIT allocation. The context it's called in (and presumably would ever be called in) can handle waiting for allocation.

[markj]

I wonder why asprintf() uses M_NOWAIT when strdup() uses M_WAITOK. Looking at the relatively few callers, I suspect we can perhaps just switch to M_WAITOK...

[jamie]

In D52039#1189578, @markj wrote:

I wonder why asprintf() uses M_NOWAIT when strdup() uses M_WAITOK. Looking at the relatively few callers, I suspect we can perhaps just switch to M_WAITOK...

Spot-checking asprintf callers has yielded eight optimists who assume it allocates, and one pessimist who just panics on failure. Not that jail's current silent failure is exactly better. And the good news is most callers check the return code and do something non-panicky.

I worry about just "fixing" asprintf though, since there are enough callers that it's non-trivial to verify their lock contexts. It might be better for prison_add_allow to just do its own asprintf-like work, and allocate the buffers sleepably and sprintf onto them.

[kevans]

FWIW- I don't actually care much about this path failing. It had just occurred to me while verifying that I can slightly move the prison_add_vfs() call in D52037 that the description really has a fixed max size.

[jamie]

The unrelated prison_add_allow talk deserves its own revision, so I made D52105 for that.