From owner-dev-commits-src-main@freebsd.org Sat Dec 26 21:14:46 2020 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 64D7B4C237B; Sat, 26 Dec 2020 21:14:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4D3Gm62Q9Bz4jPn; Sat, 26 Dec 2020 21:14:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4188C1B91F; Sat, 26 Dec 2020 21:14:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 0BQLEk2u027511; Sat, 26 Dec 2020 21:14:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 0BQLEkgf027510; Sat, 26 Dec 2020 21:14:46 GMT (envelope-from git) Date: Sat, 26 Dec 2020 21:14:46 GMT Message-Id: <202012262114.0BQLEkgf027510@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 26b23f07fb98 - main - sendfile: Ensure that sfio->npages is initialized MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 26b23f07fb981662debd69b9969f78864c262466 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "Commit messages for the main branch of the src repository." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Dec 2020 21:14:46 -0000 The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=26b23f07fb981662debd69b9969f78864c262466 commit 26b23f07fb981662debd69b9969f78864c262466 Author: Mark Johnston AuthorDate: 2020-12-26 21:07:40 +0000 Commit: Mark Johnston CommitDate: 2020-12-26 21:07:40 +0000 sendfile: Ensure that sfio->npages is initialized We initialize sfio->npages only when some I/O is required to satisfy the request. However, sendfile_iodone() contains an INVARIANTS-only check that references sfio->npages, and this check is executed even if no I/O is performed, so the check may use an uninitialized value. Fix the problem by initializing sfio->npages earlier. Note that sendfile_swapin() always initializes the page array. In some rare cases we need to trim the page array so ensure that sfio->npages gets updated accordingly. Reported by: syzkaller (with KASAN) Reviewed by: kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D27726 --- sys/kern/kern_sendfile.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/sys/kern/kern_sendfile.c b/sys/kern/kern_sendfile.c index e0b9b0e261d4..18c9ade721a9 100644 --- a/sys/kern/kern_sendfile.c +++ b/sys/kern/kern_sendfile.c @@ -413,12 +413,13 @@ out_with_ref: */ static int sendfile_swapin(vm_object_t obj, struct sf_io *sfio, int *nios, off_t off, - off_t len, int npages, int rhpages, int flags) + off_t len, int rhpages, int flags) { vm_page_t *pa; - int a, count, count1, grabbed, i, j, rv; + int a, count, count1, grabbed, i, j, npages, rv; pa = sfio->pa; + npages = sfio->npages; *nios = 0; flags = (flags & SF_NODISKIO) ? VM_ALLOC_NOWAIT : 0; sfio->pindex0 = OFF_TO_IDX(off); @@ -905,6 +906,7 @@ retry_space: sfio->obj = obj; sfio->error = 0; sfio->m = NULL; + sfio->npages = npages; #ifdef KERN_TLS /* * This doesn't use ktls_hold() because sfio->m will @@ -914,8 +916,8 @@ retry_space: sfio->tls = tls; #endif vm_object_pip_add(obj, 1); - error = sendfile_swapin(obj, sfio, &nios, off, space, npages, - rhpages, flags); + error = sendfile_swapin(obj, sfio, &nios, off, space, rhpages, + flags); if (error != 0) { if (vp != NULL) VOP_UNLOCK(vp); @@ -963,7 +965,7 @@ retry_space: if (pa[i] == NULL) { SFSTAT_INC(sf_busy); fixspace(npages, i, off, &space); - npages = i; + sfio->npages = i; softerr = EBUSY; break; } @@ -1042,12 +1044,14 @@ retry_space: if (sf == NULL) { SFSTAT_INC(sf_allocfail); sendfile_iowait(sfio, "sfnosf"); - for (int j = i; j < npages; j++) + for (int j = i; j < npages; j++) { vm_page_unwire(pa[j], PQ_INACTIVE); + pa[j] = NULL; + } if (m == NULL) softerr = ENOBUFS; fixspace(npages, i, off, &space); - npages = i; + sfio->npages = i; break; } @@ -1152,7 +1156,6 @@ prepend_header: } else { sfio->so = so; sfio->m = m0; - sfio->npages = npages; soref(so); error = (*so->so_proto->pr_usrreqs->pru_send) (so, PRUS_NOTREADY, m, NULL, NULL, td);