From nobody Tue Dec 9 22:20:31 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dQtb36whvz6Jvsp for ; Tue, 09 Dec 2025 22:20:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dQtb36KGSz4Jp3 for ; Tue, 09 Dec 2025 22:20:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765318831; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=y5K7ym/oRQfw1FuFI6moYu9IGp48qlK08Ht7ZO95f0s=; b=MU+n1dTU+kYpVueLNLxdpfUdnThGu5xgzkhGgfGTSf8H/sYUXFxqW5dfaFY1AbSE9yiHX4 t4dSSozork3O7EWNWbUlwWinbvFfh7KjDeElnHPur6YuWrLzVaWCeO+NrczaHJAnnP3tZ1 zzIzwrz9/+jLySm3jYRq21zejVmK6UkwPfnUCn+61S4VuLM1eEyREps3cZ8CWazsNne0Gb bkxJREkZ/pwSAMzywoGN477kif2Lpu3U6BqvrpM00a3S5lyGr+XaJhx7rMGCSMqsaaM/ni JaM4oci+MQh1VyxPAWrGXlSKVRgC9PTbsIwGN+RrJltXUaLB2rJh2h+fyjsAUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765318831; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=y5K7ym/oRQfw1FuFI6moYu9IGp48qlK08Ht7ZO95f0s=; b=VqOv1LwvORjsUpn8CLNbTCItxreGraMdm54gtsHX7eCz8Mu2Al+w+ugG9Omm/Icu/QBPcn K56YghF9b1VxJPGGYYKl4gxTHxbhzrMrMInLnSU1oHELm1Sby16i1RGQbf8xGvFr5MBKrG F80ywQ19pbwws7aqofiHGgB7PV7QxgURLrqQFxVWJdwzYPMPPbgtrd0TALYGzyT7zL9+Wz 17RFt6p1zNFE2wUYrkrbZxuMojPQMIVMV0jA/SPdJb4jnWUy7YCnVM+FGrpiCdYmk5ZMKc wQI/aLSKoMhstUIIxmT2EnuSWlHsg8Ouy9DMltCc2i96UTZtBM+YtrAuH8MM7A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765318831; a=rsa-sha256; cv=none; b=A2nPd5Y1zJvjw+x9nfon7Si1ivAU5yA9VRtzY6I2oU7PRSjUE/Uq3CS3MOnObIz1qJuTSk VkWtGUSxlN1tGEn/ncQA29o/YyCdiJJ5sygYFxoJQ3tPgGcyf00PiUda1W5eTieLy/hM4t IIZxwRRokBuIi93DYKxAWDqhrYNzayKElWV+a0lRR87mybY01hX9lLD5Zmr79lYpTd8w+A U7cusucZrEk81ycJEhANbgkE7qlsuoPoZT+0OPyLH3qGayXXdEuXhQQSWiuTKOYQDJb6Ze e9OT0YT6uLhr7ZbwVPJLun+ZLBk8vPzTAvpRDtPsbd76K14bXLy2d2jkSwdxOg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dQtb35tZ0z38C for ; Tue, 09 Dec 2025 22:20:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3d667 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 09 Dec 2025 22:20:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Andrew Gallatin Subject: git: a837d1fe49e0 - main - splice: Fix leaks that can happen when initiating a splice List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gallatin X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a837d1fe49e0255d81c670dc271ff245ae960097 Auto-Submitted: auto-generated Date: Tue, 09 Dec 2025 22:20:31 +0000 Message-Id: <6938a0af.3d667.4486402f@gitrepo.freebsd.org> The branch main has been updated by gallatin: URL: https://cgit.FreeBSD.org/src/commit/?id=a837d1fe49e0255d81c670dc271ff245ae960097 commit a837d1fe49e0255d81c670dc271ff245ae960097 Author: Andrew Gallatin AuthorDate: 2025-12-09 21:06:20 +0000 Commit: Andrew Gallatin CommitDate: 2025-12-09 22:07:11 +0000 splice: Fix leaks that can happen when initiating a splice - change the state to SPLICE_EXCEPTION to allow so_unsplice() to work to cleanup failed splices (fixes socket reference leak) - NULL out sp->dst when unsplicing from so_splice() before so2 has been been referenced. - Deal with a null sp->dst / so2 in so_unsplice - Fix asserts that talked about sp->state == SPLICE_INIT; that state is not possible here. Differential Revision: https://reviews.freebsd.org/D54157 Reviewed by: markj Sponsored by: Netflix Fixes: c0c5d01e5374 ("so_splice: Synchronize so_unsplice() with so_splice()") MFC after: 3 days --- sys/kern/uipc_socket.c | 44 +++++++++++++++++++++++++++----------------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 00aa5f9309b2..9eba3ad2e082 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -1726,6 +1726,10 @@ so_splice(struct socket *so, struct socket *so2, struct splice *splice) error = EBUSY; if (error != 0) { SOCK_UNLOCK(so2); + mtx_lock(&sp->mtx); + sp->dst = NULL; + sp->state = SPLICE_EXCEPTION; + mtx_unlock(&sp->mtx); so_unsplice(so, false); return (error); } @@ -1733,6 +1737,10 @@ so_splice(struct socket *so, struct socket *so2, struct splice *splice) if (so->so_snd.sb_tls_info != NULL) { SOCK_SENDBUF_UNLOCK(so2); SOCK_UNLOCK(so2); + mtx_lock(&sp->mtx); + sp->dst = NULL; + sp->state = SPLICE_EXCEPTION; + mtx_unlock(&sp->mtx); so_unsplice(so, false); return (EINVAL); } @@ -1799,20 +1807,20 @@ so_unsplice(struct socket *so, bool timeout) SOCK_UNLOCK(so); so2 = sp->dst; - SOCK_LOCK(so2); - KASSERT(!SOLISTENING(so2), ("%s: so2 is listening", __func__)); - SOCK_SENDBUF_LOCK(so2); - KASSERT(sp->state == SPLICE_INIT || - (so2->so_snd.sb_flags & SB_SPLICED) != 0, - ("%s: so2 is not spliced", __func__)); - KASSERT(sp->state == SPLICE_INIT || - so2->so_splice_back == sp, - ("%s: so_splice_back != sp", __func__)); - so2->so_snd.sb_flags &= ~SB_SPLICED; - so2rele = so2->so_splice_back != NULL; - so2->so_splice_back = NULL; - SOCK_SENDBUF_UNLOCK(so2); - SOCK_UNLOCK(so2); + if (so2 != NULL) { + SOCK_LOCK(so2); + KASSERT(!SOLISTENING(so2), ("%s: so2 is listening", __func__)); + SOCK_SENDBUF_LOCK(so2); + KASSERT((so2->so_snd.sb_flags & SB_SPLICED) != 0, + ("%s: so2 is not spliced", __func__)); + KASSERT(so2->so_splice_back == sp, + ("%s: so_splice_back != sp", __func__)); + so2->so_snd.sb_flags &= ~SB_SPLICED; + so2rele = so2->so_splice_back != NULL; + so2->so_splice_back = NULL; + SOCK_SENDBUF_UNLOCK(so2); + SOCK_UNLOCK(so2); + } /* * No new work is being enqueued. The worker thread might be @@ -1852,9 +1860,11 @@ so_unsplice(struct socket *so, bool timeout) sorwakeup(so); CURVNET_SET(so->so_vnet); sorele(so); - sowwakeup(so2); - if (so2rele) - sorele(so2); + if (so2 != NULL) { + sowwakeup(so2); + if (so2rele) + sorele(so2); + } CURVNET_RESTORE(); so_splice_free(sp); return (0);