From owner-svn-src-all@freebsd.org Tue Apr 28 15:02:44 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B6BBE2BBF74; Tue, 28 Apr 2020 15:02:44 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49BPyX4MkLz3LWb; Tue, 28 Apr 2020 15:02:44 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 914CF2607B; Tue, 28 Apr 2020 15:02:44 +0000 (UTC) (envelope-from markj@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 03SF2iXI075266; Tue, 28 Apr 2020 15:02:44 GMT (envelope-from markj@FreeBSD.org) Received: (from markj@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 03SF2iFP075265; Tue, 28 Apr 2020 15:02:44 GMT (envelope-from markj@FreeBSD.org) Message-Id: <202004281502.03SF2iFP075265@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: markj set sender to markj@FreeBSD.org using -f From: Mark Johnston Date: Tue, 28 Apr 2020 15:02:44 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r360438 - head/sys/kern X-SVN-Group: head X-SVN-Commit-Author: markj X-SVN-Commit-Paths: head/sys/kern X-SVN-Commit-Revision: 360438 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 15:02:44 -0000 Author: markj Date: Tue Apr 28 15:02:44 2020 New Revision: 360438 URL: https://svnweb.freebsd.org/changeset/base/360438 Log: Make sendfile(SF_SYNC)'s CV wait interruptible. Otherwise, since the CV is not signalled until data is drained from the socket, it is trivial to create an unkillable process using sendfile(SF_SYNC) and a process-private PF_LOCAL socket pair. In particular, the cv_wait() in sendfile() does not get interrupted until data is drained from the receiving socket buffer. Reported by: pho Discussed with: kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Modified: head/sys/kern/kern_sendfile.c Modified: head/sys/kern/kern_sendfile.c ============================================================================== --- head/sys/kern/kern_sendfile.c Tue Apr 28 14:33:33 2020 (r360437) +++ head/sys/kern/kern_sendfile.c Tue Apr 28 15:02:44 2020 (r360438) @@ -106,8 +106,36 @@ struct sendfile_sync { struct mtx mtx; struct cv cv; unsigned count; + bool waiting; }; +static void +sendfile_sync_destroy(struct sendfile_sync *sfs) +{ + KASSERT(sfs->count == 0, ("sendfile sync %p still busy", sfs)); + + cv_destroy(&sfs->cv); + mtx_destroy(&sfs->mtx); + free(sfs, M_SENDFILE); +} + +static void +sendfile_sync_signal(struct sendfile_sync *sfs) +{ + mtx_lock(&sfs->mtx); + KASSERT(sfs->count > 0, ("sendfile sync %p not busy", sfs)); + if (--sfs->count == 0) { + if (!sfs->waiting) { + /* The sendfile() waiter was interrupted by a signal. */ + sendfile_sync_destroy(sfs); + return; + } else { + cv_signal(&sfs->cv); + } + } + mtx_unlock(&sfs->mtx); +} + counter_u64_t sfstat[sizeof(struct sfstat) / sizeof(uint64_t)]; static void @@ -153,12 +181,7 @@ sendfile_free_mext(struct mbuf *m) if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { struct sendfile_sync *sfs = m->m_ext.ext_arg2; - - mtx_lock(&sfs->mtx); - KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); - if (--sfs->count == 0) - cv_signal(&sfs->cv); - mtx_unlock(&sfs->mtx); + sendfile_sync_signal(sfs); } } @@ -186,12 +209,7 @@ sendfile_free_mext_pg(struct mbuf *m) if (m->m_ext.ext_flags & EXT_FLAG_SYNC) { struct sendfile_sync *sfs = m->m_ext.ext_arg1; - - mtx_lock(&sfs->mtx); - KASSERT(sfs->count > 0, ("Sendfile sync botchup count == 0")); - if (--sfs->count == 0) - cv_signal(&sfs->cv); - mtx_unlock(&sfs->mtx); + sendfile_sync_signal(sfs); } } @@ -719,6 +737,7 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *h sfs = malloc(sizeof(*sfs), M_SENDFILE, M_WAITOK | M_ZERO); mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); cv_init(&sfs->cv, "sendfile"); + sfs->waiting = true; } rem = nbytes ? omin(nbytes, obj_size - offset) : obj_size - offset; @@ -1221,11 +1240,13 @@ out: if (sfs != NULL) { mtx_lock(&sfs->mtx); if (sfs->count != 0) - cv_wait(&sfs->cv, &sfs->mtx); - KASSERT(sfs->count == 0, ("sendfile sync still busy")); - cv_destroy(&sfs->cv); - mtx_destroy(&sfs->mtx); - free(sfs, M_SENDFILE); + error = cv_wait_sig(&sfs->cv, &sfs->mtx); + if (sfs->count == 0) { + sendfile_sync_destroy(sfs); + } else { + sfs->waiting = false; + mtx_unlock(&sfs->mtx); + } } #ifdef KERN_TLS if (tls != NULL)