Date: Fri, 14 Nov 2025 13:18:34 -0300 From: Renato Botelho <garga@FreeBSD.org> To: Gleb Smirnoff <glebius@FreeBSD.org>, src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: Re: git: 69f61cee2efb - main - unix/stream: fix a race with MSG_PEEK on SOCK_SEQPACKET with MSG_EOR Message-ID: <e4e060ea-e94f-43c5-9ff4-a296d81185b9@FreeBSD.org> In-Reply-To: <202511140240.5AE2eQmY011060__48884.4837805786$1763088041$gmane$org@gitrepo.freebsd.org>
index | next in thread | previous in thread | raw e-mail
On 13/11/25 23:40, Gleb Smirnoff wrote: > The branch main has been updated by glebius: > > URL: https://cgit.FreeBSD.org/src/commit/?id=69f61cee2efb1eec0640ca7de9b2d51599569a5d > > commit 69f61cee2efb1eec0640ca7de9b2d51599569a5d > Author: Gleb Smirnoff <glebius@FreeBSD.org> > AuthorDate: 2025-11-14 02:39:48 +0000 > Commit: Gleb Smirnoff <glebius@FreeBSD.org> > CommitDate: 2025-11-14 02:39:48 +0000 > > unix/stream: fix a race with MSG_PEEK on SOCK_SEQPACKET with MSG_EOR > > The pr_soreceive method first scans the buffer holding the both I/O sx(9) > and socket buffer mutex(9) and after figuring out how much needs to be > copied out drops the mutex. Since the other side may only append to the > buffer, it is safe to continue the operation holding the sx(9) only. > However, the code had a bug that it used pointer in the very last mbuf as > marker of the place where to stop. This worked both in a case when we > drain a buffer completely (marker points at NULL) and in a case when we > wanted to stop at MSG_EOR (marker points at next mbuf after MSG_EOR). > However, this pointer is not consistent after we dropped the socket buffer > mutex. > > Rewrite the logic to use the data length as bounds for the copyout cycle. > > Provide a test case that reproduces the race. Note that the race is very > hard to hit, thus test will pass on unmodified kernel as well. In a > virtual machine I needed to add tsleep(9) for 10 nanoseconds into the > middle of function to be able to reproduce. > > PR: 290658 > Reviewed by: markj > Differential Revision: https://reviews.freebsd.org/D53632 > Fixes: d15792780760ef94647af9b377b5f0a80e1826bc Hi Gleb! It looks like Thunderbird decided to encrypt my previous message, lets try again :) I've updated my laptop this morning and it crashed at boot as you can see at [1]. I suspect it may be related to this commit. [1] https://imgur.com/a/opfN6Ta -- Renato Botelhohome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?e4e060ea-e94f-43c5-9ff4-a296d81185b9>