From owner-svn-src-all@freebsd.org Wed Dec 2 00:48:15 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id AA61046BE7B; Wed, 2 Dec 2020 00:48:15 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Cm0gz4VDgz3hHv; Wed, 2 Dec 2020 00:48:15 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 88F4D1EA6E; Wed, 2 Dec 2020 00:48:15 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0B20mFf5098579; Wed, 2 Dec 2020 00:48:15 GMT (envelope-from mjg@FreeBSD.org) Received: (from mjg@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0B20mFQo098578; Wed, 2 Dec 2020 00:48:15 GMT (envelope-from mjg@FreeBSD.org) Message-Id: <202012020048.0B20mFQo098578@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mjg set sender to mjg@FreeBSD.org using -f From: Mateusz Guzik Date: Wed, 2 Dec 2020 00:48:15 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r368271 - head/sys/kern X-SVN-Group: head X-SVN-Commit-Author: mjg X-SVN-Commit-Paths: head/sys/kern X-SVN-Commit-Revision: 368271 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2020 00:48:15 -0000 Author: mjg Date: Wed Dec 2 00:48:15 2020 New Revision: 368271 URL: https://svnweb.freebsd.org/changeset/base/368271 Log: select: make sure there are no wakeup attempts after selfdfree returns Prior to the patch returning selfdfree could still be racing against doselwakeup which set sf_si = NULL and now locks stp to wake up the other thread. A sufficiently unlucky pair can end up going all the way down to freeing select-related structures before the lock/wakeup/unlock finishes. This started manifesting itself as crashes since select data started getting freed in r367714. Modified: head/sys/kern/sys_generic.c Modified: head/sys/kern/sys_generic.c ============================================================================== --- head/sys/kern/sys_generic.c Wed Dec 2 00:45:35 2020 (r368270) +++ head/sys/kern/sys_generic.c Wed Dec 2 00:48:15 2020 (r368271) @@ -1820,14 +1820,17 @@ doselwakeup(struct selinfo *sip, int pri) */ TAILQ_REMOVE(&sip->si_tdlist, sfp, sf_threads); stp = sfp->sf_td; - /* - * Paired with selfdfree. - */ - atomic_store_rel_ptr((uintptr_t *)&sfp->sf_si, (uintptr_t)NULL); mtx_lock(&stp->st_mtx); stp->st_flags |= SELTD_PENDING; cv_broadcastpri(&stp->st_wait, pri); mtx_unlock(&stp->st_mtx); + /* + * Paired with selfdfree. + * + * Storing this only after the wakeup provides an invariant that + * stp is not used after selfdfree returns. + */ + atomic_store_rel_ptr((uintptr_t *)&sfp->sf_si, (uintptr_t)NULL); } mtx_unlock(sip->si_mtx); } @@ -1837,14 +1840,18 @@ seltdinit(struct thread *td) { struct seltd *stp; - if ((stp = td->td_sel) != NULL) - goto out; - td->td_sel = stp = malloc(sizeof(*stp), M_SELECT, M_WAITOK|M_ZERO); + stp = td->td_sel; + if (stp != NULL) { + MPASS(stp->st_flags == 0); + MPASS(STAILQ_EMPTY(&stp->st_selq)); + return; + } + stp = malloc(sizeof(*stp), M_SELECT, M_WAITOK|M_ZERO); mtx_init(&stp->st_mtx, "sellck", NULL, MTX_DEF); cv_init(&stp->st_wait, "select"); -out: stp->st_flags = 0; STAILQ_INIT(&stp->st_selq); + td->td_sel = stp; } static int @@ -1887,6 +1894,8 @@ seltdfini(struct thread *td) stp = td->td_sel; if (stp == NULL) return; + MPASS(stp->st_flags == 0); + MPASS(STAILQ_EMPTY(&stp->st_selq)); if (stp->st_free1) free(stp->st_free1, M_SELFD); if (stp->st_free2)