From owner-dev-commits-src-main@freebsd.org Fri Jan 22 19:00:37 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B29644FC109; Fri, 22 Jan 2021 19:00:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DMpVs4kwbz3pDN; Fri, 22 Jan 2021 19:00:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 95654235B4; Fri, 22 Jan 2021 19:00:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 10MJ0bj3009359; Fri, 22 Jan 2021 19:00:37 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 10MJ0bfZ009358; Fri, 22 Jan 2021 19:00:37 GMT (envelope-from git) Date: Fri, 22 Jan 2021 19:00:37 GMT Message-Id: <202101221900.10MJ0bfZ009358@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jamie Gritton Subject: git: 195cd6ae2481 - main - jail: fix dangling reference bug from 6754ae2572eb MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 195cd6ae2481dd5ad555ed65c226b6f20908d66a Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jan 2021 19:00:37 -0000 The branch main has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=195cd6ae2481dd5ad555ed65c226b6f20908d66a commit 195cd6ae2481dd5ad555ed65c226b6f20908d66a Author: Jamie Gritton AuthorDate: 2021-01-22 18:56:24 +0000 Commit: Jamie Gritton CommitDate: 2021-01-22 18:56:24 +0000 jail: fix dangling reference bug from 6754ae2572eb The change to use refcounts for pr_uref was mishandled in prison_proc_free, so killing a jail's last process could add an extra reference, leaving it an unkillable zombie. --- sys/kern/kern_jail.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 318f81fb13be..064f1afa4133 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -2705,7 +2705,6 @@ prison_proc_hold(struct prison *pr) void prison_proc_free(struct prison *pr) { - int lasturef; /* * Locking is only required when releasing the last reference. @@ -2714,11 +2713,7 @@ prison_proc_free(struct prison *pr) */ KASSERT(refcount_load(&pr->pr_uref) > 0, ("Trying to kill a process in a dead prison (jid=%d)", pr->pr_id)); - if (refcount_release_if_not_last(&pr->pr_uref)) - return; - mtx_lock(&pr->pr_mtx); - lasturef = refcount_release(&pr->pr_uref); - if (lasturef) { + if (!refcount_release_if_not_last(&pr->pr_uref)) { /* * Don't remove the last user reference in this context, * which is expected to be a process that is not only locked, @@ -2726,11 +2721,8 @@ prison_proc_free(struct prison *pr) * prison_free() won't re-submit the task. */ refcount_acquire(&pr->pr_ref); - mtx_unlock(&pr->pr_mtx); taskqueue_enqueue(taskqueue_thread, &pr->pr_task); - return; } - mtx_unlock(&pr->pr_mtx); } /*