From nobody Wed Jul 8 18:59:47 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gwS861Jj2z6khZ5; Wed, 08 Jul 2026 18:59:50 +0000 (UTC) (envelope-from markj@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gwS860p2nz4M5s; Wed, 08 Jul 2026 18:59:50 +0000 (UTC) (envelope-from markj@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783537190; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=H4BxVJsTZOyuTdlMYmje+oab1Xt6nb2rHl9XbzHU6Bg=; b=jAQdj1tM/WpZu4P13Q/+rhGLbLI0DFfymZf28IP3iYzbjdjnIbw9WwjtWJYNtROi8p+7jP pMWOh4i0W78m2PNqc94O6X0EjNwQacucn0x2OLerdvp5+dsD0aJIYynqIb8MXxBzuFckSv cIZBtDSzq/MFHKVdOk4U58enZ5VJQejD5hD5pB/t3c6f/M5Vod5xDv+5soEnp7EbhkcJ+2 8spQaKGlShuf5Z1YRZn6cc+TIa71D2/2irtNCE+KhLIN9kLpbdsjptGI+IJxZ6tXUCwxHg K7H8BiPBKQX42MFubaufryw+gii+rjJ35lRs49rtGMXm5eEoB8Oai9sEr5cTzg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1783537190; a=rsa-sha256; cv=none; b=n6vY0gWO0YQLS9GD9L2NlN1ZxO5PhMQ7nJ8sPDWWMdI+8FF2KdbRi+JoP0kH5MaUtPX7+I uUxa+1Xzv875022N4Pn3T3Un2PK3ZqojChJksERQoKM1RVIGkHrlXAQ4nA32/6+HP1ynqr CsrNPdZXk5FlCzFQq6hvWoYVfXEy03bjtV4mUuS23bwX1DdkoJNCy/JlnHFCnBPisPRntX vofV11j+bmlQNDH2NutmsLTR/B77A9GlIf+tIjyy61p4ZUqVnu+6mayKnjecry0QcgrQpm 0DdPzK1o6BNa62pYYSioPNltiE2LyUPYnhjO93c2yXzRVwHi+RiZ+AYOZMvX0Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1783537190; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=H4BxVJsTZOyuTdlMYmje+oab1Xt6nb2rHl9XbzHU6Bg=; b=Sp+qn7gREZ+0AKiz0BPvmdCh4cjrc05yPLMWJ4rba4bioAzLTnILvOkCq8VaT5PbWLKxNg z+dNLkS/2X11LnWSDstsYXMx6GItrNo/5wnr2LaBcTIfikPfKSV00ZVK3hAFQu5EoNhjUI qzzU57c9n9kH5gMS2A34IieKt/ypkdiprQlybs/9ni92IRutuEnUB0HM3kILddmjj7ZO+G EXH4RUVpMS4XWCKzYb3wK2vy2jHdc3xLbR1hOgJindqTAb3xhWzB6P6i0hPxB5ktQCf+XG BL9IQZXygTyqIrysrOAZRdKNFf639mS5bMwNRUxwK7B3grKNc0U0C5Soob6A/A== Received: from nuc (192-0-220-237.cpe.teksavvy.com [192.0.220.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: markj) by smtp.freebsd.org (Postfix) with ESMTPSA id 4gwS854zxcz11JD; Wed, 08 Jul 2026 18:59:49 +0000 (UTC) (envelope-from markj@freebsd.org) Date: Wed, 8 Jul 2026 14:59:47 -0400 From: Mark Johnston To: Konstantin Belousov Cc: src-committers@freebsd.org, dev-commits-src-all@freebsd.org, dev-commits-src-main@freebsd.org Subject: Re: git: dfad790c8cca - main - sendfile: stop abusing kern_writev() Message-ID: References: <6a4d73f7.1e7dd.1cbcbd60@gitrepo.freebsd.org> List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6a4d73f7.1e7dd.1cbcbd60@gitrepo.freebsd.org> On Tue, Jul 07, 2026 at 09:47:35PM +0000, Konstantin Belousov wrote: > The branch main has been updated by kib: > > URL: https://cgit.FreeBSD.org/src/commit/?id=dfad790c8ccad05ff603ceaa5b2efe4205b38e1c > > commit dfad790c8ccad05ff603ceaa5b2efe4205b38e1c > Author: Konstantin Belousov > AuthorDate: 2026-07-04 02:29:56 +0000 > Commit: Konstantin Belousov > CommitDate: 2026-07-07 21:47:18 +0000 > > sendfile: stop abusing kern_writev() > > Provide convenient wrapper kern_filewrite() around fo_write(). > Switch to use it in vn_sendfile(). This allows to avoid duplicate > fget() when we already have the reference to the file, which creates a > correctness race with the userspace. Also td_retval[0] clearing hack > can be removed. > > Reviewed by: glebius, markj > Sponsored by: The FreeBSD Foundation > MFC after: 1 week > Differential revision: https://reviews.freebsd.org/D58035 > --- > sys/kern/kern_sendfile.c | 25 +++++++++++++------------ > sys/kern/sys_generic.c | 41 ++++++++++++++++++++++++++++++----------- > sys/sys/syscallsubr.h | 2 ++ > 3 files changed, 45 insertions(+), 23 deletions(-) > > diff --git a/sys/kern/kern_sendfile.c b/sys/kern/kern_sendfile.c > index cf9716560c07..1a534210ca0c 100644 > --- a/sys/kern/kern_sendfile.c > +++ b/sys/kern/kern_sendfile.c > @@ -1168,14 +1168,17 @@ prepend_header: > } > > /* > - * Send trailers. Wimp out and use writev(2). > + * Send trailers. > */ > if (trl_uio != NULL) { > + ssize_t cnt; > + > SOCK_IO_SEND_UNLOCK(so); > CURVNET_RESTORE(); > - error = kern_writev(td, sockfd, trl_uio); > + error = kern_filewrite(td, sockfd, sock_fp, trl_uio, > + (off_t)-1, 0, &cnt); > if (error == 0) > - sbytes += td->td_retval[0]; > + sbytes += cnt; > goto out; > } > > @@ -1183,15 +1186,8 @@ done: > SOCK_IO_SEND_UNLOCK(so); > CURVNET_RESTORE(); > out: > - /* > - * If there was no error we have to clear td->td_retval[0] > - * because it may have been set by writev. > - */ > - if (error == 0) { > - td->td_retval[0] = 0; > - if (sbytes > 0 && vp != NULL) > - INOTIFY(vp, IN_ACCESS); > - } > + if (error == 0 && sbytes > 0 && vp != NULL) > + INOTIFY(vp, IN_ACCESS); > if (sent != NULL) { > (*sent) = sbytes; > } > @@ -1260,6 +1256,11 @@ sendfile(struct thread *td, struct sendfile_args *uap, int compat) > &trl_uio); > if (error != 0) > goto out; > + if (trl_uio->uio_rw != UIO_WRITE) { cloneuio() does not set uio_rw. sendfile() was relying on kern_writev() to do that. A GENERIC-KMSAN kernel panics when running the test suite: panic: MSan: Uninitialized malloc memory from copyinuio+0x11d cpuid = 5 time = 1783537112 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0xa7/frame 0xfffffe00764d7840 vpanic() at vpanic+0x538/frame 0xfffffe00764d79c0 panic() at panic+0x1dd/frame 0xfffffe00764d7ad0 __msan_warning() at __msan_warning+0x25d/frame 0xfffffe00764d7c20 sendfile() at sendfile+0xcb6/frame 0xfffffe00764d7d50 amd64_syscall() at amd64_syscall+0x837/frame 0xfffffe00764d7f30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00764d7f30 --- syscall (393, FreeBSD ELF64, sendfile), rip = 0x21aad2ea3b0a, rsp = 0x21aad1d706c8, rbp = 0x21aad1d70760 --- KDB: enter: panic