From owner-svn-src-head@freebsd.org Mon Nov 23 00:33:07 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 2689D47AA84; Mon, 23 Nov 2020 00:33:07 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CfSmg0byNz4fST; Mon, 23 Nov 2020 00:33:07 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0788522FF1; Mon, 23 Nov 2020 00:33:07 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0AN0X6Ks079026; Mon, 23 Nov 2020 00:33:06 GMT (envelope-from kevans@FreeBSD.org) Received: (from kevans@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0AN0X6gS079025; Mon, 23 Nov 2020 00:33:06 GMT (envelope-from kevans@FreeBSD.org) Message-Id: <202011230033.0AN0X6gS079025@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kevans set sender to kevans@FreeBSD.org using -f From: Kyle Evans Date: Mon, 23 Nov 2020 00:33:06 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r367942 - head/sys/kern X-SVN-Group: head X-SVN-Commit-Author: kevans X-SVN-Commit-Paths: head/sys/kern X-SVN-Commit-Revision: 367942 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Nov 2020 00:33:07 -0000 Author: kevans Date: Mon Nov 23 00:33:06 2020 New Revision: 367942 URL: https://svnweb.freebsd.org/changeset/base/367942 Log: kern: dup: do not assume oldfde is valid oldfde may be invalidated if the table has grown due to the operation that we're performing, either via fdalloc() or a direct fdgrowtable_exp(). This was technically OK before rS367927 because the old table remained valid until the filedesc became unused, but now it may be freed immediately if it's an unshared table in a single-threaded process, so it is no longer a good assumption to make. This fixes dup/dup2 invocations that grow the file table; in the initial report, it manifested as a kernel panic in devel/gmake's configure script. Reported by: Guy Yur Reviewed by: rew Differential Revision: https://reviews.freebsd.org/D27319 Modified: head/sys/kern/kern_descrip.c Modified: head/sys/kern/kern_descrip.c ============================================================================== --- head/sys/kern/kern_descrip.c Sun Nov 22 20:21:10 2020 (r367941) +++ head/sys/kern/kern_descrip.c Mon Nov 23 00:33:06 2020 (r367942) @@ -870,7 +870,7 @@ kern_dup(struct thread *td, u_int mode, int flags, int struct filedesc *fdp; struct filedescent *oldfde, *newfde; struct proc *p; - struct file *delfp; + struct file *delfp, *oldfp; u_long *oioctls, *nioctls; int error, maxfd; @@ -910,7 +910,8 @@ kern_dup(struct thread *td, u_int mode, int flags, int } oldfde = &fdp->fd_ofiles[old]; - if (!fhold(oldfde->fde_file)) + oldfp = oldfde->fde_file; + if (!fhold(oldfp)) goto unlock; /* @@ -922,14 +923,14 @@ kern_dup(struct thread *td, u_int mode, int flags, int case FDDUP_NORMAL: case FDDUP_FCNTL: if ((error = fdalloc(td, new, &new)) != 0) { - fdrop(oldfde->fde_file, td); + fdrop(oldfp, td); goto unlock; } break; case FDDUP_MUSTREPLACE: /* Target file descriptor must exist. */ if (fget_locked(fdp, new) == NULL) { - fdrop(oldfde->fde_file, td); + fdrop(oldfp, td); goto unlock; } break; @@ -948,7 +949,7 @@ kern_dup(struct thread *td, u_int mode, int flags, int error = racct_set_unlocked(p, RACCT_NOFILE, new + 1); if (error != 0) { error = EMFILE; - fdrop(oldfde->fde_file, td); + fdrop(oldfp, td); goto unlock; } } @@ -963,6 +964,12 @@ kern_dup(struct thread *td, u_int mode, int flags, int } KASSERT(old != new, ("new fd is same as old")); + + /* Refetch oldfde because the table may have grown and old one freed. */ + oldfde = &fdp->fd_ofiles[old]; + KASSERT(oldfp == oldfde->fde_file, + ("fdt_ofiles shift from growth observed at fd %d", + old)); newfde = &fdp->fd_ofiles[new]; delfp = newfde->fde_file;