Bug 228858
| Summary: | panic when delivering knote to a process who has opened a kqueue() is dying | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Siddharth <siddharthtuli> |
| Component: | kern | Assignee: | Mark Johnston <markj> |
| Status: | Closed FIXED | ||
| Severity: | Affects Some People | CC: | markj, pho, siddharthtuli |
| Priority: | --- | Keywords: | crash |
| Version: | 11.0-STABLE | ||
| Hardware: | Any | ||
| OS: | Any | ||
|
Description
Siddharth
2018-06-10 05:45:52 UTC
A commit references this bug: Author: pho Date: Tue Nov 20 09:30:26 UTC 2018 New revision: 340665 URL: https://svnweb.freebsd.org/changeset/base/340665 Log: Added a kevent(2) test. PR: 228858 Sponsored by: Dell EMC Isilon Changes: user/pho/stress2/misc/kevent12.sh The process closing the kqueue should drain all of the kqueue's notes; this happens in kqueue_drain(). Unfortunately, we have a few races: - kqueue_register() doesn't check for KQ_CLOSING, so it may add knotes to the fdtable or hash table after we've started draining. This can be triggered by knote_fork(). - The locking in knote_fork() is wrong: at the end of the loop we should be acquiring the list lock before the kqueue lock. Otherwise there's a window where the knote is unlocked and not in flux, and thus may be freed. To fix this I believe it's sufficient to just reorder the locking; the list lock comes before the kqueue lock in the lock order. The in-flux state of the knote is sufficient to prevent it from being removed, I believe, so we don't need a marker knote to hold our place in the list. A commit references this bug: Author: markj Date: Sat Nov 24 16:41:29 UTC 2018 New revision: 340897 URL: https://svnweb.freebsd.org/changeset/base/340897 Log: Lock the knlist before releasing the in-flux state in knote_fork(). Otherwise there is a window, before iteration is resumed, during which the knote may be freed. The in-flux state ensures that the knote will not be removed from the knlist while locks are dropped. PR: 228858 Reviewed by: kib Tested by: pho MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D18316 Changes: head/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Sat Nov 24 16:58:34 UTC 2018 New revision: 340898 URL: https://svnweb.freebsd.org/changeset/base/340898 Log: Ensure that knotes do not get registered when KQ_CLOSING is set. KQ_CLOSING is set before draining the knotes associated with a kqueue, so we must ensure that new knotes are not added after that point. In particular, some kernel facilities may register for events on behalf of a userspace process and race with a close of the kqueue. PR: 228858 Reviewed by: kib Tested by: pho MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D18316 Changes: head/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Tue Nov 27 16:57:59 UTC 2018 New revision: 341077 URL: https://svnweb.freebsd.org/changeset/base/341077 Log: MFC r340897: Lock the knlist before releasing the in-flux state in knote_fork(). PR: 228858 Changes: _U stable/12/ stable/12/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Tue Nov 27 16:59:13 UTC 2018 New revision: 341078 URL: https://svnweb.freebsd.org/changeset/base/341078 Log: MFC r340897: Lock the knlist before releasing the in-flux state in knote_fork(). PR: 228858 Changes: _U stable/11/ stable/11/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Tue Nov 27 17:08:08 UTC 2018 New revision: 341082 URL: https://svnweb.freebsd.org/changeset/base/341082 Log: MFC r340898: Ensure that knotes do not get registered when KQ_CLOSING is set. PR: 228858 Changes: _U stable/12/ stable/12/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Tue Nov 27 17:10:01 UTC 2018 New revision: 341083 URL: https://svnweb.freebsd.org/changeset/base/341083 Log: MFC r340898: Ensure that knotes do not get registered when KQ_CLOSING is set. PR: 228858 Changes: _U stable/11/ stable/11/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Wed Nov 28 17:40:09 UTC 2018 New revision: 341157 URL: https://svnweb.freebsd.org/changeset/base/341157 Log: MFstable/12 r341077: Lock the knlist before releasing the in-flux state in knote_fork(). PR: 228858 Approved by: re (gjb) Changes: _U releng/12.0/ releng/12.0/sys/kern/kern_event.c A commit references this bug: Author: markj Date: Wed Nov 28 18:06:17 UTC 2018 New revision: 341159 URL: https://svnweb.freebsd.org/changeset/base/341159 Log: MFstable/12 r341082: Ensure that knotes do not get registered when KQ_CLOSING is set. PR: 228858 Approved by: re (gjb) Changes: _U releng/12.0/ releng/12.0/sys/kern/kern_event.c |
