Bug 275286
| Summary: | kqueue(2): kqueue_close: page fault | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Andreas Bock <andreas.bock> | ||||||
| Component: | kern | Assignee: | Konstantin Belousov <kib> | ||||||
| Status: | Closed FIXED | ||||||||
| Severity: | Affects Only Me | CC: | brooks, kib, markj, tom+fbsdbugzilla | ||||||
| Priority: | --- | ||||||||
| Version: | 13.2-RELEASE | ||||||||
| Hardware: | amd64 | ||||||||
| OS: | Any | ||||||||
| Bug Depends on: | |||||||||
| Bug Blocks: | 275215 | ||||||||
| Attachments: |
|
||||||||
|
Description
Andreas Bock
2023-11-23 20:05:31 UTC
Created attachment 246539 [details]
regression test
I took the liberty of distilling the test case into a regression test, attached.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=393ac29f0b8be068c8e46f76c2eeee07d20ea4df commit 393ac29f0b8be068c8e46f76c2eeee07d20ea4df Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-24 06:41:58 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-11-24 16:26:53 +0000 kqueue: on process exit, force-clear its registered signal events Normally, process already has all its kqueue fds destroyed at the moment p_klist is detached in exit flow. But, if the process was created with rfork(2) with shared file descriptors, its signal knotes can survive. Then, knlist_detach() does not destroy non-empty knlist. Later, when owning kqueue is closed, we access freed (or rather, reused, because struct proc is type-stable) memory by referencing p->p_klist from such knote. Handle this situation by deleting all knotes hanging from p_klist. PR: 275286 Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D42745 sys/kern/kern_exit.c | 1 + 1 file changed, 1 insertion(+) A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=ed410b78edc53e17b5a3e93ace2adbeb3a734ae9 commit ed410b78edc53e17b5a3e93ace2adbeb3a734ae9 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-28 12:51:54 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-11-28 17:29:58 +0000 EVFILT_SIGNAL: do not use target process pointer on detach It is enough to know knlist to remove from it, and the list is autodestroyed on last removal. PR: 275286 Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D42777 sys/kern/kern_sig.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=877ef685322f795c071da9657bb490730d8cbb89 commit 877ef685322f795c071da9657bb490730d8cbb89 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-28 12:32:24 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-11-28 17:29:58 +0000 Revert "kqueue: on process exit, force-clear its registered signal events" This reverts commit 393ac29f0b8be068c8e46f76c2eeee07d20ea4df. A different fix is following, which preserves semantic, required by the sys.kqueue.proc3_test.proc3 test. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week PR: 275286 Differential revision: https://reviews.freebsd.org/D42777 sys/kern/kern_exit.c | 1 - 1 file changed, 1 deletion(-) A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=24346a2f777598272caffbd7e4fb6d85cafe64ed commit 24346a2f777598272caffbd7e4fb6d85cafe64ed Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-28 12:51:54 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-12-05 00:43:27 +0000 EVFILT_SIGNAL: do not use target process pointer on detach PR: 275286 (cherry picked from commit ed410b78edc53e17b5a3e93ace2adbeb3a734ae9) sys/kern/kern_sig.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=55e91944998c128d74b94b9b48a04ef41ff5e9d0 commit 55e91944998c128d74b94b9b48a04ef41ff5e9d0 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-28 12:51:54 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2023-12-05 00:44:13 +0000 EVFILT_SIGNAL: do not use target process pointer on detach PR: 275286 (cherry picked from commit ed410b78edc53e17b5a3e93ace2adbeb3a734ae9) sys/kern/kern_sig.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) *** Bug 269520 has been marked as a duplicate of this bug. *** A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=f5463265955b829775bbb32e1fd0bc11dafc36ce commit f5463265955b829775bbb32e1fd0bc11dafc36ce Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2023-11-24 15:28:13 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2024-01-27 18:51:13 +0000 kqueue tests: Add a regression test Based on the test case submitted by Andreas Bock for PR 275286. PR: 275286 MFC after: 2 weeks tests/sys/kqueue/Makefile | 4 +- tests/sys/kqueue/kqueue_fork.c (new) | 89 ++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+), 2 deletions(-) IMO this deserves an EN as the regression test can not be run on 14.0 without a panic. A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3a90a4453750b12444e96d647d7c1203dc1cc9c5 commit 3a90a4453750b12444e96d647d7c1203dc1cc9c5 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2023-11-24 15:28:13 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2024-02-11 15:14:44 +0000 kqueue tests: Add a regression test Based on the test case submitted by Andreas Bock for PR 275286. PR: 275286 MFC after: 2 weeks (cherry picked from commit f5463265955b829775bbb32e1fd0bc11dafc36ce) tests/sys/kqueue/Makefile | 4 +- tests/sys/kqueue/kqueue_fork.c (new) | 89 ++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+), 2 deletions(-) A commit in branch releng/14.0 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=bb06104dce0b2d471772fefe2ce5b7e651287479 commit bb06104dce0b2d471772fefe2ce5b7e651287479 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-28 12:51:54 +0000 Commit: Gordon Tetlow <gordon@FreeBSD.org> CommitDate: 2024-02-14 05:37:56 +0000 EVFILT_SIGNAL: do not use target process pointer on detach PR: 275286 Approved by: so Security: FreeBSD-EN-24:03.kqueue (cherry picked from commit ed410b78edc53e17b5a3e93ace2adbeb3a734ae9) (cherry picked from commit 24346a2f777598272caffbd7e4fb6d85cafe64ed) sys/kern/kern_sig.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) A commit in branch releng/13.2 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=154dedade4654516dfd3737ae56d5b3e3721029a commit 154dedade4654516dfd3737ae56d5b3e3721029a Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2023-11-28 12:51:54 +0000 Commit: Gordon Tetlow <gordon@FreeBSD.org> CommitDate: 2024-02-14 05:37:16 +0000 EVFILT_SIGNAL: do not use target process pointer on detach PR: 275286 Approved by: so Security: FreeBSD-EN-24:03.kqueue (cherry picked from commit ed410b78edc53e17b5a3e93ace2adbeb3a734ae9) (cherry picked from commit 55e91944998c128d74b94b9b48a04ef41ff5e9d0) sys/kern/kern_sig.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) |
