Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 27 Mar 2014 19:04:15 +0000 (UTC)
From:      Alan Somers <asomers@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
Subject:   svn commit: r263823 - in stable/9/sys: kern sys
Message-ID:  <201403271904.s2RJ4Fsg030491@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: asomers
Date: Thu Mar 27 19:04:15 2014
New Revision: 263823
URL: http://svnweb.freebsd.org/changeset/base/263823

Log:
  MFC r258311
  
    opensolaris/uts/common/dtrace/fasttrap.c
            Fix several problems that can cause panics on kldload and kldunload.
  
            * kproc_create(fasttrap_pid_cleanup_cb, ...) gets called before
              fasttrap_provs.fth_table gets allocated.  This can lead to a panic
              on module load, because fasttrap_pid_cleanup_cb references
              fasttrap_provs.fth_table.  Move kproc_create down after the point
              that fasttrap_provs.fth_table gets allocated, and modify the error
              handling accordingly.
  
            * dtrace_fasttrap_{fork,exec,exit} weren't getting NULLed until
              after fasttrap_provs.fth_table got freed.  That caused panics on
              module unload because fasttrap_exec_exit calls
              fasttrap_provider_retire, which references
              fasttrap_provs.fth_table.  NULL those function pointers earlier.
  
            * There wasn't any code to destroy the
              fasttrap_{tpoints,provs,procs}.fth_table mutexes on module unload,
              leading to a resource leak when WITNESS is enabled.  Destroy those
              mutexes during fasttrap_unload().
  
  Sponsored by: Spectra Logic Corporation

Modified:
  stable/9/sys/kern/uipc_sockbuf.c
  stable/9/sys/kern/uipc_usrreq.c
  stable/9/sys/sys/sockbuf.h
Directory Properties:
  stable/9/   (props changed)
  stable/9/sys/   (props changed)
  stable/9/sys/sys/   (props changed)

Modified: stable/9/sys/kern/uipc_sockbuf.c
==============================================================================
--- stable/9/sys/kern/uipc_sockbuf.c	Thu Mar 27 18:23:02 2014	(r263822)
+++ stable/9/sys/kern/uipc_sockbuf.c	Thu Mar 27 19:04:15 2014	(r263823)
@@ -617,29 +617,12 @@ sbappendrecord(struct sockbuf *sb, struc
 	SOCKBUF_UNLOCK(sb);
 }
 
-/*
- * Append address and data, and optionally, control (ancillary) data to the
- * receive queue of a socket.  If present, m0 must include a packet header
- * with total length.  Returns 0 if no space in sockbuf or insufficient
- * mbufs.
- */
-int
-sbappendaddr_locked(struct sockbuf *sb, const struct sockaddr *asa,
-    struct mbuf *m0, struct mbuf *control)
+/* Helper routine that appends data, control, and address to a sockbuf. */
+static int
+sbappendaddr_locked_internal(struct sockbuf *sb, const struct sockaddr *asa,
+    struct mbuf *m0, struct mbuf *control, struct mbuf *ctrl_last)
 {
 	struct mbuf *m, *n, *nlast;
-	int space = asa->sa_len;
-
-	SOCKBUF_LOCK_ASSERT(sb);
-
-	if (m0 && (m0->m_flags & M_PKTHDR) == 0)
-		panic("sbappendaddr_locked");
-	if (m0)
-		space += m0->m_pkthdr.len;
-	space += m_length(control, &n);
-
-	if (space > sbspace(sb))
-		return (0);
 #if MSIZE <= 256
 	if (asa->sa_len > MLEN)
 		return (0);
@@ -649,8 +632,8 @@ sbappendaddr_locked(struct sockbuf *sb, 
 		return (0);
 	m->m_len = asa->sa_len;
 	bcopy(asa, mtod(m, caddr_t), asa->sa_len);
-	if (n)
-		n->m_next = m0;		/* concatenate data to control */
+	if (ctrl_last)
+		ctrl_last->m_next = m0;	/* concatenate data to control */
 	else
 		control = m0;
 	m->m_next = control;
@@ -674,6 +657,50 @@ sbappendaddr_locked(struct sockbuf *sb, 
  * mbufs.
  */
 int
+sbappendaddr_locked(struct sockbuf *sb, const struct sockaddr *asa,
+    struct mbuf *m0, struct mbuf *control)
+{
+	struct mbuf *ctrl_last;
+	int space = asa->sa_len;
+
+	SOCKBUF_LOCK_ASSERT(sb);
+
+	if (m0 && (m0->m_flags & M_PKTHDR) == 0)
+		panic("sbappendaddr_locked");
+	if (m0)
+		space += m0->m_pkthdr.len;
+	space += m_length(control, &ctrl_last);
+
+	if (space > sbspace(sb))
+		return (0);
+	return (sbappendaddr_locked_internal(sb, asa, m0, control, ctrl_last));
+}
+
+/*
+ * Append address and data, and optionally, control (ancillary) data to the
+ * receive queue of a socket.  If present, m0 must include a packet header
+ * with total length.  Returns 0 if insufficient mbufs.  Does not validate space
+ * on the receiving sockbuf.
+ */
+int
+sbappendaddr_nospacecheck_locked(struct sockbuf *sb, const struct sockaddr *asa,
+    struct mbuf *m0, struct mbuf *control)
+{
+	struct mbuf *ctrl_last;
+
+	SOCKBUF_LOCK_ASSERT(sb);
+
+	ctrl_last = (control == NULL) ? NULL : m_last(control);
+	return (sbappendaddr_locked_internal(sb, asa, m0, control, ctrl_last));
+}
+
+/*
+ * Append address and data, and optionally, control (ancillary) data to the
+ * receive queue of a socket.  If present, m0 must include a packet header
+ * with total length.  Returns 0 if no space in sockbuf or insufficient
+ * mbufs.
+ */
+int
 sbappendaddr(struct sockbuf *sb, const struct sockaddr *asa,
     struct mbuf *m0, struct mbuf *control)
 {

Modified: stable/9/sys/kern/uipc_usrreq.c
==============================================================================
--- stable/9/sys/kern/uipc_usrreq.c	Thu Mar 27 18:23:02 2014	(r263822)
+++ stable/9/sys/kern/uipc_usrreq.c	Thu Mar 27 19:04:15 2014	(r263823)
@@ -876,7 +876,8 @@ uipc_send(struct socket *so, int flags, 
 			from = &sun_noname;
 		so2 = unp2->unp_socket;
 		SOCKBUF_LOCK(&so2->so_rcv);
-		if (sbappendaddr_locked(&so2->so_rcv, from, m, control)) {
+		if (sbappendaddr_nospacecheck_locked(&so2->so_rcv, from, m,
+		    control)) {
 			sorwakeup_locked(so2);
 			m = NULL;
 			control = NULL;
@@ -961,8 +962,14 @@ uipc_send(struct socket *so, int flags, 
 			const struct sockaddr *from;
 
 			from = &sun_noname;
-			if (sbappendaddr_locked(&so2->so_rcv, from, m,
-			    control))
+			/*
+			 * Don't check for space available in so2->so_rcv.
+			 * Unix domain sockets only check for space in the
+			 * sending sockbuf, and that check is performed one
+			 * level up the stack.
+			 */
+			if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
+				from, m, control))
 				control = NULL;
 			break;
 			}

Modified: stable/9/sys/sys/sockbuf.h
==============================================================================
--- stable/9/sys/sys/sockbuf.h	Thu Mar 27 18:23:02 2014	(r263822)
+++ stable/9/sys/sys/sockbuf.h	Thu Mar 27 19:04:15 2014	(r263823)
@@ -127,6 +127,8 @@ int	sbappendaddr(struct sockbuf *sb, con
 	    struct mbuf *m0, struct mbuf *control);
 int	sbappendaddr_locked(struct sockbuf *sb, const struct sockaddr *asa,
 	    struct mbuf *m0, struct mbuf *control);
+int	sbappendaddr_nospacecheck_locked(struct sockbuf *sb,
+	    const struct sockaddr *asa, struct mbuf *m0, struct mbuf *control);
 int	sbappendcontrol(struct sockbuf *sb, struct mbuf *m0,
 	    struct mbuf *control);
 int	sbappendcontrol_locked(struct sockbuf *sb, struct mbuf *m0,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201403271904.s2RJ4Fsg030491>