Page MenuHomeFreeBSD

Fix some EVFILT_PROC-related race conditions.
ClosedPublic

Authored by markj on Nov 23 2018, 9:58 PM.
Tags
None
Referenced Files
F170631220: D18316.diff
Sat, Sep 5, 5:42 PM
F170614254: D18316.id.diff
Sat, Sep 5, 3:48 PM
Unknown Object (File)
Wed, Sep 2, 6:45 AM
Unknown Object (File)
Tue, Sep 1, 9:00 PM
Unknown Object (File)
Sat, Aug 29, 11:54 PM
Unknown Object (File)
Fri, Aug 28, 2:36 AM
Unknown Object (File)
Thu, Aug 27, 7:36 AM
Unknown Object (File)
Thu, Aug 27, 5:36 AM
Subscribers

Details

Summary

knote_fork() may attempt to register an event after we have started to
close a kqueue. Check for KQ_CLOSING with the kqueue lock held before
resizing the fd table or creating a knote hash table, and before
inserting a new knote into one of the kqueue tables.

In knote_fork(), acquire the knlist lock before dropping the kqueue lock
and the in-flux state of the knote. Otherwise there is nothing
preventing the knote from being freed before the knlist lock is
reacquired. I believe the in-flux state is sufficient to prevent the
knote from being removed from the knlist while locks are dropped.

When initializing the kqueue hash table, respect the "waitok" parameter;
hashinit() uses M_WAITOK.

Test Plan

I asked Peter to test the patch. His kevent12.sh triggers these races.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 21181
Build 20536: arc lint + arc unit

Event Timeline

markj added a reviewer: kib.
sys/kern/kern_event.c
1744

Commit this part (honor waitok) separately ?

This revision was not accepted when it landed; it landed in state Needs Review.Nov 23 2018, 11:10 PM
This revision was automatically updated to reflect the committed changes.
markj marked an inline comment as done.
kib added inline comments.
sys/kern/kern_event.c
606

This chunk deserves separate commit IMO.

This revision is now accepted and ready to land.Nov 23 2018, 11:43 PM
This revision was automatically updated to reflect the committed changes.