Page MenuHomeFreeBSD

socket: Remove NOFREE from the socket zone
ClosedPublic

Authored by markj on Sep 15 2021, 7:58 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Sep 3, 9:30 PM
Unknown Object (File)
Sun, Aug 30, 1:09 AM
Unknown Object (File)
Mon, Aug 24, 7:22 PM
Unknown Object (File)
Sat, Aug 22, 3:01 PM
Unknown Object (File)
Sat, Aug 22, 1:41 PM
Unknown Object (File)
Sat, Aug 22, 8:16 AM
Unknown Object (File)
Fri, Aug 21, 12:35 PM
Unknown Object (File)
Thu, Aug 20, 6:39 PM
Subscribers

Details

Summary

This flag was added during the transition away from the legacy zone
allocator, commit c897b81311792ccf6a93feff2a405e2ae53f664e. The old
zone allocator effectively provided _NOFREE semantics, but I believe
they are not required for sockets. In particular, we use reference
counting to keep sockets live.

The one case which is kind of weird is sonewconn(), which returns a
pointer to a socket with reference count 0. This socket is still
effectively owned by the listening socket. Protocols must therefore be
careful to synchronize sonewconn() calls with their pru_close
implementations, since for listening sockets soclose() will abort the
child sockets. For example, TCP holds the listening socket's PCB read
locked across the sonewconn() call, which blocks tcp_usr_close().

Eliminating _NOFREE has several benefits: it enables use-after-free
detection (e.g., by KASAN) and lets the system reclaim memory from the
socket zone under memory pressure.

No functional change intended.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 41535
Build 38424: arc lint + arc unit