From nobody Thu Apr 20 16:13:54 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Q2N4y4qPtz46Fjy; Thu, 20 Apr 2023 16:13:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Q2N4y2m7tz3Lfw; Thu, 20 Apr 2023 16:13:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682007234; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E4S2iHAnO6GAALcxsS3M/+hzR4sGUgQ6EYrmOoh96og=; b=MDJvwdHLdZipNNkGW3yIoFV5FCIRc5uPXp/y94Umx5yHkkbD8jTzB2TjGjiYAl2408ENzu 3zqfrsnhX1qRgpqFST57on2gZq/c9tjDr8y1HjZuXI4hpOZccyy4ZQ7kFS3JPLIMzJWlSP 4rVAujcHMYjV8e/99yAsnvkv8JbzWKJNSi4HK6D7FAfq3HFF1Q9H8kWRnkaQeG08i7FTqW YOfba52Q+xZGNq191WGJJUxM6tZ4GmnFNO29Nwt3pkr7m1UiZAZSdNztVzkViFLJ6Kif3v HD3+cy0AZTMAFelLiMMMV5Z5/tTb6OqjXWko2EwNmP0IPnht///xvZkmMzDzeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682007234; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=E4S2iHAnO6GAALcxsS3M/+hzR4sGUgQ6EYrmOoh96og=; b=CQq2fUHsG0PfGfnJ+jzJVZh3V8p/XVhXkCxMSGG9jrKEUKUAayQx1KZblNnuowIjrZD0uw IMdimLivW4ok+1JZTSe1AjCM8AyoJ8MS6vpB9qGx3dltXcjsmV3BKCLbJZzXYsn1RNBmZG JrT/ag3LCrOY8+y9y/xqupJTwwf4qhSUK8KGkcrAJiTdx3mwB/pFknK8PU4JLc0zmxmvC+ S0Y8aPGeefNuSbIw2lTipy4qnoj5slwMjPEaOzdhuivOPmmgYcXrU9fiy9MoU71VFRIo7u mACGeg4CET8GM6QRtdAmrF46snwpWSKNQ2DtpRvkVcpP+wsSCaoNGHAYG1pXCw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1682007234; a=rsa-sha256; cv=none; b=yQYyOLKyDI5XB0um2fCoL27W3rXqhfhjvuU2sHKaQfpmNeh7jiw/zTJgJZBf5+cxPY7F7h amf+hVdiL49yKhbrQmeIB93bzzrUI+ivdE3ke4h4t7v2Pkczi6/zJWoqQjKNus50XtmYQ4 VcEsIKFwQxJWRkfMZfNt9Db2K8lBdjkK3qdaFwy1N+2tUAvMM35bPCIcdG1CJb6rNMan+T g/SFsfoXbR/WwiEDh1MH6FoXr6zpZ/7VjVQUsDPj2aTv0juozSjNXlTpWs2vvCzwU/olTx AA72QjhRm3MGd1nTaYqKU04XunCRUBGWPBgXNV7cFiWcAO1e/HG8kGF01+C/rA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Q2N4y1GLhzkmR; Thu, 20 Apr 2023 16:13:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 33KGDs5t045459; Thu, 20 Apr 2023 16:13:54 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 33KGDsuT045458; Thu, 20 Apr 2023 16:13:54 GMT (envelope-from git) Date: Thu, 20 Apr 2023 16:13:54 GMT Message-Id: <202304201613.33KGDsuT045458@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 5fd1a67e885e - main - inpcb: Release the inpcb cred reference before freeing the structure List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5fd1a67e885e834cda8f1d122e9b0f9d47977e54 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5fd1a67e885e834cda8f1d122e9b0f9d47977e54 commit 5fd1a67e885e834cda8f1d122e9b0f9d47977e54 Author: Mark Johnston AuthorDate: 2023-04-20 15:48:33 +0000 Commit: Mark Johnston CommitDate: 2023-04-20 16:13:06 +0000 inpcb: Release the inpcb cred reference before freeing the structure Now that the inp_cred pointer is accessed only while the inpcb lock is held, we can avoid deferring a crfree() call when freeing an inpcb. This fixes a problem introduced when inpcb hash tables started being synchronized with SMR: the credential reference previously could not be released until all lockless readers have drained, and there is no mechanism to explicitly purge cached, freed UMA items. Thus, ucred references could linger indefinitely, and since ucreds hold a jail reference, the jail would linger indefinitely as well. This manifests as jails getting stuck in the DYING state. Discussed with: glebius Tested by: glebius Sponsored by: Klara, Inc. Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D38573 --- sys/netinet/in_pcb.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c index ea36d684a82b..4c1ba835a066 100644 --- a/sys/netinet/in_pcb.c +++ b/sys/netinet/in_pcb.c @@ -548,7 +548,6 @@ in_pcbinfo_destroy(struct inpcbinfo *pcbinfo) /* * Initialize a pcbstorage - per protocol zones to allocate inpcbs. */ -static void inpcb_dtor(void *, int, void *); static void inpcb_fini(void *, int); void in_pcbstorage_init(void *arg) @@ -556,7 +555,7 @@ in_pcbstorage_init(void *arg) struct inpcbstorage *pcbstor = arg; pcbstor->ips_zone = uma_zcreate(pcbstor->ips_zone_name, - pcbstor->ips_size, NULL, inpcb_dtor, pcbstor->ips_pcbinit, + pcbstor->ips_size, NULL, NULL, pcbstor->ips_pcbinit, inpcb_fini, UMA_ALIGN_CACHE, UMA_ZONE_SMR); pcbstor->ips_portzone = uma_zcreate(pcbstor->ips_portzone_name, sizeof(struct inpcbport), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0); @@ -1694,6 +1693,10 @@ in_pcbrele_rlocked(struct inpcb *inp) MPASS(inp->inp_flags & INP_FREED); MPASS(inp->inp_socket == NULL); MPASS(inp->inp_in_hpts == 0); + crfree(inp->inp_cred); +#ifdef INVARIANTS + inp->inp_cred = NULL; +#endif INP_RUNLOCK(inp); uma_zfree_smr(inp->inp_pcbinfo->ipi_zone, inp); return (true); @@ -1711,6 +1714,10 @@ in_pcbrele_wlocked(struct inpcb *inp) MPASS(inp->inp_flags & INP_FREED); MPASS(inp->inp_socket == NULL); MPASS(inp->inp_in_hpts == 0); + crfree(inp->inp_cred); +#ifdef INVARIANTS + inp->inp_cred = NULL; +#endif INP_WUNLOCK(inp); uma_zfree_smr(inp->inp_pcbinfo->ipi_zone, inp); return (true); @@ -1788,18 +1795,6 @@ in_pcbfree(struct inpcb *inp) #endif #ifdef INET inp_freemoptions(imo); -#endif - /* Destruction is finalized in inpcb_dtor(). */ -} - -static void -inpcb_dtor(void *mem, int size, void *arg) -{ - struct inpcb *inp = mem; - - crfree(inp->inp_cred); -#ifdef INVARIANTS - inp->inp_cred = NULL; #endif }