From nobody Sat Sep 11 18:40:56 2021 X-Original-To: hackers@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 7771B17AF178; Sat, 11 Sep 2021 18:41:03 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4H6M5C2hPSz3sNN; Sat, 11 Sep 2021 18:41:03 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: by mail-qk1-x733.google.com with SMTP id w78so5919726qkb.4; Sat, 11 Sep 2021 11:41:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=ypG1zs4vUIYr4Y3Alkyz8mJOsTvt+RddZ1CgA7C05TQ=; b=Be+5tOpwyq5vYm+tNehEcypQTJME2Uatp/z/u1FdIO0/Bs/zGeLu7pIn87+obtXMoH fT2IxrfbEkSeca5K0FoubbQxNHSDyqhK4apQZqZgbD81zVVxxLiyBAiqzwAR2uPwvueo V5YA2P1LqD1q/m4ARhVMeNvar1kSWjwVj8UFp0XM77aZeKUs0pUgsim9j9Gp3VVydvLn +flKbfH5ltbwsHb8fNayCR6/Yo9Ii5MDictnqFWqVGRSitIRn9y1wfJoCHklXJ9SudlA tUY0G5pJgHtAgLP4iNdNlDv/sXDISHOSZsYwF6BQUzHa974kFdj1xJZV0R8cMrR8Px2d sWvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition :content-transfer-encoding:in-reply-to; bh=ypG1zs4vUIYr4Y3Alkyz8mJOsTvt+RddZ1CgA7C05TQ=; b=ADJsBEM8AR7cEqQzDqVe/BZ+xErx1XDYMCoAF2pE4DoL3R+ZVnc/QbfPigPIgKWzLE 0IQt3WuNJVVfK73qRyMitVoeIkSgTDIJmy8Mf91G18vNTp5/1id7ykquXNAADtS1pl+I whS2MUsH7Pe3jZAiwn8D6zpWkfwjibXyjL1+uH7+oLzIwc+E2FdZQF2i7lACbnmUN5/l d/KIGHrFLzRIehyXBQGiK8FIqeyTtdroE+bclZWeI08+KdlLwpStGslUeyYSqg9oUhpa vz0jttCpn6CnoZVuTcjeY0hnu64p1mazD1ebyrv2TJbks2uxfOO+Udg+BJNk42VWz+PJ ZvLA== X-Gm-Message-State: AOAM532UhNvXIEzNc+kSQhd+vQ/69IwVEa0/H4O0TcX1flmSpQDzNegj k4Ep2Fe6Jg3w51HzPE328IFTs6fqOYmJAA== X-Google-Smtp-Source: ABdhPJwEvtvSvuICamwThXzXrjzlpNd9itjytQoyq53ZvT635/UiF8TWiWA0oCsdcaRJfW9CjkjG1w== X-Received: by 2002:a37:9481:: with SMTP id w123mr3106737qkd.75.1631385655674; Sat, 11 Sep 2021 11:40:55 -0700 (PDT) Received: from nuc ([142.126.175.196]) by smtp.gmail.com with ESMTPSA id v10sm1667799qkj.79.2021.09.11.11.40.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Sep 2021 11:40:55 -0700 (PDT) Date: Sat, 11 Sep 2021 14:40:56 -0400 From: Mark Johnston To: Andriy Gapon Cc: "net@FreeBSD.org" , hackers@freebsd.org Subject: Re: recvmsg() "short receive" after FIONREAD Message-ID: References: <500a2272-c1b3-3f97-0096-9fe8117c4b95@FreeBSD.org> <6f455869-cbdd-ee20-f2f8-f633e22071e9@FreeBSD.org> <4a2165c5-b97b-8fb7-9ada-0acae3197824@FreeBSD.org> <4499e2b0-d1e7-5bee-519c-783fb930fc06@FreeBSD.org> <82143b59-a0e6-c23e-8b47-29d8d41eb5b4@FreeBSD.org> List-Id: Technical discussions relating to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-hackers List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-hackers@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <82143b59-a0e6-c23e-8b47-29d8d41eb5b4@FreeBSD.org> X-Rspamd-Queue-Id: 4H6M5C2hPSz3sNN X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[] X-ThisMailContainsUnwantedMimeParts: N On Sat, Sep 11, 2021 at 09:25:42PM +0300, Andriy Gapon wrote: > On 11/09/2021 17:28, Andriy Gapon wrote: > > On 11/09/2021 17:16, Andriy Gapon wrote: > >> On 11/09/2021 17:13, Mark Johnston wrote: > >>> I think the semantic change is ok.  Did you change FIONREAD to lock the > >>> sockbuf?  I think it would be necessary to avoid races with pulseaudio: > >>> sb_acc is modified before sb_ctl, so there could be windows where > >>> sbavail(sb) - sb->sb_ctl gives a larger. > >>> > >>> And, it is not really safe to lock the sockbuf itself, since it may be > >>> overwritten by a listen(2) call.  SOCK_RECVBUF_LOCK(so) should be used > >>> instead. > >> > >> I didn't think about the locking, so I didn't add it. > >> My current patch is trivial: > >> @@ -210,7 +210,7 @@ soo_ioctl(struct file *fp, u_long cmd, void *data, struct > >> ucred *active_cred, > >>                  if (SOLISTENING(so)) { > >>                          error = EINVAL; > >>                  } else { > >> -                       *(int *)data = sbavail(&so->so_rcv); > >> +                       *(int *)data = sbavail(&so->so_rcv) - so->so_rcv.sb_ctl; > >>                  } > >>                  break; > >> > >> Let me try adding the lock. > > > > By the way, soo_stat() seems to be another good example to follow. > > So, this is what I've got: > diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c > index e53b0367960b..11ee03703407 100644 > --- a/sys/kern/sys_socket.c > +++ b/sys/kern/sys_socket.c > @@ -210,7 +210,12 @@ soo_ioctl(struct file *fp, u_long cmd, void *data, struct > ucred *active_cred, > if (SOLISTENING(so)) { > error = EINVAL; > } else { > - *(int *)data = sbavail(&so->so_rcv); > + struct sockbuf *sb; > + > + sb = &so->so_rcv; > + SOCKBUF_LOCK(sb); > + *(int *)data = sbavail(sb) - sb->sb_ctl; > + SOCKBUF_UNLOCK(sb); > } > break; It should use SOCK_RECVBUF_LOCK() (see https://cgit.freebsd.org/src/commit/?id=74a68313b503940158a2e8e8f02626d7cdbdaff9 ): sb = &so->so_rcv; SOCK_RECVBUF_LOCK(so); if (SOLISTENING(so)) error = EINVAL; else *(int *)data = sbavail(sb) - sb->sb_ctl; SOCK_RECVBUF_UNLOCK(so); Otherwise a concurrent listen(2) will clobber the pointer used by SOCKBUF_LOCK().