svn commit: r190299 - stable/7/sys/kern

[Robert Watson]

On Sun, 22 Mar 2009, Mike Silbersack wrote:

>  Fix unp_gc so that it recognizes file descriptors
>  that are currently in the process of being passed
>  between processes as alive and does not
>  try to garbage collect them.
>
>  The full description of the problem and a test
>  program to reproduce it can be found in PR 112554.
>
>  This fix was inspired by similar fixes in NetBSD and BSD/OS.
>  However, it does not apply to FreeBSD 8 and above -
>  when this code was rewritten and optimized, the bug
>  was fixed in a different way.  The test program in the
>  PR passes on 8-current with flying colors.

We have a UNIX domain socket-passing regression test that creates various 
contortion-esque situations and then looks to see if sockets were leaked.  If 
it doesn't yet capture this failure mode, could you add it to that test?

Robert N M Watson
Computer Laboratory
University of Cambridge

>
>  PR:		112554
>  Submitted by:	Spencer Minear
>  Reviewed by:	Mike Silbersack
>  Obtained from:	Secure Computing Corp
>  MFC after:	4 weeks
>
> Modified:
>  stable/7/sys/kern/uipc_usrreq.c
>
> Modified: stable/7/sys/kern/uipc_usrreq.c
> ==============================================================================
> --- stable/7/sys/kern/uipc_usrreq.c	Sun Mar 22 22:57:53 2009	(r190298)
> +++ stable/7/sys/kern/uipc_usrreq.c	Sun Mar 22 23:00:00 2009	(r190299)
> @@ -1878,6 +1878,7 @@ unp_gc(__unused void *arg, int pending)
> {
> 	struct file *fp, *nextfp;
> 	struct socket *so;
> +	struct socket *soa;
> 	struct file **extra_ref, **fpp;
> 	int nunref, i;
> 	int nfiles_snap;
> @@ -1984,6 +1985,20 @@ unp_gc(__unused void *arg, int pending)
> 			SOCKBUF_UNLOCK(&so->so_rcv);
>
> 			/*
> +			 * If socket is in listening state, then sockets
> +			 * in its accept queue are accessible, and so
> +			 * are any descriptors in those sockets' receive
> +			 * queues.
> +			 */
> +			ACCEPT_LOCK();
> +			TAILQ_FOREACH(soa, &so->so_comp, so_list) {
> +			    SOCKBUF_LOCK(&soa->so_rcv);
> +			    unp_scan(soa->so_rcv.sb_mb, unp_mark);
> +			    SOCKBUF_UNLOCK(&soa->so_rcv);
> +			}
> +			ACCEPT_UNLOCK();
> +
> +			/*
> 			 * Wake up any threads waiting in fdrop().
> 			 */
> 			FILE_LOCK(fp);
>