d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e2e1693f15
freebsd-dev/sys
History
Konstantin Belousov e2e1693f15 Destruction of the pipe calls knlist_cleardel() to remove the knotes 
monitoring the pipe. The code sets pipe_present = 0 and enters
knlist_cleardel(), where the PIPE_MTX might be dropped when knl->kl_list
cannot be cleared due to influx knotes.

If the following often encountered code fragment
                if (!(kn->kn_status & KN_DETACHED))
                        kn->kn_fop->f_detach(kn);
                knote_drop(kn, td); [1]
is executed while the knlist lock is dropped, then the knote memory is freed
by the knote_drop() without knote being removed from the knlist, since
the filt_pipedetach() contains the following:
        if (kn->kn_filter == EVFILT_WRITE) {
                if (!cpipe->pipe_peer->pipe_present) {
                        PIPE_UNLOCK(cpipe);
                        return;

Now, the memory may be reused in the zone, causing the access to the
freed memory. I got the panics caused by the marker knote appearing on
the knlist, that, I believe, manifestation of the issue. In the Peter
Holm test scenarious, we got unkillable processes too.

The pipe_peer that has the knote for write shall be present. Ignore the
pipe_present value for EVFILT_WRITE in filt_pipedetach().

Debugging help and tested by:	pho
Discussed with:	jmg
MFC after:	2 weeks
2008-05-23 11:09:50 +00:00
..
amd64 The VM system no longer uses setPQL2(). Remove it and its helpers. 2008-05-23 04:03:54 +00:00
arm The VM system no longer uses setPQL2(). Remove it and its helpers. 2008-05-23 04:03:54 +00:00
boot Add an entry for the age(4) module. 2008-05-19 02:13:50 +00:00
bsm Merge OpenBSM 1.0 changes to src/sys/bsm: 2007-10-29 18:47:25 +00:00
cam Locking in the ses_ioctl handler doesn't have to be so strict because 2008-03-17 17:18:16 +00:00
cddl Custom DTrace kernel module files plus FreeBSD-specific DTrace providers. 2008-05-23 05:59:42 +00:00
compat Fix a panic when it occurred during initializing the ndis driver because 2008-05-15 04:29:28 +00:00
conf Add support for generating CTF data for the kernel. 2008-05-23 03:53:49 +00:00
contrib Add code to allow the system to handle multiple routing tables. 2008-05-09 23:03:00 +00:00
crypto Make test00 compilable again. 2008-01-15 18:34:47 +00:00
ddb Rename debug.ddb.capture.bytes sysctl to debug.ddb.capture.bufoff in 2008-04-25 13:23:36 +00:00
dev Add codec id for Sigmatel STAC9872AK 2008-05-22 09:14:12 +00:00
fs Implement the per-open file data for the cdev. 2008-05-21 09:31:44 +00:00
gdb Commit SYSINIT() ;-adding patch missed in previous pass. 2008-03-16 13:02:04 +00:00
geom - Recognize the 'volume' parameter when creating a plex. 2008-05-22 10:27:03 +00:00
gnu Move the head of byte-level advisory lock list from the 2008-04-16 11:33:32 +00:00
i4b Spelling fix for interupt -> interrupt 2007-10-12 06:03:46 +00:00
i386 The VM system no longer uses setPQL2(). Remove it and its helpers. 2008-05-23 04:03:54 +00:00
ia64 The VM system no longer uses setPQL2(). Remove it and its helpers. 2008-05-23 04:03:54 +00:00
isa atrtc.c is a repocopy of the RTC device driver from i386/isa/clock.c 2008-04-14 07:57:15 +00:00
kern Destruction of the pipe calls knlist_cleardel() to remove the knotes 2008-05-23 11:09:50 +00:00
libkern Add prototype for __cmpd2(). 2008-02-23 22:40:05 +00:00
mips Retire pmap_addr_hint(). It is no longer used. 2008-05-18 04:16:57 +00:00
modules clear out crud 2008-05-22 21:53:15 +00:00
net The if_check() function performed three actions: 2008-05-17 03:38:13 +00:00
net80211 special-case broadcast probe request in ieee80211_find_rxnode; we need 2008-05-22 22:22:10 +00:00
netatalk Add code to allow the system to handle multiple routing tables. 2008-05-09 23:03:00 +00:00
netatm Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT. 2008-03-25 09:39:02 +00:00
netgraph Add code to allow the system to handle multiple routing tables. 2008-05-09 23:03:00 +00:00
netinet Consistently check IPFW and DUMMYNET privileges in the configuration 2008-05-22 08:10:31 +00:00
netinet6 - Adds support for the multi-asconf (From Kozuka-san) 2008-05-20 13:47:46 +00:00
netipsec Remove last bits of OS adaptation code from the IPSec code. 2008-05-17 04:00:11 +00:00
netipx Add code to allow the system to handle multiple routing tables. 2008-05-09 23:03:00 +00:00
netnatm
netncp lockmgrs need to be released before to be destroyed and draining doesn't 2008-03-30 18:16:33 +00:00
netsmb Really, smb_iod_main() is not totally MPSAFE, so just acquire and drop 2008-03-27 01:23:59 +00:00
nfs Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT. 2008-03-25 09:39:02 +00:00
nfs4client Add code to allow the system to handle multiple routing tables. 2008-05-09 23:03:00 +00:00
nfsclient Allow the block size used when booting over NFS to be overridden. It defaults 2008-05-16 06:27:03 +00:00
nfsserver Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT. 2008-03-25 09:39:02 +00:00
nlm Tighten up the error-handling in nlm_get_rpc. While I'm here, fix a 2008-04-16 09:09:50 +00:00
opencrypto Make ftruncate a 'struct file' operation rather than a vnode operation. 2008-01-07 20:05:19 +00:00
pc98 Resort the if_ti driver to match the PCI Network cards instead of placing 2008-05-17 23:50:00 +00:00
pccard
pci - Set sc->dev to the new-bus device_t so all the device_printf()s work. 2008-05-12 21:34:52 +00:00
powerpc The VM system no longer uses setPQL2(). Remove it and its helpers. 2008-05-23 04:03:54 +00:00
rpc Fix some issues that showed up during Kris' testing. 2008-04-11 10:34:59 +00:00
security Don't use LK_DRAIN before calling VOP_FSYNC() in the two further 2008-05-21 13:59:05 +00:00
sparc64 The VM system no longer uses setPQL2(). Remove it and its helpers. 2008-05-23 04:03:54 +00:00
sun4v Use the "options " spelling (vs. "options<TAB>") so that commented lines 2008-05-21 03:36:53 +00:00
sys Allow a rendezvous with just a specified CPU too. 2008-05-23 04:05:26 +00:00
tools Introduce a standalone shell script for embedding MFS image. 2008-02-05 10:46:30 +00:00
ufs Allow VM object creation in ufs_lookup. (If vfs.vmiodirenable is set) 2008-05-20 19:05:43 +00:00
vm Allow VM object creation in ufs_lookup. (If vfs.vmiodirenable is set) 2008-05-20 19:05:43 +00:00
xdr Add the new kernel-mode NFS Lock Manager. To use it instead of the 2008-03-26 15:23:12 +00:00
Makefile + Use the default cscope names. 2008-05-21 07:56:10 +00:00