Re: git: dfad790c8cca - main - sendfile: stop abusing kern_writev()

On Wed, Jul 08, 2026 at 10:23:06PM +0300, Konstantin Belousov wrote:
> On Wed, Jul 08, 2026 at 02:59:47PM -0400, Mark Johnston wrote:
> > On Tue, Jul 07, 2026 at 09:47:35PM +0000, Konstantin Belousov wrote:
> > >  			if (error != 0)
> > >  				goto out;
> > > +			if (trl_uio->uio_rw != UIO_WRITE) {
> > 
> > cloneuio() does not set uio_rw.  sendfile() was relying on kern_writev()
> > to do that.  A GENERIC-KMSAN kernel panics when running the test suite:
> > 
> > panic: MSan: Uninitialized malloc memory from copyinuio+0x11d
> > cpuid = 5
> > time = 1783537112
> > KDB: stack backtrace:
> > db_trace_self_wrapper() at db_trace_self_wrapper+0xa7/frame 0xfffffe00764d7840
> > vpanic() at vpanic+0x538/frame 0xfffffe00764d79c0
> > panic() at panic+0x1dd/frame 0xfffffe00764d7ad0
> > __msan_warning() at __msan_warning+0x25d/frame 0xfffffe00764d7c20
> > sendfile() at sendfile+0xcb6/frame 0xfffffe00764d7d50
> > amd64_syscall() at amd64_syscall+0x837/frame 0xfffffe00764d7f30
> > fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00764d7f30
> > --- syscall (393, FreeBSD ELF64, sendfile), rip = 0x21aad2ea3b0a, rsp = 0x21aad1d706c8, rbp = 0x21aad1d70760 ---
> > KDB: enter: panic
> 
> The following should be enough, am I correct?

I am re-running the test suite to see.

I am also not sure about the offset.  dofilewrite() sets
auio->uio_offset = offset.  kern_filewrite() takes an offset parameter
and does nothing with it.

copyinuio() initializes it to -1, so KMSAN will not report a problem,
but it looks wrong to me.

> commit 4152c4b88947d087a8fcb48a67d4dfddcdd60b31
> Author: Konstantin Belousov <kib@FreeBSD.org>
> Date:   Wed Jul 8 22:21:00 2026 +0300
> 
>     sendfile(): for trailers uio, set uio_rw to UIO_WRITE instead of checking it
>     
>     Reported by:    markj
>     Fixes:  dfad790c8cca ("sendfile: stop abusing kern_writev()")
> 
> diff --git a/sys/kern/kern_sendfile.c b/sys/kern/kern_sendfile.c
> index 1a534210ca0c..fb6d2da201ef 100644
> --- a/sys/kern/kern_sendfile.c
> +++ b/sys/kern/kern_sendfile.c
> @@ -1256,10 +1256,7 @@ sendfile(struct thread *td, struct sendfile_args *uap, int compat)
>  			    &trl_uio);
>  			if (error != 0)
>  				goto out;
> -			if (trl_uio->uio_rw != UIO_WRITE) {
> -				error = EINVAL;
> -				goto out;
> -			}
> +			trl_uio->uio_rw = UIO_WRITE;
>  			trl_uio->uio_td = td;
>  		}
>  	}
>