git: 7060da62ff18 - main - jail: Remove a prison's shared memory when it dies

The branch main has been updated by jamie:

URL: https://cgit.FreeBSD.org/src/commit/?id=7060da62ff18e8e52c5e41f0794cc4f10dadfc6e

commit 7060da62ff18e8e52c5e41f0794cc4f10dadfc6e
Author:     Jamie Gritton <jamie@FreeBSD.org>
AuthorDate: 2022-06-29 17:47:39 +0000
Commit:     Jamie Gritton <jamie@FreeBSD.org>
CommitDate: 2022-06-29 17:47:39 +0000

    jail: Remove a prison's shared memory when it dies
    
    Add shm_remove_prison(), that removes all POSIX shared memory segments
    belonging to a prison.  Call it from prison_cleanup() so a prison
    won't be stuck in a dying state due to the resources still held.
    
    PR:             257555
    Reported by:    grembo
---
 sys/kern/kern_jail.c |  2 ++
 sys/kern/uipc_shm.c  | 37 ++++++++++++++++++++++++++++++++-----
 sys/sys/mman.h       |  3 +++
 3 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index 7ef0afabe49d..965f3379adce 100644
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/jail.h>
 #include <sys/linker.h>
 #include <sys/lock.h>
+#include <sys/mman.h>
 #include <sys/mutex.h>
 #include <sys/racct.h>
 #include <sys/rctl.h>
@@ -3241,6 +3242,7 @@ prison_cleanup(struct prison *pr)
 {
 	sx_assert(&allprison_lock, SA_XLOCKED);
 	mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
+	shm_remove_prison(pr);
 	(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
 }
 
diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c
index 9f556efde3f1..1ca088edfd78 100644
--- a/sys/kern/uipc_shm.c
+++ b/sys/kern/uipc_shm.c
@@ -125,6 +125,7 @@ static void	shm_init(void *arg);
 static void	shm_insert(char *path, Fnv32_t fnv, struct shmfd *shmfd);
 static struct shmfd *shm_lookup(char *path, Fnv32_t fnv);
 static int	shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred);
+static void	shm_doremove(struct shm_mapping *map);
 static int	shm_dotruncate_cookie(struct shmfd *shmfd, off_t length,
     void *rl_cookie);
 static int	shm_dotruncate_locked(struct shmfd *shmfd, off_t length,
@@ -982,6 +983,26 @@ shm_init(void *arg)
 }
 SYSINIT(shm_init, SI_SUB_SYSV_SHM, SI_ORDER_ANY, shm_init, NULL);
 
+/*
+ * Remove all shared memory objects that belong to a prison.
+ */
+void
+shm_remove_prison(struct prison *pr)
+{
+	struct shm_mapping *shmm, *tshmm;
+	u_long i;
+
+	sx_xlock(&shm_dict_lock);
+	for (i = 0; i < shm_hash + 1; i++) {
+		LIST_FOREACH_SAFE(shmm, &shm_dictionary[i], sm_link, tshmm) {
+			if (shmm->sm_shmfd->shm_object->cred &&
+			    shmm->sm_shmfd->shm_object->cred->cr_prison == pr)
+				shm_doremove(shmm);
+		}
+	}
+	sx_xunlock(&shm_dict_lock);
+}
+
 /*
  * Dictionary management.  We maintain an in-kernel dictionary to map
  * paths to shmfd objects.  We use the FNV hash on the path to store
@@ -1034,11 +1055,7 @@ shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred)
 			    FREAD | FWRITE);
 			if (error)
 				return (error);
-			map->sm_shmfd->shm_path = NULL;
-			LIST_REMOVE(map, sm_link);
-			shm_drop(map->sm_shmfd);
-			free(map->sm_path, M_SHMFD);
-			free(map, M_SHMFD);
+			shm_doremove(map);
 			return (0);
 		}
 	}
@@ -1046,6 +1063,16 @@ shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred)
 	return (ENOENT);
 }
 
+static void
+shm_doremove(struct shm_mapping *map)
+{
+	map->sm_shmfd->shm_path = NULL;
+	LIST_REMOVE(map, sm_link);
+	shm_drop(map->sm_shmfd);
+	free(map->sm_path, M_SHMFD);
+	free(map, M_SHMFD);
+}
+
 int
 kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode,
     int shmflags, struct filecaps *fcaps, const char *name __unused)
diff --git a/sys/sys/mman.h b/sys/sys/mman.h
index a07b3550d51a..71172bfd49a3 100644
--- a/sys/sys/mman.h
+++ b/sys/sys/mman.h
@@ -300,6 +300,8 @@ struct shmfd {
 #endif
 
 #ifdef _KERNEL
+struct prison;
+
 int	shm_map(struct file *fp, size_t size, off_t offset, void **memp);
 int	shm_unmap(struct file *fp, void *mem, size_t size);
 
@@ -309,6 +311,7 @@ struct shmfd *shm_hold(struct shmfd *shmfd);
 void	shm_drop(struct shmfd *shmfd);
 int	shm_dotruncate(struct shmfd *shmfd, off_t length);
 bool	shm_largepage(struct shmfd *shmfd);
+void	shm_remove_prison(struct prison *pr);
 
 extern struct fileops shm_ops;