git: 1df3097d5525 - main - unix/stream: fix wakeup race between pr_poll and pr_soreceive

The branch main has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=1df3097d5525509020fa0ced391377554aad2918

commit 1df3097d5525509020fa0ced391377554aad2918
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2025-05-07 15:32:26 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2025-05-07 15:36:04 +0000

    unix/stream: fix wakeup race between pr_poll and pr_soreceive
    
    Both selrecord(9) and UXST_PEER_SEL marking should happen under the
    receive buffer lock.  Otherwise, there is a race window, when a reading
    thread would issue wakeup(9) before a polling thread have entered
    sleep(9).
    
    Reported by:    cy
    Fixes:          d15792780760ef94647af9b377b5f0a80e1826bc
---
 sys/kern/uipc_usrreq.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index 1722a43a800e..0836652b6a24 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
@@ -1681,11 +1681,12 @@ uipc_sopoll_stream_or_seqpacket(struct socket *so, int events,
 					    (POLLOUT | POLLWRNORM);
 				if (sb->sb_state & SBS_CANTRCVMORE)
 					revents |= POLLHUP;
-				if (!(revents & (POLLOUT | POLLWRNORM)))
+				if (!(revents & (POLLOUT | POLLWRNORM))) {
 					so2->so_rcv.uxst_flags |= UXST_PEER_SEL;
+					selrecord(td, &so->so_wrsel);
+				}
 				SOCK_RECVBUF_UNLOCK(so2);
-			}
-			if (!(revents & (POLLOUT | POLLWRNORM)))
+			} else
 				selrecord(td, &so->so_wrsel);
 		}
 	}