From nobody Fri May 23 22:52:51 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4b40mh0l4Nz5whkp; Fri, 23 May 2025 22:52:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4b40mg6CXFz3tBs; Fri, 23 May 2025 22:52:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1748040771; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=o4fD5/iE5Op1CpTPwI989fOzIfw3QD+bHyAnDLGrCOc=; b=Gy4lajzQSUdTXPTS8VOD3v4Z35BKSfTzZ5vwo3Ulk+e+v5waXikPSTgxGTUUZ2gVVwG4lZ yunL5KFILi2qF0K6vD5dpA8kP2ecPgI1x0/5ndzpvYhtTtFHOXn6YdpJ87AJbyZH8ojcAQ YXygQWRWZ1uI8wys326Cxzw12DDttx+NQNT0MoiDezN36l2A48/oVfbsIAqcR85JbULwKB CG69Dyb1mSg3CbWrk4JpW8PZFT4jB/AbzXjaBZjF7L1H+6mfYo1S1pT0oki7I3hpOvtmuF oUXfflkx6MPhRs3LT/zQJafI4TaQwNVKRyjpUoosHpefRm66V5maOeQ6rN7whA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1748040771; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=o4fD5/iE5Op1CpTPwI989fOzIfw3QD+bHyAnDLGrCOc=; b=CToX19xRCRg78MLwb2eA6Xc8ajwToOYHzfxLWhkph0E3rcO5yLYSgEC4B82eRMzX6rjZWR 57mUztdJpQo9gQ1EqgCtnwYmNvD7Vb5UEMDO6lHvxNnRpozkBaTAvvblAEiJvx5rRRaao8 ZEWZhiIVWodMkE+AXvlomDh3PTZQnEMkDK3+3BOCPUquvE0l2WR9tupwvny9v6tGYurCTP yi6S6rraKqFEKY0MObkV1tlMTMntIWaMN7QWEgHeAexF3TGuNtQqWabgeU1L4GL2Vpgeu2 cMK7zoWfnM6dlOdZQz9Kkee0FUngxVOWCA2+A90eWMnFiOaZi+uiEZ6x6zLu+w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1748040771; a=rsa-sha256; cv=none; b=gHBb2N34emUoy9LzBQPQDzgge7Eb9wlJ3ctrHZ8E0cCG07Vt1LSjAqK/kGVWJNGxNp2aou UePQ7s5A7HYxiVmnwCqzONyF4CyVCmeitqvD+HxrZKqdPvenegvBCzAuorM/Z9suHztOMp Re8gj/g9ouJldaLAhFPDp+E8gwDFryJ4mWckcJraC00BbJSEd9KQU7PsE6dLsV92dkbC6n xqBtw68pVqUgyAX8jomk3G8i64iRBH0U+EudVLPLnE0Hkl30ZhvEQZKhjO54g5Qg8HQirW XLavGaoFXjYstS4PJWqVyeB1uL6NI3vL54UReNSEWZOUT5eBp3YXs/SvSHVuEQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4b40mg5pDxz1Ntb; Fri, 23 May 2025 22:52:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 54NMqpoC050692; Fri, 23 May 2025 22:52:51 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 54NMqp9f050688; Fri, 23 May 2025 22:52:51 GMT (envelope-from git) Date: Fri, 23 May 2025 22:52:51 GMT Message-Id: <202505232252.54NMqp9f050688@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: c44d6f43a68f - main - unix/stream: provide uipc_cantrcvmore() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c44d6f43a68f6bb39b92df85c5ba90a9b0feee15 Auto-Submitted: auto-generated The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=c44d6f43a68f6bb39b92df85c5ba90a9b0feee15 commit c44d6f43a68f6bb39b92df85c5ba90a9b0feee15 Author: Gleb Smirnoff AuthorDate: 2025-05-12 18:12:09 +0000 Commit: Gleb Smirnoff CommitDate: 2025-05-23 22:04:38 +0000 unix/stream: provide uipc_cantrcvmore() and use it the pr_shutdown method. While unix/dgram can still use generic socket socantrcvmore(), the stream versions need a specific one. This fixes a panic reported by syzkaller. While here inline unp_shutdown() into uipc_shutdown(). Reported-by: syzbot+86c18f0886f70a3509c6@syzkaller.appspotmail.com --- sys/kern/uipc_usrreq.c | 52 +++++++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index a855c47d2e5a..0f730cf9424b 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -299,7 +299,6 @@ static int unp_connectat(int, struct socket *, struct sockaddr *, static void unp_connect2(struct socket *, struct socket *, bool); static void unp_disconnect(struct unpcb *unp, struct unpcb *unp2); static void unp_dispose(struct socket *so); -static void unp_shutdown(struct unpcb *); static void unp_drop(struct unpcb *); static void unp_gc(__unused void *, int); static void unp_scan(struct mbuf *, void (*)(struct filedescent **, int)); @@ -1341,6 +1340,18 @@ uipc_wakeup(struct socket *so) SOCK_RECVBUF_UNLOCK(so); } +static void +uipc_cantrcvmore(struct socket *so) +{ + + SOCK_RECVBUF_LOCK(so); + so->so_rcv.sb_state |= SBS_CANTRCVMORE; + if (so->so_rcv.uxst_peer != NULL) + uipc_wakeup(so); + else + SOCK_RECVBUF_UNLOCK(so); +} + static int uipc_soreceive_stream_or_seqpacket(struct socket *so, struct sockaddr **psa, struct uio *uio, struct mbuf **mp0, struct mbuf **controlp, int *flagsp) @@ -2646,18 +2657,28 @@ uipc_shutdown(struct socket *so, enum shutdown_how how) switch (how) { case SHUT_RD: - socantrcvmore(so); + if (so->so_type == SOCK_DGRAM) + socantrcvmore(so); + else + uipc_cantrcvmore(so); unp_dispose(so); break; case SHUT_RDWR: - socantrcvmore(so); + if (so->so_type == SOCK_DGRAM) + socantrcvmore(so); + else + uipc_cantrcvmore(so); unp_dispose(so); /* FALLTHROUGH */ case SHUT_WR: - UNP_PCB_LOCK(unp); - socantsendmore(so); - unp_shutdown(unp); - UNP_PCB_UNLOCK(unp); + if (so->so_type == SOCK_DGRAM) { + socantsendmore(so); + } else { + UNP_PCB_LOCK(unp); + if (unp->unp_conn != NULL) + uipc_cantrcvmore(unp->unp_conn->unp_socket); + UNP_PCB_UNLOCK(unp); + } } wakeup(&so->so_timeo); @@ -3380,23 +3401,6 @@ SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist, (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb", "List of active local seqpacket sockets"); -static void -unp_shutdown(struct unpcb *unp) -{ - struct unpcb *unp2; - struct socket *so; - - UNP_PCB_LOCK_ASSERT(unp); - - unp2 = unp->unp_conn; - if ((unp->unp_socket->so_type == SOCK_STREAM || - (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) { - so = unp2->unp_socket; - if (so != NULL) - socantrcvmore(so); - } -} - static void unp_drop(struct unpcb *unp) {