From nobody Fri Nov 14 00:46:15 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4d6z3D0SlDz6GXch; Fri, 14 Nov 2025 00:46:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4d6z3C6syJz3dmK; Fri, 14 Nov 2025 00:46:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1763081176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EjdMCp63JYCQerSGAH2OaLfdCz1rgvi0PiXgKGV6yjI=; b=vW2dD6FilJwH05xkr7WYpRVVd7UUbccS4ZLhJUS+HQyTUPelcZScxQ5lCMc3R3WVKDYqiE izcZZb2L61y48tyxFV833300iPdMvFy6Lf1s633RbJrOXQ/KZJkc8tWiSW85tpCJbx7Tla 1nqXxOQj0vspgixYr0WgNkBOp7kFZAujuah7R6mcpvrTGQyiMM3KlurCb/pLvrdTSSxo1i EpU2iy00hYkpHeP01YKax0C33ndo/W1DeW53cVTXX95Ti/FEVRmGGu/1VhrBSP15b5JIxC UUm+YSZSEYWuv+ZS6n/nFrgteY/J5Ssm82GgotNZmuLK+iTJhSCgvQ7KFR7qKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1763081176; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=EjdMCp63JYCQerSGAH2OaLfdCz1rgvi0PiXgKGV6yjI=; b=cIAt2qNF8tZ32pXKWVMPk6IosuaNt72jqzE7JMrH03/LNa3dbyzwfOsv1R8WZG/Yh+aRHB TYemxzGR4mOqThiiSSFQ8kxoAHaFSFqe1/Ma+U8qEdiBFsJjbx4hvSiEWrOXZoa9OoH6+v vAhOq3o/uerWp4iHHAueLEY1khl/OsUok+QCbWKPG4itoSxnY2CXIWrGHagawCIWAyX/f2 7TnKJNPiKdMa4OLEaa1xz6b080i0Wr2iwiZXuXIO2uNF9BnicQNgnmLYwmmVIb+I3oxnxq jWCPg4tk7cG305B9H7Fje+wY0RSuYc1RweKhMtJHLLkppBbOaa84UKkHqA5RfA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1763081176; a=rsa-sha256; cv=none; b=yccz/D0vXwyOenVdsXl1mPcjxEpz3Qc9xJ9H9XNngPTBe6c9+ozNo/+g0WbAxCT0Tp9/sQ hUJcv97vw7lg++qV1e6bI1JEs5duJ+Ij3yyTVWwRPrKPQZgsvwiakGSlFA16k3xJMcvCB5 fYTt/qBryF+03f7izYpKxfpEf5vaMVZ5AJNvC2VZplINlw+RGw0p9xNvYfzjcs9s9u8Uil 5+L6GsYbaAA6l4/DwzqjCbhhb8iadI1nfy8YE8A2xqdCyO1h7LLkpZE2o7UkwyEc1NF9pY B9ZnGxtR91jgmTFz0UUTGNTjybb4etP8elLrrMTWqUQJbVNRLWqRB4T7//dKNQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4d6z3C6T0lzl0D; Fri, 14 Nov 2025 00:46:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5AE0kFlX092914; Fri, 14 Nov 2025 00:46:15 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5AE0kFJ3092911; Fri, 14 Nov 2025 00:46:15 GMT (envelope-from git) Date: Fri, 14 Nov 2025 00:46:15 GMT Message-Id: <202511140046.5AE0kFJ3092911@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 9d9fa9a2c22f - main - unix: Fix handling of listening sockets during garbage collection List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9d9fa9a2c22f67d5f8afec18106c9f0072d6b3d4 Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9d9fa9a2c22f67d5f8afec18106c9f0072d6b3d4 commit 9d9fa9a2c22f67d5f8afec18106c9f0072d6b3d4 Author: Mark Johnston AuthorDate: 2025-11-13 22:56:15 +0000 Commit: Mark Johnston CommitDate: 2025-11-14 00:43:38 +0000 unix: Fix handling of listening sockets during garbage collection socantrcvmore() and unp_dispose() assume that the socket's socket buffers are initialized, which isn't the case for listening sockets. Reported by: syzbot+a62883292a5c257703be@syzkaller.appspotmail.com MFC after: 1 week Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D53743 --- sys/kern/uipc_usrreq.c | 10 ++++++---- tests/sys/kern/unix_passfd_test.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 807271488af2..8c9fa4c012e4 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -4208,10 +4208,12 @@ unp_gc(__unused void *arg, int pending) struct socket *so; so = unref[i]->f_data; - CURVNET_SET(so->so_vnet); - socantrcvmore(so); - unp_dispose(so); - CURVNET_RESTORE(); + if (!SOLISTENING(so)) { + CURVNET_SET(so->so_vnet); + socantrcvmore(so); + unp_dispose(so); + CURVNET_RESTORE(); + } } /* diff --git a/tests/sys/kern/unix_passfd_test.c b/tests/sys/kern/unix_passfd_test.c index 7dc4541ad402..66bb406ea14e 100644 --- a/tests/sys/kern/unix_passfd_test.c +++ b/tests/sys/kern/unix_passfd_test.c @@ -1189,6 +1189,34 @@ ATF_TC_CLEANUP(cross_jail_dirfd, tc) err(1, "jail_remove"); } +ATF_TC_WITHOUT_HEAD(listening_socket); +ATF_TC_BODY(listening_socket, tc) +{ + struct sockaddr_un sun; + int error, ls, s[2]; + + ls = socket(AF_UNIX, SOCK_STREAM, 0); + ATF_REQUIRE(ls != -1); + + memset(&sun, 0, sizeof(sun)); + sun.sun_len = sizeof(sun); + sun.sun_family = AF_UNIX; + snprintf(sun.sun_path, sizeof(sun.sun_path), "listen.sock"); + error = bind(ls, (struct sockaddr *)&sun, sizeof(sun)); + ATF_REQUIRE_MSG(error == 0, "bind failed: %s", strerror(errno)); + error = listen(ls, 0); + + error = socketpair(AF_UNIX, SOCK_STREAM, 0, s); + ATF_REQUIRE_MSG(error == 0, "socketpair failed: %s", strerror(errno)); + + sendfd(s[0], ls); + sendfd(s[0], s[0]); + sendfd(s[0], s[1]); + close(ls); + close(s[0]); + close(s[1]); +} + ATF_TP_ADD_TCS(tp) { @@ -1211,6 +1239,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, empty_rights_message); ATF_TP_ADD_TC(tp, control_creates_records); ATF_TP_ADD_TC(tp, cross_jail_dirfd); + ATF_TP_ADD_TC(tp, listening_socket); return (atf_no_error()); }