[Bug 220888] [panic][patch] Race between ngs_rcvdata() and soclose()

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220888

            Bug ID: 220888
           Summary: [panic][patch] Race between ngs_rcvdata() and
                    soclose()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Keywords: patch
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: kxie at xiplink.com
          Keywords: patch

Created attachment 184554
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=184554&action=edit
prevent race in ng_socket

Recently we got some "Fatal trap 12" panics when the userland processes which
used ng_socket to communicate got killed. The panics happened in ng_queue and
the backtrace is

Tracing pid 12 tid 100009 td 0xfffffe0001514490
_mtx_lock_sleep() at _mtx_lock_sleep+0x70/frame 0xffffff800025a700
_mtx_lock_flags() at _mtx_lock_flags+0x4d/frame 0xffffff800025a710
ngs_rcvdata() at ngs_rcvdata+0xfa/frame 0xffffff800025a870
ng_apply_item() at ng_apply_item+0x1f2/frame 0xffffff800025a970
ngthread() at ngthread+0x1c6/frame 0xffffff800025a9a0
fork_exit() at fork_exit+0x114/frame 0xffffff800025a9f0
fork_trampoline() at fork_trampoline+0xe/frame 0xffffff800025a9f0

The reason is that soclose() closed the data socket while ngs_rcvdata() in
ng_socket.c was still using it.

ngs_rcvmsg() in the same file applies locking to prevent the race in r208300,
so we borrowed the idea to ngs_rcvdata() and got a patch attached here.

We tested the patched system and the described problem does not happen anymore.

-- 
You are receiving this mail because:
You are the assignee for the bug.