pass(4): Don't drop the periph lock before selrecord() in passpoll()
passpoll() checked the done queue while holding the peripheral lock,
dropped the lock, and only then called selrecord(). A CCB completing
in the window between the unlock and the selrecord() call sent its
selwakeuppri() before the polling thread was on the selinfo list, so
the wakeup was lost and select(2) or poll(2) slept until another
completion arrived or the timeout expired.
Call selrecord() before dropping the lock. This lock order is
already established: passdone() calls selwakeuppri(), which takes
the selinfo lock, while holding the peripheral lock.
kqueue is not affected, since the knlist is backed by the peripheral
mutex.
Reported by: llm-postcr
Fixes: a9934668aa13
MFC after: 1 week
[2 lines not shown]
pass(4): Wake select/kqueue waiters when an immediate CCB completes
In the CAMIOQUEUE ioctl, a queued CCB completes through passdone(),
which moves it to the done queue and calls selwakeuppri() and
KNOTE_LOCKED() so that a consumer blocked in select(2), poll(2) or
kevent(2) wakes up and collects the CCB with CAMIOGET. An immediate
CCB (e.g. XPT_DEV_ADVINFO or XPT_DEV_MATCH) is instead executed
synchronously in the ioctl and moved to the done queue directly,
with no notification, so a consumer sleeping while waiting for its
completion never wakes up until some other queued I/O completes.
Send the same notification that passdone() sends. The peripheral
lock is held at this point and backs the knlist, so KNOTE_LOCKED()
is the correct variant.
A version of this fix has been in production use at Spectra Logic
since 2024.
Co-authored-by: Dave Baukus <daveb at spectralogic.com>
[5 lines not shown]
uipc_syscalls.c: add kern_ and user_ implementations
Rename accept1 and sendit to user_accept and user_sendit.
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Pull Request: https://github.com/freebsd/freebsd-src/pull/2284
acpi_cpu: Bring back setting BM_RLD on resume
enable_idle(), which was called on resume before 427747fc16c9
("acpi_cpu: No longer disable idle during suspend"), also set BM_RLD.
This commit brings back just setting BM_RLD on resume because some
firmware might not be doing this itself on some machines.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D61431
acpi_cpu: No longer disable idle during suspend
This had been introduced in 3331373ce733 ("Disable CPU idle states
during suspend and reenable them during resume.") to work around C-state
selection logic which would skip C-states which returned immediately,
considering them "broken".
This workaround is incompatible with suspend-to-idle however, which
requires CPUs to be in their idle states, and is no longer relevant
either way since b0baaaaecf1a ("Avoid comparing negative signed to
positive unsignad values.") removed the C-state skipping logic the
previous change was working around.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/71
Differential Revision: https://reviews.freebsd.org/D60649
libfetch: Prepare for OpenSSL 4
* Always use libmd's MD5 since it's deprecated in OpenSSL.
* Use ASN1_STRING_get_length() instead of ASN1_STRING_length().
modstat: avoid copying from freed memory
If a module is unloaded after the module is looked up in kern_modstat,
but before one of the copyout's occurs, then the memory being copied
might be freed and reused leading to an information disclosure.
The LLM was particularly concerned about a TOCTOU issue in the length
of the name, but it seems likely that there are issues with all the
copyout's. As such, hold the shared lock throughout.
Reviewed by: markj
Reported by: llm-postcr
MFC after: 3 days
Sponsored by: Innovate UK
Fixes: 9b3851e9e3b1 ("- Lock down the ``module'' structure...")
Differential Revision: https://reviews.freebsd.org/D61398
openssl: Update .pc files for correct version.
Correct the pkgconf files to reflect the in-tree version.
Direct commit to stable/14 as main has long since moved past
openssl-3.0.
netipsec: Release the sahtree lock on the AH and IPComp EAGAIN paths
183513d15f22 made the AH, ESP and IPComp input callbacks hold the
sahtree read lock, but only esp_input_cb() drops it before resubmitting
a request that the crypto framework completed with EAGAIN.
ah_input_cb() and ipcomp_input_cb() return with the lock still held.
crypto_invoke() completes requests with EAGAIN while their driver
detaches. Detaching ossl(4) under inbound AH traffic then hangs the
next rmlock writer, and the system panics with "spin lock held too
long" in smp_rendezvous_cpus() called from _rm_wlock().
Release the lock as esp_input_cb() does.
Reported by: llm-postcr
Reviewed by: kib
Fixes: 183513d15f22 ("sys/netipsec: ensure sah stability during input callback processing")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D61399
ppp: bound IPCP IP-Address replies to the reply buffers
`ipcp_ValidateReq()` appended `IP-Address ack/nak/reject` records to the fixed `fsm_decode` buffers without a bound check. A `Config-Request` with ~17 or more `IP-Address` options overran a buffer into its own end pointer, so later writes could go wherever the peer chose.
Emit the option through `fsm_ack()/fsm_nak()/fsm_rej()` like the other options.
Reviewed by: markj
Approved by: adrian (mentor)
Signed-off-by: Nick Price <nprice at FreeBSD.org>
Differential Revision: https://reviews.freebsd.org/D61326
mlx5: add per-flow-group hash table for FTE lookup
lookup_fte_locked() scanned every FTE in a flow group with xa_next()
and memcmp() on each one. A new RX TLS session always misses, so the
whole group was walked under the group lock for every insertion. With
tens of thousands of RX-offloaded sessions in the same IPv6 TCP group
this costs milliseconds per call and grows linearly with the number of
FTEs.
Keep a hash table of the FTEs in each flow group, keyed by a jhash of
the match value. The table is sized from the group size, capped at
16K buckets. It is updated in insert_fte() and del_sw_fte(), both of
which hold the group write lock, and read in lookup_fte_locked() under
the group read or write lock. The xarray is kept for index
allocation. No lockless reads are introduced.
Reported by: NetApp
Reviewed by: kib
Sponsored by: NVidia networking
MFC after: 1 week
zvol: leave alone a minor that is being removed
zvol_os_remove_minor() clears zv_zso and drops zv_state_lock while it
tears down the OS side of a ZVOL_REMOVING zvol. zvol_set_ro() and
zvol_set_volthreading() can find the zvol by name in that window and
zvol_set_ro() dereferences the NULL zv_zso. zvol_set_volsize() drops
all its locks before it updates the OS side, so the removal can start
under it.
Since d73686867 the thread that changes volmode waits for the minor to
be replaced, but another process setting readonly or volsize on the
same volume still hits the window: the kernel oopses in
zvol_os_set_disk_ro() or zvol_os_update_volsize(), the ioctl thread
dies with the zvol's lock held and every later minor operation hangs
in the zvol taskq.
Skip a ZVOL_REMOVING zvol when setting readonly, volthreading or
volsize, as zvol_suspend() does; the property is still stored, as when
there is no minor. Hold a suspend reference across the OS side of the
[12 lines not shown]
ZTS: race volume property changes with volmode changes
Setting readonly or volsize on a volume whose minor another process is
removing, for a volmode change, dereferences the minor's OS state after
it has been cleared. Run volmode, readonly, volthreading and volsize
changes on the same volume at the same time, and check that they all
finish and the volume still works afterwards, with the properties set.
A loop still running two minutes after it should have stopped is stuck
in the kernel: fail with the stuck zfs processes' stacks rather than
wait for the test timeout.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Will Rouesnel <wrouesnel at wrouesnel.com>
Closes #19319
libzfs_input_check: Fix integer to pointer casts
The zc_nvlist_foo fields are uint64_t and must be first cast to a
pointer-sized integer (uintptr_t) before being cast to a pointer to
avoid build-breakage for some targets (e.g. FreeBSD i386 w/GCC).
Fixes: 59dc88602
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Garth Snyder <garth at garthsnyder.com>
Reviewed-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Signed-off-by: Ryan Moeller <rmoeller at FreeBSD.org>
Closes #19793
libspl/kmem: Make prototypes safe for C++
restrict is a C99 keyword and is not available in C++, so including
this header from C++ fails to compile. FreeBSD's zfsd is one such
user, through sys/vdev_impl.h.
Use __restrict, which gcc and clang accept in both languages.
Fixes: 8b5d919d4 ("libspl: move kmem definitions from zfs_context.h")
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Garth Snyder <garth at garthsnyder.com>
Reviewed-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Signed-off-by: Ryan Moeller <rmoeller at FreeBSD.org>
Closes #19793
Fix uint64_t format strings on 32-bit targets
These print 64-bit values with %lu, %ld or %lx, which only matches
where long is 64 bits, and breaks builds with -Werror.
Use %llu and %lld with (u_longlong_t) and (longlong_t) casts, as is
done elsewhere.
Fixes: 13ec35ce3 ("Linux/vnops: implement STATX_DIOALIGN")
Fixes: d1b0a6982 ("draid: add failure domains support")
Fixes: 816804dfd ("Add support for anyraid vdevs")
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Garth Snyder <garth at garthsnyder.com>
Reviewed-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Signed-off-by: Ryan Moeller <rmoeller at FreeBSD.org>
Closes #19793
zstream: Use libspl atomics for memory accounting
These were the only bare __atomic calls in zstream, and Clang rejects
the 64-bit ones on i386 with -Watomic-alignment. The rest of zstream
already uses libspl.
Fixes: c878ee452 ("zstream: track and limit memory use")
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Garth Snyder <garth at garthsnyder.com>
Reviewed-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Signed-off-by: Ryan Moeller <rmoeller at FreeBSD.org>
Closes #19793
libspl/atomic: Add sequentially consistent ops
The libspl load and store are relaxed. Add the sequentially consistent
variants that zstream needs, so that it does not have to use bare
__atomic calls or add full barriers around relaxed operations.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Garth Snyder <garth at garthsnyder.com>
Reviewed-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Signed-off-by: Ryan Moeller <rmoeller at FreeBSD.org>
Closes #19793
libspl/atomic: Silence Clang -Watomic-alignment
Since the implementation moved into the header as inlines, the 64-bit
operations are compiled in every file that includes it, not just in
libspl where NO_ATOMIC_ALIGNMENT is applied. On 32-bit targets Clang
warns because the operations become library calls, as uint64_t may be
under-aligned (i386) or too wide to be lock-free (powerpc). This is
fatal with -Werror.
Those library calls are expected, so ignore the warning for the
inlines only.
Fixes: 32ba39f47
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Garth Snyder <garth at garthsnyder.com>
Reviewed-by: Tigerblue77 <37409593+tigerblue77 at users.noreply.github.com>
Signed-off-by: Ryan Moeller <rmoeller at FreeBSD.org>
Closes #19793
freebsd/kstat: clean up properly when kstat_create fails
On error, kstat_create() would free the sysctl context and the kstat
itself, but missed the lock and most importantly, any memory allocated
for ks_data. Sending those error cases through to kstat_delete() handles
all the cleanup necessary.
Sponsored-by: TrueNAS
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Matthew Ahrens <matt at mahrens.org>
Signed-off-by: Rob Norris <rob.norris at truenas.com>
Closes #19789
kstat: don't set ks_data for KSTAT_TYPE RAW
It's used for internal kstat stuff, nothing to do with us.
Sponsored-by: TrueNAS
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Matthew Ahrens <matt at mahrens.org>
Signed-off-by: Rob Norris <rob.norris at truenas.com>
Closes #19789
