The branch main has been updated by jamie:
URL:
https://cgit.FreeBSD.org/src/commit/?id=7060da62ff18e8e52c5e41f0794cc4f10dadfc6e
commit 7060da62ff18e8e52c5e41f0794cc4f10dadfc6e
Author: Jamie Gritton <ja...@freebsd.org>
AuthorDate: 2022-06-29 17:47:39 +0000
Commit: Jamie Gritton <ja...@freebsd.org>
CommitDate: 2022-06-29 17:47:39 +0000
jail: Remove a prison's shared memory when it dies
Add shm_remove_prison(), that removes all POSIX shared memory segments
belonging to a prison. Call it from prison_cleanup() so a prison
won't be stuck in a dying state due to the resources still held.
PR: 257555
Reported by: grembo
---
sys/kern/kern_jail.c | 2 ++
sys/kern/uipc_shm.c | 37 ++++++++++++++++++++++++++++++++-----
sys/sys/mman.h | 3 +++
3 files changed, 37 insertions(+), 5 deletions(-)
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index 7ef0afabe49d..965f3379adce 100644
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$");
#include <sys/jail.h>
#include <sys/linker.h>
#include <sys/lock.h>
+#include <sys/mman.h>
#include <sys/mutex.h>
#include <sys/racct.h>
#include <sys/rctl.h>
@@ -3241,6 +3242,7 @@ prison_cleanup(struct prison *pr)
{
sx_assert(&allprison_lock, SA_XLOCKED);
mtx_assert(&pr->pr_mtx, MA_NOTOWNED);
+ shm_remove_prison(pr);
(void)osd_jail_call(pr, PR_METHOD_REMOVE, NULL);
}
diff --git a/sys/kern/uipc_shm.c b/sys/kern/uipc_shm.c
index 9f556efde3f1..1ca088edfd78 100644
--- a/sys/kern/uipc_shm.c
+++ b/sys/kern/uipc_shm.c
@@ -125,6 +125,7 @@ static void shm_init(void *arg);
static void shm_insert(char *path, Fnv32_t fnv, struct shmfd *shmfd);
static struct shmfd *shm_lookup(char *path, Fnv32_t fnv);
static int shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred);
+static void shm_doremove(struct shm_mapping *map);
static int shm_dotruncate_cookie(struct shmfd *shmfd, off_t length,
void *rl_cookie);
static int shm_dotruncate_locked(struct shmfd *shmfd, off_t length,
@@ -982,6 +983,26 @@ shm_init(void *arg)
}
SYSINIT(shm_init, SI_SUB_SYSV_SHM, SI_ORDER_ANY, shm_init, NULL);
+/*
+ * Remove all shared memory objects that belong to a prison.
+ */
+void
+shm_remove_prison(struct prison *pr)
+{
+ struct shm_mapping *shmm, *tshmm;
+ u_long i;
+
+ sx_xlock(&shm_dict_lock);
+ for (i = 0; i < shm_hash + 1; i++) {
+ LIST_FOREACH_SAFE(shmm, &shm_dictionary[i], sm_link, tshmm) {
+ if (shmm->sm_shmfd->shm_object->cred &&
+ shmm->sm_shmfd->shm_object->cred->cr_prison == pr)
+ shm_doremove(shmm);
+ }
+ }
+ sx_xunlock(&shm_dict_lock);
+}
+
/*
* Dictionary management. We maintain an in-kernel dictionary to map
* paths to shmfd objects. We use the FNV hash on the path to store
@@ -1034,11 +1055,7 @@ shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred)
FREAD | FWRITE);
if (error)
return (error);
- map->sm_shmfd->shm_path = NULL;
- LIST_REMOVE(map, sm_link);
- shm_drop(map->sm_shmfd);
- free(map->sm_path, M_SHMFD);
- free(map, M_SHMFD);
+ shm_doremove(map);
return (0);
}
}
@@ -1046,6 +1063,16 @@ shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred)
return (ENOENT);
}
+static void
+shm_doremove(struct shm_mapping *map)
+{
+ map->sm_shmfd->shm_path = NULL;
+ LIST_REMOVE(map, sm_link);
+ shm_drop(map->sm_shmfd);
+ free(map->sm_path, M_SHMFD);
+ free(map, M_SHMFD);
+}
+
int
kern_shm_open2(struct thread *td, const char *userpath, int flags, mode_t mode,
int shmflags, struct filecaps *fcaps, const char *name __unused)
diff --git a/sys/sys/mman.h b/sys/sys/mman.h
index a07b3550d51a..71172bfd49a3 100644
--- a/sys/sys/mman.h
+++ b/sys/sys/mman.h
@@ -300,6 +300,8 @@ struct shmfd {
#endif
#ifdef _KERNEL
+struct prison;
+
int shm_map(struct file *fp, size_t size, off_t offset, void **memp);
int shm_unmap(struct file *fp, void *mem, size_t size);
@@ -309,6 +311,7 @@ struct shmfd *shm_hold(struct shmfd *shmfd);
void shm_drop(struct shmfd *shmfd);
int shm_dotruncate(struct shmfd *shmfd, off_t length);
bool shm_largepage(struct shmfd *shmfd);
+void shm_remove_prison(struct prison *pr);
extern struct fileops shm_ops;
