Module Name: src
Committed By: riastradh
Date: Thu Aug 11 12:52:24 UTC 2022
Modified Files:
src/sys/miscfs/specfs: spec_vnops.c
Log Message:
specfs: Sprinkle opencnt/opened/closing assertions.
There seems to be a bug here but I'm not sure what it is yet:
https://mail-index.netbsd.org/current-users/2022/08/09/msg042800.html
https://syzkaller.appspot.com/bug?id=47c67ab6d3a87514d0707882a9ad6671beaa8642
The decision to actually invoke d_close is serialized under
device_lock, so it should not be possible for more than one process
to close at the same time, but syzbot and kre found a way for
sd_closing to be false later in spec_close. Let's make sure it's
false when we're making what should be the exclusive decision to
close.
We can't assert !sd_opened before cancel and spec_io_drain, because
those are necessary to interrupt and wait for pending opens that
might later set sd_opened, but we can assert !sd_opened afterward
because once sd_closing is true nothing should set sd_opened.
To generate a diff of this commit:
cvs rdiff -u -r1.210 -r1.211 src/sys/miscfs/specfs/spec_vnops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/miscfs/specfs/spec_vnops.c
diff -u src/sys/miscfs/specfs/spec_vnops.c:1.210 src/sys/miscfs/specfs/spec_vnops.c:1.211
--- src/sys/miscfs/specfs/spec_vnops.c:1.210 Mon Mar 28 12:39:10 2022
+++ src/sys/miscfs/specfs/spec_vnops.c Thu Aug 11 12:52:24 2022
@@ -1,4 +1,4 @@
-/* $NetBSD: spec_vnops.c,v 1.210 2022/03/28 12:39:10 riastradh Exp $ */
+/* $NetBSD: spec_vnops.c,v 1.211 2022/08/11 12:52:24 riastradh Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -58,7 +58,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.210 2022/03/28 12:39:10 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.211 2022/08/11 12:52:24 riastradh Exp $");
#include <sys/param.h>
#include <sys/proc.h>
@@ -603,7 +603,9 @@ spec_node_revoke(vnode_t *vp)
KASSERT(sn->sn_gone == false);
mutex_enter(&device_lock);
- KASSERT(sn->sn_opencnt <= sd->sd_opencnt);
+ KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+ "sn_opencnt=%u > sd_opencnt=%u",
+ sn->sn_opencnt, sd->sd_opencnt);
sn->sn_gone = true;
if (sn->sn_opencnt != 0) {
sd->sd_opencnt -= (sn->sn_opencnt - 1);
@@ -775,6 +777,9 @@ spec_open(void *v)
break;
sd->sd_opencnt++;
sn->sn_opencnt++;
+ KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+ "sn_opencnt=%u > sd_opencnt=%u",
+ sn->sn_opencnt, sd->sd_opencnt);
break;
case VBLK:
/*
@@ -789,7 +794,8 @@ spec_open(void *v)
error = EBUSY;
break;
}
- KASSERTMSG(sn->sn_opencnt == 0, "%u", sn->sn_opencnt);
+ KASSERTMSG(sn->sn_opencnt == 0, "sn_opencnt=%u",
+ sn->sn_opencnt);
sn->sn_opencnt = 1;
sd->sd_opencnt = 1;
sd->sd_bdevvp = vp;
@@ -963,6 +969,9 @@ spec_open(void *v)
} else {
KASSERT(sd->sd_opencnt);
KASSERT(sn->sn_opencnt);
+ KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+ "sn_opencnt=%u > sd_opencnt=%u",
+ sn->sn_opencnt, sd->sd_opencnt);
sd->sd_opencnt--;
sn->sn_opencnt--;
if (vp->v_type == VBLK)
@@ -1664,6 +1673,9 @@ spec_close(void *v)
mutex_enter(&device_lock);
KASSERT(sn->sn_opencnt);
KASSERT(sd->sd_opencnt);
+ KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+ "sn_opencnt=%u > sd_opencnt=%u",
+ sn->sn_opencnt, sd->sd_opencnt);
sn->sn_opencnt--;
count = --sd->sd_opencnt;
if (vp->v_type == VBLK) {
@@ -1672,6 +1684,9 @@ spec_close(void *v)
sd->sd_bdevvp = NULL;
}
if (count == 0) {
+ KASSERTMSG(sn->sn_opencnt == 0, "sn_opencnt=%u",
+ sn->sn_opencnt);
+ KASSERT(!sd->sd_closing);
sd->sd_opened = false;
sd->sd_closing = true;
}
@@ -1722,6 +1737,7 @@ spec_close(void *v)
* reacquiring the lock would deadlock.
*/
mutex_enter(&device_lock);
+ KASSERT(!sd->sd_opened);
KASSERT(sd->sd_closing);
sd->sd_closing = false;
cv_broadcast(&specfs_iocv);
