[src/trunk]: src/sys/miscfs/specfs specfs: Sprinkle opencnt/opened/closing as...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/040443244171
branches:  trunk
changeset: 368883:040443244171
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Thu Aug 11 12:52:24 2022 +0000

description:
specfs: Sprinkle opencnt/opened/closing assertions.

There seems to be a bug here but I'm not sure what it is yet:

https://mail-index.netbsd.org/current-users/2022/08/09/msg042800.html
https://syzkaller.appspot.com/bug?id=47c67ab6d3a87514d0707882a9ad6671beaa8642

The decision to actually invoke d_close is serialized under
device_lock, so it should not be possible for more than one process
to close at the same time, but syzbot and kre found a way for
sd_closing to be false later in spec_close.  Let's make sure it's
false when we're making what should be the exclusive decision to
close.

We can't assert !sd_opened before cancel and spec_io_drain, because
those are necessary to interrupt and wait for pending opens that
might later set sd_opened, but we can assert !sd_opened afterward
because once sd_closing is true nothing should set sd_opened.

diffstat:

 sys/miscfs/specfs/spec_vnops.c |  24 ++++++++++++++++++++----
 1 files changed, 20 insertions(+), 4 deletions(-)

diffs (87 lines):

diff -r 560eb62c2405 -r 040443244171 sys/miscfs/specfs/spec_vnops.c
--- a/sys/miscfs/specfs/spec_vnops.c    Thu Aug 11 10:17:44 2022 +0000
+++ b/sys/miscfs/specfs/spec_vnops.c    Thu Aug 11 12:52:24 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: spec_vnops.c,v 1.210 2022/03/28 12:39:10 riastradh Exp $       */
+/*     $NetBSD: spec_vnops.c,v 1.211 2022/08/11 12:52:24 riastradh Exp $       */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -58,7 +58,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.210 2022/03/28 12:39:10 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.211 2022/08/11 12:52:24 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/proc.h>
@@ -603,7 +603,9 @@
        KASSERT(sn->sn_gone == false);
 
        mutex_enter(&device_lock);
-       KASSERT(sn->sn_opencnt <= sd->sd_opencnt);
+       KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+           "sn_opencnt=%u > sd_opencnt=%u",
+           sn->sn_opencnt, sd->sd_opencnt);
        sn->sn_gone = true;
        if (sn->sn_opencnt != 0) {
                sd->sd_opencnt -= (sn->sn_opencnt - 1);
@@ -775,6 +777,9 @@
                        break;
                sd->sd_opencnt++;
                sn->sn_opencnt++;
+               KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+                   "sn_opencnt=%u > sd_opencnt=%u",
+                   sn->sn_opencnt, sd->sd_opencnt);
                break;
        case VBLK:
                /*
@@ -789,7 +794,8 @@
                        error = EBUSY;
                        break;
                }
-               KASSERTMSG(sn->sn_opencnt == 0, "%u", sn->sn_opencnt);
+               KASSERTMSG(sn->sn_opencnt == 0, "sn_opencnt=%u",
+                   sn->sn_opencnt);
                sn->sn_opencnt = 1;
                sd->sd_opencnt = 1;
                sd->sd_bdevvp = vp;
@@ -963,6 +969,9 @@
        } else {
                KASSERT(sd->sd_opencnt);
                KASSERT(sn->sn_opencnt);
+               KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+                   "sn_opencnt=%u > sd_opencnt=%u",
+                   sn->sn_opencnt, sd->sd_opencnt);
                sd->sd_opencnt--;
                sn->sn_opencnt--;
                if (vp->v_type == VBLK)
@@ -1664,6 +1673,9 @@
        mutex_enter(&device_lock);
        KASSERT(sn->sn_opencnt);
        KASSERT(sd->sd_opencnt);
+       KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt,
+           "sn_opencnt=%u > sd_opencnt=%u",
+           sn->sn_opencnt, sd->sd_opencnt);
        sn->sn_opencnt--;
        count = --sd->sd_opencnt;
        if (vp->v_type == VBLK) {
@@ -1672,6 +1684,9 @@
                sd->sd_bdevvp = NULL;
        }
        if (count == 0) {
+               KASSERTMSG(sn->sn_opencnt == 0, "sn_opencnt=%u",
+                   sn->sn_opencnt);
+               KASSERT(!sd->sd_closing);
                sd->sd_opened = false;
                sd->sd_closing = true;
        }
@@ -1722,6 +1737,7 @@
         * reacquiring the lock would deadlock.
         */
        mutex_enter(&device_lock);
+       KASSERT(!sd->sd_opened);
        KASSERT(sd->sd_closing);
        sd->sd_closing = false;
        cv_broadcast(&specfs_iocv);