[src/trunk]: src/sys/kern PR kern/55251 (use of ZFS may trigger kernel memory...

[ad <ad%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/b7846c8752df
branches:  trunk
changeset: 932623:b7846c8752df
user:      ad <ad%NetBSD.org@localhost>
date:      Tue May 12 21:56:17 2020 +0000

description:
PR kern/55251 (use of ZFS may trigger kernel memory corruption (KASAN error))

Previous wasn't quite right.  Redo it differently - disable preemption
earlier instead.

diffstat:

 sys/kern/kern_mutex.c |  15 ++++++---------
 1 files changed, 6 insertions(+), 9 deletions(-)

diffs (58 lines):

diff -r a5d09ae20652 -r b7846c8752df sys/kern/kern_mutex.c
--- a/sys/kern/kern_mutex.c     Tue May 12 21:24:29 2020 +0000
+++ b/sys/kern/kern_mutex.c     Tue May 12 21:56:17 2020 +0000
@@ -1,7 +1,7 @@
-/*     $NetBSD: kern_mutex.c,v 1.91 2020/05/12 21:24:29 ad Exp $       */
+/*     $NetBSD: kern_mutex.c,v 1.92 2020/05/12 21:56:17 ad Exp $       */
 
 /*-
- * Copyright (c) 2002, 2006, 2007, 2008, 2019, 2020 The NetBSD Foundation, Inc.
+ * Copyright (c) 2002, 2006, 2007, 2008, 2019 The NetBSD Foundation, Inc.
  * All rights reserved.
  *
  * This code is derived from software contributed to The NetBSD Foundation
@@ -40,7 +40,7 @@
 #define        __MUTEX_PRIVATE
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_mutex.c,v 1.91 2020/05/12 21:24:29 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_mutex.c,v 1.92 2020/05/12 21:56:17 ad Exp $");
 
 #include <sys/param.h>
 #include <sys/atomic.h>
@@ -456,11 +456,13 @@
        /*
         * Handle spin mutexes.
         */
+       KPREEMPT_DISABLE(curlwp);
        owner = mtx->mtx_owner;
        if (MUTEX_SPIN_P(owner)) {
 #if defined(LOCKDEBUG) && defined(MULTIPROCESSOR)
                u_int spins = 0;
 #endif
+               KPREEMPT_ENABLE(curlwp);
                MUTEX_SPIN_SPLRAISE(mtx);
                MUTEX_WANTLOCK(mtx);
 #ifdef FULL
@@ -521,7 +523,6 @@
         * determine that the owner is not running on a processor,
         * then we stop spinning, and sleep instead.
         */
-       KPREEMPT_DISABLE(curlwp);
        for (;;) {
                if (!MUTEX_OWNED(owner)) {
                        /*
@@ -545,12 +546,8 @@
                /*
                 * Check to see if the owner is running on a processor.
                 * If so, then we should just spin, as the owner will
-                * likely release the lock very soon.  Unfortunately
-                * mtx_owner needs to be reloaded here with preemption
-                * now disabled, otherwise the LWP could already have
-                * been freed & destructed (see lwp_dtor()).
+                * likely release the lock very soon.
                 */
-               owner = mtx->mtx_owner;
                if (mutex_oncpu(owner)) {
                        LOCKSTAT_START_TIMER(lsflag, spintime);
                        count = SPINLOCK_BACKOFF_MIN;