[src/netbsd-9]: src/sys/kern Pull up following revision(s) (requested by maya...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ba3db8fdea04
branches:  netbsd-9
changeset: 963864:ba3db8fdea04
user:      martin <martin%NetBSD.org@localhost>
date:      Tue May 05 20:12:37 2020 +0000

description:
Pull up following revision(s) (requested by maya in ticket #888):

        sys/kern/uipc_sem.c: revision 1.59

Release the collision if we find one.

Candidate fix for:
panic: lock error: Mutex: mutex_vector_enter,542: locking against myself: lock 0xffff8f611abd37e0 cpu 8 lwp 0xffff8f60a3c6a040
cpu8: Begin traceback...
vpanic() at netbsd:vpanic+0x178
snprintf() at netbsd:snprintf
lockdebug_abort() at netbsd:lockdebug_abort+0xe6
mutex_vector_enter() at netbsd:mutex_vector_enter+0x3c1
ksem_close_fop() at netbsd:ksem_close_fop+0x17
closef() at netbsd:closef+0x69
fd_free() at netbsd:fd_free+0x101
exit1() at netbsd:exit1+0x118
sys_exit() at netbsd:sys_exit+0x3d
syscall() at netbsd:syscall+0x299

Would be nice to have an automatic test for this.  Since semids are
only 24 bits, we only need to create a few thousand of them to have a
high probability of collision.  Maybe we should bump default semmax
while here...

diffstat:

 sys/kern/uipc_sem.c |  9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diffs (47 lines):

diff -r eabe9e937bfd -r ba3db8fdea04 sys/kern/uipc_sem.c
--- a/sys/kern/uipc_sem.c       Tue May 05 18:34:48 2020 +0000
+++ b/sys/kern/uipc_sem.c       Tue May 05 20:12:37 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_sem.c,v 1.55.4.1 2019/12/18 20:20:17 martin Exp $ */
+/*     $NetBSD: uipc_sem.c,v 1.55.4.2 2020/05/05 20:12:37 martin Exp $ */
 
 /*-
  * Copyright (c) 2011, 2019 The NetBSD Foundation, Inc.
@@ -60,7 +60,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.55.4.1 2019/12/18 20:20:17 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.55.4.2 2020/05/05 20:12:37 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -110,6 +110,7 @@
 static int             ksem_sysinit(void);
 static int             ksem_sysfini(bool);
 static int             ksem_modcmd(modcmd_t, void *);
+static void            ksem_release(ksem_t *, int);
 static int             ksem_close_fop(file_t *);
 static int             ksem_stat_fop(file_t *, struct stat *);
 static int             ksem_read_fop(file_t *, off_t *, struct uio *,
@@ -366,6 +367,7 @@
 static void
 ksem_alloc_pshared_id(ksem_t *ksem)
 {
+       ksem_t *ksem0;
        uint32_t try;
 
        KASSERT(ksem->ks_pshared_proc != NULL);
@@ -375,10 +377,11 @@
                try = (cprng_fast32() & ~KSEM_MARKER_MASK) |
                    KSEM_PSHARED_MARKER;
 
-               if (ksem_lookup_pshared_locked(try) == NULL) {
+               if ((ksem0 = ksem_lookup_pshared_locked(try)) == NULL) {
                        /* Got it! */
                        break;
                }
+               ksem_release(ksem0, -1);
        }
        ksem->ks_pshared_id = try;
        u_long bucket = KSEM_PSHARED_HASH(ksem->ks_pshared_id);