From ae11a989e6e04fa591e81e754223f52a0661ebe9 Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Sun, 27 Apr 2008 15:50:00 +0000 Subject: When writing trailers in sendfile(2), don't call kern_writev() while holding the socket buffer lock. These leads to an immediate panic due to recursing the socket buffer lock. This bug was introduced in uipc_syscalls.c:1.240, but masked by another bug until that was fixed in uipc_syscalls.c:1.269. Note that the current fix isn't perfect, but better than panicking: normally we guarantee that simultaneous invocations of a system call to write on a stream socket won't be interlaced, which is ensured by use of the socket buffer sleep lock. This is guaranteed for the sendfile headers, but not trailers. In practice, this is likely not a problem, but should be fixed. MFC after: 3 days Pointy hat to: andre (1.240), cperciva (1.269) --- sys/kern/uipc_syscalls.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'sys') diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index ab5cb5f8f506..0599b229d236 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -2207,10 +2207,11 @@ retry_space: * Send trailers. Wimp out and use writev(2). */ if (trl_uio != NULL) { + sbunlock(&so->so_snd); error = kern_writev(td, uap->s, trl_uio); - if (error) - goto done; - sbytes += td->td_retval[0]; + if (error == 0) + sbytes += td->td_retval[0]; + goto out; } done: -- cgit v1.3