Re: Samba 4.3 and 4.4 crashes on FreeBSD 11-ALPHA4

From: Konstantin Belousov <kostikbel_at_gmail.com>
Date: Sat, 25 Jun 2016 12:20:40 +0300
On Sat, Jun 25, 2016 at 11:49:39AM +0300, Konstantin Belousov wrote:
> On Sat, Jun 25, 2016 at 01:03:13AM +0300, Guy Yur wrote:
> > libtdb.so.1`tdb_runtime_check_for_robust_mutexes + 1475 at mutex.c:957
> > ...
> 
> The pointer to tdb_runtime_check_for_robust_mutexes() appeared to be
> most useful, thanks.
> 
> The two patches below should fix samba use of robustness. First,
> kernel erronously reset robust lists locations on fork. Second, the
> pthread_mutex_trylock() for owned errorcheck mutex must return EDEADLK
> and not EBUSY.  Try that.

Correction, there was a reason why I initially put the rb list pointers
into zeroed region.  It still needs to be zeroed on new thread creation.
Updated patch.

diff --git a/lib/libthr/thread/thr_mutex.c b/lib/libthr/thread/thr_mutex.c
index 5a99605..da71c70 100644
--- a/lib/libthr/thread/thr_mutex.c
+++ b/lib/libthr/thread/thr_mutex.c
_at__at_ -850,9 +871,12 _at__at_ mutex_self_trylock(struct pthread_mutex *m)
 
 	switch (PMUTEX_TYPE(m->m_flags)) {
 	case PTHREAD_MUTEX_ERRORCHECK:
-	case PTHREAD_MUTEX_NORMAL:
 	case PTHREAD_MUTEX_ADAPTIVE_NP:
-		ret = EBUSY; 
+		ret = EDEADLK;
+		break;
+
+	case PTHREAD_MUTEX_NORMAL:
+		ret = EBUSY;
 		break;
 
 	case PTHREAD_MUTEX_RECURSIVE:
diff --git a/sys/kern/kern_thr.c b/sys/kern/kern_thr.c
index 10ccdab..293574c 100644
--- a/sys/kern/kern_thr.c
+++ b/sys/kern/kern_thr.c
_at__at_ -234,6 +234,7 _at__at_ thread_create(struct thread *td, struct rtprio *rtp,
 	bcopy(&td->td_startcopy, &newtd->td_startcopy,
 	    __rangeof(struct thread, td_startcopy, td_endcopy));
 	newtd->td_proc = td->td_proc;
+	newtd->td_rb_list = newtd->td_rbp_list = newtd->td_rb_inact = 0;
 	thread_cow_get(newtd, td);
 
 	error = initialize_thread(newtd, thunk);
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 6d03062..6162a16 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
_at__at_ -282,9 +282,6 _at__at_ struct thread {
 	int		td_no_sleeping;	/* (k) Sleeping disabled count. */
 	int		td_dom_rr_idx;	/* (k) RR Numa domain selection. */
 	void		*td_su;		/* (k) FFS SU private */
-	uintptr_t	td_rb_list;	/* (k) Robust list head. */
-	uintptr_t	td_rbp_list;	/* (k) Robust priv list head. */
-	uintptr_t	td_rb_inact;	/* (k) Current in-action mutex loc. */
 #define	td_endzero td_sigmask
 
 /* Copied during fork1() or create_thread(). */
_at__at_ -298,6 +295,9 _at__at_ struct thread {
 	u_char		td_base_user_pri; /* (t) Base user pri */
 	u_int		td_dbg_sc_code;	/* (c) Syscall code to debugger. */
 	u_int		td_dbg_sc_narg;	/* (c) Syscall arg count to debugger.*/
+	uintptr_t	td_rb_list;	/* (k) Robust list head. */
+	uintptr_t	td_rbp_list;	/* (k) Robust priv list head. */
+	uintptr_t	td_rb_inact;	/* (k) Current in-action mutex loc. */
 #define	td_endcopy td_pcb
 
 /*
Received on Sat Jun 25 2016 - 07:20:47 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:06 UTC