Page MenuHomeFreeBSD

socket: Remove NOFREE from the socket zone
ClosedPublic

Authored by markj on Sep 15 2021, 7:58 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Sep 28, 3:33 PM
Unknown Object (File)
Fri, Sep 27, 5:15 PM
Unknown Object (File)
Fri, Sep 27, 4:24 PM
Unknown Object (File)
Wed, Sep 25, 2:34 PM
Unknown Object (File)
Tue, Sep 24, 2:56 AM
Unknown Object (File)
Thu, Sep 5, 5:12 AM
Unknown Object (File)
Mon, Sep 2, 6:48 AM
Unknown Object (File)
Sun, Sep 1, 8:30 PM
Subscribers

Details

Summary

This flag was added during the transition away from the legacy zone
allocator, commit c897b81311792ccf6a93feff2a405e2ae53f664e. The old
zone allocator effectively provided _NOFREE semantics, but I believe
they are not required for sockets. In particular, we use reference
counting to keep sockets live.

The one case which is kind of weird is sonewconn(), which returns a
pointer to a socket with reference count 0. This socket is still
effectively owned by the listening socket. Protocols must therefore be
careful to synchronize sonewconn() calls with their pru_close
implementations, since for listening sockets soclose() will abort the
child sockets. For example, TCP holds the listening socket's PCB read
locked across the sonewconn() call, which blocks tcp_usr_close().

Eliminating _NOFREE has several benefits: it enables use-after-free
detection (e.g., by KASAN) and lets the system reclaim memory from the
socket zone under memory pressure.

No functional change intended.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 41535
Build 38424: arc lint + arc unit