Merge branch 'freebsd/current/main' into hardened/current/master

lib/libc/stdlib/qsort.c

@@ -108,6 +108,8 @@ local_qsort(void *a, size_t n, size_t es, cmp_t *cmp, void *thunk)
 	int cmp_result;
 	int swap_cnt;
 
+	if (__predict_false(n == 0))
+		return;
 loop:
 	swap_cnt = 0;
 	if (n < 7) {

sys/dev/mana/gdma_main.c

@@ -1359,8 +1359,12 @@ mana_gd_read_cqe(struct gdma_queue *cq, struct gdma_comp *comp)
 
 	new_bits = (cq->head / num_cqe) & GDMA_CQE_OWNER_MASK;
 	/* Return -1 if overflow detected. */
-	if (owner_bits != new_bits)
+	if (owner_bits != new_bits) {
+		mana_warn(NULL,
+		    "overflow detected! owner_bits %u != new_bits %u\n",
+		    owner_bits, new_bits);
 		return -1;
+	}
 
 	comp->wq_num = cqe->cqe_info.wq_num;
 	comp->is_sq = cqe->cqe_info.is_sq;
@@ -1808,9 +1812,6 @@ mana_gd_attach(device_t dev)
 
 err_clean_up_gdma:
 	mana_hwc_destroy_channel(gc);
-	if (gc->cq_table)
-		free(gc->cq_table, M_DEVBUF);
-	gc->cq_table = NULL;
 err_remove_irq:
 	mana_gd_remove_irqs(dev);
 err_free_pci_res:
@@ -1836,8 +1837,6 @@ mana_gd_detach(device_t dev)
 	mana_remove(&gc->mana);
 
 	mana_hwc_destroy_channel(gc);
-	free(gc->cq_table, M_DEVBUF);
-	gc->cq_table = NULL;
 
 	mana_gd_remove_irqs(dev);
 

sys/dev/mana/hw_channel.c

@@ -383,9 +383,6 @@ mana_hwc_comp_event(void *ctx, struct gdma_queue *q_self)
 static void
 mana_hwc_destroy_cq(struct gdma_context *gc, struct hwc_cq *hwc_cq)
 {
-	if (!hwc_cq)
-		return;
-
 	if (hwc_cq->comp_buf)
 		free(hwc_cq->comp_buf, M_DEVBUF);
 
@@ -531,9 +528,6 @@ static void
 mana_hwc_destroy_wq(struct hw_channel_context *hwc,
     struct hwc_wq *hwc_wq)
 {
-	if (!hwc_wq)
-		return;
-
 	mana_hwc_dealloc_dma_buf(hwc, hwc_wq->msg_buf);
 
 	if (hwc_wq->gdma_wq)
@@ -575,16 +569,16 @@ mana_hwc_create_wq(struct hw_channel_context *hwc,
 	if (err)
 		goto out;
 
-	err = mana_hwc_alloc_dma_buf(hwc, q_depth, max_msg_size,
-	    &hwc_wq->msg_buf);
-	if (err)
-		goto out;
-
 	hwc_wq->hwc = hwc;
 	hwc_wq->gdma_wq = queue;
 	hwc_wq->queue_depth = q_depth;
 	hwc_wq->hwc_cq = hwc_cq;
 
+	err = mana_hwc_alloc_dma_buf(hwc, q_depth, max_msg_size,
+	    &hwc_wq->msg_buf);
+	if (err)
+		goto out;
+
 	*hwc_wq_ptr = hwc_wq;
 	return 0;
 out:
@@ -718,6 +712,7 @@ mana_hwc_establish_channel(struct gdma_context *gc, uint16_t *q_depth,
 	*max_req_msg_size = hwc->hwc_init_max_req_msg_size;
 	*max_resp_msg_size = hwc->hwc_init_max_resp_msg_size;
 
+	/* Both were set in mana_hwc_init_event_handler(). */
 	if (cq->id >= gc->max_num_cqs) {
 		mana_warn(NULL, "invalid cq id %u > %u\n",
 		    cq->id, gc->max_num_cqs);
@@ -738,9 +733,6 @@ static int
 mana_hwc_init_queues(struct hw_channel_context *hwc, uint16_t q_depth,
     uint32_t max_req_msg_size, uint32_t max_resp_msg_size)
 {
-	struct hwc_wq *hwc_rxq = NULL;
-	struct hwc_wq *hwc_txq = NULL;
-	struct hwc_cq *hwc_cq = NULL;
 	int err;
 
 	err = mana_hwc_init_inflight_msg(hwc, q_depth);
@@ -753,44 +745,32 @@ mana_hwc_init_queues(struct hw_channel_context *hwc, uint16_t q_depth,
 	err = mana_hwc_create_cq(hwc, q_depth * 2,
 	    mana_hwc_init_event_handler, hwc,
 	    mana_hwc_rx_event_handler, hwc,
-	    mana_hwc_tx_event_handler, hwc, &hwc_cq);
+	    mana_hwc_tx_event_handler, hwc, &hwc->cq);
 	if (err) {
 		device_printf(hwc->dev, "Failed to create HWC CQ: %d\n", err);
 		goto out;
 	}
-	hwc->cq = hwc_cq;
 
 	err = mana_hwc_create_wq(hwc, GDMA_RQ, q_depth, max_req_msg_size,
-	    hwc_cq, &hwc_rxq);
+	    hwc->cq, &hwc->rxq);
 	if (err) {
 		device_printf(hwc->dev, "Failed to create HWC RQ: %d\n", err);
 		goto out;
 	}
-	hwc->rxq = hwc_rxq;
 
 	err = mana_hwc_create_wq(hwc, GDMA_SQ, q_depth, max_resp_msg_size,
-	    hwc_cq, &hwc_txq);
+	    hwc->cq, &hwc->txq);
 	if (err) {
 		device_printf(hwc->dev, "Failed to create HWC SQ: %d\n", err);
 		goto out;
 	}
-	hwc->txq = hwc_txq;
 
 	hwc->num_inflight_msg = q_depth;
 	hwc->max_req_msg_size = max_req_msg_size;
 
 	return 0;
 out:
-	if (hwc_txq)
-		mana_hwc_destroy_wq(hwc, hwc_txq);
-
-	if (hwc_rxq)
-		mana_hwc_destroy_wq(hwc, hwc_rxq);
-
-	if (hwc_cq)
-		mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc_cq);
-
-	mana_gd_free_res_map(&hwc->inflight_msg_res);
+	/* mana_hwc_create_channel() will do the cleanup.*/
 	return err;
 }
 
@@ -819,6 +799,10 @@ mana_hwc_create_channel(struct gdma_context *gc)
 	gd->pdid = INVALID_PDID;
 	gd->doorbell = INVALID_DOORBELL;
 
+	/*
+	 * mana_hwc_init_queues() only creates the required data structures,
+	 * and doesn't touch the HWC device.
+	 */
 	err = mana_hwc_init_queues(hwc, HW_CHANNEL_VF_BOOTSTRAP_QUEUE_DEPTH,
 	    HW_CHANNEL_MAX_REQUEST_SIZE,
 	    HW_CHANNEL_MAX_RESPONSE_SIZE);
@@ -846,7 +830,7 @@ mana_hwc_create_channel(struct gdma_context *gc)
 
 	return 0;
 out:
-	free(hwc, M_DEVBUF);
+	mana_hwc_destroy_channel(gc);
 	return (err);
 }
 
@@ -854,35 +838,44 @@ void
 mana_hwc_destroy_channel(struct gdma_context *gc)
 {
 	struct hw_channel_context *hwc = gc->hwc.driver_data;
-	struct hwc_caller_ctx *ctx;
 
-	mana_smc_teardown_hwc(&gc->shm_channel, false);
+	if (!hwc)
+		return;
 
-	ctx = hwc->caller_ctx;
-	free(ctx, M_DEVBUF);
+	/*
+	 * gc->max_num_cqs is set in mana_hwc_init_event_handler(). If it's
+	 * non-zero, the HWC worked and we should tear down the HWC here.
+	 */
+	if (gc->max_num_cqs > 0) {
+		mana_smc_teardown_hwc(&gc->shm_channel, false);
+		gc->max_num_cqs = 0;
+	}
+
+	free(hwc->caller_ctx, M_DEVBUF);
 	hwc->caller_ctx = NULL;
 
-	mana_hwc_destroy_wq(hwc, hwc->txq);
-	hwc->txq = NULL;
+	if (hwc->txq)
+		mana_hwc_destroy_wq(hwc, hwc->txq);
 
-	mana_hwc_destroy_wq(hwc, hwc->rxq);
-	hwc->rxq = NULL;
+	if (hwc->rxq)
+		mana_hwc_destroy_wq(hwc, hwc->rxq);
 
-	mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);
-	hwc->cq = NULL;
+	if (hwc->cq)
+		mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);
 
 	mana_gd_free_res_map(&hwc->inflight_msg_res);
 
 	hwc->num_inflight_msg = 0;
 
-	if (hwc->gdma_dev->pdid != INVALID_PDID) {
-		hwc->gdma_dev->doorbell = INVALID_DOORBELL;
-		hwc->gdma_dev->pdid = INVALID_PDID;
-	}
+	hwc->gdma_dev->doorbell = INVALID_DOORBELL;
+	hwc->gdma_dev->pdid = INVALID_PDID;
 
 	free(hwc, M_DEVBUF);
 	gc->hwc.driver_data = NULL;
 	gc->hwc.gdma_context = NULL;
+
+	free(gc->cq_table, M_DEVBUF);
+	gc->cq_table = NULL;
 }
 
 int

sys/dev/mana/mana_en.c

@@ -1935,7 +1935,8 @@ mana_create_txq(struct mana_port_context *apc, struct ifnet *net)
 
 		if (cq->gdma_id >= gc->max_num_cqs) {
 			if_printf(net, "CQ id %u too large.\n", cq->gdma_id);
-			return EINVAL;
+			err = EINVAL;
+			goto out;
 		}
 
 		gc->cq_table[cq->gdma_id] = cq->gdma_cq;
@@ -2249,8 +2250,10 @@ mana_create_rxq(struct mana_port_context *apc, uint32_t rxq_idx,
 	if (err)
 		goto out;
 
-	if (cq->gdma_id >= gc->max_num_cqs)
+	if (cq->gdma_id >= gc->max_num_cqs) {
+		err = EINVAL;
 		goto out;
+	}
 
 	gc->cq_table[cq->gdma_id] = cq->gdma_cq;
 
@@ -2393,7 +2396,8 @@ mana_init_port(struct ifnet *ndev)
 	err = mana_query_vport_cfg(apc, port_idx, &max_txq, &max_rxq,
 	    &num_indirect_entries);
 	if (err) {
-		if_printf(ndev, "Failed to query info for vPort 0\n");
+		if_printf(ndev, "Failed to query info for vPort %d\n",
+		    port_idx);
 		goto reset_apc;
 	}
 

tools/test/stress2/misc/all.exclude

@@ -38,6 +38,7 @@ newfs4.sh		watchdog fired. newbuf						20190225
 nfs10.sh		Double fault							20151013
 nfs13.sh		mount_nfs hangs in mntref					20191007
 nfs16.sh		panic: Failed to register NFS lock locally - error=11		20160608
+nullfs28.sh		Hang in "mount drain" seen					20220111
 oom2.sh			Hang in pfault							20180324
 overcommit2.sh		CAM stuck in vmwait seen					20200112
 pageout.sh		panic: handle_written_filepage: not started			20190218
@@ -73,7 +74,11 @@ syzkaller43.sh		WiP								20210906
 syzkaller46.sh		WiP								20210925
 syzkaller47.sh		WiP								20210925
 truss3.sh		WiP								20200915
-unionfs7.sh		https://people.freebsd.org/~pho/stress/log/log0202.txt		20211215
+unionfs6.sh		https://people.freebsd.org/~pho/stress/log/log0231.txt		20220112
+unionfs7.sh		https://people.freebsd.org/~pho/stress/log/log0232.txt		20220113
+unionfs8.sh		panic: unionfs_noderem: vnode locked recursively		20220111
+unionfs9.sh		https://people.freebsd.org/~pho/stress/log/log0226.txt		20220111
+unionfs14.sh		WiP								20220111
 
 # Test not to run for other reasons:
 

tools/test/stress2/misc/nullfs28.sh

+#!/bin/sh
+
+#
+# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+#
+# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+
+# Scenario: mount -t nullfs /mnt /mnt
+
+# Seen:
+# [root@mercat1 /home/pho]# ps -lUroot | grep -v grep | grep -E "find|umount"
+#   0 23496  3144  0  52  0  12856  2544 ufs      D+    0   0:00.00 find /mnt -type f -maxdepth 2 -ls
+#   0 23497  3126  6  52  0  12812  2512 mount dr D+    0   0:00.00 umount /mnt
+# [root@mercat1 /home/pho]# 
+
+# Test suggestion by Jason Harmening:
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+nullfs_srcdir=$mntpoint
+nullfs_dstdir=$mntpoint
+runtime=300
+
+set -e
+mount | grep $mntpoint | grep -q /dev/md && umount -f $mntpoint
+mdconfig -l | grep -q md$mdstart &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 2g -u $mdstart || exit 1
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+chmod 777 $mntpoint
+set +e
+
+start=`date '+%s'`
+while [ `date '+%s'` -lt $((start + $runtime)) ]; do
+	find $nullfs_dstdir -type f -maxdepth 2 -ls > \
+	    /dev/null 2>&1
+done &
+
+(cd ../testcases/swap; ./swap -t ${runtime}s -i 20) &
+start=`date '+%s'`
+while [ `date '+%s'` -lt $((start + $runtime)) ]; do
+	mount_nullfs $nullfs_srcdir $nullfs_dstdir
+	opt=$([ `jot -r 1 0 1` -eq 0 ] && echo "-f")
+	while mount | grep nullfs | grep -q ${nullfs_dstdir}; do
+		umount $opt $nullfs_dstdir
+	done
+done > /dev/null 2>&1
+pkill swap
+wait
+n=0
+while mount | grep $mntpoint | grep -q /dev/md; do
+	umount $mntpoint || sleep 1
+	n=$((n + 1))
+	[ $n -gt 30 ] && { echo FAIL; status=2; }
+done
+mdconfig -d -u $mdstart
+exit 0

tools/test/stress2/misc/radix.sh

@@ -47,12 +47,14 @@ rm -f radix.c
 cd $odir
 
 set -e
+trap "rm -f rendezvous" EXIT INT
 parallel=1
 usermem=`sysctl hw.usermem | sed 's/.* //'`
 pagesize=`pagesize`
 start=`date +%s`
 while true; do
-	/tmp/radix $parallel > $log; s=$?
+	timeout 2m /tmp/radix $parallel > $log; s=$?
+	[ $s -eq 124 ] && { echo "Timed out"; break; }
 	[ $s -ne 0 ] && cat $log
 	used=`awk '{print $4}' < $log`
 	[ -z "$used" ] && break

tools/test/stress2/misc/unionfs14.sh

+#!/bin/sh
+
+#
+# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+#
+# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+
+# Parallel mount and umount test.
+# Copy of unionfs9.sh, with a subdirectory mount point.
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+. ../default.cfg
+
+mounts=3	# Number of parallel scripts
+CONT=/tmp/unionfs9.continue
+
+set -e
+mdconfig -a -t swap -s 256m -u $mdstart
+newfs $newfs_flags -n md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+
+for i in `jot $mounts $((mdstart + 2))`; do
+	mdconfig -a -t swap -s 512m -u $((mdstart + i))
+	newfs $newfs_flags -n md$((mdstart + i)) > /dev/null
+	mkdir -p ${mntpoint}$i
+	mount /dev/md$((mdstart + i)) ${mntpoint}$i
+	mkdir -p ${mntpoint}$i/dir
+done
+set +e
+echo Pre:
+mount | grep mnt
+
+(cd $mntpoint; jot 500 | xargs touch)
+(cd ../testcases/swap; ./swap -t 5m -i 20 > /dev/null) &
+
+# Start the parallel tests
+touch $CONT
+for i in `jot $mounts $((mdstart + 2))`; do
+	while [ -f $CONT ]; do
+		find ${mntpoint}$i -type f -maxdepth 2 -ls > \
+		    /dev/null 2>&1
+	done &
+	# The test: Parallel mount and unmounts
+	start=`date +%s`
+	(
+		while [ $((`date +%s` - start))  -lt 300 ]; do
+			mount_unionfs $mntpoint ${mntpoint}$i/dir
+			opt=$([ `jot -r 1 0 1` -eq 0 ] && echo "-f")
+			while mount | grep -q ${mntpoint}$i/dir; do
+				umount $opt ${mntpoint}$i/dir
+			done
+		done > /dev/null 2>&1
+		rm -f $CONT
+	) &
+done
+while [ -f $CONT ] ; do sleep 1; done
+while pgrep -q swap; do pkill swap; done
+wait
+echo Post:
+mount | grep mnt
+
+for i in `jot $mounts $((mdstart + 2))`; do
+	umount ${mntpoint}$i > /dev/null 2>&1
+	mdconfig -d -u $((mdstart + i))
+	rmdir ${mntpoint}$i
+done
+while mount | grep $mntpoint | grep -q /dev/md; do
+	umount $mntpoint || sleep 1
+	[ $((n += 1)) -gt 300 ] && { echo FAIL; exit 1; }
+done
+mdconfig -d -u $mdstart
+exit 0