[src/trunk]: src/sys/kern Release the collision if we find one.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d303afcd04ed
branches:  trunk
changeset: 932297:d303afcd04ed
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Mon May 04 13:58:48 2020 +0000

description:
Release the collision if we find one.

Candidate fix for:

panic: lock error: Mutex: mutex_vector_enter,542: locking against myself: lock 0xffff8f611abd37e0 cpu 8 lwp 0xffff8f60a3c6a040
cpu8: Begin traceback...
vpanic() at netbsd:vpanic+0x178
snprintf() at netbsd:snprintf
lockdebug_abort() at netbsd:lockdebug_abort+0xe6
mutex_vector_enter() at netbsd:mutex_vector_enter+0x3c1
ksem_close_fop() at netbsd:ksem_close_fop+0x17
closef() at netbsd:closef+0x69
fd_free() at netbsd:fd_free+0x101
exit1() at netbsd:exit1+0x118
sys_exit() at netbsd:sys_exit+0x3d
syscall() at netbsd:syscall+0x299

Would be nice to have an automatic test for this.  Since semids are
only 24 bits, we only need to create a few thousand of them to have a
high probability of collision.  Maybe we should bump default semmax
while here...

diffstat:

 sys/kern/uipc_sem.c |  9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diffs (47 lines):

diff -r a8ece65ae636 -r d303afcd04ed sys/kern/uipc_sem.c
--- a/sys/kern/uipc_sem.c       Mon May 04 12:15:43 2020 +0000
+++ b/sys/kern/uipc_sem.c       Mon May 04 13:58:48 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_sem.c,v 1.58 2019/12/17 18:16:05 ad Exp $ */
+/*     $NetBSD: uipc_sem.c,v 1.59 2020/05/04 13:58:48 riastradh Exp $  */
 
 /*-
  * Copyright (c) 2011, 2019 The NetBSD Foundation, Inc.
@@ -60,7 +60,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.58 2019/12/17 18:16:05 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.59 2020/05/04 13:58:48 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -110,6 +110,7 @@
 static int             ksem_sysinit(void);
 static int             ksem_sysfini(bool);
 static int             ksem_modcmd(modcmd_t, void *);
+static void            ksem_release(ksem_t *, int);
 static int             ksem_close_fop(file_t *);
 static int             ksem_stat_fop(file_t *, struct stat *);
 static int             ksem_read_fop(file_t *, off_t *, struct uio *,
@@ -365,6 +366,7 @@
 static void
 ksem_alloc_pshared_id(ksem_t *ksem)
 {
+       ksem_t *ksem0;
        uint32_t try;
 
        KASSERT(ksem->ks_pshared_proc != NULL);
@@ -374,10 +376,11 @@
                try = (cprng_fast32() & ~KSEM_MARKER_MASK) |
                    KSEM_PSHARED_MARKER;
 
-               if (ksem_lookup_pshared_locked(try) == NULL) {
+               if ((ksem0 = ksem_lookup_pshared_locked(try)) == NULL) {
                        /* Got it! */
                        break;
                }
+               ksem_release(ksem0, -1);
        }
        ksem->ks_pshared_id = try;
        u_long bucket = KSEM_PSHARED_HASH(ksem->ks_pshared_id);