NetBSD Problem Report #59475

From www@netbsd.org  Fri Jun 20 14:37:43 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 484261A923C
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 20 Jun 2025 14:37:43 +0000 (UTC)
Message-Id: <20250620143741.BFE1A1A923D@mollari.NetBSD.org>
Date: Fri, 20 Jun 2025 14:37:41 +0000 (UTC)
From: pfg@freebsd.org
Reply-To: pfg@freebsd.org
To: gnats-bugs@NetBSD.org
Subject: libc/rpc: clnt_vc_create: Do not hold a global mutex during connect
X-Send-Pr-Version: www-1.0

>Number:         59475
>Category:       lib
>Synopsis:       libc/rpc: clnt_vc_create: Do not hold a global mutex during connect
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 20 14:40:01 +0000 2025
>Originator:     Pedro Giffuni
>Release:        all releases
>Organization:
FreeBSD
>Environment:
N/A
>Description:
Don't hold a mutex when connecting

A multi-threaded application, connecting to multiple rpc servers,
may dead lock if the connect call stalls on a non responsive server.

That's why the kind linux tirpc guys have these two changes in their system (under a 3 clause BSD license, since the code is derived from FreeBSD):

http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=644b861b01a0b53a9b920e50f68e4f1252000bbd
http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=45ceae856f314f7367695e81e835ba4b306cd335

I sort of put them together in a patch but its untested.
>How-To-Repeat:
N/A
>Fix:
This is against FreeBSD but should apply pretty cleanly to NetBSD.
diff --git a/lib/libc/rpc/clnt_vc.c b/lib/libc/rpc/clnt_vc.c
index 60e381168ed3..2a3aa4469ac2 100644
--- a/lib/libc/rpc/clnt_vc.c
+++ b/lib/libc/rpc/clnt_vc.c
@@ -224,24 +224,24 @@ clnt_vc_create(int fd, const struct netbuf *raddr, const rpcprog_t prog,
 	ct->ct_addr.buf = NULL;

 	/*
-	 * XXX - fvdl connecting while holding a mutex?
+	 * Do not hold mutex during connect
 	 */
+	mutex_unlock(&clnt_fd_lock);
+
 	slen = sizeof ss;
 	if (_getpeername(fd, (struct sockaddr *)(void *)&ss, &slen) < 0) {
 		if (errno != ENOTCONN) {
 			rpc_createerr.cf_stat = RPC_SYSTEMERROR;
 			rpc_createerr.cf_error.re_errno = errno;
-			mutex_unlock(&clnt_fd_lock);
 			goto err;
 		}
-		if (_connect(fd, (struct sockaddr *)raddr->buf, raddr->len) < 0){
-			rpc_createerr.cf_stat = RPC_SYSTEMERROR;
-			rpc_createerr.cf_error.re_errno = errno;
-			mutex_unlock(&clnt_fd_lock);
-			goto err;
+		if ((_connect(fd, (struct sockaddr *)raddr->buf, raddr->len) < 0) &&
+			(errno != EISCONN) ) {
+				rpc_createerr.cf_stat = RPC_SYSTEMERROR;
+				rpc_createerr.cf_error.re_errno = errno;
+				goto err;
 		}
 	}
-	mutex_unlock(&clnt_fd_lock);
 	if (!__rpc_fd2sockinfo(fd, &si))
 		goto err;

Home	PR Database Search