7422 dpioctl should pay attention to FKIOCTL

7423 epoll_ctl should throw EINVAL for loops
7424 epoll should not leave dangling polldat_t entries
7425 devpoll write feigns success in the face of EINTR
7426 epoll_ctl not allowed to emit EINTR
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Reviewed by: Bryan Cantrill <bryan@joyent.com>
Approved by: Dan McDonald <danmcd@omniti.com>

2 files changed, 63 insertions, 16 deletions

diff --git a/usr/src/lib/libc/port/sys/epoll.c b/usr/src/lib/libc/port/sys/epoll.c
index 93379b583e..543856b2ec 100644
--- a/usr/src/lib/libc/port/sys/epoll.c
+++ b/usr/src/lib/libc/port/sys/epoll.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/types.h>
@@ -114,7 +114,7 @@ epoll_ctl(int epfd, int op, int fd, struct epoll_event *event)
 {
 	dvpoll_epollfd_t epoll[2];
 	uint32_t events, ev = 0;
-	int i = 0;
+	int i = 0, res;
 
 	epoll[i].dpep_pollfd.fd = fd;
 
@@ -165,8 +165,29 @@ epoll_ctl(int epfd, int op, int fd, struct epoll_event *event)
 	}
 
 	epoll[i].dpep_pollfd.events = ev;
-
-	return (write(epfd, epoll, sizeof (epoll[0]) * (i + 1)) == -1 ? -1 : 0);
+retry:
+	res = write(epfd, epoll, sizeof (epoll[0]) * (i + 1));
+
+	if (res == -1) {
+		if (errno == EINTR) {
+			/*
+			 * Linux does not document EINTR as an allowed error
+			 * for epoll_ctl.  The write must be retried if it is
+			 * not done automatically via SA_RESTART.
+			 */
+			goto retry;
+		}
+		if (errno == ELOOP) {
+			/*
+			 * Convert the specific /dev/poll error about an fd
+			 * loop into what is expected from the Linux epoll
+			 * interface.
+			 */
+			errno = EINVAL;
+		}
+		return (-1);
+	}
+	return (0);
 }
 
 int
diff --git a/usr/src/uts/common/io/devpoll.c b/usr/src/uts/common/io/devpoll.c
index 8c63043d00..4fce431e00 100644
--- a/usr/src/uts/common/io/devpoll.c
+++ b/usr/src/uts/common/io/devpoll.c
@@ -353,8 +353,9 @@ repoll:
 					pdp->pd_fp = NULL;
 					pdp->pd_events = 0;
 
-					if (php != NULL) {
-						pollhead_delete(php, pdp);
+					if (pdp->pd_php != NULL) {
+						pollhead_delete(pdp->pd_php,
+						    pdp);
 						pdp->pd_php = NULL;
 					}
 
@@ -503,8 +504,9 @@ repoll:
 					pdp->pd_fp = NULL;
 					pdp->pd_events = 0;
 
-					if (php != NULL) {
-						pollhead_delete(php, pdp);
+					if (pdp->pd_php != NULL) {
+						pollhead_delete(pdp->pd_php,
+						    pdp);
 						pdp->pd_php = NULL;
 					}
 
@@ -639,6 +641,7 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 	uintptr_t	limit;
 	int		error, size;
 	ssize_t		uiosize;
+	size_t		copysize;
 	nfds_t		pollfdnum;
 	struct pollhead	*php = NULL;
 	polldat_t	*pdp;
@@ -704,11 +707,19 @@ dpwrite(dev_t dev, struct uio *uiop, cred_t *credp)
 	 * here for every call.
 	 */
 	uiop->uio_loffset = 0;
-	if ((error = uiomove((caddr_t)pollfdp, uiosize, UIO_WRITE, uiop))
-	    != 0) {
+
+	/*
+	 * Use uiocopy instead of uiomove when populating pollfdp, keeping
+	 * uio_resid untouched for now.  Write syscalls will translate EINTR
+	 * into a success if they detect "successfully transfered" data via an
+	 * updated uio_resid.  Falsely suppressing such errors is disastrous.
+	 */
+	if ((error = uiocopy((caddr_t)pollfdp, uiosize, UIO_WRITE, uiop,
+	    &copysize)) != 0) {
 		kmem_free(pollfdp, uiosize);
 		return (error);
 	}
+
 	/*
 	 * We are about to enter the core portion of dpwrite(). Make sure this
 	 * write has exclusive access in this portion of the code, i.e., no
@@ -981,6 +992,13 @@ bypass:
 	cv_broadcast(&dpep->dpe_cv);
 	mutex_exit(&dpep->dpe_lock);
 	kmem_free(pollfdp, uiosize);
+	if (error == 0) {
+		/*
+		 * The state of uio_resid is updated only after the pollcache
+		 * is successfully modified.
+		 */
+		uioskip(uiop, copysize);
+	}
 	return (error);
 }
 
@@ -1123,14 +1141,18 @@ dpioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp, int *rvalp)
 			void *setp = STRUCT_FGETP(dvpoll, dp_setp);
 
 			if (setp != NULL) {
-				if (copyin(setp, &set, sizeof (set))) {
-					DP_REFRELE(dpep);
-					return (EFAULT);
+				if ((mode & FKIOCTL) != 0) {
+					/* Use the signal set directly */
+					ksetp = (k_sigset_t *)setp;
+				} else {
+					if (copyin(setp, &set, sizeof (set))) {
+						DP_REFRELE(dpep);
+						return (EFAULT);
+					}
+					sigutok(&set, &kset);
+					ksetp = &kset;
 				}
 
-				sigutok(&set, &kset);
-				ksetp = &kset;
-
 				mutex_enter(&p->p_lock);
 				schedctl_finish_sigblock(t);
 				lwp->lwp_sigoldmask = t->t_hold;
@@ -1279,6 +1301,10 @@ dpioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp, int *rvalp)
 		DP_SIGMASK_RESTORE(ksetp);
 
 		if (error == 0 && fdcnt > 0) {
+			/*
+			 * It should be noted that FKIOCTL does not influence
+			 * the copyout (vs bcopy) of dp_fds at this time.
+			 */
 			if (copyout(ps->ps_dpbuf,
 			    STRUCT_FGETP(dvpoll, dp_fds), fdcnt * fdsize)) {
 				DP_REFRELE(dpep);