From owner-svn-src-all@FreeBSD.ORG Sat Oct 30 12:05:20 2010 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 639BD106566B; Sat, 30 Oct 2010 12:05:20 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 51D918FC1A; Sat, 30 Oct 2010 12:05:20 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o9UC5Kcn096534; Sat, 30 Oct 2010 12:05:20 GMT (envelope-from bz@svn.freebsd.org) Received: (from bz@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o9UC5KDV096532; Sat, 30 Oct 2010 12:05:20 GMT (envelope-from bz@svn.freebsd.org) Message-Id: <201010301205.o9UC5KDV096532@svn.freebsd.org> From: "Bjoern A. Zeeb" Date: Sat, 30 Oct 2010 12:05:20 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r214553 - stable/8/sys/netinet X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Oct 2010 12:05:20 -0000 Author: bz Date: Sat Oct 30 12:05:20 2010 New Revision: 214553 URL: http://svn.freebsd.org/changeset/base/214553 Log: MFC r213932: MfP4 CH182763 (original version): Make it harder to exploit certain in_control() related races between the intiial lookup at the beginning and the time we will remove the entry from the lists by re-checking that entry is still in the list before trying to remove it. Reported by: Nima Misaghian (nima_misa hotmail.com) on net@ 20100817 Tested by: Nima Misaghian (nima_misa hotmail.com) (original version) PR: kern/146250 Submitted by: Mikolaj Golub (to.my.trociny gmail.com) (different version) Modified: stable/8/sys/netinet/in.c Directory Properties: stable/8/sys/ (props changed) stable/8/sys/amd64/include/xen/ (props changed) stable/8/sys/cddl/contrib/opensolaris/ (props changed) stable/8/sys/contrib/dev/acpica/ (props changed) stable/8/sys/contrib/pf/ (props changed) stable/8/sys/dev/xen/xenpci/ (props changed) Modified: stable/8/sys/netinet/in.c ============================================================================== --- stable/8/sys/netinet/in.c Sat Oct 30 11:54:55 2010 (r214552) +++ stable/8/sys/netinet/in.c Sat Oct 30 12:05:20 2010 (r214553) @@ -599,6 +599,21 @@ in_control(struct socket *so, u_long cmd } IF_ADDR_LOCK(ifp); + /* Re-check that ia is still part of the list. */ + TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { + if (ifa == &ia->ia_ifa) + break; + } + if (ifa == NULL) { + /* + * If we lost the race with another thread, there is no need to + * try it again for the next loop as there is no other exit + * path between here and out. + */ + IF_ADDR_UNLOCK(ifp); + error = EADDRNOTAVAIL; + goto out; + } TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link); IF_ADDR_UNLOCK(ifp); ifa_free(&ia->ia_ifa); /* if_addrhead */