Date: Mon, 25 Mar 2019 15:23:21 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r345504 - head/sys/netinet Message-ID: <201903251523.x2PFNL6I096193@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Mon Mar 25 15:23:20 2019 New Revision: 345504 URL: https://svnweb.freebsd.org/changeset/base/345504 Log: Improve locking when tearing down an SCTP association. This is joint work with rrs@ and the issue was found by syzkaller. MFC after: 1 week Modified: head/sys/netinet/sctp_pcb.c Modified: head/sys/netinet/sctp_pcb.c ============================================================================== --- head/sys/netinet/sctp_pcb.c Mon Mar 25 14:50:38 2019 (r345503) +++ head/sys/netinet/sctp_pcb.c Mon Mar 25 15:23:20 2019 (r345504) @@ -4982,6 +4982,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc * in case. */ /* anything on the wheel needs to be removed */ + SCTP_TCB_SEND_LOCK(stcb); for (i = 0; i < asoc->streamoutcnt; i++) { struct sctp_stream_out *outs; @@ -4990,7 +4991,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { atomic_subtract_int(&asoc->stream_queue_cnt, 1); TAILQ_REMOVE(&outs->outqueue, sp, next); - stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 0); + stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1); sctp_free_spbufspace(stcb, asoc, sp); if (sp->data) { if (so) { @@ -5012,6 +5013,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); } } + SCTP_TCB_SEND_UNLOCK(stcb); /* sa_ignore FREED_MEMORY */ TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) { TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201903251523.x2PFNL6I096193>