Date: Fri, 6 Jan 2012 11:22:25 +0000 (GMT) From: Robert Watson <rwatson@FreeBSD.org> To: Navdeep Parhar <nparhar@gmail.com> Cc: freebsd-net@freebsd.org Subject: Re: tcp_detach can return with inpcb lock held Message-ID: <alpine.BSF.2.00.1201061120001.31024@fledge.watson.org> In-Reply-To: <CAPFoGT-S-gvp12dGBZewEEZUFrWaOL=V4Jotu-pgzOEpcHs7Xg@mail.gmail.com> References: <CAPFoGT-S-gvp12dGBZewEEZUFrWaOL=V4Jotu-pgzOEpcHs7Xg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 5 Jan 2012, Navdeep Parhar wrote:
> Looks like there's a case where tcp_detach could return with the inp lock
> held. I see an XXXRW comment questioning this possibility, but we should
> either add an assertion to verify that the case does not occur, or unlock
> the inpcb before returning. Or maybe both?
Hi Navdeep:
A number of other folks have pointed this out as well -- usually while
tracking a different bug, so a fix never gets committed. I believe we should
commit + merge the patch you've proposed. However, as far as I'm aware, it's
never triggered, so the comment is probably correct. I'm not sure if we want
to make the comment an invariant, since other than avoiding this bug, it
shouldn't need to be true (I think).
Robert
>
> Regards, Navdeep
>
> diff -r 35bdf8d932e8 sys/netinet/tcp_usrreq.c
> --- a/sys/netinet/tcp_usrreq.c Mon Dec 19 10:08:31 2011 -0800
> +++ b/sys/netinet/tcp_usrreq.c Thu Jan 05 21:20:24 2012 -0800
> @@ -204,8 +204,11 @@
> tcp_discardcb(tp);
> in_pcbdetach(inp);
> in_pcbfree(inp);
> - } else
> + } else {
> in_pcbdetach(inp);
> + INP_WUNLOCK(inp);
> + }
> +
> }
> }
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.00.1201061120001.31024>