Date: Wed, 1 Sep 2021 14:28:45 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: d35be50f5779 - main - sctp: Hold association locks across socket wakeups when freeing Message-ID: <202109011428.181ESjBH027534@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d35be50f57797a400ff68a37777405029bf9730a commit d35be50f57797a400ff68a37777405029bf9730a Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-09-01 14:27:51 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-09-01 14:27:51 +0000 sctp: Hold association locks across socket wakeups when freeing At this point we do not hold the inpcb lock, so the only thing holding the socket reference live is the TCB lock, which needs to be acquired by sctp_inpcb_free() in order to destroy associations. Defer the unlock to until after we dereference the socket reference. Reported by: syzbot+1d0f2c4675de76a4cf1e@syzkaller.appspotmail.com Reported by: syzbot+fabee77954fe69d3a5ad@syzkaller.appspotmail.com Reviewed by: tuexen MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D31754 --- sys/netinet/sctp_pcb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c index 2b8653ac8109..3e517889d171 100644 --- a/sys/netinet/sctp_pcb.c +++ b/sys/netinet/sctp_pcb.c @@ -4802,8 +4802,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE); sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL); } - SCTP_TCB_SEND_UNLOCK(stcb); - SCTP_TCB_UNLOCK(stcb); if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) /* nothing around */ @@ -4813,6 +4811,8 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre sctp_sorwakeup(inp, so); sctp_sowwakeup(inp, so); } + SCTP_TCB_SEND_UNLOCK(stcb); + SCTP_TCB_UNLOCK(stcb); #ifdef SCTP_LOG_CLOSING sctp_log_closing(inp, stcb, 9);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202109011428.181ESjBH027534>