Date: Wed, 8 Sep 2021 15:41:24 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 6e3af6321ba4 - main - sctp: Fix lock recursion in sctp_swap_inpcb_for_listen() Message-ID: <202109081541.188FfOQR004119@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6e3af6321ba46010272c78487634ec16816ff3e6 commit 6e3af6321ba46010272c78487634ec16816ff3e6 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-09-08 03:02:15 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-09-08 15:41:18 +0000 sctp: Fix lock recursion in sctp_swap_inpcb_for_listen() After commit bd4a39cc93d9 we now hold the global inp info lock across the call to sctp_swap_inpcb_for_listen(), which attempts to acquire it again. Since sctp_swap_inpcb_for_listen()'s sole caller is sctp_listen(), we can simply change it to not try to acquire the lock. Reported by: syzbot+a76b19ea2f8e1190c451@syzkaller.appspotmail.com Reported by: syzbot+a1b6cef257ad145b7187@syzkaller.appspotmail.com Reviewed by: tuexen Fixes: bd4a39cc93d9 ("socket: Properly interlock when transitioning to a listening socket") MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D31878 --- sys/netinet/sctp_pcb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c index 473c71917ce7..cdecb9f4bc9c 100644 --- a/sys/netinet/sctp_pcb.c +++ b/sys/netinet/sctp_pcb.c @@ -1845,6 +1845,8 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp) struct sctppcbhead *head; struct sctp_inpcb *tinp, *ninp; + SCTP_INP_INFO_WLOCK_ASSERT(); + if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) { /* only works with port reuse on */ return (-1); @@ -1853,7 +1855,6 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp) return (0); } SCTP_INP_RUNLOCK(inp); - SCTP_INP_INFO_WLOCK(); head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport, SCTP_BASE_INFO(hashmark))]; /* Kick out all non-listeners to the TCP hash */ @@ -1885,7 +1886,6 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp) LIST_INSERT_HEAD(head, inp, sctp_hash); SCTP_INP_WUNLOCK(inp); SCTP_INP_RLOCK(inp); - SCTP_INP_INFO_WUNLOCK(); return (0); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202109081541.188FfOQR004119>