From owner-dev-commits-src-branches@freebsd.org Wed Sep 8 12:41:49 2021 Return-Path: Delivered-To: dev-commits-src-branches@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 3EA8E67A84C; Wed, 8 Sep 2021 12:41:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4H4MG50JsNz3hWD; Wed, 8 Sep 2021 12:41:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id DE62425EFC; Wed, 8 Sep 2021 12:41:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 188CfmUg065224; Wed, 8 Sep 2021 12:41:48 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 188CfmlX065223; Wed, 8 Sep 2021 12:41:48 GMT (envelope-from git) Date: Wed, 8 Sep 2021 12:41:48 GMT Message-Id: <202109081241.188CfmlX065223@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: d30602a2b495 - stable/13 - sctp: Hold association locks across socket wakeups when freeing MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: d30602a2b4952571ca4dcf302422cd86f4bfaa6a Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-branches@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commits to the stable branches of the FreeBSD src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Sep 2021 12:41:49 -0000 The branch stable/13 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d30602a2b4952571ca4dcf302422cd86f4bfaa6a commit d30602a2b4952571ca4dcf302422cd86f4bfaa6a Author: Mark Johnston AuthorDate: 2021-09-01 14:27:51 +0000 Commit: Mark Johnston CommitDate: 2021-09-08 12:40:33 +0000 sctp: Hold association locks across socket wakeups when freeing At this point we do not hold the inpcb lock, so the only thing holding the socket reference live is the TCB lock, which needs to be acquired by sctp_inpcb_free() in order to destroy associations. Defer the unlock to until after we dereference the socket reference. Reported by: syzbot+1d0f2c4675de76a4cf1e@syzkaller.appspotmail.com Reported by: syzbot+fabee77954fe69d3a5ad@syzkaller.appspotmail.com Reviewed by: tuexen Sponsored by: The FreeBSD Foundation (cherry picked from commit d35be50f57797a400ff68a37777405029bf9730a) --- sys/netinet/sctp_pcb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c index 12f2d5d7fb76..fc3cd79c5d87 100644 --- a/sys/netinet/sctp_pcb.c +++ b/sys/netinet/sctp_pcb.c @@ -4785,8 +4785,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE); sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL); } - SCTP_TCB_SEND_UNLOCK(stcb); - SCTP_TCB_UNLOCK(stcb); if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) || (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) /* nothing around */ @@ -4796,6 +4794,8 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre sctp_sorwakeup(inp, so); sctp_sowwakeup(inp, so); } + SCTP_TCB_SEND_UNLOCK(stcb); + SCTP_TCB_UNLOCK(stcb); #ifdef SCTP_LOG_CLOSING sctp_log_closing(inp, stcb, 9);