The branch main has been updated by markj:
URL:
https://cgit.FreeBSD.org/src/commit/?id=6e3af6321ba46010272c78487634ec16816ff3e6
commit 6e3af6321ba46010272c78487634ec16816ff3e6
Author: Mark Johnston <ma...@freebsd.org>
AuthorDate: 2021-09-08 03:02:15 +0000
Commit: Mark Johnston <ma...@freebsd.org>
CommitDate: 2021-09-08 15:41:18 +0000
sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
After commit bd4a39cc93d9 we now hold the global inp info lock across
the call to sctp_swap_inpcb_for_listen(), which attempts to acquire it
again. Since sctp_swap_inpcb_for_listen()'s sole caller is
sctp_listen(), we can simply change it to not try to acquire the lock.
Reported by: syzbot+a76b19ea2f8e1190c...@syzkaller.appspotmail.com
Reported by: syzbot+a1b6cef257ad145b7...@syzkaller.appspotmail.com
Reviewed by: tuexen
Fixes: bd4a39cc93d9 ("socket: Properly interlock when transitioning to a
listening socket")
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D31878
---
sys/netinet/sctp_pcb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c
index 473c71917ce7..cdecb9f4bc9c 100644
--- a/sys/netinet/sctp_pcb.c
+++ b/sys/netinet/sctp_pcb.c
@@ -1845,6 +1845,8 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
struct sctppcbhead *head;
struct sctp_inpcb *tinp, *ninp;
+ SCTP_INP_INFO_WLOCK_ASSERT();
+
if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) {
/* only works with port reuse on */
return (-1);
@@ -1853,7 +1855,6 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
return (0);
}
SCTP_INP_RUNLOCK(inp);
- SCTP_INP_INFO_WLOCK();
head =
&SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport,
SCTP_BASE_INFO(hashmark))];
/* Kick out all non-listeners to the TCP hash */
@@ -1885,7 +1886,6 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
LIST_INSERT_HEAD(head, inp, sctp_hash);
SCTP_INP_WUNLOCK(inp);
SCTP_INP_RLOCK(inp);
- SCTP_INP_INFO_WUNLOCK();
return (0);
}
_______________________________________________
dev-commits-src-main@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-main
To unsubscribe, send any mail to "dev-commits-src-main-unsubscr...@freebsd.org"
