Author: bz
Date: Sat Oct 16 19:53:22 2010
New Revision: 213932
URL: http://svn.freebsd.org/changeset/base/213932
Log:
MfP4 CH182763 (original version):
Make it harder to exploit certain in_control() related races between the
intiial lookup at the beginning and the time we will remove the entry
from the lists by re-checking that entry is still in the list before
trying to remove it.
(*) It is believed that with the current code and locking strategy we
cannot completely fix all race.
Reported by: Nima Misaghian (nima_misa hotmail.com) on net@ 20100817
Tested by: Nima Misaghian (nima_misa hotmail.com) (original version)
PR: kern/146250
Submitted by: Mikolaj Golub (to.my.trociny gmail.com) (different version)
MFC after: 1 week
Modified:
head/sys/netinet/in.c
Modified: head/sys/netinet/in.c
==============================================================================
--- head/sys/netinet/in.c Sat Oct 16 19:29:37 2010 (r213931)
+++ head/sys/netinet/in.c Sat Oct 16 19:53:22 2010 (r213932)
@@ -599,6 +599,21 @@ in_control(struct socket *so, u_long cmd
}
IF_ADDR_LOCK(ifp);
+ /* Re-check that ia is still part of the list. */
+ TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
+ if (ifa == &ia->ia_ifa)
+ break;
+ }
+ if (ifa == NULL) {
+ /*
+ * If we lost the race with another thread, there is no need to
+ * try it again for the next loop as there is no other exit
+ * path between here and out.
+ */
+ IF_ADDR_UNLOCK(ifp);
+ error = EADDRNOTAVAIL;
+ goto out;
+ }
TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link);
IF_ADDR_UNLOCK(ifp);
ifa_free(&ia->ia_ifa); /* if_addrhead */
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
