Date: Mon, 8 Apr 2013 19:03:01 +0000 (UTC) From: John Baldwin <jhb@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r249263 - head/sys/rpc Message-ID: <201304081903.r38J31FG084693@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jhb Date: Mon Apr 8 19:03:01 2013 New Revision: 249263 URL: http://svnweb.freebsd.org/changeset/base/249263 Log: Fix a potential socket leak in the NFS server. If a client closes its connection after it was accepted by the userland nfsd process but before it was handled off to svc_vc_create() in the kernel, then svc_vc_create() would see it as a new listen socket and try to listen on it leaving a dangling reference to the socket. Instead, check for disconnected sockets and treat them like a connected socket. The call to pru_getaddr() should fail and cause svc_vc_create() to fail. Note that we need to lock the socket to get a consistent snapshot of so_state since there is a window in soisdisconnected() where both flags are clear. Reviewed by: dfr, rmacklem MFC after: 1 week Modified: head/sys/rpc/svc_vc.c Modified: head/sys/rpc/svc_vc.c ============================================================================== --- head/sys/rpc/svc_vc.c Mon Apr 8 18:46:35 2013 (r249262) +++ head/sys/rpc/svc_vc.c Mon Apr 8 19:03:01 2013 (r249263) @@ -146,7 +146,9 @@ svc_vc_create(SVCPOOL *pool, struct sock struct sockaddr* sa; int error; - if (so->so_state & SS_ISCONNECTED) { + SOCK_LOCK(so); + if (so->so_state & (SS_ISCONNECTED|SS_ISDISCONNECTED)) { + SOCK_UNLOCK(so); error = so->so_proto->pr_usrreqs->pru_peeraddr(so, &sa); if (error) return (NULL); @@ -154,6 +156,7 @@ svc_vc_create(SVCPOOL *pool, struct sock free(sa, M_SONAME); return (xprt); } + SOCK_UNLOCK(so); xprt = svc_xprt_alloc(); sx_init(&xprt->xp_lock, "xprt->xp_lock");
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201304081903.r38J31FG084693>