Date: Fri, 20 May 2011 12:33:35 GMT From: Dmitrij Tejblum <tejblum@yandex-team.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/157209: [patch] locking error in rip6_input() (sys/netinet6/raw_ip6.c) Message-ID: <201105201233.p4KCXZ1R068374@red.freebsd.org> Resent-Message-ID: <201105201240.p4KCeAja007115@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 157209
>Category: kern
>Synopsis: [patch] locking error in rip6_input() (sys/netinet6/raw_ip6.c)
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri May 20 12:40:10 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator: Dmitrij Tejblum
>Release: 8.2-STABLE
>Organization:
Yandex
>Environment:
>Description:
On a failure path in rip6_input(), the PCB is unlocked before the lock is taken.
>How-To-Repeat:
>Fix:
A possible quick patch is attached; anothe quick possibility would be to remove the unlock.
Patch attached with submission follows:
--- sys/netinet6/raw_ip6.c 2010-08-31 19:52:12.000000000 +0400
+++ sys/netinet6/raw_ip6.c 2011-05-14 00:27:24.000000000 +0400
@@ -193,20 +193,20 @@
if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
prison_check_ip6(in6p->inp_cred,
&ip6->ip6_dst) != 0)
continue;
}
+ INP_RLOCK(in6p);
if (in6p->in6p_cksum != -1) {
V_rip6stat.rip6s_isum++;
if (in6_cksum(m, proto, *offp,
m->m_pkthdr.len - *offp)) {
INP_RUNLOCK(in6p);
V_rip6stat.rip6s_badsum++;
continue;
}
}
- INP_RLOCK(in6p);
/*
* If this raw socket has multicast state, and we
* have received a multicast, check if this socket
* should receive it, as multicast filtering is now
* the responsibility of the transport layer.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201105201233.p4KCXZ1R068374>