From owner-dev-commits-ports-all@freebsd.org Tue Sep 7 21:58:33 2021 Return-Path: Delivered-To: dev-commits-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 2B1B766DED1; Tue, 7 Sep 2021 21:58:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4H3zfx0VKsz4nwm; Tue, 7 Sep 2021 21:58:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id DAC7C1A585; Tue, 7 Sep 2021 21:58:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 187LwW3X077543; Tue, 7 Sep 2021 21:58:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 187LwWok077542; Tue, 7 Sep 2021 21:58:32 GMT (envelope-from git) Date: Tue, 7 Sep 2021 21:58:32 GMT Message-Id: <202109072158.187LwWok077542@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Craig Leres Subject: git: b0c4eaac2a3a - main - security/suricata: Add patch for upstream locking fix MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: leres X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b0c4eaac2a3aa9bc422c21b9d398e4dbfea18736 Auto-Submitted: auto-generated X-BeenThere: dev-commits-ports-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the ports repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Sep 2021 21:58:33 -0000 The branch main has been updated by leres: URL: https://cgit.FreeBSD.org/ports/commit/?id=b0c4eaac2a3aa9bc422c21b9d398e4dbfea18736 commit b0c4eaac2a3aa9bc422c21b9d398e4dbfea18736 Author: Craig Leres AuthorDate: 2021-09-07 21:55:24 +0000 Commit: Craig Leres CommitDate: 2021-09-07 21:55:24 +0000 security/suricata: Add patch for upstream locking fix https://redmine.openinfosecfoundation.org/issues/4478 - Suricata 6 may stop forwarding traffic due to lock/unlock executed between CPUs, which is undetermined behaviour. PR: 258335 Approved by: Franco Fichtner (maintainer) --- security/suricata/Makefile | 1 + security/suricata/files/patch-3c53a1601 | 78 +++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+) diff --git a/security/suricata/Makefile b/security/suricata/Makefile index e450a344652f..d2887b48c134 100644 --- a/security/suricata/Makefile +++ b/security/suricata/Makefile @@ -1,5 +1,6 @@ PORTNAME= suricata DISTVERSION= 6.0.3 +PORTREVISION= 1 CATEGORIES= security MASTER_SITES= https://www.openinfosecfoundation.org/download/ diff --git a/security/suricata/files/patch-3c53a1601 b/security/suricata/files/patch-3c53a1601 new file mode 100644 index 000000000000..d70b3c563e5a --- /dev/null +++ b/security/suricata/files/patch-3c53a1601 @@ -0,0 +1,78 @@ +From 3c53a1601b6f861f8b7f0cd0984b18e78291fe85 Mon Sep 17 00:00:00 2001 +From: Victor Julien +Date: Wed, 18 Aug 2021 20:14:48 +0200 +Subject: [PATCH] threading: don't pass locked flow between threads + +Previously the flow manager would share evicted flows with the workers +while keeping the flows mutex locked. This reduced the number of unlock/ +lock cycles while there was guaranteed to be no contention. + +This turns out to be undefined behavior. A lock is supposed to be locked +and unlocked from the same thread. It appears that FreeBSD is stricter on +this than Linux. + +This patch addresses the issue by unlocking before handing a flow off +to another thread, and locking again from the new thread. + +Issue was reported and largely analyzed by Bill Meeks. + +Bug: #4478 +(cherry picked from commit 9551cd05357925e8bec8e0030d5f98fd07f17839) +--- + src/flow-hash.c | 1 + + src/flow-manager.c | 2 +- + src/flow-timeout.c | 1 + + src/flow-worker.c | 1 + + 4 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/flow-hash.c b/src/flow-hash.c +index ebbd836e81a..760bc53e0a8 100644 +--- src/flow-hash.c ++++ src/flow-hash.c +@@ -669,6 +669,7 @@ static inline void MoveToWorkQueue(ThreadVars *tv, FlowLookupStruct *fls, + f->fb = NULL; + f->next = NULL; + FlowQueuePrivateAppendFlow(&fls->work_queue, f); ++ FLOWLOCK_UNLOCK(f); + } else { + /* implied: TCP but our thread does not own it. So set it + * aside for the Flow Manager to pick it up. */ +diff --git a/src/flow-manager.c b/src/flow-manager.c +index d58a49637d6..9228c88490c 100644 +--- src/flow-manager.c ++++ src/flow-manager.c +@@ -333,9 +333,9 @@ static uint32_t ProcessAsideQueue(FlowManagerTimeoutThread *td, FlowTimeoutCount + FlowForceReassemblyNeedReassembly(f) == 1) + { + FlowForceReassemblyForFlow(f); ++ FLOWLOCK_UNLOCK(f); + /* flow ownership is passed to the worker thread */ + +- /* flow remains locked */ + counters->flows_aside_needs_work++; + continue; + } +diff --git a/src/flow-timeout.c b/src/flow-timeout.c +index 972b35076bd..d6cca490087 100644 +--- src/flow-timeout.c ++++ src/flow-timeout.c +@@ -401,6 +401,7 @@ static inline void FlowForceReassemblyForHash(void) + RemoveFromHash(f, prev_f); + f->flow_end_flags |= FLOW_END_FLAG_SHUTDOWN; + FlowForceReassemblyForFlow(f); ++ FLOWLOCK_UNLOCK(f); + f = next_f; + continue; + } +diff --git a/src/flow-worker.c b/src/flow-worker.c +index 69dbb6ac575..dccf3581dd5 100644 +--- src/flow-worker.c ++++ src/flow-worker.c +@@ -168,6 +168,7 @@ static void CheckWorkQueue(ThreadVars *tv, FlowWorkerThreadData *fw, + { + Flow *f; + while ((f = FlowQueuePrivateGetFromTop(fq)) != NULL) { ++ FLOWLOCK_WRLOCK(f); + f->flow_end_flags |= FLOW_END_FLAG_TIMEOUT; //TODO emerg + + const FlowStateType state = f->flow_state;