Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 26 Nov 2018 11:51:44 +0000 (UTC)
From:      Eugene Grosbein <eugen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r340957 - stable/10/sys/netinet
Message-ID:  <201811261151.wAQBpi3v041072@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: eugen
Date: Mon Nov 26 11:51:44 2018
New Revision: 340957
URL: https://svnweb.freebsd.org/changeset/base/340957

Log:
  Prevent multicast code from panicing due to unprotected access
  to INADDR_HASH. This is direct commit to stable/10 instead of MFC r339807
  due to significant difference in code base.
  
  PR:                   		220078
  Tested-by:			Cassiano Peixoto and others

Modified:
  stable/10/sys/netinet/in_mcast.c

Modified: stable/10/sys/netinet/in_mcast.c
==============================================================================
--- stable/10/sys/netinet/in_mcast.c	Mon Nov 26 11:32:22 2018	(r340956)
+++ stable/10/sys/netinet/in_mcast.c	Mon Nov 26 11:51:44 2018	(r340957)
@@ -1339,9 +1339,11 @@ inp_block_unblock_source(struct inpcb *inp, struct soc
 		ssa->sin.sin_len = sizeof(struct sockaddr_in);
 		ssa->sin.sin_addr = mreqs.imr_sourceaddr;
 
-		if (!in_nullhost(mreqs.imr_interface))
+		if (!in_nullhost(mreqs.imr_interface)) {
+			IN_IFADDR_RLOCK();
 			INADDR_TO_IFP(mreqs.imr_interface, ifp);
-
+			IN_IFADDR_RUNLOCK();
+		}
 		if (sopt->sopt_name == IP_BLOCK_SOURCE)
 			doblock = 1;
 
@@ -1836,7 +1838,6 @@ inp_getmoptions(struct inpcb *inp, struct sockopt *sop
  *
  * Returns NULL if no ifp could be found.
  *
- * SMPng: TODO: Acquire the appropriate locks for INADDR_TO_IFP.
  * FUTURE: Implement IPv4 source-address selection.
  */
 static struct ifnet *
@@ -1851,7 +1852,9 @@ inp_lookup_mcast_ifp(const struct inpcb *inp,
 
 	ifp = NULL;
 	if (!in_nullhost(ina)) {
+		IN_IFADDR_RLOCK();
 		INADDR_TO_IFP(ina, ifp);
+		IN_IFADDR_RUNLOCK();
 	} else {
 		struct route ro;
 
@@ -2247,9 +2250,11 @@ inp_leave_group(struct inpcb *inp, struct sockopt *sop
 		 * XXX NOTE WELL: The RFC 3678 API is preferred because
 		 * using an IPv4 address as a key is racy.
 		 */
-		if (!in_nullhost(mreqs.imr_interface))
+		if (!in_nullhost(mreqs.imr_interface)) {
+			IN_IFADDR_RLOCK();
 			INADDR_TO_IFP(mreqs.imr_interface, ifp);
-
+			IN_IFADDR_RUNLOCK();
+		}
 		CTR3(KTR_IGMPV3, "%s: imr_interface = %s, ifp = %p",
 		    __func__, inet_ntoa(mreqs.imr_interface), ifp);
 
@@ -2447,7 +2452,9 @@ inp_set_multicast_if(struct inpcb *inp, struct sockopt
 		if (in_nullhost(addr)) {
 			ifp = NULL;
 		} else {
+			IN_IFADDR_RLOCK();
 			INADDR_TO_IFP(addr, ifp);
+			IN_IFADDR_RUNLOCK();
 			if (ifp == NULL)
 				return (EADDRNOTAVAIL);
 		}

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201811261151.wAQBpi3v041072>