Date: Thu, 16 May 2019 09:28:34 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r347678 - stable/11/sys/netinet Message-ID: <201905160928.x4G9SY6n046011@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Thu May 16 09:28:34 2019 New Revision: 347678 URL: https://svnweb.freebsd.org/changeset/base/347678 Log: MFC r345504: Improve locking when tearing down an SCTP association. This is joint work with rrs@ and the issue was found by syzkaller. Modified: stable/11/sys/netinet/sctp_pcb.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/netinet/sctp_pcb.c ============================================================================== --- stable/11/sys/netinet/sctp_pcb.c Thu May 16 09:27:13 2019 (r347677) +++ stable/11/sys/netinet/sctp_pcb.c Thu May 16 09:28:34 2019 (r347678) @@ -4981,6 +4981,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc * in case. */ /* anything on the wheel needs to be removed */ + SCTP_TCB_SEND_LOCK(stcb); for (i = 0; i < asoc->streamoutcnt; i++) { struct sctp_stream_out *outs; @@ -4989,7 +4990,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { atomic_subtract_int(&asoc->stream_queue_cnt, 1); TAILQ_REMOVE(&outs->outqueue, sp, next); - stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 0); + stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1); sctp_free_spbufspace(stcb, asoc, sp); if (sp->data) { if (so) { @@ -5011,6 +5012,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); } } + SCTP_TCB_SEND_UNLOCK(stcb); /* sa_ignore FREED_MEMORY */ TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) { TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905160928.x4G9SY6n046011>