Date: Sat, 4 May 2019 12:54:24 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r347118 - stable/12/sys/netinet Message-ID: <201905041254.x44CsOcQ088261@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Sat May 4 12:54:24 2019 New Revision: 347118 URL: https://svnweb.freebsd.org/changeset/base/347118 Log: MFC r345504: Improve locking when tearing down an SCTP association. This is joint work with rrs@ and the issue was found by syzkaller. Modified: stable/12/sys/netinet/sctp_pcb.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/netinet/sctp_pcb.c ============================================================================== --- stable/12/sys/netinet/sctp_pcb.c Sat May 4 12:52:24 2019 (r347117) +++ stable/12/sys/netinet/sctp_pcb.c Sat May 4 12:54:24 2019 (r347118) @@ -4982,6 +4982,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc * in case. */ /* anything on the wheel needs to be removed */ + SCTP_TCB_SEND_LOCK(stcb); for (i = 0; i < asoc->streamoutcnt; i++) { struct sctp_stream_out *outs; @@ -4990,7 +4991,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { atomic_subtract_int(&asoc->stream_queue_cnt, 1); TAILQ_REMOVE(&outs->outqueue, sp, next); - stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 0); + stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1); sctp_free_spbufspace(stcb, asoc, sp); if (sp->data) { if (so) { @@ -5012,6 +5013,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); } } + SCTP_TCB_SEND_UNLOCK(stcb); /* sa_ignore FREED_MEMORY */ TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) { TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905041254.x44CsOcQ088261>