d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tcp: Fix a locking issue related to logging

Browse Source 
tcp_respond() is sometimes called with only a read lock.
The logging however, requires a write lock. So either
try to upgrade the lock if needed, or don't log the packet.

Reported by:		syzbot+8151ef969c170f76706b@syzkaller.appspotmail.com
Reported by:		syzbot+eb679adb3304c511c1e4@syzkaller.appspotmail.com
Reviewed by:		markj, rrs
Sponsored by:		Netflix, Inc.
Differential Revision:	https://reviews.freebsd.org/D32983
This commit is contained in:
Michael Tuexen 2021-11-14 14:56:43 +01:00
parent c200441872
commit 2f62f92e37
1 changed files with 23 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
sys/netinet/tcp_subr.c
View File

@ -1755,7 +1755,7 @@ tcp_respond(struct tcpcb *tp, void *ipgen, struct tcphdr *th, struct mbuf *m,
int isipv6;
#endif /* INET6 */
int optlen, tlen, win, ulen;
bool incl_opts;
bool incl_opts, lock_upgraded;
uint16_t port;
int output_ret;
@ -2088,21 +2088,29 @@ tcp_respond(struct tcpcb *tp, void *ipgen, struct tcphdr *th, struct mbuf *m,
TCP_PROBE3(debug__output, tp, th, m);
if (flags & TH_RST)
TCP_PROBE5(accept__refused, NULL, NULL, m, tp, nth);
lock_upgraded = false;
lgb = NULL;
if ((tp != NULL) && (tp->t_logstate != TCP_LOG_STATE_OFF)) {
union tcp_log_stackspecific log;
struct timeval tv;
memset(&log.u_bbr, 0, sizeof(log.u_bbr));
log.u_bbr.inhpts = tp->t_inpcb->inp_in_hpts;
log.u_bbr.ininput = tp->t_inpcb->inp_in_input;
log.u_bbr.flex8 = 4;
log.u_bbr.pkts_out = tp->t_maxseg;
log.u_bbr.timeStamp = tcp_get_usecs(&tv);
log.u_bbr.delivered = 0;
lgb = tcp_log_event_(tp, nth, NULL, NULL, TCP_LOG_OUT, ERRNO_UNK,
0, &log, false, NULL, NULL, 0, &tv);
} else
lgb = NULL;
lock_upgraded = !INP_WLOCKED(inp) && INP_TRY_UPGRADE(inp);
/*
*`If we don't already own the write lock and can't upgrade,
* just don't log the event, but still send the response.
*/
if (INP_WLOCKED(inp)) {
memset(&log.u_bbr, 0, sizeof(log.u_bbr));
log.u_bbr.inhpts = tp->t_inpcb->inp_in_hpts;
log.u_bbr.ininput = tp->t_inpcb->inp_in_input;
log.u_bbr.flex8 = 4;
log.u_bbr.pkts_out = tp->t_maxseg;
log.u_bbr.timeStamp = tcp_get_usecs(&tv);
log.u_bbr.delivered = 0;
lgb = tcp_log_event_(tp, nth, NULL, NULL, TCP_LOG_OUT, ERRNO_UNK,
0, &log, false, NULL, NULL, 0, &tv);
}
}
#ifdef INET6
if (isipv6) {
@ -2119,10 +2127,10 @@ tcp_respond(struct tcpcb *tp, void *ipgen, struct tcphdr *th, struct mbuf *m,
output_ret = ip_output(m, NULL, NULL, 0, NULL, inp);
}
#endif
if (lgb) {
if (lgb != NULL)
lgb->tlb_errno = output_ret;
lgb = NULL;
}
if (lock_upgraded)
INP_DOWNGRADE(inp);
}
/*