d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

o Fix INP lock leak in the minttl case

Browse Source 
o Remove indirection in the decision of unlocking inp
o Further annotation of locking in tcp_input()
This commit is contained in:
Andre Oppermann 2007-04-23 19:41:47 +00:00
parent b77d604841
commit 9fa198bead
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=168986
2 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/netinet/tcp_input.c
View File

@ -751,9 +751,9 @@ tcp_input(struct mbuf *m, int off0)
if (inp->inp_vflag & INP_TIMEWAIT) {
if (thflags & TH_SYN)
tcp_dooptions(&to, optp, optlen, TO_SYN);
/* NB: tcp_timewait unlocks the INP and frees the mbuf. */
if (tcp_timewait(inp, &to, th, m, tlen))
goto findpcb;
/* tcp_timewait unlocks inp. */
INP_INFO_WUNLOCK(&tcbinfo);
return;
}
@ -764,7 +764,6 @@ tcp_input(struct mbuf *m, int off0)
*/
tp = intotcpcb(inp);
if (tp == NULL) {
INP_UNLOCK(inp);
rstreason = BANDLIM_RST_CLOSEDPORT;
goto dropwithreset;
}
@ -833,6 +832,10 @@ tcp_input(struct mbuf *m, int off0)
* timestamp.
*/
tcp_dooptions(&to, optp, optlen, 0);
/*
* NB: syncache_expand() doesn't unlock
* inp and tcpinfo locks.
*/
if (!syncache_expand(&inc, &to, th, &so, m)) {
/*
* No syncache entry or ACK was not
@ -925,8 +928,6 @@ tcp_input(struct mbuf *m, int off0)
if ((ia6 = ip6_getdstifaddr(m)) &&
(ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
INP_UNLOCK(inp);
tp = NULL;
rstreason = BANDLIM_RST_OPENPORT;
goto dropwithreset;
}
@ -998,7 +999,7 @@ tcp_input(struct mbuf *m, int off0)
m = NULL; /* mbuf chain got consumed. */
dropunlock:
INP_INFO_WLOCK_ASSERT(&tcbinfo);
if (tp != NULL)
if (inp != NULL)
INP_UNLOCK(inp);
INP_INFO_WUNLOCK(&tcbinfo);
drop:

11
sys/netinet/tcp_reass.c
View File

@ -751,9 +751,9 @@ tcp_input(struct mbuf *m, int off0)
if (inp->inp_vflag & INP_TIMEWAIT) {
if (thflags & TH_SYN)
tcp_dooptions(&to, optp, optlen, TO_SYN);
/* NB: tcp_timewait unlocks the INP and frees the mbuf. */
if (tcp_timewait(inp, &to, th, m, tlen))
goto findpcb;
/* tcp_timewait unlocks inp. */
INP_INFO_WUNLOCK(&tcbinfo);
return;
}
@ -764,7 +764,6 @@ tcp_input(struct mbuf *m, int off0)
*/
tp = intotcpcb(inp);
if (tp == NULL) {
INP_UNLOCK(inp);
rstreason = BANDLIM_RST_CLOSEDPORT;
goto dropwithreset;
}
@ -833,6 +832,10 @@ tcp_input(struct mbuf *m, int off0)
* timestamp.
*/
tcp_dooptions(&to, optp, optlen, 0);
/*
* NB: syncache_expand() doesn't unlock
* inp and tcpinfo locks.
*/
if (!syncache_expand(&inc, &to, th, &so, m)) {
/*
* No syncache entry or ACK was not
@ -925,8 +928,6 @@ tcp_input(struct mbuf *m, int off0)
if ((ia6 = ip6_getdstifaddr(m)) &&
(ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
INP_UNLOCK(inp);
tp = NULL;
rstreason = BANDLIM_RST_OPENPORT;
goto dropwithreset;
}
@ -998,7 +999,7 @@ tcp_input(struct mbuf *m, int off0)
m = NULL; /* mbuf chain got consumed. */
dropunlock:
INP_INFO_WLOCK_ASSERT(&tcbinfo);
if (tp != NULL)
if (inp != NULL)
INP_UNLOCK(inp);
INP_INFO_WUNLOCK(&tcbinfo);
drop: