d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Plug possible calls into ip6?_output() without network epoch from SCTP

Browse Source 
bluntly adding epoch entrance into the macro that SCTP uses to call
ip6?_output().  This definitely will introduce several epoch recursions.

Reported by:	https://syzkaller.appspot.com/bug?id=79f03f574594a5be464997310896765c458ed80a
Reported by:	https://syzkaller.appspot.com/bug?id=07c6f52106cddbe356cc2b2f3664a1c51cc0dadf
This commit is contained in:
Gleb Smirnoff 2020-01-22 17:19:53 +00:00
parent e617b21d2f
commit a3b0db5b0a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=356989
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/netinet/sctp_os_bsd.h
View File

@ -412,6 +412,7 @@ typedef struct rtentry sctp_rtentry_t;
*/
#define SCTP_IP_OUTPUT(result, o_pak, ro, stcb, vrf_id) \
{ \
struct epoch_tracker et; \
int o_flgs = IP_RAWOUTPUT; \
struct sctp_tcb *local_stcb = stcb; \
if (local_stcb && \
@ -419,19 +420,24 @@ typedef struct rtentry sctp_rtentry_t;
local_stcb->sctp_ep->sctp_socket) \
o_flgs |= local_stcb->sctp_ep->sctp_socket->so_options & SO_DONTROUTE; \
m_clrprotoflags(o_pak); \
NET_EPOCH_ENTER(et); \
result = ip_output(o_pak, NULL, ro, o_flgs, 0, NULL); \
NET_EPOCH_EXIT(et); \
}
#define SCTP_IP6_OUTPUT(result, o_pak, ro, ifp, stcb, vrf_id) \
{ \
struct epoch_tracker et; \
struct sctp_tcb *local_stcb = stcb; \
m_clrprotoflags(o_pak); \
NET_EPOCH_ENTER(et); \
if (local_stcb && local_stcb->sctp_ep) \
result = ip6_output(o_pak, \
((struct inpcb *)(local_stcb->sctp_ep))->in6p_outputopts, \
(ro), 0, 0, ifp, NULL); \
else \
result = ip6_output(o_pak, NULL, (ro), 0, 0, ifp, NULL); \
NET_EPOCH_EXIT(et); \
}
struct mbuf *