2d5c48eccd
All callers of sctp_aloc_assoc() mark the PCB as connected after a successful call (for one-to-one-style sockets). In all cases this is done without the PCB lock, so the PCB's flags can be corrupted. We also do not atomically check whether a one-to-one-style socket is a listening socket, which violates various assumptions in solisten_proto(). We need to hold the PCB lock across all of sctp_aloc_assoc() to fix this. In order to do that without introducing lock order reversals, we have to hold the global info lock as well. So: - Convert sctp_aloc_assoc() so that the inp and info locks are consistently held. It returns with the association lock held, as before. - Fix an apparent bug where we failed to remove an association from a global hash if sctp_add_remote_addr() fails. - sctp_select_a_tag() is called when initializing an association, and it acquires the global info lock. To avoid lock recursion, push locking into its callers. - Introduce sctp_aloc_assoc_connected(), which atomically checks for a listening socket and sets SCTP_PCB_FLAGS_CONNECTED. There is still one edge case in sctp_process_cookie_new() where we do not update PCB/socket state correctly. Reviewed by: tuexen MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D31908 |
||
|---|---|---|
| .. | ||
| dest6.c | ||
| frag6.c | ||
| icmp6.c | ||
| icmp6.h | ||
| in6_cksum.c | ||
| in6_fib_algo.c | ||
| in6_fib.c | ||
| in6_fib.h | ||
| in6_gif.c | ||
| in6_ifattach.c | ||
| in6_ifattach.h | ||
| in6_jail.c | ||
| in6_mcast.c | ||
| in6_pcb.c | ||
| in6_pcb.h | ||
| in6_pcbgroup.c | ||
| in6_proto.c | ||
| in6_rmx.c | ||
| in6_rss.c | ||
| in6_rss.h | ||
| in6_src.c | ||
| in6_var.h | ||
| in6.c | ||
| in6.h | ||
| ip6_ecn.h | ||
| ip6_fastfwd.c | ||
| ip6_forward.c | ||
| ip6_gre.c | ||
| ip6_id.c | ||
| ip6_input.c | ||
| ip6_mroute.c | ||
| ip6_mroute.h | ||
| ip6_output.c | ||
| ip6_var.h | ||
| ip6.h | ||
| ip6protosw.h | ||
| ip_fw_nat64.h | ||
| ip_fw_nptv6.h | ||
| mld6_var.h | ||
| mld6.c | ||
| mld6.h | ||
| nd6_nbr.c | ||
| nd6_rtr.c | ||
| nd6.c | ||
| nd6.h | ||
| pim6_var.h | ||
| pim6.h | ||
| raw_ip6.c | ||
| raw_ip6.h | ||
| route6.c | ||
| scope6_var.h | ||
| scope6.c | ||
| sctp6_usrreq.c | ||
| sctp6_var.h | ||
| send.c | ||
| send.h | ||
| tcp6_var.h | ||
| udp6_usrreq.c | ||
| udp6_var.h | ||