d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve locking when tearing down an SCTP association.

Browse Source 
This is joint work with rrs@ and the issue was found by
syzkaller.

MFC after:		1 week
This commit is contained in:
Michael Tuexen 2019-03-25 15:23:20 +00:00
parent d7c5dccd66
commit 689ed08920
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/sctp_pcb.c
View File

@ -4982,6 +4982,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
* in case. * in case.
*/ */
/* anything on the wheel needs to be removed */ /* anything on the wheel needs to be removed */
SCTP_TCB_SEND_LOCK(stcb);
for (i = 0; i < asoc->streamoutcnt; i++) { for (i = 0; i < asoc->streamoutcnt; i++) {
struct sctp_stream_out *outs; struct sctp_stream_out *outs;
@ -4990,7 +4991,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) { TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
atomic_subtract_int(&asoc->stream_queue_cnt, 1); atomic_subtract_int(&asoc->stream_queue_cnt, 1);
TAILQ_REMOVE(&outs->outqueue, sp, next); TAILQ_REMOVE(&outs->outqueue, sp, next);
stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 0); stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
sctp_free_spbufspace(stcb, asoc, sp); sctp_free_spbufspace(stcb, asoc, sp);
if (sp->data) { if (sp->data) {
if (so) { if (so) {
@ -5012,6 +5013,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED); sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
} }
} }
SCTP_TCB_SEND_UNLOCK(stcb);
/* sa_ignore FREED_MEMORY */ /* sa_ignore FREED_MEMORY */
TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) { TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp); TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);