d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MfP4 CH182763 (original version):

Browse Source 
Make it harder to exploit certain in_control() related races between the
intiial lookup at the beginning and the time we will remove the entry
from the lists by re-checking that entry is still in the list before
trying to remove it.

(*) It is believed that with the current code and locking strategy we
    cannot completely fix all race.

Reported by:	Nima Misaghian (nima_misa hotmail.com) on net@ 20100817
Tested by:	Nima Misaghian (nima_misa hotmail.com) (original version)
PR:		kern/146250
Submitted by:	Mikolaj Golub (to.my.trociny gmail.com) (different version)
MFC after:	1 week
This commit is contained in:
Bjoern A. Zeeb 2010-10-16 19:53:22 +00:00
parent 0aa99d33b5
commit 12112cf676
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/netinet/in.c
View File

@ -599,6 +599,21 @@ in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
}
IF_ADDR_LOCK(ifp);
/* Re-check that ia is still part of the list. */
TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
if (ifa == &ia->ia_ifa)
break;
}
if (ifa == NULL) {
/*
* If we lost the race with another thread, there is no need to
* try it again for the next loop as there is no other exit
* path between here and out.
*/
IF_ADDR_UNLOCK(ifp);
error = EADDRNOTAVAIL;
goto out;
}
TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link);
IF_ADDR_UNLOCK(ifp);
ifa_free(&ia->ia_ifa); /* if_addrhead */