From 292410a6b8e787b12658c7d87f2bbaeeb273723a Mon Sep 17 00:00:00 2001
From: rwatson <rwatson@FreeBSD.org>
Date: Tue, 15 Jun 2004 04:13:59 +0000
Subject: [PATCH] Lock down rawcb_list, a global list of control blocks for raw
 sockets, using rawcb_mtx.  Hold this mutex while modifying or iterating over
 the control list; this means that the mutex is held over calls into socket
 delivery code, which no longer causes a lock order reversal as the routing
 socket code uses a netisr to avoid recursing socket -> routing -> socket.

Note: Locking of IPsec consumers of rawcb_list is not included in this
commit.
---
 sys/net/raw_cb.c     | 3 +++
 sys/net/raw_cb.h     | 1 +
 sys/net/raw_usrreq.c | 6 ++++++
 3 files changed, 10 insertions(+)

diff --git a/sys/net/raw_cb.c b/sys/net/raw_cb.c
index 1e293af01f3a..04b45163a3ba 100644
--- a/sys/net/raw_cb.c
+++ b/sys/net/raw_cb.c
@@ -51,6 +51,7 @@
  *	redo address binding to allow wildcards
  */
 
+struct mtx rawcb_mtx;
 struct rawcb_list_head rawcb_list;
 
 const static u_long	raw_sendspace = RAWSNDQ;
@@ -81,7 +82,9 @@ raw_attach(so, proto)
 	rp->rcb_socket = so;
 	rp->rcb_proto.sp_family = so->so_proto->pr_domain->dom_family;
 	rp->rcb_proto.sp_protocol = proto;
+	mtx_lock(&rawcb_mtx);
 	LIST_INSERT_HEAD(&rawcb_list, rp, list);
+	mtx_unlock(&rawcb_mtx);
 	return (0);
 }
 
diff --git a/sys/net/raw_cb.h b/sys/net/raw_cb.h
index 22b100bca759..177dedff6ae2 100644
--- a/sys/net/raw_cb.h
+++ b/sys/net/raw_cb.h
@@ -57,6 +57,7 @@ struct rawcb {
 
 #ifdef _KERNEL
 extern LIST_HEAD(rawcb_list_head, rawcb) rawcb_list;
+extern struct mtx rawcb_mtx;
 
 /* protosw entries */
 pr_ctlinput_t	raw_ctlinput;
diff --git a/sys/net/raw_usrreq.c b/sys/net/raw_usrreq.c
index 95072677b9b3..7517743dfa86 100644
--- a/sys/net/raw_usrreq.c
+++ b/sys/net/raw_usrreq.c
@@ -31,6 +31,7 @@
  */
 
 #include <sys/param.h>
+#include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
@@ -44,12 +45,15 @@
 
 #include <net/raw_cb.h>
 
+MTX_SYSINIT(rawcb_mtx, &rawcb_mtx, "rawcb", MTX_DEF);
+
 /*
  * Initialize raw connection block q.
  */
 void
 raw_init()
 {
+
 	LIST_INIT(&rawcb_list);
 }
 
@@ -73,6 +77,7 @@ raw_input(m0, proto, src, dst)
 	struct socket *last;
 
 	last = 0;
+	mtx_lock(&rawcb_mtx);
 	LIST_FOREACH(rp, &rawcb_list, list) {
 		if (rp->rcb_proto.sp_family != proto->sp_family)
 			continue;
@@ -117,6 +122,7 @@ raw_input(m0, proto, src, dst)
 		}
 	} else
 		m_freem(m);
+	mtx_unlock(&rawcb_mtx);
 }
 
 /*ARGSUSED*/