81158452be
(sorele()/sotryfree()): - This permits the caller to acquire the accept mutex before the socket mutex, avoiding sofree() having to drop the socket mutex and re-order, which could lead to races permitting more than one thread to enter sofree() after a socket is ready to be free'd. - This also covers clearing of the so_pcb weak socket reference from the protocol to the socket, preventing races in clearing and evaluation of the reference such that sofree() might be called more than once on the same socket. This appears to close a race I was able to easily trigger by repeatedly opening and resetting TCP connections to a host, in which the tcp_close() code called as a result of the RST raced with the close() of the accepted socket in the user process resulting in simultaneous attempts to de-allocate the same socket. The new locking increases the overhead for operations that may potentially free the socket, so we will want to revise the synchronization strategy here as we normalize the reference counting model for sockets. The use of the accept mutex in freeing of sockets that are not listen sockets is primarily motivated by the potential need to remove the socket from the incomplete connection queue on its parent (listen) socket, so cleaning up the reference model here may allow us to substantially weaken the synchronization requirements. RELENG_5_3 candidate. MFC after: 3 days Reviewed by: dwhite Discussed with: gnn, dwhite, green Reported by: Marc UBM Bocklet <ubm at u-boot-man dot de> Reported by: Vlad <marchenko at gmail dot com>
150 lines
3.9 KiB
C
150 lines
3.9 KiB
C
/*
|
|
* Copyright (c) 1980, 1986, 1993
|
|
* The Regents of the University of California. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* @(#)raw_cb.c 8.1 (Berkeley) 6/10/93
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#include <sys/param.h>
|
|
#include <sys/domain.h>
|
|
#include <sys/lock.h>
|
|
#include <sys/malloc.h>
|
|
#include <sys/mutex.h>
|
|
#include <sys/protosw.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/socketvar.h>
|
|
#include <sys/systm.h>
|
|
|
|
#include <net/raw_cb.h>
|
|
|
|
/*
|
|
* Routines to manage the raw protocol control blocks.
|
|
*
|
|
* TODO:
|
|
* hash lookups by protocol family/protocol + address family
|
|
* take care of unique address problems per AF?
|
|
* redo address binding to allow wildcards
|
|
*/
|
|
|
|
struct mtx rawcb_mtx;
|
|
struct rawcb_list_head rawcb_list;
|
|
|
|
const static u_long raw_sendspace = RAWSNDQ;
|
|
const static u_long raw_recvspace = RAWRCVQ;
|
|
|
|
/*
|
|
* Allocate a control block and a nominal amount
|
|
* of buffer space for the socket.
|
|
*/
|
|
int
|
|
raw_attach(so, proto)
|
|
register struct socket *so;
|
|
int proto;
|
|
{
|
|
register struct rawcb *rp = sotorawcb(so);
|
|
int error;
|
|
|
|
/*
|
|
* It is assumed that raw_attach is called
|
|
* after space has been allocated for the
|
|
* rawcb.
|
|
*/
|
|
if (rp == 0)
|
|
return (ENOBUFS);
|
|
error = soreserve(so, raw_sendspace, raw_recvspace);
|
|
if (error)
|
|
return (error);
|
|
rp->rcb_socket = so;
|
|
rp->rcb_proto.sp_family = so->so_proto->pr_domain->dom_family;
|
|
rp->rcb_proto.sp_protocol = proto;
|
|
mtx_lock(&rawcb_mtx);
|
|
LIST_INSERT_HEAD(&rawcb_list, rp, list);
|
|
mtx_unlock(&rawcb_mtx);
|
|
return (0);
|
|
}
|
|
|
|
/*
|
|
* Detach the raw connection block and discard
|
|
* socket resources.
|
|
*/
|
|
void
|
|
raw_detach(rp)
|
|
register struct rawcb *rp;
|
|
{
|
|
struct socket *so = rp->rcb_socket;
|
|
|
|
ACCEPT_LOCK();
|
|
SOCK_LOCK(so);
|
|
so->so_pcb = 0;
|
|
sotryfree(so);
|
|
LIST_REMOVE(rp, list);
|
|
#ifdef notdef
|
|
if (rp->rcb_laddr)
|
|
m_freem(dtom(rp->rcb_laddr));
|
|
rp->rcb_laddr = 0;
|
|
#endif
|
|
free((caddr_t)(rp), M_PCB);
|
|
}
|
|
|
|
/*
|
|
* Disconnect and possibly release resources.
|
|
*/
|
|
void
|
|
raw_disconnect(rp)
|
|
struct rawcb *rp;
|
|
{
|
|
|
|
#ifdef notdef
|
|
if (rp->rcb_faddr)
|
|
m_freem(dtom(rp->rcb_faddr));
|
|
rp->rcb_faddr = 0;
|
|
#endif
|
|
if (rp->rcb_socket->so_state & SS_NOFDREF)
|
|
raw_detach(rp);
|
|
}
|
|
|
|
#ifdef notdef
|
|
#include <sys/mbuf.h>
|
|
|
|
int
|
|
raw_bind(so, nam)
|
|
register struct socket *so;
|
|
struct mbuf *nam;
|
|
{
|
|
struct sockaddr *addr = mtod(nam, struct sockaddr *);
|
|
register struct rawcb *rp;
|
|
|
|
if (ifnet == 0)
|
|
return (EADDRNOTAVAIL);
|
|
rp = sotorawcb(so);
|
|
nam = m_copym(nam, 0, M_COPYALL, M_TRYWAIT);
|
|
rp->rcb_laddr = mtod(nam, struct sockaddr *);
|
|
return (0);
|
|
}
|
|
#endif
|