Author: jhb
Date: Mon Apr 8 19:03:01 2013
New Revision: 249263
URL: http://svnweb.freebsd.org/changeset/base/249263
Log:
Fix a potential socket leak in the NFS server. If a client closes its
connection after it was accepted by the userland nfsd process but before
it was handled off to svc_vc_create() in the kernel, then svc_vc_create()
would see it as a new listen socket and try to listen on it leaving a
dangling reference to the socket. Instead, check for disconnected sockets
and treat them like a connected socket. The call to pru_getaddr() should
fail and cause svc_vc_create() to fail. Note that we need to lock the
socket to get a consistent snapshot of so_state since there is a window
in soisdisconnected() where both flags are clear.
Reviewed by: dfr, rmacklem
MFC after: 1 week
Modified:
head/sys/rpc/svc_vc.c
Modified: head/sys/rpc/svc_vc.c
==============================================================================
--- head/sys/rpc/svc_vc.c Mon Apr 8 18:46:35 2013 (r249262)
+++ head/sys/rpc/svc_vc.c Mon Apr 8 19:03:01 2013 (r249263)
@@ -146,7 +146,9 @@ svc_vc_create(SVCPOOL *pool, struct sock
struct sockaddr* sa;
int error;
- if (so->so_state & SS_ISCONNECTED) {
+ SOCK_LOCK(so);
+ if (so->so_state & (SS_ISCONNECTED|SS_ISDISCONNECTED)) {
+ SOCK_UNLOCK(so);
error = so->so_proto->pr_usrreqs->pru_peeraddr(so, &sa);
if (error)
return (NULL);
@@ -154,6 +156,7 @@ svc_vc_create(SVCPOOL *pool, struct sock
free(sa, M_SONAME);
return (xprt);
}
+ SOCK_UNLOCK(so);
xprt = svc_xprt_alloc();
sx_init(&xprt->xp_lock, "xprt->xp_lock");
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
