Author: tuexen
Date: Thu May 16 09:28:34 2019
New Revision: 347678
URL: https://svnweb.freebsd.org/changeset/base/347678
Log:
MFC r345504:
Improve locking when tearing down an SCTP association.
This is joint work with rrs@ and the issue was found by
syzkaller.
Modified:
stable/11/sys/netinet/sctp_pcb.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/11/sys/netinet/sctp_pcb.c Thu May 16 09:27:13 2019
(r347677)
+++ stable/11/sys/netinet/sctp_pcb.c Thu May 16 09:28:34 2019
(r347678)
@@ -4981,6 +4981,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
* in case.
*/
/* anything on the wheel needs to be removed */
+ SCTP_TCB_SEND_LOCK(stcb);
for (i = 0; i < asoc->streamoutcnt; i++) {
struct sctp_stream_out *outs;
@@ -4989,7 +4990,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
atomic_subtract_int(&asoc->stream_queue_cnt, 1);
TAILQ_REMOVE(&outs->outqueue, sp, next);
-
stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 0);
+
stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
sctp_free_spbufspace(stcb, asoc, sp);
if (sp->data) {
if (so) {
@@ -5011,6 +5012,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
}
}
+ SCTP_TCB_SEND_UNLOCK(stcb);
/* sa_ignore FREED_MEMORY */
TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
