> On 22. Jan 2020, at 18:19, Gleb Smirnoff <gleb...@freebsd.org> wrote:
>
> Author: glebius
> Date: Wed Jan 22 17:19:53 2020
> New Revision: 356989
> URL: https://svnweb.freebsd.org/changeset/base/356989
>
> Log:
> Plug possible calls into ip6?_output() without network epoch from SCTP
> bluntly adding epoch entrance into the macro that SCTP uses to call
> ip6?_output(). This definitely will introduce several epoch recursions.
Can you specify under which condition NET_EPOCH_ENTER() should be called?
Then I can try to figure out where these calls need to be made in the
SCTP code.
Best regards
Michael
>
> Reported by:
> https://syzkaller.appspot.com/bug?id=79f03f574594a5be464997310896765c458ed80a
> Reported by:
> https://syzkaller.appspot.com/bug?id=07c6f52106cddbe356cc2b2f3664a1c51cc0dadf
>
> Modified:
> head/sys/netinet/sctp_os_bsd.h
>
> Modified: head/sys/netinet/sctp_os_bsd.h
> ==============================================================================
> --- head/sys/netinet/sctp_os_bsd.h Wed Jan 22 17:06:55 2020
> (r356988)
> +++ head/sys/netinet/sctp_os_bsd.h Wed Jan 22 17:19:53 2020
> (r356989)
> @@ -412,6 +412,7 @@ typedef struct rtentry sctp_rtentry_t;
> */
> #define SCTP_IP_OUTPUT(result, o_pak, ro, stcb, vrf_id) \
> { \
> + struct epoch_tracker et; \
> int o_flgs = IP_RAWOUTPUT; \
> struct sctp_tcb *local_stcb = stcb; \
> if (local_stcb && \
> @@ -419,19 +420,24 @@ typedef struct rtentry sctp_rtentry_t;
> local_stcb->sctp_ep->sctp_socket) \
> o_flgs |= local_stcb->sctp_ep->sctp_socket->so_options &
> SO_DONTROUTE; \
> m_clrprotoflags(o_pak); \
> + NET_EPOCH_ENTER(et); \
> result = ip_output(o_pak, NULL, ro, o_flgs, 0, NULL); \
> + NET_EPOCH_EXIT(et); \
> }
>
> #define SCTP_IP6_OUTPUT(result, o_pak, ro, ifp, stcb, vrf_id) \
> { \
> + struct epoch_tracker et; \
> struct sctp_tcb *local_stcb = stcb; \
> m_clrprotoflags(o_pak); \
> + NET_EPOCH_ENTER(et); \
> if (local_stcb && local_stcb->sctp_ep) \
> result = ip6_output(o_pak, \
> ((struct inpcb
> *)(local_stcb->sctp_ep))->in6p_outputopts, \
> (ro), 0, 0, ifp, NULL); \
> else \
> result = ip6_output(o_pak, NULL, (ro), 0, 0, ifp, NULL); \
> + NET_EPOCH_EXIT(et); \
> }
>
> struct mbuf *
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
