cvs commit: src/sys/kern kern_descrip.c uipc_socket.c uipc_usrreq.c src/sys/net raw_cb.c raw_usrreq.c src/sys/netatalk ddp_pcb.c src/sys/netatm atm_socket.cng_btsocket_l2cap.c ...

[Robert Watson]

rwatson     2004-10-20 12:42:56 UTC

  FreeBSD src repository

  Modified files:        (Branch: RELENG_5)
    sys/kern             kern_descrip.c uipc_socket.c 
                         uipc_usrreq.c 
    sys/net              raw_cb.c raw_usrreq.c 
    sys/netatalk         ddp_pcb.c 
    sys/netatm           atm_socket.c 
    sys/netgraph/bluetooth/socket ng_btsocket_hci_raw.c 
                                  ng_btsocket_l2cap.c 
                                  ng_btsocket_l2cap_raw.c 
                                  ng_btsocket_rfcomm.c 
    sys/netinet          in_pcb.c tcp_subr.c 
    sys/netinet6         in6_pcb.c 
    sys/netipx           ipx_pcb.c ipx_usrreq.c 
    sys/netnatm          natm.c 
    sys/sys              socketvar.h 
  Log:
  Merge kern_descrip.c:1.246, uipc_socket.c:1.214, uipc_usrreq.c:1.141,
  raw_cb.c:1.30, raw_usrreq.c:1.35, ddp_pcb.c:1.45, atm_socket.c:1.21,
  ng_btsocket_hci_raw.c:1.16, ng_btsocket_l2cap.c:1.14,
  ng_btsocket_l2cap_raw.c:1.13, ng_btsocket_rfcomm.c:1.13, in_pcb.c:1.156,
  tcp_subr.c:1.205, in6_pcb.c:1.61, ipx_pcb.c:1.29, ipx_usrreq.c:1.41,
  natm.c:1.35, socketvar.h:1.135 from HEAD to RELENG_5:
  
    Push acquisition of the accept mutex out of sofree() into the caller
    (sorele()/sotryfree()):
  
    - This permits the caller to acquire the accept mutex before the socket
      mutex, avoiding sofree() having to drop the socket mutex and re-order,
      which could lead to races permitting more than one thread to enter
      sofree() after a socket is ready to be free'd.
  
    - This also covers clearing of the so_pcb weak socket reference from
      the protocol to the socket, preventing races in clearing and
      evaluation of the reference such that sofree() might be called more
      than once on the same socket.
  
    This appears to close a race I was able to easily trigger by repeatedly
    opening and resetting TCP connections to a host, in which the
    tcp_close() code called as a result of the RST raced with the close()
    of the accepted socket in the user process resulting in simultaneous
    attempts to de-allocate the same socket.  The new locking increases
    the overhead for operations that may potentially free the socket, so we
    will want to revise the synchronization strategy here as we normalize
    the reference counting model for sockets.  The use of the accept mutex
    in freeing of sockets that are not listen sockets is primarily
    motivated by the potential need to remove the socket from the
    incomplete connection queue on its parent (listen) socket, so cleaning
    up the reference model here may allow us to substantially weaken the
    synchronization requirements.
  
    RELENG_5_3 candidate.
  
    MFC after:      3 days
    Reviewed by:    dwhite
    Discussed with: gnn, dwhite, green
    Reported by:    Marc UBM Bocklet <ubm at u-boot-man dot de>
    Reported by:    Vlad <marchenko at gmail dot com>
  
  MFC after:      1 day
  Approved by:    re (scottl)
  
  Revision   Changes    Path
  1.243.2.3  +1 -0      src/sys/kern/kern_descrip.c
  1.208.2.4  +4 -3      src/sys/kern/uipc_socket.c
  1.138.2.3  +1 -0      src/sys/kern/uipc_usrreq.c
  1.29.2.1   +1 -0      src/sys/net/raw_cb.c
  1.34.2.1   +1 -0      src/sys/net/raw_usrreq.c
  1.44.2.1   +1 -0      src/sys/netatalk/ddp_pcb.c
  1.20.2.1   +1 -0      src/sys/netatm/atm_socket.c
  1.15.2.1   +1 -0      src/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
  1.13.2.1   +2 -0      src/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
  1.12.2.1   +1 -0      src/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap_raw.c
  1.12.2.1   +1 -0      src/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
  1.153.2.2  +1 -0      src/sys/netinet/in_pcb.c
  1.201.2.2  +1 -0      src/sys/netinet/tcp_subr.c
  1.59.2.2   +1 -0      src/sys/netinet6/in6_pcb.c
  1.28.2.1   +1 -0      src/sys/netipx/ipx_pcb.c
  1.40.2.1   +1 -0      src/sys/netipx/ipx_usrreq.c
  1.34.2.1   +2 -0      src/sys/netnatm/natm.c
  1.133.2.2  +10 -2     src/sys/sys/socketvar.h