cvs commit: src/sys/netinet tcp_input.c

[Robert Watson]

rwatson     2008-09-24 11:07:03 UTC

  FreeBSD src repository

  Modified files:
    sys/netinet          tcp_input.c 
  Log:
  SVN rev 183323 on 2008-09-24 11:07:03Z by rwatson
  
  When dropping a packet and issuing a reset during TCP segment handling,
  unconditionally drop the tcbinfo lock (after all, we assert it lines
  before), but call tcp_dropwithreset() under both inpcb and inpcbinfo
  locks only if we pass in an tcpcb.  Otherwise, if the pointer is NULL,
  firewall code may later recurse the global tcbinfo lock trying to look
  up an inpcb.
  
  This is an instance where a layering violation leads not only
  potentially to code reentrace and recursion, but also to lock
  recursion, and was revealed by the conversion to rwlocks because
  acquiring a read lock on an rwlock already held with a write lock is
  forbidden.  When these locks were mutexes, they simply recursed.
  
  Reported by:    Stefan Ehmann <shoesoft at gmx dot net>
  MFC after:      3 days
  
  Revision  Changes    Path
  1.382     +12 -5     src/sys/netinet/tcp_input.c