svn commit: r204809 - head/sys/netinet

[Robert Watson]

Author: rwatson
Date: Sat Mar  6 21:38:31 2010
New Revision: 204809
URL: http://svn.freebsd.org/changeset/base/204809

Log:
  Add a comment to tcp_usr_accept() to indicate why it is we acquire the
  tcbinfo lock there: r175612, which re-added it, masked a race between
  sonewconn(2) and accept(2) that could allow an incompletely initialized
  address on a newly-created socket on a listen queue to be exposed.  Full
  details can be found in that commit message.
  
  MFC after:	1 week
  Sponsored by:	Juniper Networks

Modified:
  head/sys/netinet/tcp_usrreq.c

Modified: head/sys/netinet/tcp_usrreq.c
==============================================================================
--- head/sys/netinet/tcp_usrreq.c	Sat Mar  6 21:27:26 2010	(r204808)
+++ head/sys/netinet/tcp_usrreq.c	Sat Mar  6 21:38:31 2010	(r204809)
@@ -560,9 +560,15 @@ out:
 }
 
 /*
- * Accept a connection.  Essentially all the work is
- * done at higher levels; just return the address
- * of the peer, storing through addr.
+ * Accept a connection.  Essentially all the work is done at higher levels;
+ * just return the address of the peer, storing through addr.
+ *
+ * The rationale for acquiring the tcbinfo lock here is somewhat complicated,
+ * and is described in detail in the commit log entry for r175612.  Acquiring
+ * it delays an accept(2) racing with sonewconn(), which inserts the socket
+ * before the inpcb address/port fields are initialized.  A better fix would
+ * prevent the socket from being placed in the listen queue until all fields
+ * are fully initialized.
  */
 static int
 tcp_usr_accept(struct socket *so, struct sockaddr **nam)