svn commit: r356989 - head/sys/netinet

[Michael Tuexen]

> On 22. Jan 2020, at 18:19, Gleb Smirnoff <glebius at FreeBSD.org> wrote:
> 
> Author: glebius
> Date: Wed Jan 22 17:19:53 2020
> New Revision: 356989
> URL: https://svnweb.freebsd.org/changeset/base/356989
> 
> Log:
>  Plug possible calls into ip6?_output() without network epoch from SCTP
>  bluntly adding epoch entrance into the macro that SCTP uses to call
>  ip6?_output().  This definitely will introduce several epoch recursions.
Can you specify under which condition NET_EPOCH_ENTER() should be called?
Then I can try to figure out where these calls need to be made in the
SCTP code.

Best regards
Michael
> 
>  Reported by:	https://syzkaller.appspot.com/bug?id=79f03f574594a5be464997310896765c458ed80a
>  Reported by:	https://syzkaller.appspot.com/bug?id=07c6f52106cddbe356cc2b2f3664a1c51cc0dadf
> 
> Modified:
>  head/sys/netinet/sctp_os_bsd.h
> 
> Modified: head/sys/netinet/sctp_os_bsd.h
> ==============================================================================
> --- head/sys/netinet/sctp_os_bsd.h	Wed Jan 22 17:06:55 2020	(r356988)
> +++ head/sys/netinet/sctp_os_bsd.h	Wed Jan 22 17:19:53 2020	(r356989)
> @@ -412,6 +412,7 @@ typedef struct rtentry sctp_rtentry_t;
>  */
> #define SCTP_IP_OUTPUT(result, o_pak, ro, stcb, vrf_id) \
> { \
> +	struct epoch_tracker et; \
> 	int o_flgs = IP_RAWOUTPUT; \
> 	struct sctp_tcb *local_stcb = stcb; \
> 	if (local_stcb && \
> @@ -419,19 +420,24 @@ typedef struct rtentry sctp_rtentry_t;
> 	    local_stcb->sctp_ep->sctp_socket) \
> 		o_flgs |= local_stcb->sctp_ep->sctp_socket->so_options & SO_DONTROUTE; \
> 	m_clrprotoflags(o_pak); \
> +	NET_EPOCH_ENTER(et); \
> 	result = ip_output(o_pak, NULL, ro, o_flgs, 0, NULL); \
> +	NET_EPOCH_EXIT(et); \
> }
> 
> #define SCTP_IP6_OUTPUT(result, o_pak, ro, ifp, stcb, vrf_id) \
> { \
> +	struct epoch_tracker et; \
> 	struct sctp_tcb *local_stcb = stcb; \
> 	m_clrprotoflags(o_pak); \
> +	NET_EPOCH_ENTER(et); \
> 	if (local_stcb && local_stcb->sctp_ep) \
> 		result = ip6_output(o_pak, \
> 				    ((struct inpcb *)(local_stcb->sctp_ep))->in6p_outputopts, \
> 				    (ro), 0, 0, ifp, NULL); \
> 	else \
> 		result = ip6_output(o_pak, NULL, (ro), 0, 0, ifp, NULL); \
> +	NET_EPOCH_EXIT(et); \
> }
> 
> struct mbuf *