svn commit: r208700 - stable/8/sys/netinet

[Robert Watson]

Author: rwatson
Date: Tue Jun  1 14:21:24 2010
New Revision: 208700
URL: http://svn.freebsd.org/changeset/base/208700

Log:
  Merge r204809 from head to stable/8:
  
    Add a comment to tcp_usr_accept() to indicate why it is we acquire the
    tcbinfo lock there: r175612, which re-added it, masked a race between
    sonewconn(2) and accept(2) that could allow an incompletely initialized
    address on a newly-created socket on a listen queue to be exposed.  Full
    details can be found in that commit message.
  
    Sponsored by:	Juniper Networks
  
  Approved by:	re (bz)

Modified:
  stable/8/sys/netinet/tcp_usrreq.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)
  stable/8/sys/geom/sched/   (props changed)

Modified: stable/8/sys/netinet/tcp_usrreq.c
==============================================================================
--- stable/8/sys/netinet/tcp_usrreq.c	Tue Jun  1 14:20:58 2010	(r208699)
+++ stable/8/sys/netinet/tcp_usrreq.c	Tue Jun  1 14:21:24 2010	(r208700)
@@ -560,9 +560,15 @@ out:
 }
 
 /*
- * Accept a connection.  Essentially all the work is
- * done at higher levels; just return the address
- * of the peer, storing through addr.
+ * Accept a connection.  Essentially all the work is done at higher levels;
+ * just return the address of the peer, storing through addr.
+ *
+ * The rationale for acquiring the tcbinfo lock here is somewhat complicated,
+ * and is described in detail in the commit log entry for r175612.  Acquiring
+ * it delays an accept(2) racing with sonewconn(), which inserts the socket
+ * before the inpcb address/port fields are initialized.  A better fix would
+ * prevent the socket from being placed in the listen queue until all fields
+ * are fully initialized.
  */
 static int
 tcp_usr_accept(struct socket *so, struct sockaddr **nam)