svn commit: r213932 - head/sys/netinet

[Bjoern A. Zeeb]

Author: bz
Date: Sat Oct 16 19:53:22 2010
New Revision: 213932
URL: http://svn.freebsd.org/changeset/base/213932

Log:
  MfP4 CH182763 (original version):
  
  Make it harder to exploit certain in_control() related races between the
  intiial lookup at the beginning and the time we will remove the entry
  from the lists by re-checking that entry is still in the list before
  trying to remove it.
  
  (*) It is believed that with the current code and locking strategy we
      cannot completely fix all race.
  
  Reported by:	Nima Misaghian (nima_misa hotmail.com) on net@ 20100817
  Tested by:	Nima Misaghian (nima_misa hotmail.com) (original version)
  PR:		kern/146250
  Submitted by:	Mikolaj Golub (to.my.trociny gmail.com) (different version)
  MFC after:	1 week

Modified:
  head/sys/netinet/in.c

Modified: head/sys/netinet/in.c
==============================================================================
--- head/sys/netinet/in.c	Sat Oct 16 19:29:37 2010	(r213931)
+++ head/sys/netinet/in.c	Sat Oct 16 19:53:22 2010	(r213932)
@@ -599,6 +599,21 @@ in_control(struct socket *so, u_long cmd
 	}
 
 	IF_ADDR_LOCK(ifp);
+	/* Re-check that ia is still part of the list. */
+	TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
+		if (ifa == &ia->ia_ifa)
+			break;
+	}
+	if (ifa == NULL) {
+		/*
+		 * If we lost the race with another thread, there is no need to
+		 * try it again for the next loop as there is no other exit
+		 * path between here and out.
+		 */
+		IF_ADDR_UNLOCK(ifp);
+		error = EADDRNOTAVAIL;
+		goto out;
+	}
 	TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link);
 	IF_ADDR_UNLOCK(ifp);
 	ifa_free(&ia->ia_ifa);				/* if_addrhead */