svn commit: r356989 - head/sys/netinet

[Gleb Smirnoff]

Author: glebius
Date: Wed Jan 22 17:19:53 2020
New Revision: 356989
URL: https://svnweb.freebsd.org/changeset/base/356989

Log:
  Plug possible calls into ip6?_output() without network epoch from SCTP
  bluntly adding epoch entrance into the macro that SCTP uses to call
  ip6?_output().  This definitely will introduce several epoch recursions.
  
  Reported by:	https://syzkaller.appspot.com/bug?id=79f03f574594a5be464997310896765c458ed80a
  Reported by:	https://syzkaller.appspot.com/bug?id=07c6f52106cddbe356cc2b2f3664a1c51cc0dadf

Modified:
  head/sys/netinet/sctp_os_bsd.h

Modified: head/sys/netinet/sctp_os_bsd.h
==============================================================================
--- head/sys/netinet/sctp_os_bsd.h	Wed Jan 22 17:06:55 2020	(r356988)
+++ head/sys/netinet/sctp_os_bsd.h	Wed Jan 22 17:19:53 2020	(r356989)
@@ -412,6 +412,7 @@ typedef struct rtentry sctp_rtentry_t;
  */
 #define SCTP_IP_OUTPUT(result, o_pak, ro, stcb, vrf_id) \
 { \
+	struct epoch_tracker et; \
 	int o_flgs = IP_RAWOUTPUT; \
 	struct sctp_tcb *local_stcb = stcb; \
 	if (local_stcb && \
@@ -419,19 +420,24 @@ typedef struct rtentry sctp_rtentry_t;
 	    local_stcb->sctp_ep->sctp_socket) \
 		o_flgs |= local_stcb->sctp_ep->sctp_socket->so_options & SO_DONTROUTE; \
 	m_clrprotoflags(o_pak); \
+	NET_EPOCH_ENTER(et); \
 	result = ip_output(o_pak, NULL, ro, o_flgs, 0, NULL); \
+	NET_EPOCH_EXIT(et); \
 }
 
 #define SCTP_IP6_OUTPUT(result, o_pak, ro, ifp, stcb, vrf_id) \
 { \
+	struct epoch_tracker et; \
 	struct sctp_tcb *local_stcb = stcb; \
 	m_clrprotoflags(o_pak); \
+	NET_EPOCH_ENTER(et); \
 	if (local_stcb && local_stcb->sctp_ep) \
 		result = ip6_output(o_pak, \
 				    ((struct inpcb *)(local_stcb->sctp_ep))->in6p_outputopts, \
 				    (ro), 0, 0, ifp, NULL); \
 	else \
 		result = ip6_output(o_pak, NULL, (ro), 0, 0, ifp, NULL); \
+	NET_EPOCH_EXIT(et); \
 }
 
 struct mbuf *