git: 6e3af6321ba4 - main - sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()

[Mark Johnston]

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=6e3af6321ba46010272c78487634ec16816ff3e6

commit 6e3af6321ba46010272c78487634ec16816ff3e6
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-09-08 03:02:15 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-09-08 15:41:18 +0000

    sctp: Fix lock recursion in sctp_swap_inpcb_for_listen()
    
    After commit bd4a39cc93d9 we now hold the global inp info lock across
    the call to sctp_swap_inpcb_for_listen(), which attempts to acquire it
    again.  Since sctp_swap_inpcb_for_listen()'s sole caller is
    sctp_listen(), we can simply change it to not try to acquire the lock.
    
    Reported by:    syzbot+a76b19ea2f8e1190c451 at syzkaller.appspotmail.com
    Reported by:    syzbot+a1b6cef257ad145b7187 at syzkaller.appspotmail.com
    Reviewed by:    tuexen
    Fixes:  bd4a39cc93d9 ("socket: Properly interlock when transitioning to a listening socket")
    MFC after:      1 month
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D31878
---
 sys/netinet/sctp_pcb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c
index 473c71917ce7..cdecb9f4bc9c 100644
--- a/sys/netinet/sctp_pcb.c
+++ b/sys/netinet/sctp_pcb.c
@@ -1845,6 +1845,8 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
 	struct sctppcbhead *head;
 	struct sctp_inpcb *tinp, *ninp;
 
+	SCTP_INP_INFO_WLOCK_ASSERT();
+
 	if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) {
 		/* only works with port reuse on */
 		return (-1);
@@ -1853,7 +1855,6 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
 		return (0);
 	}
 	SCTP_INP_RUNLOCK(inp);
-	SCTP_INP_INFO_WLOCK();
 	head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport,
 	    SCTP_BASE_INFO(hashmark))];
 	/* Kick out all non-listeners to the TCP hash */
@@ -1885,7 +1886,6 @@ sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
 	LIST_INSERT_HEAD(head, inp, sctp_hash);
 	SCTP_INP_WUNLOCK(inp);
 	SCTP_INP_RLOCK(inp);
-	SCTP_INP_INFO_WUNLOCK();
 	return (0);
 }