git: c6ded47d0bae - main - [udp] fix possible mbuf and lock leak in udp_input().

[Andrey V. Elsukov]

The branch main has been updated by ae:

URL: https://cgit.FreeBSD.org/src/commit/?id=c6ded47d0bae801589b564dbe01dccd474edaed0

commit c6ded47d0bae801589b564dbe01dccd474edaed0
Author:     Andrey V. Elsukov <ae at FreeBSD.org>
AuthorDate: 2021-02-11 08:55:39 +0000
Commit:     Andrey V. Elsukov <ae at FreeBSD.org>
CommitDate: 2021-02-11 09:08:41 +0000

    [udp] fix possible mbuf and lock leak in udp_input().
    
    In error case we can leave `inp' locked, also we need to free
    mbuf chain `m' in the same case. Release the lock and use `badunlocked'
    label to exit with freed mbuf. Also modify UDP error statistic to
    match the IPv6 code.
    
    Remove redundant INP_RUNLOCK() from the `if (last == NULL)' block,
    there are no ways to reach this point with locked `inp'.
    
    Obtained from:  Yandex LLC
    MFC after:      3 days
    Sponsored by:   Yandex LLC
---
 sys/netinet/udp_usrreq.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 52304ddd6584..c2ad9381850e 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -610,9 +610,11 @@ udp_input(struct mbuf **mp, int *offp, int proto)
 						    uh);
 					if (udp_append(last, ip, n, iphlen,
 						udp_in)) {
-						goto inp_lost;
+						INP_RUNLOCK(inp);
+						goto badunlocked;
 					}
 				}
+				/* Release PCB lock taken on previous pass. */
 				INP_RUNLOCK(last);
 			}
 			last = inp;
@@ -635,9 +637,11 @@ udp_input(struct mbuf **mp, int *offp, int proto)
 			 * to send an ICMP Port Unreachable for a broadcast
 			 * or multicast datgram.)
 			 */
-			UDPSTAT_INC(udps_noportbcast);
-			if (inp)
-				INP_RUNLOCK(inp);
+			UDPSTAT_INC(udps_noport);
+			if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)))
+				UDPSTAT_INC(udps_noportmcast);
+			else
+				UDPSTAT_INC(udps_noportbcast);
 			goto badunlocked;
 		}
 		if (proto == IPPROTO_UDPLITE)
@@ -646,7 +650,6 @@ udp_input(struct mbuf **mp, int *offp, int proto)
 			UDP_PROBE(receive, NULL, last, ip, last, uh);
 		if (udp_append(last, ip, m, iphlen, udp_in) == 0)
 			INP_RUNLOCK(last);
-	inp_lost:
 		return (IPPROTO_DONE);
 	}