HEADS UP: socket and pcb reference changes entering tree today

[Maxim Konovalov]

Hello,

On Sun, 2 Apr 2006, 23:37+0100, Robert Watson wrote:
>
> On Sat, 1 Apr 2006, Robert Watson wrote:
>
> > On Sat, 1 Apr 2006, Robert Watson wrote:
> >
> > > You get to experience the above in the order presented. :-)  I
> > > will send out a follow-up e-mail once the merges have stopped
> > > and/or slowed down, which will be later today sometime.
> >
> > This e-mail is to let you know that the commit spree is over for the day,
> > with no remaining changes in the rwatson_sockref branch.
> >
> > There are likely bugs.  You may find them.  If you do, please
> > e-mail bug reports, ideally including any panic messages, stack
> > traces, reproduction cases, etc, to current@, and I will try to
> > get to them as quickly as possible.
>
> OK, so it's been >24 hours since this was committed, and I've not
> received any bug reports yet.  This means once of three things:
>
> (1) There are no bugs.
>
> (2) I've broken everyone's systems so badly they can't submit bug reports.
>
> (3) Everyone is waiting for everyone else to upgrade due to the
> advance notice of instability.
>
> I consider (1) highly likely, (2) a property of 1990's development
> and we've left that time since most people have multiple machines
> now, and (3) much more likely.
>
> Please help test these changes!  I leave for a trip to the US on
> Thursday, and I'd rather get things working before I leave than
> while on travel, it will save a lot of hassle for everyone.
>
> And if you're reading this after spending 48 hours getting your
> systems working again to the point where you can read e-mail, sorry  :-).

There is a bug in raw ip code processing which panics system.  I put a
small regression test in src/tools/regression/netinet/rawconnect.

At the moment the code path for the connected raw ip socket looks like
that:

% soclose()
%   sodisconnect()
%     rip_disconnect()
%       rip_abort()
%         rip_pcbdetach()
%   rip_detach <<<--------- panic
%     rip_pcbdetach()

.. and we panics in rip_detach() at KASSERT(inp != NULL).

With this patch panic has gone.

Index: raw_ip.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/raw_ip.c,v
retrieving revision 1.160
diff -u -p -r1.160 raw_ip.c
--- raw_ip.c	21 Apr 2006 09:25:39 -0000	1.160
+++ raw_ip.c	14 May 2006 23:39:15 -0000
@@ -661,9 +661,19 @@ rip_abort(struct socket *so)
 static int
 rip_disconnect(struct socket *so)
 {
+	struct inpcb *inp;
+
 	if ((so->so_state & SS_ISCONNECTED) == 0)
 		return ENOTCONN;
-	rip_abort(so);
+
+	inp = sotoinpcb(so);
+	KASSERT(inp != NULL, ("rip_disconnect: inp == NULL"));
+	INP_INFO_WLOCK(&ripcbinfo);
+	INP_LOCK(inp);
+	inp->inp_faddr.s_addr = INADDR_ANY;
+	INP_UNLOCK(inp);
+	INP_INFO_WUNLOCK(&ripcbinfo);
+	so->so_state &= ~SS_ISCONNECTED;
 	return (0);
 }
%%%

-- 
Maxim Konovalov