svn commit: r355850 - stable/11/sys/netpfil/ipfw

[Andrey V. Elsukov]

Author: ae
Date: Tue Dec 17 10:23:08 2019
New Revision: 355850
URL: https://svnweb.freebsd.org/changeset/base/355850

Log:
  MFC r350413:
    Avoid possible lock leaking.
  
    After r343619 ipfw uses own locking for packets flow. PULLUP_LEN() macro
    is used in ipfw_chk() to make m_pullup(). When m_pullup() fails, it just
    returns via `goto pullup_failed`. There are two places where PULLUP_LEN()
    is called with IPFW_PF_RLOCK() held.
  
    Add PULLUP_LEN_LOCKED() macro to use in these places to be able release
    the lock, when m_pullup() fails.
  
    Sponsored by:	Yandex LLC
  
  NOTE: since r343619 was not merged, this commit is mostly NOP, but
  it is needed to reduce code difference between stable and head/.

Modified:
  stable/11/sys/netpfil/ipfw/ip_fw2.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netpfil/ipfw/ip_fw2.c
==============================================================================
--- stable/11/sys/netpfil/ipfw/ip_fw2.c	Tue Dec 17 10:00:19 2019	(r355849)
+++ stable/11/sys/netpfil/ipfw/ip_fw2.c	Tue Dec 17 10:23:08 2019	(r355850)
@@ -1426,17 +1426,23 @@ ipfw_chk(struct ip_fw_args *args)
  * this way).
  */
 #define PULLUP_TO(_len, p, T)	PULLUP_LEN(_len, p, sizeof(T))
-#define PULLUP_LEN(_len, p, T)					\
+#define	_PULLUP_LOCKED(_len, p, T, unlock)			\
 do {								\
 	int x = (_len) + T;					\
 	if ((m)->m_len < x) {					\
 		args->m = m = m_pullup(m, x);			\
-		if (m == NULL)					\
+		if (m == NULL) {				\
+			unlock;					\
 			goto pullup_failed;			\
+		}						\
 	}							\
 	p = (mtod(m, char *) + (_len));				\
 } while (0)
 
+#define	PULLUP_LEN(_len, p, T)	_PULLUP_LOCKED(_len, p, T, )
+#define	PULLUP_LEN_LOCKED(_len, p, T)	\
+    _PULLUP_LOCKED(_len, p, T, IPFW_PF_RUNLOCK(chain));
+
 	/*
 	 * if we have an ether header,
 	 */
@@ -2267,7 +2273,7 @@ do {								\
 
 			case O_TCPOPTS:
 				if (proto == IPPROTO_TCP && offset == 0 && ulp){
-					PULLUP_LEN(hlen, ulp,
+					PULLUP_LEN_LOCKED(hlen, ulp,
 					    (TCP(ulp)->th_off << 2));
 					match = tcpopts_match(TCP(ulp), cmd);
 				}
@@ -2292,7 +2298,7 @@ do {								\
 					uint16_t mss, *p;
 					int i;
 
-					PULLUP_LEN(hlen, ulp,
+					PULLUP_LEN_LOCKED(hlen, ulp,
 					    (TCP(ulp)->th_off << 2));
 					if ((tcpopts_parse(TCP(ulp), &mss) &
 					    IP_FW_TCPOPT_MSS) == 0)
@@ -3143,6 +3149,7 @@ do {								\
 
 		}	/* end of inner loop, scan opcodes */
 #undef PULLUP_LEN
+#undef PULLUP_LEN_LOCKED
 
 		if (done)
 			break;