svn commit: r303831 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Mon Aug  8 08:20:10 2016
New Revision: 303831
URL: https://svnweb.freebsd.org/changeset/base/303831

Log:
  Fix a locking issue found by stress testing with tsctp.
  The inp read lock neeeds to be held when considering control->do_not_ref_stcb.
  MFC after:	3 days

Modified:
  head/sys/netinet/sctputil.c

Modified: head/sys/netinet/sctputil.c
==============================================================================
--- head/sys/netinet/sctputil.c	Mon Aug  8 07:19:30 2016	(r303830)
+++ head/sys/netinet/sctputil.c	Mon Aug  8 08:20:10 2016	(r303831)
@@ -5497,20 +5497,16 @@ restart_nosblocks:
 	}
 	/* Clear the held length since there is something to read */
 	control->held_length = 0;
-	if (hold_rlock) {
-		SCTP_INP_READ_UNLOCK(inp);
-		hold_rlock = 0;
-	}
 found_one:
 	/*
 	 * If we reach here, control has a some data for us to read off.
 	 * Note that stcb COULD be NULL.
 	 */
-	control->some_taken++;
-	if (hold_sblock) {
-		SOCKBUF_UNLOCK(&so->so_rcv);
-		hold_sblock = 0;
+	if (hold_rlock == 0) {
+		hold_rlock = 1;
+		SCTP_INP_READ_LOCK(inp);
 	}
+	control->some_taken++;
 	stcb = control->stcb;
 	if (stcb) {
 		if ((control->do_not_ref_stcb == 0) &&
@@ -5684,6 +5680,14 @@ found_one:
 		}
 #endif
 	}
+	if (hold_rlock) {
+		SCTP_INP_READ_UNLOCK(inp);
+		hold_rlock = 0;
+	}
+	if (hold_sblock) {
+		SOCKBUF_UNLOCK(&so->so_rcv);
+		hold_sblock = 0;
+	}
 	/* now copy out what data we can */
 	if (mp == NULL) {
 		/* copy out each mbuf in the chain up to length */