svn commit: r355848 - stable/12/sys/netpfil/ipfw

[Andrey V. Elsukov]

Author: ae
Date: Tue Dec 17 09:46:00 2019
New Revision: 355848
URL: https://svnweb.freebsd.org/changeset/base/355848

Log:
  MFC r350413:
    Avoid possible lock leaking.
  
    After r343619 ipfw uses own locking for packets flow. PULLUP_LEN() macro
    is used in ipfw_chk() to make m_pullup(). When m_pullup() fails, it just
    returns via `goto pullup_failed`. There are two places where PULLUP_LEN()
    is called with IPFW_PF_RLOCK() held.
  
    Add PULLUP_LEN_LOCKED() macro to use in these places to be able release
    the lock, when m_pullup() fails.
  
    Sponsored by:	Yandex LLC
  
    NOTE: since r343619 was not merged, this commit is mostly NOP, but
    it is needed to reduce code difference between stable and head/.

Modified:
  stable/12/sys/netpfil/ipfw/ip_fw2.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netpfil/ipfw/ip_fw2.c
==============================================================================
--- stable/12/sys/netpfil/ipfw/ip_fw2.c	Tue Dec 17 09:13:48 2019	(r355847)
+++ stable/12/sys/netpfil/ipfw/ip_fw2.c	Tue Dec 17 09:46:00 2019	(r355848)
@@ -1427,18 +1427,24 @@ ipfw_chk(struct ip_fw_args *args)
  * pointer might become stale after other pullups (but we never use it
  * this way).
  */
-#define PULLUP_TO(_len, p, T)	PULLUP_LEN(_len, p, sizeof(T))
-#define PULLUP_LEN(_len, p, T)					\
+#define	PULLUP_TO(_len, p, T)	PULLUP_LEN(_len, p, sizeof(T))
+#define	_PULLUP_LOCKED(_len, p, T, unlock)			\
 do {								\
 	int x = (_len) + T;					\
 	if ((m)->m_len < x) {					\
 		args->m = m = m_pullup(m, x);			\
-		if (m == NULL)					\
+		if (m == NULL) {				\
+			unlock;					\
 			goto pullup_failed;			\
+		}						\
 	}							\
 	p = (mtod(m, char *) + (_len));				\
 } while (0)
 
+#define	PULLUP_LEN(_len, p, T)	_PULLUP_LOCKED(_len, p, T, )
+#define	PULLUP_LEN_LOCKED(_len, p, T)	\
+    _PULLUP_LOCKED(_len, p, T, IPFW_PF_RUNLOCK(chain))
+
 	/*
 	 * if we have an ether header,
 	 */
@@ -2269,7 +2275,7 @@ do {								\
 
 			case O_TCPOPTS:
 				if (proto == IPPROTO_TCP && offset == 0 && ulp){
-					PULLUP_LEN(hlen, ulp,
+					PULLUP_LEN_LOCKED(hlen, ulp,
 					    (TCP(ulp)->th_off << 2));
 					match = tcpopts_match(TCP(ulp), cmd);
 				}
@@ -2294,7 +2300,7 @@ do {								\
 					uint16_t mss, *p;
 					int i;
 
-					PULLUP_LEN(hlen, ulp,
+					PULLUP_LEN_LOCKED(hlen, ulp,
 					    (TCP(ulp)->th_off << 2));
 					if ((tcpopts_parse(TCP(ulp), &mss) &
 					    IP_FW_TCPOPT_MSS) == 0)
@@ -3145,6 +3151,7 @@ do {								\
 
 		}	/* end of inner loop, scan opcodes */
 #undef PULLUP_LEN
+#undef PULLUP_LEN_LOCKED
 
 		if (done)
 			break;