svn commit: r214553 - stable/8/sys/netinet
Bjoern A. Zeeb
bz at FreeBSD.org
Sat Oct 30 12:05:20 UTC 2010
Author: bz
Date: Sat Oct 30 12:05:20 2010
New Revision: 214553
URL: http://svn.freebsd.org/changeset/base/214553
Log:
MFC r213932:
MfP4 CH182763 (original version):
Make it harder to exploit certain in_control() related races between the
intiial lookup at the beginning and the time we will remove the entry
from the lists by re-checking that entry is still in the list before
trying to remove it.
Reported by: Nima Misaghian (nima_misa hotmail.com) on net@ 20100817
Tested by: Nima Misaghian (nima_misa hotmail.com) (original version)
PR: kern/146250
Submitted by: Mikolaj Golub (to.my.trociny gmail.com) (different version)
Modified:
stable/8/sys/netinet/in.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
stable/8/sys/dev/xen/xenpci/ (props changed)
Modified: stable/8/sys/netinet/in.c
==============================================================================
--- stable/8/sys/netinet/in.c Sat Oct 30 11:54:55 2010 (r214552)
+++ stable/8/sys/netinet/in.c Sat Oct 30 12:05:20 2010 (r214553)
@@ -599,6 +599,21 @@ in_control(struct socket *so, u_long cmd
}
IF_ADDR_LOCK(ifp);
+ /* Re-check that ia is still part of the list. */
+ TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
+ if (ifa == &ia->ia_ifa)
+ break;
+ }
+ if (ifa == NULL) {
+ /*
+ * If we lost the race with another thread, there is no need to
+ * try it again for the next loop as there is no other exit
+ * path between here and out.
+ */
+ IF_ADDR_UNLOCK(ifp);
+ error = EADDRNOTAVAIL;
+ goto out;
+ }
TAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifa_link);
IF_ADDR_UNLOCK(ifp);
ifa_free(&ia->ia_ifa); /* if_addrhead */
More information about the svn-src-stable-8
mailing list