Fix an infinite loop in tcp_tw_2msl_scan() when an INP_TIMEWAIT inp has been destroyed before its tcptw with INVARIANTS undefined.
ClosedPublic
Actions

Authored by jch on Sep 7 2017, 3:12 PM.

Details

Reviewers

• hselasky
mjoras

Group Reviewers

transport

Commits

rS324948: MFC r324179, r324193:
rS324179: Fix an infinite loop in tcp_tw_2msl_scan() when an INP_TIMEWAIT inp has

Summary

Fix an infinite loop in tcp_tw_2msl_scan() when an INP_TIMEWAIT inp has been destroyed before its tcptw wint INVARIANTS undefined.

This is a symmetric change of r307551:

A INP_TIMEWAIT inp should not be destroyed before its tcptw, and INVARIANTS
will catch this case. If INVARIANTS is undefined it will emit a log(LOG_ERR)
and avoid a hard to debug infinite loop in tcp_tw_2msl_scan().

Reported by: Ben Rubson, hselasky
Submitted by: hselasky
Tested by: Ben Rubson, jch
MFC after: 1 week
Sponsored by: Verisign, inc

Diff Detail

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 11413
Build 11773: arc lint + arc unit

Event Timeline

jch created this revision.Sep 7 2017, 3:12 PM

Herald added a reviewer: transport. · View Herald TranscriptSep 7 2017, 3:12 PM

• hselasky accepted this revision.Sep 7 2017, 4:44 PM

j-nitrology.com added a subscriber: j-nitrology.com.Sep 8 2017, 12:26 AM

For anyone wondering about the history here, see this thread from -net: https://lists.freebsd.org/pipermail/freebsd-net/2017-August/048621.html. TL;DR is this: https://lists.freebsd.org/pipermail/freebsd-net/2017-September/048826.html

This revision is now accepted and ready to land.Sep 12 2017, 4:41 PM

kbowling added a subscriber: kbowling.Sep 12 2017, 8:07 PM

Closed by commit rS324179: Fix an infinite loop in tcp_tw_2msl_scan() when an INP_TIMEWAIT inp has (authored by jch). · Explain WhyOct 1 2017, 9:20 PM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Path

Size

sys/

netinet/

tcp_timewait.c

27 lines

Diff 32766

View Options

sys/netinet/tcp_timewait.c

Show First 20 Lines • Show All 745 Lines • ▼ Show 20 Lines	default:
lsi->lsi_int = si->si_value.sival_int;		lsi->lsi_int = si->si_value.sival_int;
lsi->lsi_ptr = PTROUT(si->si_value.sival_ptr);		lsi->lsi_ptr = PTROUT(si->si_value.sival_ptr);
}		}
break;		break;
}		}
break;		break;
}		}
}		}

		void
		lsiginfo_to_ksiginfo(const l_siginfo_t lsi, ksiginfo_t ksi, int sig)
		{

		ksi->ksi_signo = sig;
		ksi->ksi_code = lsi->lsi_code;
		dchaginAuthorUnsubmitted Not Done Inline Actions Linux allows SI_ here. So, I plan to convert this later. dchagin: Linux allows SI_ here. So, I plan to convert this later.
		ksi->ksi_pid = lsi->lsi_pid;
		ksi->ksi_uid = lsi->lsi_uid;
		ksi->ksi_status = lsi->lsi_status;
		ksi->ksi_addr = PTRIN(lsi->lsi_addr);
		ksi->ksi_info.si_value.sival_int = lsi->lsi_int;
		}

		int
		linux_rt_sigqueueinfo(struct thread td, struct linux_rt_sigqueueinfo_args args)
		{
		l_siginfo_t linfo;
		struct proc *p;
		ksiginfo_t ksi;
		int error;
		int sig;

		if (!LINUX_SIG_VALID(args->sig))
		return (EINVAL);

		error = copyin(args->info, &linfo, sizeof(linfo));
		if (error != 0)
		return (error);

		if (linfo.lsi_code >= 0)
		return (EPERM);

		if (args->sig > 0 && args->sig <= LINUX_SIGTBLSZ)
		sig = linux_to_bsd_signal[_SIG_IDX(args->sig)];
		else
		emasteUnsubmitted Not Done Inline Actions Should we log and/or disallow this case? emaste: Should we log and/or disallow this case?
		dchaginAuthorUnsubmitted Not Done Inline Actions No, RT signals. LINUX_SIG_VALID (707-708) validate user supplied sigcode. dchagin: No, RT signals. LINUX_SIG_VALID (707-708) validate user supplied sigcode.
		sig = args->sig;

		error = ESRCH;
		if ((p = pfind(args->pid)) != NULL \|\|
		(p = zpfind(args->pid)) != NULL) {
		ksiginfo_init(&ksi);
		traszUnsubmitted Not Done Inline Actions I think you're missing a lot of access checks here. See sys/kern/kern_sig:sys_kill(); in particular the IN_CAPABILITY_MODE() and p_cansignal(). trasz: I think you're missing a lot of access checks here. See sys/kern/kern_sig:sys_kill(); in…
		traszUnsubmitted Not Done Inline Actions Erm, ignore the IN_CAPABILITY_MODE(), but p_cansignal() should still be used, no? trasz: Erm, ignore the IN_CAPABILITY_MODE(), but p_cansignal() should still be used, no?
		lsiginfo_to_ksiginfo(&linfo, &ksi, sig);
		error = tdsendsignal(p, NULL, sig, &ksi);
		PROC_UNLOCK(p);
		}
		return (error);
		}

Fix an infinite loop in tcp_tw_2msl_scan() when an INP_TIMEWAIT inp has been destroyed before its tcptw with INVARIANTS undefined.ClosedPublicActions