Lock down rawcb_list, a global list of control blocks for raw sockets,

using rawcb_mtx.  Hold this mutex while modifying or iterating over
the control list; this means that the mutex is held over calls into
socket delivery code, which no longer causes a lock order reversal as
the routing socket code uses a netisr to avoid recursing socket ->
routing -> socket.

Note: Locking of IPsec consumers of rawcb_list is not included in this
commit.

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/net/raw_usrreq.c b/sys/net/raw_usrreq.c
index 9507267..7517743 100644
--- a/sys/net/raw_usrreq.c
+++ b/sys/net/raw_usrreq.c
@@ -31,6 +31,7 @@
  */
 
 #include <sys/param.h>
+#include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
@@ -44,12 +45,15 @@
 
 #include <net/raw_cb.h>
 
+MTX_SYSINIT(rawcb_mtx, &rawcb_mtx, "rawcb", MTX_DEF);
+
 /*
  * Initialize raw connection block q.
  */
 void
 raw_init()
 {
+
 	LIST_INIT(&rawcb_list);
 }
 
@@ -73,6 +77,7 @@ raw_input(m0, proto, src, dst)
 	struct socket *last;
 
 	last = 0;
+	mtx_lock(&rawcb_mtx);
 	LIST_FOREACH(rp, &rawcb_list, list) {
 		if (rp->rcb_proto.sp_family != proto->sp_family)
 			continue;
@@ -117,6 +122,7 @@ raw_input(m0, proto, src, dst)
 		}
 	} else
 		m_freem(m);
+	mtx_unlock(&rawcb_mtx);
 }
 
 /*ARGSUSED*/