Socket MAC labels so_label and so_peerlabel are now protected by

SOCK_LOCK(so):

- Hold socket lock over calls to MAC entry points reading or
  manipulating socket labels.

- Assert socket lock in MAC entry point implementations.

- When externalizing the socket label, first make a thread-local
  copy while holding the socket lock, then release the socket lock
  to externalize to userspace.

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/netatalk/ddp_output.c b/sys/netatalk/ddp_output.c
index 232fa2b..7270d54 100644
--- a/sys/netatalk/ddp_output.c
+++ b/sys/netatalk/ddp_output.c
@@ -52,7 +52,9 @@ ddp_output(struct mbuf *m, struct socket *so)
     struct ddpcb *ddp = sotoddpcb(so);
 
 #ifdef MAC
+    SOCK_LOCK(so);
     mac_create_mbuf_from_socket(so, m);
+    SOCK_UNLOCK(so);
 #endif
 
     M_PREPEND(m, sizeof(struct ddpehdr), M_TRYWAIT);