diff options
| author | rwatson <rwatson@FreeBSD.org> | 2004-11-23 16:06:15 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2004-11-23 16:06:15 +0000 |
| commit | 32947f494f39ebc1429459b4beb89f1c642abe0a (patch) | |
| tree | a533bbf3efae2c8d996de30bbbf7440a0553f8b5 /sys/netinet | |
| parent | 37654f9d78eafb0fa438f156e67683a3faa82a29 (diff) | |
| download | FreeBSD-src-32947f494f39ebc1429459b4beb89f1c642abe0a.zip FreeBSD-src-32947f494f39ebc1429459b4beb89f1c642abe0a.tar.gz | |
Assert inpcb lock in tcp_quench(), tcp_drop_syn_sent(), tcp_mtudisc(),
and tcp_drop(), due to read-modify-write of TCP state variables.
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/tcp_subr.c | 4 | ||||
| -rw-r--r-- | sys/netinet/tcp_timewait.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index d54b6fa..e3fcdf1 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -646,6 +646,7 @@ tcp_drop(tp, errno) { struct socket *so = tp->t_inpcb->inp_socket; + INP_LOCK_ASSERT(tp->t_inpcb); if (TCPS_HAVERCVDSYN(tp->t_state)) { tp->t_state = TCPS_CLOSED; (void) tcp_output(tp); @@ -1373,6 +1374,7 @@ tcp_quench(inp, errno) { struct tcpcb *tp = intotcpcb(inp); + INP_LOCK_ASSERT(inp); if (tp != NULL) tp->snd_cwnd = tp->t_maxseg; return (inp); @@ -1390,6 +1392,7 @@ tcp_drop_syn_sent(inp, errno) { struct tcpcb *tp = intotcpcb(inp); + INP_LOCK_ASSERT(inp); if (tp != NULL && tp->t_state == TCPS_SYN_SENT) { tcp_drop(tp, errno); return (struct inpcb *)0; @@ -1417,6 +1420,7 @@ tcp_mtudisc(inp, errno) int isipv6; #endif /* INET6 */ + INP_LOCK_ASSERT(inp); if (tp != NULL) { #ifdef INET6 isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) != 0; diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c index d54b6fa..e3fcdf1 100644 --- a/sys/netinet/tcp_timewait.c +++ b/sys/netinet/tcp_timewait.c @@ -646,6 +646,7 @@ tcp_drop(tp, errno) { struct socket *so = tp->t_inpcb->inp_socket; + INP_LOCK_ASSERT(tp->t_inpcb); if (TCPS_HAVERCVDSYN(tp->t_state)) { tp->t_state = TCPS_CLOSED; (void) tcp_output(tp); @@ -1373,6 +1374,7 @@ tcp_quench(inp, errno) { struct tcpcb *tp = intotcpcb(inp); + INP_LOCK_ASSERT(inp); if (tp != NULL) tp->snd_cwnd = tp->t_maxseg; return (inp); @@ -1390,6 +1392,7 @@ tcp_drop_syn_sent(inp, errno) { struct tcpcb *tp = intotcpcb(inp); + INP_LOCK_ASSERT(inp); if (tp != NULL && tp->t_state == TCPS_SYN_SENT) { tcp_drop(tp, errno); return (struct inpcb *)0; @@ -1417,6 +1420,7 @@ tcp_mtudisc(inp, errno) int isipv6; #endif /* INET6 */ + INP_LOCK_ASSERT(inp); if (tp != NULL) { #ifdef INET6 isipv6 = (tp->t_inpcb->inp_vflag & INP_IPV6) != 0; |
