Grab the socket buffer send or receive mutex when performing a

read-modify-write on the sb_state field.  This commit catches only
the "easy" ones where it doesn't interact with as yet unmerged
locking.

6 files changed, 36 insertions, 3 deletions

diff --git a/sys/fs/fifofs/fifo_vnops.c b/sys/fs/fifofs/fifo_vnops.c
index 80fe7b6..c35a8a0 100644
--- a/sys/fs/fifofs/fifo_vnops.c
+++ b/sys/fs/fifofs/fifo_vnops.c
@@ -211,7 +211,9 @@ fail1:
 		}
 		fip->fi_readers = fip->fi_writers = 0;
 		wso->so_snd.sb_lowat = PIPE_BUF;
+		SOCKBUF_LOCK(&rso->so_rcv);
 		rso->so_rcv.sb_state |= SBS_CANTRCVMORE;
+		SOCKBUF_UNLOCK(&rso->so_rcv);
 		vp->v_fifoinfo = fip;
 	}
 
@@ -229,7 +231,9 @@ fail1:
 	if (ap->a_mode & FREAD) {
 		fip->fi_readers++;
 		if (fip->fi_readers == 1) {
+			SOCKBUF_LOCK(&fip->fi_writesock->so_snd);
 			fip->fi_writesock->so_snd.sb_state &= ~SBS_CANTSENDMORE;
+			SOCKBUF_UNLOCK(&fip->fi_writesock->so_snd);
 			if (fip->fi_writers > 0) {
 				wakeup(&fip->fi_writers);
 				sowwakeup(fip->fi_writesock);
@@ -243,7 +247,9 @@ fail1:
 		}
 		fip->fi_writers++;
 		if (fip->fi_writers == 1) {
+			SOCKBUF_LOCK(&fip->fi_writesock->so_rcv);
 			fip->fi_readsock->so_rcv.sb_state &= ~SBS_CANTRCVMORE;
+			SOCKBUF_UNLOCK(&fip->fi_writesock->so_rcv);
 			if (fip->fi_readers > 0) {
 				wakeup(&fip->fi_readers);
 				sorwakeup(fip->fi_writesock);
diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c
index 2d50f32..9b02fec 100644
--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -154,8 +154,12 @@ soisdisconnecting(so)
 
 	so->so_state &= ~SS_ISCONNECTING;
 	so->so_state |= SS_ISDISCONNECTING;
+	SOCKBUF_LOCK(&so->so_rcv);
 	so->so_rcv.sb_state |= SBS_CANTRCVMORE;
+	SOCKBUF_UNLOCK(&so->so_rcv);
+	SOCKBUF_LOCK(&so->so_snd);
 	so->so_snd.sb_state |= SBS_CANTSENDMORE;
+	SOCKBUF_UNLOCK(&so->so_snd);
 	wakeup(&so->so_timeo);
 	sowwakeup(so);
 	sorwakeup(so);
@@ -168,8 +172,12 @@ soisdisconnected(so)
 
 	so->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
 	so->so_state |= SS_ISDISCONNECTED;
+	SOCKBUF_LOCK(&so->so_rcv);
 	so->so_rcv.sb_state |= SBS_CANTRCVMORE;
+	SOCKBUF_UNLOCK(&so->so_rcv);
+	SOCKBUF_LOCK(&so->so_snd);
 	so->so_snd.sb_state |= SBS_CANTSENDMORE;
+	SOCKBUF_UNLOCK(&so->so_snd);
 	wakeup(&so->so_timeo);
 	sbdrop(&so->so_snd, so->so_snd.sb_cc);
 	sowwakeup(so);
diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c
index 2d50f32..9b02fec 100644
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ -154,8 +154,12 @@ soisdisconnecting(so)
 
 	so->so_state &= ~SS_ISCONNECTING;
 	so->so_state |= SS_ISDISCONNECTING;
+	SOCKBUF_LOCK(&so->so_rcv);
 	so->so_rcv.sb_state |= SBS_CANTRCVMORE;
+	SOCKBUF_UNLOCK(&so->so_rcv);
+	SOCKBUF_LOCK(&so->so_snd);
 	so->so_snd.sb_state |= SBS_CANTSENDMORE;
+	SOCKBUF_UNLOCK(&so->so_snd);
 	wakeup(&so->so_timeo);
 	sowwakeup(so);
 	sorwakeup(so);
@@ -168,8 +172,12 @@ soisdisconnected(so)
 
 	so->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
 	so->so_state |= SS_ISDISCONNECTED;
+	SOCKBUF_LOCK(&so->so_rcv);
 	so->so_rcv.sb_state |= SBS_CANTRCVMORE;
+	SOCKBUF_UNLOCK(&so->so_rcv);
+	SOCKBUF_LOCK(&so->so_snd);
 	so->so_snd.sb_state |= SBS_CANTSENDMORE;
+	SOCKBUF_UNLOCK(&so->so_snd);
 	wakeup(&so->so_timeo);
 	sbdrop(&so->so_snd, so->so_snd.sb_cc);
 	sowwakeup(so);
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 3fa801d..03ed420 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -2249,8 +2249,11 @@ step6:
 			tp->rcv_up = th->th_seq + th->th_urp;
 			so->so_oobmark = so->so_rcv.sb_cc +
 			    (tp->rcv_up - tp->rcv_nxt) - 1;
-			if (so->so_oobmark == 0)
+			if (so->so_oobmark == 0) {
+				SOCKBUF_LOCK(&so->so_rcv);
 				so->so_rcv.sb_state |= SBS_RCVATMARK;
+				SOCKBUF_UNLOCK(&so->so_rcv);
+			}
 			sohasoutofband(so);
 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
 		}
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index 3fa801d..03ed420 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -2249,8 +2249,11 @@ step6:
 			tp->rcv_up = th->th_seq + th->th_urp;
 			so->so_oobmark = so->so_rcv.sb_cc +
 			    (tp->rcv_up - tp->rcv_nxt) - 1;
-			if (so->so_oobmark == 0)
+			if (so->so_oobmark == 0) {
+				SOCKBUF_LOCK(&so->so_rcv);
 				so->so_rcv.sb_state |= SBS_RCVATMARK;
+				SOCKBUF_UNLOCK(&so->so_rcv);
+			}
 			sohasoutofband(so);
 			tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
 		}
diff --git a/sys/netipx/spx_usrreq.c b/sys/netipx/spx_usrreq.c
index eb34fb7..b9c7a11 100644
--- a/sys/netipx/spx_usrreq.c
+++ b/sys/netipx/spx_usrreq.c
@@ -566,8 +566,11 @@ present:
 				cb->s_oobflags &= ~SF_IOOB;
 				if (so->so_rcv.sb_cc)
 					so->so_oobmark = so->so_rcv.sb_cc;
-				else
+				else {
+					SOCKBUF_LOCK(&so->so_rcv);
 					so->so_rcv.sb_state |= SBS_RCVATMARK;
+					SOCKBUF_UNLOCK(&so->so_rcv);
+				}
 			}
 			q = q->si_prev;
 			remque(q->si_next);
@@ -597,7 +600,9 @@ present:
 					MCHTYPE(m, MT_OOBDATA);
 					spx_newchecks[1]++;
 					so->so_oobmark = 0;
+					SOCKBUF_LOCK(&so->so_rcv);
 					so->so_rcv.sb_state &= ~SBS_RCVATMARK;
+					SOCKBUF_UNLOCK(&so->so_rcv);
 				}
 				if (packetp == 0) {
 					m->m_data += SPINC;