[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

kern/119778: unp_connect() locking problems with early returns

>Number:         119778
>Category:       kern
>Synopsis:       unp_connect() locking problems with early returns
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Jan 18 17:40:00 UTC 2008
>Originator:     James Juran
>Release:        7.0-RC1
BAE Systems
There are two early returns in unp_connect() that need to re-acquire the
UNP global lock before returning.  I tested on the December snapshot of
CURRENT-8.0, but the same problem occurs in RELENG_7.

I posted this problem to freebsd-net (http://lists.freebsd.org/pipermail/freebsd-net/2008-January/016392.html) but did not receive a response.

This program will trigger a panic on a WITNESS-enabled system:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/un.h>

int main(void)
    int s;
    struct sockaddr_un un;

    s = socket(PF_LOCAL, SOCK_STREAM, 0);
    if (s == -1)

    memset(&un, 0, sizeof(un));
    un.sun_family = AF_UNIX;
    if ((connect(s, (struct sockaddr *)&un, 2)) == -1)
    return 0;

I believe this patch will fix the problem, but unfortunately I do not
have time to test it.  Could someone please try this out?  Instead of
this approach, it may be possible to move the unlocking to after the
early returns are done, but I have not analyzed what impact this would

Index: uipc_usrreq.c
RCS file: /home/ncvs/src/sys/kern/uipc_usrreq.c,v
retrieving revision 1.210
diff -u -p -r1.210 uipc_usrreq.c
--- uipc_usrreq.c	1 Jan 2008 01:46:42 -0000	1.210
+++ uipc_usrreq.c	3 Jan 2008 02:53:51 -0000
@@ -1129,13 +1129,16 @@ unp_connect(struct socket *so, struct so
 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
-	if (len <= 0)
+	if (len <= 0) {
 		return (EINVAL);
+	}
 	strlcpy(buf, soun->sun_path, len + 1);
 	if (unp->unp_flags & UNP_CONNECTING) {
 		return (EALREADY);
 	unp->unp_flags |= UNP_CONNECTING;

freebsd-bugs_(_at_)_freebsd_(_dot_)_org mailing list
To unsubscribe, send any mail to "freebsd-bugs-unsubscribe_(_at_)_freebsd_(_dot_)_org"