HomeFreeBSD

sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()

Description

sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()

SCTP needs to avoid binding a given socket twice. The check used to
avoid this is racy since neither the inpcb lock nor the global info lock
is held. Fix it by synchronizing using the global info lock. In
particular, sctp_inpcb_bind() may drop the inpcb lock in some cases, but
the info lock is sufficient to prevent double insertion into PCB hash
tables.

Reported by: syzbot+548a8560d959669d0e12@syzkaller.appspotmail.com
Reviewed by: tuexen
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D31734

Details

Provenance
markjAuthored on Aug 31 2021, 11:43 AM
Reviewer
tuexen
Differential Revision
D31734: sctp: Fix racy UNBOUND flag check in sctp_inpcb_bind()
Parents
rG2496d812a9c7: sctp: Simplify the free port search in sctp_inpcb_bind()
Branches
Unknown
Tags
Unknown