From nobody@FreeBSD.org  Fri Jan 21 05:33:17 2011
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A49A7106564A
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 21 Jan 2011 05:33:17 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (unknown [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id 9494A8FC1D
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 21 Jan 2011 05:33:17 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.4/8.14.4) with ESMTP id p0L5XHie003509
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 21 Jan 2011 05:33:17 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.4/8.14.4/Submit) id p0L5XHXL003508;
	Fri, 21 Jan 2011 05:33:17 GMT
	(envelope-from nobody)
Message-Id: <201101210533.p0L5XHXL003508@red.freebsd.org>
Date: Fri, 21 Jan 2011 05:33:17 GMT
From: Zhouyi Zhou <zhouzhouyi@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: race condition in mb_dupcl
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         154185
>Category:       kern
>Synopsis:       race condition in mb_dupcl
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-net
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Jan 21 05:40:06 UTC 2011
>Closed-Date:    
>Last-Modified:  Thu Feb 17 10:42:51 UTC 2011
>Originator:     Zhouyi Zhou
>Release:        FreeBSD 8.0
>Organization:
ICT CAS
>Environment:
FreeBSD zzy 8.0-RELEASE FreeBSD 8.0-RELEASE #85: Fri Jan 21 12:56:40 UTC 2011     root@zzy:/root/sys/amd64/compile/GENERIC  amd64
>Description:
There is race condition in function mb_dupcl in src/sys/kern/uipc_mbuf.c 

The code to add reference count in mb_dupcl is as follows
     

 390         if (*(m->m_ext.ref_cnt) == 1)
 391                 *(m->m_ext.ref_cnt) += 1;

The x86 asm code for these two lines is:
0xffffffff807aa28d <mb_dupcl+13>:       sub    $0x1,%eax
0xffffffff807aa290 <mb_dupcl+16>:       je     0xffffffff807aa2f0 <mb_dupcl+112>
..
0xffffffff807aa2f0 <mb_dupcl+112>:      mov    (%rdx),%ecx
0xffffffff807aa2f2 <mb_dupcl+114>:      add    $0x1,%ecx
0xffffffff807aa2f5 <mb_dupcl+117>:      mov    %ecx,(%rdx)

It is appearant that multiple threads will race for the contents of (%rdx)
>How-To-Repeat:
Can write a kernel module like:

struct mbuf *m;
MGETHDR(m, M_DONTWAIT, MT_DATA);
MCLGET(m, M_DONTWAIT);

Then let multiple threads 
execute simulately:
 m1 = m_copypacket(m, M_DONTWAIT);
 m_freem(m1);
>Fix:
function mb_dupcl
    390 -        if (*(m->m_ext.ref_cnt) == 1)
    391 -                *(m->m_ext.ref_cnt) += 1;
    392 -        else
    393                 atomic_add_int(m->m_ext.ref_cnt, 1);



>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-standards->freebsd-net 
Responsible-Changed-By: brucec 
Responsible-Changed-When: Thu Feb 17 10:42:02 UTC 2011 
Responsible-Changed-Why:  
Not a standards issue. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=154185 
>Unformatted:
