From nobody@FreeBSD.org  Fri Dec 20 18:49:25 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTPS id 9497C986
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 20 Dec 2013 18:49:25 +0000 (UTC)
Received: from oldred.freebsd.org (oldred.freebsd.org [IPv6:2001:1900:2254:206a::50:4])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.freebsd.org (Postfix) with ESMTPS id 7EF971F94
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 20 Dec 2013 18:49:25 +0000 (UTC)
Received: from oldred.freebsd.org ([127.0.1.6])
	by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id rBKInORm084542
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 20 Dec 2013 18:49:24 GMT
	(envelope-from nobody@oldred.freebsd.org)
Received: (from nobody@localhost)
	by oldred.freebsd.org (8.14.5/8.14.5/Submit) id rBKInOlO084534;
	Fri, 20 Dec 2013 18:49:24 GMT
	(envelope-from nobody)
Message-Id: <201312201849.rBKInOlO084534@oldred.freebsd.org>
Date: Fri, 20 Dec 2013 18:49:24 GMT
From: Michael Bentkofsky <mbentkofsky@verisign.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Kernel panic: Sleeping thread (tid , pid ) owns a non-sleepable lock from netinet/in_multi.c
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         185043
>Category:       kern
>Synopsis:       Kernel panic: Sleeping thread (tid , pid ) owns a non-sleepable lock from netinet/in_multi.c
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    gnn
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Dec 20 18:50:04 UTC 2013
>Closed-Date:    
>Last-Modified:  Sun Feb  9 21:50:00 UTC 2014
>Originator:     Michael Bentkofsky
>Release:        8.4, 10/stable
>Organization:
VeriSign, Inc.
>Environment:
FreeBSD omg022-std1 8.4-RELEASE-p4 FreeBSD 8.4-RELEASE-p4 #0: Mon Nov 18 16:42:01 UTC 2013     root@bsd83-dev:/usr/obj/usr/src/sys/GENERIC  amd64

>Description:
Running ospfd from Quagga and restarting the network can trigger a kernel panic with the following stack trace:

root@omg022-std1:~ # Sleeping thread (tid 100188, pid 2047) owns a non-sleepable lock
KDB: stack backtrace of thread 100188:
#0 0xffffffff8064a4d6 at mi_switch+0x186
#1 0xffffffff8067f18c at sleepq_catch_signals+0x31c
#2 0xffffffff8067f9a9 at sleepq_timedwait_sig+0x19
#3 0xffffffff805fcdec at _cv_timedwait_sig+0x13c
#4 0xffffffff806850e8 at seltdwait+0x98
#5 0xffffffff806870df at kern_select+0x6ef
#6 0xffffffff8068737d at select+0x5d
#7 0xffffffff809ca3c4 at amd64_syscall+0x1f4
#8 0xffffffff809b253c at Xfast_syscall+0xfc
panic: sleeping thread
cpuid = 11
KDB: stack backtrace:
#0 0xffffffff806756d6 at kdb_backtrace+0x66
#1 0xffffffff80641d9e at panic+0x1ce
#2 0xffffffff806826bb at propagate_priority+0x1cb
#3 0xffffffff806833ff at turnstile_wait+0x1bf
#4 0xffffffff806322dd at _mtx_lock_sleep+0xbd
#5 0xffffffff80743ff1 at igmp_fasttimo+0x881
#6 0xffffffff8069df8b at pffasttimo+0x2b
#7 0xffffffff80655a63 at softclock+0x343
#8 0xffffffff806195a4 at intr_event_execute_handlers+0x104
#9 0xffffffff8061ac35 at ithread_loop+0x95
#10 0xffffffff806167bf at fork_exit+0x11f
#11 0xffffffff809b278e at fork_trampoline+0xe

The pid 2047 is ospfd from quagga-0.99.22. With ospfd running and configured, it uses multicast to listen for OSPF hello packets. Restarting the network with this command triggers the kernel panic:

# /etc/rc.d/netif restart && /etc/rc.d/routing restart
Catching the panic in ddb shows this bit of detail about the locks:

db> show allchains
chain 1:
thread 100015 (pid 12, swi4: clock) blocked on lock 0xffffffff80e4eca0 (sleep mutex) "in_multi_mtx"
thread 100233 (pid 2047, ospfd) inhibited

Looking at the places where this lock is acquired, we see several suspicious error paths that can leave the lock acquired in netinet/in_mcast.c. Here is an example from CURRENT:

static int
inp_block_unblock_source(struct inpcb *inp, struct sockopt *sopt)
{

	/*
	 * Begin state merge transaction at IGMP layer.
	 */
	IN_MULTI_LOCK();

	CTR1(KTR_IGMPV3, "%s: merge inm state", __func__);
	error = inm_merge(inm, imf);
	if (error) {
		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
		goto out_imf_rollback;
	}

	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
	error = igmp_change_state(inm);
	if (error)
		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);

	IN_MULTI_UNLOCK();

out_imf_rollback:
	if (error)
		imf_rollback(imf);
	else
		imf_commit(imf);

	imf_reap(imf);

}

Thus when there is an error in inm_merge() or igmp_change_state(), this lock remains acquired. There are other similar code segments such as  inp_join_group(), inp_set_source_filters() and inp_leave_group().

The panic was produced in FreeBSD-8.4, although I have also verified that the case happens with both stable/10  at r259575 and head at the same revision. I have tested a patch that ensures IN_MULTI_UNLOCK() is called after any of these error conditions and added KTR output to the particular path that had triggered this panic.

With even this patch in place, we have further found a subsequent race condition that so far weve only reproduced when compiling with KTR, INVARIANTS, and DDB flags, although I suspect the race condition can still occur. Although I dont have a patch to fix that race condition, I am interested in hearing from others how we should handle this case.

The race condition can happen when the userspace application adds a subscription to a multicast address while at the same time it is being removed. The steps to cause the race condition are exactly the same as cited at the beginning of this PR (running quagga ospfd and doing /etc/rc.d/netif restart), however it doesnt seem to actually trigger without INVARIANTS and DDB in our test environment.

The race condition happens in two threads  as seen with the KTR output below, although we have added a little more detail in our version to help debug this case:

509 (0xffffff00473ff490:cpu1): in_getmulti: join 224.0.0.6 on 0xffffff0031a93000(eth0.100))
510 (0xffffff00473ff490:cpu1): in_getmulti: join 224.0.0.6 family 2 len 16 on 0xffffff0031a93000(eth0.100))
520 (0xffffff00473ff490:cpu1): ether_resolvemulti: family 2 len 16 on 0xffffff0031a93000(eth0.100))
521 (0xffffff00473ff490:cpu1): ether_resolvemulti: join 224.0.0.6 family 2 len 16 on 0xffffff0031a93000(eth0.100))
523 (0xffffff00473ff490:cpu1): if_addmulti: ifma allocate (0xffffff00473d6780)

In this thread, ifma allocate is whats happening when [in sys/netinet/in_mcast.c] inp_join_group () will add a new address calling in_join_group_locked(), calling  in_getmulti() and add the address. 

At the same time, the interface is being removed in this path:

537 (0xffffff00474a1920:cpu9): mld_ifdetach: called for ifp 0xffffff0031a93000(eth0.100)
545 (0xffffff00474a1920:cpu9): if_purgemaddrs: will free ifma (0xffffff00473d6780)
565 (0xffffff00474a1920:cpu9): if_freemulti: free ifma (0xffffff00473d6780)

Here the interface ifp is removed via [in sys/if/if.c] if_pur gemaddrs() which will if_delmulti_locked() and then call if_freemulti() which triggers this KASSERT because a new ifma is being added, as above:

	KASSERT(ifma->ifma_protospec == NULL,
	    ("if_freemulti: protospec not NULL"));


Interestingly, this comment seems to hint at this being a known issue: 

/*
 * Detach an interface, removing it from the list of "active" interfaces.
 * If vmove flag is set on entry to if_detach_internal(), perform only a
 * limited subset of cleanup tasks, given that we are moving an ifnet from
 * one vnet to another, where it must be fully operational.
 *
 * XXXRW: There are some significant questions about event ordering, and
 * how to prevent things from starting to use the interface during detach.
 */

For this particular race condition, we continue to think about a fix, but would appreciate input from others as well.


>How-To-Repeat:
See description.
>Fix:
See attached patch.


>Release-Note:
>Audit-Trail:

From: "Bentkofsky, Michael" <MBentkofsky@verisign.com>
To: "bug-followup@FreeBSD.org" <bug-followup@FreeBSD.org>
Cc:  
Subject: Re: kern/185043: Kernel panic: Sleeping thread (tid ..., pid ... )
 owns a non-sleepable lock from netinet/in_multi.c
Date: Mon, 6 Jan 2014 13:23:43 +0000

 --_007_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: multipart/related;
 	boundary="_006_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_";
 	type="multipart/alternative"
 
 --_006_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: multipart/alternative;
 	boundary="_000_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_"
 
 --_000_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: text/plain; charset="us-ascii"
 Content-Transfer-Encoding: quoted-printable
 
 See attached proposed patch.
 
 
 
 Michael Bentkofsky
 Principal Engineer
 mbentkofsky@Verisign.com
 
 m: 703-268-0298  t: 703-948-4274
 12061 Bluemont Way
 Reston, VA 20190
 
 VerisignInc.com<http://www.verisigninc.com/>
 
 [Verisign(tm)]
 
 
 
 
 --_000_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: text/html; charset="us-ascii"
 Content-Transfer-Encoding: quoted-printable
 
 <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
 osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
 xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
 //www.w3.org/TR/REC-html40">
 <head>
 <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
 >
 <meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)">
 <!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
 o\:* {behavior:url(#default#VML);}
 w\:* {behavior:url(#default#VML);}
 .shape {behavior:url(#default#VML);}
 </style><![endif]--><style><!--
 /* Font Definitions */
 @font-face
 	{font-family:Helvetica;
 	panose-1:2 11 6 4 2 2 2 2 2 4;}
 @font-face
 	{font-family:Helvetica;
 	panose-1:2 11 6 4 2 2 2 2 2 4;}
 @font-face
 	{font-family:Calibri;
 	panose-1:2 15 5 2 2 2 4 3 2 4;}
 @font-face
 	{font-family:Tahoma;
 	panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
 	{margin:0in;
 	margin-bottom:.0001pt;
 	font-size:11.0pt;
 	font-family:"Calibri","sans-serif";}
 a:link, span.MsoHyperlink
 	{mso-style-priority:99;
 	color:blue;
 	text-decoration:underline;}
 a:visited, span.MsoHyperlinkFollowed
 	{mso-style-priority:99;
 	color:purple;
 	text-decoration:underline;}
 p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
 	{mso-style-priority:99;
 	mso-style-link:"Balloon Text Char";
 	margin:0in;
 	margin-bottom:.0001pt;
 	font-size:8.0pt;
 	font-family:"Tahoma","sans-serif";}
 span.EmailStyle17
 	{mso-style-type:personal-compose;
 	font-family:"Calibri","sans-serif";
 	color:windowtext;}
 span.BalloonTextChar
 	{mso-style-name:"Balloon Text Char";
 	mso-style-priority:99;
 	mso-style-link:"Balloon Text";
 	font-family:"Tahoma","sans-serif";}
 .MsoChpDefault
 	{mso-style-type:export-only;
 	font-family:"Calibri","sans-serif";}
 @page WordSection1
 	{size:8.5in 11.0in;
 	margin:1.0in 1.0in 1.0in 1.0in;}
 div.WordSection1
 	{page:WordSection1;}
 --></style><!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext=3D"edit" spidmax=3D"1027" />
 </xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext=3D"edit">
 <o:idmap v:ext=3D"edit" data=3D"1" />
 </o:shapelayout></xml><![endif]-->
 </head>
 <body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
 <div class=3D"WordSection1">
 <p class=3D"MsoNormal">See attached proposed patch.<o:p></o:p></p>
 <p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
 <div>
 <table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
 =3D"0" width=3D"371" style=3D"width:278.25pt">
 <tbody>
 <tr>
 <td colspan=3D"2" style=3D"padding:0in 0in 0in 0in">
 <p class=3D"MsoNormal"><img width=3D"371" height=3D"2" id=3D"_x0000_i1025" =
 src=3D"cid:image001.gif@01CF0AB8.94A930D0" alt=3D"Verisign"><span style=3D"=
 font-size:12.0pt"><o:p></o:p></span></p>
 </td>
 </tr>
 <tr>
 <td style=3D"padding:11.25pt 0in 15.0pt 0in">
 <p class=3D"MsoNormal" style=3D"line-height:10.5pt"><b><span style=3D"font-=
 size:9.0pt;font-family:&quot;Helvetica&quot;,&quot;sans-serif&quot;;color:#=
 006AAA">Michael Bentkofsky</span></b><span style=3D"font-size:8.5pt;font-fa=
 mily:&quot;Helvetica&quot;,&quot;sans-serif&quot;;color:#6B6D71"><br>
 Principal Engineer<br>
 mbentkofsky@Verisign.com<br>
 <br>
 m: 703-268-0298&nbsp; t: 703-948-4274<br>
 12061 Bluemont Way<o:p></o:p></span></p>
 <p class=3D"MsoNormal" style=3D"line-height:10.5pt"><span style=3D"font-siz=
 e:8.5pt;font-family:&quot;Helvetica&quot;,&quot;sans-serif&quot;;color:#6B6=
 D71">Reston, VA 20190<br>
 <br>
 <a href=3D"http://www.verisigninc.com/"><span style=3D"font-size:9.0pt;colo=
 r:#006AAA;text-decoration:none">VerisignInc.com</span></a>
 <o:p></o:p></span></p>
 </td>
 <td valign=3D"top" style=3D"padding:11.25pt 0in 0in 0in">
 <p class=3D"MsoNormal"><!--[if gte vml 1]><v:shapetype id=3D"_x0000_t75" co=
 ordsize=3D"21600,21600" o:spt=3D"75" o:preferrelative=3D"t" path=3D"m@4@5l@=
 4@11@9@11@9@5xe" filled=3D"f" stroked=3D"f">
 <v:stroke joinstyle=3D"miter" />
 <v:formulas>
 <v:f eqn=3D"if lineDrawn pixelLineWidth 0" />
 <v:f eqn=3D"sum @0 1 0" />
 <v:f eqn=3D"sum 0 0 @1" />
 <v:f eqn=3D"prod @2 1 2" />
 <v:f eqn=3D"prod @3 21600 pixelWidth" />
 <v:f eqn=3D"prod @3 21600 pixelHeight" />
 <v:f eqn=3D"sum @0 0 1" />
 <v:f eqn=3D"prod @6 1 2" />
 <v:f eqn=3D"prod @7 21600 pixelWidth" />
 <v:f eqn=3D"sum @8 21600 0" />
 <v:f eqn=3D"prod @7 21600 pixelHeight" />
 <v:f eqn=3D"sum @10 21600 0" />
 </v:formulas>
 <v:path o:extrusionok=3D"f" gradientshapeok=3D"t" o:connecttype=3D"rect" />
 <o:lock v:ext=3D"edit" aspectratio=3D"t" />
 </v:shapetype><v:shape id=3D"Picture_x0020_2" o:spid=3D"_x0000_s1026" type=
 =3D"#_x0000_t75" alt=3D"Verisign&#8482;" style=3D'position:absolute;margin-=
 left:3.55pt;margin-top:0;width:54.75pt;height:48pt;z-index:251659264;visibi=
 lity:visible;mso-wrap-style:square;mso-width-percent:0;mso-height-percent:0=
 ;mso-wrap-distance-left:0;mso-wrap-distance-top:0;mso-wrap-distance-right:0=
 ;mso-wrap-distance-bottom:0;mso-position-horizontal:right;mso-position-hori=
 zontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-r=
 elative:line;mso-width-percent:0;mso-height-percent:0;mso-width-relative:pa=
 ge;mso-height-relative:page' o:allowoverlap=3D"f">
 <v:imagedata src=3D"cid:image002.gif@01CF0AB8.9CE7F060" o:href=3D"file:///C=
 :\Users\mbentkofsky\AppData\Roaming\Microsoft\Signatures\logo.gif" />
 <w:wrap type=3D"square" anchory=3D"line"/>
 </v:shape><![endif]--><![if !vml]><img width=3D"73" height=3D"64" src=3D"ci=
 d:image002.gif@01CF0AB8.9CE7F060" align=3D"right" alt=3D"Verisign&#8482;" v=
 :shapes=3D"Picture_x0020_2"><![endif]><span style=3D"font-size:12.0pt"><o:p=
 ></o:p></span></p>
 </td>
 </tr>
 </tbody>
 </table>
 </div>
 <p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
 <p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
 </div>
 </body>
 </html>
 
 --_000_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_--
 
 --_006_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: image/gif; name="image001.gif"
 Content-Description: image001.gif
 Content-Disposition: inline; filename="image001.gif"; size=131;
 	creation-date="Mon, 06 Jan 2014 13:23:43 GMT";
 	modification-date="Mon, 06 Jan 2014 13:23:43 GMT"
 Content-ID: <image001.gif@01CF0AB8.94A930D0>
 Content-Transfer-Encoding: base64
 
 R0lGODlhcwECAKIAAP////f395OUl9vc3eTl5QAAAAAAAAAAACH5BAAAAAAALAAAAABzAQIAAANI
 GAPK2/BJR2OdNuN9u/bcJ4YkaI5nia5qm74s7Mb0TBICgOv57vdAnvA3DBKPxmRxiWQqm9Cn1EmN
 VqfWLHZ77Wq93K84LE0AADs=
 
 --_006_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: image/gif; name="image002.gif"
 Content-Description: image002.gif
 Content-Disposition: inline; filename="image002.gif"; size=3105;
 	creation-date="Mon, 06 Jan 2014 13:23:43 GMT";
 	modification-date="Mon, 06 Jan 2014 13:23:43 GMT"
 Content-ID: <image002.gif@01CF0AB8.9CE7F060>
 Content-Transfer-Encoding: base64
 
 R0lGODlhSQBAAPcAANLT0yxljJiamt7e3rvN2drb26Cioj+Brg1TggBcm2+dvB9mlsjJyV6LqQ9h
 mcXKzX+jvJGTk4qLi6y8xnueth5dip2enrO/xtTV1cHBwYyOjr/U4wBZlgBOhc7PzwBSikx0j9jZ
 2WWClQBTjL/S34+xyaWmpj9+qb6/vwBKfY6QkABgosXGxm6GlgBMgd/q8czNzQBWkT96orW2tqex
 uABfoABQh9DR0ZSWlq+vr6eoqImKioKWorm7uwBIehRWg+/z9pSuwQBNgpqcnDRrknKWr7fJ1q3D
 0+ru8kp7nQBgoN/o75+goABal5eZmQBKfGqLoQ9dkqKkpLnL15+8z6qrq+3x9P///x1ahA9moMPD
 w5+/1Q9ajT+DslF+nX+syy90o26Wsi9pkXBwcNzc3JSUlP39/f7+/gBenuXl5ff397i4uABbmfz8
 /ABdnfv7+wBdnO7u7gBamHl5eQBXk/n5+QBUjvr6+gBen/Ly8vj4+ABYlQBRiQBVkABfn/X19QBY
 lABVj+vr6wBRiPb29gBbmvDw8KampvT09IKCgsrKyoaIiPHx8ezs7Ojo6Orq6gBUje3t7QBOgwBP
 hgBWkgBXkgBZlQBQiPPz852dnQBcnLe4uODg4ABJfOfn5+Hh4e/v7+Pj47Kzs4SGhuzt7enq6pOV
 lfP09MrLy+/w8ABUj+Hi4uTk5KqsrMPExKipqdbX15WXl5GXmq2urubm5ubn5+np6QBbmABLfwBX
 lO/096Slpby9vbCxsbS1teLi4gBenQBdngBMf8HCwu/0+MnT2YqMjAlPgHWJluPk5Nbb3gBYk1+P
 sERvi0+FqU+Ksj5tjp2fn9HS0t3d3bu8vLXG02+Sq7O0tJCfqY6Zn4OfsgBHeQBSiR9vpilhiNPT
 09zg5La3t5aptdXW1p/A13uXq3+cr8/e6D90mVeEo6/I2SRhjC9wm8vLyw5Rf6Cmqezw8zBkhzFo
 j3+nw3+qx4invMLL0QBVjj+Aq0V0leLj46mqqo2swS96rJOZndTd4yH5BAAAAAAALAAAAABJAEAA
 AAj/AK8IHEiwoMGDA8+cMWNGIcKHECNKlHimTR1CeUBFatQoEqg8hOq0OTOxpMmJZvTkecSKVqlG
 hgwxysOokS1Pj/LoMXOyp882hCKxYkUqz6k/hNToqXPnzZs2ZuoY8hSJUBufWCGmjPQrDak4qWYe
 Tbq06VOGZwg9irQzq9uBbzCx+uSolKCvYY0iVcrUKdSGZxA5wvTmbdY7cTh9SlOr7l2w1epRmDyZ
 ABK/aCs2inPHcM86gshwWhWKsSNwQZJs89EphesUnTr5EMMP3l+HmATV8VyyziNpBQaMDqWsiLtO
 LjpMGvThA59BNjoIwdUJQRgrma+s3M0b4p1GNzAU/yAjfAKWFJIufRhhJ1CfGDH69FE1gk8HFykQ
 HMmep1Hn7ge1YYg0MMASwnjW+CCEDR/Y0QcldACyhyUU7gFIJTEE8oEkwnTSQHaMGHIVgAQFFoIW
 AGBgoBcpdMAHJH3QsQcHTcjBxo1syCEHB3vkEoMdNgjxhBjYOSQIIiSRKFAdaQyDyg0peoHLJB+o
 QgkgHNiYQAKawOHlloWw0YQldPTBhxApoJNZG7ZwR6IZhsCAAgwe3KDNlB8EQkeWbCQAhxvBoCGo
 oG7AoUkht3AASAxnPhFGZjHxRKIen6yhBSowXIBAB3nueYufbqCBhx9+1FADqXgQmoCYi57ZCQGZ
 Of+iB4lnMMLADCwwgAoRQgwCSQyANNHnn6KaWsMKpvqBBjBuJFCIHJZUEogNwlRwG01J8nYHLb5s
 4goL4uAZxQkn4HPAuQd0kcWxK7RbgyZdoHsAPvicAMYIkqQAwV9vOPIfb39gMEsPGbgijxDcjBAF
 EAdtAEe77cJxAEIK2MGHCxWcZYYgf3R3BigotEINCjSkMMkIgfDBDEJd+NGuH4C8cNASH/woSSdH
 nIUJKNm+1YYjouzTAy9QuMBHINIKQcJBLyTQbgL0ICQDsDEMgksDft3hyIiG1fHJLlVs0kMAktQ8
 ox0yIPSFoA7ocpA6gXDAQSUjCFGBWW3Q4uZbanz/I8UrM2zizsmUcMAGB3xQcRAxWTSxBUILcPAs
 IKrcjIRZnqjBGyIwMPGKKDOkYAMkdDRRSAJ0LMCwQVuAgdA8dGwpxx59TJICAX3FgQhvmChigQm9
 YIOLDXaUnoAbhUACAULnHKSLAwmgAQcblvQxSApTlNUIJp6dkQcDQxgwCw+4XKJKLnIcDwwHNixx
 EAnLDSI/czGwIej0llSNPV+C5NFzVt8TQDRaQb5L2CEXTTgeHuAQA2cg5Bnp29KW3ICHVOGPUSkw
 Aln6tzkGxEIAr3jH8IqXQArigQ0fWJpBXpAFiEHsVGjQBBtodz0j7OVIAGuHKWJhgleYbASVkBwF
 /5UFCHaoDQ0uRJYfgpEAOQBiWp34x1ho0THP6GEAETAFE0zgjQ6MIAaGgwMaSpUASCjOIMToRhJr
 gIdmNYEOdpgEAsTyB0/MyjN3SIMTIuAEKYBACB/owx7SR0E2coALqysIOR7mLmVNjwOUqFsS8nKK
 NPzrLWZoxCtUEAEDtKB8JCyEGEvlhj4oACH9UAKy2Nis2fXhA7gIAlgYIYhGSMow3huGBlQgAAP8
 4GQxGKQCTyWHQbivIM8zlgUPB0cbdAIceEmD/7qjhwJoQAMRiAYIjFY8w2lCVH5wQyXSVhAFyKFU
 qWol7T4ghHTY5SusuCNv2iAIE0hAA07wxzE41f+HYIlSVGhAoQoF8oIYwMEP6UxAoigBCWcWwzGe
 EATXAPaNRdxzCC1wgQ2+OMhCaCJUbkgdQU7QBIDCYVUcoIMqLlYE05TiF1UE0BseIQWLRmAI8egV
 JCixB2GBig0jKIFANhCD6LnhUDuig4Y6EADSMCYZjygMrf4Qgh1YFAeywIIk+GAHYGXpdKhD5BUi
 Z6hVNWEP0vqAHO0xnDTo4w//m2ckrjEKi8Yiq5IYxAhi1FMbcWAEzChBH+QQpiYo6kdqRcAFyDMa
 TsRhoiSqgycMUFcJ3BULC2pQDGQkt0pA4h7LMKyFKBGI+nQAARM4EHkG4Im9KSkt04hAZe/ajOT/
 8IE976kEhiBEB0pkaARqFQIRHqCiA8EiFISI65sQUQDZWtQUQ0DGD1wwCfWMgD12yC4kgMuHSdjN
 HHVK0Tg8MABE3FJJBDEDJppbWRUMIRoi8AYuhKAcG1zivjaYhCRcsI5y6IpON/AAAwaAifOiN72I
 CIUUKquBWETDANkQATS88QNc4AIBAcgHFGhQsFyhAhW5+oV5D/wQM6jBFiiQgEV36QQmSKGHrZhF
 L0AnNl6goGAZQAEvPGALNRiYxAU5wx0MUYAcGOOenIyFBaSggxjPOHCbCMcMROELVwzAEHdQLpAL
 YuJIFCAcpthlFj84hCXvYhc62EcrRMECMkTC/8dbNkkb1ACKNHhgEyawwA4FUGbP+SIDGEgDKNQA
 2Tij5A5/MMQj0vCJAZCBPIt5hCH+cIcfG/okC3lDHfSgBr68oSGXDrWoR03qUpv61JdOw6M1B5FH
 kyEOPpHAGMbA6hzM+huzzvWsyXCFMuh6DIlYg0B8PQaBpCERuj6E5sgwa2Ff4djJZvWsJSAQZo+B
 14eYwxzIkIFZK0Igsp7DFX69616TewzfMHexr4DsX89BDdYWdhrmMGttT1sguc7AFazNazL4+tWz
 PsQV4hDwcY+hDAYhtrFnnQl173vWObiCGnKw7YePQdiZ8LZAsu3sXL+b3wYJ9xUUcWuDB3sNKP4f
 9qwFooZZI1zh1g72N9IwkHgbnNoDgTW+c30IkBek22NIQ8bFbfBfq/zgZWi3sBV+BVnreg7ftnmz
 n12GqpeB5vWeNdB5XRCCX5zeAjf4HKyOcHVH2+ESz4HTcw3vqUPc4uWGOLLpfe2DrL3uBi87QYi9
 BqfTHO1q0LnQd21zeidC4tyO+8VxnWuuF4Tksz78ziXgajLQHOYuP/oVvqFtRcQhDU6Pg80PwfBH
 O53XUyc23gvS8rfv/NcvX/kVMo5uh0P+1wK3eRzo/mvUX3zgjUdIDqr+916TveoRH37Z41B1gSu/
 2rQHtrPTUPVvD5z2c1gD8Y1vfe1fvSABAQA7
 
 --_006_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_--
 
 --_007_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_
 Content-Type: application/octet-stream; name="in_multi_patch"
 Content-Description: in_multi_patch
 Content-Disposition: attachment; filename="in_multi_patch"; size=2379;
 	creation-date="Fri, 20 Dec 2013 18:55:51 GMT";
 	modification-date="Fri, 20 Dec 2013 18:55:51 GMT"
 Content-Transfer-Encoding: base64
 
 SW5kZXg6IHN5cy9uZXRpbmV0L2luX21jYXN0LmMKPT09PT09PT09PT09PT09PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gc3lzL25ldGluZXQv
 aW5fbWNhc3QuYwkocmV2aXNpb24gMjU5MjY0KQorKysgc3lzL25ldGluZXQvaW5fbWNhc3QuYwko
 d29ya2luZyBjb3B5KQpAQCAtMTQ5Miw3ICsxNDkyLDcgQEAKIAllcnJvciA9IGlubV9tZXJnZShp
 bm0sIGltZik7CiAJaWYgKGVycm9yKSB7CiAJCUNUUjEoS1RSX0lHTVBWMywgIiVzOiBmYWlsZWQg
 dG8gbWVyZ2UgaW5tIHN0YXRlIiwgX19mdW5jX18pOwotCQlnb3RvIG91dF9pbWZfcm9sbGJhY2s7
 CisJCWdvdG8gb3V0X2luX211bHRpX2xvY2tlZDsKIAl9CiAKIAlDVFIxKEtUUl9JR01QVjMsICIl
 czogZG9pbmcgaWdtcCBkb3duY2FsbCIsIF9fZnVuY19fKTsKQEAgLTE1MDAsNiArMTUwMCw4IEBA
 CiAJaWYgKGVycm9yKQogCQlDVFIxKEtUUl9JR01QVjMsICIlczogZmFpbGVkIGlnbXAgZG93bmNh
 bGwiLCBfX2Z1bmNfXyk7CiAKK291dF9pbl9tdWx0aV9sb2NrZWQ6CisKIAlJTl9NVUxUSV9VTkxP
 Q0soKTsKIAogb3V0X2ltZl9yb2xsYmFjazoKQEAgLTIxNjgsOCArMjE3MCwxMiBAQAogCWlmIChp
 c19uZXcpIHsKIAkJZXJyb3IgPSBpbl9qb2luZ3JvdXBfbG9ja2VkKGlmcCwgJmdzYS0+c2luLnNp
 bl9hZGRyLCBpbWYsCiAJCSAgICAmaW5tKTsKLQkJaWYgKGVycm9yKQorCQlpZiAoZXJyb3IpIHsK
 KyAgICAgICAgICAgICAgICAgICAgICAgIENUUjEoS1RSX0lHTVBWMywgIiVzOiBpbl9qb2luZ3Jv
 dXBfbG9ja2VkIGZhaWxlZCIsIAorICAgICAgICAgICAgICAgICAgICAgICAgICAgIF9fZnVuY19f
 KTsKKyAgICAgICAgICAgICAgICAgICAgICAgIElOX01VTFRJX1VOTE9DSygpOwogCQkJZ290byBv
 dXRfaW1vX2ZyZWU7CisgICAgICAgICAgICAgICAgfQogCQlpbW8tPmltb19tZW1iZXJzaGlwW2lk
 eF0gPSBpbm07CiAJfSBlbHNlIHsKIAkJQ1RSMShLVFJfSUdNUFYzLCAiJXM6IG1lcmdlIGlubSBz
 dGF0ZSIsIF9fZnVuY19fKTsKQEAgLTIxNzcsMjAgKzIxODMsMjEgQEAKIAkJaWYgKGVycm9yKSB7
 CiAJCQlDVFIxKEtUUl9JR01QVjMsICIlczogZmFpbGVkIHRvIG1lcmdlIGlubSBzdGF0ZSIsCiAJ
 CQkgICAgX19mdW5jX18pOwotCQkJZ290byBvdXRfaW1mX3JvbGxiYWNrOworCQkJZ290byBvdXRf
 aW5fbXVsdGlfbG9ja2VkOwogCQl9CiAJCUNUUjEoS1RSX0lHTVBWMywgIiVzOiBkb2luZyBpZ21w
 IGRvd25jYWxsIiwgX19mdW5jX18pOwogCQllcnJvciA9IGlnbXBfY2hhbmdlX3N0YXRlKGlubSk7
 CiAJCWlmIChlcnJvcikgewogCQkJQ1RSMShLVFJfSUdNUFYzLCAiJXM6IGZhaWxlZCBpZ21wIGRv
 d25jYWxsIiwKIAkJCSAgICBfX2Z1bmNfXyk7Ci0JCQlnb3RvIG91dF9pbWZfcm9sbGJhY2s7CisJ
 CQlnb3RvIG91dF9pbl9tdWx0aV9sb2NrZWQ7CiAJCX0KIAl9CiAKK291dF9pbl9tdWx0aV9sb2Nr
 ZWQ6CisKIAlJTl9NVUxUSV9VTkxPQ0soKTsKIAotb3V0X2ltZl9yb2xsYmFjazoKIAlJTlBfV0xP
 Q0tfQVNTRVJUKGlucCk7CiAJaWYgKGVycm9yKSB7CiAJCWltZl9yb2xsYmFjayhpbWYpOwpAQCAt
 MjM5NCw3ICsyNDAxLDcgQEAKIAkJaWYgKGVycm9yKSB7CiAJCQlDVFIxKEtUUl9JR01QVjMsICIl
 czogZmFpbGVkIHRvIG1lcmdlIGlubSBzdGF0ZSIsCiAJCQkgICAgX19mdW5jX18pOwotCQkJZ290
 byBvdXRfaW1mX3JvbGxiYWNrOworCQkJZ290byBvdXRfaW5fbXVsdGlfbG9ja2VkOwogCQl9CiAK
 IAkJQ1RSMShLVFJfSUdNUFYzLCAiJXM6IGRvaW5nIGlnbXAgZG93bmNhbGwiLCBfX2Z1bmNfXyk7
 CkBAIC0yNDA1LDkgKzI0MTIsMTAgQEAKIAkJfQogCX0KIAorb3V0X2luX211bHRpX2xvY2tlZDoK
 KwogCUlOX01VTFRJX1VOTE9DSygpOwogCi1vdXRfaW1mX3JvbGxiYWNrOgogCWlmIChlcnJvcikK
 IAkJaW1mX3JvbGxiYWNrKGltZik7CiAJZWxzZQpAQCAtMjY0MSw3ICsyNjQ5LDcgQEAKIAllcnJv
 ciA9IGlubV9tZXJnZShpbm0sIGltZik7CiAJaWYgKGVycm9yKSB7CiAJCUNUUjEoS1RSX0lHTVBW
 MywgIiVzOiBmYWlsZWQgdG8gbWVyZ2UgaW5tIHN0YXRlIiwgX19mdW5jX18pOwotCQlnb3RvIG91
 dF9pbWZfcm9sbGJhY2s7CisJCWdvdG8gb3V0X2luX211bHRpX2xvY2tlZDsKIAl9CiAKIAlDVFIx
 KEtUUl9JR01QVjMsICIlczogZG9pbmcgaWdtcCBkb3duY2FsbCIsIF9fZnVuY19fKTsKQEAgLTI2
 NDksNiArMjY1Nyw4IEBACiAJaWYgKGVycm9yKQogCQlDVFIxKEtUUl9JR01QVjMsICIlczogZmFp
 bGVkIGlnbXAgZG93bmNhbGwiLCBfX2Z1bmNfXyk7CiAKK291dF9pbl9tdWx0aV9sb2NrZWQ6CisK
 IAlJTl9NVUxUSV9VTkxPQ0soKTsKIAogb3V0X2ltZl9yb2xsYmFjazoK
 
 --_007_080FBD5B7A09F845842100A6DE79623346E3DB5BBRN1WNEXMBX01vc_--

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/185043: commit references a PR
Date: Thu, 16 Jan 2014 22:15:01 +0000 (UTC)

 Author: gnn
 Date: Thu Jan 16 22:14:54 2014
 New Revision: 260796
 URL: http://svnweb.freebsd.org/changeset/base/260796
 
 Log:
   Fix various places where we don't properly release a lock
   
   PR:		185043
   Submitted by:	Michael Bentkofsky
   MFC after:	2 weeks
 
 Modified:
   head/sys/netinet/in_mcast.c
 
 Modified: head/sys/netinet/in_mcast.c
 ==============================================================================
 --- head/sys/netinet/in_mcast.c	Thu Jan 16 21:56:05 2014	(r260795)
 +++ head/sys/netinet/in_mcast.c	Thu Jan 16 22:14:54 2014	(r260796)
 @@ -1496,7 +1496,7 @@ inp_block_unblock_source(struct inpcb *i
  	error = inm_merge(inm, imf);
  	if (error) {
  		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
 -		goto out_imf_rollback;
 +		goto out_in_multi_locked;
  	}
  
  	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -1504,6 +1504,8 @@ inp_block_unblock_source(struct inpcb *i
  	if (error)
  		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
  out_imf_rollback:
 @@ -2172,8 +2174,12 @@ inp_join_group(struct inpcb *inp, struct
  	if (is_new) {
  		error = in_joingroup_locked(ifp, &gsa->sin.sin_addr, imf,
  		    &inm);
 -		if (error)
 +		if (error) {
 +                        CTR1(KTR_IGMPV3, "%s: in_joingroup_locked failed", 
 +                            __func__);
 +                        IN_MULTI_UNLOCK();
  			goto out_imo_free;
 +                }
  		imo->imo_membership[idx] = inm;
  	} else {
  		CTR1(KTR_IGMPV3, "%s: merge inm state", __func__);
 @@ -2181,20 +2187,21 @@ inp_join_group(struct inpcb *inp, struct
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed to merge inm state",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  		CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
  		error = igmp_change_state(inm);
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed igmp downcall",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  	}
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
 -out_imf_rollback:
  	INP_WLOCK_ASSERT(inp);
  	if (error) {
  		imf_rollback(imf);
 @@ -2398,7 +2405,7 @@ inp_leave_group(struct inpcb *inp, struc
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed to merge inm state",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  
  		CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -2409,9 +2416,10 @@ inp_leave_group(struct inpcb *inp, struc
  		}
  	}
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
 -out_imf_rollback:
  	if (error)
  		imf_rollback(imf);
  	else
 @@ -2645,7 +2653,7 @@ inp_set_source_filters(struct inpcb *inp
  	error = inm_merge(inm, imf);
  	if (error) {
  		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
 -		goto out_imf_rollback;
 +		goto out_in_multi_locked;
  	}
  
  	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -2653,6 +2661,8 @@ inp_set_source_filters(struct inpcb *inp
  	if (error)
  		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
  out_imf_rollback:
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: jmg 
State-Changed-When: Tue Jan 28 18:18:18 UTC 2014 
State-Changed-Why:  
gnn has committed the fix, but still needs to be MFC'd... 


Responsible-Changed-From-To: freebsd-bugs->gnn 
Responsible-Changed-By: jmg 
Responsible-Changed-When: Tue Jan 28 18:18:18 UTC 2014 
Responsible-Changed-Why:  
gnn has committed the fix, but still needs to be MFC'd... 

http://www.freebsd.org/cgi/query-pr.cgi?pr=185043 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/185043: commit references a PR
Date: Mon,  3 Feb 2014 03:31:42 +0000 (UTC)

 Author: gnn
 Date: Mon Feb  3 03:31:35 2014
 New Revision: 261425
 URL: http://svnweb.freebsd.org/changeset/base/261425
 
 Log:
   MFC 260796
   
   Fix various places where we don't properly release a lock
   
   PR:		185043
   Submitted by:	Michael Bentkofsky
 
 Modified:
   stable/10/sys/netinet/in_mcast.c
 Directory Properties:
   stable/10/   (props changed)
 
 Modified: stable/10/sys/netinet/in_mcast.c
 ==============================================================================
 --- stable/10/sys/netinet/in_mcast.c	Mon Feb  3 02:56:23 2014	(r261424)
 +++ stable/10/sys/netinet/in_mcast.c	Mon Feb  3 03:31:35 2014	(r261425)
 @@ -1452,7 +1452,7 @@ inp_block_unblock_source(struct inpcb *i
  	error = inm_merge(inm, imf);
  	if (error) {
  		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
 -		goto out_imf_rollback;
 +		goto out_in_multi_locked;
  	}
  
  	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -1460,6 +1460,8 @@ inp_block_unblock_source(struct inpcb *i
  	if (error)
  		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
  out_imf_rollback:
 @@ -2128,8 +2130,12 @@ inp_join_group(struct inpcb *inp, struct
  	if (is_new) {
  		error = in_joingroup_locked(ifp, &gsa->sin.sin_addr, imf,
  		    &inm);
 -		if (error)
 +		if (error) {
 +                        CTR1(KTR_IGMPV3, "%s: in_joingroup_locked failed", 
 +                            __func__);
 +                        IN_MULTI_UNLOCK();
  			goto out_imo_free;
 +                }
  		imo->imo_membership[idx] = inm;
  	} else {
  		CTR1(KTR_IGMPV3, "%s: merge inm state", __func__);
 @@ -2137,20 +2143,21 @@ inp_join_group(struct inpcb *inp, struct
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed to merge inm state",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  		CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
  		error = igmp_change_state(inm);
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed igmp downcall",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  	}
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
 -out_imf_rollback:
  	INP_WLOCK_ASSERT(inp);
  	if (error) {
  		imf_rollback(imf);
 @@ -2354,7 +2361,7 @@ inp_leave_group(struct inpcb *inp, struc
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed to merge inm state",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  
  		CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -2365,9 +2372,10 @@ inp_leave_group(struct inpcb *inp, struc
  		}
  	}
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
 -out_imf_rollback:
  	if (error)
  		imf_rollback(imf);
  	else
 @@ -2601,7 +2609,7 @@ inp_set_source_filters(struct inpcb *inp
  	error = inm_merge(inm, imf);
  	if (error) {
  		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
 -		goto out_imf_rollback;
 +		goto out_in_multi_locked;
  	}
  
  	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -2609,6 +2617,8 @@ inp_set_source_filters(struct inpcb *inp
  	if (error)
  		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
  out_imf_rollback:
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/185043: commit references a PR
Date: Sun,  9 Feb 2014 21:48:22 +0000 (UTC)

 Author: gnn
 Date: Sun Feb  9 21:48:14 2014
 New Revision: 261694
 URL: http://svnweb.freebsd.org/changeset/base/261694
 
 Log:
   MFC: 260796
   
   Fix various places where we don't properly release a lock.
   
   PR:		185043
   Submitted by:	Michael Bentkofsky
 
 Modified:
   stable/9/sys/netinet/in_mcast.c
 Directory Properties:
   stable/9/sys/   (props changed)
 
 Modified: stable/9/sys/netinet/in_mcast.c
 ==============================================================================
 --- stable/9/sys/netinet/in_mcast.c	Sun Feb  9 21:47:46 2014	(r261693)
 +++ stable/9/sys/netinet/in_mcast.c	Sun Feb  9 21:48:14 2014	(r261694)
 @@ -1446,7 +1446,7 @@ inp_block_unblock_source(struct inpcb *i
  	error = inm_merge(inm, imf);
  	if (error) {
  		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
 -		goto out_imf_rollback;
 +		goto out_in_multi_locked;
  	}
  
  	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -1454,6 +1454,8 @@ inp_block_unblock_source(struct inpcb *i
  	if (error)
  		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
  out_imf_rollback:
 @@ -2094,8 +2096,12 @@ inp_join_group(struct inpcb *inp, struct
  	if (is_new) {
  		error = in_joingroup_locked(ifp, &gsa->sin.sin_addr, imf,
  		    &inm);
 -		if (error)
 +		if (error) {
 +                        CTR1(KTR_IGMPV3, "%s: in_joingroup_locked failed", 
 +                            __func__);
 +                        IN_MULTI_UNLOCK();
  			goto out_imo_free;
 +                }
  		imo->imo_membership[idx] = inm;
  	} else {
  		CTR1(KTR_IGMPV3, "%s: merge inm state", __func__);
 @@ -2103,20 +2109,21 @@ inp_join_group(struct inpcb *inp, struct
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed to merge inm state",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  		CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
  		error = igmp_change_state(inm);
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed igmp downcall",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  	}
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
 -out_imf_rollback:
  	INP_WLOCK_ASSERT(inp);
  	if (error) {
  		imf_rollback(imf);
 @@ -2320,7 +2327,7 @@ inp_leave_group(struct inpcb *inp, struc
  		if (error) {
  			CTR1(KTR_IGMPV3, "%s: failed to merge inm state",
  			    __func__);
 -			goto out_imf_rollback;
 +			goto out_in_multi_locked;
  		}
  
  		CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -2331,9 +2338,10 @@ inp_leave_group(struct inpcb *inp, struc
  		}
  	}
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
 -out_imf_rollback:
  	if (error)
  		imf_rollback(imf);
  	else
 @@ -2567,7 +2575,7 @@ inp_set_source_filters(struct inpcb *inp
  	error = inm_merge(inm, imf);
  	if (error) {
  		CTR1(KTR_IGMPV3, "%s: failed to merge inm state", __func__);
 -		goto out_imf_rollback;
 +		goto out_in_multi_locked;
  	}
  
  	CTR1(KTR_IGMPV3, "%s: doing igmp downcall", __func__);
 @@ -2575,6 +2583,8 @@ inp_set_source_filters(struct inpcb *inp
  	if (error)
  		CTR1(KTR_IGMPV3, "%s: failed igmp downcall", __func__);
  
 +out_in_multi_locked:
 +
  	IN_MULTI_UNLOCK();
  
  out_imf_rollback:
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
