> On 6 Dec 2023, at 00:18, Vitaliy Makkoveev <o...@bsdbox.dev> wrote:
>
>> On 5 Dec 2023, at 22:40, Alexander Bluhm <alexander.bl...@gmx.net> wrote:
>>
>> On Tue, Dec 05, 2023 at 08:22:52PM +0100, Jo Geraerts wrote:
>>> maybe its a good idea to just change 1 thing
>>
>> Yes, only change 1 thing. I just wrote down all my ideas.
>>
>>>> It could be race or a single packet that crashes the machine.
>>
>> Found a race when we insert the IGMP packet into the socket buffer.
>> Unicast takes a mutex, but multicast code does not.
>>
>>> Other than that, I suspect the issue was introduced in 7.3 because
>>> (iirc) I never ran into that issue before 7.3.
>>
>> The parallel receive as commited in 7.2.
>> ----------------------------
>> revision 1.148
>> date: 2022/09/13 09:05:02; author: mvs; state: Exp; lines: +30 -3;
>> commitid: 7OEqRrdapIF2uHHb;
>> Do soreceive() with shared netlock for raw sockets.
>>
>> ok bluhm@
>> ----------------------------
>>
>> Please try the diff below.
>>
>> bluhm
>>
>
> Diff makes sense in any case.
>
Just checked, socket6_send() is identical to socket_send() and needs
to be reworked in the same way.
>> Index: netinet/ip_mroute.c
>> ===================================================================
>> RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_mroute.c,v
>> diff -u -p -r1.139 ip_mroute.c
>> --- netinet/ip_mroute.c 14 Jun 2023 14:30:08 -0000 1.139
>> +++ netinet/ip_mroute.c 5 Dec 2023 19:24:11 -0000
>> @@ -1048,11 +1048,18 @@ del_mfc(struct socket *so, struct mbuf *
>> }
>>
>> int
>> -socket_send(struct socket *s, struct mbuf *mm, struct sockaddr_in *src)
>> +socket_send(struct socket *so, struct mbuf *mm, struct sockaddr_in *src)
>> {
>> - if (s != NULL) {
>> - if (sbappendaddr(s, &s->so_rcv, sintosa(src), mm, NULL) != 0) {
>> - sorwakeup(s);
>> + if (so != NULL) {
>> + struct inpcb *inp = sotoinpcb(so);
>> + int ret;
>> +
>> + mtx_enter(&inp->inp_mtx);
>> + ret = sbappendaddr(so, &so->so_rcv, sintosa(src), mm, NULL);
>> + mtx_leave(&inp->inp_mtx);
>> +
>> + if (ret != 0) {
>> + sorwakeup(so);
>> return (0);
>> }
>> }
>>
>
