On Mon, Sep 17, 2018 at 04:00:28PM +0200, Alexander Bluhm wrote: > + /* XXXSMP Is it safe to call notify with inpcbtable mutex? */ > if (notify) > (*notify)(inp, errno);
visa@ pointed out that this may cause a deadlock as the notify functions may grab the kernel lock. If we always take the kernel lock in in_pcbnotifyall() before the mutex, it fixes the deadlock. As notifications are not in the hot path, it does not matter for performance. ok? bluhm Index: kern/kern_sysctl.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/kern/kern_sysctl.c,v retrieving revision 1.346 diff -u -p -r1.346 kern_sysctl.c --- kern/kern_sysctl.c 12 Jul 2018 01:23:38 -0000 1.346 +++ kern/kern_sysctl.c 19 Sep 2018 19:30:06 -0000 @@ -1179,7 +1179,8 @@ fill_file(struct kinfo_file *kf, struct kf->inp_rtableid = inpcb->inp_rtableid; if (so->so_type == SOCK_RAW) kf->inp_proto = inpcb->inp_ip.ip_p; - if (so->so_proto->pr_protocol == IPPROTO_TCP) { + if (so->so_proto->pr_protocol == IPPROTO_TCP && + inpcb->inp_ppcb != NULL) { struct tcpcb *tcpcb = (void *)inpcb->inp_ppcb; kf->t_rcv_wnd = tcpcb->rcv_wnd; kf->t_snd_wnd = tcpcb->snd_wnd; @@ -1206,7 +1207,8 @@ fill_file(struct kinfo_file *kf, struct kf->inp_rtableid = inpcb->inp_rtableid; if (so->so_type == SOCK_RAW) kf->inp_proto = inpcb->inp_ipv6.ip6_nxt; - if (so->so_proto->pr_protocol == IPPROTO_TCP) { + if (so->so_proto->pr_protocol == IPPROTO_TCP && + inpcb->inp_ppcb != NULL) { struct tcpcb *tcpcb = (void *)inpcb->inp_ppcb; kf->t_rcv_wnd = tcpcb->rcv_wnd; kf->t_snd_wnd = tcpcb->snd_wnd; @@ -1320,10 +1322,16 @@ sysctl_file(int *name, u_int namelen, ch } \ needed += elem_size; \ } while (0) + #define FILLIT(fp, fdp, i, vp, pr) \ FILLIT2(fp, fdp, i, vp, pr, NULL) -#define FILLSO(so) \ - FILLIT2(NULL, NULL, 0, NULL, NULL, so) + +#define FILLINPCB(inp) do { \ + mtx_enter(&inp->inp_mtx); \ + if (inp->inp_socket != NULL) \ + FILLIT2(NULL, NULL, 0, NULL, NULL, inp->inp_socket); \ + mtx_leave(&inp->inp_mtx); \ +} while (0) switch (op) { case KERN_FILE_BYFILE: @@ -1331,19 +1339,26 @@ sysctl_file(int *name, u_int namelen, ch if (arg == DTYPE_SOCKET) { struct inpcb *inp; - NET_LOCK(); + /* + * The inpcb and socket fields are accessed and read + * without net lock. This may result in inconsistent + * data provided to userland. The fix will be to + * protect the socket fields with the inpcb mutex. + * XXXSMP + */ + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH(inp, &tcbtable.inpt_queue, inp_queue) - FILLSO(inp->inp_socket); + FILLINPCB(inp); TAILQ_FOREACH(inp, &udbtable.inpt_queue, inp_queue) - FILLSO(inp->inp_socket); + FILLINPCB(inp); TAILQ_FOREACH(inp, &rawcbtable.inpt_queue, inp_queue) - FILLSO(inp->inp_socket); + FILLINPCB(inp); #ifdef INET6 TAILQ_FOREACH(inp, &rawin6pcbtable.inpt_queue, inp_queue) - FILLSO(inp->inp_socket); + FILLINPCB(inp); #endif - NET_UNLOCK(); + mtx_leave(&inpcbtable_mtx); } fp = NULL; while ((fp = fd_iterfile(fp, p)) != NULL) { Index: netinet/in_pcb.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/in_pcb.c,v retrieving revision 1.245 diff -u -p -r1.245 in_pcb.c --- netinet/in_pcb.c 14 Sep 2018 12:55:17 -0000 1.245 +++ netinet/in_pcb.c 19 Sep 2018 19:30:06 -0000 @@ -111,12 +111,16 @@ int ipport_lastauto = IPPORT_USERRESERVE int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; int ipport_hilastauto = IPPORT_HILASTAUTO; +/* Protect PCB table queues, lookup hashes and existence of inpcb. */ +struct mutex inpcbtable_mtx = MUTEX_INITIALIZER(IPL_SOFTNET); + struct baddynamicports baddynamicports; struct baddynamicports rootonlyports; struct pool inpcb_pool; int inpcb_pool_initialized = 0; -int in_pcbresize (struct inpcbtable *, int); +void in_pcbrehash_locked(struct inpcb *); +int in_pcbresize(struct inpcbtable *, int); #define INPCBHASH_LOADFACTOR(_x) (((_x) * 3) / 4) @@ -159,6 +163,7 @@ void in_pcbinit(struct inpcbtable *table, int hashsize) { + mtx_enter(&inpcbtable_mtx); TAILQ_INIT(&table->inpt_queue); table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &table->inpt_mask); @@ -172,6 +177,7 @@ in_pcbinit(struct inpcbtable *table, int table->inpt_size = hashsize; arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); + mtx_leave(&inpcbtable_mtx); } /* @@ -246,6 +252,7 @@ in_pcballoc(struct socket *so, struct in inp->inp_cksum6 = -1; #endif /* INET6 */ + mtx_enter(&inpcbtable_mtx); if (table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_size)) (void)in_pcbresize(table, table->inpt_size * 2); TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue); @@ -262,6 +269,8 @@ in_pcballoc(struct socket *so, struct in &inp->inp_faddr, inp->inp_fport, &inp->inp_laddr, inp->inp_lport); LIST_INSERT_HEAD(head, inp, inp_hash); + mtx_leave(&inpcbtable_mtx); + so->so_pcb = inp; return (0); @@ -545,10 +554,15 @@ in_pcbdisconnect(struct inpcb *inp) void in_pcbdetach(struct inpcb *inp) { - struct socket *so = inp->inp_socket; + struct socket *so; NET_ASSERT_LOCKED(); + mtx_enter(&inp->inp_mtx); + so = inp->inp_socket; + inp->inp_socket = NULL; + mtx_leave(&inp->inp_mtx); + so->so_pcb = NULL; /* * As long as the NET_LOCK() is the default lock for Internet @@ -575,10 +589,12 @@ in_pcbdetach(struct inpcb *inp) pf_inp_unlink(inp); } #endif + mtx_enter(&inpcbtable_mtx); LIST_REMOVE(inp, inp_lhash); LIST_REMOVE(inp, inp_hash); TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue); inp->inp_table->inpt_count--; + mtx_leave(&inpcbtable_mtx); in_pcbunref(inp); } @@ -594,6 +610,7 @@ void in_pcbunref(struct inpcb *inp) { if (refcnt_rele(&inp->inp_refcnt)) { + KASSERT(inp->inp_socket == NULL); KASSERT((LIST_NEXT(inp, inp_hash) == NULL) || (LIST_NEXT(inp, inp_hash) == _Q_INVALID)); KASSERT((LIST_NEXT(inp, inp_lhash) == NULL) || @@ -672,6 +689,8 @@ in_pcbnotifyall(struct inpcbtable *table return; rdomain = rtable_l2(rtable); + KERNEL_LOCK(); + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) { #ifdef INET6 if (inp->inp_flags & INP_IPV6) @@ -679,12 +698,20 @@ in_pcbnotifyall(struct inpcbtable *table #endif if (inp->inp_faddr.s_addr != faddr.s_addr || rtable_l2(inp->inp_rtableid) != rdomain || - inp->inp_socket == 0) { + inp->inp_socket == NULL) { continue; } + /* + * The notify functions may grab the kernel lock. Sometimes + * we already hold the kernel lock when we acquire the pcb + * mutex. So do an extra kernel lock before the mutex outside + * of this loop. XXXSMP + */ if (notify) (*notify)(inp, errno); } + mtx_leave(&inpcbtable_mtx); + KERNEL_UNLOCK(); } /* @@ -757,6 +784,7 @@ in_pcblookup_local(struct inpcbtable *ta u_int rdomain; rdomain = rtable_l2(rtable); + mtx_enter(&inpcbtable_mtx); head = in_pcblhash(table, rdomain, lport); LIST_FOREACH(inp, head, inp_lhash) { if (rtable_l2(inp->inp_rtableid) != rdomain) @@ -807,6 +835,8 @@ in_pcblookup_local(struct inpcbtable *ta break; } } + mtx_leave(&inpcbtable_mtx); + return (match); } @@ -952,10 +982,19 @@ in_pcbselsrc(struct in_addr **insrc, str void in_pcbrehash(struct inpcb *inp) { + mtx_enter(&inpcbtable_mtx); + in_pcbrehash_locked(inp); + mtx_leave(&inpcbtable_mtx); +} + +void +in_pcbrehash_locked(struct inpcb *inp) +{ struct inpcbtable *table = inp->inp_table; struct inpcbhead *head; NET_ASSERT_LOCKED(); + MUTEX_ASSERT_LOCKED(&inpcbtable_mtx); LIST_REMOVE(inp, inp_lhash); head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); @@ -982,6 +1021,8 @@ in_pcbresize(struct inpcbtable *table, i void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl; struct inpcb *inp; + MUTEX_ASSERT_LOCKED(&inpcbtable_mtx); + ohashtbl = table->inpt_hashtbl; olhashtbl = table->inpt_lhashtbl; osize = table->inpt_size; @@ -1003,7 +1044,7 @@ in_pcbresize(struct inpcbtable *table, i arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) { - in_pcbrehash(inp); + in_pcbrehash_locked(inp); } hashfree(ohashtbl, osize, M_PCB); hashfree(olhashtbl, osize, M_PCB); @@ -1034,6 +1075,7 @@ in_pcbhashlookup(struct inpcbtable *tabl u_int rdomain; rdomain = rtable_l2(rtable); + mtx_enter(&inpcbtable_mtx); head = in_pcbhash(table, rdomain, &faddr, fport, &laddr, lport); LIST_FOREACH(inp, head, inp_hash) { #ifdef INET6 @@ -1056,6 +1098,7 @@ in_pcbhashlookup(struct inpcbtable *tabl break; } } + mtx_leave(&inpcbtable_mtx); #ifdef DIAGNOSTIC if (inp == NULL && in_pcbnotifymiss) { printf("%s: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%u\n", @@ -1117,6 +1160,7 @@ in_pcblookup_listen(struct inpcbtable *t #endif rdomain = rtable_l2(rtable); + mtx_enter(&inpcbtable_mtx); head = in_pcbhash(table, rdomain, &zeroin_addr, 0, key1, lport); LIST_FOREACH(inp, head, inp_hash) { #ifdef INET6 @@ -1153,6 +1197,7 @@ in_pcblookup_listen(struct inpcbtable *t LIST_REMOVE(inp, inp_hash); LIST_INSERT_HEAD(head, inp, inp_hash); } + mtx_leave(&inpcbtable_mtx); #ifdef DIAGNOSTIC if (inp == NULL && in_pcbnotifymiss) { printf("%s: laddr=%08x lport=%d rdom=%u\n", Index: netinet/in_pcb.h =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/in_pcb.h,v retrieving revision 1.113 diff -u -p -r1.113 in_pcb.h --- netinet/in_pcb.h 14 Sep 2018 12:55:17 -0000 1.113 +++ netinet/in_pcb.h 19 Sep 2018 19:30:06 -0000 @@ -64,6 +64,7 @@ #ifndef _NETINET_IN_PCB_H_ #define _NETINET_IN_PCB_H_ +#include <sys/mutex.h> #include <sys/queue.h> #include <sys/refcnt.h> #include <netinet/ip6.h> @@ -84,6 +85,12 @@ union inpaddru { }; /* + * Locks used to protect struct members in this file: + * I immutable after creation + * t protected by internet table mutex inpcbtable_mtx + * p protected by internet PCB mutex inp_mtx + */ +/* * Common structure pcb for internet protocol implementation. * Here are stored pointers to local and foreign host table * entries, local and foreign socket numbers, and pointers @@ -91,10 +98,11 @@ union inpaddru { * control block. */ struct inpcb { - LIST_ENTRY(inpcb) inp_hash; /* local and foreign hash */ - LIST_ENTRY(inpcb) inp_lhash; /* local port hash */ - TAILQ_ENTRY(inpcb) inp_queue; /* inet PCB queue */ - struct inpcbtable *inp_table; /* inet queue/hash table */ + LIST_ENTRY(inpcb) inp_hash; /* [t] local and foreign hash */ + LIST_ENTRY(inpcb) inp_lhash; /* [t] local port hash */ + TAILQ_ENTRY(inpcb) inp_queue; /* [t] inet PCB queue */ + struct inpcbtable *inp_table; /* [I] inet queue/hash table */ + struct mutex inp_mtx; /* protect PCB and socket */ union inpaddru inp_faddru; /* Foreign address. */ union inpaddru inp_laddru; /* Local address. */ #define inp_faddr inp_faddru.iau_a4u.inaddr @@ -103,8 +111,8 @@ struct inpcb { #define inp_laddr6 inp_laddru.iau_addr6 u_int16_t inp_fport; /* foreign port */ u_int16_t inp_lport; /* local port */ - struct socket *inp_socket; /* back pointer to socket */ - caddr_t inp_ppcb; /* pointer to per-protocol pcb */ + struct socket *inp_socket; /* [p] back pointer to socket */ + caddr_t inp_ppcb; /* [p] pointer to per-protocol pcb */ union { /* Route (notice increased size). */ struct route ru_route; struct route_in6 ru_route6; @@ -150,12 +158,12 @@ struct inpcb { LIST_HEAD(inpcbhead, inpcb); struct inpcbtable { - TAILQ_HEAD(inpthead, inpcb) inpt_queue; /* inet PCB queue */ - struct inpcbhead *inpt_hashtbl; /* local and foreign hash */ - struct inpcbhead *inpt_lhashtbl; /* local port hash */ - SIPHASH_KEY inpt_key, inpt_lkey; /* secrets for hashes */ - u_long inpt_mask, inpt_lmask; /* hash masks */ - int inpt_count, inpt_size; /* queue count, hash size */ + TAILQ_HEAD(inpthead, inpcb) inpt_queue; /* [t] inet PCB queue */ + struct inpcbhead *inpt_hashtbl; /* [t] local and foreign hash */ + struct inpcbhead *inpt_lhashtbl; /* [t] local port hash */ + SIPHASH_KEY inpt_key, inpt_lkey; /* [t] secrets for hashes */ + u_long inpt_mask, inpt_lmask; /* [t] hash masks */ + int inpt_count, inpt_size; /* [t] queue count, hash size */ }; /* flags in inp_flags: */ @@ -249,6 +257,7 @@ struct baddynamicports { #ifdef _KERNEL +extern struct mutex inpcbtable_mtx; extern struct inpcbtable rawcbtable, rawin6pcbtable; extern struct baddynamicports baddynamicports; extern struct baddynamicports rootonlyports; Index: netinet/ip_divert.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/ip_divert.c,v retrieving revision 1.57 diff -u -p -r1.57 ip_divert.c --- netinet/ip_divert.c 24 Apr 2018 15:40:55 -0000 1.57 +++ netinet/ip_divert.c 19 Sep 2018 19:30:06 -0000 @@ -186,10 +186,12 @@ divert_packet(struct mbuf *m, int dir, u return (0); } + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH(inp, &divbtable.inpt_queue, inp_queue) { if (inp->inp_lport == divert_port) break; } + mtx_leave(&inpcbtable_mtx); memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; Index: netinet/raw_ip.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/raw_ip.c,v retrieving revision 1.112 diff -u -p -r1.112 raw_ip.c --- netinet/raw_ip.c 13 Sep 2018 19:53:58 -0000 1.112 +++ netinet/raw_ip.c 19 Sep 2018 19:30:06 -0000 @@ -149,6 +149,7 @@ rip_input(struct mbuf **mp, int *offp, i } #endif NET_ASSERT_LOCKED(); + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH(inp, &rawcbtable.inpt_queue, inp_queue) { if (inp->inp_socket->so_state & SS_CANTRCVMORE) continue; @@ -188,6 +189,8 @@ rip_input(struct mbuf **mp, int *offp, i } last = inp; } + mtx_leave(&inpcbtable_mtx); + if (last) { if (last->inp_flags & INP_CONTROLOPTS || last->inp_socket->so_options & SO_TIMESTAMP) Index: netinet/tcp_subr.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/tcp_subr.c,v retrieving revision 1.172 diff -u -p -r1.172 tcp_subr.c --- netinet/tcp_subr.c 14 Jun 2018 01:24:08 -0000 1.172 +++ netinet/tcp_subr.c 19 Sep 2018 19:30:06 -0000 @@ -520,7 +520,9 @@ tcp_close(struct tcpcb *tp) /* Free tcpcb after all pending timers have been run. */ TCP_TIMER_ARM(tp, TCPT_REAPER, 0); + mtx_enter(&inp->inp_mtx); inp->inp_ppcb = NULL; + mtx_leave(&inp->inp_mtx); soisdisconnected(so); in_pcbdetach(inp); return (NULL); Index: netinet/udp_usrreq.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/udp_usrreq.c,v retrieving revision 1.251 diff -u -p -r1.251 udp_usrreq.c --- netinet/udp_usrreq.c 13 Sep 2018 19:53:58 -0000 1.251 +++ netinet/udp_usrreq.c 19 Sep 2018 19:30:06 -0000 @@ -380,6 +380,7 @@ udp_input(struct mbuf **mp, int *offp, i */ last = NULL; NET_ASSERT_LOCKED(); + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH(inp, &udbtable.inpt_queue, inp_queue) { if (inp->inp_socket->so_state & SS_CANTRCVMORE) continue; @@ -455,6 +456,7 @@ udp_input(struct mbuf **mp, int *offp, i SO_REUSEADDR)) == 0) break; } + mtx_leave(&inpcbtable_mtx); if (last == NULL) { /* Index: netinet6/in6_pcb.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/in6_pcb.c,v retrieving revision 1.106 diff -u -p -r1.106 in6_pcb.c --- netinet6/in6_pcb.c 11 Sep 2018 21:04:03 -0000 1.106 +++ netinet6/in6_pcb.c 19 Sep 2018 19:30:06 -0000 @@ -411,6 +411,8 @@ in6_pcbnotify(struct inpcbtable *table, errno = inet6ctlerrmap[cmd]; rdomain = rtable_l2(rtable); + KERNEL_LOCK(); + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) { if ((inp->inp_flags & INP_IPV6) == 0) continue; @@ -474,7 +476,7 @@ in6_pcbnotify(struct inpcbtable *table, else if (!IN6_ARE_ADDR_EQUAL(&inp->inp_faddr6, &dst->sin6_addr) || rtable_l2(inp->inp_rtableid) != rdomain || - inp->inp_socket == 0 || + inp->inp_socket == NULL || (lport && inp->inp_lport != lport) || (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) && !IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, @@ -484,9 +486,18 @@ in6_pcbnotify(struct inpcbtable *table, } do_notify: nmatch++; + /* + * The notify functions may grab the kernel lock. Sometimes + * we already hold the kernel lock when we acquire the pcb + * mutex. So do an extra kernel lock before the mutex outside + * of this loop. XXXSMP + */ if (notify) (*notify)(inp, errno); } + mtx_leave(&inpcbtable_mtx); + KERNEL_UNLOCK(); + return (nmatch); } @@ -501,6 +512,7 @@ in6_pcbhashlookup(struct inpcbtable *tab u_int rdomain; rdomain = rtable_l2(rtable); + mtx_enter(&inpcbtable_mtx); head = in6_pcbhash(table, rdomain, faddr, fport, laddr, lport); LIST_FOREACH(inp, head, inp_hash) { if (!(inp->inp_flags & INP_IPV6)) @@ -521,6 +533,7 @@ in6_pcbhashlookup(struct inpcbtable *tab break; } } + mtx_leave(&inpcbtable_mtx); #ifdef DIAGNOSTIC if (inp == NULL && in_pcbnotifymiss) { printf("%s: faddr= fport=%d laddr= lport=%d rdom=%u\n", @@ -571,6 +584,7 @@ in6_pcblookup_listen(struct inpcbtable * #endif rdomain = rtable_l2(rtable); + mtx_enter(&inpcbtable_mtx); head = in6_pcbhash(table, rdomain, &zeroin6_addr, 0, key1, lport); LIST_FOREACH(inp, head, inp_hash) { if (!(inp->inp_flags & INP_IPV6)) @@ -603,6 +617,7 @@ in6_pcblookup_listen(struct inpcbtable * LIST_REMOVE(inp, inp_hash); LIST_INSERT_HEAD(head, inp, inp_hash); } + mtx_leave(&inpcbtable_mtx); #ifdef DIAGNOSTIC if (inp == NULL && in_pcbnotifymiss) { printf("%s: laddr= lport=%d rdom=%u\n", Index: netinet6/ip6_divert.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/ip6_divert.c,v retrieving revision 1.56 diff -u -p -r1.56 ip6_divert.c --- netinet6/ip6_divert.c 24 Apr 2018 15:40:55 -0000 1.56 +++ netinet6/ip6_divert.c 19 Sep 2018 19:30:06 -0000 @@ -190,10 +190,12 @@ divert6_packet(struct mbuf *m, int dir, return (0); } + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH(inp, &divb6table.inpt_queue, inp_queue) { if (inp->inp_lport == divert_port) break; } + mtx_leave(&inpcbtable_mtx); memset(&addr, 0, sizeof(addr)); addr.sin6_family = AF_INET6; Index: netinet6/raw_ip6.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/raw_ip6.c,v retrieving revision 1.130 diff -u -p -r1.130 raw_ip6.c --- netinet6/raw_ip6.c 13 Sep 2018 19:53:58 -0000 1.130 +++ netinet6/raw_ip6.c 19 Sep 2018 19:30:06 -0000 @@ -158,6 +158,7 @@ rip6_input(struct mbuf **mp, int *offp, } #endif NET_ASSERT_LOCKED(); + mtx_enter(&inpcbtable_mtx); TAILQ_FOREACH(in6p, &rawin6pcbtable.inpt_queue, inp_queue) { if (in6p->inp_socket->so_state & SS_CANTRCVMORE) continue; @@ -177,8 +178,10 @@ rip6_input(struct mbuf **mp, int *offp, IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, *offp, sizeof(*icmp6)); - if (icmp6 == NULL) + if (icmp6 == NULL) { + mtx_leave(&inpcbtable_mtx); return IPPROTO_DONE; + } if (ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type, in6p->inp_icmp6filt)) continue; @@ -212,6 +215,8 @@ rip6_input(struct mbuf **mp, int *offp, } last = in6p; } + mtx_leave(&inpcbtable_mtx); + if (last) { if (last->inp_flags & IN6P_CONTROLOPTS) ip6_savecontrol(last, m, &opts);