From: mvs <mvs@openbsd.org>
Date: Mon, 11 Apr 2022 18:18:17 +0000 (+0000)
Subject: Keep `fdp' locked until we finish the second loop of unp_externalize().
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=30b5b25bb25518f8e01439e2aa53f33c272ed3ef;p=openbsd

Keep `fdp' locked until we finish the second loop of unp_externalize().
This prevents descriptors from being closed concurrently on receiver side.

ok bluhm@ claudio@
---

diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index a4538f2c805..c3c3d01bdac 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_usrreq.c,v 1.163 2022/02/25 23:51:03 guenther Exp $	*/
+/*	$OpenBSD: uipc_usrreq.c,v 1.164 2022/04/11 18:18:17 mvs Exp $	*/
 /*	$NetBSD: uipc_usrreq.c,v 1.18 1996/02/09 19:00:50 christos Exp $	*/
 
 /*
@@ -953,7 +953,13 @@ restart:
 
 		rp++;
 	}
-	fdpunlock(fdp);
+
+	/*
+	 * Keep `fdp' locked to prevent concurrent close() of just
+	 * inserted descriptors. Such descriptors could have the only
+	 * `f_count' reference which is now shared between control
+	 * message and `fdp'. 
+	 */
 
 	/*
 	 * Now that adding them has succeeded, update all of the
@@ -972,6 +978,7 @@ restart:
 			rw_exit_write(&unp_gc_lock);
 		}
 	}
+	fdpunlock(fdp);
 
 	mtx_enter(&unp_rights_mtx);
 	unp_rights -= nfds;