[src/trunk]: src/sys/net Protect sysctl_rtable with KERNEL_LOCK and softnet_lock

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/47089b5437d0
branches:  trunk
changeset: 449218:47089b5437d0
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Wed Feb 27 04:03:06 2019 +0000

description:
Protect sysctl_rtable with KERNEL_LOCK and softnet_lock

In the function the routing table could be accessed without any locks, which was
unsafe.  Actually, on netbsd-7, a kernel panic happened(*).  The situation of
locking hasn't changed since netbsd-7 so we still need to hold the big locks on
-current (and netbsd-8) too.

Note that if NET_MPSAFE is enabled, the routing table is protected by its own
lock and we don't need the locks.

Reported and tested on netbsd-7 by sborrill@

(*) http://mail-index.netbsd.org/tech-net/2018/11/08/msg007153.html

diffstat:

 sys/net/rtsock.c |  6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diffs (34 lines):

diff -r 7595e82d4a2c -r 47089b5437d0 sys/net/rtsock.c
--- a/sys/net/rtsock.c  Wed Feb 27 03:05:39 2019 +0000
+++ b/sys/net/rtsock.c  Wed Feb 27 04:03:06 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: rtsock.c,v 1.246 2019/01/29 09:28:51 pgoyette Exp $    */
+/*     $NetBSD: rtsock.c,v 1.247 2019/02/27 04:03:06 ozaki-r Exp $     */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rtsock.c,v 1.246 2019/01/29 09:28:51 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rtsock.c,v 1.247 2019/02/27 04:03:06 ozaki-r Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -432,6 +432,7 @@
        w.w_needed = 0 - w.w_given;
        w.w_where = where;
 
+       SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
        s = splsoftnet();
        switch (w.w_op) {
 
@@ -478,6 +479,7 @@
                break;
        }
        splx(s);
+       SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
 
        /* check to see if we couldn't allocate memory with NOWAIT */
        if (error == ENOBUFS && w.w_tmem == 0 && w.w_tmemneeded)