Attachment 201876 Details for Bug 235582 – fix race in ref counting of svc_rpc_gss_client struct

[patch] fix race in ref counting of svc_rpc_gss_client struct

svcgss3.patch (text/plain), 1.64 KB, created by Rick Macklem on 2019-02-09 23:28:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rick Macklem

Created: 2019-02-09 23:28:19 UTC

Size: 1.64 KB

patch

obsolete

>--- rpc/rpcsec_gss/svc_rpcsec_gss.c.sav2	2019-02-09 18:50:46.164203000 -0500
>+++ rpc/rpcsec_gss/svc_rpcsec_gss.c	2019-02-09 18:52:28.041501000 -0500
>@@ -562,19 +562,13 @@ svc_rpc_gss_create_client(void)
> 
> 	client = mem_alloc(sizeof(struct svc_rpc_gss_client));
> 	memset(client, 0, sizeof(struct svc_rpc_gss_client));
>-	refcount_init(&client->cl_refs, 1);
>+	refcount_init(&client->cl_refs, 2);
> 	sx_init(&client->cl_lock, "GSS-client");
> 	getcredhostid(curthread->td_ucred, &hostid);
> 	client->cl_id.ci_hostid = hostid;
> 	getboottime(&boottime);
> 	client->cl_id.ci_boottime = boottime.tv_sec;
> 	client->cl_id.ci_id = svc_rpc_gss_next_clientid++;
>-	list = &svc_rpc_gss_client_hash[client->cl_id.ci_id % CLIENT_HASH_SIZE];
>-	sx_xlock(&svc_rpc_gss_lock);
>-	TAILQ_INSERT_HEAD(list, client, cl_link);
>-	TAILQ_INSERT_HEAD(&svc_rpc_gss_clients, client, cl_alllink);
>-	svc_rpc_gss_client_count++;
>-	sx_xunlock(&svc_rpc_gss_lock);
> 
> 	/*
> 	 * Start the client off with a short expiration time. We will
>@@ -584,6 +578,12 @@ svc_rpc_gss_create_client(void)
> 	client->cl_locked = FALSE;
> 	client->cl_expiration = time_uptime + 5*60;
> 
>+	list = &svc_rpc_gss_client_hash[client->cl_id.ci_id % CLIENT_HASH_SIZE];
>+	sx_xlock(&svc_rpc_gss_lock);
>+	TAILQ_INSERT_HEAD(list, client, cl_link);
>+	TAILQ_INSERT_HEAD(&svc_rpc_gss_clients, client, cl_alllink);
>+	svc_rpc_gss_client_count++;
>+	sx_xunlock(&svc_rpc_gss_lock);
> 	return (client);
> }
> 
>@@ -1301,7 +1301,6 @@ svc_rpc_gss(struct svc_req *rqst, struct
> 			goto out;
> 		}
> 		client = svc_rpc_gss_create_client();
>-		refcount_acquire(&client->cl_refs);
> 	} else {
> 		struct svc_rpc_gss_clientid *p;
> 		if (gc.gc_handle.length != sizeof(*p)) {

Actions: View | Diff

Attachments on bug 235582: 201858 | 201862 | 201876