[src/trunk]: src/sys/net Don't overwrite an existing llentry on RTM_ADD to av...

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ad60d99a85da
branches:  trunk
changeset: 320489:ad60d99a85da
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Tue Jul 10 01:23:13 2018 +0000

description:
Don't overwrite an existing llentry on RTM_ADD to avoid race conditions

Reported and tested by christos@

diffstat:

 sys/net/if_llatbl.c |  18 ++++++++++++++----
 1 files changed, 14 insertions(+), 4 deletions(-)

diffs (39 lines):

diff -r 326e12c45e48 -r ad60d99a85da sys/net/if_llatbl.c
--- a/sys/net/if_llatbl.c       Mon Jul 09 18:52:04 2018 +0000
+++ b/sys/net/if_llatbl.c       Tue Jul 10 01:23:13 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_llatbl.c,v 1.27 2018/06/05 01:25:59 nonaka Exp $    */
+/*     $NetBSD: if_llatbl.c,v 1.28 2018/07/10 01:23:13 ozaki-r Exp $   */
 /*
  * Copyright (c) 2004 Luigi Rizzo, Alessandro Cerri. All rights reserved.
  * Copyright (c) 2004-2008 Qing Li. All rights reserved.
@@ -672,7 +672,7 @@
 
                /* Add static LLE */
                IF_AFDATA_WLOCK(ifp);
-               lle = lla_lookup(llt, 0, dst);
+               lle = lla_lookup(llt, LLE_EXCLUSIVE, dst);
 
                /* Cannot overwrite an existing static entry */
                if (lle != NULL &&
@@ -684,8 +684,18 @@
                        error = EEXIST;
                        goto out;
                }
-               if (lle != NULL)
-                       LLE_RUNLOCK(lle);
+
+               /*
+                * We can't overwrite an existing entry to avoid race
+                * conditions so remove it first.
+                */
+               if (lle != NULL) {
+                       size_t pkts_dropped = llentry_free(lle);
+                       if (dst->sa_family == AF_INET) {
+                               arp_stat_add(ARP_STAT_DFRDROPPED,
+                                   (uint64_t)pkts_dropped);
+                       }
+               }
 
                lle = lla_create(llt, 0, dst, rt);
                if (lle == NULL) {