Revert the inpcb table mutex commit. It triggers a witness panic

in raw IP delivery and UDP broadcast loops.  There inpcbtable_mtx
is held and sorwakeup() is called within the loop.  As sowakeup()
grabs the kernel lock, we have a lock ordering problem.
found by Hrvoje Popovski; OK deraadt@ mpi@

1 files changed, 13 insertions, 22 deletions

diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index 4ec18dea8ac..a8fa2235c95 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.h,v 1.114 2018/09/20 18:59:10 bluhm Exp $	*/
+/*	$OpenBSD: in_pcb.h,v 1.115 2018/10/04 17:33:41 bluhm Exp $	*/
 /*	$NetBSD: in_pcb.h,v 1.14 1996/02/13 23:42:00 christos Exp $	*/
 
 /*
@@ -64,7 +64,6 @@
 #ifndef _NETINET_IN_PCB_H_
 #define _NETINET_IN_PCB_H_
 
-#include <sys/mutex.h>
 #include <sys/queue.h>
 #include <sys/refcnt.h>
 #include <netinet/ip6.h>
@@ -85,12 +84,6 @@ union inpaddru {
 };
 
 /*
- *  Locks used to protect struct members in this file:
- *	I	immutable after creation
- *	t	protected by internet table mutex inpcbtable_mtx
- *	p	protected by internet PCB mutex inp_mtx
- */
-/*
  * Common structure pcb for internet protocol implementation.
  * Here are stored pointers to local and foreign host table
  * entries, local and foreign socket numbers, and pointers
@@ -98,11 +91,10 @@ union inpaddru {
  * control block.
  */
 struct inpcb {
-	LIST_ENTRY(inpcb) inp_hash;		/* [t] local and foreign hash */
-	LIST_ENTRY(inpcb) inp_lhash;		/* [t] local port hash */
-	TAILQ_ENTRY(inpcb) inp_queue;		/* [t] inet PCB queue */
-	struct	  inpcbtable *inp_table;	/* [I] inet queue/hash table */
-	struct	  mutex inp_mtx;		/* protect PCB and socket */
+	LIST_ENTRY(inpcb) inp_hash;		/* local and foreign hash */
+	LIST_ENTRY(inpcb) inp_lhash;		/* local port hash */
+	TAILQ_ENTRY(inpcb) inp_queue;		/* inet PCB queue */
+	struct	  inpcbtable *inp_table;	/* inet queue/hash table */
 	union	  inpaddru inp_faddru;		/* Foreign address. */
 	union	  inpaddru inp_laddru;		/* Local address. */
 #define	inp_faddr	inp_faddru.iau_a4u.inaddr
@@ -111,8 +103,8 @@ struct inpcb {
 #define	inp_laddr6	inp_laddru.iau_addr6
 	u_int16_t inp_fport;		/* foreign port */
 	u_int16_t inp_lport;		/* local port */
-	struct	  socket *inp_socket;	/* [p] back pointer to socket */
-	caddr_t	  inp_ppcb;		/* [p] pointer to per-protocol pcb */
+	struct	  socket *inp_socket;	/* back pointer to socket */
+	caddr_t	  inp_ppcb;		/* pointer to per-protocol pcb */
 	union {				/* Route (notice increased size). */
 		struct route ru_route;
 		struct route_in6 ru_route6;
@@ -158,12 +150,12 @@ struct inpcb {
 LIST_HEAD(inpcbhead, inpcb);
 
 struct inpcbtable {
-	TAILQ_HEAD(inpthead, inpcb) inpt_queue;	/* [t] inet PCB queue */
-	struct	inpcbhead *inpt_hashtbl;	/* [t] local and foreign hash */
-	struct	inpcbhead *inpt_lhashtbl;	/* [t] local port hash */
-	SIPHASH_KEY inpt_key, inpt_lkey;	/* [t] secrets for hashes */
-	u_long	inpt_mask, inpt_lmask;		/* [t] hash masks */
-	int	inpt_count, inpt_size;		/* [t] queue count, hash size */
+	TAILQ_HEAD(inpthead, inpcb) inpt_queue;	/* inet PCB queue */
+	struct	inpcbhead *inpt_hashtbl;	/* local and foreign hash */
+	struct	inpcbhead *inpt_lhashtbl;	/* local port hash */
+	SIPHASH_KEY inpt_key, inpt_lkey;	/* secrets for hashes */
+	u_long	inpt_mask, inpt_lmask;		/* hash masks */
+	int	inpt_count, inpt_size;		/* queue count, hash size */
 };
 
 /* flags in inp_flags: */
@@ -257,7 +249,6 @@ struct baddynamicports {
 
 #ifdef _KERNEL
 
-extern struct mutex inpcbtable_mtx;
 extern struct inpcbtable rawcbtable, rawin6pcbtable;
 extern struct baddynamicports baddynamicports;
 extern struct baddynamicports rootonlyports;