The call to in_pcballoc() in user request attach was handled in

three different ways.  Use the same code in udp_usrreq() and
rip_usrreq() and rip6_usrreq(). This also fixes a pcb and socket
leak in udp_usrreq() in case soreserve() fails.  Put an splsoftassert()
into in_pcballoc() for safety.
OK mpi@

4 files changed, 21 insertions, 19 deletions

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index cf64629aaf5..3b67f7fcfd2 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.c,v 1.134 2013/03/29 13:16:14 bluhm Exp $	*/
+/*	$OpenBSD: in_pcb.c,v 1.135 2013/03/31 11:18:35 bluhm Exp $	*/
 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
 
 /*
@@ -177,6 +177,8 @@ in_pcballoc(struct socket *so, struct inpcbtable *table)
 	struct inpcb *inp;
 	int s;
 
+	splsoftassert(IPL_SOFTNET);
+
 	if (inpcb_pool_initialized == 0) {
 		pool_init(&inpcb_pool, sizeof(struct inpcb), 0, 0, 0,
 		    "inpcbpl", NULL);
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 502eecd7ad8..4f3bbc95285 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.63 2013/03/30 12:15:29 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.64 2013/03/31 11:18:35 bluhm Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -396,8 +396,9 @@ int
 rip_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
     struct mbuf *control, struct proc *p)
 {
-	int error = 0;
 	struct inpcb *inp = sotoinpcb(so);
+	int error = 0;
+	int s;
 #ifdef MROUTING
 	extern struct socket *ip_mrouter;
 #endif
@@ -423,9 +424,13 @@ rip_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 			error = EPROTONOSUPPORT;
 			break;
 		}
+		s = splsoftnet();
 		if ((error = soreserve(so, rip_sendspace, rip_recvspace)) ||
-		    (error = in_pcballoc(so, &rawcbtable)))
+		    (error = in_pcballoc(so, &rawcbtable))) {
+			splx(s);
 			break;
+		}
+		splx(s);
 		inp = (struct inpcb *)so->so_pcb;
 		inp->inp_ip.ip_p = (long)nam;
 		break;
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index a289e93ac29..f5c1c094c94 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.156 2013/03/31 00:59:52 bluhm Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.157 2013/03/31 11:18:35 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -1153,13 +1153,12 @@ udp_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *addr,
 			break;
 		}
 		s = splsoftnet();
-		error = in_pcballoc(so, &udbtable);
-		splx(s);
-		if (error)
-			break;
-		error = soreserve(so, udp_sendspace, udp_recvspace);
-		if (error)
+		if ((error = soreserve(so, udp_sendspace, udp_recvspace)) ||
+		    (error = in_pcballoc(so, &udbtable))) {
+			splx(s);
 			break;
+		}
+		splx(s);
 #ifdef INET6
 		if (((struct inpcb *)so->so_pcb)->inp_flags & INP_IPV6)
 			((struct inpcb *) so->so_pcb)->inp_ipv6.ip6_hlim =
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index 531efd0cece..d612011da99 100644
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip6.c,v 1.50 2013/03/30 12:15:29 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip6.c,v 1.51 2013/03/31 11:18:35 bluhm Exp $	*/
 /*	$KAME: raw_ip6.c,v 1.69 2001/03/04 15:55:44 itojun Exp $	*/
 
 /*
@@ -593,8 +593,8 @@ rip6_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 	struct mbuf *control, struct proc *p)
 {
 	struct in6pcb *in6p = sotoin6pcb(so);
-	int s;
 	int error = 0;
+	int s;
 	int priv;
 
 	priv = 0;
@@ -618,12 +618,8 @@ rip6_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 			break;
 		}
 		s = splsoftnet();
-		if ((error = soreserve(so, rip6_sendspace, rip6_recvspace)) != 0) {
-			splx(s);
-			break;
-		}
-		if ((error = in_pcballoc(so, &rawin6pcbtable)) != 0)
-		{
+		if ((error = soreserve(so, rip6_sendspace, rip6_recvspace)) ||
+		    (error = in_pcballoc(so, &rawin6pcbtable))) {
 			splx(s);
 			break;
 		}