From owner-freebsd-net@FreeBSD.ORG  Mon Jan 17 21:20:08 2011
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A1AF7106564A
	for <freebsd-net@hub.freebsd.org>; Mon, 17 Jan 2011 21:20:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 8A2418FC15
	for <freebsd-net@hub.freebsd.org>; Mon, 17 Jan 2011 21:20:08 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p0HLK83d009773
	for <freebsd-net@freefall.freebsd.org>; Mon, 17 Jan 2011 21:20:08 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p0HLK8iN009772;
	Mon, 17 Jan 2011 21:20:08 GMT (envelope-from gnats)
Date: Mon, 17 Jan 2011 21:20:08 GMT
Message-Id: <201101172120.p0HLK8iN009772@freefall.freebsd.org>
To: freebsd-net@FreeBSD.org
From: Juergen Lock <nox@jelal.kn-bremen.de>
Cc: 
Subject: Re: kern/153938: [run] [panic] [patch] Workaround for use-after-free
 panic
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Juergen Lock <nox@jelal.kn-bremen.de>
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Jan 2011 21:20:08 -0000

The following reply was made to PR kern/153938; it has been noted by GNATS.

From: Juergen Lock <nox@jelal.kn-bremen.de>
To: PseudoCylon <moonlightakkiy@yahoo.ca>
Cc: Juergen Lock <nox@jelal.kn-bremen.de>, bug-followup@freebsd.org
Subject: Re: kern/153938: [run] [panic] [patch] Workaround for use-after-free
 panic
Date: Mon, 17 Jan 2011 22:14:04 +0100

 On Sun, Jan 16, 2011 at 10:24:07PM -0800, PseudoCylon wrote:
 
 > > [...]
 > >  I see you removed the rn->wcid code, I guess I should  have
 > > explained what it's for:  ni->ni_associd already gets zeroed  before
 > > run_node_cleanup() is called so with your version no  sc->sc_ni[wcid]
 > > ever gets set to NULL.
 > > 
 > 
 > You're right.
 > 
 > > +        if (wcid ==  0)
 > > +            wcid =  rn->wcid;
 > 
 > 
 > Is there any reason to test "ni->ni_associd == 0"? We know it is 0.
 
 Oh I only left it in in case the surrounding code changes in the
 future, but I guess that's pretty unlikely.  So I agree the check
 can be removed...