Date: Fri, 21 Oct 2011 22:28:16 +0000 (UTC) From: Gleb Smirnoff <glebius@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r226623 - head/sys/contrib/pf/net Message-ID: <201110212228.p9LMSGhn044256@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: glebius Date: Fri Oct 21 22:28:15 2011 New Revision: 226623 URL: http://svn.freebsd.org/changeset/base/226623 Log: Fix a race: we should update sc_len before dropping the pf lock, otherwise a number of packets can be queued on sc, while we are in ip_output(), and then we wipe the accumulated sc_len. On next pfsync_sendout() that would lead to writing beyond our mbuf cluster. Modified: head/sys/contrib/pf/net/if_pfsync.c Modified: head/sys/contrib/pf/net/if_pfsync.c ============================================================================== --- head/sys/contrib/pf/net/if_pfsync.c Fri Oct 21 22:12:24 2011 (r226622) +++ head/sys/contrib/pf/net/if_pfsync.c Fri Oct 21 22:28:15 2011 (r226623) @@ -2354,6 +2354,7 @@ pfsync_sendout(void) sc->sc_if.if_obytes += m->m_pkthdr.len; #endif + sc->sc_len = PFSYNC_MINPKT; #ifdef __FreeBSD__ PF_UNLOCK(); #endif @@ -2375,9 +2376,6 @@ pfsync_sendout(void) #ifdef __FreeBSD__ } #endif - - /* start again */ - sc->sc_len = PFSYNC_MINPKT; } void
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201110212228.p9LMSGhn044256>