Date: Sat, 28 Jun 2003 22:22:20 -0400 From: Don Bowman <don@sandvine.com> To: Don Bowman <don@sandvine.com>, "''freebsd-net@freebsd.org' '" <freebsd-net@freebsd.org> Subject: RE: using memory after freed in tcp_syncache (syncache_timer()) Message-ID: <FE045D4D9F7AED4CBFF1B3B813C8533702741BEA@mail.sandvine.com>
next in thread | raw e-mail | index | archive | help
From: Don Bowman ... It appears this may also occur in syncache_add(): in this case, syncache_respond() alters the list. sc->sc_tp = tp; sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt; if (syncache_respond(sc, m) == 0) { s = splnet(); TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot], sc, sc_timerq); SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot); splx(s); tcpstat.tcps_sndacks++; tcpstat.tcps_sndtotal++; } *sop = NULL;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FE045D4D9F7AED4CBFF1B3B813C8533702741BEA>