Skip site navigation (1)Skip section navigation (2) 
Date:      Sat, 28 Jun 2003 22:22:20 -0400
From:      Don Bowman <don@sandvine.com>
To:        Don Bowman <don@sandvine.com>, "''freebsd-net@freebsd.org' '" <freebsd-net@freebsd.org>
Subject:   RE: using memory after freed in tcp_syncache (syncache_timer())
Message-ID:  <FE045D4D9F7AED4CBFF1B3B813C8533702741BEA@mail.sandvine.com>
index | next in thread | raw e-mail 

From: Don Bowman
 ...
It appears this may also occur in syncache_add():
in this case, syncache_respond() alters the list.

                sc->sc_tp = tp;
                sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
                if (syncache_respond(sc, m) == 0) {
                        s = splnet();
                        TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot],
                            sc, sc_timerq);
                        SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot);
                        splx(s);
                        tcpstat.tcps_sndacks++;
                        tcpstat.tcps_sndtotal++;
                }
                *sop = NULL;
help

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FE045D4D9F7AED4CBFF1B3B813C8533702741BEA>