Date: Mon, 13 Oct 2003 23:11:49 -0400 (EDT) From: Scot Loach <sloach@sandvine.com> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/57985: [patch] Missing splx in ether_output_frame (-stable) Message-ID: <20031014031149.AD1F7411@bsd-make.sandvine.com> Resent-Message-ID: <200310140320.h9E3KKpO027072@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 57985
>Category: kern
>Synopsis: [patch] Missing splx in ether_output_frame (-stable)
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Oct 13 20:20:20 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator: Scot Loach
>Release: FreeBSD 4.8-RELEASE-p3 i386
>Organization:
Sandvine Incorporated
>Environment:
>Description:
In /sys/net/if_ethersubr.c, in ether_output_frame, there is a return
for an error case that fails to call splx to release the splimp
taken above. (see the included patch)
>How-To-Repeat:
>Fix:
Index: if_ethersubr.c
===================================================================
RCS file: /cvs/src/sys/net/if_ethersubr.c,v
retrieving revision 1.70.2.30.1000.3
diff -U10 -r1.70.2.30.1000.3 if_ethersubr.c
--- if_ethersubr.c 21 Jun 2003 20:47:55 -0000 1.70.2.30.1000.3
+++ if_ethersubr.c 14 Oct 2003 02:13:58 -0000
@@ -410,20 +410,21 @@
no_bridge:
s = splimp();
if (IPFW_LOADED && ether_ipfw != 0) {
struct ether_header save_eh, *eh;
eh = mtod(m, struct ether_header *);
save_eh = *eh;
m_adj(m, ETHER_HDR_LEN);
if (ether_ipfw_chk(&m, ifp, &rule, eh, 0) == 0) {
if (m) {
+ splx(s);
m_freem(m);
return ENOBUFS; /* pkt dropped */
} else
return 0; /* consumed e.g. in a pipe */
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031014031149.AD1F7411>