Date: Tue, 6 Nov 2012 21:07:05 +0000 (UTC) From: Guy Helmer <ghelmer@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r242673 - head/sys/net Message-ID: <201211062107.qA6L75At049708@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ghelmer Date: Tue Nov 6 21:07:04 2012 New Revision: 242673 URL: http://svnweb.freebsd.org/changeset/base/242673 Log: Work around a race in bpfread() by validating the hold buffer pointer before freeing it. Otherwise, we can lose a buffer and cause a panic in catchpacket(). Modified: head/sys/net/bpf.c Modified: head/sys/net/bpf.c ============================================================================== --- head/sys/net/bpf.c Tue Nov 6 20:30:23 2012 (r242672) +++ head/sys/net/bpf.c Tue Nov 6 21:07:04 2012 (r242673) @@ -954,10 +954,13 @@ bpfread(struct cdev *dev, struct uio *ui error = bpf_uiomove(d, d->bd_hbuf, d->bd_hlen, uio); BPFD_LOCK(d); - d->bd_fbuf = d->bd_hbuf; - d->bd_hbuf = NULL; - d->bd_hlen = 0; - bpf_buf_reclaimed(d); + if (d->bd_hbuf != NULL) { + /* Free the hold buffer only if it is still valid. */ + d->bd_fbuf = d->bd_hbuf; + d->bd_hbuf = NULL; + d->bd_hlen = 0; + bpf_buf_reclaimed(d); + } BPFD_UNLOCK(d); return (error);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201211062107.qA6L75At049708>