RE: using memory after freed in tcp_syncache (syncache_timer())

From: Don Bowman (don_at_sandvine.com)
Date: 06/29/03

  • Next message: George V. Neville-Neil: "Another question on locking..." 
    To: Don Bowman <don@sandvine.com>, "''freebsd-net@freebsd.org' '" <freebsd-net@freebsd.org>
Date: Sat, 28 Jun 2003 22:22:20 -0400

    From: Don Bowman
     ...
    It appears this may also occur in syncache_add():
    in this case, syncache_respond() alters the list.

                    sc->sc_tp = tp;
                    sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
                    if (syncache_respond(sc, m) == 0) {
                            s = splnet();
                            TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot],
                                sc, sc_timerq);
                            SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot);
                            splx(s);
                            tcpstat.tcps_sndacks++;
                            tcpstat.tcps_sndtotal++;
                    }
                    *sop = NULL;
    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: George V. Neville-Neil: "Another question on locking..."