diff options
| author | rwatson <rwatson@FreeBSD.org> | 2006-08-11 23:03:10 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2006-08-11 23:03:10 +0000 |
| commit | 14b1513b2cc8a5f9a618312b7251ed8b73df08e3 (patch) | |
| tree | 9514c0f613afa6432d74a8ed96add93157eb7c7c | |
| parent | 2fea2ea779bcaa01eb2741b4a02a383b36080351 (diff) | |
| download | FreeBSD-src-14b1513b2cc8a5f9a618312b7251ed8b73df08e3.zip FreeBSD-src-14b1513b2cc8a5f9a618312b7251ed8b73df08e3.tar.gz | |
Before performing a sodealloc() when pru_attach() fails, assert that
the socket refcount remains 1, and then drop to 0 before freeing the
socket.
PR: 101763
Reported by: Gleb Kozyrev <gkozyrev at ukr dot net>
| -rw-r--r-- | sys/kern/uipc_socket.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 882ecfd..b75f5e6 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -367,6 +367,9 @@ socreate(dom, aso, type, proto, cred, td) so->so_count = 1; error = (*prp->pr_usrreqs->pru_attach)(so, proto, td); if (error) { + KASSERT(so->so_count == 1, ("socreate: so_count %d", + so->so_count)); + so->so_count = 0; sodealloc(so); return (error); } |
