diff options
author | mks <mks@FreeBSD.org> | 1999-01-19 23:14:51 +0000 |
---|---|---|
committer | mks <mks@FreeBSD.org> | 1999-01-19 23:14:51 +0000 |
commit | 1b34e45dc5e322279a7ea84160c85f7d3cdf8eda (patch) | |
tree | ed4ea13adb8073076183e9e5f7f03c1c0ca2c6d7 | |
parent | cbe8ae2bb7d48d7161752c13fc7e55c07324b077 (diff) | |
download | FreeBSD-src-1b34e45dc5e322279a7ea84160c85f7d3cdf8eda.zip FreeBSD-src-1b34e45dc5e322279a7ea84160c85f7d3cdf8eda.tar.gz |
Prevent accessing freed signalling instance memory during detach processing.
-rw-r--r-- | sys/netatm/uni/unisig_sigmgr_state.c | 21 |
1 files changed, 9 insertions, 12 deletions
diff --git a/sys/netatm/uni/unisig_sigmgr_state.c b/sys/netatm/uni/unisig_sigmgr_state.c index fe9a010..e2213bf 100644 --- a/sys/netatm/uni/unisig_sigmgr_state.c +++ b/sys/netatm/uni/unisig_sigmgr_state.c @@ -23,7 +23,7 @@ * Copies of this Software may be made, however, the above copyright * notice must be reproduced on all copies. * - * @(#) $Id: unisig_sigmgr_state.c,v 1.2 1998/09/17 09:35:02 phk Exp $ + * @(#) $Id: unisig_sigmgr_state.c,v 1.3 1998/10/31 20:07:01 phk Exp $ * */ @@ -47,7 +47,7 @@ #include <netatm/uni/sscf_uni.h> #ifndef lint -__RCSID("@(#) $Id: unisig_sigmgr_state.c,v 1.2 1998/09/17 09:35:02 phk Exp $"); +__RCSID("@(#) $Id: unisig_sigmgr_state.c,v 1.3 1998/10/31 20:07:01 phk Exp $"); #endif @@ -817,11 +817,6 @@ unisig_sigmgr_act14(usp, m) } /* - * Set the signalling manager state - */ - usp->us_state = UNISIG_DETACH; - - /* * Close the signalling channel */ if (usp->us_conn) { @@ -849,12 +844,14 @@ unisig_sigmgr_act14(usp, m) UNLINK((struct siginst *)usp, struct siginst, smp->sm_prinst, si_next); KM_FREE(usp, sizeof(struct unisig), M_DEVBUF); + } else { + /* + * Otherwise, set new signalling manager state and + * wait for protocol instance to be freed during + * unisig_free processing for the last queued VCC + */ + usp->us_state = UNISIG_DETACH; } - /* - * Otherwise, wait for protocol instance to be freed - * during unisig_free processing for the last queued VCC - */ - return (0); } |