diff options
| author | glebius <glebius@FreeBSD.org> | 2011-10-21 22:28:15 +0000 |
|---|---|---|
| committer | glebius <glebius@FreeBSD.org> | 2011-10-21 22:28:15 +0000 |
| commit | 904eece235fe1a81630554860e6445bee04ab378 (patch) | |
| tree | 41ae08f23f5e7db6a0e8bc902d8c3ad10d1607a5 | |
| parent | 1f39d42bbd7adaf5acaa21507380f702084010d4 (diff) | |
| download | FreeBSD-src-904eece235fe1a81630554860e6445bee04ab378.zip FreeBSD-src-904eece235fe1a81630554860e6445bee04ab378.tar.gz | |
Fix a race: we should update sc_len before dropping the pf lock, otherwise a
number of packets can be queued on sc, while we are in ip_output(), and then
we wipe the accumulated sc_len. On next pfsync_sendout() that would lead to
writing beyond our mbuf cluster.
| -rw-r--r-- | sys/contrib/pf/net/if_pfsync.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/contrib/pf/net/if_pfsync.c b/sys/contrib/pf/net/if_pfsync.c index 8ca7924..4aaca76 100644 --- a/sys/contrib/pf/net/if_pfsync.c +++ b/sys/contrib/pf/net/if_pfsync.c @@ -2354,6 +2354,7 @@ pfsync_sendout(void) sc->sc_if.if_obytes += m->m_pkthdr.len; #endif + sc->sc_len = PFSYNC_MINPKT; #ifdef __FreeBSD__ PF_UNLOCK(); #endif @@ -2375,9 +2376,6 @@ pfsync_sendout(void) #ifdef __FreeBSD__ } #endif - - /* start again */ - sc->sc_len = PFSYNC_MINPKT; } void |
