Avoid reentrantly sending on the same socket, which causes a kernel panic.

1 files changed, 9 insertions, 0 deletions

diff --git a/sys/netgraph/ng_ksocket.c b/sys/netgraph/ng_ksocket.c
index 31cf0b9..34f2937 100644
--- a/sys/netgraph/ng_ksocket.c
+++ b/sys/netgraph/ng_ksocket.c
@@ -95,6 +95,7 @@ typedef struct ng_ksocket_private *priv_p;
 #define	KSF_EOFSEEN	0x00000004	/* Have sent 0-length EOF mbuf */
 #define	KSF_CLONED	0x00000008	/* Cloned from an accepting socket */
 #define	KSF_EMBRYONIC	0x00000010	/* Cloned node with no hooks yet */
+#define	KSF_SENDING	0x00000020	/* Sending on socket */
 
 /* Netgraph node methods */
 static ng_constructor_t	ng_ksocket_constructor;
@@ -891,6 +892,12 @@ ng_ksocket_rcvdata(hook_p hook, item_p item)
 	int error;
 	struct mbuf *m;
 
+	/* Avoid reentrantly sending on the socket */
+	if ((priv->flags & KSF_SENDING) != 0) {
+		NG_FREE_ITEM(item);
+		return (EDEADLK);
+	}
+
 	/* Extract data and meta information */
 	NGI_GET_M(item, m);
 	NGI_GET_META(item, meta);
@@ -914,7 +921,9 @@ ng_ksocket_rcvdata(hook_p hook, item_p item)
 	}
 
 	/* Send packet */
+	priv->flags |= KSF_SENDING;
 	error = (*so->so_proto->pr_usrreqs->pru_sosend)(so, sa, 0, m, 0, 0, td);
+	priv->flags &= ~KSF_SENDING;
 
 	/* Clean up and exit */
 	NG_FREE_META(meta);