diff options
| author | tuexen <tuexen@FreeBSD.org> | 2011-10-09 14:12:17 +0000 |
|---|---|---|
| committer | tuexen <tuexen@FreeBSD.org> | 2011-10-09 14:12:17 +0000 |
| commit | 187fe92b28e9f1274f337c7d4597e2934db396d0 (patch) | |
| tree | 38754b42a292a0731560e3eed98ab49b5be6897a /sys/netinet | |
| parent | 71b88d2a56e51eacfbc63fb7b57a29d8f6572ac7 (diff) | |
| download | FreeBSD-src-187fe92b28e9f1274f337c7d4597e2934db396d0.zip FreeBSD-src-187fe92b28e9f1274f337c7d4597e2934db396d0.tar.gz | |
Update the inp stored in a HB-timer when moving an stcb to a new inp.
Use only this stored inp when processing a HB timeout.
This fixes a bug which results in a crash.
MFC after: 3 days.
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/sctp_pcb.c | 1 | ||||
| -rw-r--r-- | sys/netinet/sctputil.c | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c index 9eb9a7d..b04ee93 100644 --- a/sys/netinet/sctp_pcb.c +++ b/sys/netinet/sctp_pcb.c @@ -2804,6 +2804,7 @@ sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp, /* now what about the nets? */ TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) { net->pmtu_timer.ep = (void *)new_inp; + net->hb_timer.ep = (void *)new_inp; net->rxt_timer.ep = (void *)new_inp; } SCTP_INP_WUNLOCK(new_inp); diff --git a/sys/netinet/sctputil.c b/sys/netinet/sctputil.c index 4a16b06..3bd4e6f 100644 --- a/sys/netinet/sctputil.c +++ b/sys/netinet/sctputil.c @@ -1661,7 +1661,7 @@ sctp_timeout_handler(void *t) sctp_auditing(4, inp, stcb, net); #endif if (!(net->dest_state & SCTP_ADDR_NOHB)) { - sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net); + sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net); sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED); } break; |
