diff options
| author | dg <dg@FreeBSD.org> | 1996-04-16 03:50:08 +0000 |
|---|---|---|
| committer | dg <dg@FreeBSD.org> | 1996-04-16 03:50:08 +0000 |
| commit | f248f3aa323c33beb54218ef56bc6476bcf9af31 (patch) | |
| tree | 17a7fb2805779040e115b6b9cb685ca1a32d4b49 /sys | |
| parent | fc6f345c4da6a4204d423adf1fcbde431868e30d (diff) | |
| download | FreeBSD-src-f248f3aa323c33beb54218ef56bc6476bcf9af31.zip FreeBSD-src-f248f3aa323c33beb54218ef56bc6476bcf9af31.tar.gz | |
Fix for PR #1146: the "next" pointer must be cached before calling soabort
since the struct containing it may be freed.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/uipc_socket.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 565d3c7..72a4567 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)uipc_socket.c 8.3 (Berkeley) 4/15/94 - * $Id: uipc_socket.c,v 1.15 1996/02/13 18:16:20 wollman Exp $ + * $Id: uipc_socket.c,v 1.16 1996/03/11 15:37:31 davidg Exp $ */ #include <sys/param.h> @@ -177,12 +177,16 @@ soclose(so) int error = 0; if (so->so_options & SO_ACCEPTCONN) { - struct socket *sp; + struct socket *sp, *sonext; - for (sp = so->so_incomp.tqh_first; sp != NULL; sp = sp->so_list.tqe_next) + for (sp = so->so_incomp.tqh_first; sp != NULL; sp = sonext) { + sonext = sp->so_list.tqe_next; (void) soabort(sp); - for (sp = so->so_comp.tqh_first; sp != NULL; sp = sp->so_list.tqe_next) + } + for (sp = so->so_comp.tqh_first; sp != NULL; sp = sonext) { + sonext = sp->so_list.tqe_next; (void) soabort(sp); + } } if (so->so_pcb == 0) goto discard; |
