diff options
| author | rwatson <rwatson@FreeBSD.org> | 2009-02-24 11:17:50 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2009-02-24 11:17:50 +0000 |
| commit | 313ce0df5b13f494f88a3e5511e4f65a3af68d81 (patch) | |
| tree | f83ab659948766f1471f143c4b8c565ea81d749c /sys | |
| parent | 729961165c7ad7b6926ecdcd662955f3f38cd31d (diff) | |
| download | FreeBSD-src-313ce0df5b13f494f88a3e5511e4f65a3af68d81.zip FreeBSD-src-313ce0df5b13f494f88a3e5511e4f65a3af68d81.tar.gz | |
In tcp_usr_shutdown() and tcp_usr_send(), I missed converting NULL
checks for the tcpcb, previously used to detect complete disconnection,
with INP_DROPPED checks. Correct that, preventing shutdown() from
improperly generating a TCP segment with destination IP and port of
0.0.0.0:0.
PR: kern/132050
Reported by: david gueluy <david.gueluy at netasq.com>
MFC after: 3 weeks
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet/tcp_usrreq.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c index 89987c4..05e22be 100644 --- a/sys/netinet/tcp_usrreq.c +++ b/sys/netinet/tcp_usrreq.c @@ -695,7 +695,8 @@ tcp_usr_shutdown(struct socket *so) TCPDEBUG1(); socantsendmore(so); tcp_usrclosed(tp); - error = tcp_output_disconnect(tp); + if (!(inp->inp_vflag & INP_DROPPED)) + error = tcp_output_disconnect(tp); out: TCPDEBUG2(PRU_SHUTDOWN); @@ -828,7 +829,7 @@ tcp_usr_send(struct socket *so, int flags, struct mbuf *m, INP_INFO_WUNLOCK(&V_tcbinfo); headlocked = 0; } - if (tp != NULL) { + if (!(inp->inp_vflag & INP_DROPPED)) { if (flags & PRUS_MORETOCOME) tp->t_flags |= TF_MORETOCOME; error = tcp_output_send(tp); |
