diff options
author | robert <robert@FreeBSD.org> | 2003-07-17 23:49:10 +0000 |
---|---|---|
committer | robert <robert@FreeBSD.org> | 2003-07-17 23:49:10 +0000 |
commit | ab57004058eee4b698f7d9cece99440ad9b49bbb (patch) | |
tree | af5c6b63b4afd1e633ebf9934eefff4ed33989da /usr.bin/top/top.local.1 | |
parent | 242d14a38d959afc315ff9143d62e22fe10d7176 (diff) | |
download | FreeBSD-src-ab57004058eee4b698f7d9cece99440ad9b49bbb.zip FreeBSD-src-ab57004058eee4b698f7d9cece99440ad9b49bbb.tar.gz |
To avoid a kernel panic provoked by a NULL pointer dereference,
do not clear the `sb_sel' member of the sockbuf structure
while invalidating the receive sockbuf in sorflush(), called
from soshutdown().
The panic was reproduceable from user land by attaching a knote
with EVFILT_READ filters to a socket, disabling further reads
from it using shutdown(2), and then closing it. knote_remove()
was called to remove all knotes from the socket file descriptor
by detaching each using its associated filterops' detach call-
back function, sordetach() in this case, which tried to remove
itself from the invalidated sockbuf's klist (sb_sel.si_note).
PR: kern/54331
Diffstat (limited to 'usr.bin/top/top.local.1')
0 files changed, 0 insertions, 0 deletions