diff options
| author | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2009-01-22 13:51:38 +0000 |
|---|---|---|
| committer | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2009-01-22 13:51:38 +0000 |
| commit | 031496a8211ef4fb3b92d0979061e51305b74c2e (patch) | |
| tree | 4efda87fcb0ddf5f2a024f9aecf0f575833d48f0 /sys | |
| parent | 12a980adbe8fe65dfb70f202f17140db2b9e4e89 (diff) | |
The variable nfs_reqq was protected by splsoftnet() only in 3 out
of 5 cases. In the functions nfs_reconnect() and nfs_reply() put
the TAILQ_FOREACH over nfs_reqq also inside splsoftnet() protection.
found with pedro@, ok blambert@, pedro@, thib@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/nfs/nfs_socket.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/sys/nfs/nfs_socket.c b/sys/nfs/nfs_socket.c index 4056cade7ed..016b8a27a8b 100644 --- a/sys/nfs/nfs_socket.c +++ b/sys/nfs/nfs_socket.c @@ -1,4 +1,4 @@ -/* $OpenBSD: nfs_socket.c,v 1.73 2009/01/20 18:03:33 blambert Exp $ */ +/* $OpenBSD: nfs_socket.c,v 1.74 2009/01/22 13:51:37 bluhm Exp $ */ /* $NetBSD: nfs_socket.c,v 1.27 1996/04/15 20:20:00 thorpej Exp $ */ /* @@ -310,7 +310,7 @@ nfs_reconnect(rep) { struct nfsreq *rp; struct nfsmount *nmp = rep->r_nmp; - int error; + int s, error; nfs_disconnect(nmp); while ((error = nfs_connect(nmp, rep)) != 0) { @@ -323,12 +323,14 @@ nfs_reconnect(rep) * Loop through outstanding request list and fix up all requests * on old socket. */ + s = splsoftnet(); TAILQ_FOREACH(rp, &nfs_reqq, r_chain) { if (rp->r_nmp == nmp) { rp->r_flags |= R_MUSTRESEND; rp->r_rexmit = 0; } } + splx(s); return (0); } @@ -663,7 +665,7 @@ nfs_reply(myrep) struct mbuf *mrep, *nam, *md; u_int32_t rxid, *tl; caddr_t dpos, cp2; - int error; + int s, error; /* * Loop around until we get our own reply @@ -717,6 +719,7 @@ nfsmout: * Loop through the request list to match up the reply * Iff no match, just drop the datagram */ + s = splsoftnet(); TAILQ_FOREACH(rep, &nfs_reqq, r_chain) { if (rep->r_mrep == NULL && rxid == rep->r_xid) { /* Found it.. */ @@ -780,6 +783,7 @@ nfsmout: break; } } + splx(s); /* * If not matched to a request, drop it. * If it's mine, get out. |