From 90f0cef67a39a7de970b0210a839ba9c59ced39b Mon Sep 17 00:00:00 2001
From: Alexander Bluhm <bluhm@cvs.openbsd.org>
Date: Tue, 14 Nov 2017 14:46:50 +0000
Subject: Put the net lock around frag6_freef() as it sends ICMP6 error
 messages.  Splassert was triggered by regress/sys/netinet6/frag6. OK mpi@
 sashan@ visa@

---
 sys/netinet6/frag6.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'sys/netinet6/frag6.c')

diff --git a/sys/netinet6/frag6.c b/sys/netinet6/frag6.c
index c273fa05ca9..7b874e37bab 100644
--- a/sys/netinet6/frag6.c
+++ b/sys/netinet6/frag6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frag6.c,v 1.80 2017/11/13 07:16:35 mpi Exp $	*/
+/*	$OpenBSD: frag6.c,v 1.81 2017/11/14 14:46:49 bluhm Exp $	*/
 /*	$KAME: frag6.c,v 1.40 2002/05/27 21:40:31 itojun Exp $	*/
 
 /*
@@ -593,8 +593,12 @@ frag6_slowtimo(void)
 
 	mtx_leave(&frag6_mutex);
 
-	while ((q6 = TAILQ_FIRST(&rmq6)) != NULL) {
-		TAILQ_REMOVE(&rmq6, q6, ip6q_queue);
-		frag6_freef(q6);
+	if (!TAILQ_EMPTY(&rmq6)) {
+		NET_LOCK();
+		while ((q6 = TAILQ_FIRST(&rmq6)) != NULL) {
+			TAILQ_REMOVE(&rmq6, q6, ip6q_queue);
+			frag6_freef(q6);
+		}
+		NET_UNLOCK();
 	}
 }
-- 
cgit v1.2.3