From 031496a8211ef4fb3b92d0979061e51305b74c2e Mon Sep 17 00:00:00 2001 From: Alexander Bluhm Date: Thu, 22 Jan 2009 13:51:38 +0000 Subject: The variable nfs_reqq was protected by splsoftnet() only in 3 out of 5 cases. In the functions nfs_reconnect() and nfs_reply() put the TAILQ_FOREACH over nfs_reqq also inside splsoftnet() protection. found with pedro@, ok blambert@, pedro@, thib@ --- sys/nfs/nfs_socket.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'sys') diff --git a/sys/nfs/nfs_socket.c b/sys/nfs/nfs_socket.c index 4056cade7ed..016b8a27a8b 100644 --- a/sys/nfs/nfs_socket.c +++ b/sys/nfs/nfs_socket.c @@ -1,4 +1,4 @@ -/* $OpenBSD: nfs_socket.c,v 1.73 2009/01/20 18:03:33 blambert Exp $ */ +/* $OpenBSD: nfs_socket.c,v 1.74 2009/01/22 13:51:37 bluhm Exp $ */ /* $NetBSD: nfs_socket.c,v 1.27 1996/04/15 20:20:00 thorpej Exp $ */ /* @@ -310,7 +310,7 @@ nfs_reconnect(rep) { struct nfsreq *rp; struct nfsmount *nmp = rep->r_nmp; - int error; + int s, error; nfs_disconnect(nmp); while ((error = nfs_connect(nmp, rep)) != 0) { @@ -323,12 +323,14 @@ nfs_reconnect(rep) * Loop through outstanding request list and fix up all requests * on old socket. */ + s = splsoftnet(); TAILQ_FOREACH(rp, &nfs_reqq, r_chain) { if (rp->r_nmp == nmp) { rp->r_flags |= R_MUSTRESEND; rp->r_rexmit = 0; } } + splx(s); return (0); } @@ -663,7 +665,7 @@ nfs_reply(myrep) struct mbuf *mrep, *nam, *md; u_int32_t rxid, *tl; caddr_t dpos, cp2; - int error; + int s, error; /* * Loop around until we get our own reply @@ -717,6 +719,7 @@ nfsmout: * Loop through the request list to match up the reply * Iff no match, just drop the datagram */ + s = splsoftnet(); TAILQ_FOREACH(rep, &nfs_reqq, r_chain) { if (rep->r_mrep == NULL && rxid == rep->r_xid) { /* Found it.. */ @@ -780,6 +783,7 @@ nfsmout: break; } } + splx(s); /* * If not matched to a request, drop it. * If it's mine, get out. -- cgit v1.2.3