From 9f5c0ef09417f4e79eb7c0763979ab938c7259cb Mon Sep 17 00:00:00 2001
From: Grigoriy Orlov <gluk@cvs.openbsd.org>
Date: Sun, 25 Mar 2001 12:03:12 +0000
Subject: Protect KFREES by splnet and rearrange pointers. This fix interrupt
 race between ipllog() and ipflog_read() which caused a memory leak and "Data
 modified on freelist" error.

fgsch@ ok.
---
 sys/netinet/ip_log.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

(limited to 'sys')

diff --git a/sys/netinet/ip_log.c b/sys/netinet/ip_log.c
index a5d696631cb..c9a14531c9e 100644
--- a/sys/netinet/ip_log.c
+++ b/sys/netinet/ip_log.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_log.c,v 1.10 2001/01/30 04:23:56 kjell Exp $	*/
+/*	$OpenBSD: ip_log.c,v 1.11 2001/03/25 12:03:11 gluk Exp $	*/
 
 /*
  * Copyright (C) 1997-2000 by Darren Reed.
@@ -446,22 +446,19 @@ struct uio *uio;
 		/*
 		 * Don't hold the mutex over the uiomove call.
 		 */
-		iplt[unit] = ipl->ipl_next;
-		iplused[unit] -= dlen;
 		MUTEX_EXIT(&ipl_mutex);
 		SPL_X(s);
 		error = UIOMOVE((caddr_t)ipl, dlen, UIO_READ, uio);
 		if (error) {
 			SPL_NET(s);
 			MUTEX_ENTER(&ipl_mutex);
-			ipl->ipl_next = iplt[unit];
-			iplt[unit] = ipl;
-			iplused[unit] += dlen;
 			break;
 		}
-		KFREES((caddr_t)ipl, dlen);
 		SPL_NET(s);
 		MUTEX_ENTER(&ipl_mutex);
+		iplused[unit] -= dlen;
+		iplt[unit] = ipl->ipl_next;
+		KFREES((caddr_t)ipl, dlen);
 	}
 	if (!iplt[unit]) {
 		iplused[unit] = 0;
-- 
cgit v1.2.3