Date: Tue, 17 Mar 2009 10:15:49 +0000 (UTC) From: Robert Watson <rwatson@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org Subject: svn commit: r189920 - in stable/7/sys: . contrib/pf dev/ath/ath_hal dev/cxgb netinet Message-ID: <200903171015.n2HAFnDa092044@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rwatson Date: Tue Mar 17 10:15:49 2009 New Revision: 189920 URL: http://svn.freebsd.org/changeset/base/189920 Log: Merge r188992 from head to stable/7: In tcp_usr_shutdown() and tcp_usr_send(), I missed converting NULL checks for the tcpcb, previously used to detect complete disconnection, with INP_DROPPED checks. Correct that, preventing shutdown() from improperly generating a TCP segment with destination IP and port of 0.0.0.0:0. PR: kern/132050 Reported by: david gueluy <david.gueluy at netasq.com> Modified: stable/7/sys/ (props changed) stable/7/sys/contrib/pf/ (props changed) stable/7/sys/dev/ath/ath_hal/ (props changed) stable/7/sys/dev/cxgb/ (props changed) stable/7/sys/netinet/tcp_usrreq.c Modified: stable/7/sys/netinet/tcp_usrreq.c ============================================================================== --- stable/7/sys/netinet/tcp_usrreq.c Tue Mar 17 09:50:40 2009 (r189919) +++ stable/7/sys/netinet/tcp_usrreq.c Tue Mar 17 10:15:49 2009 (r189920) @@ -712,7 +712,8 @@ tcp_usr_shutdown(struct socket *so) TCPDEBUG1(); socantsendmore(so); tcp_usrclosed(tp); - error = tcp_output_disconnect(tp); + if (!(inp->inp_vflag & INP_DROPPED)) + error = tcp_output_disconnect(tp); out: TCPDEBUG2(PRU_SHUTDOWN); @@ -844,7 +845,7 @@ tcp_usr_send(struct socket *so, int flag INP_INFO_WUNLOCK(&tcbinfo); headlocked = 0; } - if (tp != NULL) { + if (!(inp->inp_vflag & INP_DROPPED)) { if (flags & PRUS_MORETOCOME) tp->t_flags |= TF_MORETOCOME; error = tcp_output_send(tp);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200903171015.n2HAFnDa092044>