Date: Tue, 16 Dec 2008 02:06:27 +0000 (UTC) From: Kip Macy <kmacy@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r186157 - head/sys/netinet6 Message-ID: <200812160206.mBG26RCX023301@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kmacy Date: Tue Dec 16 02:06:26 2008 New Revision: 186157 URL: http://svn.freebsd.org/changeset/base/186157 Log: make sure redirect doesn't return without dropping the lock Modified: head/sys/netinet6/icmp6.c Modified: head/sys/netinet6/icmp6.c ============================================================================== --- head/sys/netinet6/icmp6.c Tue Dec 16 02:05:11 2008 (r186156) +++ head/sys/netinet6/icmp6.c Tue Dec 16 02:06:26 2008 (r186157) @@ -2453,6 +2453,7 @@ icmp6_redirect_output(struct mbuf *m0, s struct mbuf *m = NULL; /* newly allocated one */ struct ip6_hdr *ip6; /* m as struct ip6_hdr */ struct nd_redirect *nd_rd; + struct llentry *ln = NULL; size_t maxlen; u_char *p; struct ifnet *outif = NULL; @@ -2575,20 +2576,19 @@ icmp6_redirect_output(struct mbuf *m0, s { /* target lladdr option */ int len; - struct llentry *ln; struct nd_opt_hdr *nd_opt; char *lladdr; IF_AFDATA_LOCK(ifp); ln = nd6_lookup(router_ll6, 0, ifp); IF_AFDATA_UNLOCK(ifp); - if (!ln) + if (ln == NULL) goto nolladdropt; len = sizeof(*nd_opt) + ifp->if_addrlen; len = (len + 7) & ~7; /* round by 8 */ /* safety check */ - if (len + (p - (u_char *)ip6) > maxlen) + if (len + (p - (u_char *)ip6) > maxlen) goto nolladdropt; if (ln->la_flags & LLE_VALID) { @@ -2599,10 +2599,11 @@ icmp6_redirect_output(struct mbuf *m0, s bcopy(&ln->ll_addr, lladdr, ifp->if_addrlen); p += len; } - LLE_RUNLOCK(ln); } -nolladdropt:; - +nolladdropt: + if (ln != NULL) + LLE_RUNLOCK(ln); + m->m_pkthdr.len = m->m_len = p - (u_char *)ip6; /* just to be safe */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200812160206.mBG26RCX023301>