Date: Wed, 9 Jun 2010 22:05:29 +0000 (UTC) From: Randall Stewart <rrs@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r208970 - head/sys/netinet Message-ID: <201006092205.o59M5TsI054137@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rrs Date: Wed Jun 9 22:05:29 2010 New Revision: 208970 URL: http://svn.freebsd.org/changeset/base/208970 Log: Found by Michael. In cases where we run out of memory (no more inp space) we don't propely NULL the INP on return. Obtained from: tuexen MFC after: 3 Days Modified: head/sys/netinet/sctp_pcb.c Modified: head/sys/netinet/sctp_pcb.c ============================================================================== --- head/sys/netinet/sctp_pcb.c Wed Jun 9 21:40:38 2010 (r208969) +++ head/sys/netinet/sctp_pcb.c Wed Jun 9 22:05:29 2010 (r208970) @@ -2338,6 +2338,7 @@ sctp_inpcb_alloc(struct socket *so, uint * in protosw */ SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EOPNOTSUPP); + so->so_pcb = NULL; SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp); return (EOPNOTSUPP); } @@ -2356,6 +2357,7 @@ sctp_inpcb_alloc(struct socket *so, uint if (inp->sctp_tcbhash == NULL) { SCTP_PRINTF("Out of SCTP-INPCB->hashinit - no resources\n"); SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS); + so->so_pcb = NULL; SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp); return (ENOBUFS); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201006092205.o59M5TsI054137>