cvs commit: src/sys/net netisr.c netisr.h src/sys/netinet ip_demux.c ip_input.c ip_var.h

[Matthew Dillon <dillon@xxxxxxxxxxxxxxxxxxxxxxx>]

dillon      2004/07/18 09:26:44 PDT

DragonFly src repository

  Modified files:
    sys/net              netisr.c netisr.h 
    sys/netinet          ip_demux.c ip_input.c ip_var.h 
  Log:
  Fix two serious bugs in the IP demux code.  First, if ip_mport() m_pullup()'s
  an mbuf, the new/modified mbuf is not returned to the caller and the caller
  may wind up using a stale/freed mbuf.  Second, ip_mport() was not consistently
  freeding mbufs which could lead to both a memory leak and a double free.
  
  Reported-by: YONETANI Tomokazu <qhwt+dragonfly-bugs@xxxxxxxxxx> (panic: TCP header not in one mbuf).
  
  Revision  Changes    Path
  1.21      +2 -2      src/sys/net/netisr.c
  1.20      +2 -2      src/sys/net/netisr.h
  1.25      +70 -22    src/sys/netinet/ip_demux.c
  1.34      +8 -8      src/sys/netinet/ip_input.c
  1.11      +1 -1      src/sys/netinet/ip_var.h


http://www.dragonflybsd.org/cvsweb/src/sys/net/netisr.c.diff?r1=1.20&r2=1.21&f=u
http://www.dragonflybsd.org/cvsweb/src/sys/net/netisr.h.diff?r1=1.19&r2=1.20&f=u
http://www.dragonflybsd.org/cvsweb/src/sys/netinet/ip_demux.c.diff?r1=1.24&r2=1.25&f=u
http://www.dragonflybsd.org/cvsweb/src/sys/netinet/ip_input.c.diff?r1=1.33&r2=1.34&f=u
http://www.dragonflybsd.org/cvsweb/src/sys/netinet/ip_var.h.diff?r1=1.10&r2=1.11&f=u