STABLE14-rx-rdwr-writeproc-race-20081228

LICENSE MIT
FIXES 123799

prevent rx_WriteProc() from passing a packet to rxi_PrepareSendPacket()
that has been freed and possibly allocated to another call.

(cherry picked from commit d0cc6eb2f5f0aea0a6ad88de2d847f93d07cc8b9)

diff --git a/src/rx/rx_rdwr.c b/src/rx/rx_rdwr.c
index bcaa11870d5a4d4bde9c61c2b932235c97f0021c..a3542e6028d759a17351579b4295f867c75d6a60 100644 (file)
--- a/src/rx/rx_rdwr.c
+++ b/src/rx/rx_rdwr.c
@@ -690,6 +690,12 @@ rxi_WriteProc(register struct rx_call *call, register char *buf,
     do {
        if (call->nFree == 0) {
            if (!call->error && cp) {
+                /* Clear the current packet now so that if
+                 * we are forced to wait and drop the lock 
+                 * the packet we are planning on using 
+                 * cannot be freed.
+                 */
+               call->currentPacket = (struct rx_packet *)0;
 #ifdef AFS_GLOBAL_RXLOCK_KERNEL
                /* Wait until TQ_BUSY is reset before adding any
                 * packets to the transmit queue
@@ -711,7 +717,7 @@ rxi_WriteProc(register struct rx_call *call, register char *buf,
                hadd32(call->bytesSent, cp->length);
                rxi_PrepareSendPacket(call, cp, 0);
                queue_Append(&call->tq, cp);
-               cp = call->currentPacket = NULL;
+               cp = NULL;
                if (!
                    (call->
                     flags & (RX_CALL_FAST_RECOVER |